<iframe sandbox> should inherit through <a target='_blank'>.

Source/core/frame/Frame.cpp

Index: Source/core/frame/Frame.cpp
diff --git a/Source/core/frame/Frame.cpp b/Source/core/frame/Frame.cpp
index 7194c8d8a7e560b002a84ca525112642ccfb2aa1..da10a9311e270162a9e519d8ba9a07809515d616 100644
--- a/Source/core/frame/Frame.cpp
+++ b/Source/core/frame/Frame.cpp
@@ -163,7 +163,7 @@ void Frame::finishSwapFrom(Frame* old)
 Frame* Frame::findFrameForNavigation(const AtomicString& name, Frame& activeFrame)

[Nate Chapin, 2015/03/04 17:44:55]

This unconditionally returns the result of tree().find() now. Remove this and
call find() directly?

 {
     Frame* frame = tree().find(name);
-    if (!frame || !activeFrame.canNavigate(*frame))
+    if (!frame)
         return nullptr;
     return frame;
 }