The repro code is 

  <meta name="no-referrer">
  <iframe srcdoc="<iframe src=https://shhnjk.com/>" referrerpolicy="no-referrer"></iframe>

...and the Referer is indeed sent on the request for https://shhnjk.com. (Note that the META directive is malformed.)

In contrast, changing the code to specify a refererpolicy on the iframe within the srcdoc:

<iframe srcdoc="<iframe referrerpolicy='no-referrer' src=https://shhnjk.com/>" referrerpolicy="no-referrer"></iframe>

...ensures that the Referer policy is applied.

Similarly, if you fix the malformed META on the outer page:

  <meta name="referrer" content="no-referrer">
  <iframe srcdoc="<iframe src=https://shhnjk.com/>"></iframe>

The request for https://shhnjk.com/ from the srcdoc omits the Referer. 

So I think the only question is whether or not the referrerpolicy on the IFRAME is expected to be applied to content within the srcdoc.

Notably, Firefox 57.0a1 does not apply the RefererPolicy (specified on the outer IFRAME) to the frame in the srcdoc. Unlike Chrome, Firefox also does not apply a META REFERRER policy from the outer page to the srcdoc content.

https://html.spec.whatwg.org/#script-settings-for-window-objects says:

The referrer policy
Let document be the Document with which window is currently associated.

While document is an iframe srcdoc document and document's referrer policy is the empty string, set document to document's browsing context's browsing context container's node document.

Return document's referrer policy.

estark: Assigning to you so that this has an owner. Seems to be a low severity bug though.

the referrerpolicy attribure only controls the referrer used to load the resource of the respective element, however, for an iframe, it does not apply to the iframe's content.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot