Non-web-accessible extension URLs should not load in non-extension processes

chrome/renderer/extensions/resource_request_policy.cc

Index: chrome/renderer/extensions/resource_request_policy.cc
diff --git a/chrome/renderer/extensions/resource_request_policy.cc b/chrome/renderer/extensions/resource_request_policy.cc
index 194ae25e1fe06b93b1cb824c70cbaee338fc8eeb..9f8e33656ca75586ddb921c40f22aed2a256ddd3 100644
--- a/chrome/renderer/extensions/resource_request_policy.cc
+++ b/chrome/renderer/extensions/resource_request_policy.cc
@@ -23,6 +23,12 @@
 
 namespace extensions {
 
+// This method does a security check whether chrome-extension:// URLs can be
+// requested by the renderer. Since this is in an untrusted process, the browser
+// has a similar check to enforce the policy, in case this process is exploited.
+// If you are changing this function, ensure equivalent checks are added to
+// extension_protocols.cc AllowExtensionResourceLoad.
+
 // static
 bool ResourceRequestPolicy::CanRequestResource(
     const GURL& resource_url,