Allow creating HTML notifications with the data: scheme. I've confirmed this...

chrome/renderer/notification_provider.cc

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/renderer/notification_provider.h"
 
 #include "base/string_util.h"
 #include "base/task.h"
 #include "chrome/common/render_messages.h"
 #include "chrome/common/url_constants.h"
@@ skipping 77 matching lines @@
   IPC_END_MESSAGE_MAP()
   return handled;
 }
 
 void NotificationProvider::OnNavigate() {
   manager_.Clear();
 }
 
 bool NotificationProvider::ShowHTML(const WebNotification& notification,
                                     int id) {
-  // Disallow HTML notifications from non-HTTP schemes.
+  // Disallow HTML notifications from unwanted schemes.  javascript:
+  // in particular allows unwanted cross-domain access.
   GURL url = notification.url();
   if (!url.SchemeIs(chrome::kHttpScheme) &&
       !url.SchemeIs(chrome::kHttpsScheme) &&
-      !url.SchemeIs(chrome::kExtensionScheme))
+      !url.SchemeIs(chrome::kExtensionScheme) &&
+      !url.SchemeIs(chrome::kDataScheme))
     return false;
 
   DCHECK(notification.isHTML());
   return Send(new ViewHostMsg_ShowDesktopNotification(view_->routing_id(),
               GURL(view_->webview()->mainFrame()->url()).GetOrigin(),
               notification.url(), id));
 }
 
 bool NotificationProvider::ShowText(const WebNotification& notification,
                                     int id) {
@@ skipping 36 matching lines @@
 void NotificationProvider::OnPermissionRequestComplete(int id) {
   WebNotificationPermissionCallback* callback = manager_.GetCallback(id);
   DCHECK(callback);
   callback->permissionRequestComplete();
   manager_.OnPermissionRequestComplete(id);
 }
 
 bool NotificationProvider::Send(IPC::Message* message) {
   return RenderThread::current()->Send(message);
 }