[qt/qt/qtwebengine-chromium]: Summary of bulk changes made

Git repository change summary for qt/qt/qtwebengine-chromium
Pushed by mirror-service into branch '140-based'.
Changed from 68a4c08d7100f3ab7dc9a9af0df6fb44ebf4481d to 622496e7e1bf702c1312c943d27f09f2f8017281
Acknowledgement was received that this change introduces only existing code that has been pushed to another public open source repository.

This change contains the following new commits:

Git commit 5cc13a92363e57cfeaadf5629d9f692b19d739bc by Michal Klocek (on behalf of Vladimir Levin) on 17/07/2026 at 07:22..
[backport] CVE-2026-13790: Side-channel information leakage in Scroll

Reland "STTF: Delay sttf until related pages are finalized."

Fixed the test.

Original reason for revert: TextFragmentAnchorTest.AvoidScrollingIfHasOtherRelatedPages failed at https://ci.chromium.org/ui/p/chromium/builders/ci/Linux%20UBSan%20Tests/15610/overview

Original change's description:
> STTF: Delay sttf until related pages are finalized.
>
> This patch delays sttf until related pages are finalized. It also
> sends the browser-authoritative bool indicating whether there are
> related pages associated with this renderer.
>
> [email protected]
>
> Change-Id: Ifc03488451bd3d1e99c4ab447362437778ddf96d
> Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7629937
> Reviewed-by: Rakina Zata Amni <[email protected]>
> Commit-Queue: Vladimir Levin <[email protected]>
> Reviewed-by: Ken Buchanan <[email protected]>
> Reviewed-by: Ari Chivukula <[email protected]>
> Cr-Commit-Position: refs/heads/main@{#1625391}

Bug: 457771782
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7818478
Task-number: QTBUG-147883
Change-Id: I9a36bfc18d12af87e96880bd565e670a2c9068ff
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753036
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/5cc13a92363e57cfeaadf5629d9f692b19d739bc

Git commit 7996c88dcafb577a730da59a5c4b12a6f682cf24 by Michal Klocek (on behalf of Min Qin) on 17/07/2026 at 07:22..
[backport] CVE-2026-13791: Insufficient validation of untrusted input in Downloads

Enforce resolved-path containment for downloads to prevent symlink traversal

This CL changes ValidatePathAndResolveConflicts() to ensure it will only
return a file path that is under default download dir or fallback dir.

Bug: 503850012
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7854993
Task-number: QTBUG-147883
Change-Id: I266b04f9621a787df0855e30c305b6c861e740d8
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753037
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/7996c88dcafb577a730da59a5c4b12a6f682cf24

Git commit 9384413b6d7a02a1bbc3e17b5b3c198312e8d1ce by Michal Klocek (on behalf of Philip Rogers) on 17/07/2026 at 07:22..
[backport] CVE-2026-13793: Insufficient policy enforcement in SVG

Fix cross-origin image leak in SVG masks

This CL fixes a privacy leak where cross-origin images used inside
<mask> elements were incorrectly rendered into <canvas>.

Fixed: 510829679
Bug: 512516331
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7841426
Task-number: QTBUG-147883
Change-Id: Ibaed202157c13fcf42cb01b71fa92140d872a1ed
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753038
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/9384413b6d7a02a1bbc3e17b5b3c198312e8d1ce

Git commit cc5f84fc95febd407f5021df50008d873dc94358 by Michal Klocek (on behalf of Allen Bauer) on 17/07/2026 at 07:23..
[backport] CVE-2026-13802: Use after free in Views

Check for MenuController(this) deletion after ShowAt() call.

It is possible that the ShowAt() above can synchronously re-enter and
destroy `this` and the entire MenuItemView tree. We do a CHECK() here
instead of a early return. There are still other things up the stack
that would require additional guarding. It is also unknown what state
things would be left in should it be allowed to continue.

Bug: 501623322
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7849124
Task-number: QTBUG-147883
Change-Id: Ie49260fcd60e68b828a081041611392649bf29a8
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753040
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/cc5f84fc95febd407f5021df50008d873dc94358

Git commit 65a9569744ec87c5e6ace821ab8c867da5d5315f by Michal Klocek (on behalf of Peter KH) on 17/07/2026 at 07:23..
[backport] CVE-2026-13806: Insufficient validation of untrusted input in Accessibility

Make DidCommitNavigation() crash if in-use embedding token is passed

This CL makes RenderFrameHostImpl::DidCommitProvisionalLoad() kill the
renderer if an in-use embedding token is passed in
mojom::DidCommitProvisionalLoadParams::embedding_token.

