PlzNavigate: Do not disclose urls between cross-origin renderers.

content/browser/frame_host/render_frame_host_impl.cc

Index: content/browser/frame_host/render_frame_host_impl.cc
diff --git a/content/browser/frame_host/render_frame_host_impl.cc b/content/browser/frame_host/render_frame_host_impl.cc
index 2f7909aa9f906ebdb243e26e6322a4379a535aad..df0c13a5a2620ae3462a98974db07360a136c915 100644
--- a/content/browser/frame_host/render_frame_host_impl.cc
+++ b/content/browser/frame_host/render_frame_host_impl.cc
@@ -119,6 +119,7 @@
 #include "ui/accessibility/ax_tree_update.h"
 #include "ui/gfx/geometry/quad_f.h"
 #include "url/gurl.h"
+#include "url/origin.h"
 
 #if defined(OS_ANDROID)
 #include "content/browser/android/java_interfaces_impl.h"
@@ -973,6 +974,11 @@ void RenderFrameHostImpl::ReportContentSecurityPolicyViolation(
                                                          violation_params));
 }
 
+bool RenderFrameHostImpl::IsOriginSafeToUseInCspViolation(
+    const url::Origin& origin) const {
+  return origin.IsSameOriginWith(last_committed_origin_);
+}
+
 bool RenderFrameHostImpl::SchemeShouldBypassCSP(
     const base::StringPiece& scheme) {
   // Blink uses its SchemeRegistry to check if a scheme should be bypassed.