<iframe sandbox> should inherit through <a target='_blank'>.

Source/core/loader/FrameLoader.cpp

Index: Source/core/loader/FrameLoader.cpp
diff --git a/Source/core/loader/FrameLoader.cpp b/Source/core/loader/FrameLoader.cpp
index 65497cf1c2506e975077e69f485e77df01637399..42bc6689e00a067504d0da66eb9374f1d9275b1d 100644
--- a/Source/core/loader/FrameLoader.cpp
+++ b/Source/core/loader/FrameLoader.cpp
@@ -768,6 +768,8 @@ void FrameLoader::load(const FrameLoadRequest& passedRequest)
         return;
 
     RefPtrWillBeRawPtr<LocalFrame> targetFrame = toLocalFrame(request.formState() ? nullptr : m_frame->findFrameForNavigation(AtomicString(request.frameName()), *m_frame));
+    if (targetFrame && !m_frame->canNavigate(*targetFrame))
+        return;
     if (targetFrame && targetFrame.get() != m_frame) {
         request.setFrameName("_self");
         targetFrame->loader().load(request);