Unsandboxed popups may also be navigated.

third_party/WebKit/Source/core/frame/Frame.cpp

 /*
  * Copyright (C) 1998, 1999 Torben Weis <weis@kde.org>
  *                     1999 Lars Knoll <knoll@kde.org>
  *                     1999 Antti Koivisto <koivisto@kde.org>
  *                     2000 Simon Hausmann <hausmann@kde.org>
  *                     2000 Stefan Schimanski <1Stein@gmx.de>
  *                     2001 George Staikos <staikos@kde.org>
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2005 Alexey Proskuryakov <ap@nypop.com>
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
@@ skipping 186 matching lines @@
     return false;
 }
 
 bool Frame::canNavigate(const Frame& targetFrame)
 {
     // Frame-busting is generally allowed, but blocked for sandboxed frames lacking the 'allow-top-navigation' flag.
     if (!securityContext()->isSandboxed(SandboxTopNavigation) && targetFrame == tree().top())
         return true;
 
     if (securityContext()->isSandboxed(SandboxNavigation)) {
+        // Sandboxed frames can navigate their own children.
         if (targetFrame.tree().isDescendantOf(this))
             return true;
 
+        // They can also navigate popups, if the 'allow-sandbox-escape-via-popup' flag is specified.
+        if (targetFrame == targetFrame.tree().top() && targetFrame.tree().top() != tree().top() && !securityContext()->isSandboxed(SandboxPropagatesToAuxiliaryBrowsingContexts))
+            return true;
+
+        // Otherwise, block the navigation.
         const char* reason = "The frame attempting navigation is sandboxed, and is therefore disallowed from navigating its ancestors.";
         if (securityContext()->isSandboxed(SandboxTopNavigation) && targetFrame == tree().top())
             reason = "The frame attempting navigation of the top-level window is sandboxed, but the 'allow-top-navigation' flag is not set.";
 
         printNavigationErrorMessage(targetFrame, reason);
         return false;
     }
 
     ASSERT(securityContext()->securityOrigin());
     SecurityOrigin& origin = *securityContext()->securityOrigin();
@@ skipping 85 matching lines @@
 
     if (m_owner) {
         if (m_owner->isLocal())
             toHTMLFrameOwnerElement(m_owner)->setContentFrame(*this);
     } else {
         page()->setMainFrame(this);
     }
 }
 
 } // namespace blink