[qt/qt/qtwebengine-chromium]: Summary of bulk changes made

Git repository change summary for qt/qt/qtwebengine-chromium
Pushed by mirror-service into branch '140-based'.
Changed from f5ab470c8e50a15d336c840d5fbfb92ece0d2a89 to 96505d59557fa63daaa2195ad562c663e26cabde
Acknowledgement was received that this change introduces only existing code that has been pushed to another public open source repository.

This change contains the following new commits:

Git commit 280aad119dae9d655d10a2d8aeda1ff5186c7523 by Michal Klocek (on behalf of Geoff Lang) on 23/07/2026 at 10:01..
[Backport] CVE-2026-13877: Insufficient validation of untrusted input in ANGLE

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/angle/angle/+/7832969:
Add hardened context checks for several isWebGL() checks.

I triaged the calls to isWebGL and made sure they fell into one of three
categories:
 1. Check isWebGL() only when it's WebGL specific validation with no
    security implications.
 2. Check isWebGL() || isRobustResourceInitEnabled() when resource
    initialization may need to happen.
 3. Check isWebGL() || isHardenedContext() when protecting against
    undefined behaviour.

Fixed: chromium:498820206
Change-Id: I70dcdbee4806b8e047972eea080a178ed5c501b5
Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7832969
Commit-Queue: Geoff Lang <[email protected]>
Reviewed-by: Shahbaz Youssefi <[email protected]>
Task-number: QTBUG-147898
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753343
Reviewed-by: Allan Sandfeld Jensen <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/280aad119dae9d655d10a2d8aeda1ff5186c7523

Git commit c0edcb3a81963c05958c7fc04f38469081744905 by Michal Klocek (on behalf of Alvin Ji) on 23/07/2026 at 10:01..
[Backport] CVE-2026-13878: Use after free in Bluetooth

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/7833477:
bluetooth: Fix Use-After-Free in BluetoothSocketMac::Send

IOBluetooth writeAsync callbacks can fire synchronously on macOS,
causing premature request cleanup and UAFs if pending write counters are
incremented after the call.

This CL pre-calculates total chunks and initializes active_async_writes
upfront to ensure safe lifetime management across multi-chunk writes.

Bug: 499007266
Change-Id: I7bb48661e3b2ce72e3f9457c4be07b66a027b845
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7833477
Reviewed-by: Matt Reynolds <[email protected]>
Commit-Queue: Alvin Ji <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1631527}
Task-number: QTBUG-147898
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753344
Reviewed-by: Allan Sandfeld Jensen <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/c0edcb3a81963c05958c7fc04f38469081744905

Git commit 9b200388953f113f63d661903578a57d30bae47d by Michal Klocek (on behalf of Alvin Ji) on 23/07/2026 at 10:01..
[Backport] CVE-2026-13879: Use after free in Bluetooth

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/7876494:
bluetooth: Keep IOBuffer alive during async macOS Bluetooth socket writes

In BluetoothSocketMac::Send, asynchronous writes are issued to the OS
via WriteAsync using a raw pointer to the buffer's data. Previously, the
SendRequest queue struct did not hold a strong reference to the
net::IOBuffer. Consequently, the buffer could go out of scope and be
destroyed while the asynchronous write was still in progress, leading to
a potential use-after-unmap information leak.

This change stores the scoped_refptr of the net::IOBuffer in
SendRequest, guaranteeing that the buffer remains valid and is kept
alive until the write completion callback is executed and the request is
popped from the queue.

Bug: 499022239
Change-Id: If017da97516dc876b9190c37cf763dc0443d3159
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7876494
Commit-Queue: Alvin Ji <[email protected]>
Reviewed-by: Matt Reynolds <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1637042}
Task-number: QTBUG-147898
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753345
Reviewed-by: Allan Sandfeld Jensen <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/9b200388953f113f63d661903578a57d30bae47d

Git commit 96505d59557fa63daaa2195ad562c663e26cabde by Michal Klocek (on behalf of Andrea Orru) on 23/07/2026 at 10:05..
[Backport] CVE-2026-13891: Insufficient validation of untrusted input in Extensions

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/7886165:
[Extensions] Fix DoS of events via malformed filters in EventListenerMap

Prevents a compromised renderer from permanently disabling delivery of
specific extension events by registering a listener with a malformed
filter. We now check the result of EventFilter::AddEventMatcher and
abort adding the listener if it fails. This avoids poisoning the
EventListenerMap state with invalid matchers that cause subsequent
legitimate events to be dropped.

Fixed: 501631475
Change-Id: I3fe0a9988408f2e2a5cbdb391208e4b1d1ec0fbd
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7886165
Reviewed-by: Tim <[email protected]>
Commit-Queue: Andrea Orru <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1638898}
Task-number: QTBUG-147898
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/753350
Reviewed-by: Allan Sandfeld Jensen <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/96505d59557fa63daaa2195ad562c663e26cabde