[qt/qt/qtwebengine-chromium]: Summary of bulk changes made

Git repository change summary for qt/qt/qtwebengine-chromium
Pushed by mirror-service into branch '140-based'.
Changed from 15884c2fca5e2c8d8aa1985df6c80afe6bf01729 to 629f3cd4a03cc19793331521990a5d3c81bd7273
Acknowledgement was received that this change introduces only existing code that has been pushed to another public open source repository.

This change contains the following new commits:

Git commit 69b812701418f2c6cc08540b3eb41cd296f30591 by Michal Klocek (on behalf of haoyuewang) on 20/07/2026 at 08:54..
[backport] CVE-2026-13799: Use after free in QUIC

Maybe copy datagram frames in QuicUnackedPacketMap.

Protected by FLAGS_quic_reloadable_flag_quic_maybe_copy_datagram_frames.

PiperOrigin-RevId: 914318383

Upstream: https://quiche.googlesource.com/quiche.git/+/94742a8a93d3c0828fdd615e5ab5389ef77ba42e
Task-number: QTBUG-147883
Change-Id: I05ecc8f8ea000ce0e5ccf2da348fcd0a77625c70
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753039
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/69b812701418f2c6cc08540b3eb41cd296f30591

Git commit f0da7fb32bb2aec98930d90bde4a572b5d70973d by Michal Klocek (on behalf of Dave Tapuska) on 20/07/2026 at 08:55..
[backport] CVE-2026-13811: Use after free in IME

Add validity checks after frame_widget calls in IME methods.

Introduce ImeEventGuard::IsValid() to check if the associated WidgetBase
is still alive. Use this check in WidgetBase's SetComposition,
CommitText, and FinishComposingText methods after calling the
corresponding frame_widget methods. This prevents use-after-free issues
if the frame_widget call causes the WidgetBase to be destroyed.

BUG=506149253

(cherry picked from commit 3474a9978fb63e39e5f73ba35db253caa5f40e19)

Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7923472
Task-number: QTBUG-147884
Change-Id: Ic17e5ee9e39334d8afe1429e1c755e57ed344bbc
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753043
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/f0da7fb32bb2aec98930d90bde4a572b5d70973d

Git commit a99419c7f249c533909b67009237631120209eec by Michal Klocek (on behalf of Roberto Rodriguez) on 20/07/2026 at 08:55..
[backport] Dependency for CVE-2026-13819

Clamp up to base level in Metal backend

The Metal backend will crash (i.e., fail a Metal assertion) when
mipmap base level is greater than max level, which can result in
attempting to create a texture view with a range of 0. This change
clamps the max level up to the base level to prevent the crash.

Added tests to verify framebuffer completeness and rendering behavior
when base > max. The tests verify that the framebuffer is complete
when attachment equals base level, and incomplete otherwise.

Test Texture2DBaseMaxTestES3.BaseExceedsMaxFboAttachAtBase is
skipped on Vulkan and OpenGL backends as it currently crashes.

Bug: angleproject:451876199
Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7040665
Task-number: QTBUG-147884
Change-Id: Ic58668e45a93aa8af05e824d152a411723dfc4cf
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753045
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/a99419c7f249c533909b67009237631120209eec

Git commit d7be0988af656f5fb1bb4c74bc8563e25705024d by Michal Klocek (on behalf of Le Hoang Quyen) on 20/07/2026 at 08:55..
[backport] CVE-2026-13819: Out of bounds read in ANGLE

Metal: Fix crash when setting non-zero base level on IOSurface.

- Clamped baseLevel and maxLevel to supported range in
  `createViewFromBaseToMaxLevel` to avoid creating invalid views.
- Added `SetNonZeroBaseLevel` test in
  `EGLIOSurfaceClientBufferTest.cpp`.

