Code:  void BrowserEventRouter::TabUpdated(WebContents* contents, bool did_navigate) {
   TabEntry* entry = GetTabEntry(contents);
  DictionaryValue* changed_properties = NULL;
 
   DCHECK(entry);
 
   if (did_navigate)
    changed_properties = entry->DidNavigate(contents);
   else
    changed_properties = entry->UpdateLoadState(contents);
 
   if (changed_properties)
    DispatchTabUpdatedEvent(contents, changed_properties);
 }

Vulnerability Type: 
CWE ID: CWE-264
Summary: Google Chrome before 26.0.1410.43 does not ensure that an extension has the tabs (aka APIPermission::kTab) permission before providing a URL to this extension, which has unspecified impact and remote attack vectors.
Commit Message: Do not pass URLs in onUpdated events to extensions unless they have the
"tabs" permission.

BUG=168442


Review URL: https://chromiumcodereview.appspot.com/11824004

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@176406 0039d316-1c4b-4281-b951-d872f2087c98