Code:  bool RenderFrameHostManager::CanSubframeSwapProcess(
     const GURL& dest_url,
     SiteInstance* source_instance,
    SiteInstance* dest_instance,
    bool was_server_redirect) {
  DCHECK(!source_instance || !dest_instance);

  GURL resolved_url = dest_url;
  if (url::Origin::Create(resolved_url).unique()) {
    if (source_instance) {
      resolved_url = source_instance->GetSiteURL();
    } else if (dest_instance) {
       resolved_url = dest_instance->GetSiteURL();
     } else {
      if (!was_server_redirect)
         return false;
     }
   }
 
  if (!IsRendererTransferNeededForNavigation(render_frame_host_.get(),
                                             resolved_url)) {
    DCHECK(!dest_instance ||
           dest_instance == render_frame_host_->GetSiteInstance());
    return false;
  }

  return true;
}

Vulnerability Type: Bypass 
CWE ID: CWE-285
Summary: Insufficient policy enforcement in site isolation in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to bypass site isolation via a crafted HTML page.
Commit Message: Use unique processes for data URLs on restore.

Data URLs are usually put into the process that created them, but this
info is not tracked after a tab restore.  Ensure that they do not end up
in the parent frame's process (or each other's process), in case they
are malicious.

BUG=863069

Change-Id: Ib391f90c7bdf28a0a9c057c5cc7918c10aed968b
Reviewed-on: https://chromium-review.googlesource.com/1150767
Reviewed-by: Alex Moshchuk <alexmos@chromium.org>
Reviewed-by: Lei Zhang <thestig@chromium.org>
Commit-Queue: Charlie Reis <creis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#581023}