Code: bool RenderFrameDevToolsAgentHost::AttachSession(DevToolsSession* session) {
  if (!ShouldAllowSession(session))
    return false;

   protocol::EmulationHandler* emulation_handler =
       new protocol::EmulationHandler();
   session->AddHandler(base::WrapUnique(new protocol::BrowserHandler()));
  session->AddHandler(base::WrapUnique(new protocol::DOMHandler()));
   session->AddHandler(base::WrapUnique(emulation_handler));
   session->AddHandler(base::WrapUnique(new protocol::InputHandler()));
   session->AddHandler(base::WrapUnique(new protocol::InspectorHandler()));
  session->AddHandler(base::WrapUnique(new protocol::IOHandler(
      GetIOContext())));
  session->AddHandler(base::WrapUnique(new protocol::MemoryHandler()));
  session->AddHandler(base::WrapUnique(new protocol::NetworkHandler(
      GetId(),
      frame_tree_node_ ? frame_tree_node_->devtools_frame_token()
                       : base::UnguessableToken(),
      GetIOContext())));
  session->AddHandler(base::WrapUnique(new protocol::SchemaHandler()));
  session->AddHandler(base::WrapUnique(new protocol::ServiceWorkerHandler()));
  session->AddHandler(base::WrapUnique(new protocol::StorageHandler()));
  session->AddHandler(base::WrapUnique(new protocol::TargetHandler(
      session->client()->MayAttachToBrowser()
          ? protocol::TargetHandler::AccessMode::kRegular
          : protocol::TargetHandler::AccessMode::kAutoAttachOnly,
      GetId(), GetRendererChannel(), session->GetRootSession())));
  session->AddHandler(base::WrapUnique(new protocol::PageHandler(
      emulation_handler, session->client()->MayAffectLocalFiles())));
  session->AddHandler(base::WrapUnique(new protocol::SecurityHandler()));
  if (!frame_tree_node_ || !frame_tree_node_->parent()) {
    session->AddHandler(base::WrapUnique(
        new protocol::TracingHandler(frame_tree_node_, GetIOContext())));
  }

  if (sessions().empty()) {
    bool use_video_capture_api = true;
#ifdef OS_ANDROID
    if (!CompositorImpl::IsInitialized())
      use_video_capture_api = false;
#endif
    if (!use_video_capture_api)
      frame_trace_recorder_.reset(new DevToolsFrameTraceRecorder());
    GrantPolicy();
#if defined(OS_ANDROID)
    GetWakeLock()->RequestWakeLock();
#endif
  }
  return true;
}

Vulnerability Type: 
CWE ID: CWE-254
Summary: DevTools API not correctly gating on extension capability in DevTools in Google Chrome prior to 72.0.3626.81 allowed an attacker who convinced a user to install a malicious extension to read local files via a crafted Chrome Extension.
Commit Message: [DevTools] Guard DOM.setFileInputFiles under MayAffectLocalFiles

Bug: 805557
Change-Id: Ib6f37ec6e1d091ee54621cc0c5c44f1a6beab10f
Reviewed-on: https://chromium-review.googlesource.com/c/1334847
Reviewed-by: Pavel Feldman <pfeldman@chromium.org>
Commit-Queue: Dmitry Gozman <dgozman@chromium.org>
Cr-Commit-Position: refs/heads/master@{#607902}