<iframe sandbox> should inherit through <a target='_blank'>.

Source/core/page/CreateWindow.cpp

Index: Source/core/page/CreateWindow.cpp
diff --git a/Source/core/page/CreateWindow.cpp b/Source/core/page/CreateWindow.cpp
index 843fc437528b1b72bedde92699a56b613192e641..b3b2cdd598b3e961346b978b369e6f926e1bf575 100644
--- a/Source/core/page/CreateWindow.cpp
+++ b/Source/core/page/CreateWindow.cpp
@@ -118,6 +118,8 @@ static LocalFrame* createWindow(LocalFrame& openerFrame, LocalFrame& lookupFrame
     host->chrome().setWindowRect(newWindowRect);
     host->chrome().show(policy);
 
+    frame.loader().forceSandboxFlags(openerFrame.document()->sandboxFlags());
+
     created = true;
     return &frame;
 }
@@ -151,9 +153,6 @@ LocalFrame* createWindow(const String& urlString, const AtomicString& frameName,
     if (!newFrame)
         return nullptr;
 
-    if (newFrame != &openerFrame && newFrame != openerFrame.tree().top())
-        newFrame->loader().forceSandboxFlags(openerFrame.document()->sandboxFlags());
-
     newFrame->loader().setOpener(&openerFrame);
 
     if (newFrame->localDOMWindow()->isInsecureScriptAccess(callingWindow, completedURL))