The bug
=======
Right click a chrome-extension:// link and select either

1. "Open in a new tab"
2. "Open in a new window"

It opens the extension page.


What should happen
==================
Note that a Ctrl-Click (equivalent to "Open in a new tab") or Ctrl-Shift-Click (equivalent to "Open in a new window") does _not_ open the extension page. They open about:blank. It would be consistent to do the same with the right click menu.


Why this may be a security bug
==============================
Two attack scenarios come to my mind:

1. Opening an extension page might trigger an unwanted action for a user ("CSRF"-style of attack).
2. It is possible to open extension URLs with XSS payloads.

Let's take the Enhanced History Chrome extension for scenario 2 to show this has some real world impact. Note that the vulnerability described in the next paragraph has been reported to the extension already.

Enhanced History for Chrome suffers from an XSS flaw in it's search functionality. An attack would look like this:

chrome-extension://blpnkmdkoapbdhpmemnaikpbhajknmdb/index.html#search/<b>injection</b>

Opening such an URL from a website is not easily possible - except for the two reported methods above. Thus, it enables a simpler way to trigger XSS bugs in some extensions.

Multiple limiting factors to this kind of attack:
1. Extensions have a default CSP that will mitigate most straightforward attacks. Enabling unsecure-eval, AngularJS in other extensions [1] or scriptless attacks can still pose some limited risk.
2. It might require a fair amount of social engineering to make a user right click and open in a new tab. This might be offset by targeting a large enough number of users.

I am not entirely sure the right click "bypass" is a full blown security bug on its own. Thus, I leave this decision to you.


REPRODUCTION
============
Paste the following link into your address bar:

data:text/html,<a href="chrome-extension://ghbmnnjooekpmoecnnnilnnbdlolhkhi/manifest.json">Click here</a>

It assumes the Google Docs Offline extension is installed and enabled. Right clicking and selecting the menu entries will open the link, Ctrl-Click will not.


VERSION
=======
Tested on Chrome Canary 58.0.3013.0 canary (64-bit)


[1] Section 6.2.2 in https://golubovic.net/thesis/master.pdf