Nice find on the Chromium bug! You can "knock out" STS rules by injecting a max-age=0 STS header, which is how HSTS websites tell the client that they no longer want HSTS.