Hi, thanks for the report. Could you clarify what the bug is here? In particular it's not clear how data: URLs can be used for XSS. If you could give a full proof of concept that demonstrates this, that would be great. 

Thanks!

As indicated in http://klevjers.com/papers/phishing.pdf, the data URI scheme can be exploited to host fully functional web pages, such as for login and handling private data. The entire web page's contents is hosted inside the data:URI, rather than at a location, 
allowing the "phisher" to evade the issue of compromising a server.


In my opinion, it is dangerous to allow Chrome to host web pages: The URIs can be of arbitrary length, following an arbitrary amount of data.
Controls should be put in place to prevent this.

I have already attached test-case above for your reference.  

Refre: http://en.wikipedia.org/wiki/Data_URI_scheme#Disadvantages 

The proposed change is a breaking change to the web platform, and this should almost certainly be deemed WontFix, Working as Intended. If we had reason to believe that this was a broadly misused feature, we would need a use counter before considering deprecation.

 Issue 594215  concerns blocking top-level navigations to such URIs for anti-spoofing reasons.

Thanks for the report, but marking WontFix per elawrence@'s comment.