[qt/qt/qtwebengine-chromium]: Summary of bulk changes made

Git repository change summary for qt/qt/qtwebengine-chromium
Pushed by mirror-service into branch '140-based'.
Changed from 629f3cd4a03cc19793331521990a5d3c81bd7273 to 272971f169d6c9d875d47d00fe02407e35c64b1f
Acknowledgement was received that this change introduces only existing code that has been pushed to another public open source repository.

This change contains the following new commits:

Git commit 2ad17f4733bfc56303123ff0ee3a3b716f8e1e6c by Michal Klocek (on behalf of Stefan Zager) on 20/07/2026 at 15:19..
[Backport] CVE-2026-13857: Inappropriate implementation in Geometry (1/2)

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/7835432:
[IntersectionObserver] Fix occlusion detection with 3D transform

For regular (i.e. event-targeting) hit testing, z-axis ordering is
based on the z-axis position of the center of a PaintLayer. That's
not good enough for occlusion testing.

With this CL, when a hit test for occlusion encounters a 3d transform,
it computes the z-axis position of the four corners of the PaintLayer,
and if any of them are above any point in the occlusion target (i.e.
the HitTestRequest::stop_node_) then the PaintLayer is considered
occluding. This is not 100% accurate, but it will never result in a
false positive (i.e., reporting the target as unoccluded when it
actually is), which is a hard requirement of IntersectionObserver.

The corner-checking code makes a simplifying assumption that the
stop_node_ has no 3D projection, which is enforced by a call to
LayoutObject::HasDistortingVisualEffects from IntersectionObserver.

Bug: 479203484
Change-Id: Ida70f919efc73149d32112900b019987f27a5a7e
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7835432
Reviewed-by: Philip Rogers <[email protected]>
Commit-Queue: Stefan Zager <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1629048}
Task-number: QTBUG-147892
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753332
Reviewed-by: Allan Sandfeld Jensen <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/2ad17f4733bfc56303123ff0ee3a3b716f8e1e6c

Git commit 2102f426935fd4871c6cd50c188ff577f204a0cc by Michal Klocek (on behalf of Philip Rogers) on 20/07/2026 at 15:19..
[Backport] CVE-2026-13857: Inappropriate implementation in Geometry (2/2)

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/7854105:
Fix occlusion by not overwriting z_offset in IsHitCandidateForDepthOrder

https://crrev.com/1629048 introduced an intersection observer v2
regression due to z_offset being overwritten with smaller values. This
patch ensure z_offset only increases.

Bug: 479203484
Fixed: 513624405
Change-Id: Ic5b3b8633979cf7ffeb57f9739e8fe4dd9417518
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7854105
Reviewed-by: Stefan Zager <[email protected]>
Commit-Queue: Philip Rogers <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1632217}
Task-number: QTBUG-147892
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753333
Reviewed-by: Allan Sandfeld Jensen <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/2102f426935fd4871c6cd50c188ff577f204a0cc

Git commit 5c613f449983eabbed86ccf49bb0eee2c0a43ca8 by Michal Klocek (on behalf of Dale Curtis) on 20/07/2026 at 15:19..
[Backport] CVE-2026-13858: Out of bounds read in FFmpeg

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/third_party/ffmpeg/+/7819356:
avformat/mov: Fix negative index given to can_seek_to_key_sample()

The potentially negative return value of av_index_search_timestamp()
wasn't being handled before passing it to can_seek_to_key_sample().

Found by Wongi Lee (@_qwerty_po) of Theori with Xint Code,
Jungwoo Lee (@physicube).

Signed-off-by: Dale Curtis <[email protected]>
Bug: 507090179
Change-Id: I3037acb8e3d6cd5eedb7ef812569673d9be61879
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/third_party/ffmpeg/+/7819356
Reviewed-by: Thomas Guilbert <[email protected]>
Task-number: QTBUG-147892
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753334
Reviewed-by: Allan Sandfeld Jensen <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/5c613f449983eabbed86ccf49bb0eee2c0a43ca8

Git commit d7c6eb2a138cb7b4c3feaef99fed7c89f8e10fe0 by Michal Klocek (on behalf of Shahbaz Youssefi) on 20/07/2026 at 15:19..
[Backport] CVE-2026-13859: Inappropriate implementation in ANGLE

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/angle/angle/+/7829599:
AST: Fix variable declaration in dead code in `case`

Previously fixed for IR here:

https://chromium-review.git.corp.google.com/c/angle/angle/+/7589940

A similar transformation is applied to the AST transformation.

