[qt/qt/qtwebengine]: Summary of bulk changes made

Git repository change summary for qt/qt/qtwebengine
Pushed by mirror-service into branch 'dev'.
Changed from 75d30d937b6aaf0a9d6d14dd3739271c3eab5836 to 8a16089e7d4c9ad15e695a383921963b3196c9be
Acknowledgement was received that this change introduces only existing code that has been pushed to another public open source repository.

This change contains the following new commits:

Git commit dc577db3b62028befd08af0c5037dac628e0ebe5 by Michal Klocek on 16/07/2026 at 17:16..
Update Chromium

Submodule src/3rdparty fc3a1a76..fcce06d1:
* CVE-2026-10916: Insufficient validation of untrusted input in DevTools
* [backport] CVE-2026-9939: Heap buffer overflow in WebCodecs
* [fixup][backport] CVE-2026-7943
* [gnc][pdb] Allow optional disabling of symbols for mojo bindings
* [Backport] CVE-2026-10909: Use after free in Dawn
* [Backport] Dependency for CVE-2026-10909 (2/2)
* [Backport] Dependency for CVE-2026-10909 (1/2)
* [Backport] CVE-2026-10914: Use after free in ANGLE
* [Backport] CVE-2026-10913: Use after free in ANGLE
* [Backport] CVE-2026-10912: Insufficient validation of untrusted input in Extensions
* [Backport] Dependency for CVE-2026-10912
* [Backport] CVE-2026-11669: Integer overflow in Media
* [Backport] CVE-2026-11683: Use after free in WebCodecs
* [Backport] CVE-2026-11201: Use after free in ServiceWorker (2/2)
* [Backport] CVE-2026-11201: Use after free in ServiceWorker (1/2)
* [Backport] CVE-2026-12030: Heap buffer overflow GPU
* [Backport] CVE-2026-12017: Insufficient validation of untrusted input Extensions
* [Backport] CVE-2026-12018: Inappropriate implementation Mojo
* [Backport] CVE-2026-12023: Use after free GPU
* [Backport] CVE-2026-12012: Use after free Network
* [Backport] CVE-2026-12013: Use after free Media
* [Backport] CVE-2026-12016: Insufficient validation of untrusted input DevTools
* [Backport] CVE-2026-12019: Out of bounds write Codecs
* [Backport] CVE-2026-12025: Insufficient validation of untrusted input Network
* [Backport] CVE-2026-12026: Out of bounds read Video
* [Backport] CVE-2026-12031: Inappropriate implementation Views
* [Backport] CVE-2026-12033: Out of bounds read VideoCapture
* [Backport] CVE-2026-12035: Use after free Views
* [Backport] CVE-2026-12007: Use after free in Core
* [Backport] CVE-2026-12009: Insufficient validation of untrusted input in Accessibility
* [Backport] CVE-2026-12010: Heap buffer overflow in GPU
* [Backport] CVE-2026-12011: Use after free in WebMIDI
* [backport] CVE-2026-13024: Insufficient validation of untrusted input in Navigation (2/2)
* [backport] CVE-2026-13024: Insufficient validation of untrusted input in Navigation (1/2)
* [Backport] CVE-2026-11067: Uninitialized Use in Dawn (3/3)
* Support vector<bool> in ityp::vector
* [Backport] Dependency for CVE-2026-11067

Fixes: QTBUG-146589
Fixes: QTBUG-147249
Fixes: QTBUG-147294
Fixes: QTBUG-147296
Fixes: QTBUG-147297
Fixes: QTBUG-147298
Fixes: QTBUG-147417
Fixes: QTBUG-147420
Fixes: QTBUG-147421
Fixes: QTBUG-147422
Fixes: QTBUG-147423
Fixes: QTBUG-147424
Fixes: QTBUG-147425
Fixes: QTBUG-147426
Fixes: QTBUG-147428
Fixes: QTBUG-147429
Fixes: QTBUG-147430
Fixes: QTBUG-147431
Fixes: QTBUG-147435
Fixes: QTBUG-147436
Fixes: QTBUG-147437
Fixes: QTBUG-147438
Fixes: QTBUG-147439
Fixes: QTBUG-147440
Fixes: QTBUG-147441
Fixes: QTBUG-147557
Fixes: QTBUG-147555
Fixes: QTBUG-147702
Fixes: QTBUG-147703
Fixes: QTBUG-147704
Fixes: QTBUG-147759
Pick-to: 6.12 6.11
Change-Id: I97f7558f162f3ea6db8da25165182c9ee6d1d0f5
Reviewed-by: Michael Brüning <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine/-/commit/dc577db3b62028befd08af0c5037dac628e0ebe5

Git commit 4ab9df6d57c20cc2d754a6d78dce7a4af41699bd by Michal Klocek on 16/07/2026 at 17:16..
Update Chromium

Submodule src/3rdparty fcce06d1..216d5324:
* Revert "CVE-2026-10916: Insufficient validation of untrusted input in DevTools"
* [arm64] Fix QtWebEngine build on ARM64
* [Backport] CVE-2026-13903: Insufficient policy enforcement in Bluetooth
* [Backport] CVE-2026-13901: Insufficient validation of untrusted input in Serial
* [Backport] CVE-2026-13899: Use after free in HTML
* Add WebEngine example warning text to chrome://qt
* [Backport] CVE-2026-11696: Uninitialized Use in Video

Pick-to: 6.12 6.11
Change-Id: Ifefd71d5d557b708d55156c0d63d7bbf186cf251
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine/-/commit/4ab9df6d57c20cc2d754a6d78dce7a4af41699bd

Git commit fc55c13ad1653f2ca2e54b50556cd44ecd79d4e4 by Marc Mutz on 16/07/2026 at 17:16..
QPdfSearchModel: use QMetaEnum::fromType()

The old code used the virtual metaObject() function from within the
constructor, which always is a bit fishy, since it's not actually a
virtual function call in the constructor. In addition, the code
performed a job at runtime that can be performed at compile-time, so
do that: Use QMetaEnum::fromType().

As a drive-by, make the QMetaEnum const.

The roleNames() reimplementation doesn't include the
QAbstractListModel ones, filed QTBUG-148177 to keep track of the
issue.

Amends 0b6a4d94945a975390b2574e6aff2568ebb7f061 (5.15).

Pick-to: 6.12 6.11 6.8
Change-Id: I84d5b77243ebf1ba5b6c7469f97e1ab15206e401
Reviewed-by: Shawn Rutledge <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine/-/commit/fc55c13ad1653f2ca2e54b50556cd44ecd79d4e4

Git commit 8a16089e7d4c9ad15e695a383921963b3196c9be by Kaloyan Chehlarski on 16/07/2026 at 17:16..
Examples: Show example disclaimer in simplebrowser/quicknanobrowser

The text for the disclaimer is defined inside qt_version.html
inside the Chromium submodule.

Task-number: QTBUG-147681
Pick-to: 6.12 6.11 6.8
Change-Id: I37196589973204ecf97282ce9c84101869f1ad68
Reviewed-by: Allan Sandfeld Jensen <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine/-/commit/8a16089e7d4c9ad15e695a383921963b3196c9be