<iframe sandbox> should inherit through <a target='_blank'>.

Source/core/frame/Frame.cpp

 /*
  * Copyright (C) 1998, 1999 Torben Weis <weis@kde.org>
  *                     1999 Lars Knoll <knoll@kde.org>
  *                     1999 Antti Koivisto <koivisto@kde.org>
  *                     2000 Simon Hausmann <hausmann@kde.org>
  *                     2000 Stefan Schimanski <1Stein@gmx.de>
  *                     2001 George Staikos <staikos@kde.org>
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2005 Alexey Proskuryakov <ap@nypop.com>
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
@@ skipping 142 matching lines @@
 {
     WindowProxyManager* oldManager = old->windowProxyManager();
     // FIXME: In the future, the Blink API layer will be calling detach() on the
     // old frame prior to completing the swap. However, detach calls
     // clearForClose() instead of clearForNavigation(). Make sure this doesn't
     // become a no-op when that lands, since it's important to detach the global.
     oldManager->clearForNavigation();
     windowProxyManager()->takeGlobalFrom(oldManager);
 }
 
 Frame* Frame::findFrameForNavigation(const AtomicString& name, Frame& activeFrame)

[Nate Chapin, 2015/03/04 17:44:55]

This unconditionally returns the result of tree().find() now. Remove this and
call find() directly?

 {
     Frame* frame = tree().find(name);
-    if (!frame || !activeFrame.canNavigate(*frame))
+    if (!frame)
         return nullptr;
     return frame;
 }
 
 static bool canAccessAncestor(const SecurityOrigin& activeSecurityOrigin, const Frame* targetFrame)
 {
     // targetFrame can be 0 when we're trying to navigate a top-level frame
     // that has a 0 opener.
     if (!targetFrame)
         return false;
@@ skipping 119 matching lines @@
 
     if (m_owner) {
         if (m_owner->isLocal())
             toHTMLFrameOwnerElement(m_owner)->setContentFrame(*this);
     } else {
         page()->setMainFrame(this);
     }
 }
 
 } // namespace blink