blob: URLs are same-origin with the page in which they were created, but match only if the blob: scheme is specified.