> What Google needs to do in this case
And presumably also Microsoft, Apple, Mozilla, Opera...
And presumably also Microsoft, Apple, Mozilla, Opera...
It's a bit weird from a security point of view that self-XSS is protected in Firefox & Chrome (https://bugzilla.mozilla.org/show_bug.cgi?id=994134 & https://bugs.chromium.org/p/chromium/issues/detail?id=345205), but navigation data-uris are not.