Do not pass URLs in onUpdated events to extensions unless they have the

chrome/browser/extensions/extension_tab_util.h

Index: chrome/browser/extensions/extension_tab_util.h
diff --git a/chrome/browser/extensions/extension_tab_util.h b/chrome/browser/extensions/extension_tab_util.h
index 4e8e5c68c984d61c51057d08d14cbd91d92fa09d..5c856d9cf41aa4b98344de6989ef0b48f9dee99b 100644
--- a/chrome/browser/extensions/extension_tab_util.h
+++ b/chrome/browser/extensions/extension_tab_util.h
@@ -72,6 +72,14 @@ class ExtensionTabUtil {
       int tab_index,
       IncludePrivacySensitiveFields include_privacy_sensitive_fields);
 
+  // Remove any privacy-sensitive fields from a Tab object or event info
+  // dictionary, if the extension does not have the tabs permission.  Returns a
+  // new dictionary value; the input update_info dictionary is left unmodified.
+  static base::DictionaryValue* ScrubTabValue(
+      const content::WebContents* contents,
+      const extensions::Extension* extension,
+      const base::DictionaryValue* update_info);
+
   // Gets the |tab_strip_model| and |tab_index| for the given |web_contents|.
   static bool GetTabStripModel(const content::WebContents* web_contents,
                                TabStripModel** tab_strip_model,