Bug: chromium:484756087
Change-Id: I579f839613ed5f1e05084f2b1c19bc0dbd386cbc
Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7829599
Commit-Queue: Shahbaz Youssefi <[email protected]>
Reviewed-by: Geoff Lang <[email protected]>
Task-number: QTBUG-147892
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753335
Reviewed-by: Allan Sandfeld Jensen <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/d7c6eb2a138cb7b4c3feaef99fed7c89f8e10fe0

Git commit 1a8b4e99cf274facc7759ec4b8d8883134bed8d4 by Michal Klocek (on behalf of Charlie Reis) on 20/07/2026 at 15:20..
[Backport] CVE-2026-13861: Use after free in Core

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/7885218:
Convert RenderProcessHostImpl::browser_context_ to MiraclePtr.

Bug: 495456765
Change-Id: Ib31a537b009ae9e73b297a21483834704c2bf73b
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7885218
Commit-Queue: Keishi Hattori <[email protected]>
Auto-Submit: Charlie Reis <[email protected]>
Reviewed-by: Keishi Hattori <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1639175}
Task-number: QTBUG-147892
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753336
Reviewed-by: Allan Sandfeld Jensen <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/1a8b4e99cf274facc7759ec4b8d8883134bed8d4

Git commit 0fc16532edcd4949a0f6d249a0f31500ed3ce381 by Michal Klocek (on behalf of Alvin Ji) on 20/07/2026 at 15:20..
[Backport] CVE-2026-13869: Use after free in Device

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/7831801:
serial: Keep data pipe handles alive until pending I/O completes on Win

On Windows, abruptly closing a serial port while overlapped I/O is
pending can unmap the Mojo data pipe shared memory buffers before the
kernel finishes processing the aborted IRPs, creating a potential
Use-After-Unmap vulnerability.

This CL resolves the issue by transferring ownership of active Mojo
handles into keep-alive closures attached to SerialIoHandler. These
closures defer unmapping until the OS kernel successfully signals
completion.

This behavior is restricted entirely to Windows builds and gated behind
the enabled-by-default feature flag kSafeSerialPortImplWinClose.

Bug: 497610642
Change-Id: I906ede1c9bf77ea126829a9ff2c3cf12e64efeeb
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7831801
Reviewed-by: Matt Reynolds <[email protected]>
Commit-Queue: Alvin Ji <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1628814}
Task-number: QTBUG-147892
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753337
Reviewed-by: Allan Sandfeld Jensen <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/0fc16532edcd4949a0f6d249a0f31500ed3ce381

Git commit cbc2f6065badff442faf96414a75ac049713cb49 by Michal Klocek (on behalf of Dan Harrington) on 20/07/2026 at 15:20..
[Backport] CVE-2026-13871: Insufficient data validation in GuestView (1/2)

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/7117291:
Fix crash in guest view

Update the guest owner_rfh_id if the render frame host is changed.
Without this, it's possible to point to a RFH that no longer exists,
and later crash when trying to access it.

Bug: 456749647
Change-Id: I076c30aeaa58bb19e8973b81ee68e2766a6a6964
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7117291
Commit-Queue: Dan Harrington <[email protected]>
Reviewed-by: Kevin McNee <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1540322}
Task-number: QTBUG-147892
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753338
Reviewed-by: Allan Sandfeld Jensen <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/cbc2f6065badff442faf96414a75ac049713cb49

Git commit 9d2bd7aa000d5b3e9601e42124fb9c44d27edf49 by Michal Klocek (on behalf of Kevin McNee) on 20/07/2026 at 15:20..
[Backport] CVE-2026-13871: Insufficient data validation in GuestView (2/2)

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/7837698:
Ensure pre-attachment guest owner RFH updates stay within the same renderer

An unattached guest is scoped to the process that created it.

Fixed: 497961376
Change-Id: I3d4c588080bb07b8122dc7f045bc677f118bad62
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7837698
Reviewed-by: Alex Moshchuk <[email protected]>
Commit-Queue: Alex Moshchuk <[email protected]>
Auto-Submit: Kevin McNee <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1628925}
Task-number: QTBUG-147892
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753339
Reviewed-by: Allan Sandfeld Jensen <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/9d2bd7aa000d5b3e9601e42124fb9c44d27edf49

Git commit 9d11250ae689510aa84102cb049362bf490c1a0f by Michal Klocek (on behalf of Koji Ishii) on 20/07/2026 at 15:20..
[Backport] CVE-2026-13873: Out of bounds memory access in Layout

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/7867050:
Fix asymmetric bounds check in `ForEachGraphemeClusters`

This patch fixes `ForEachGraphemeClusters` to check both lower
and upper boundaries. Before the change, it was checking only
the left side boundary, and thus it could iterate beyond
given `to` in LTR, so long as the `ShapeResult` has such
cluster indexes.

