When we used window.open(), we ran into issues with Chrome's popup blocker. I think it's because we create the popup in an ajax callback. We'll take another look; there might be a workaround for us.

I just noticed that chrome.tabs.create doesn't require the 'tabs' permission, so that might be another option. Thanks for the help. We'll try to remove the permission in the next release. :)