Don't focus the location bar in a phishy situation.

chrome/browser/ui/browser_focus_uitest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <stddef.h>
 
 #include "base/bind.h"
 #include "base/files/file_util.h"
 #include "base/format_macros.h"
 #include "base/macros.h"
@@ skipping 720 matching lines @@
     content::WindowedNotificationObserver forward_nav_observer(
         content::NOTIFICATION_NAV_ENTRY_COMMITTED,
         content::NotificationService::AllSources());
     chrome::GoForward(browser(), CURRENT_TAB);
     forward_nav_observer.Wait();
   }
 
   EXPECT_FALSE(IsViewFocused(VIEW_ID_OMNIBOX));
 }
 
+// Ensure that crbug.com/567445 does not regress.
+IN_PROC_BROWSER_TEST_F(BrowserFocusTest, AboutBlankNavigationLocationTest) {
+  ui_test_utils::NavigateToURL(browser(),
+                               embedded_test_server()->GetURL("/title1.html"));
+
+  const char kSpoofScript[] =
+      "var w = window.open('about:blank');"
+      "w.opener = null;"
+      "w.document.location = '%s';";
+
+  TabStripModel* tab_strip = browser()->tab_strip_model();
+  WebContents* web_contents = tab_strip->GetActiveWebContents();
+
+  ASSERT_TRUE(content::ExecuteScript(
+      web_contents,
+      base::StringPrintf(
+          kSpoofScript,
+          embedded_test_server()->GetURL("/title2.html").spec().c_str())));
+  EXPECT_FALSE(web_contents->GetController().GetPendingEntry());

[Charlie Reis, 2016/02/12 23:43:47]

I don't think you don't need this line.  Technically there will be a pending
entry during the popup's navigation.

[palmer, 2016/02/23 00:37:59]

Done.

+  EXPECT_EQ(embedded_test_server()->GetURL("/title1.html"),
+            web_contents->GetVisibleURL());

[Charlie Reis, 2016/02/12 23:43:47]

Hmm, this isn't the WebContents where the spoof happens.  There's a separate
popup WebContents that we have to wait for (and wait for it to finish
navigating).

[palmer, 2016/02/23 00:37:59]

Following the example of other code in this file, I added:

  ASSERT_NO_FATAL_FAILURE(content::WaitForLoadStop(
      browser()->tab_strip_model()->GetActiveWebContents()));

+  EXPECT_FALSE(IsViewFocused(VIEW_ID_OMNIBOX));

[Charlie Reis, 2016/02/12 23:43:47]

Which window is this checking?  Is the test opening the popup in the same window
or a different one?  (I'm not sure if you need the popup to be in a new window
for the attack to succeed.  If so, you might need to specify the size in the
window.open call.)

[palmer, 2016/02/23 00:37:59]

I think the core problem is that the Omnibox is focused for editing, not so much
that it's a particular size. The size arguments in the example spoof 
seem to be just for tuning the attack to get the right text scrolled to the
leading-most edge. I could be wrong though.

+}
+
 }  // namespace