With the fix, the iteration is limited within the given `from`
and `to`.

The `emphasis.html` is rebasedlined, as it was rendering
emphasis marks twice; once normally and another by excess
rendering when painting the selection.

Fixed: 498085466
Change-Id: Ic31c3544e035145e32552595389bd269775ec91c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7867050
Auto-Submit: Koji Ishii <[email protected]>
Commit-Queue: Koji Ishii <[email protected]>
Reviewed-by: Kent Tamura <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1635934}
Task-number: QTBUG-147892
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753340
Reviewed-by: Allan Sandfeld Jensen <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/9d11250ae689510aa84102cb049362bf490c1a0f

Git commit 2283ad4ddd13d6cabe7fc902a7278b308bac4531 by Michal Klocek (on behalf of Mike West) on 20/07/2026 at 15:20..
[Backport] CVE-2026-13876: Inappropriate implementation in Network

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/7826651:
[SRI Message Signatures] Fail validation when signature base fails.

Rather than synthesizing an empty string when signature base construction
fails, we ought to fail validation entirely. This CL does that, and adds
additional error enum values to cover the ways in which signature base
generation might fail.

Bug: 498722200
Change-Id: Ia1f27540626400765a94017389472b02cda5bef1
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7826651
Reviewed-by: Danil Somsikov <[email protected]>
Reviewed-by: Kenichi Ishibashi <[email protected]>
Commit-Queue: Mike West <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1629106}
Task-number: QTBUG-147898
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753342
Reviewed-by: Allan Sandfeld Jensen <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/2283ad4ddd13d6cabe7fc902a7278b308bac4531

Git commit 3010e6ee3586bbd3f4d9f95c13850a7baae81952 by Michal Klocek (on behalf of Alvin Ji) on 20/07/2026 at 15:21..
[Backport] CVE-2026-13880: Use after free in USB

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/7877663:
usb: Fix thread-safety in macOS SetConfiguration

SetConfiguration cleared claimed_interfaces_ on the main thread, causing
InterfaceClaimer destruction (and libusb_release_interface) on the main
thread. This could run concurrently with libusb_set_configuration on the
blocking thread, leading to undefined behavior and potential UAF.

This CL uses ReleaseSoon to release claimed interfaces on the blocking
thread instead, ensuring sequential execution with
SetConfigurationBlocking.

Bug: 499025880
Change-Id: If544f27259742c50b30896d7763aa8afad3dc190
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7877663
Commit-Queue: Alvin Ji <[email protected]>
Reviewed-by: Matt Reynolds <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1637824}
Task-number: QTBUG-147898
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753346
Reviewed-by: Allan Sandfeld Jensen <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/3010e6ee3586bbd3f4d9f95c13850a7baae81952

Git commit 653ac1b228d61c2c8080dbe6a1294fbe3171ddf2 by Michal Klocek (on behalf of Alvin Ji) on 20/07/2026 at 15:21..
[Backport] CVE-2026-13882: Inappropriate implementation in USB

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/7831277:
usb: Lock interface requests during pending device state changes

Fixes a TOCTOU vulnerability where a compromised renderer could pipeline
a ClaimInterface request immediately behind SetConfiguration, bypassing
the protected interface blocklist by validating against stale
configuration metadata.

Introduces a `device_state_change_in_progress_` flag to DeviceImpl to
synchronously reject interface operations while a device configuration
switch or reset is pending.

Bug: 499162550
Change-Id: Id7bbe4d655598814cdc0f8e03a92423360805732
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7831277
Commit-Queue: Alvin Ji <[email protected]>
Reviewed-by: Matt Reynolds <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1628883}
Task-number: QTBUG-147898
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753347
Reviewed-by: Allan Sandfeld Jensen <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/653ac1b228d61c2c8080dbe6a1294fbe3171ddf2

Git commit 5cc2200eee041c5b6783b00f3d718909f98aa296 by Michal Klocek (on behalf of Shahbaz Youssefi) on 20/07/2026 at 15:21..
[Backport] CVE-2026-13883: Type Confusion in ANGLE

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/angle/angle/+/7872077:
Translator: Fail compilation with (a, struct_with_sampler).field

This is fixed in IR, and nearly impossible to fix with AST.

