Repro instructions:

1. Add the following browsertest to the bottom of chrome/browser/extensions/process_management_browsertest.cc:

IN_PROC_BROWSER_TEST_F(ProcessManagementTest,
                       WebAccessibleResourcesVersusServerRedirect) {
  ASSERT_TRUE(embedded_test_server()->Start());

  WebContents* web_contents =
      browser()->tab_strip_model()->GetActiveWebContents();

  // Any valid extension that happens to have a web accessible resource.
  const extensions::Extension* patsy =
      LoadExtension(test_data_dir_.AppendASCII("subscribe_page_action"));

  // An extension with a non-webaccessible resource.
  const extensions::Extension* target =
      LoadExtension(test_data_dir_.AppendASCII("simple_with_file"));

  // Start with an iframe.
  ui_test_utils::NavigateToURL(browser(),
                               embedded_test_server()->GetURL("/iframe.html"));

  // Send it to a web accessible resource of any extension.
  GURL patsy_url = patsy->GetResourceURL("style.css");
  content::NavigateIframeToURL(web_contents, "test", patsy_url);

  // Now send it to a NON-webaccessible resource of any other extension, via
  // http redirect.
  GURL target_url = target->GetResourceURL("file.html");
  GURL http_redirect_to_target_url = embedded_test_server()->GetURL(
      "evil.com", "/server-redirect?" + target_url.spec());
  content::NavigateIframeToURL(web_contents, "test",
                               http_redirect_to_target_url);

  // That should not have been allowed.
  EXPECT_NE(url::Origin(target_url).GetURL(),
            ChildFrameAt(web_contents->GetMainFrame(), 0)
                ->GetLastCommittedOrigin()
                .GetURL());
}

2. Run it with --enable-browser-side-navigation.

3. This should be blocked by the web_accessible_resources policy, but it is allowed.