 bool IsAppsShortcutEnabled(Profile* profile) {
  if (profile->IsLegacySupervised())
    return false;

#if defined(USE_ASH)
  return false;
#else
  return search::IsInstantExtendedAPIEnabled() && !profile->IsOffTheRecord();
#endif
}

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.