<iframe sandbox> should inherit through <a target='_blank'>.

Source/core/html/HTMLFormElement.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *           (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 423 matching lines @@
     }
 
     Frame* targetFrame = document().frame()->findFrameForNavigation(submission->target(), *submission->state()->sourceDocument()->frame());
     if (!targetFrame) {
         if (!LocalDOMWindow::allowPopUp(*document().frame()) && !UserGestureIndicator::processingUserGesture())
             return;
         targetFrame = document().frame();
     } else {
         submission->clearTarget();
     }
+    if (!submission->state()->sourceDocument()->frame()->canNavigate(*targetFrame))
+        return;
     if (!targetFrame->host())
         return;
 
     UseCounter::count(document(), UseCounter::FormsSubmitted);
     if (MixedContentChecker::isMixedFormAction(document().frame(), submission->action()))
         UseCounter::count(document().frame(), UseCounter::MixedContentFormsSubmitted);
 
     // FIXME: Plumb form submission for remote frames.
     if (targetFrame->isLocalFrame())
         toLocalFrame(targetFrame)->navigationScheduler().scheduleFormSubmission(submission);
@@ skipping 394 matching lines @@
 }
 
 void HTMLFormElement::setDemoted(bool demoted)
 {
     if (demoted)
         UseCounter::count(document(), UseCounter::DemotedFormElement);
     m_wasDemoted = demoted;
 }
 
 } // namespace