Added a new process mitigation to harden process token IL policy.

content/app/startup_helper_win.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/public/app/startup_helper_win.h"
 
 #include <crtdbg.h>
 #include <new.h>
 
 #include "base/base_switches.h"
@@ skipping 25 matching lines @@
 namespace content {
 
 void InitializeSandboxInfo(sandbox::SandboxInterfaceInfo* info) {
   info->broker_services = sandbox::SandboxFactory::GetBrokerServices();
   if (!info->broker_services) {
     info->target_services = sandbox::SandboxFactory::GetTargetServices();
   } else {
     // Ensure the proper mitigations are enforced for the browser process.
     sandbox::ApplyProcessMitigationsToCurrentProcess(
         sandbox::MITIGATION_DEP |
-        sandbox::MITIGATION_DEP_NO_ATL_THUNK);
+        sandbox::MITIGATION_DEP_NO_ATL_THUNK |
+        sandbox::MITIGATION_HARDEN_TOKEN_IL_POLICY);
   }
 }
 
 // Register the invalid param handler and pure call handler to be able to
 // notify breakpad when it happens.
 void RegisterInvalidParamHandler() {
   _set_invalid_parameter_handler(InvalidParameter);
   _set_purecall_handler(PureCall);
   // Also enable the new handler for malloc() based failures.
   _set_new_mode(1);
 }
 
 void SetupCRT(const base::CommandLine& command_line) {
 #if defined(_CRTDBG_MAP_ALLOC)
   _CrtSetReportFile(_CRT_WARN, _CRTDBG_FILE_STDERR);
   _CrtSetReportMode(_CRT_WARN, _CRTDBG_MODE_FILE);
 #else
   if (!command_line.HasSwitch(switches::kDisableBreakpad)) {
     _CrtSetReportMode(_CRT_ASSERT, 0);
   }
 #endif
 }
 
 }  // namespace content