[qt/qt/qtwebengine-chromium]: Summary of bulk changes made

Git repository change summary for qt/qt/qtwebengine-chromium
Pushed by mirror-service into branch '140-based'.
Changed from e79701be45aa9f39309d1379246cbf9ff6579e21 to ba7ac37c693dcd272150bcd9b77d6945f7264bc1
Acknowledgement was received that this change introduces only existing code that has been pushed to another public open source repository.

This change contains the following new commits:

Git commit 2b56b97d8afd031a16e25f096f05f2f11c0a7f85 by Allan Sandfeld Jensen on 29/07/2026 at 08:41..
[Backport] CVE-2026-16420/CVE-2026-16421: Type Confusion in WebAudio/Inappropriate Implementation in WebAudio

Manually cherry-picked. Originally reviewed on:
https://chromium-review.googlesource.com/c/chromium/src/+/8021606

[PATCH] [WebAudio] Disable FTZ/DAZ during JavaScript AudioWorklet
execution

This CL disables the Float-to-Zero (FTZ) and Denormals-are-Zero (DAZ)
FPU features when running JavaScript code within AudioWorklets.

Historically, worker backing threads for AudioWorklets enabled FTZ/DAZ
to avoid microcode performance overheads during real-time processing.
However, V8 compiler optimization assumes strict IEEE-754 floating
point semantics. Running JIT-optimized code under non-standard FPU
behavior causes compiler and runtime execution divergences, which
leads to incorrect type assertions and memory safety issues.

To resolve this alignment issue, this change:
1. Prevents AudioWorklet backing threads from turning on FTZ/DAZ at
   startup, ensuring that the V8 Isolate initializes in standard
   IEEE-754 mode.
2. Instantiates DenormalEnabler inside AudioWorkletProcessor::Process()
   to temporarily disable FTZ/DAZ during JS execution. This guarantees
   standard floating point behavior for user scripts while leaving
   native WebAudio DSP nodes to run with FTZ/DAZ enabled.

Bug: 528276487, 527930356
Test: blink_unittests --gtest_filter="*DenormalProcessing*"

TAG=agy
CONV=9d8e1d6c-f19f-4ec3-adae-3a4328b455ca

Change-Id: I7f012fbb7e50fe4bd5369968a94d6531bfb12df1
Reviewed-on:
https: //chromium-review.googlesource.com/c/chromium/src/+/8021606
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/755557
Reviewed-by: Michal Klocek <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/2b56b97d8afd031a16e25f096f05f2f11c0a7f85

Git commit c1f41f1bd1eeba95c6b89465c8b4ee8bdd0d7b39 by Allan Sandfeld Jensen on 29/07/2026 at 08:41..
[Backport] CVE-2026-16413: Out of bounds write in ANGLE

Cherry-picked from:
https://chromium-review.googlesource.com/c/angle/angle/+/7952070

[PATCH] Ignore most indexing in attribute and output bindings

In ProgramBindings::bindLocation(for attributes) and
ProgramAliasedBindings::bindLocation (for outputs), ignore any binding
name if there's [ in it, unless it's a [0] suffix. Adjust getter
expectations to match. If ANGLE has no explicit binding recorded,
array[1] will receive the consecutive location following array[0]
meaning that it's no longer possible to bind arrays data to arbitrary
memory addresses.

This change impacts the GLES APIs glBindAttribLocation,
glGetFragDataLocation (inputs), and glBindFragDataLocationEXT (outputs).

Bug: angleproject:517359779
Change-Id: I1b538a772a5c9a834059ef93a648be115ebb28c2
Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7952070
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/755558
Reviewed-by: Michal Klocek <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/c1f41f1bd1eeba95c6b89465c8b4ee8bdd0d7b39

Git commit b10fecbec3907f0cbcfafab89b390f01ec07add7 by Allan Sandfeld Jensen on 29/07/2026 at 08:41..
[Backport] CVE-2026-16417: Uninitialized Use in Skia

Cherry-picked from https://skia-review.googlesource.com/c/skia/+/1295737

[PATCH] [ganesh] prevent stale readbacks

* Ganesh's SurfaceContext::readPixels did not consider whether the content it was attempting to readback was successfully rendered or not, leading to a scenario where stale texture data could potentially be readback.

