New WebContents created via ctrl-click should be in a new process.

content/browser/frame_host/navigator_impl.cc

Index: content/browser/frame_host/navigator_impl.cc
diff --git a/content/browser/frame_host/navigator_impl.cc b/content/browser/frame_host/navigator_impl.cc
index 0c34b760f629ae56c9c4c8fa0b69852949bee897..cb772fcdf89f3ef4b32c733dcce8c9af173d1122 100644
--- a/content/browser/frame_host/navigator_impl.cc
+++ b/content/browser/frame_host/navigator_impl.cc
@@ -771,12 +771,6 @@ void NavigatorImpl::RequestOpenURL(
   params.should_replace_current_entry = should_replace_current_entry;
   params.user_gesture = user_gesture;
 
-  // RequestOpenURL is used only for local frames, so we can get here only if
-  // the navigation is initiated by a frame in the same SiteInstance as this
-  // frame.  Note that navigations on RenderFrameProxies do not use
-  // RequestOpenURL and go through RequestTransferURL instead.
-  params.source_site_instance = current_site_instance;

[Łukasz Anforowicz, 2017/02/09 16:53:01]

My initial fix was to never use params.source_site_instance in
CreateTargetContents in chrome/browser/ui/browser_navigator.cc, but this went
too far and broke hangouts when --isolate-extensions flag is present.

[alexmos, 2017/02/09 22:58:36]

Acknowledged.

-
   if (render_frame_host->web_ui()) {
     // Note that we hide the referrer for Web UI pages. We don't really want
     // web sites to see a referrer of "chrome://blah" (and some chrome: URLs