Bug:503333798
TEST=SecurityExploitBrowserTest.AttemptUseStolenEmbedderToken

Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7841613
Task-number: QTBUG-147883
Change-Id: I15fca4c66e1324ce28b64f28cf28018d52ce2322
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753041
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/65a9569744ec87c5e6ace821ab8c867da5d5315f

Git commit 5b2b78e486fb1d375334f5dbb5e3663309d4f54f by Michal Klocek (on behalf of Tom Anderson) on 17/07/2026 at 07:23..
[backport] CVE-2026-13810: Inappropriate implementation in Input

Guard user activation against empty IME events

On Linux platforms, window focus events trigger the display server or
compositor (via IME frameworks like IBus/Fcitx or zwp_text_input_v3) to
send state-clearing preedit/reset events with an empty string.

Historically, WebInputMethodControllerImpl::SetComposition and
CommitText unconditionally triggered local frame UserActivation (with
kInteraction), allowing window focus/creation to erroneously grant
transient and sticky user activation. This bypassed user gesture
security checks and enabled silent password exfiltration under XSS.

This CL prevents user activation from triggering when the incoming IME
text is empty. We also add a unit test to verify that empty IME
composition and commit events do not elevate user activation, while
non-empty events do.

Bug: 504600482
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7868631
Task-number: QTBUG-147884
Change-Id: I82444a21888d4e61fe1a8cf75871ed47b18d1aef
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753042
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/5b2b78e486fb1d375334f5dbb5e3663309d4f54f

Git commit 979b19bcf523ef4643c3171177f642d0efa97a98 by Michal Klocek (on behalf of Allen Bauer) on 17/07/2026 at 07:23..
[backport] CVE-2026-13814: Use after free in Views

Check for MenuController deletion in OnMouseReleased.

In the rare, off-chance that an Accessibility tool causes the
MenuController to be deleted while in OnMouseReleased, check for that
case and exit immediately. This guards against a potential UaF of
"this".

Bug: 511712766
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7839811
Task-number: QTBUG-147884
Change-Id: Icdd4898c7ca38d00ac9839f4b8e48b86830ca92b
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753044
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/979b19bcf523ef4643c3171177f642d0efa97a98

Git commit 6709ecc810a97d6173484ad3f5cfb5d1a10a22ef by Michal Klocek (on behalf of Devlin Cronin) on 17/07/2026 at 07:24..
[backport] CVE-2026-13824: Insufficient validation of untrusted input in Extensions (1/2)

Properly respect FrameIterationAction in ScriptExecutor

ScriptExecutor called into ForEachRenderFrame and meant to be using
a RenderFrameHost::FrameIterationAction, but it wasn't doing so
properly. Fix this.

Bug: 513177497
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7857934
Task-number: QTBUG-147884
Change-Id: I14ba61997a998bcedcf8c98aa47c0fff2e162020
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753047
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/6709ecc810a97d6173484ad3f5cfb5d1a10a22ef

Git commit dd9a98c9a9c9d9f406bc0a6f3cbb69f24c4eb12c by Michal Klocek (on behalf of Devlin Cronin) on 17/07/2026 at 07:24..
[backport] CVE-2026-13824: Insufficient validation of untrusted input in Extensions (2/2)

Better track uncommitted frames in ScriptInjectionTracker

ScriptInjectionTracker tracks when extensions run scripts in various
processes so that we can determine if a request from that process is
legitimate.

When an extension requests a script execution in all frames in a frame
tree, it's possible that some of those frames haven't yet committed. In
this case, today, we send down the script injection to the renderer,
which will evaluate whether the script should inject once the frame
commits -- even though the script might not inject. However, we mark
the process as having had a script injected into it at this point, since
the script *may* run.

Instead of doing this, treat uncommitted subframes as though they were
about:blank in determining if a script can inject in the browser. This
matches what the renderer would do when the script arrives.

For this, we consider a number of situations with a slow-committing
frame.
1) Assume an extension with access to a.com, and a page, a.com, with
   an embedded frame to b.com, which itself has an embedded frame to
   b.com/slow. The extension injects into all frames.

   The frame with b.com/slow is hosted in the process for b.com. The
   extension script will never run in this frame, so the process
   should not be tracked in the ScriptInjectionTracker.