* Add some state tracking so that a failed flush is propagated out of the drawing manager and to the surface context

Bug: b/521491024
Change-Id: Idb2b5eaccda7f4ec388e3dc415ee41d329d28533
Reviewed-on: https://skia-review.googlesource.com/c/skia/+/1295737
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/755559
Reviewed-by: Michal Klocek <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/b10fecbec3907f0cbcfafab89b390f01ec07add7

Git commit 86025604b2dc968f660139830f8035ae91ce0568 by Allan Sandfeld Jensen on 29/07/2026 at 08:41..
[Backport] CVE-2026-16418: Stack buffer overflow in V8

Cherry-picked. Originally revied on
https://chromium-review.googlesource.com/c/v8/v8/+/8011046

[PATCH] [M150] [turbofan] Avoid stack buffer overflow during inlining

Original change's description:
> [turbofan] Avoid stack buffer overflow during inlining
>
> There can be mismatches between the Node* that InlineCandidate tries
> to inline and the Candidate information that was computed before.
>
> This CL recomputes the Candidate in InlineCandidate and bails out if
> it doesn't match what we computed earlier.
>
> Fixed: 522125255
> Change-Id: Iefc229417f09bdd82b79c643c5939860a796b910
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8011046
> Commit-Queue: Darius Mercadier <[email protected]>
> Auto-Submit: Darius Mercadier <[email protected]>
> Reviewed-by: Nico Hartmann <[email protected]>
> Cr-Commit-Position: refs/heads/main@{#108645}

(cherry picked from commit 0cc5dcf12126a6bd5ca8fb95aa49fd5d228ed7e5)

Bug: 535457674,522125255
Change-Id: Iefc229417f09bdd82b79c643c5939860a796b910
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8115807
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/755560
Reviewed-by: Michal Klocek <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/86025604b2dc968f660139830f8035ae91ce0568

Git commit 8e92cf430651fcd7d320e4d22430ceaed65c7577 by Allan Sandfeld Jensen on 29/07/2026 at 08:41..
[Backport] CVE-2026-16419: Out of bounds read and write in ANGLE

Cherry-pick. Originally reviewed on
https://chromium-review.googlesource.com/c/angle/angle/+/8084755

[PATCH] [7871_124] Translator: avoid collisions in hashed names.

Original change's description:
> [M150] Translator: avoid collisions in hashed names.
>
> When using shader name hashing (mainly used in WebGL implementations),
> guard against collisions in the hashed names. Add a unit test for the
> new logic.
>
> Co-authored with Gemini.
>
> (cherry picked from commit ab15aec81e4976bef62ed9d16a19a3d59a15f297)
>
> Fixed: chromium:535050441
> Bug: chromium:523435970
> Change-Id: Id466f5016c0da4f53cdcf6cab7d07afc29863c8d
> Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/8102122
> Reviewed-by: Shahbaz Youssefi <[email protected]>

(cherry picked from commit edae461ad2122a3a2be0b5d3d067472aa0e3329c)

Bug: chromium:535050441,chromium:535050441,chromium:523435970
Change-Id: Id466f5016c0da4f53cdcf6cab7d07afc29863c8d
Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/8102242
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/755561
Reviewed-by: Michal Klocek <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/8e92cf430651fcd7d320e4d22430ceaed65c7577

Git commit dac03d9b7ff0b1d4e4d29f070dad16440e65404a by Allan Sandfeld Jensen on 29/07/2026 at 08:42..
[Backport] CVE-2026-16422: Insufficient validation of untrusted input in Certificate

Chery-pick. Originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/8087128

[PATCH] TrustStoreNSS: CERT_FindCertByDERCert may return a different cert

Fixed: 533515002
Change-Id: I5d98e2b778ea7fc0f325f7e0fd8a41cb84f06a31
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8087128
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/755562
Reviewed-by: Michal Klocek <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/dac03d9b7ff0b1d4e4d29f070dad16440e65404a

