[qt/qt/qtwebengine-chromium]: Summary of bulk changes made

Git repository change summary for qt/qt/qtwebengine-chromium
Pushed by mirror-service into branch '140-based'.
Changed from a26988d1ad1c47909a063a679d72c959697d2e1d to f5ab470c8e50a15d336c840d5fbfb92ece0d2a89
Acknowledgement was received that this change introduces only existing code that has been pushed to another public open source repository.

This change contains the following new commits:

Git commit d156adcaa1244b901314b304ce87ee9133bce77d by Michal Klocek (on behalf of Geoff Lang) on 22/07/2026 at 08:09..
[backport] CVE-2026-14385: Heap buffer overflow in ANGLE

Metal: Treat glGenerateMipmap as an image redefinition.

When TextureMtl::generateMipmap creates a native storage, it doesn't
treat it as a texture redefinition and clear out old images. This leaves
images with formats and sizes that do not match the storage.

Fixed: chromium:499006005
Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7806315
Task-number: CVE-2026-14385
Change-Id: I78cdbf77ccb75469fba3ca4654ea9118aa80edd5
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753820
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/d156adcaa1244b901314b304ce87ee9133bce77d

Git commit 182a2e34d63c807bd8adfe47d48cdb4e98a93799 by Michal Klocek (on behalf of Tzarial) on 22/07/2026 at 08:09..
[backport] CVE-2026-14386: Out of bounds read in ANGLE

Fix GPU memory disclosure in index rewriting

When rewriting index buffers for provoking vertex workarounds, the
Metal backend could leave portions of the allocated output buffer
uninitialized. Because these buffers are recycled from a BufferPool
without being cleared, unwritten slots retained stale indices from
previous operations.

This caused a GPU memory disclosure vulnerability because:
1. The `fixIndexBuffer` compute kernel returned early upon encountering
   a primitive restart, skipping writes to reserved output slots.
2. The `ContextMtl::drawElementsImpl` logic sliced the draw commands
   based on the original index buffer's restart points, but failed to
   transform the slice `count` and `offset` to account for the buffer
   expansion (e.g., TriangleStrip to Triangles).

This CL fixes the issue by:
- Updating `outputPrimitive` in `rewrite_indices.metal` to explicitly
  write the correct `restartIndex` (either 0xFFFF or 0xFFFFFFFF) into
  all output slots whenever a thread returns early or skips indices.
- Transforming the `DrawCommandRange` slices in `ContextMtl.mm` when
  the index buffer has been expanded, ensuring subsequent indexed
  draw calls correctly index into the expanded buffer layout.
- Adding a regression test.

Bug: 499047960
Fixed: 514929155
Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7814681
Task-number: QTBUG-147889
Change-Id: I2034492e2016c91064025f2b0705767d1da21783
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753821
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/182a2e34d63c807bd8adfe47d48cdb4e98a93799

Git commit f8137387698c5cda33c46995465dca248a1d5023 by Michal Klocek (on behalf of Charlie Lao) on 22/07/2026 at 08:09..
[backport] CVE-2026-14390: Use after free in ANGLE

M148: Limit VertexConversionBuffer to single attribIndex

This change prevents rendering corruption by ensuring that
VertexConversionBuffer instances are not shared across different vertex
attributes.

Key Changes: Unique Cache Key: Adds VertexArrayVk * and attribIndex to
VertexConversionBuffer::CacheKey. This ensures that attributes with
different source offsets but the same format/stride do not attempt to
reuse the same conversion buffer, which previously caused destination
offset conflicts. VertexConversionBuffer::match() is updated to include
these new fields in its comparison.

Regression tests are also added (credit to Shahbaz).

Bug: 503054174
Fixed: 514924769
(cherry picked from commit bbcfc3c0f7d3c60bd81d85877036541641b3af99)

Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7880270
Task-number: QTBUG-147889
Change-Id: Ia6e75401aa07978c94b935bc7d392f824efcca75
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753822
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/f8137387698c5cda33c46995465dca248a1d5023

Git commit b95f70bb3e7edc5c5949aea3f7153ba682a2cecd by Michal Klocek (on behalf of Le Hoang Quyen) on 22/07/2026 at 08:09..
[backport] CVE-2026-14396: Out of bounds read in ANGLE

Metal: fix primitive restart with converted indices

When using GL_UNSIGNED_BYTE indices, ANGLE's Metal backend converts
them to GL_UNSIGNED_SHORT in a shared pool.
VertexArrayMtl::getDrawIndices calculates currentIndexOffset by dividing
the pool offset by the index type size, making it relative to the start
of the pool sub-allocation. However, restart ranges from
BufferMtl::getRestartIndices are absolute element indices relative to
the original GL buffer. This mismatch causes incorrect draw splitting
when a non-zero pool offset is present, as currentIndexOffset is
artificially inflated.

Bug: angleproject:511737097
Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7839560
Task-number: QTBUG-147889
Change-Id: I80e2d0d20d38376aa912c851954701fac510ea46
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753825
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/b95f70bb3e7edc5c5949aea3f7153ba682a2cecd

Git commit f878f11f7711153421bd6f9628525d1c87273738 by Michal Klocek (on behalf of Le Hoang Quyen) on 22/07/2026 at 08:09..
[backport] CVE-2026-14400: Out of bounds write in ANGLE

Metal: Fix potential OOB write in Transform Feedback

Fixes a bug where incomplete primitives in transform feedback could
cause incorrect buffer offset calculations, potentially leading to
out-of-bounds writes in the Metal backend. We now round down the
vertex count for independent primitives when XFB is active.

Bug: angleproject:513010645
Fixed: chromium:515275618
Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7931427
Task-number: QTBUG-147889
Change-Id: I82b91500108fb1a7059e43479e7af87702d33b6d
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753827
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/f878f11f7711153421bd6f9628525d1c87273738

Git commit 07126d42b4b1f0ecc5efe928948ed38f612e1567 by Michal Klocek (on behalf of Ken Russell) on 22/07/2026 at 08:09..
[backport] CVE-2026-14401: Insufficient validation of untrusted input in ANGLE

Remove BlendState struct in favor of BlendStateExt.

Eliminate duplicate state tracking to fix state desynchronization
bugs. Refactor D3D9 backend to look only at index 0 of BlendStateExt.
Remove BlendState usage from FrameCapture, inlining some GL defaults
where they previously came from a temporary BlendState instance.

Add test case from bug report. Verified on Pixel 9 that the new test
fails prior to the code changes and passes with them.

Co-authored with jetski-cli.

