<iframe sandbox> should inherit through <a target='_blank'>.

Source/core/page/CreateWindow.cpp

Index: Source/core/page/CreateWindow.cpp
diff --git a/Source/core/page/CreateWindow.cpp b/Source/core/page/CreateWindow.cpp
index 843fc437528b1b72bedde92699a56b613192e641..5dd75e8b78f87c30e34ae87401e8fd3127b20c7a 100644
--- a/Source/core/page/CreateWindow.cpp
+++ b/Source/core/page/CreateWindow.cpp
@@ -51,6 +51,10 @@ static LocalFrame* createWindow(LocalFrame& openerFrame, LocalFrame& lookupFrame
 
     if (!request.frameName().isEmpty() && request.frameName() != "_blank" && policy == NavigationPolicyIgnore) {
         if (Frame* frame = lookupFrame.findFrameForNavigation(request.frameName(), openerFrame)) {
+            if (!openerFrame.canNavigate(*frame)) {
+                created = false;
+                return nullptr;
+            }
             if (request.frameName() != "_self") {
                 if (FrameHost* host = frame->host()) {
                     if (host == openerFrame.host())
@@ -119,6 +123,9 @@ static LocalFrame* createWindow(LocalFrame& openerFrame, LocalFrame& lookupFrame
     host->chrome().show(policy);
 
     created = true;
+
+    frame.loader().forceSandboxFlags(openerFrame.document()->sandboxFlags());
+
     return &frame;
 }
 
@@ -151,9 +158,6 @@ LocalFrame* createWindow(const String& urlString, const AtomicString& frameName,
     if (!newFrame)
         return nullptr;
 
-    if (newFrame != &openerFrame && newFrame != openerFrame.tree().top())
-        newFrame->loader().forceSandboxFlags(openerFrame.document()->sandboxFlags());
-
     newFrame->loader().setOpener(&openerFrame);
 
     if (newFrame->localDOMWindow()->isInsecureScriptAccess(callingWindow, completedURL))
@@ -189,6 +193,7 @@ void createWindowForRequest(const FrameLoadRequest& request, LocalFrame& openerF
         newFrame->loader().setOpener(&openerFrame);
         newFrame->document()->setReferrerPolicy(openerFrame.document()->referrerPolicy());
     }
+
     FrameLoadRequest newRequest(0, request.resourceRequest());
     newRequest.setFormState(request.formState());
     newFrame->loader().load(newRequest);