What steps will reproduce the problem?
(1) With --site-per-process, go to http://csreis.github.io/tests/cross-site-iframe.html
(2) From DevTools:
  document.querySelector("iframe").sandbox="allow-scripts allow-popups"
(3) Click "Go same-site" so the sandbox flags take effect.
(4) In DevTools, switch to subframe context and execute
  var w = window.open("https://csreis.github.io")
(5) Check that document.origin in the new window is "null", as it should be, since it inherited the iframe's sandbox flags and preserved them across the cross-process navigation.
(6) Back in first tab, again from subframe context, execute
  w.location="http://csreis.github.io"
(7) Recheck the document.origin in the new window.  It's now "http://csreis.github.io", because we've lost the sandbox flags during the remote-to-local navigation.

This is because for remote-to-local transitions, WebLocalFrameImpl::CreateProvisional sets the sandbox flags only for subframes, when there's an owner present.  I think it also should force the sandbox flags for main frames, just like CreateMainFrame does it via ForceSandboxFlags for cases where the main frame is created along with the RenderView.  I've got a fix in progress.