Don't propagate sandbox flags to an opened window unless triggered entirely by script.

Source/core/page/CreateWindow.cpp

Index: Source/core/page/CreateWindow.cpp
diff --git a/Source/core/page/CreateWindow.cpp b/Source/core/page/CreateWindow.cpp
index 9c2adf361bc9891dae8cc126686e181fe0a85ee3..4eb99754adb375fdef70fe78b72dae905084ecaa 100644
--- a/Source/core/page/CreateWindow.cpp
+++ b/Source/core/page/CreateWindow.cpp
@@ -81,8 +81,6 @@ static LocalFrame* createWindow(LocalFrame& openerFrame, LocalFrame& lookupFrame
     ASSERT(page->mainFrame());
     LocalFrame& frame = *page->mainFrame();
 
-    frame.loader().forceSandboxFlags(openerFrame.document()->sandboxFlags());
-
     if (request.frameName() != "_blank")
         frame.tree().setName(request.frameName());
 
@@ -141,6 +139,9 @@ LocalFrame* createWindow(const String& urlString, const AtomicString& frameName,
     if (!newFrame)
         return 0;
 
+    if (newFrame != &openerFrame && newFrame != openerFrame.tree().top())
+        newFrame->loader().forceSandboxFlags(openerFrame.document()->sandboxFlags());
+
     newFrame->loader().setOpener(&openerFrame);
     newFrame->page()->setOpenedByDOM();