Code:  void BrowserPpapiHostImpl::DeleteInstance(PP_Instance instance) {
   auto it = instance_map_.find(instance);
  DCHECK(it != instance_map_.end());
  for (auto& observer : it->second->observer_list)
    observer.OnHostDestroyed();
 
  instance_map_.erase(it);
 }

Vulnerability Type: 
CWE ID: CWE-20
Summary: Insufficient validation of untrusted input in PPAPI Plugins in Google Chrome prior to 60.0.3112.78 for Windows allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
Commit Message: Validate in-process plugin instance messages.

Bug: 733548, 733549
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_site_isolation
Change-Id: Ie5572c7bcafa05399b09c44425ddd5ce9b9e4cba
Reviewed-on: https://chromium-review.googlesource.com/538908
Commit-Queue: Bill Budge <bbudge@chromium.org>
Reviewed-by: Raymes Khoury <raymes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#480696}