Code: Response DOMHandler::SetFileInputFiles(
    std::unique_ptr<protocol::Array<std::string>> files,
     Maybe<DOM::NodeId> node_id,
     Maybe<DOM::BackendNodeId> backend_node_id,
     Maybe<String> in_object_id) {
   if (host_) {
     for (size_t i = 0; i < files->length(); i++) {
 #if defined(OS_WIN)
      ChildProcessSecurityPolicyImpl::GetInstance()->GrantReadFile(
          host_->GetProcess()->GetID(),
          base::FilePath(base::UTF8ToUTF16(files->get(i))));
#else
      ChildProcessSecurityPolicyImpl::GetInstance()->GrantReadFile(
          host_->GetProcess()->GetID(),
          base::FilePath(files->get(i)));
#endif  // OS_WIN
    }
  }
  return Response::FallThrough();
}

Vulnerability Type: 
CWE ID: CWE-254
Summary: DevTools API not correctly gating on extension capability in DevTools in Google Chrome prior to 72.0.3626.81 allowed an attacker who convinced a user to install a malicious extension to read local files via a crafted Chrome Extension.
Commit Message: [DevTools] Guard DOM.setFileInputFiles under MayAffectLocalFiles

Bug: 805557
Change-Id: Ib6f37ec6e1d091ee54621cc0c5c44f1a6beab10f
Reviewed-on: https://chromium-review.googlesource.com/c/1334847
Reviewed-by: Pavel Feldman <pfeldman@chromium.org>
Commit-Queue: Dmitry Gozman <dgozman@chromium.org>
Cr-Commit-Position: refs/heads/master@{#607902}