Code: bool PermissionsData::CanCaptureVisiblePage(const GURL& document_url,
                                            int tab_id,
                                            std::string* error) const {
   bool has_active_tab = false;
   bool has_all_urls = false;
  url::Origin origin = url::Origin::Create(document_url);
  const GURL origin_url = origin.GetURL();
  {
    base::AutoLock auto_lock(runtime_lock_);
    if (location_ != Manifest::COMPONENT &&
        IsPolicyBlockedHostUnsafe(origin_url)) {
      if (error)
        *error = extension_misc::kPolicyBlockedScripting;
      return false;
    }

    const PermissionSet* tab_permissions = GetTabSpecificPermissions(tab_id);
    has_active_tab = tab_permissions &&
                     tab_permissions->HasAPIPermission(APIPermission::kTab);

    const URLPattern all_urls(URLPattern::SCHEME_ALL,
                               URLPattern::kAllUrlsPattern);
     has_all_urls =
         active_permissions_unsafe_->explicit_hosts().ContainsPattern(all_urls);
   }
 
  if (!has_active_tab && !has_all_urls) {
    if (error)
      *error = manifest_errors::kAllURLOrActiveTabNeeded;
    return false;
  }
 
  std::string access_error;
  if (GetPageAccess(origin_url, tab_id, &access_error) == PageAccess::kAllowed)
    return true;
 
 
   if (origin_url.host() == extension_id_)
    return true;

  bool allowed_with_active_tab =
      origin_url.SchemeIs(content::kChromeUIScheme) ||
      origin_url.SchemeIs(kExtensionScheme) ||
      document_url.SchemeIs(url::kDataScheme) ||
      origin.IsSameOriginWith(
          url::Origin::Create(ExtensionsClient::Get()->GetWebstoreBaseURL()));

  if (!allowed_with_active_tab) {
    if (error)
       *error = access_error;
     return false;
   }
   if (has_active_tab)
     return true;

  if (error)
    *error = manifest_errors::kActiveTabPermissionNotGranted;
  return false;
}

Vulnerability Type: Bypass 
CWE ID: CWE-20
Summary: Insufficient policy enforcement in extensions API in Google Chrome prior to 75.0.3770.80 allowed an attacker who convinced a user to install a malicious extension to bypass restrictions on file URIs via a crafted Chrome Extension.
Commit Message: Call CanCaptureVisiblePage in page capture API.

Currently the pageCapture permission allows access
to arbitrary local files and chrome:// pages which
can be a security concern. In order to address this,
the page capture API needs to be changed similar to
the captureVisibleTab API. The API will now only allow
extensions to capture otherwise-restricted URLs if the
user has granted activeTab. In addition, file:// URLs are
only capturable with the "Allow on file URLs" option enabled.

Bug: 893087

Change-Id: I6d6225a3efb70fc033e2e1c031c633869afac624
Reviewed-on: https://chromium-review.googlesource.com/c/1330689
Commit-Queue: Bettina Dea <bdea@chromium.org>
Reviewed-by: Devlin <rdevlin.cronin@chromium.org>
Reviewed-by: Varun Khaneja <vakh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#615248}