Code: void DOMWindow::focus(LocalDOMWindow* incumbent_window) {
  if (!GetFrame())
    return;

  Page* page = GetFrame()->GetPage();
  if (!page)
    return;

  DCHECK(incumbent_window);
  ExecutionContext* incumbent_execution_context =
      incumbent_window->GetExecutionContext();

  bool allow_focus = incumbent_execution_context->IsWindowInteractionAllowed();
  if (allow_focus) {
    incumbent_execution_context->ConsumeWindowInteraction();
  } else {
    DCHECK(IsMainThread());
    allow_focus =
        opener() && (opener() != this) &&
        (ToDocument(incumbent_execution_context)->domWindow() == opener());
  }
 
   if (GetFrame()->IsMainFrame() && allow_focus)
    page->GetChromeClient().Focus();
 
   page->GetFocusController().FocusDocumentView(GetFrame(),
                                                true /* notifyEmbedder */);
}

Vulnerability Type: 
CWE ID: 
Summary: A JavaScript focused window could overlap the fullscreen notification in Fullscreen in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to obscure the full screen warning via a crafted HTML page.
Commit Message: If a page calls |window.focus()|, kick it out of fullscreen.

BUG=776418, 800056

Change-Id: I1880fe600e4814c073f247c43b1c1ac80c8fc017
Reviewed-on: https://chromium-review.googlesource.com/852378
Reviewed-by: Nasko Oskov <nasko@chromium.org>
Reviewed-by: Philip Jägenstedt <foolip@chromium.org>
Commit-Queue: Avi Drissman <avi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#533790}