When Chrome hands off a URL to be opened by the external host by the ViewHost...

chrome/renderer/render_view.cc

Index: chrome/renderer/render_view.cc
===================================================================
--- chrome/renderer/render_view.cc	(revision 29317)
+++ chrome/renderer/render_view.cc	(working copy)
@@ -1847,7 +1847,8 @@
     GURL frame_origin = GURL(frame->url()).GetOrigin();
     if (url.GetOrigin() != frame_origin || url.ref().empty()) {
       last_top_level_navigation_page_id_ = page_id_;
-      OpenURL(url, GURL(), default_policy);
+      GURL referrer(request.httpHeaderField(WebString::fromUTF8("Referer")));
+      OpenURL(url, referrer, default_policy);
       return WebKit::WebNavigationPolicyIgnore;  // Suppress the load here.
     }
   }