   This injection behaved properly before this CL, but the tracking
   incorrectly assumed the extension would inject into the b.com frame.
   This is fixed because when evaluating whether to inject in the
   uncommitted b.com/slow page, we compare it to its parent's /
   initiator's origin, which is b.com, which the extension does not have
   access to.
2) Assume an extension with access to a.com, and a page, a.com, with
   an embedded frame directly to b.com/slow. The extension tries to
   inject into the subframe.

   The frame with b.com/slow is initially hosted in the process for
   a.com until it commits. In this case, the extension script *may* run
   in the initial empty document for the b.com/slow frame (before it
   commits), since the parent / initiator is a.com. In this case, we
   will mark the script as having injected in a.com's process, since it
   may do so if it arrives before the frame commits. It should not run
   in b.com's process, and that process should not be tracked in the
   ScriptInjectionTracker.

   This is behavior is unchanged with this CL.
3) Assume an extension with access to a.com, and a page, b.com, with
   an embedded frame to a.com/slow (the extension has access to the
   subframe, but not the parent). The extension tries to inject into
   the frame.

   Behavior today, assuming:
   a) a.com/slow commits before we check the frames on the browser
      side. The extension injects into a.com/slow because it has access.
   b) a.com/slow commits after the script is sent to the renderer. The
      extension does *not* inject into the frame; the frame does a frame
      and process swap, and the script is dropped.

   This behavior is unchanged in this CL.
4) Assume an extension with access to foo.a.com, but *not* a.com, and a
   page to a.com with a frame to foo.a.com/slow. The extension tries to
   inject into all frames.

   This is a special variant of 3), above. In this case, the navigation
   is cross-origin, but same-site, so we don't undergo a render frame
   or process swap.

   Behavior today, assuming:
   a) foo.a.com/slow commits before we check the frames on the browser
      side. The extension injects into foo.a.com/slow because it has
      access.
   b) foo.a.com/slow commits after the script arrives in the renderer.
      The extension does *not* inject into the frame; there is a
      document swap (even though there is no render frame swap, since
      this is a cross-origin, same-site navigation), and we drop any
      pending scripts on document swaps.
   c) foo.a.com/slow commits after the script is *sent* to the
      renderer, but before the script *arrives* in the renderer. The
      extension injects in the frame.

   Behavior after this CL:
   a) Unchanged.
   b) Unchanged.
   c) The extension will *no longer inject* in this case. This only
      affects this specific scenario of a subframe, in a parent document
      to which the extension doesn't have access, in a cross-origin,
      same-site navigation, when the extension script is sent from the
      browser before commit, and arrives in the browser after commit.
      This flow is inherently racy, and will break in the future when
      we force render frame swaps for cross-origin, same-site
      navigations.

Tests for 1), 2), and 4b) have been added as part of this CL. 4c) is
now identical behavior to 4b), in practice, since the evaluation on the
browser side is the same (and forcing an IPC message race is
challenging). We rely on existing test coverage for other scenarios.

Cq-Include-Trybots: luci.chromium.try:linux-oi-rel
Bug: 513177497
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7857379
Task-number: QTBUG-147884
Change-Id: I76754944cf5c02cca83d1b8be1f2bb1a433033bd
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753048
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/dd9a98c9a9c9d9f406bc0a6f3cbb69f24c4eb12c

Git commit fcd1bc947bb3fa833c5caaeada7c8cd389bb0525 by Michal Klocek (on behalf of Kyle Charbonneau) on 17/07/2026 at 07:24..
[backport] CVE-2026-13825: Uninitialized Use in Dawn

Trim data returned for VkPipelineCache

vkCreateGraphicsPipeline() can write less data than the allocated blob
stores. If that happens shrink the blob to match the size written.

Also if VulkanIncompletePipelineCacheWorkaround is triggered then ensure
it's not stored into the cache. The data is suspected to be corrupted if
the workaround triggers.

Bug: 513209610
Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/308856
Task-number: QTBUG-147884
Change-Id: I4490dcecdd2a5a18d3118557d8fe233f37ac2ac8
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753049
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/fcd1bc947bb3fa833c5caaeada7c8cd389bb0525

Git commit 529eed16d51804d933939e3a6c6c2909e46567cc by Michal Klocek (on behalf of vikas soni) on 17/07/2026 at 07:42..
[Backport] CVE-2026-13775: Use after free in GPU (1/9)

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/6909990:
[DCSI] Add SharedMemoryCopyStrategy.

