Do not pass URLs in onUpdated events to extensions unless they have the

chrome/browser/extensions/extension_tab_util.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROME_BROWSER_EXTENSIONS_EXTENSION_TAB_UTIL_H__
 #define CHROME_BROWSER_EXTENSIONS_EXTENSION_TAB_UTIL_H__
 
 #include <string>
 
 #include "base/callback.h"
@@ skipping 54 matching lines @@
       IncludePrivacySensitiveFields include_privacy_sensitive_fields) {
     return CreateTabValue(web_contents, NULL, -1,
                           include_privacy_sensitive_fields);
   }
   static base::DictionaryValue* CreateTabValue(
       const content::WebContents* web_contents,
       TabStripModel* tab_strip,
       int tab_index,
       IncludePrivacySensitiveFields include_privacy_sensitive_fields);
 
+  // Remove any privacy-sensitive fields from a Tab object or event info
+  // dictionary, if the extension does not have the tabs permission.  Returns a
+  // new dictionary value; the input update_info dictionary is left unmodified.
+  static base::DictionaryValue* ScrubTabValue(
+      const content::WebContents* contents,
+      const extensions::Extension* extension,
+      const base::DictionaryValue* update_info);
+
   // Gets the |tab_strip_model| and |tab_index| for the given |web_contents|.
   static bool GetTabStripModel(const content::WebContents* web_contents,
                                TabStripModel** tab_strip_model,
                                int* tab_index);
   static bool GetDefaultTab(Browser* browser,
                             content::WebContents** contents,
                             int* tab_id);
   // Any out parameter (|browser|, |tab_strip|, |contents|, & |tab_index|) may
   // be NULL and will not be set within the function.
   static bool GetTabById(int tab_id, Profile* profile, bool incognito_enabled,
@@ skipping 25 matching lines @@
 
   // Executes the specified callback for all tabs in all browser windows.
   static void ForEachTab(
       const base::Callback<void(content::WebContents*)>& callback);
 
   static extensions::WindowController* GetWindowControllerOfTab(
       const content::WebContents* web_contents);
 };
 
 #endif  // CHROME_BROWSER_EXTENSIONS_EXTENSION_TAB_UTIL_H__