Code:  void ManifestChangeNotifier::DidChangeManifest() {
   if (weak_factory_.HasWeakPtrs())
     return;
 
  if (!render_frame()->GetWebFrame()->IsLoading()) {
    render_frame()
        ->GetTaskRunner(blink::TaskType::kUnspecedLoading)
        ->PostTask(FROM_HERE,
                   base::BindOnce(&ManifestChangeNotifier::ReportManifestChange,
                                  weak_factory_.GetWeakPtr()));
    return;
  }
  ReportManifestChange();
}

Vulnerability Type: 
CWE ID: 
Summary: Failure to disallow PWA installation from CSP sandboxed pages in AppManifest in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to access privileged APIs via a crafted HTML page.
Commit Message: Fail the web app manifest fetch if the document is sandboxed.

This ensures that sandboxed pages are regarded as non-PWAs, and that
other features in the browser process which trust the web manifest do
not receive the manifest at all if the document itself cannot access the
manifest.

BUG=771709

Change-Id: Ifd4d00c2fccff8cc0e5e8d2457bd55b992b0a8f4
Reviewed-on: https://chromium-review.googlesource.com/866529
Commit-Queue: Dominick Ng <dominickn@chromium.org>
Reviewed-by: Mounir Lamouri <mlamouri@chromium.org>
Reviewed-by: Mike West <mkwst@chromium.org>
Cr-Commit-Position: refs/heads/master@{#531121}