Fixed: chromium:513048822
Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7851594
Task-number: QTBUG-147889
Change-Id: Ibe9ed7e574c5519c19d215f22d082cc7e5d1c251
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753828
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/07126d42b4b1f0ecc5efe928948ed38f612e1567

Git commit f0fd74cc46f0d5bc4bf8f9a03e06051440f02c3e by Michal Klocek (on behalf of Geoff Lang) on 22/07/2026 at 08:09..
[backport] CVE-2026-14402: Uninitialized Use in ANGLE

D3D11: Avoid partial init state in Blit11.

If a resource allocation fails, Blit11 would be left in a partially
initialized state. Allocate to new stack variables and assign them to
members at the end.

Fixed: chromium:513051340
Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7850285
Task-number: QTBUG-147889
Change-Id: I197715bad3db9c6eda9d8fd2cb7593450ba5e413
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753830
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/f0fd74cc46f0d5bc4bf8f9a03e06051440f02c3e

Git commit 0db98f770bc6ead19351561155e226a942f8403a by Michal Klocek (on behalf of Geoff Lang) on 22/07/2026 at 08:10..
[backport] CVE-2026-14411: Insufficient validation of untrusted input in ANGLE

GL: Sync program state after transform feedback.

If we are syncing a call to BeginTransformFeedback,
PauseTransformFeedback, UseProgram all at once, the program will be
bound and then changed to an incorrect program when the transform
feedback active state is synced afterwards.

Fixed: chromium:513919827
Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7858018
Task-number: QTBUG-147889
Change-Id: I66562446d364d03f628f927b4f4e8f5d7113fe4b
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753831
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/0db98f770bc6ead19351561155e226a942f8403a

Git commit 2aa3116f11bffebd98053f64e51430fa8efac69c by Michal Klocek (on behalf of Geoff Lang) on 22/07/2026 at 08:10..
[backport] CVE-2026-14412: Insufficient validation of untrusted input in ANGLE

Validate unique framebuffer attachments for hardened contexts.

This behaviour was already done for WebGL and some backends.

Fixed: chromium:513920834
Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7870307
Task-number: QTBUG-147889
Change-Id: Ifedf64a9b9be2265fa0f42af4f05586dd45611cd
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753832
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/2aa3116f11bffebd98053f64e51430fa8efac69c

Git commit 06e3aa8a37bd023562f24e0fd9f24edba36fca2b by Michal Klocek (on behalf of Charlie Lao) on 22/07/2026 at 08:10..
[backport] CVE-2026-14413: Uninitialized Use in ANGLE

Vulkan: Fix stale RefCountedEventArrayWithAccessFlags::mAccessFlags

When a BufferHelper is re-initialized or orphaned (e.g., via
glBufferData), it calls initializeBarrierTracker(), which calls
mCurrentReadEvents.release(renderer). This call resolves to the base
class implementation, leaving the mAccessFlags map populated with stale
data from the buffer's previous incarnation. This may cause other
problems later on when this buffer gets used. This CL ensures we clear
mAccessFlags on release() call.

Bug: b/513922055
Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7885808
Task-number: QTBUG-147889
Change-Id: I36f1d9588280001866b73c1b71c29fab0d318ef3
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753852
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/06e3aa8a37bd023562f24e0fd9f24edba36fca2b

Git commit f1f91c2f452e9b5b2e1f27642ff98d8d5e39ee85 by Michal Klocek (on behalf of wangra) on 22/07/2026 at 08:10..
[backport] CVE-2026-14418: Uninitialized Use in ANGLE

Vulkan: Fix robust-init bypass on array texture redefinition

Resets the clear cache (mCurrentSingleClearValue) in ImageHelper when
releasing the VkImage or removing staged updates. This prevents stale
cache values from incorrectly dropping subsequent robust resource
initialization clears on redefined array textures.

Test: angle_end2end_tests --gtest_filter="*Texture2DArrayRedefine*"
Bug: b/516865345
Task-number: QTBUG-147889
Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7974096
Change-Id: Ie7b20a680abfe47e3b97034f182842fb470b1452
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753853
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/f1f91c2f452e9b5b2e1f27642ff98d8d5e39ee85

Git commit 5e02987355fe001f82e1db3513e8649009603268 by Michal Klocek on 22/07/2026 at 08:13..
[roll][expat] CVE-2026-13835: Inappropriate implementation in XML

Rolls expat to version 2.8 from chromium 150.0.7871.150

Task-number: QTBUG-147885
Change-Id: Ia099b989a545b2216d78901a3f939d7ed256aacd
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753747
Reviewed-by: Allan Sandfeld Jensen <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/5e02987355fe001f82e1db3513e8649009603268

Git commit c158e09161f2fd28e6bc81326ff0bcc13058afda by Michal Klocek (on behalf of Natalie Chouinard) on 22/07/2026 at 08:32..
[backport] CVE-2026-14392: Out of bounds write in Tint

Collapse nested subgroupMin/Max ops on AMD

On some AMD GPUs on Windows, nested subgroupMin/Max operations can
trigger a crash.

This change collapses multiple nested subgroupMin/Max calls to a single
call, the innermost subgroupMin/Max operation. This is safe because the
result of a subgroupMin/Max call is necessarily subgroup uniform.

This bug exists in both the Vulkan and D3D12 drivers on Windows, and on
Mac. On Windows it is fixed in later versions, but because it's a
harmless optimizing transform it's applied broadly to all versions on
affected backend platforms.

Bug: 508265321
Fixed: 519444494
Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/314215
Task-number: QTBUG-147889
Change-Id: I658d0ddece1887d9211ad9ea2eb07a96ada0e3ce
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753823
Reviewed-by: Allan Sandfeld Jensen <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/c158e09161f2fd28e6bc81326ff0bcc13058afda

Git commit 885291ba96b0c55e14e13551a96da7cf273f1115 by Michal Klocek (on behalf of James Price) on 22/07/2026 at 08:32..
[backport] CVE-2026-14422: Out of bounds read and write in Tint

Add workaround for u32 div/mod miscompile

Original change's description:
> [msl] Add workaround for u32 div/mod miscompile
>
> Add a volatile zero to the LHS of all u32 divide and modulo
> operations, which fixes a miscompile on Apple Silicon.
>
> Bug: 517225032
> Change-Id: I1e9e56a5109ada6a6d89760116d5a5f24f8bacc4
> Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/312755
> Reviewed-by: dan sinclair <[email protected]>
> Commit-Queue: James Price <[email protected]>

(cherry picked from commit a9a6ec351486b901f0d1f6e6c46f256248bc90c0)

Bug: 517225032
Fixed: 522134088
Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/316215
Task-number: QTBUG-147889
Change-Id: I89be3013cd602f5599400b13575090087994be84
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753854
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/885291ba96b0c55e14e13551a96da7cf273f1115

Git commit b57af9b96b098e72c151fa647959c210cc4cfd0b by Michal Klocek (on behalf of Yulun Zeng) on 22/07/2026 at 08:33..
[backport] CVE-2026-14426: Use after free in V8

Handle context destruction when adding binding within V8InspectorImpl::contextCreated.