Bug: chromium:500030250
Change-Id: I39ad823e1548f857851088a4c535b6ba17931a1c
Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7872077
Reviewed-by: Geoff Lang <[email protected]>
Commit-Queue: Shahbaz Youssefi <[email protected]>
Task-number: QTBUG-147898
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753348
Reviewed-by: Allan Sandfeld Jensen <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/5cc2200eee041c5b6783b00f3d718909f98aa296

Git commit 1a9004e38605ecfc30949d081e53fd4d296d40a9 by Michal Klocek (on behalf of Vlad Krot) on 20/07/2026 at 15:21..
[Backport] CVE-2026-13886: Policy bypass in Isolated Web Apps

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/7859854:
[IWA] enforce headers on navigations and in workers.

This CL makes sure that in Isolated Web Apps CSP, COEP, COOP, CORP
headers are injected on navigation / shared worker main script load /
dedicated worker main script load.

Previously, the headers were only injected via
components/webapps/isolated_web_apps/url_loading/url_loader_factory.h,
however, that is not enough because ServiceWorker interception bypasses
url_loader_factory and correct headers were not injected.

Change-Id: Iad801ac9e59f225521de44bc3bd9aa9c025c2f93
Fixed: 500475136
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7859854
Reviewed-by: Andrew Rayskiy <[email protected]>
Commit-Queue: Vlad Krot <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1635085}
Task-number: QTBUG-147898
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753349
Reviewed-by: Allan Sandfeld Jensen <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/1a9004e38605ecfc30949d081e53fd4d296d40a9

Git commit 092d9d22677fbcd93e6c783f8abe5806fbc92ddf by Michal Klocek (on behalf of Andrew Paseltiner) on 20/07/2026 at 15:22..
[Backport] CVE-2026-13893: Insufficient validation of untrusted input in WebUI

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/7818475:
searchbox: Encode image and icon URLs to prevent parameter injection

The computeSrc_ function in searchbox_icon.ts used string interpolation
to construct chrome://image URLs without encoding the url parameter.
This allowed an attacker who controls search suggestions to inject
parameters like &isGooglePhotos=true, which could lead to OAuth token
leakage in the browser process.

This CL adds a call to encodeURIComponent() to prevent such injections
and includes a WebUI test to verify correct encoding.

Fixed: 501729582
Change-Id: I8cf5893ed1c424201501c0e4417cbdb43e237b03
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7818475
Commit-Queue: Andrew Paseltiner <[email protected]>
Reviewed-by: Riley Tatum <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1626658}
Task-number: QTBUG-147898
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753351
Reviewed-by: Allan Sandfeld Jensen <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/092d9d22677fbcd93e6c783f8abe5806fbc92ddf

Git commit 2040a134ba0776a39182c10ea61c7c468f96a663 by Michal Klocek (on behalf of Devlin Cronin) on 20/07/2026 at 15:22..
[Backport] CVE-2026-13919: Insufficient data validation in Extensions

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/7838724:
[Extensions] Don't treat error pages as commits for script injections

ScriptInjectionTracker tracks the pages that are committed in order to
determine if an extension script may have run in them. There's a bug
where it doesn't properly filter out error pages, which appear to
commit to the given origin, but are distinct and don't allow script
injection. This would result in potentially recording a script as
having injected into a page, even though it didn't.

Fix this by filtering out error pages in ReadyToCommitNavigation() and
DidFinishNavigation() and add a regression test.

Bug: 511249430
Change-Id: Ia1fadad97950c1ba54d5aeee4420e14047650a18
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7838724
Reviewed-by: Łukasz Anforowicz <[email protected]>
Commit-Queue: Devlin Cronin <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1630279}
Task-number: QTBUG-147900
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753352
Reviewed-by: Allan Sandfeld Jensen <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/2040a134ba0776a39182c10ea61c7c468f96a663

Git commit 272971f169d6c9d875d47d00fe02407e35c64b1f by Michal Klocek (on behalf of Eugene Zemtsov) on 20/07/2026 at 15:22..
[Backport] CVE-2026-13920: Insufficient validation of untrusted input in Media

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/7839078:
media: Validate arguments for CopySubresourceRegion and VideoProcessorBlt

This change adds bounds validation in MediaFoundationVideoEncodeAccelerator
(PerformD3DCopy and PerformD3DScaling) to ensure the untrusted
`visible_rect` does not exceed the actual D3D11 texture dimensions.

Bug: 511722559
Change-Id: I6a71136293c85b362e570f2184436cffcb7ea8a0
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7839078
Reviewed-by: Qiu, Jianlin <[email protected]>
Commit-Queue: Eugene Zemtsov <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1629457}
Task-number: QTBUG-147900
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753353
Reviewed-by: Allan Sandfeld Jensen <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/272971f169d6c9d875d47d00fe02407e35c64b1f