Code:  void ChromeContentBrowserClient::OpenURL(
    content::BrowserContext* browser_context,
     const content::OpenURLParams& params,
    const base::Callback<void(content::WebContents*)>& callback) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
 #if defined(OS_ANDROID)
   ServiceTabLauncher::GetInstance()->LaunchTab(browser_context, params,
                                               callback);
#else
  NavigateParams nav_params(Profile::FromBrowserContext(browser_context),
                            params.url, params.transition);
  nav_params.FillNavigateParamsFromOpenURLParams(params);
  nav_params.user_gesture = params.user_gesture;

  Navigate(&nav_params);
  callback.Run(nav_params.navigated_or_inserted_contents);
#endif
}

Vulnerability Type: Bypass 
CWE ID: CWE-264
Summary: Insufficient policy validation in ServiceWorker in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
Commit Message: service worker: Make navigate/openWindow go through more security checks.

WindowClient.navigate() and Clients.openWindow() were implemented in
a way that directly navigated to the URL without going through
some checks that the normal navigation path goes through. This CL
attempts to fix that:
- WindowClient.navigate() now goes through Navigator::RequestOpenURL()
  instead of directly through WebContents::OpenURL().
- Clients.openWindow() now calls more ContentBrowserClient functions
  for manipulating the navigation before invoking
  ContentBrowserClient::OpenURL().

Bug: 904219
Change-Id: Ic38978aee98c09834fdbbc240164068faa3fd4f5
Reviewed-on: https://chromium-review.googlesource.com/c/1345686
Commit-Queue: Matt Falkenhagen <falken@chromium.org>
Reviewed-by: Arthur Sonzogni <arthursonzogni@chromium.org>
Reviewed-by: Kinuko Yasuda <kinuko@chromium.org>
Cr-Commit-Position: refs/heads/master@{#610753}