Original change's description:
> Handle context destruction when adding binding within V8InspectorImpl::contextCreated.
>
> CDP specifies that the bindings must persist across reloads, and thus in
> V8InspectorImpl::contextCreated(), bindings are added again when new
> contexts are created. The issue arises when context is destroyed when
> adding binding (as the regress test shows), but the context is still
> being processed down the code path.
>
> This change skips operations on the context if it has been destroyed
> during adding binding.
>
> There is the same check before addBindings() because operations on the
> context have to skipped too when it loops to other inspector sessions.
>
> Also, `contextRef` is a `std::shared_ptr` to keep it alive when looping
> through inspector sessions. This allows getting the context ID on the
> object for other addBinding() calls within addBindings().
>
> Bug: 517981277
> Change-Id: Ic1ee273c316040acc611f6c53349b734076f7f14
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7904365
> Reviewed-by: Simon Zünd <[email protected]>
> Reviewed-by: Philip Pfaffe <[email protected]>
> Commit-Queue: Yulun Zeng <[email protected]>
> Cr-Commit-Position: refs/heads/main@{#107830}

(cherry picked from commit 3c3aab471d2b291626328169e988e4846127e751)

Bug: 522600776,517981277
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7921560
Task-number: QTBUG-147927
Change-Id: Ic1ee273c316040acc611f6c53349b734076f7f14
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/754401
Reviewed-by: Allan Sandfeld Jensen <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/b57af9b96b098e72c151fa647959c210cc4cfd0b

Git commit 432a42d92a1c0f149d06d7a0250899999a3b55d0 by Michal Klocek (on behalf of Brandon Jones) on 22/07/2026 at 08:34..
[backport] CVE-2026-14428: Insufficient validation of untrusted input in Dawn

Vulkan: Avoid UB in CreateSamplerYCbCrConversion

Original change's description:
> Vulkan: Avoid UB in CreateSamplerYCbCrConversion
>
> If the Chroma Filter is linear in CreateSamplerYCbCrConversion do
> a check to ensure that the format allows for it and adjust the
> filter to nearest if not to avoid undefined behavior in
> CreateSamplerYcbcrConversion.
>
> Fixed: 520180257
> Change-Id: I6be11b5e72f83326f73a2e4ad9b6659172c83ae4
> Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/314296
> Reviewed-by: Corentin Wallez <[email protected]>
> Commit-Queue: Brandon Jones <[email protected]>

(cherry picked from commit dbeb906300358eb5c8f61e98a8f71f57285b714c)

Bug: 523532146,520180257
Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/317015
Task-number: QTBUG-147927
Change-Id: I6be11b5e72f83326f73a2e4ad9b6659172c83ae4
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/754402
Reviewed-by: Allan Sandfeld Jensen <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/432a42d92a1c0f149d06d7a0250899999a3b55d0

Git commit 92f9fd486e91974d197e490089db4f56ffd84be9 by Michal Klocek (on behalf of Kaylee Lubick) on 22/07/2026 at 08:34..
[backport][parts] CVE-2026-14429: Insufficient validation of untrusted input in Skia

Avoid improper mask formats for SDFT runs

SDFTSubRun has a hard assumption of the kA8 mask format and
if the vertex filler differs, there will be a memory mismatch.

This catches it when deserializing the Slug and changes the
debug-only assert to be runtime to make sure we don't miss other
places.

Bug: 520571816
Fixed: 522134026
Reviewed-on: https://skia-review.googlesource.com/c/skia/+/1257397
Task-number: QTBUG-147927
Change-Id: I9ae3e509397e23d38d621cb7eb8bb5b955a43d7d
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/754403
Reviewed-by: Allan Sandfeld Jensen <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/92f9fd486e91974d197e490089db4f56ffd84be9

Git commit 96c4cd3feb68f07dd25f14dc2fad84905e072d41 by Michal Klocek (on behalf of pthier) on 22/07/2026 at 08:34..
[backport] CVE-2026-14430: Integer overflow in V8 (1/2)

Merged: [test] Reduce FastArray size in lower_limits_mode

Further reduce the size of FastArrays to 1MB (was 8MB) in
lower_limits_mode.
This ensures that the FastArray size is <= MaxStringLength also in
lower_limits_mode.

(cherry picked from commit 81ed440d87ca9963c3aeb8494ac33cc2f1af5572)

Bug: 522126182, 524508980
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7942109
Task-number: QTBUG-147927
Change-Id: I8795005c70f9f34aaffb52a970a276a65c9b5c4c
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/754404
Reviewed-by: Allan Sandfeld Jensen <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/96c4cd3feb68f07dd25f14dc2fad84905e072d41

Git commit c15e00183bf3d862ef814ae5471baee1bac24fd3 by Michal Klocek (on behalf of pthier) on 22/07/2026 at 08:34..
[backport] CVE-2026-14430: Integer overflow in V8 (2/2)

Reland "[M148] Check early for separator overflow in Array.prototype.join()"

This is a reland of commit b43465d71335ab36c61dfa66aaadb631f8346263

Original change's description:
> [M148] Check early for separator overflow in Array.prototype.join()
>
> Original change's description:
> > Check early for separator overflow in Array.prototype.join()
> >
> > Instead of checking if separators overflow the maximum string length
> > each time we add a (or multiple) separator(s) to the buffer, we check
> > once in the beginning (based on the separator- and array-length).
> >
> > Besides avoiding a division in the hot loop, this also fixes a potential
> > nofSeparators overflow on 32-bit platforms.
> >
> > Fixed: 522126182
> > Change-Id: Iab05848b9ec1960a925e56b11bb74569438ebafb
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7927166
> > Reviewed-by: Igor Sheludko <[email protected]>
> > Commit-Queue: Patrick Thier <[email protected]>
> > Cr-Commit-Position: refs/heads/main@{#107953}
>
> (cherry picked from commit 7893ac23bc1e640904892810891d144e4894ccd0)
>
> Bug: 524507838,522126182
> Change-Id: Iab05848b9ec1960a925e56b11bb74569438ebafb
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7958687
> Commit-Queue: [email protected] <[email protected]>
> Auto-Submit: chrome-cherry-picker@chops-service-accounts.iam.gserviceaccount.com <chrome-cherry-picker@chops-service-accounts.iam.gserviceaccount.com>
> Bot-Commit: [email protected] <[email protected]>
> Cr-Commit-Position: refs/branch-heads/14.8@{#70}
> Cr-Branched-From: f9659283a5f8d42b3c09228cf5df606fcaf47a3d-refs/heads/14.8.178@{#1}
> Cr-Branched-From: 141232520dc4910401240c531db3af36910a0fd1-refs/heads/main@{#106240}

