Code:  void ForeignSessionHelper::TriggerSessionSync(
     JNIEnv* env,
     const JavaParamRef<jobject>& obj) {
  browser_sync::ProfileSyncService* service =
      ProfileSyncServiceFactory::GetInstance()->GetForProfile(profile_);
   if (!service)
     return;
 
  const syncer::ModelTypeSet types(syncer::SESSIONS);
  service->TriggerRefresh(types);
 }

Vulnerability Type: 
CWE ID: CWE-254
Summary: Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux does not properly validate access to the initial document, which allows remote attackers to spoof the address bar via a crafted web site.
Commit Message: Prefer SyncService over ProfileSyncService in foreign_session_helper

SyncService is the interface, ProfileSyncService is the concrete
implementation. Generally no clients should need to use the conrete
implementation - for one, testing will be much easier once everyone
uses the interface only.

Bug: 924508
Change-Id: Ia210665f8f02512053d1a60d627dea0f22758387
Reviewed-on: https://chromium-review.googlesource.com/c/1461119
Auto-Submit: Marc Treib <treib@chromium.org>
Commit-Queue: Yaron Friedman <yfriedman@chromium.org>
Reviewed-by: Yaron Friedman <yfriedman@chromium.org>
Cr-Commit-Position: refs/heads/master@{#630662}