Summary

The "one permitted sandboxed navigator" is only set in the "Otherwise" (noopener=false) branch of the rules for choosing a navigable (step 8.2). However, since PR #4330 (2019), target="_blank" implies noopener=true, so step 7 is always taken and step 8.2 never runs.

This means sandboxed iframes with allow-popups that use target="_blank" links can create a new tab but cannot navigate it to the target URL — the sandbox check in allowed by sandboxing to navigate fails because the one permitted sandboxed navigator was never set.

Steps to reproduce

<iframe sandbox="allow-popups allow-popups-to-escape-sandbox allow-same-origin allow-scripts"
        srcdoc='<a href="https://example.com" target="_blank">Click me</a>'>
</iframe>

Clicking the link should open a new tab navigated to example.com. In a spec-literal implementation, the new tab opens but stays at about:blank because:

1. target="_blank" sets noopener=true (per PR Make target=_blank imply noopener; support opener #4330)
2. Step 7 runs (noopener=true branch) — new traversable created
3. Step 8 (Otherwise) is skipped — one permitted sandboxed navigator is never set
4. navigate() calls "allowed by sandboxing to navigate" which checks if source is the one permitted sandboxed navigator of target (step 4.1) — it's not set, so falls through
5. Step 4.2 sees SandboxedNavigation flag is set → returns false → navigation blocked

How Firefox handles this

Firefox sets the one permitted sandboxed navigator unconditionally, before the noopener check, in nsWindowWatcher.cpp:

// If our parent is sandboxed, set it as the one permitted sandboxed navigator
// on the new window we're opening.
if (activeDocsSandboxFlags && parentBC) {
    MOZ_ALWAYS_SUCCEEDS(targetBC->SetOnePermittedSandboxedNavigator(parentBC));
}

if (!aForceNoOpener && parentBC) {
    // ... opener handling

Proposed fix

Move step 8.2 ("If sandboxingFlagSet's sandboxed navigation browsing context flag is set, then set chosen's active browsing context's one permitted sandboxed navigator...") out of the "Otherwise" block so it runs regardless of noopener, alongside the existing step 9 (sandbox propagates to auxiliary browsing contexts) which is already correctly outside both branches.

History

• 2016: PR #1774 / Issue #1218 fixed the one permitted sandboxed navigator to be set for all sandbox-created popups
• 2019: PR #4330 made target="_blank" imply noopener, inadvertently moving all target="_blank" traffic to the noopener=true branch where step 8.2 doesn't run

Found while fixing this in Ladybird.