Bug: 524507838,522126182
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7957108
Task-number: QTBUG-147927
Change-Id: I2760309f5d1e0a8360a7b198980115b404a153da
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/754405
Reviewed-by: Allan Sandfeld Jensen <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/c15e00183bf3d862ef814ae5471baee1bac24fd3

Git commit 478225eb0f25849dca7c5620c2b83760ef124301 by Michal Klocek (on behalf of Victor Gomes) on 22/07/2026 at 08:34..
[backport] CVE-2026-14431: Type Confusion in V8

Check map of inlined array in ArrayIteratorPrototypeNext

Original change's description:
> [maglev] Check map of inlined array in ArrayIteratorPrototypeNext
>
> Fixed: 523884658
> Change-Id: I2a2bba817952d7023eb4b97ad41d8bb460fb9359
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7950517
> Commit-Queue: Leszek Swirski <[email protected]>
> Reviewed-by: Leszek Swirski <[email protected]>
> Auto-Submit: Victor Gomes <[email protected]>
> Cr-Commit-Position: refs/heads/main@{#108053}

(cherry picked from commit 811ebc89d5d26653f73b9b0e589591e09344e551)

Bug: 525280898,523884658
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7983510
Task-number: QTBUG-147927
Change-Id: I2a2bba817952d7023eb4b97ad41d8bb460fb9359
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/754406
Reviewed-by: Allan Sandfeld Jensen <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/478225eb0f25849dca7c5620c2b83760ef124301

Git commit bb83d70d3b3eed78e9eea9caca3e2441fa9e38af by Michal Klocek (on behalf of wangra) on 22/07/2026 at 11:05..
[Backport] CVE-2026-15109: Uninitialized Use in ANGLE

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/angle/angle/+/7963962:
Vulkan: Defer update pruning until image is valid

Prevents exposure of uninitialized memory and GPU memory disclosure
by deferring staged update pruning calculations until the physical
VkImage has been allocated.

Test: angle_end2end_tests --gtest_filter="*Texture2DArrayPrunedSupersededUpdatesLeak*"
Bug: b/516899138
Change-Id: Ib414934f746d75ffd7f0bd47751d0d3be41db079
Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7963962
Commit-Queue: Ran Wang <[email protected]>
Reviewed-by: Charlie Lao <[email protected]>
Reviewed-by: Shahbaz Youssefi <[email protected]>
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753254
Reviewed-by: Allan Sandfeld Jensen <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/bb83d70d3b3eed78e9eea9caca3e2441fa9e38af

Git commit f8ab98cb17d965ba441746d50aa325321e507f85 by Michal Klocek (on behalf of Sangwhan Moon) on 22/07/2026 at 11:05..
[Backport] Dependency for CVE-2026-15114

Manual cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/7912486:
Refactor AV1 sequence header validation to fix hardware context invalidation

This change extracts sequence header comparison logic into a dedicated
helper method to improve readability. Additionally, it fixes an issue
where changes to structural parameters like 128x128 superblocks and film
grain configurations failed to trigger a hardware context
reconfiguration.

Bug: 520565945
Change-Id: I205443bb8f063ff4ee8637d7aa11f0bd79efe5e6
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7912486
Commit-Queue: James Zern <[email protected]>
Commit-Queue: Sangwhan Moon <[email protected]>
Auto-Submit: Sangwhan Moon <[email protected]>
Reviewed-by: James Zern <[email protected]>
Reviewed-by: Dale Curtis <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1644968}
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753261
Reviewed-by: Allan Sandfeld Jensen <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/f8ab98cb17d965ba441746d50aa325321e507f85

Git commit d0e486219df949d551f7f0e3bbd6381f7f6cba89 by Michal Klocek (on behalf of Sangwhan Moon) on 22/07/2026 at 11:05..
[Backport] CVE-2026-15114: Out of bounds read and write in Codecs

Manual cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/8021903:
Fix AV1 hardware context invalidation on sequence tool flag changes

When mid-stream sequence headers alter coding tool flags such as
enable_ref_frame_mvs, enable_order_hint, or enable_superres without
triggering a configuration change, AV1Decoder reuses the existing
hardware context and memory pools. This can cause driver state
desynchronization and out-of-bounds reads/writes if scratch buffers
were not allocated at context creation time.

This change updates RequiresHardwareContextReset() to check all 15
sequence-level coding tool flags that gate hardware resource
allocations.

Bug: 520565945
Test: media_unittests --gtest_filter=AV1DecoderTest.ConfigChangeOnSequenceHeaderToolFlags
Change-Id: I586bdd9347fec513e3e73a3983528d9635b4576c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8021903
Reviewed-by: Ted (Chromium) Meyer <[email protected]>
Commit-Queue: Ted (Chromium) Meyer <[email protected]>
Reviewed-by: Hirokazu Honda <[email protected]>
Auto-Submit: Sangwhan Moon <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1655533}
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753262
Reviewed-by: Allan Sandfeld Jensen <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/d0e486219df949d551f7f0e3bbd6381f7f6cba89

Git commit a9e9f330519a2d8ca70e21289c239190da487fec by Michal Klocek (on behalf of Vladimir Levin) on 22/07/2026 at 11:05..
[Backport] CVE-2026-15118: Use after free in Input

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/7941475:
Extend weak self checks to more places in HandleInputEvent

Various calls can delete the "this" object, so extend the checks
to more spots.

[email protected]

Bug: 523238265
Change-Id: Ifb5b22fbc09bdbcb3a33be65b935d6633c9d03fa
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7941475
Reviewed-by: Dave Tapuska <[email protected]>
Commit-Queue: Vladimir Levin <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1647525}
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753255
Reviewed-by: Allan Sandfeld Jensen <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/a9e9f330519a2d8ca70e21289c239190da487fec

Git commit 70c7f775835d563c3512bb0d0bc18a46c5bf211a by Michal Klocek (on behalf of Tove Petersson) on 22/07/2026 at 11:05..
[Backport] CVE-2026-15119: Inappropriate implementation in GetUserMedia

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/8004471:
Abort pending AudioInputDeviceManager open when closed early

AudioInputDeviceManager::Open() returns a session id immediately and
queries the audio system asynchronously. If Close() is called for that
session before the query completes, the device is not yet in |devices_|
so Close() returns without doing anything, and the later
OpenedOnIOThread() callback still registers the device, leaving a
session that MediaStreamManager no longer tracks.

