Code: void InstallablePaymentAppCrawler::OnPaymentMethodManifestParsed(
    const GURL& method_manifest_url,
    const std::vector<GURL>& default_applications,
    const std::vector<url::Origin>& supported_origins,
    bool all_origins_supported) {
  number_of_payment_method_manifest_to_parse_--;

  if (web_contents() == nullptr)
    return;
  content::PermissionManager* permission_manager =
      web_contents()->GetBrowserContext()->GetPermissionManager();
  if (permission_manager == nullptr)
    return;

  for (const auto& url : default_applications) {
    if (downloaded_web_app_manifests_.find(url) !=
        downloaded_web_app_manifests_.end()) {
       continue;
     }
 
     if (permission_manager->GetPermissionStatus(
             content::PermissionType::PAYMENT_HANDLER, url.GetOrigin(),
             url.GetOrigin()) != blink::mojom::PermissionStatus::GRANTED) {
      continue;
    }

    number_of_web_app_manifest_to_download_++;
    downloaded_web_app_manifests_.insert(url);
    downloader_->DownloadWebAppManifest(
        url,
        base::BindOnce(
            &InstallablePaymentAppCrawler::OnPaymentWebAppManifestDownloaded,
            weak_ptr_factory_.GetWeakPtr(), method_manifest_url, url));
  }

  FinishCrawlingPaymentAppsIfReady();
}

Vulnerability Type: 
CWE ID: 
Summary: Insufficiently strict origin checks during JIT payment app installation in Payments in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to install a service worker for a domain that can host attacker controled files via a crafted HTML page.
Commit Message: [Payments] Restrict just-in-time payment handler to payment method domain and its subdomains

Bug: 853937
Change-Id: I148b3d96950a9d90fa362e580e9593caa6b92a36
Reviewed-on: https://chromium-review.googlesource.com/1132116
Reviewed-by: Mathieu Perreault <mathp@chromium.org>
Commit-Queue: Ganggui Tang <gogerald@chromium.org>
Cr-Commit-Position: refs/heads/master@{#573911}