What steps will reproduce the problem?
(1) Navigate to chrome://settings
(2) document.body.appendChild(document.createElement('iframe'));
(3) document.querySelector('iframe').src = 'chrome://resources/html/cr.html';

What is the expected result?
Renderer kill?

What happens instead?
Browser crashes with a CHECK in NavigatorImpl::CheckWebUIRendererDoesNotDisplayNormalURL. https://crash.corp.google.com/browse?q=reportid=%27ebf0855148780d1e%27


Please use labels and text to provide additional information.

If this is a regression (i.e., worked before), please consider using the
bisect tool (https://www.chromium.org/developers/bisect-builds-py) to help
us identify the root cause and more rapidly triage the issue.

For graphics-related bugs, please copy/paste the contents of the about:gpu
page at the end of this report.