Track sessions whose open is still in flight and drop the result of
OpenedOnIOThread() when Close() has already been called for the session.

Bug: 523505418
Change-Id: Ib64b19cbf2fb3077bae7107b11d0570d4551efde
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8004471
Commit-Queue: Tove Petersson <[email protected]>
Reviewed-by: Guido Urdaneta <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1654054}
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753256
Reviewed-by: Allan Sandfeld Jensen <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/70c7f775835d563c3512bb0d0bc18a46c5bf211a

Git commit 6ae89c77fa5643e3ece821db6406d7c48a4bbc8c by Michal Klocek (on behalf of Ted Meyer) on 22/07/2026 at 11:05..
[Backport] Dependency for CVE-2026-15121

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/7180528:
Fix raw ptr to stack local binding

`result` and `waiter` are both stack local, captured by unretained raw
ptrs, passed across thread, and then deleted, potentially before that
thread can write back into them.

Now they are owned by RTCVideoDecodeAdapter, and only written into by an
init_cb which is bound to a weak_ptr to it, so they can never get UAF'd.

R=dalecurtis

Fixed: 461214000
Change-Id: I82702adc1af8d3d407053539971d93f78d7e7861
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7180528
Reviewed-by: Dale Curtis <[email protected]>
Commit-Queue: Ted (Chromium) Meyer <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1548220}
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753269
Reviewed-by: Allan Sandfeld Jensen <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/6ae89c77fa5643e3ece821db6406d7c48a4bbc8c

Git commit c3a358d2a1222565854f3a6e25236f3cc577043d by Michal Klocek (on behalf of Erik Språng) on 22/07/2026 at 11:06..
[Backport] CVE-2026-15121: Use after free in WebRTC

Manual cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/7992498:
Add better handling of RtcVideoDecoderAdapter init timeout.

This CL introduced as new private `OnInitializeDone()` callback method
and uses the `weak_decoder_this_` instead of unreatined
`video_decoder_.get()`.

Bug: 523712556
Change-Id: Icc2f8272b948dbc4fa65d5175dbcf60cea033462
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7992498
Reviewed-by: Guido Urdaneta <[email protected]>
Commit-Queue: Erik Språng <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1652310}
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753260
Reviewed-by: Allan Sandfeld Jensen <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/c3a358d2a1222565854f3a6e25236f3cc577043d

Git commit 037b684f367460cf275c46d0f961bde6e6d99b27 by Michal Klocek (on behalf of David Baron) on 22/07/2026 at 11:06..
[Backport] CVE-2026-15123: Insufficient data validation in DOM

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/7963938:
Recheck prerequisites when inserting multiple nodes into a Document.

This moves the check of prerequisites earlier so that it also applies
when the parent node is a Document.  This is needed so that we check
that the nodes' parents are still all null.

The added test is a simplified version of the AI-generated test provided
in the bug.  Without the fix it fails a DCHECK in DCHECK-enabled builds,
at third_party/blink/renderer/core/dom/container_node.cc:400:
DCHECK failed: !target_node->parentNode().

Fixed: 523729553
Change-Id: I409e096d54150f97083a281e0b3dee5a203015ac
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7963938
Commit-Queue: David Baron <[email protected]>
Reviewed-by: Mason Freed <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1650442}
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753257
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/037b684f367460cf275c46d0f961bde6e6d99b27

Git commit 0c1bdb515d1accd1fb3a245adcc00537a2f9a91c by Michal Klocek (on behalf of Joey Arhar) on 22/07/2026 at 11:06..
[Backport] Dependency for CVE-2026-15125, CVE-2026-15126, CVE-2026-15128 (1/3)

Manual cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/7744228:
Add Element::MatchesDisabledPseudoClass

Some elements have special logic for matching :disabled, and having an
overridable method like this matches the presence of
Element::MatchesEnabledPseudoClass and allows elements to override the
behavior without adding a bunch of cases to SelectorChecker.

This patch doesn't change any behavior, and is in preparation for adding
new logic for option elements to change the way they match :disabled.

Bug: 490082172
Change-Id: Ice376ab1f6b6bf6cceae925b89375207a6b62f5b
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7744228
Commit-Queue: Joey Arhar <[email protected]>
Reviewed-by: Joey Arhar <[email protected]>
Reviewed-by: David Baron <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1614138}
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753802
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/0c1bdb515d1accd1fb3a245adcc00537a2f9a91c

Git commit b3a6acd0df3a1e285e3e447d54d7770f67e2c7da by Michal Klocek (on behalf of Joey Arhar) on 22/07/2026 at 11:06..
[Backport] Dependency for CVE-2026-15125, CVE-2026-15126, CVE-2026-15128 (2/3)

Manual cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/7624129:
Make option:disabled match inside disabled select

Options and optgroups aren't considered disabled when they are inside a
disabled select, which is causing an issue for customizable select UA
styles where hover styles are activating when the select is disabled.

Some code still needs to consider options inside a disabled select as
enabled in order to make sure that an option becomes selected inside a
disabled select, so now the :enabled and :disabled pseudo-classes don't
match up with the internally disabled state.

Context: https://github.com/w3c/csswg-drafts/issues/13383
Spec PR: https://github.com/whatwg/html/pull/12205

Fixed: 490082172
Change-Id: I8c4dac7ee5da5e36ab205a536d36651528937df8
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7624129
Reviewed-by: David Baron <[email protected]>
Reviewed-by: Joey Arhar <[email protected]>
Commit-Queue: Joey Arhar <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1624951}
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753794
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/b3a6acd0df3a1e285e3e447d54d7770f67e2c7da

Git commit d97081b69ed823fdc5e3005f0bf02ee82820af53 by Michal Klocek (on behalf of Joey Arhar) on 22/07/2026 at 11:06..
[Backport] Dependency for CVE-2026-15125, CVE-2026-15126, CVE-2026-15128 (3/3)

Manual cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/7921190:
Fix option element disabled invalidation

Now that option and optgroup elements match the :disabled selector based
on whether their ancestor select is disabled via the
OptionDisablednessCheckAncestors flag from
commit a76ffb0bf65c2530cfc3a6b1334f0dc4e9638de6, they need to have their
:disabled and :enabled pseudo-classes invalidated when their ancestor
select has its disabledness changed.

