Code: void DownloadUIAdapterDelegate::OpenItem(const OfflineItem& item,
                                          int64_t offline_id) {
   JNIEnv* env = AttachCurrentThread();
   Java_OfflinePageDownloadBridge_openItem(
      env, ConvertUTF8ToJavaString(env, item.page_url.spec()), offline_id);
 }

Vulnerability Type: Bypass 
CWE ID: CWE-264
Summary: The DOM implementation in Blink, as used in Google Chrome before 47.0.2526.73, does not prevent javascript: URL navigation while a document is being detached, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code that improperly interacts with a plugin.
Commit Message: Open Offline Pages in CCT from Downloads Home.

When the respective feature flag is enabled, offline pages opened from
the Downloads Home will use CCT instead of normal tabs.

Bug: 824807
Change-Id: I6d968b8b0c51aaeb7f26332c7ada9f927e151a65
Reviewed-on: https://chromium-review.googlesource.com/977321
Commit-Queue: Carlos Knippschild <carlosk@chromium.org>
Reviewed-by: Ted Choc <tedchoc@chromium.org>
Reviewed-by: Bernhard Bauer <bauerb@chromium.org>
Reviewed-by: Jian Li <jianli@chromium.org>
Cr-Commit-Position: refs/heads/master@{#546545}