Don't allow sending data URLs to WebUI, unless in a ChromeOS BalloonHost.

chrome/browser/notifications/balloon_host.cc

Index: chrome/browser/notifications/balloon_host.cc
diff --git a/chrome/browser/notifications/balloon_host.cc b/chrome/browser/notifications/balloon_host.cc
index 05d7301cfbf66ea73dbc2424069192841efa09ff..9c81d20ac1c673c63f15a1718100c1867e45d8b8 100644
--- a/chrome/browser/notifications/balloon_host.cc
+++ b/chrome/browser/notifications/balloon_host.cc
@@ -166,3 +166,14 @@ void BalloonHost::NotifyDisconnect() {
 bool BalloonHost::IsRenderViewReady() const {
   return should_notify_on_disconnect_;
 }
+
+bool BalloonHost::CanLoadDataURLsInWebUI() const {
+#if defined(OS_CHROMEOS)
+  // Chrome OS uses data URLs in WebUI BalloonHosts.  We normally do not allow
+  // data URLs in WebUI renderers, but normal pages cannot target BalloonHosts,
+  // so this should be safe.
+  return true;
+#else
+  return false;
+#endif
+}