Fixed: 490082172
Change-Id: Ic712a8eeac2de23502eb9f6690fe0e46faef7a20
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7921190
Reviewed-by: David Baron <[email protected]>
Reviewed-by: Joey Arhar <[email protected]>
Commit-Queue: Joey Arhar <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1651106}
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753795
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/d97081b69ed823fdc5e3005f0bf02ee82820af53

Git commit cf732ac6d437759204177a8f037a692f836ab12e by Michal Klocek (on behalf of Joey Arhar) on 22/07/2026 at 11:06..
[Backport] CVE-2026-15125, CVE-2026-15126, CVE-2026-15128: Inappropriate implementation / Use after free in Forms

Manual backport of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/7948021:
Don't fire change event during mutations affecting disabledness

Running script inside mutations (InsertedInto, RemovedFrom, MovedFrom)
is not allowed.

Fixed: 523756329, 523748081, 523737685
Change-Id: Ib0842d5c8fcf837d96f270a8d50d4189ef151d06
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7948021
Reviewed-by: Joey Arhar <[email protected]>
Reviewed-by: David Baron <[email protected]>
Commit-Queue: Joey Arhar <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1652428}
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753263
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/cf732ac6d437759204177a8f037a692f836ab12e

Git commit be25fee0eb567daa877b850195229990dd1c72fc by Michal Klocek (on behalf of Brandon Jones) on 22/07/2026 at 11:06..
[Backport] CVE-2026-15127: Inappropriate implementation in WebGL

Manual cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/8025784:
WebGL: use per-caller resolvers for makeXRCompatible()

makeXRCompatible() cached a single ScriptPromiseResolver while the async
XR-compatible request was in flight and returned that resolver's promise
to every subsequent caller. Because a single WebGLRenderingContextBase
is shared by every world that wraps a given canvas, a caller from a
different world could be handed a Promise that didn't belong to its
world.

Track all pending callers in a HeapVector instead, creating a fresh
resolver bound to the caller's ScriptState for each call and
resolving/rejecting them together when the in-flight request completes
(the same pattern as HTMLMediaElement's play() resolvers). Add a
wpt_internal test that calls makeXRCompatible() from an isolated world
while a main-world request is pending and checks that the returned
Promise belongs to the calling world.

(Patch and description provided by Project Fortify)

Fixed: 523752265
Change-Id: I9f5bf2d79cc4ee1ae8564f13175bbba2af0f58b2
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8025784
Reviewed-by: Alexander Cooper <[email protected]>
Commit-Queue: Brandon Jones <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1655552}
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753259
Reviewed-by: Allan Sandfeld Jensen <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/be25fee0eb567daa877b850195229990dd1c72fc

Git commit 6c0f4fa826b82c36bb3d856a6bab089853d0fc0e by Michal Klocek (on behalf of Darius Mercadier) on 22/07/2026 at 11:06..
[Backport] CVE-2026-15132: Uninitialized Use in V8

Manual cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/v8/v8/+/8005985:
[turboshaft] Mark array initializing stores as initializing

With the right combination of loop unrolling and a bunch of other
optimizations kicking in in the perfect way, this missing annotation
can lead to the initializing stores being elided and the GC observing
uninitialized memory.

Fixed: 527385397
Change-Id: I581f8bf8b518a64d2a3427ab18746c1242ba6194
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8005985
Reviewed-by: Nico Hartmann <[email protected]>
Auto-Submit: Darius Mercadier <[email protected]>
Commit-Queue: Nico Hartmann <[email protected]>
Cr-Commit-Position: refs/heads/main@{#108296}
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753258
Reviewed-by: Allan Sandfeld Jensen <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/6c0f4fa826b82c36bb3d856a6bab089853d0fc0e

Git commit 0842cb1e258eff1e6f960b318a06ca10dae82f7d by Michal Klocek (on behalf of Wan-Teh Chang) on 22/07/2026 at 11:07..
[Backport] CVE-2026-15767: Heap buffer overflow in libyuv

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/libyuv/libyuv/+/8031724:
I010ToNV12: dispatch Convert16To8Row on halfwidth

The Convert16To8Row function pointer in I010ToNV12 is only ever called
with halfwidth for the chroma planes (the Y plane goes through
Convert16To8Plane which has its own dispatch), but its SIMD variants
were selected based on the alignment of the full luma width. When width
is a multiple of 32 but halfwidth is not, the bare AVX2 kernel was
selected and over-read the chroma sources and over-wrote the temporary
row buffer. Match the MergeUVRow dispatch in the same function and key
on halfwidth.

Bug: chromium:514748734
Change-Id: I4c2a42857828cdcc6505ebaa65d5b6a95b0f7e55
Reviewed-on: https://chromium-review.googlesource.com/c/libyuv/libyuv/+/8031724
Reviewed-by: Frank Barchard <[email protected]>
Commit-Queue: Wan-Teh Chang <[email protected]>
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753107
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/0842cb1e258eff1e6f960b318a06ca10dae82f7d

Git commit 8e600d8d0648012f7dcd5037503383e23c3dc492 by Michal Klocek (on behalf of Sam Parker) on 22/07/2026 at 11:07..
[Backport] CVE-2026-15770: Uninitialized Use in V8

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/v8/v8/+/8024753:
[compiler][arm64][arm] IsOnlyUserOfNodeInSameBlock

Don't try to use IsOnlyUserOfNodeInSameBlock when the continuation is
anything but a branch or set as it's possible that we've already
explored through the original conditional setting instruction and are
trying to optimise a binop that would then have to be pulled past a
use to be tied to the continuation.

Bug: 524792614
Change-Id: I94a3c46799197c152873ea9f09e99ff4db4efccd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8024753
Reviewed-by: Nico Hartmann <[email protected]>
Commit-Queue: Sam Parker-Haynes <[email protected]>
Reviewed-by: Daniel Lehmann <[email protected]>
Cr-Commit-Position: refs/heads/main@{#108482}
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753108
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/8e600d8d0648012f7dcd5037503383e23c3dc492

Git commit 9afbb666f50c709e21927eb4b44978eebac95338 by Michal Klocek (on behalf of Eugene Zemtsov) on 22/07/2026 at 11:11..
[Backport] CVE-2026-15771: Insufficient validation of untrusted input in Media

Manual backport of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/8013291:
media: Validate source texture format in PerformD3DCopy

Unfortunately ID3D11DeviceContext::CopySubresourceRegion silently drops
copies between incompatible formats.
This change adds an explicit check in PerformD3DCopy to ensure the
source texture is DXGI_FORMAT_NV12 before copying.