Bug: chromium:512962749
Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7862465
Task-number: QTBUG-147884
Change-Id: I0faff0414aa0230918ed7bce663f4a87d7bf376e
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753046
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/d7be0988af656f5fb1bb4c74bc8563e25705024d

Git commit 6389daf35a3159f6465a0b8c63d0e336220ed978 by Michal Klocek (on behalf of Le Hoang Quyen) on 20/07/2026 at 08:56..
[backport] CVE-2026-13833: Uninitialized Use in ANGLE

Metal: Fix texture storage desynchronization bug

Fix texture redefinition when the new format matches native storage
but contradicts the old image definition. Instead of asserting,
lazily recreate the view of the native storage.

Added a regression test PerLevelFormatMismatchRedefine.

Bug: chromium:513920082
Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7859329
Task-number: QTBUG-147885
Change-Id: I48a930256b6ff545fb5fa7b54b0198be99bc34c6
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753745
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/6389daf35a3159f6465a0b8c63d0e336220ed978

Git commit 90644daee681a91c2ac173e10e76e3496129132b by Michal Klocek (on behalf of Geoff Lang) on 20/07/2026 at 08:56..
[backport] CVE-2026-13834: Insufficient validation of untrusted input in ANGLE

Validate that TF buffers cannot be modified when TF is unbound.

The buffer transform feedback conflict validation would only track
buffers that are bound to the current transform feedback object. Since
it is possible to pause transform feedback and unbind it, the buffers
could be modified when in this state.

Add additional tracking for when the buffer is attached to an active
transform feedback.

Apply this validation to hardened contexts as well as WebGL since it is
undefined behaviour in the GL spec to use a buffer for transform
feedback and other usages simultaneously.

Fixed: chromium:492218546
Fixed: chromium:513925114
Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7864196
Task-number: QTBUG-147885
Change-Id: I45b99ce847d74946870ba35fc9a17294e3386523
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753746
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/90644daee681a91c2ac173e10e76e3496129132b

Git commit 92d80e7684612ecb9f2ec25a2883a13d6b9ec508 by Michal Klocek (on behalf of Rune Lillesveen) on 20/07/2026 at 08:56..
[backport] CVE-2026-13836: Inappropriate implementation in CSS

Escape 'name' part of @position-try prelude when necessary

Bug: 514420555
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7859393
Task-number: QTBUG-147885
Change-Id: I97ba58938a16c52f47f9e8003ace9f98ede207f5
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753748
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/92d80e7684612ecb9f2ec25a2883a13d6b9ec508

Git commit 8d963de718a41274ba84b0d2cac5e83d31098caa by Michal Klocek (on behalf of Rune Lillesveen) on 20/07/2026 at 08:57..
[backport][parts] CVE-2026-13837: Inappropriate implementation in CSS

Escaped idents when serializing CSS counter names

There was missing escaping for idents when serializing counter names in:

- The counter-set/reset/increment property values
- The content property value

Bug: 514429130
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7859556
Task-number: QTBUG-147885
Change-Id: Ia21161017622af951fb6895bb995af396489f04e
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753749
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/8d963de718a41274ba84b0d2cac5e83d31098caa

Git commit e370a3b04df74db5719d08f0c57a102bee4493a5 by Michal Klocek (on behalf of Michael Ludwig) on 20/07/2026 at 08:57..
[backport] CVE-2026-13841: Integer overflow in Skia

Drop excessively large gradient draws

This skips recording draws with more than 1M color stops, primarily as
a way to avoid worrying about overflowing during intermediate
calculations. We can increase it if necessary, but hopefully this is
healthy enough no one is trying to make shaders this large.

