D'oh, sorry about closing this - didn't see the "Android" tag as opposed to iOS.

+cc some media folks, can you follow up on this please?

Here's a PoC to steal any frame of video. It will steal the video frame when you click on the get image button.

https://test.shhnjk.com/hls/blink_steal.html

dalecurtis@ suggested a fix offline. I will take a closer look and test things out tomorrow.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/153f8457c7867d5c9b627c11b52f5de0671d2fff

commit 153f8457c7867d5c9b627c11b52f5de0671d2fff
Author: Thomas Guilbert <tguilbert@chromium.org>
Date: Thu Jul 19 05:03:58 2018

Fix HasSingleSecurityOrigin for HLS

HLS manifests can request segments from a different origin than the
original manifest's origin. We do not inspect HLS manifests within
Chromium, and instead delegate to Android's MediaPlayer. This means we
need to be conservative, and always assume segments might come from a
different origin. HasSingleSecurityOrigin should always return false
when decoding HLS.

Bug:  864283 
Change-Id: Ie16849ac6f29ae7eaa9caf342ad0509a226228ef
Reviewed-on: https://chromium-review.googlesource.com/1142691
Reviewed-by: Dale Curtis <dalecurtis@chromium.org>
Reviewed-by: Dominick Ng <dominickn@chromium.org>
Commit-Queue: Thomas Guilbert <tguilbert@chromium.org>
Cr-Commit-Position: refs/heads/master@{#576378}
[modify] https://crrev.com/153f8457c7867d5c9b627c11b52f5de0671d2fff/media/blink/webmediaplayer_impl.cc
[modify] https://crrev.com/153f8457c7867d5c9b627c11b52f5de0671d2fff/media/blink/webmediaplayer_impl.h

I will verify on Dev tomorrow

The NextAction date has arrived: 2018-07-20

Canary doesn't have the patch yet. Snoozing till Monday

The NextAction date has arrived: 2018-07-23

Verified on Canary 70.0.3498.0

This bug requires manual review: M69 has already been promoted to the beta branch, so this requires manual review
Please contact the milestone owner if you have questions.
Owners: amineer@(Android), kariahda@(iOS), cindyb@(ChromeOS), govind@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

This is already in the m69 branch, no action needed.

*** Boilerplate reminders! ***
Please do NOT publicly disclose details until a fix has been released to all our users. Early public disclosure may cancel the provisional reward. Also, please be considerate about disclosure when the bug affects a core library that may be used by other products. Please do NOT share this information with third parties who are not directly involved in fixing the bug. Doing so may cancel the provisional reward. Please be honest if you have already disclosed anything publicly or to third parties. Lastly, we understand that some of you are not interested in money. We offer the option to donate your reward to an eligible charity. If you prefer this option, let us know and we will also match your donation - subject to our discretion. Any rewards that are unclaimed after 12 months will be donated to a charity of our choosing.
*********************************

Thanks again s.h.h.n.j.k@, $4,000 for this one.

Great! Thanks!