Don't send saved password domain

components/safe_browsing/csd.proto

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 //
 // This proto file includes:
 // (1) Client side phishing and malware detection request and response
 //   protocol buffers.  Those protocol messages should be kept in sync
 //   with the server implementation.
 //
 // (2) Safe Browsing reporting protocol buffers.
@@ skipping 190 matching lines @@
       // Whether the form contains password field.
       optional bool has_password_field = 2;
     }
 
     repeated Form forms = 6;
   }
 
   repeated Frame frames = 3;
 
   // The message contains fields needed for a password reuse event.
+  // Next tag: 3
   message PasswordReuseEvent {
-    // Origins that the reused password had been used on. The origins are
-    // maintained by Chrome password manager.
-    // The field is filled in only when TriggerType is PASSWORD_REUSE_EVENT.
-    repeated string password_reused_original_origins = 1;
+    reserved 1;
 
     // The frame that the password reuse is detected.
     optional int32 frame_id = 2;

[Nathan Parker, 2017/05/22 19:50:31]

Also add this missing field:

// Whether the reused password is used for Chrome signin.
optional bool is_chrome_signin_password = 3;

[Jialiu Lin, 2017/05/22 20:02:41]

Done.

   }
 
   optional PasswordReuseEvent password_reuse_event = 4;
 
   // The number of verdicts stored on the client.
   optional int32 stored_verdict_cnt = 5;
 
   // Chrome user population.
   optional ChromeUserPopulation population = 6;
 }
@@ skipping 806 matching lines @@
 // There is no response (an empty body) to this request.
 message NotificationImageReportRequest {
   optional string notification_origin = 1;  // Src-origin of the notification.
   optional ImageData image = 2;             // The bitmap of the image.
 
   // Note that the image URL is deliberately omitted as it would be untrusted,
   // since the notification image fetch may be intercepted by a Service Worker
   // (even if the image URL is cross-origin). Otherwise a website could mislead
   // Safe Browsing into associating phishing image bitmaps with safe image URLs.
 }