This also skips recording draws when the FSM has maxed out its
allocatable size for a single buffer. Given how large that is,
we shouldn't encounter it in the wild but this lets us fail semi
gracefully. If needed, we can revisit by either flushing the entire
Recorder when reaching a limit, or by allowing a recording to use
multiple buffers

Bug: 515467789
Fixed: 517017693
Reviewed-on: https://skia-review.googlesource.com/c/skia/+/1243936
Task-number: QTBUG-147885
Change-Id: Ie032f9ed35b6cf0316a18b32bb36e3ec3c047097
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753750
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/e370a3b04df74db5719d08f0c57a102bee4493a5

Git commit 8e0914abd262e13ef22eb648374569eaa7096144 by Michal Klocek (on behalf of Mason Freed) on 20/07/2026 at 08:57..
[backport] CVE-2026-13845: Use after free in DOM

Fix UAF in PagePopupController via orphaned popup destruction teardown

Original change's description:
> Fix UAF in PagePopupController via orphaned popup destruction teardown
>
> When PagePopup cancellation occurs, re-entrant page popup creation can
> overwrite or clear WebViewImpl's tracking reference, leaving an
> orphaned popup that bypasses standard teardown in ClosePopup(). If a
> pending DOM timer or asynchronous script task subsequently invokes
> setWindowRect() on the orphaned frame, it attempts a virtual method
> call on the freed WebPagePopupImpl referent.
>
> The fix includes:
> 1. Guard PagePopupController::setWindowRect() with an explicit check on
> popup_client_.
> 2. In WebPagePopupImpl::Close(), if page_ remains non-null after
> Cancel() returns, explicitly invoke ClearPagePopupClient() and
> DestroyPage() so the frame and scheduler are detached before freeing.
>
> Fixed: 516936863
> Change-Id: I218c94955949e8a07535239eecf05350c56ab24a
> Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7905043
> Commit-Queue: Joey Arhar <[email protected]>
> Reviewed-by: Joey Arhar <[email protected]>
> Auto-Submit: Mason Freed <[email protected]>
> Cr-Commit-Position: refs/heads/main@{#1644092}

(cherry picked from commit 9800c213a58d1eedefae6b64aebf98a5bda62c81)

Bug: 522134407,516936863
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7928406
Task-number: QTBUG-147885
Change-Id: I218c94955949e8a07535239eecf05350c56ab24a
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753751
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/8e0914abd262e13ef22eb648374569eaa7096144

Git commit 629a7932044ef93d9489248c458cb4c9f1e10982 by Michal Klocek (on behalf of Alvin Ji) on 20/07/2026 at 08:57..
[backport] CVE-2026-13846: Use after free in USB

usb: prevent UAF in macOS WebUSB isochronous transfers

Original change's description:
> usb: prevent UAF in macOS WebUSB isochronous transfers
>
> Add endpoint verification to IsochronousTransferIn and IsochronousTransferOut to ensure the target endpoint is part of a claimed interface before creating the transfer. This prevents transfers from being created with a null claimed interface, which allowed them to bypass cancellation during ReleaseInterface and lead to a Use-After-Free on macOS.
>
> BUG=516999424
>
> Change-Id: Ie957a81626631ee914a685860debab357f8191aa
> Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7879472
> Commit-Queue: Alvin Ji <[email protected]>
> Reviewed-by: Matt Reynolds <[email protected]>
> Cr-Commit-Position: refs/heads/main@{#1637882}

(cherry picked from commit 91cbfc99801d49d4e7d8a6349552870f95b48cb0)

Bug: 517793587
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7884241
Task-number: QTBUG-147885
Change-Id: Ie957a81626631ee914a685860debab357f8191aa
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753752
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/629a7932044ef93d9489248c458cb4c9f1e10982

Git commit 80df2346ebb9214d906df478e95ba9a56da94f70 by Michal Klocek (on behalf of Dominic Farolino) on 20/07/2026 at 08:57..
[backport] CVE-2026-13848: Use after free in Forms

DOM: Fix connected subframe count during moveBefore()

Before this CL: In `HTMLFrameOwnerElement::RemovedFrom()`, when an
element was removed during a state-preserving atomic move
(moveBefore()), we decremented the connected subframe count on the frame
owner element itself and on all ancestors starting from
`insertion_point` (the old, connected parent of the newly-disconnected
subtree).

