Suggestion from a reply to my bug report (filed under security so it's non-public) points to a dupe of:

https://code.google.com/p/chromium/issues/detail?id=472899

and fixed in:

https://chromium.googlesource.com/chromium/src/+/5922e15ca3d...

FWIW