Bug: 525177160
Change-Id: I262079c23c553938c08cdc381b8f6d5b2b86d3ff
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8013291
Reviewed-by: Ted (Chromium) Meyer <[email protected]>
Commit-Queue: Eugene Zemtsov <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1653876}
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753110
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/9afbb666f50c709e21927eb4b44978eebac95338

Git commit 4d759f0324e6094b75109e46d2979339cc6126fc by Michal Klocek (on behalf of Tzarial) on 22/07/2026 at 11:11..
[Backport] CVE-2026-15772: Use after free in GPU

Manual cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/8015318:
[agy][gpu] Fix FBO delete-while-bound bug

Ensure the previous framebuffer is restored before deleting the
temporary framebuffer in GLTextureHolder::ReadbackToMemory.

Some drivers retain an internal reference to the previously bound FBO
across bind transitions; deleting it while bound and then rebinding
can dereference freed driver state.

Fixed: 525317502
Test: gpu_unittests --gtest_filter=GLTextureHolderTest.*
Change-Id: I359330bb3d1d07c7605b85039081a5f70d8c10c4
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8015318
Reviewed-by: Corentin Wallez <[email protected]>
Reviewed-by: Colin Blundell <[email protected]>
Commit-Queue: Tzarial <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1657204}
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753105
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/4d759f0324e6094b75109e46d2979339cc6126fc

Git commit 9383d030c7235271b772ca61d016ba4539744935 by Michal Klocek (on behalf of Xinchao Tian) on 22/07/2026 at 11:12..
[Backport] CVE-2026-15773: Use after free in Core

Manual cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/8003496:
Guard against re-entrant destruction in CreateNewWindow

CreateNewWindow() (opener-suppressed path) calls
delegate_->AddNewContents() and then continues using state owned by this
(opener, delegate_, primary frame tree).

On Windows, AddNewContents() may enter a nested message loop while
showing a new browser window. A window-close message can destroy the
opener WebContents during this call, causing use-after-free.

Fix by capturing a WeakPtr to this before calling AddNewContents() and
aborting if it is invalidated, similar to existing weak_new_contents
logic.

Add a browsertest that destroys the opener inside AddNewContents() to
prevent regressions.

Bug: 527676561
Change-Id: If224916a349113845cce68c438b04f451126d6ee
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8003496
Commit-Queue: Xinchao Tian <[email protected]>
Reviewed-by: Alex Moshchuk <[email protected]>
Reviewed-by: Bo Liu <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1653497}
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753104
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/9383d030c7235271b772ca61d016ba4539744935

Git commit 7a8ea1099276359e16fa43c8ed6f19c607c7b432 by Michal Klocek (on behalf of Arthur Sonzogni) on 22/07/2026 at 11:12..
[Backport] CVE-2026-15774: Use after free in Skia

Cherry-pick of patch originally reviewed on
https://skia-review.googlesource.com/c/skia/+/1284796:
Fix Use-After-Free in SubRunAllocator

The destruction order of `std::tuple` members is not specified by the
C++ standard. This is the root cause of a Use-After-Free (UAF) in
SubRunAllocator. Replacing the tuple with a custom struct resolves the
issue by guaranteeing the correct destruction order.

The Bug:
During deserialization of a Slug (specifically in
SlugImpl::MakeFromBuffer), if the input buffer is invalid or corrupted,
Skia detects this and returns nullptr early.

This early return destroys the temporary return value. In the old code
(using `std::tuple`), `SubRunInitializer` (index 0) was destructed
first and freed the backing memory.

`SubRunAllocator` (index 2) was destructed next. Its destructor
(~BagOfBytes) then attempted to access fEndByte (which points inside
the freed memory), resulting in a UAF (read) followed by a wild-free
or double-free.

The Fix:
We replaced the `std::tuple` with a custom helper struct
`AllocateAndArenaResult`:

struct AllocateAndArenaResult {
    SubRunInitializer<T> initializer; // Destructed last
    int totalMemorySize;
    SubRunAllocator alloc;            // Destructed first
};

Since struct members are guaranteed to be destructed in the reverse
order of their declaration, declaring `alloc` last guarantees it is
destructed before `SubRunInitializer` frees the memory.

Additionally, this CL refactors `SubRunInitializer` to use
`std::unique_ptr` with a custom deleter to manage the raw memory,
removing the need for a manual destructor and making the ownership
transfer explicit via `release()`.

Bug: skia:530646115
Change-Id: I80cba4fdb9eebfe16e5ec837d70b5646422fbcff
Reviewed-on: https://skia-review.googlesource.com/c/skia/+/1284796
Commit-Queue: Kaylee Lubick <[email protected]>
Reviewed-by: Kaylee Lubick <[email protected]>
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753103
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/7a8ea1099276359e16fa43c8ed6f19c607c7b432

Git commit f4392e582804f99cc579537743b58bee5a0cc348 by Michal Klocek (on behalf of Igor Sheludko) on 22/07/2026 at 11:12..
[Backport] CVE-2026-15775: Insufficient policy enforcement in V8

Manual cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/v8/v8/+/8064992:
[stack-traces] Make .stack accessors look only at receiver

... when reading internal stack trace or message (i.e. [[ErrorData]]
slot). Update tests accordingly.

This is a first step towards implementing Error Stack Accessor proposal
https://tc39.es/proposal-error-stack-accessor/#sec-get-error.prototype-stack.

Fixed: 531319201
Bug: 512450179
Change-Id: I333769d61d20c99b59250b8cbd2dcf3172b56640
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8064992
Reviewed-by: Olivier Flückiger <[email protected]>
Commit-Queue: Igor Sheludko <[email protected]>
Cr-Commit-Position: refs/heads/main@{#108587}
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753102
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/f4392e582804f99cc579537743b58bee5a0cc348

Git commit b64cac4e71e9a53eb9fb38185b5db596604e4e56 by Michal Klocek (on behalf of pthier) on 22/07/2026 at 11:12..
[Backport] CVE-2026-15776: Type Confusion in V8

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/v8/v8/+/8070079:
[regexp] Hard Check that index + 1 is a Smi in AdvanceStringIndex

Bug: 532595489
Change-Id: I3fb2a3246ebbf801b883cc9fe22a7903cf7b1edd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8070079
Reviewed-by: Jakob Linke <[email protected]>
Commit-Queue: Patrick Thier <[email protected]>
Auto-Submit: Patrick Thier <[email protected]>
Cr-Commit-Position: refs/heads/main@{#108562}
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753101
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/b64cac4e71e9a53eb9fb38185b5db596604e4e56

Git commit 16af55701838c2aee4b66bffbe7789cfa935f47d by Michal Klocek (on behalf of Test User) on 22/07/2026 at 11:12..
[Backport] CVE-2026-15778: Insufficient validation of untrusted input in Navigation

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/8028880:
Reject redirects from blob: URL navigations

NavigationURLLoaderImpl already assumes that requests to the blob:
scheme are never redirected and skips interceptor setup on that basis.
Make that assumption explicit in OnReceiveRedirect: if a redirect
arrives while loading a blob: URL, fail the navigation with
ERR_UNSAFE_REDIRECT instead of consulting bypass_redirect_checks from
the response head, since the underlying Blob endpoint may live outside
the browser process and a real blob load never produces a redirect.