This CL introduces a new copy strategy to handle copy between backings
where one of the backings is of type SharedMemory.

The SharedMemoryCopyStrategy implements two copy paths:
1. From SharedMemory to another backing: It retrieves the SkPixmaps
   from the SharedMemoryImageBacking and calls UploadFromMemory() on the
   destination backing.

2. From another backing to SharedMemory: It retrieves the SkPixmaps
   from the destination SharedMemoryImageBacking and calls
   ReadbackToMemory() on the source backing.

This provides a copy strategy for the SharedImageCopyManager to use
in CompoundImageBacking to copy between shm and gpu backing.

A unit test is added to SharedImageCopyManagerTest to verify the new
strategy's behavior.

Bug: 434215964
Change-Id: I8fba46900862e6ae6b3f06c765b40c33710df31b
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6909990
Commit-Queue: vikas soni <[email protected]>
Reviewed-by: Vasiliy Telezhnikov <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1510419}
Task-number: QTBUG-147859
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/752132
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/529eed16d51804d933939e3a6c6c2909e46567cc

Git commit 17c162a3462c9239472a1b6e67a9e17a90ef2fa4 by Michal Klocek (on behalf of vikas soni) on 17/07/2026 at 07:43..
[Backport] CVE-2026-13775: Use after free in GPU (2/9)

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/6909626:
[DCSI] Use SharedImageCopymanager in CompoundImageBacking.

This CL updates CompoundImageBacking to use SharedImageCopyManager for
copies between its shared memory and GPU backings.

To enable this:
- SharedImageFactory creates a ref_counted SharedImageCopyManager,
  populating it with copy strategies.
- CompoundImageBacking receives a scoped_refptr to the
  SharedImageCopyManager from the factory.

This change centralizes the copy logic, allows CompoundImageBacking to
use SharedImageCopymanager, and makes the system more extensible for
future copy strategies.

Bug: 441900741
Change-Id: I346022ee601c4d6820c4c37e916077fa7026549b
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6909626
Reviewed-by: Vasiliy Telezhnikov <[email protected]>
Commit-Queue: vikas soni <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1510603}
Task-number: QTBUG-147859
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/752133
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/17c162a3462c9239472a1b6e67a9e17a90ef2fa4

Git commit 1f86ec385736e1cb93f388858e1de91744ddd15c by Michal Klocek (on behalf of vikas soni) on 17/07/2026 at 07:43..
[Backport] CVE-2026-13775: Use after free in GPU (3/9)

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/6900637:
[DCSI] Move CompoundImageBacking creation logic into the backing.

This CL refactors the creation logic of CompoundImageBacking and adds a
weak_ptr to SharedImageFactory.

It introduces a new static method, `CompoundImageBacking::Create()`,
which encapsulates the logic for finding a suitable GPU backing factory
and validating the shared memory buffer format.

This is needed as a part of DCSI work where in future
CompoundImageBacking eventually will be the only backing which will be
created by SharedImageFactory.

During initial backing creation time, CompoundImageBacking will then
internally find suitable backing or combination of multiple backings
which could satisfy all the initial shared image usage requirements.

It will also be able to allocate new backings on the fly after initial
backing creation time. CompoundImageBacking now holds a weak_ptr to
SharedImageFactory to be able to do that by querying appropriate
SharedImageBackingFactory when needed.

Note that Existing CompoundImageBacking::CreateSharedMemory() methods
are renamed as CompoundImageBacking::CreateSharedMemoryForTesting() in
order to avoid test changes. Future Cls will merge
CompoundImageBacking::Create() and
CompoundImageBacking::CreateSharedMemoryForTesting().

Bug: 441900741
Change-Id: Ic6c5f8cc5c78dcf8b730cf9ce33c45de9ff2f63a
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6900637
Commit-Queue: vikas soni <[email protected]>
Reviewed-by: Vasiliy Telezhnikov <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1510651}
Task-number: QTBUG-147859
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/752134
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/1f86ec385736e1cb93f388858e1de91744ddd15c

Git commit a24f8adbcff1a1b4abe00d231be5a43a30a399d7 by Michal Klocek (on behalf of vikas soni) on 17/07/2026 at 07:43..
[Backport] CVE-2026-13775: Use after free in GPU (4/9)

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/6910982:
[DCSI] Refactor CompoundImageBacking access logic to be backing-centric.

