`<a target="_blank">` with image child `<img src="data:image"/>` causes app crash on Android in MAUI Blazor Hybrid

Description

Hello,
I have encountered a bug where given the following situation:

<a href="https://www.google.com" target="_blank"><img src="data:image/png;base64,some-base-64...="></a>

clicking on the image inside of the anchor tag causes an app crash. It seems that Android is trying to open whatever is inside src instead of what is inside the href (when I placed google.com inside the src, a browser opened with google.com). When target="_blank" is not present though, it works fine.

Any ideas would be appreciated :-)

Steps to Reproduce

1. Create a new .NET MAUI Blazor hybrid app
2. Add the following code to the Home.razor

<h2>With target="_blank"</h2>
Crash:
<a href="https://www.google.com" target="_blank">
    <img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNk+A8AAQUBAScY42YAAAAASUVORK5CYII=" width="300" height="300">
</a>

Different site:
<a href="https://www.google.com" target="_blank">
    <img src="https://www.youtube.com" alt="other image alt" width="300" height="300">
</a>


<h2>And now without target="_blank":</h2>
<a href="https://www.google.com">
    <img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNk+A8AAQUBAScY42YAAAAASUVORK5CYII=" width="300" height="300">
</a>

also works fine
<a href="https://www.google.com">
    <img src="https://www.youtube.com" alt="other image alt" width="300" height="300">
</a>

3. Click the first black square image -> observe crash
4. Click the second image (click the alt text) -> view another page
5. Click the second black square -> works fine (no target="_blank")
6. Click the fourth image (click the alt text) -> view correct page

Link to public reproduction project repository

No response

Version with bug

10.0.20

Is this a regression from previous behavior?

Not sure, did not test other versions

Last version that worked well

Unknown/Other

Affected platforms

Android, I was not able test on other platforms

Affected platform versions

Android emulator pixel_7 Android 16.0 API 36.0

Did you find any workaround?

As a workaround I am removing the target="_blank" from my HTML.

Relevant log output

A stacktrace that shows that Android is trying to find an activity for `data:` which comes from the image `src`

