Don't focus the location bar in a phishy situation.

content/browser/web_contents/web_contents_impl.cc

Index: content/browser/web_contents/web_contents_impl.cc
diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
index 58fc9d2d4cf14365137590e9204cbe7462f12e2d..42c0f997cccb1bfdf038b2b8242614dbbfeec5af 100644
--- a/content/browser/web_contents/web_contents_impl.cc
+++ b/content/browser/web_contents/web_contents_impl.cc
@@ -2932,9 +2932,16 @@ void WebContentsImpl::ResumeLoadingCreatedWebContents() {
 }
 
 bool WebContentsImpl::FocusLocationBarByDefault() {
-  NavigationEntry* entry = controller_.GetVisibleEntry();
-  if (entry && entry->GetURL() == GURL(url::kAboutBlankURL))
+  // If we are starting at about:blank, give the omnibox focus to let the user
+  // easily edit it.  We intentionally check the pending entry rather than the
+  // visible one, since we don't want to be tricked by non-visible pending URLs.
+  // See https://crbug.com/567445.

[Peter Kasting, 2016/03/03 21:02:19]

Nit: I'd prefer to explain sufficiently inline that we don't need the bug
reference.  This way a reader doesn't need to go anywhere else to understand
this sufficiently.

Maybe something like this:

When the browser is started with about:blank as the startup URL, focus the
location bar (which will also select its contents) so users can simply begin
typing to navigate elsewhere.

We need to be careful not to trigger this for anything other than the startup
navigation.  In particular, if we allow an attacker to open a popup to
about:blank, then navigate, focusing the omnibox will cause the end of the new
URL to be scrolled into view instead of the start, allowing the attacker to
spoof other URLs.  The conditions checked here are all aimed at ensuring no such
attacker-controlled navigation can trigger this.

Note that we check the pending entry instead of the visible one; for the startup
URL case these are the same, but for the attacker-controlled navigation case the
visible entry is the committed "about:blank" URL and the pending entry is the
problematic navigation elsewhere.

[palmer, 2016/03/04 22:15:57]

Done.

+  NavigationEntryImpl* entry = controller_.GetPendingEntry();
+  if (controller_.IsInitialNavigation() && entry &&
+      !entry->is_renderer_initiated() &&
+      entry->GetURL() == GURL(url::kAboutBlankURL)) {
     return true;
+  }
   return delegate_ && delegate_->ShouldFocusLocationBarByDefault(this);
 }