Block navigations in extensions via ShouldTransferNavigation (not via OpenURL).

chrome/browser/extensions/extension_view_host.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/extensions/extension_view_host.h"
 
 #include "base/macros.h"
 #include "base/strings/string_piece.h"
 #include "chrome/browser/browser_process.h"
 #include "chrome/browser/chrome_notification_types.h"
@@ skipping 147 matching lines @@
       // Only allow these from hosts that are bound to a browser (e.g. popups).
       // Otherwise they are not driven by a user gesture.
       Browser* browser = view_->GetBrowser();
       return browser ? browser->OpenURL(params) : NULL;
     }
     default:
       return NULL;
   }
 }
 
+bool ExtensionViewHost::ShouldTransferNavigation(
+    bool is_main_frame_navigation) {
+  // Block navigations that cause main frame of an extension pop-up (or
+  // background page) to navigate to non-extension content (i.e. to web
+  // content).
+  return !is_main_frame_navigation;
+}
+
 bool ExtensionViewHost::PreHandleKeyboardEvent(
     WebContents* source,
     const NativeWebKeyboardEvent& event,
     bool* is_keyboard_shortcut) {
   if (extension_host_type() == VIEW_TYPE_EXTENSION_POPUP &&
       event.type == NativeWebKeyboardEvent::RawKeyDown &&
       event.windowsKeyCode == ui::VKEY_ESCAPE) {
     DCHECK(is_keyboard_shortcut != NULL);
     *is_keyboard_shortcut = true;
     return false;
@@ skipping 120 matching lines @@
                                 const content::NotificationSource& source,
                                 const content::NotificationDetails& details) {
   DCHECK_EQ(type, extensions::NOTIFICATION_EXTENSION_BACKGROUND_PAGE_READY);
   DCHECK(ExtensionSystem::Get(browser_context())
              ->runtime_data()
              ->IsBackgroundPageReady(extension()));
   LoadInitialURL();
 }
 
 }  // namespace extensions