Whe moving an ancestor of an iframe, this caused a bookkeeping problem:
  1. Intermediate nodes between the iframe and the insertion point never
     had their subframe counts decremented;
  2. When InsertedInto() later runs, the subframe counts on all nodes
     starting at the iframe's parent up to the root get re-incremented.

This means that intermediate nodes between the iframe and the insertion
point have their counts "re-incremented" after never being decremented.
This causes the page's subframe count to by desynchronized from reality,
causing a DCHECK() in `CheckFrameCountConsistency()` during the next
operation that invokes that path, such as the child frame disconnector.

After this CL: We updated the increment logic in `InsertedInto()` to
mirror that in `RemovedFrom()`. Specifically, we now increment the
connected subframe count on the frame owner element itself and on all
ancestors starting from `insertion_point` (the new parent of the
attached subtree). This leaves the subframe counts of any intermediate
nodes within the moved subtree completely untouched and accurate.

See https://crrev.com/c/7882216 for a previous attempt.

R=jarhar, nrosenthal

Bug: 517345069
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7950701
Task-number: QTBUG-147885
Change-Id: I3d2f1d9641cfde9b57246fa4c7932da35b7c2588
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753753
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/80df2346ebb9214d906df478e95ba9a56da94f70

Git commit a7988c6a28a1f8480c45a01da032e7b6fa401c54 by Michal Klocek (on behalf of Brandon Jones) on 20/07/2026 at 08:58..
[Backport] CVE-2026-13776: Type Confusion in Dawn

Cherry-pick of patch originally reviewed on
https://dawn-review.googlesource.com/c/dawn/+/308855:
Don't allocate command space for 0 render bundles

Early terminates APIExecuteBundles on the Render Pass if count is
0, which was otherwise causing allocation issues.

Bug: 513012139
Fixes: 513012139
Change-Id: Ia58e6da36c8049573e5a60a558c65fdfa72bedc8
Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/308855
Auto-Submit: Brandon Jones <[email protected]>
Reviewed-by: Loko Kung <[email protected]>
Commit-Queue: Brandon Jones <[email protected]>
Task-number: QTBUG-147859
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/752139
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/a7988c6a28a1f8480c45a01da032e7b6fa401c54

Git commit c56b6403f08e8761ee542a84c495f58369d09c77 by Michal Klocek (on behalf of Rob Pitkin) on 20/07/2026 at 08:58..
[Backport] CVE-2026-13778: Use after free in WebUSB

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/7851679:
usb: harden WebUSB against Endpoint Aliasing UAF on macOS

This CL implements a defense hardening fix in Chromium's WebUSB
implementation to mitigate a Use-After-Free (UAF) vulnerability in
libusb on macOS.

The vulnerability arises from inconsistent endpoint-to-interface mapping
between Chromium and libusb when a malicious device advertises duplicate
endpoint addresses across different interfaces. Libusb uses a "first
match" behavior when claiming interfaces, while Chromium overwrites
entries in `endpoint_map_` based on order of appearance.

Changes made:

1. Added a check in UsbDeviceHandleImpl::ClaimInterface to reject
claiming an interface if any of its alternate settings contain an
endpoint that is already present in endpoint_map_ and belongs to a
different interface.

2. Modified UsbDeviceHandleImpl::RefreshEndpointMap to not overwrite
existing entries when processing duplicate endpoints. This ensures that
the mapping matches libusb's "first match" behavior.

