Don't allow sending data URLs to WebUI, unless in a ChromeOS BalloonHost.

chrome/browser/notifications/balloon_host.h

Index: chrome/browser/notifications/balloon_host.h
diff --git a/chrome/browser/notifications/balloon_host.h b/chrome/browser/notifications/balloon_host.h
index 00b1565da127435541556eeeb1e9f8b14f897d3b..4fbb1707edc4a415d463da78068a3236aca727b4 100644
--- a/chrome/browser/notifications/balloon_host.h
+++ b/chrome/browser/notifications/balloon_host.h
@@ -50,6 +50,9 @@ class BalloonHost : public content::WebContentsDelegate,
   // Returns whether the associated render view is ready. Used only for testing.
   bool IsRenderViewReady() const;
 
+  // content::WebContentsDelegate implementation:
+  virtual bool CanLoadDataURLsInWebUI() const OVERRIDE;
+
  protected:
   virtual ~BalloonHost();