'data:' may not be used as a document's base URL.

third_party/WebKit/Source/core/dom/Document.cpp

Index: third_party/WebKit/Source/core/dom/Document.cpp
diff --git a/third_party/WebKit/Source/core/dom/Document.cpp b/third_party/WebKit/Source/core/dom/Document.cpp
index cc8eabdcd805decf74ec1cb685438bd916a27082..03a65cf6a6ec13f79de3710a15377b2db0ef2274 100644
--- a/third_party/WebKit/Source/core/dom/Document.cpp
+++ b/third_party/WebKit/Source/core/dom/Document.cpp
@@ -3325,13 +3325,17 @@ void Document::processBaseElement() {
   }
 
   if (!baseElementURL.isEmpty()) {
-    if (baseElementURL.protocolIsData())
+    if (baseElementURL.protocolIsData()) {
       UseCounter::count(*this, UseCounter::BaseWithDataHref);
+      addConsoleMessage(ConsoleMessage::create(
+          SecurityMessageSource, ErrorMessageLevel,
+          "'data:' URLs may not be used as base URLs for a document."));
+    }
     if (!this->getSecurityOrigin()->canRequest(baseElementURL))
       UseCounter::count(*this, UseCounter::BaseWithCrossOriginHref);
   }
 
-  if (m_baseElementURL != baseElementURL &&
+  if (baseElementURL != m_baseElementURL && !baseElementURL.protocolIsData() &&
       contentSecurityPolicy()->allowBaseURI(baseElementURL)) {
     m_baseElementURL = baseElementURL;
     updateBaseURL();