The cross-origin checks in the multibuffer code are not sufficient, as they only trigger when a red…

media/blink/url_index.h

Index: media/blink/url_index.h
diff --git a/media/blink/url_index.h b/media/blink/url_index.h
index be96858825b964904f5d8bd0ba24228c2970aef2..fb77ba90f441802310f99ddddc43e611a5096b21 100644
--- a/media/blink/url_index.h
+++ b/media/blink/url_index.h
@@ -97,6 +97,12 @@ class MEDIA_BLINK_EXPORT UrlData : public base::RefCounted<UrlData> {
   // this is not called regularly.
   void Use();
 
+  // Call this before we add some data to the multibuffer().
+  // If the multibuffer is empty, the data origin is set from
+  // |origin| and returns true. If not, it compares |origin|
+  // to the previous origin and returns wheather they match or not.
+  bool ValidateDataOrigin(const GURL& origin);
+
   // Setters.
   void set_length(int64_t length);
   void set_cacheable(bool cacheable);
@@ -148,6 +154,11 @@ class MEDIA_BLINK_EXPORT UrlData : public base::RefCounted<UrlData> {
   // the same url.
   const GURL url_;
 
+  // Origin of the data, should only be different from the url_.GetOrigin()
+  // when service workers are involved.
+  GURL data_origin_;
+  bool have_data_origin_;
+
   // Cross-origin access mode.
   const CORSMode cors_mode_;