Bug: 513167952
Change-Id: I18551e0ab45f0f076079befcac85f6d2fc8c0111
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7851679
Commit-Queue: Rob Pitkin <[email protected]>
Reviewed-by: Matt Reynolds <[email protected]>
Reviewed-by: Reilly Grant <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1631665}
Task-number: QTBUG-147859
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/752140
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/c56b6403f08e8761ee542a84c495f58369d09c77

Git commit 08ac07a6356299db32b329bc64f71ae96e8eff1e by Michal Klocek (on behalf of Geoff Lang) on 20/07/2026 at 08:58..
[Backport] CVE-2026-13780: Insufficient validation of untrusted input in ANGLE

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/7863315:
Remove buffer mapping commands from the gles2 cmd decoder

Buffer mapping commands are not exposed on WebGL and un-used except to
implement the WebGL getBufferSubData command. Implement it with a
specialized command which does the mapping in the GPU process.

These calls are particularly difficult to validate and are commonly
targeted in compromised renderer attacks on the GPU process.

Fixed: chromium:514769383
Fixed: chromium:513925114
Change-Id: I49d57ad190722c0bfb2d2a5535ee5d50819d825c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7863315
Reviewed-by: Kenneth Russell <[email protected]>
Commit-Queue: Geoff Lang <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1635266}
Task-number: QTBUG-147859
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/752141
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/08ac07a6356299db32b329bc64f71ae96e8eff1e

Git commit 90598b698d5146966df2b2c982ee8f6d6d00d550 by Michal Klocek (on behalf of Allen Bauer) on 20/07/2026 at 08:58..
[Backport] CVE-2026-13783: Use after free in Views

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/7882246:
Added additional `this` tracking in MenuController:OnMousePressed().

Guards against a11y tools signaling the menu to close during the
notification of the newly hot-tracked button.

Change-Id: Ida8121655c53bc1c4f59c0aaf9a25226ee73c40a
Bug: 516962178
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7882246
Auto-Submit: Allen Bauer <[email protected]>
Commit-Queue: Allen Bauer <[email protected]>
Reviewed-by: David Yeung <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1637875}
Task-number: QTBUG-147859
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/752142
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/90598b698d5146966df2b2c982ee8f6d6d00d550

Git commit 3f0832b8199e070022f73cfd8f1c955cc3d50c50 by Michal Klocek (on behalf of Allen Bauer) on 20/07/2026 at 08:58..
[Backport] CVE-2026-13784: Use after free in Views

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/7881707:
Track view in DropHelper::OnDragOver to guard against potential UaF.

Change-Id: I8b98d1477673c6aaf14d31015a12ccc42e2bfb6f
Bug: 516962715
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7881707
Auto-Submit: Allen Bauer <[email protected]>
Reviewed-by: David Yeung <[email protected]>
Commit-Queue: Allen Bauer <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1637795}
Task-number: QTBUG-147859
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/752143
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/3f0832b8199e070022f73cfd8f1c955cc3d50c50

Git commit d54d80fa06b467c95bf2c282fa044534b6288aa7 by Michal Klocek (on behalf of Alvin Ji) on 20/07/2026 at 08:59..
[Backport] CVE-2026-13785: Use after free in Bluetooth

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/7882486:
bluetooth: prevent use-after-free in SDPQueryListener during timeout

Keep SDPQueryListener alive using a strong self-reference until the
macOS IOBluetooth callback is delivered.

On a watchdog timeout, the socket drops its strong reference to the
listener. Because IOBluetooth stores its target unretained (FB13705522),
this leads to an immediate deallocation and a subsequent Use-After-Free
(UAF) when the late callback fires. Retaining self until the callback
completes ensures the listener survives.

BUG=517021684

Change-Id: If7cfbd483ccf3339d6e06348ca9936b350fab9fa
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7882486
Reviewed-by: Matt Reynolds <[email protected]>
Commit-Queue: Alvin Ji <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1638924}
Task-number: QTBUG-147859
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/752144
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/d54d80fa06b467c95bf2c282fa044534b6288aa7

Git commit 97124024f278f1e9ada2009b8053fb53898f5fbf by Michal Klocek (on behalf of Charlie Lao) on 20/07/2026 at 08:59..
[Backport] CVE-2026-14398: Use after free in ANGLE

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/angle/angle/+/7846935:
Vulkan: Ensure we clean up mHandle when Event::init() fail

Otherwise we may leave a dangling mHandle in RefCountedEvent and cause
potential UAF later.

