Disallow navigations to blob URLs with non-canonical origins.

content/browser/child_process_security_policy_impl.cc

Index: content/browser/child_process_security_policy_impl.cc
diff --git a/content/browser/child_process_security_policy_impl.cc b/content/browser/child_process_security_policy_impl.cc
index 901a95eb31c930895f16499515dca744bc39d978..3b5fcfe3cd86998f77081c5efc4024232ae9ab12 100644
--- a/content/browser/child_process_security_policy_impl.cc
+++ b/content/browser/child_process_security_policy_impl.cc
@@ -579,6 +579,14 @@ bool ChildProcessSecurityPolicyImpl::CanRequestURL(
     return false;
   }
 
+  // https://crbug.com/646278 Valid blob URLs should contain canonically
+  // serialized origins.
+  if (url.SchemeIsBlob() &&
+      !base::StartsWith(url.GetContent(), url::Origin(url).Serialize() + "/",
+                        base::CompareCase::INSENSITIVE_ASCII)) {
+    return false;
+  }
+
   // If the process can commit the URL, it can request it.
   if (CanCommitURL(child_id, url))
     return true;