Code: void CredentialManagerImpl::OnProvisionalSaveComplete() {
  DCHECK(form_manager_);
  DCHECK(client_->IsSavingAndFillingEnabledForCurrentPage());
  const autofill::PasswordForm& form = form_manager_->pending_credentials();

  if (form_manager_->IsPendingCredentialsPublicSuffixMatch()) {
    form_manager_->Save();
    return;
  }

  if (!form.federation_origin.unique()) {
    for (auto* match : form_manager_->form_fetcher()->GetFederatedMatches()) {
      if (match->username_value == form.username_value &&
          match->federation_origin.IsSameOriginWith(form.federation_origin)) {
        form_manager_->Update(*match);
        return;
      }
    }
  } else if (!form_manager_->IsNewLogin()) {
    form_manager_->Update(*form_manager_->preferred_match());
     return;
   }
 
  client_->PromptUserToSaveOrUpdatePassword(std::move(form_manager_), false);
}

Vulnerability Type: 
CWE ID: CWE-125
Summary: Insufficient validation in V8 in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
Commit Message: Fix Credential Management API Store() for existing Credentials

This changes fixes the Credential Management API to correctly handle
storing of already existing credentials. In the previous version
`preferred_match()` was updated, which is not necessarily the credential
selected by the user.

Bug: 795878
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_mojo
Change-Id: I269f465861f44cdd784f0ce077e755191d3bd7bd
Reviewed-on: https://chromium-review.googlesource.com/843022
Commit-Queue: Jan Wilken Dörrie <jdoerrie@chromium.org>
Reviewed-by: Balazs Engedy <engedy@chromium.org>
Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Reviewed-by: Maxim Kolosovskiy <kolos@chromium.org>
Cr-Commit-Position: refs/heads/master@{#526313}