Allow the MITIGATION_WIN32K_DISABLE process mitigation to be set in the renderer sandbox.

content/common/sandbox_win.cc

Index: content/common/sandbox_win.cc
diff --git a/content/common/sandbox_win.cc b/content/common/sandbox_win.cc
index 7c3048aadbb477209d5a63b44b2f845bc33378ae..202c82170c4b31d96f99a176e79105ee9b4ebe11 100644
--- a/content/common/sandbox_win.cc
+++ b/content/common/sandbox_win.cc
@@ -602,6 +602,12 @@ base::ProcessHandle StartSandboxedProcess(
                                          sandbox::MITIGATION_DEP_NO_ATL_THUNK |
                                          sandbox::MITIGATION_SEHOP;
 
+ if (base::win::GetVersion() >= base::win::VERSION_WIN8 &&
+     type_str == switches::kRendererProcess &&
+     cmd_line->HasSwitch(switches::kEnableGDIUser32RendererLockDown)) {
+   mitigations |= sandbox::MITIGATION_WIN32K_DISABLE;
+ }
+
   if (policy->SetProcessMitigations(mitigations) != sandbox::SBOX_ALL_OK)
     return 0;