void PerformanceNavigationTiming::Trace(blink::Visitor* visitor) {
  ContextClient::Trace(visitor);
  PerformanceResourceTiming::Trace(visitor);
}

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.