We can fix this issue by copying the SW-related flags in ParseHeaders().
I feel it's safer to copy the whole ResourceResponse except for the headers (See Patch Set 2 of https://codereview.chromium.org/2956343002) rather than copying URL/headers to avoid similar issues. (I expect we have to clear more fields though, e.g. multipart boundary)
However, this solution might also have risks to copy some fields unintentionally. (Probably "leaking" some fields from the original multipart response to the copied response doesn't have security impacts?)

yhirano@, WDTY?

hiroshige@, could you add labels to reflect Security_Impact and Security_Severity? Thanks!

hiroshige: do you have any update on this? Is Pri=1, Status=Started still accurate?

hiroshige: friendly security sheriff ping! This bug hasn't had an update in over 2 months. Could you please help provide an update or find another owner if needed? Thanks

S13n service worker/CORS/URLLoader are all moving parts now... if there is no quick fix for this bug and it's not super critical it might make sense to just wait for the new architecture to emerge.

#9: Is there an ETA for that S13n work?

+additional Service Worker friends, FYI.

It's our main project. ETA for S13nServiceWorker is 2018Q1-Q2. But I'm not sure things shaping up to change CORS and ResourceResponse in a way that will make this bug go away automatically.

I'm now realizing this looks similar to  issue 780435 .

Maybe we need to look at ResourceResponse::fetch_response_type similar to there, and check if the response is opaque?

As S13nServiceWorker is taking shape, it looks like it likely won't fix this alone. Sorry for leading us down that path.

hiroshige: do you think you'd be able to resume this work, maybe using fetch_response_type which is available now?

Passing to bashi@ who might be able to look at this. I think we can base a solution on hiroshige@'s patch/test. Most likely the only info we need to keep between "multiparts" is the FetchResponseType. Once the FetchResponseType is opaque in one part, the whole response should remain opaque. This is similar to  issue 780435  (CL: https://chromium-review.googlesource.com/#/c/828564/)  

Uploaded a WIP CL based on hiroshige@'s repro.
https://chromium-review.googlesource.com/c/chromium/src/+/907012

(I'm not sure how to set reviewers for private CLs on gerrit. I couldn't set reviewers)

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/d356217626d029ab76d4355e0fdfe5f744266a35

commit d356217626d029ab76d4355e0fdfe5f744266a35
Author: Kenichi Ishibashi <bashi@chromium.org>
Date: Mon Feb 19 05:21:32 2018

Set WasFetchedViaServiceWorker for multipart image response

When creating a ResourceResponse from another ResourceResponse,
we need to copy WasFetchedViaServiceWorker and
ResponseTypeViaServiceWorker.

Bug:  737648 
Change-Id: I9405738221ef5232e235f9fc400f204b7b558596
Reviewed-on: https://chromium-review.googlesource.com/907012
Commit-Queue: Kenichi Ishibashi <bashi@chromium.org>
Reviewed-by: Yutaka Hirano <yhirano@chromium.org>
Reviewed-by: Matt Falkenhagen <falken@chromium.org>
Cr-Commit-Position: refs/heads/master@{#537579}
[add] https://crrev.com/d356217626d029ab76d4355e0fdfe5f744266a35/third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/multipart-image.https.html
[add] https://crrev.com/d356217626d029ab76d4355e0fdfe5f744266a35/third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/resources/multipart-image-iframe.html
[add] https://crrev.com/d356217626d029ab76d4355e0fdfe5f744266a35/third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/resources/multipart-image-worker.js
[add] https://crrev.com/d356217626d029ab76d4355e0fdfe5f744266a35/third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/resources/multipart-image.py
[modify] https://crrev.com/d356217626d029ab76d4355e0fdfe5f744266a35/third_party/WebKit/Source/core/loader/resource/ImageResource.cpp
[modify] https://crrev.com/d356217626d029ab76d4355e0fdfe5f744266a35/third_party/WebKit/Source/core/loader/resource/MultipartImageResourceParser.cpp

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot