diff --git content/browser/renderer_host/render_frame_host_impl.cc content/browser/renderer_host/render_frame_host_impl.cc index d29dac8938055..c2bbba0d6c2ab 100644 --- content/browser/renderer_host/render_frame_host_impl.cc +++ content/browser/renderer_host/render_frame_host_impl.cc @@ -9180,6 +9180,16 @@ void RenderFrameHostImpl::CreateNewWindow( return; } + callback = base::BindOnce( + [](RenderFrameHostImpl* self, + CreateNewWindowCallback callback, + mojom::CreateNewWindowStatus status, + mojom::CreateNewWindowReplyPtr reply) { + GetContentClient()->browser()->CreateWindowResult( + self, status == mojom::CreateNewWindowStatus::kSuccess); + std::move(callback).Run(status, std::move(reply)); + }, base::Unretained(this), std::move(callback)); + // Otherwise, consume user activation before we proceed. In particular, it is // important to do this before we return from the |opener_suppressed| case // below. @@ -11558,6 +11568,7 @@ void RenderFrameHostImpl::CommitNavigation( auto browser_calc_origin_to_commit = navigation_request->GetOriginToCommitWithDebugInfo(); if (!process_lock.is_error_page() && !is_mhtml_subframe && + common_params->url.IsStandard() && !policy->CanAccessOrigin( GetProcess()->GetID(), browser_calc_origin_to_commit.first.value(), ChildProcessSecurityPolicyImpl::AccessType::kCanCommitNewOrigin)) {