Allow the MITIGATION_WIN32K_DISABLE process mitigation to be set in the renderer sandbox.

content/common/sandbox_win.cc

Index: content/common/sandbox_win.cc
diff --git a/content/common/sandbox_win.cc b/content/common/sandbox_win.cc
index 7c3048aadbb477209d5a63b44b2f845bc33378ae..9e56fed6cbe0be48602574f7fab9278a92c49af1 100644
--- a/content/common/sandbox_win.cc
+++ b/content/common/sandbox_win.cc
@@ -602,6 +602,13 @@ base::ProcessHandle StartSandboxedProcess(
                                          sandbox::MITIGATION_DEP_NO_ATL_THUNK |
                                          sandbox::MITIGATION_SEHOP;
 
+ if (base::win::GetVersion() >= base::win::VERSION_WIN8 &&
+     type_str == switches::kRendererProcess &&
+     browser_command_line.HasSwitch(
+        switches::kEnableWin32kRendererLockDown)) {
+   mitigations |= sandbox::MITIGATION_WIN32K_DISABLE;
+ }
+
   if (policy->SetProcessMitigations(mitigations) != sandbox::SBOX_ALL_OK)
     return 0;