Code: void HTMLFormElement::ScheduleFormSubmission(FormSubmission* submission) {
  DCHECK(submission->Method() == FormSubmission::kPostMethod ||
         submission->Method() == FormSubmission::kGetMethod);
  DCHECK(submission->Data());
  DCHECK(submission->Form());
  if (submission->Action().IsEmpty())
    return;
  if (GetDocument().IsSandboxed(kSandboxForms)) {
    GetDocument().AddConsoleMessage(ConsoleMessage::Create(
        kSecurityMessageSource, kErrorMessageLevel,
        "Blocked form submission to '" + submission->Action().ElidedString() +
            "' because the form's frame is sandboxed and the 'allow-forms' "
            "permission is not set."));
    return;
  }

  if (!GetDocument().GetContentSecurityPolicy()->AllowFormAction(
          submission->Action())) {
    return;
  }

  if (submission->Action().ProtocolIsJavaScript()) {
    GetDocument()
        .GetFrame()
        ->GetScriptController()
        .ExecuteScriptIfJavaScriptURL(submission->Action(), this);
    return;
  }

  Frame* target_frame = GetDocument().GetFrame()->FindFrameForNavigation(
      submission->Target(), *GetDocument().GetFrame(),
      submission->RequestURL());
  if (!target_frame) {
    target_frame = GetDocument().GetFrame();
  } else {
    submission->ClearTarget();
  }
  if (!target_frame->GetPage())
    return;

  UseCounter::Count(GetDocument(), WebFeature::kFormsSubmitted);
  if (MixedContentChecker::IsMixedFormAction(GetDocument().GetFrame(),
                                             submission->Action())) {
    UseCounter::Count(GetDocument().GetFrame(),
                      WebFeature::kMixedContentFormsSubmitted);
  }

  if (target_frame->IsLocalFrame()) {
    ToLocalFrame(target_frame)
        ->GetNavigationScheduler()
        .ScheduleFormSubmission(&GetDocument(), submission);
   } else {
     FrameLoadRequest frame_load_request =
         submission->CreateFrameLoadRequest(&GetDocument());
     ToRemoteFrame(target_frame)->Navigate(frame_load_request);
   }
 }

Vulnerability Type: Exec Code Overflow 
CWE ID: CWE-190
Summary: An integer overflow leading to an incorrect capacity of a buffer in JavaScript in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
Commit Message: Move user activation check to RemoteFrame::Navigate's callers.

Currently RemoteFrame::Navigate is the user of
Frame::HasTransientUserActivation that passes a RemoteFrame*, and
it seems wrong because the user activation (user gesture) needed by
the navigation should belong to the LocalFrame that initiated the
navigation.

Follow-up CLs after this one will update UserActivation code in
Frame to take a LocalFrame* instead of a Frame*, and get rid of
redundant IPCs.

Bug: 811414
Change-Id: I771c1694043edb54374a44213d16715d9c7da704
Reviewed-on: https://chromium-review.googlesource.com/914736
Commit-Queue: Mustaq Ahmed <mustaq@chromium.org>
Reviewed-by: Daniel Cheng <dcheng@chromium.org>
Cr-Commit-Position: refs/heads/master@{#536728}