This CL refactors the access notification and content synchronization
logic within `CompoundImageBacking` to be more modular and robust which
allows it to copy data from backing with the latest content to the
backing which is being accessed.

The primary change is to make these operations backing-centric rather
than stream-centric. Previously, access was tracked via the
`SharedImageAccessStream`. Now, the specific `SharedImageBacking`
instance being accessed is used instead since multiple backings can
support same AccessStream. This provides a more precise and flexible
foundation for managing content across different backings.

Key changes:
 1. `NotifyBeginAccess` now accepts a `SharedImageBacking*` instead of a   `SharedImageAccessStream`, allowing for accurate control given the fact that multiple backings can support same access stream.

2. Content synchronization logic is centralized within
`NotifyBeginAccess`, which handles copying from the element with the
latest content to the element being accessed if element does not already
have the latest content.

3. A new `GetElementWithLatestContent()` method has been introduced to
find the element with the latest data/content_id. This is needed to find
the backing from which the copy will be done to currently accessed
backing.

4. `GetBacking()` is updated to preferably return a backing with the
latest content id corresponding to the given access stream. Else return
any backing which can support the access stream Or null otherwise. This
method will be updated in future to also allocate a new backing if no
such backing is found.

This refactoring simplifies the access logic and improves correctness
without changing existing behavior. The current implementation still
allocates both a shared memory and a GPU backing at initialization.

Bug: 441908433
Change-Id: Ibd302dc380be09275025ca8ca0a061debf16843d
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6910982
Reviewed-by: Vasiliy Telezhnikov <[email protected]>
Commit-Queue: vikas soni <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1512522}
Task-number: QTBUG-147859
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/752135
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/a24f8adbcff1a1b4abe00d231be5a43a30a399d7

Git commit a0698a948bdaf7e5047ab69f3cd299d58d8d377b by Michal Klocek (on behalf of vikas soni) on 17/07/2026 at 07:43..
[Backport] CVE-2026-13775: Use after free in GPU (5/9)

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/7022772:
[DCSI] Make SharedImageCopyManager RefCountedThreadSafe.

This CL makes SharedImageCopyManager RefCountedThreadSafe. This allows
the manager to be created and destroyed on different threads. This is
required since CompoundImageBacking has a ref on it and backing can be
created and destroyed on different threads.

Bug: 448962784
Change-Id: I05850dbeb6f036930b56c0ffb35cfc161b67f5e4
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7022772
Reviewed-by: Vasiliy Telezhnikov <[email protected]>
Commit-Queue: vikas soni <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1527085}
Task-number: QTBUG-147859
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/752136
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/a0698a948bdaf7e5047ab69f3cd299d58d8d377b

Git commit 58e26526c8baa3092ae2cb0f80fb769283147c4d by Michal Klocek (on behalf of vikas soni) on 17/07/2026 at 07:44..
[Backport] CVE-2026-13775: Use after free in GPU (6/9)

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/6917219:
[DCSI] CompoundImageBacking supports on-demand backing allocations.

This CL enhances `CompoundImageBacking` to support on-demand allocation
of GPU backings, making it more dynamic and memory-efficient.

Previously, `CompoundImageBacking` was only limited to allocate backings
during construction time based on intiail shared image usage set. If a
new usage is requested by client which can not be supported by existing
backings, it returned null. This change introduces logic to create new
backings at runtime when a representation is requested for an access
stream that has no corresponding backing.

Key changes:
 - `GetBacking()` has been renamed to `GetOrAllocateBacking()` to
 reflect its new capabilities.
 - A new helper function, `GetUsageFromAccessStream()`, has been
 added to map a `SharedImageAccessStream` to the appropriate
`SharedImageUsageSet`.
 - `GetOrAllocateBacking()` now uses this usage set to query the
`SharedImageFactory` for a suitable backing factory and create a new
 element on the fly.
 - Added CHECKs to ensure that there is at most one shared memory element.

This change lays the groundwork for a more flexible
`CompoundImageBacking` that can adapt to different usage scenarios
without upfront allocation of all potential backings.

The logic to allocate backings dynamically is behind a feature flag
and is disabled for now until the SharedImageCopyManager is ready
with all existing gpu-gpu copy logic.

