Chrome-side changes to use registerURLSchemeNoAccess.

chrome/renderer/render_thread.cc

Index: chrome/renderer/render_thread.cc
===================================================================
--- chrome/renderer/render_thread.cc	(revision 11496)
+++ chrome/renderer/render_thread.cc	(working copy)
@@ -252,8 +252,14 @@
 
   webkit_client_.reset(new RendererWebKitClientImpl);
   WebKit::initialize(webkit_client_.get());
-  WebKit::registerURLSchemeAsLocal(ASCIIToUTF16(chrome::kChromeUIScheme));
 
+  // chrome-ui pages should not be accessible by normal content, and should
+  // also be unable to script anything but themselves (to help limit the damage
+  // that a corrupt chrome-ui page could cause).
+  WebKit::WebString chrome_ui_scheme(ASCIIToUTF16(chrome::kChromeUIScheme));
+  WebKit::registerURLSchemeAsLocal(chrome_ui_scheme);
+  WebKit::registerURLSchemeAsNoAccess(chrome_ui_scheme);
+
   WebKit::registerExtension(extensions_v8::GearsExtension::Get());
   WebKit::registerExtension(extensions_v8::IntervalExtension::Get());