Validate the Origin HTTP header in the browser process.

chrome/browser/chrome_content_browser_client.cc

Index: chrome/browser/chrome_content_browser_client.cc
diff --git a/chrome/browser/chrome_content_browser_client.cc b/chrome/browser/chrome_content_browser_client.cc
index 58d255514e25a13d91a188d267741fd5c76f6c82..e723e33b534c0de4acea9fe2b723a883e79b7ffa 100644
--- a/chrome/browser/chrome_content_browser_client.cc
+++ b/chrome/browser/chrome_content_browser_client.cc
@@ -993,6 +993,18 @@ bool ChromeContentBrowserClient::CanCommitURL(
 #endif
 }
 
+bool ChromeContentBrowserClient::IsIllegalOrigin(
+    content::ResourceContext* resource_context,
+    int child_process_id,
+    const GURL& origin) {
+#if defined(ENABLE_EXTENSIONS)
+  return ChromeContentBrowserClientExtensionsPart::IsIllegalOrigin(
+      resource_context, child_process_id, origin);
+#else
+  return false;
+#endif
+}
+
 bool ChromeContentBrowserClient::ShouldAllowOpenURL(
     content::SiteInstance* site_instance, const GURL& url) {
   GURL from_url = site_instance->GetSiteURL();