← Back to release summary

Remove: Content initiated top frame navigations to data URLs

Category
Security
Type
New or changed feature
Status
Removed (Chrome 60)
Intent stage
None

Summary

We intend to block web pages from loading data: URLs in the top frame using <A> tags, window.open, window.location and similar mechanisms. Pseudo URLs such as data: are generally a source of confusion for users. Because of their unfamiliarity, these schemes are widely being used in spoofing and phishing attacks. Users browsing the web ideally should only ever end up on the two well known schemes (http and https). Deprecated in M58 Removal in M60

Standards & signals

Docs: https://bugs.chromium.org/p/chromium/issues/detail?id=594215

View on chromestatus.com