DragEnter grants both read and navigate permissions to files.

content/browser/renderer_host/render_view_host_impl.cc

Index: content/browser/renderer_host/render_view_host_impl.cc
===================================================================
--- content/browser/renderer_host/render_view_host_impl.cc	(revision 136090)
+++ content/browser/renderer_host/render_view_host_impl.cc	(working copy)
@@ -577,13 +577,12 @@
   FilterURL(policy, renderer_id, true, &filtered_data.url);
 
   // The filenames vector, on the other hand, does represent a capability to
-  // access the given files.
+  // read the given files (but not to navigate to any file:// scheme URL),
   std::set<FilePath> filesets;
   for (std::vector<WebDropData::FileInfo>::const_iterator iter(
            filtered_data.filenames.begin());
        iter != filtered_data.filenames.end(); ++iter) {
     FilePath path = FilePath::FromUTF8Unsafe(UTF16ToUTF8(iter->path));
-    policy->GrantRequestURL(renderer_id, net::FilePathToFileURL(path));
 
     // If the renderer already has permission to read these paths, we don't need
     // to re-grant them. This prevents problems with DnD for files in the CrOS