Code: void BrowserEventRouter::ExtensionActionExecuted(
    Profile* profile,
    const ExtensionAction& extension_action,
    WebContents* web_contents) {
  const char* event_name = NULL;
  switch (extension_action.action_type()) {
    case Extension::ActionInfo::TYPE_BROWSER:
      event_name = "browserAction.onClicked";
      break;
    case Extension::ActionInfo::TYPE_PAGE:
      event_name = "pageAction.onClicked";
      break;
    case Extension::ActionInfo::TYPE_SCRIPT_BADGE:
      event_name = "scriptBadge.onClicked";
      break;
    case Extension::ActionInfo::TYPE_SYSTEM_INDICATOR:
      break;
  }

   if (event_name) {
     scoped_ptr<ListValue> args(new ListValue());
     DictionaryValue* tab_value = ExtensionTabUtil::CreateTabValue(
        web_contents,
        ExtensionTabUtil::INCLUDE_PRIVACY_SENSITIVE_FIELDS);
     args->Append(tab_value);
 
     DispatchEventToExtension(profile,
                             extension_action.extension_id(),
                             event_name,
                             args.Pass(),
                             EventRouter::USER_GESTURE_ENABLED);
  }
}

Vulnerability Type: 
CWE ID: CWE-264
Summary: Google Chrome before 26.0.1410.43 does not ensure that an extension has the tabs (aka APIPermission::kTab) permission before providing a URL to this extension, which has unspecified impact and remote attack vectors.
Commit Message: Do not pass URLs in onUpdated events to extensions unless they have the
"tabs" permission.

BUG=168442


Review URL: https://chromiumcodereview.appspot.com/11824004

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@176406 0039d316-1c4b-4281-b951-d872f2087c98