[qt/qt/qtwebengine-chromium]: Summary of bulk changes made

Git repository change summary for qt/qt/qtwebengine-chromium
Pushed by mirror-service into branch '140-based'.
Changed from 96505d59557fa63daaa2195ad562c663e26cabde to 1e2ffa9caf5466dda4228c0d30d943251614524b
Acknowledgement was received that this change introduces only existing code that has been pushed to another public open source repository.

This change contains the following new commits:

Git commit d41780650f6fce3d4b4f17fd6dcf110d4cfb41d2 by Michal Klocek (on behalf of Markus Handell) on 23/07/2026 at 14:09..
[backport] CVE-2026-13942: Insufficient validation of untrusted input in Video Capture (1/2)

Capture: prevent virtual devices shadowing real ones.

Bug: 513194241, 513186670
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7852499
Taks-number: QTBUG-147901
Change-Id: Ie5827d50767ae0eb7845329b8111747e65e3f2a1
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/754732
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/d41780650f6fce3d4b4f17fd6dcf110d4cfb41d2

Git commit 0d5531301e7bc229170590792afbc161c9f81373 by Michal Klocek (on behalf of Markus Handell) on 23/07/2026 at 14:09..
[backport] CVE-2026-13942: Insufficient validation of untrusted input in Video Capture (2/2)

Capture: prevent DoS-ing real device capture by previously used virtual device.

Fixed: 513186670
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7852489
Task-number: QTBUG-147901
Change-Id: I40f19f2152576594cab68d8aae551ea8ccdbb641
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/754733
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/0d5531301e7bc229170590792afbc161c9f81373

Git commit 85d9f56dbbc4e3dfb6b52ac11dee925293b0797c by Michal Klocek (on behalf of Kevin Babbitt) on 23/07/2026 at 14:09..
[backport] CVE-2026-13943: Uninitialized Use in CSS

Ensure is_current_color is initialized for unresolved color functions

Also initialize a related local variable at a call site as
defense-in-depth.

Fixed: 513204116
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7850514
Task-number: QTBUG-147901
Change-Id: Ic092fcb1e0b50b61009706408733e2c8a4e23329
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/754734
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/85d9f56dbbc4e3dfb6b52ac11dee925293b0797c

Git commit 7197a39a79c1400fd93fb597b3601aa5c157f5f0 by Michal Klocek (on behalf of Avi Drissman) on 23/07/2026 at 14:09..
[backport] CVE-2026-13944: Inappropriate implementation in DataTransfe

Provide the correct filename for drag and drop

When a user drops a file from a website into the Finder, it's possible
that there is an existing file with the name in the drop location. In
that case, while fulfilling the file drop promise, the function
WebContentsViewMac::DragPromisedFileTo() will use the helper function
content::CreateFileForDrop() to generate a new filename that is derived
from the dropped filename, so there will be no conflict. This new file
path is then returned to the caller.

Psych! The out-parameter is set to the new filename, but then
overwritten at the end of the function by the original value. The
comment explaining this is double nonsense: it says that the value might
have been overwritten, but the parameter is passed in by value, so it
couldn't have been overwritten, and the value assigned is the old,
incorrect value.

Solve this by just removing this incorrect code.

Fixed: 513224212
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7849762
Task-number: QTBUG-147901
Change-Id: Id44cbff6f750ee38c561b15400f97771c6a9c7bb
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/754735
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/7197a39a79c1400fd93fb597b3601aa5c157f5f0

Git commit 3e4d78c6d9b5f2f5dfe5476e651f528ff0b3bdaf by Michal Klocek (on behalf of Alexander Cooper) on 23/07/2026 at 14:09..
[backport] CVE-2026-13947: Uninitialized Use in XR

Initialize stage_parameters_id_ in OpenXrRenderLoop

Explicitly initialize stage_parameters_id_ to 0 in OpenXrRenderLoop
header to prevent it from using uninitialized memory for the value.

Fixed: 513280648
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7853507
Task-number: QTBUG-147901
Change-Id: I63fa68458e7311d7c7ddfe37cd8023c35c4a29fd
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/754736
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/3e4d78c6d9b5f2f5dfe5476e651f528ff0b3bdaf

Git commit 70fbd1c47d6953dd3f0bb1a28a62d28e50911959 by Michal Klocek (on behalf of Geoff Lang) on 23/07/2026 at 14:09..
[backport] CVE-2026-13950: Uninitialized Use in GPU

Disable GL_RASTERIZER_DISCARD during shared image clearing.

Clear commands are ignored while rasterizer discard is enabled.

Fixed: 513360781
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7874936
Task-number: QTBUG-147901
Change-Id: I1d13c08b5004d9ff01f5781e87c494958eeb6b17
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/754737
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/70fbd1c47d6953dd3f0bb1a28a62d28e50911959

Git commit 6afc33bc0e8f35e37fa121ed30d08f10ba9d1a91 by Michal Klocek (on behalf of Alvin Ji) on 23/07/2026 at 14:09..
[backport] CVE-2026-13951: Policy bypass in USB

usb: Block SetInterfaceAlternateSetting on protected interfaces

Fixes a WebUSB policy bypass where a compromised renderer could issue
unauthorized SET_INTERFACE commands to blocked interface classes (e.g.,
HID) on Linux-based platforms.

To prevent this, we now validate the target interface against blocked
interface classes at the Mojo layer in DeviceImpl, and enforce that the
interface must be claimed first in the UsbDeviceHandleUsbfs backend to
prevent exploiting the Linux kernel's auto-claim behavior.

Bug: 513394321
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7855216
Task-number: QTBUG-147901
Change-Id: Ic2f851f3fc68ed714406cd09773b8dce636d39ec
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/754738
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/6afc33bc0e8f35e37fa121ed30d08f10ba9d1a91

Git commit 645f8c258c06f4b5656d59e6bf89e34ec2c49d3c by Michal Klocek (on behalf of Noam Rosenthal) on 23/07/2026 at 14:09..
[backport] CVE-2026-13952: Inappropriate implementation in PerformanceAPIs

LoAF: don't expose function names of double-bound functions

Bug: 513401808
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7864061
Task-number: QTBUG-147901
Change-Id: I3647aa873300b5e7a40d9f5059fad6994efe3e19
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/754739
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/645f8c258c06f4b5656d59e6bf89e34ec2c49d3c

Git commit 1e2ffa9caf5466dda4228c0d30d943251614524b by Michal Klocek (on behalf of David Baron) on 23/07/2026 at 14:09..
[backport] CVE-2026-13954: Insufficient policy enforcement in XML

Ensure we've initialized libxml before parsing XSLT.

Fixed: 513504934
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7850598
Task-number: QTBUG-147901
Change-Id: Ide1f7bca5b6ea4e706bdf0fd4f327098205281ac
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/754740
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/1e2ffa9caf5466dda4228c0d30d943251614524b