Bug: 441908433
Change-Id: I2dfe65cfc350f36a928fa06b1a3c893aa2f24958
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6917219
Commit-Queue: vikas soni <[email protected]>
Reviewed-by: Vasiliy Telezhnikov <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1512610}
Task-number: QTBUG-147859
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753319
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/58e26526c8baa3092ae2cb0f80fb769283147c4d

Git commit bf0a1949e8c2552ed63b489963f3f67694460cd3 by Michal Klocek (on behalf of vikas soni) on 17/07/2026 at 07:44..
[Backport] CVE-2026-13775: Use after free in GPU (7/9)

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/7630881:
[DCSI]: Fix dynamic backing allocation in CompoundImageBacking.

This change fixes an issue where CompoundImageBacking's dynamic
backing allocation would fail for certain usage combinations.
Specifically, it ensures that the correct, stream-specific usage
is passed to the SharedImageBackingFactory when creating a new
backing dynamically.

Previously, the overall usage of the CompoundImageBacking was
used, which could cause IsSupported checks to fail if the
original usage was incompatible with the dynamically required
backing type.

This change modifies CreateBackingFromBackingFactory to accept a
SharedImageUsageSet parameter, allowing GetOrAllocateBacking
to provide the correct stream-specific usage.

Bug: 475210055
Change-Id: I79c8f1a217a45dcb0c8b7fe0b2248092fb0838ab
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7630881
Reviewed-by: Vasiliy Telezhnikov <[email protected]>
Commit-Queue: Vikas Soni <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1594168}
Task-number: QTBUG-147859
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753320
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/bf0a1949e8c2552ed63b489963f3f67694460cd3

Git commit 04c1235dc6d4814f537b2e79e66f79039f68e0c2 by Michal Klocek (on behalf of vikas soni) on 17/07/2026 at 07:44..
[Backport] CVE-2026-13775: Use after free in GPU (8/9)

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/7793608:
[Security]: Fix cross-thread UAF in CompoundImageBacking.

CompoundImageBacking holds a base::WeakPtr<SharedImageFactory> to
support dynamic backing allocations. When dynamic allocation is enabled
for thread-safe backings (e.g., DrDc, WebNN), GetOrAllocateBacking() may
run on a different thread and dereference this WeakPtr. Since
base::WeakPtr is not thread-safe for off-sequence dereferencing, this
creates a race condition and a potential heap-use-after-free if the
SharedImageFactory is destroyed on the GPU main thread simultaneously.

This CL introduces SharedImageFactoryRef, a thread-safe, ref-counted
holder for SharedImageFactory. It uses a base::Lock to coordinate access
and destruction. SharedImageFactory now manages a SharedImageFactoryRef
and invalidates it in its destructor. CompoundImageBacking uses this
holder to safely execute allocation logic on different threads, ensuring
the factory remains valid during the operation or bails out safely if it
has been destroyed.

Bug: 497136403
Change-Id: I2f567709a46f5d7accc66e2e86581dbe8b77d0b7
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7793608
Commit-Queue: vikas soni <[email protected]>
Reviewed-by: Vasiliy Telezhnikov <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1622511}
Task-number: QTBUG-147859
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/752137
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/04c1235dc6d4814f537b2e79e66f79039f68e0c2

Git commit 622496e7e1bf702c1312c943d27f09f2f8017281 by Michal Klocek (on behalf of vikas soni) on 17/07/2026 at 07:44..
[Backport] CVE-2026-13775: Use after free in GPU (9/9)

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/7838134:
[GPU Security]: Fix thread-safety issues in CompoundImageBacking.

This CL addresses potential security vulnerabilities where a raw
SharedImageBackingFactory pointer could escape the synchronization scope
or a thread-affine WeakPtr be used across threads.

The fix involves:

1. Moving dynamic backing allocation logic entirely inside the
SharedImageFactoryRef::Execute lambda in GetOrAllocateBacking.

2. Consolidating backing creation into a single method that assumes the
factory lock is held.

3. Updating the lazy allocation callback to use SharedImageFactoryRef to
safely look up the correct factory by type under lock.

4. Adding SharedImageFactory::GetFactoryByType to support safe lookup.

These changes ensure that all factory-dependent operations in
CompoundImageBacking are performed under the factory lock and are
thread-safe.

Bug: 511766407
Change-Id: Iab94d024f7cb5c43e17a4237f5572c80bf96b373
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7838134
Reviewed-by: Vasiliy Telezhnikov <[email protected]>
Commit-Queue: vikas soni <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1629530}
Task-number: QTBUG-147859
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/752138
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/622496e7e1bf702c1312c943d27f09f2f8017281