Bug: b/512995785
Change-Id: Id9148c7d05fbca4abd9eda0e7f1c73edc372c224
Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7846935
Reviewed-by: Yuxin Hu <[email protected]>
Reviewed-by: Shahbaz Youssefi <[email protected]>
Commit-Queue: Charlie Lao <[email protected]>
Task-number: QTBUG-147859
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/752145
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/97124024f278f1e9ada2009b8053fb53898f5fbf

Git commit 6b2f27ad34390e98021b2724fd8ac007f7d70c82 by Michal Klocek (on behalf of Corentin Wallez) on 20/07/2026 at 08:59..
[Backport] CVE-2026-14417: Use after free in Dawn

Cherry-pick of patch originally reviewed on
https://dawn-review.googlesource.com/c/dawn/+/311135:
[dawn] Remove AllocNoThrow calls without proper error handling.

 - CommandAllocator had an AllocNoThrow that caused errors not handled
   all cases: nullptr would be returned, but when writing AdditionalData
   of size 0, it wouldn't cause an immediate crash and lead to issue
   much later.
 - ChunkedCommandSerializer had an AllocNoThrow but just drops the
   command if it failed, which seems like it could cause issues
   downstream. Turn it into a regular allocation.

Fixed: 516649133
Change-Id: I90d1b19c0838d32b0b47bd1a2d5779967fdc3f25
Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/311135
Commit-Queue: Corentin Wallez <[email protected]>
Reviewed-by: Kai Ninomiya <[email protected]>
Task-number: QTBUG-147859
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/752146
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/6b2f27ad34390e98021b2724fd8ac007f7d70c82

Git commit 293ed531c9bc932ab65e3ae9fec388c2a469b43b by Michal Klocek (on behalf of Stephen White) on 20/07/2026 at 08:59..
[Backport] CVE-2026-14420: Out of bounds read and write in Dawn

Cherry-pick of patch originally reviewed on
https://dawn-review.googlesource.com/c/dawn/+/314675:
[M144-LTS] GL: add missing stage visibility check

In GenerateArrayLengthFromUniformData(), skip bindings that are
not visible to the current stage.

Bug: 517031505

Change-Id: Ida25ca9233a6880461f67a177e9d2257c1727094
Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/313155
Reviewed-by: Geoff Lang <[email protected]>
Commit-Queue: Stephen White <[email protected]>
(cherry picked from commit 73591422f504902c597a67beaeb8e22101f030bd)
Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/314675
Reviewed-by: Mohamed Omar <[email protected]>
Owners-Override: Mohamed Omar <[email protected]>
Task-number: QTBUG-147859
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/752147
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/293ed531c9bc932ab65e3ae9fec388c2a469b43b

Git commit 98174f9dbc9cb5cf557d91fc85ffcafdf0e765e8 by Michal Klocek (on behalf of Kaylee Lubick) on 20/07/2026 at 08:59..
[Backport] CVE-2026-14427: Heap buffer overflow in Skia (1/2)

Cherry-pick of patch originally reviewed on
https://skia-review.googlesource.com/c/skia/+/1256016:
Reject Slugs that have creationMatrix with perspective

This shouldn't happen during normal use [1] but if the data
is corrupted, there are some assumptions that can can cause
issues, like the ones linked in the bug.

This rejects those and turns one assert into an actual runtime
check to provide defense in depth.