Add a content_browsertest that registers a blink::mojom::Blob whose
Load() responds with OnReceiveRedirect and verifies that navigating to
its blob: URL fails rather than following the redirect.

TAG=agy
CONV=51d0251b-c784-4f07-b4fe-93b5087402df

Fixed: 513795122
Change-Id: I8525501812232c2aa2bef9422d282ad4c12112e0
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8028880
Commit-Queue: Minoru Chikamune <[email protected]>
Reviewed-by: Rakina Zata Amni <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1656964}
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753109
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/16af55701838c2aee4b66bffbe7789cfa935f47d

Git commit c7bb9bf7a726c40ed1e03523631d013862f18032 by Michal Klocek (on behalf of Sangwhan Moon) on 22/07/2026 at 11:12..
[Backport] CVE-2026-15899: Use after free in CameraCapture

Manual backport of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/7912588:
[mac] Fix use-after-free in VideoCaptureDeviceApple Mojo callback

AVFoundation invokes OnPhotoTaken and OnPhotoError on an arbitrary
background queue. VideoCaptureDeviceApple::OnPhotoTaken was previously
executing std::move(photo_callback_).Run(...) directly on that
background thread, which causes threading violations and potential
use-after-free/double-free issues if the VideoCaptureDeviceApple
instance is destroyed concurrently, or if photo_callback_ is accessed
while being modified on the main task runner.

Bug: 516987782
Change-Id: Ibefa689f22116a4e5e3d89da7a3476af36c55251
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7912588
Reviewed-by: Ilya Nikolaevskiy <[email protected]>
Commit-Queue: Sangwhan Moon <[email protected]>
Auto-Submit: Sangwhan Moon <[email protected]>
Reviewed-by: Ted (Chromium) Meyer <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1656796}
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753800
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/c7bb9bf7a726c40ed1e03523631d013862f18032

Git commit 03c7c98fa18bf7a977ea805c898e4a77792cac05 by Michal Klocek (on behalf of Tzarial) on 22/07/2026 at 11:12..
[Backport] CVE-2026-15900: Use after free in GPU

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/8015317:
[agy][gpu] Fix active transform feedback buffer tracking

An active (even if paused/unbound) transform feedback object continues
to reference its attached buffers in the driver until
glEndTransformFeedback. If a different transform feedback object is
bound, the previous one becomes unbound but remains active, and its
attached buffers should still be considered busy and locked.

This CL refactors IndexedBufferBindingHost and TransformFeedback to use
AreBuffersBound() instead of is_bound_ directly. For
TransformFeedback, AreBuffersBound() is defined as (is_bound_ ||
active_). This preserves symmetric SetIsBound(true/false) calls on
TransformFeedback while correctly tracking buffer bindings on active
(but paused/unbound) transform feedback objects.

Additionally, this CL addresses destruction edge cases by:
1. Adding ForceUnbindBuffers() to prevent a buffer binding state leak
   on destruction of an active but unbound transform feedback object.
2. Restricting glEndTransformFeedback() inside the destructor to only
   run when the object is currently bound, matching GL requirements.

Fixed: 523750584
Test: gpu_unittests --gtest_filter=TransformFeedbackManagerTest.*
Change-Id: I4d9f0f133e18e54f57a14e15b9c5d70a36a099a7
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8015317
Reviewed-by: Kai Ninomiya <[email protected]>
Commit-Queue: Kai Ninomiya <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1659202}
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753796
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/03c7c98fa18bf7a977ea805c898e4a77792cac05

Git commit 843719168ebfb1d6d864047ff8b4c83f7c6a5c44 by Michal Klocek (on behalf of Maks Orlovich) on 22/07/2026 at 11:13..
[Backport] CVE-2026-15901: Use after free in Network

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/8074044:
SimpleCache: fix problems with self-deletion in post-doom callbacks

Fixed: 533446300
Change-Id: I130245edb091f1d48437d74a59aa012667a6227b
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8074044
Reviewed-by: Josh Karlin <[email protected]>
Commit-Queue: Maks Orlovich <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1661113}
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753797
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/843719168ebfb1d6d864047ff8b4c83f7c6a5c44

Git commit dfba70f70f40542adc94e1c425bab29581c8145f by Michal Klocek (on behalf of Victor Gomes) on 22/07/2026 at 11:13..
[Backport] CVE-2026-15903: Out of bounds read and write in V8

Manual cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/v8/v8/+/8052504:
[turbofan] Keep safe-integer check in ToNumber Word32 lowering

Fixed: 531503216
Change-Id: Icd80dc73acffe448922c6d3a33e7b750662223af
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8052504
Commit-Queue: Victor Gomes <[email protected]>
Auto-Submit: Victor Gomes <[email protected]>
Reviewed-by: Nico Hartmann <[email protected]>
Cr-Commit-Position: refs/heads/main@{#108479}
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753798
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/dfba70f70f40542adc94e1c425bab29581c8145f

Git commit f5ab470c8e50a15d336c840d5fbfb92ece0d2a89 by Michal Klocek (on behalf of Tom Anderson) on 22/07/2026 at 11:13..
[Backport] CVE-2026-15905: Use after free in Aura

Manual backport of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/8072900:
[aura] Guard against root window destruction in ScopedCursorHider

Avoid Use-After-Free during device scale factor changes on Linux/X11 by
using an aura::WindowTracker inside
ScopedCursorHider::~ScopedCursorHider(). Previously,
display::Screen::Get()->GetDisplayNearestWindow() could synchronously
dispatch events that tear down the root window and the CursorClient. By
tracking window destruction, the window is verified to be alive after
returning from display queries before making calls on the CursorClient.

Fixed: 532970574
Change-Id: I495fa5f12bf0a58fb047009d792366879e75521b
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8072900
Commit-Queue: Thomas Anderson <[email protected]>
Reviewed-by: Colin Blundell <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1661444}
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753799
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/f5ab470c8e50a15d336c840d5fbfb92ece0d2a89