Code: void NavigateOnUIThread(
    const GURL& url,
    const std::vector<GURL> url_chain,
    const Referrer& referrer,
    bool has_user_gesture,
    const ResourceRequestInfo::WebContentsGetter& wc_getter) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
   WebContents* web_contents = wc_getter.Run();
  if (web_contents) {
    NavigationController::LoadURLParams params(url);
     params.has_user_gesture = has_user_gesture;
     params.referrer = referrer;
     params.redirect_chain = url_chain;
     web_contents->GetController().LoadURLWithParams(params);
   }
 }

Vulnerability Type: Bypass 
CWE ID: CWE-284
Summary: Inappropriate implementation in Blink in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to bypass same origin policy via a crafted HTML page.
Commit Message: When turning a download into a navigation, navigate the right frame

Code changes from Nate Chapin <japhet@chromium.org>

Bug: 926105
Change-Id: I098599394e6ebe7d2fce5af838014297a337d294
Reviewed-on: https://chromium-review.googlesource.com/c/1454962
Reviewed-by: Camille Lamy <clamy@chromium.org>
Commit-Queue: Jochen Eisinger <jochen@chromium.org>
Cr-Commit-Position: refs/heads/master@{#629547}