[1] https://github.com/google/skia/blob/9eecbdc30f7da675edab96974b23174a9d521e0c/src/text/gpu/SubRunContainer.cpp#L1578-L1581

Bug: 520113415
Fixed: 520113415
Change-Id: I6ec23df9a23ea588fa89f7a62dc1f197fe3905fd
Reviewed-on: https://skia-review.googlesource.com/c/skia/+/1256016
Commit-Queue: Kaylee Lubick <[email protected]>
Reviewed-by: Thomas Smith <[email protected]>
Task-number: QTBUG-147859
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/752148
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/98174f9dbc9cb5cf557d91fc85ffcafdf0e765e8

Git commit eca6e43f08962f87c6f222d4f94a627c75b3ae39 by Michal Klocek (on behalf of Kaylee Lubick) on 20/07/2026 at 09:00..
[Backport] CVE-2026-14427: Heap buffer overflow in Skia (2/2)

Cherry-pick of patch originally reviewed on
https://skia-review.googlesource.com/c/skia/+/1257236:
Use an assert release on stride length

Follow-up to https://review.skia.org/1256016

Bug: 520113415
Change-Id: I2765f579914ba14c9a7fd126872229ceacfaf9ec
Reviewed-on: https://skia-review.googlesource.com/c/skia/+/1257236
Reviewed-by: Thomas Smith <[email protected]>
Commit-Queue: Kaylee Lubick <[email protected]>
Reviewed-by: Michael Ludwig <[email protected]>
Auto-Submit: Kaylee Lubick <[email protected]>
Task-number: QTBUG-147859
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/752149
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/eca6e43f08962f87c6f222d4f94a627c75b3ae39

Git commit 629f3cd4a03cc19793331521990a5d3c81bd7273 by Allan Sandfeld Jensen on 20/07/2026 at 10:28..
[Backport] CVE-2026-11700: Use after free in Tracing

Manually cherry-picked from:
https://github.com/google/perfetto/pull/5795/changes/e7902807e1b617c90e539c9e830972b129684ccd

protovm: fix use-after-free in Parser::ParseSelect

ParseSelect snapshots `cursors_` (which holds raw Node* pointers in
RwProtoCursor::node_ and parent_link_.map_node) before running nested
instructions and unconditionally restores it afterwards. A nested `del`
that frees the same node aliased by the snapshot would leave a dangling
pointer on restore; a subsequent `del` would then double-free the node
and corrupt the SlabAllocator freelist.

Track one extra Node* in the parser: the dst.GetNode() of the innermost
in-flight ParseSelect frame. When `del` is asked to free a non-root
node whose address matches that snapshot, abort the program instead of
producing a stale cursor on restore. Snapshots form a non-strict
descending chain (each new ParseSelect either keeps dst at the same
node or moves it deeper), so checking only the innermost is sufficient:
if any outer snapshot aliases the deletion target, this one does too.
Auxiliary space is O(1).

Legitimate `del` patterns continue to work: top-level del; del under a
select that walks dst to the target via path components; iterate-and-
delete on a repeated field. Only `del` wrapped in a select that does
not move dst is rejected, and those forms are always expressible by
hoisting the del out of the wrapper:

  select(cursor=DST, path=[]) { del }       -> del
  select(cursor=SRC, path=[X]) { del }      -> select(SRC,X){...}; del
  select(path=[X]) { select(path=[]){del} } -> select(path=[X]){del}

As defense in depth, also reserve TracePacket.trace_provenance (124)
and TracePacket.protovms (125) in the SMB packet validator. Both
fields are emitted only by TracingServiceImpl and have no legitimate
producer-side use, so dropping them on the producer-incoming path
prevents a compromised producer from injecting protovm programs or
spoofing sequence provenance.

Regression tests added in vm_unittest.cc for both the empty-path and
SRC-cursor-with-non-empty-path variants of the UAF, and in
packet_stream_validator_unittest.cc for the two newly reserved fields.

Change-Id: I2bde318c644c5ddd93a57631327aa6c151d9c31a
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753026
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/629f3cd4a03cc19793331521990a5d3c81bd7273