Code: void BrowserEventRouter::TabPinnedStateChanged(WebContents* contents,
                                               int index) {
  TabStripModel* tab_strip = NULL;
   int tab_index;
 
   if (ExtensionTabUtil::GetTabStripModel(contents, &tab_strip, &tab_index)) {
    DictionaryValue* changed_properties = new DictionaryValue();
     changed_properties->SetBoolean(tab_keys::kPinnedKey,
                                    tab_strip->IsTabPinned(tab_index));
    DispatchTabUpdatedEvent(contents, changed_properties);
   }
 }

Vulnerability Type: 
CWE ID: CWE-264
Summary: Google Chrome before 26.0.1410.43 does not ensure that an extension has the tabs (aka APIPermission::kTab) permission before providing a URL to this extension, which has unspecified impact and remote attack vectors.
Commit Message: Do not pass URLs in onUpdated events to extensions unless they have the
"tabs" permission.

BUG=168442


Review URL: https://chromiumcodereview.appspot.com/11824004

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@176406 0039d316-1c4b-4281-b951-d872f2087c98