We would like to disallow network subresource requests from WebUI. "WebUI pages should use <webview> instead so that network access is isolated to less privileged renderers".
There might be a simpler solution for favicons than <webview> though.
Is chrome://discards doing network requests only to fetch favicons? If so favicons are normally exposed to WebUI pages via chrome://favicon/ (which is backed up by the FaviconService).
All additions to the whitelist are temporary, per the comment above the
whitelist. Though of course if it's easy enough to fix this now, that would
be preferable.
Comment 1 by dpa...@chromium.org
, Apr 26 2018