When the browser in private browsing mode then the browserAction popup should also probably be loaded as such. In chrome there seems to be incognito_behavior to control this behavior. See bug 1208563.
The popup should inherit the private browsing state of its parent. Do you have a reason to think it doesn't?
I tested this by adding some links to the html page in browser popup. When opening the browser popup in normal mode, the links were marked as visited, as expected. When opening the browser popup they were not marked as visited. Maybe a naive test, but let's be believe that this is working correctly. Kris mentioned that there might not be any unit tests for this, it would be good to add those, so keeping it open for that.