Fix popunders spawned from a subframe.

content/browser/web_contents/web_contents_impl.cc

Index: content/browser/web_contents/web_contents_impl.cc
diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
index 0d42f075a7b522356aa84b779758582a5532882a..ca275ca7a0ba3519c851da73c7d476a6cab94e4c 100644
--- a/content/browser/web_contents/web_contents_impl.cc
+++ b/content/browser/web_contents/web_contents_impl.cc
@@ -603,7 +603,12 @@ WebContentsImpl* WebContentsImpl::CreateWithOpener(
   FrameTreeNode* new_root = new_contents->GetFrameTree()->root();
 
   if (opener) {
-    new_root->SetOriginalOpener(opener);
+    // For the "original opener", track the opener's main frame instead, because
+    // if the opener is a subframe, the opener tracking could be easily bypassed
+    // by spawning from a subframe and deleting the subframe.
+    // https://crbug.com/705316
+    new_root->SetOriginalOpener(opener->frame_tree()->root());
+
     if (!params.opener_suppressed) {
       new_root->SetOpener(opener);
       new_contents->created_with_opener_ = true;