For trusted and certified apps, by default links pointing outside of the app:// scheme in the top window should not navigate the window. They can open the link in a separate window, fire an event the app can handle, or something else (I don't really care what). But since many device will not have the concept of a "back" button, clicking on such a link will result in the user being stuck outside the app with no way of getting back in. It could be possible for an app to define a whitelist of (cooperating) domains that navigation could be permitted to, assuming that content on those domains provides a clear way to return back into the app. That content would still not get app privileges, its just for window navigation. This may be an unnecessary complication though. Ideally we'd have a similar restriction for web installed apps, except I don't think we can clearly delineate the boundaries of a apps that don't rely on the app:// scheme.

Leaving nominated - bringing up in product/UX circles.

Can you provide some use cases? Is there prior art we can look to? Is this related at all to our window.open policies. Am trying to wrap my head around the problem.

We don't have a back button on the device. If a user clicks on a link in an app that its outside the app, that content will replace the current app with a random webpage with no way of getting back to the app. This a bit of a security problem, but mostly a big footgun for developers and users.

If I understand the scenario correctly, the user can either: * Access the original app from the Home app. * Access the original app from the Task Swicher (long press on Home HW button) Both of which are better usability solutions for novice to intermediate users (and arguably experienced users as well) than the unpredictability of the blind back button.

Not advocating for the back button, but for the inability to navigate into dead-ends. I think technically the user would have to go to task switcher, kill the current app, and restart it (otherwise it would load the dead-end content).

Per discussions on triage and on the google group, this bug looks like we don't want to do. We want to follow suit with we what we did for regular hosted apps: - target blank links take you to the browser - show origin of the app when you are off the origin of the app