Don't allow targeted navigations across BrowsingInstances.

content/browser/renderer_host/render_view_host_impl.cc

Index: content/browser/renderer_host/render_view_host_impl.cc
diff --git a/content/browser/renderer_host/render_view_host_impl.cc b/content/browser/renderer_host/render_view_host_impl.cc
index 919aee0e996b8ac5ed85280e1dbd940ca10be62d..5296ddb48df28d872a772990b354d39c05b83826 100644
--- a/content/browser/renderer_host/render_view_host_impl.cc
+++ b/content/browser/renderer_host/render_view_host_impl.cc
@@ -1258,7 +1258,7 @@ void RenderViewHostImpl::OnMsgOpenURL(const GURL& url,
             GetProcess()->GetID(), false, &validated_url);
 
   delegate_->RequestOpenURL(
-      validated_url, referrer, disposition, source_frame_id);
+      this, validated_url, referrer, disposition, source_frame_id);
 }
 
 void RenderViewHostImpl::OnMsgDidContentsPreferredSizeChange(
@@ -1475,6 +1475,8 @@ bool RenderViewHostImpl::IsFullscreen() const {
 }
 
 void RenderViewHostImpl::OnMsgFocus() {
+  // Note: We allow focus and blur from swapped out RenderViewHosts, even when
+  // the active RenderViewHost is in a different BrowsingInstance (e.g., WebUI).
   delegate_->Activate();
 }