Packaged (CRX) extensions shouldn't be able to get 'dev' interfaces in NaCl.

chrome/renderer/chrome_content_renderer_client.h

Index: chrome/renderer/chrome_content_renderer_client.h
===================================================================
--- chrome/renderer/chrome_content_renderer_client.h	(revision 105971)
+++ chrome/renderer/chrome_content_renderer_client.h	(working copy)
@@ -127,6 +127,14 @@
                                const GURL& new_url,
                                bool is_initial_navigation);
 
+  // Returns true if the NaCl plugin can be created. If it returns true, as a
+  // side effect, it may add special attributes to params.
+  bool IsNaClAllowed(const webkit::WebPluginInfo& plugin,
+                     const GURL& url,
+                     const std::string& actual_mime_type,
+                     bool enable_nacl,
+                     WebKit::WebPluginParams& params);
+
   scoped_ptr<ChromeRenderProcessObserver> chrome_observer_;
   scoped_ptr<ExtensionDispatcher> extension_dispatcher_;
   scoped_ptr<RendererHistogramSnapshots> histogram_snapshots_;