[chromium] [ERROR:jni_android.cc(159)] Crashing due to uncaught Java exception
[chromium] [ERROR:jni_android.cc(203)] Native stack trace:
[chromium] #00 pc 0x0000000002d931fc /data/app/~~WsuBRZRqFwBUp9laSS-tNw==/com.google.android.trichromelibrary_694313738-I7X9_bkbQYVCFrHIZEXB4w==/TrichromeLibrary.apk (offset 0x898000)
[chromium] #01 pc 0x0000000004b328e3 /data/app/~~WsuBRZRqFwBUp9laSS-tNw==/com.google.android.trichromelibrary_694313738-I7X9_bkbQYVCFrHIZEXB4w==/TrichromeLibrary.apk (offset 0x898000)
[chromium] #02 pc 0x0000000005e28f61 /data/app/~~WsuBRZRqFwBUp9laSS-tNw==/com.google.android.trichromelibrary_694313738-I7X9_bkbQYVCFrHIZEXB4w==/TrichromeLibrary.apk (offset 0x898000)
[chromium] #03 pc 0x0000000005cd5739 /data/app/~~WsuBRZRqFwBUp9laSS-tNw==/com.google.android.trichromelibrary_694313738-I7X9_bkbQYVCFrHIZEXB4w==/TrichromeLibrary.apk (offset 0x898000)
[chromium] #04 pc 0x00000000056e5b43 /data/app/~~WsuBRZRqFwBUp9laSS-tNw==/com.google.android.trichromelibrary_694313738-I7X9_bkbQYVCFrHIZEXB4w==/TrichromeLibrary.apk (offset 0x898000)
[chromium] #05 pc 0x0000000002bc154d /data/app/~~WsuBRZRqFwBUp9laSS-tNw==/com.google.android.trichromelibrary_694313738-I7X9_bkbQYVCFrHIZEXB4w==/TrichromeLibrary.apk (offset 0x898000)
[chromium] #06 pc 0x0000000002d8da6d /data/app/~~WsuBRZRqFwBUp9laSS-tNw==/com.google.android.trichromelibrary_694313738-I7X9_bkbQYVCFrHIZEXB4w==/TrichromeLibrary.apk (offset 0x898000)
[chromium] #07 pc 0x00000000023c4912 /data/app/~~WsuBRZRqFwBUp9laSS-tNw==/com.google.android.trichromelibrary_694313738-I7X9_bkbQYVCFrHIZEXB4w==/TrichromeLibrary.apk (offset 0x898000)
[chromium] #08 pc 0x000000000762b221 /data/app/~~WsuBRZRqFwBUp9laSS-tNw==/com.google.android.trichromelibrary_694313738-I7X9_bkbQYVCFrHIZEXB4w==/TrichromeLibrary.apk (offset 0x898000)
[chromium] #09 pc 0x00000000023e3caf /data/app/~~WsuBRZRqFwBUp9laSS-tNw==/com.google.android.trichromelibrary_694313738-I7X9_bkbQYVCFrHIZEXB4w==/TrichromeLibrary.apk (offset 0x898000)
[chromium] #10 pc 0x0000000007155456 /data/app/~~WsuBRZRqFwBUp9laSS-tNw==/com.google.android.trichromelibrary_694313738-I7X9_bkbQYVCFrHIZEXB4w==/TrichromeLibrary.apk (offset 0x898000)
[chromium] #11 pc 0x0000000007155a9f /data/app/~~WsuBRZRqFwBUp9laSS-tNw==/com.google.android.trichromelibrary_694313738-I7X9_bkbQYVCFrHIZEXB4w==/TrichromeLibrary.apk (offset 0x898000)
[chromium] #12 pc 0x0000000007175e34 /data/app/~~WsuBRZRqFwBUp9laSS-tNw==/com.google.android.trichromelibrary_694313738-I7X9_bkbQYVCFrHIZEXB4w==/TrichromeLibrary.apk (offset 0x898000)
[chromium] #13 pc 0x00000000000075db /system/lib64/libutils.so
[chromium] #14 pc 0x00000000000dd2a6 /system/lib64/libandroid_runtime.so
[cr_JniAndroid] Handling uncaught Java exception
[cr_JniAndroid] android.content.ActivityNotFoundException: No Activity found to handle Intent { act=android.intent.action.VIEW dat=data: xflg=0x4 }
[cr_JniAndroid] 	at android.app.Instrumentation.checkStartActivityResult(Instrumentation.java:2426)
[cr_JniAndroid] 	at android.app.Instrumentation.execStartActivity(Instrumentation.java:2000)
[cr_JniAndroid] 	at android.app.Activity.startActivityForResult(Activity.java:5997)
[cr_JniAndroid] 	at androidx.activity.ComponentActivity.startActivityForResult(ComponentActivity.kt:694)
[cr_JniAndroid] 	at android.app.Activity.startActivityForResult(Activity.java:5954)
[cr_JniAndroid] 	at androidx.activity.ComponentActivity.startActivityForResult(ComponentActivity.kt:679)
[cr_JniAndroid] 	at android.app.Activity.startActivity(Activity.java:6457)
[cr_JniAndroid] 	at android.app.Activity.startActivity(Activity.java:6424)
[cr_JniAndroid] 	at crc64d693e2d9159537db.BlazorWebChromeClient.n_onCreateWindow(Native Method)
[cr_JniAndroid] 	at crc64d693e2d9159537db.BlazorWebChromeClient.onCreateWindow(BlazorWebChromeClient.java:29)
[cr_JniAndroid] 	at WV.F9.addNewContents(chromium-TrichromeWebViewGoogle6432.aab-stable-694313738:39)
[cr_JniAndroid] 	at android.os.MessageQueue.nativePollOnce(Native Method)
[cr_JniAndroid] 	at android.os.MessageQueue.nextLegacy(MessageQueue.java:913)
[cr_JniAndroid] 	at android.os.MessageQueue.next(MessageQueue.java:1025)
[cr_JniAndroid] 	at android.os.Looper.loopOnce(Looper.java:196)
[cr_JniAndroid] 	at android.os.Looper.loop(Looper.java:338)
[cr_JniAndroid] 	at android.app.ActivityThread.main(ActivityThread.java:9067)
[cr_JniAndroid] 	at java.lang.reflect.Method.invoke(Native Method)
[cr_JniAndroid] 	at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:593)
[cr_JniAndroid] 	at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:932)

First reproduce the crash with the Home.razor markup and Android API 36 emulator described in the issue. Then inspect BlazorWebChromeClient.onCreateWindow and the ActivityNotFoundException showing that data: is used for the new window. Done means clicking the image opens the anchor href without crashing, while the existing no-target behavior remains intact.