A compromised renderer can spoof the committed URL (e.g. spoof the Omnibox URL, URL shown in permission dialogs, etc.) by sending FrameHostMsg_DidCommitProvisionalLoad_Params with 1) opaque origin and 2) arbitrary URL.


This should be addressed by nasko@'s work on precursor origins, but
1) probably requires some extra checks in the code (i.e. url-VS-origin comparison in addition to the origin-VS-process-lock comparison) and
2) probably requires some extra tests (i.e. injecting spoofed URL in addition to tests that inject a spoofed origin like the already existing SitePerProcessBrowserTest.CommittedOriginIncompatibleWithOriginLock)

Because of the above, I think it should be useful to track this in a separate bug.


Credit for pointing out this Site Isolation enforcement gap: jun.kokatsu@microsoft.com