Today, we use GrantScheme() so things like WebUI have access to request subresources from chrome://.

However, granting access to a scheme for a child process means that CanRequestURL and CanCommitURL will both start returning true for any URL with that scheme. This is somewhat problematic: different WebUI pages are supposed to be isolated, so a renderer that's committed chrome://settings shouldn't be able to commit chrome://downloads as well. We do prevent this from happening at a higher layer (SiteInstanceImpl::IsSameWebSite classifies chrome://settings and chrome://downloads as different sites)...

... however, filesystem checks are gated based on CanCommitURL checks. So if a child process that's granted the chrome:// scheme is compromised, it can now create filesystem URLs that belong to the origin of another chrome:// pages, bypassing this protection.