[qt/qt/qtwebengine-chromium]: Summary of bulk changes made

Git repository change summary for qt/qt/qtwebengine-chromium
Pushed by mirror-service into branch '140-based'.
Changed from 2b58222ca1e73e710a9278986a40c1b6890bd09d to 898dae20d240b7a29dd74423ce7a18173cad225a
Acknowledgement was received that this change introduces only existing code that has been pushed to another public open source repository.

This change contains the following new commits:

Git commit f184bfa06e52dd7d11a1e818c587c1e21e1e7264 by Moss Heim on 28/07/2026 at 13:12..
[fixup][3rdparty] Unbundle Linux system libraries for GN

Pass USE_SYSTEM_MINIZIP to builds. Remove previously unused shim
code which makes use of that, to avoid changing behavior.

This is used in the following commit to make use of Chromium-specific
extensions to minizip types.

Change-Id: Id9867f07de0d17c613d9e1f2ba349fe9e714ecfe
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/749071
Reviewed-by: Michael Brüning <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/f184bfa06e52dd7d11a1e818c587c1e21e1e7264

Git commit 23ee9390c48a3fbef1f2142b0538a1c28eec7f69 by Moss Heim (on behalf of Hans Wennborg) on 28/07/2026 at 13:13..
[Backport] CVE-2026-11266: Policy bypass in SafeBrowsing

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/7797172:
[minizip] Store the filename from Unicode Path Extra Field separately

Instead of overriding unz_file_info64's size_filename and writing it to
szFileName, store the Unicode filename and its size in new fields.

Overriding size_filename could cause unzGoToNextFile() to jump to the
wrong offset, potentially skipping a file in the central directory,
as demonstrated by a newly added test.

Storing the Unicode filename and its size separately avoids that
problem and lets the caller decide what to do with the filename. Besides
fixing the problem above, that seems like a safer way of bolting on
support for this functionality.

Bug: 40623474, 500521311
Change-Id: I06e6c8a8ff8baa729b10a67a998f8804803ae6cd
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7797172
Commit-Queue: Hans Wennborg <[email protected]>
Reviewed-by: Joshua Pawlicki <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1624516}
Task-number: QTBUG-147421
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/749072
Reviewed-by: Michael Brüning <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/23ee9390c48a3fbef1f2142b0538a1c28eec7f69

Git commit cfff3b9d38c0ac075db095a45a7c46dde2761e09 by Michael Brüning (on behalf of Shrek Shao) on 28/07/2026 at 14:03..
[Backport] CVE-2026-14408: Uninitialized Use in Dawn

Cherry-pick of patch originally reviewed on
https://dawn-review.googlesource.com/c/dawn/+/309588:
Remove the optimization of a clearing buffer in BlitTextureToBuffer

This optimization is temporarily removed because we cannot mark
the buffer as initialized until the command buffer is submitted.

FIXED: 513631768
Change-Id: Ie6f539e07139c5eefef9ddf87231af346d7a9e28
Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/309588
Auto-Submit: Shrek Shao <[email protected]>
Reviewed-by: Loko Kung <[email protected]>
Commit-Queue: Shrek Shao <[email protected]>
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/755888
Reviewed-by: Allan Sandfeld Jensen <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/cfff3b9d38c0ac075db095a45a7c46dde2761e09

Git commit 3cfa11a82a0b0209b4da8f616fb4b8b586bd8322 by Michael Brüning (on behalf of Corentin Wallez) on 28/07/2026 at 14:03..
[Backport] CVE-2026-14421: Uninitialized Use in Dawn

Manual backport of patch originally reviewed on
https://dawn-review.googlesource.com/c/dawn/+/311895:
Use VkDriverId to decide workaround toggles.

The IsAndroidFoo conditions matched GPUs only on Android when the same
drivers may be used on ChromeOS. To broaden the checks without
penalizing other drivers, PhysicalDeviceVk now uses VkDriverId that lets
us detect which driver we're running on. Assuming all the proprietary
drivers are the same source (and that the workarounds are for driver
issues, not hardware issues), this gives more precise conditions for
when the workaround is needed.

Also group toggles under IsIntelMesa together.

Fixed: 517033235
Change-Id: I67775c8a508f03e6adaf440d6577a319c1f65a78
Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/311895
Reviewed-by: Brandon Jones <[email protected]>
Commit-Queue: Corentin Wallez <[email protected]>
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/755889
Reviewed-by: Allan Sandfeld Jensen <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/3cfa11a82a0b0209b4da8f616fb4b8b586bd8322

Git commit 1d741e56ae96b1c3ab5614054cc55af254f9cfd0 by Michael Brüning (on behalf of Maks Orlovich) on 28/07/2026 at 14:03..
[Backport] CVE-2026-11673: Use after free in InterestGroups

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/7877578:
FLEDGE: Fix wrong timing of microtask checkpoint execution

Bug: 516902973
Change-Id: Ibac10bc5f07b40ca9cd984fe30e5950f7c12a7ff
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7877578
Commit-Queue: Maks Orlovich <[email protected]>
Reviewed-by: Russ Hamilton <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1637121}
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/755890
Reviewed-by: Allan Sandfeld Jensen <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/1d741e56ae96b1c3ab5614054cc55af254f9cfd0

Git commit 898dae20d240b7a29dd74423ce7a18173cad225a by Michael Brüning (on behalf of Maks Orlovich) on 28/07/2026 at 14:04..
[Backport] CVE-2026-15133: Use after free in InterestGroups

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/8063845:
FLEDGE: fix lifetime reportWin's deprecatedUrl handler.

Original change's description:
> FLEDGE: fix lifetime reportWin's deprecatedUrl handler.
>
> Other lazy fillers seem fine on read-through, but just in case:
> 1) Reuse unused logger param from the config filler --- it gets
>    it from ContextRecycler, and using the passed in one would
>    cause trouble.
> 2) Call the checkpoint after resetting the bindings and lazy fillers.
>
> Bug: 527406824
> Change-Id: I570a1267be21d9d398c4e2102e21a6bb923345c2
> Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8006698
> Reviewed-by: mmenke <[email protected]>
> Commit-Queue: Maks Orlovich <[email protected]>
> Cr-Commit-Position: refs/heads/main@{#1653488}

(cherry picked from commit 5a68bc6c97d97312ffa0f9ac04e2288f1cdadd13)
(change in merge: don't need tags for v8::External in this version)

Bug: 532492736,527406824
Change-Id: I570a1267be21d9d398c4e2102e21a6bb923345c2
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8063845
Commit-Queue: Maks Orlovich <[email protected]>
Reviewed-by: mmenke <[email protected]>
Cr-Commit-Position: refs/branch-heads/7559@{#5071}
Cr-Branched-From: 223dfbac1c7542a06b422390d954afe5b560b607-refs/heads/main@{#1552494}
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/755588
Reviewed-by: Allan Sandfeld Jensen <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/898dae20d240b7a29dd74423ce7a18173cad225a