Code: void RemoteFrame::ScheduleNavigation(Document& origin_document,
                                      const KURL& url,
                                      WebFrameLoadType frame_load_type,
                                      UserGestureStatus user_gesture_status) {
   FrameLoadRequest frame_request(&origin_document, ResourceRequest(url));
   frame_request.GetResourceRequest().SetHasUserGesture(
       user_gesture_status == UserGestureStatus::kActive);
  frame_request.GetResourceRequest().SetFrameType(
      IsMainFrame() ? network::mojom::RequestContextFrameType::kTopLevel
                    : network::mojom::RequestContextFrameType::kNested);
  Navigate(frame_request, frame_load_type);
}

Vulnerability Type: 
CWE ID: CWE-732
Summary: Remote frame navigations was incorrectly permitted to local resources in Blink in Google Chrome prior to 71.0.3578.80 allowed an attacker who convinced a user to install a malicious extension to access files on the local file system via a crafted Chrome Extension.
Commit Message: Add a check for disallowing remote frame navigations to local resources.

Previously, RemoteFrame navigations did not perform any renderer-side
checks and relied solely on the browser-side logic to block disallowed
navigations via mechanisms like FilterURL.  This means that blocked
remote frame navigations were silently navigated to about:blank
without any console error message.

This CL adds a CanDisplay check to the remote navigation path to match
an equivalent check done for local frame navigations.  This way, the
renderer can consistently block disallowed navigations in both cases
and output an error message.

Bug: 894399
Change-Id: I172f68f77c1676f6ca0172d2a6c78f7edc0e3b7a
Reviewed-on: https://chromium-review.googlesource.com/c/1282390
Reviewed-by: Charlie Reis <creis@chromium.org>
Reviewed-by: Nate Chapin <japhet@chromium.org>
Commit-Queue: Alex Moshchuk <alexmos@chromium.org>
Cr-Commit-Position: refs/heads/master@{#601022}