Restrict app sandbox's CSP to disallow loading web content in them.

chrome/test/data/extensions/api_test/sandboxed_pages_csp/remote_frame.js

Index: chrome/test/data/extensions/api_test/sandboxed_pages_csp/remote_frame.js
diff --git a/chrome/test/data/extensions/api_test/sandboxed_pages_csp/remote_frame.js b/chrome/test/data/extensions/api_test/sandboxed_pages_csp/remote_frame.js
new file mode 100644
index 0000000000000000000000000000000000000000..35f22fc0dd8406729e2562c9b2358e487c84a8bf
--- /dev/null
+++ b/chrome/test/data/extensions/api_test/sandboxed_pages_csp/remote_frame.js
@@ -0,0 +1,11 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+onmessage = function(e) {
+  var data = JSON.parse(e.data);
+  if (data[0] != 'sandboxed frame msg')
+    return;
+  var param = data[1];
+  e.source.postMessage(JSON.stringify(['remote frame msg', param]), '*');
+};