Git commit 98c1102a4f2ce9f6b2bb1a2b0b2b065835e2d548 by Allan Sandfeld Jensen on 29/07/2026 at 08:42..
[Backport] CVE-2026-16423: Use after free in UI

Cherry-pick. Originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/8092749

[PATCH] [X11] Fix potential use-after-free in X11WSML::EndMoveLoop

EndMoveLoop() invokes OnMoveLoopEnded() on its delegate. Under some
conditions (e.g., drag-and-drop operations on Linux/X11), this callback
can synchronously destroy the owning window and the move loop instance
itself. Upon returning to EndMoveLoop(), accessing any members on a
freed 'this' causes a use-after-free (UAF) crash.

This CL introduces a WeakPtr guard immediately after the delegate
invocation to check if the loop is still alive before executing the
remaining cleanup/teardown code. An automated unit test is added to
prevent regressions.

Change-Id: Ia4ea812661a1a67313af90e994eed842d5ebc913
Fixed: 534582496
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8092749
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/755563
Reviewed-by: Michal Klocek <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/98c1102a4f2ce9f6b2bb1a2b0b2b065835e2d548

Git commit a2a89d668092f6a09fa2456612f803d11dcb9208 by Allan Sandfeld Jensen on 29/07/2026 at 08:42..
[Backport] CVE-2026-16424: Use after free in GPU

Cherry-pick. Originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/8096884

[PATCH] [viz] Harden SurfaceManager recursive commit to avoid re-entrancy

Harden SurfaceManager and Surface for committing frames recursively
by passing SurfaceRange by value instead of ref and iterating over
a copy of vectors so that we can avoid potential UAF through
re-entrancy.

Bug: 534858939
Change-Id: I2ec6ce6752eb540fa290dfd13f717d087e4115ca
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8096884
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/755564
Reviewed-by: Michal Klocek <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/a2a89d668092f6a09fa2456612f803d11dcb9208

Git commit a8a02379b865083681d62261894f7415c820900b by Michael Brüning (on behalf of Stephen Nusko) on 29/07/2026 at 09:34..
[Backport] CVE-2026-14025: Use after free in Views

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/7847592:
Keep MenuItemView as a raw_ptr to prevent unsafe dangling

Previously a delegate could delete this and that could leave a
MenuItemView being freed. Normally stored as a raw_ptr, this defensive
copy wasn't kept as a raw_ptr so lost the ref count protection. This
protects `result` similar to the `this_ref` WeakPtr.

DanglingUntriaged-notes: Preventing MiraclePtr protection drop.
Bug: 506482786
Change-Id: Ifc68b46f160f5de0588318af3ac7b48b97672b1f
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7847592
Auto-Submit: Stephen Nusko <[email protected]>
Reviewed-by: Dana Fried <[email protected]>
Commit-Queue: Stephen Nusko <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1630955}
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756133
Reviewed-by: Michal Klocek <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/a8a02379b865083681d62261894f7415c820900b

Git commit 34bd6c9137ef7eb80d950e0ebad75719b767d6d0 by Michael Brüning (on behalf of Alvin Ji) on 29/07/2026 at 09:34..
[Backport] CVE-2026-14032: Use after free in Bluetooth

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/7833747:
bluetooth: Fix potential browser-process UAF in socket listeners

Due to an Apple framework bug (FB13705522), IOBluetooth holds an
unsafe_unretained pointer and may dispatch late callbacks to freed
listeners after unregistration.

This CL fixes the UAF by clearing back-pointers and posting a keep-alive
block to the main queue, ensuring the listener safely outlives any
pending OS notifications.

Bug: 495783474
Change-Id: I79497e722159320158bb411fcb15f99066d7ca0e
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7833747
Reviewed-by: Matt Reynolds <[email protected]>
Commit-Queue: Alvin Ji <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1635359}
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756134
Reviewed-by: Michal Klocek <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/34bd6c9137ef7eb80d950e0ebad75719b767d6d0

Git commit 45c4458ab2fe326a2fd9c8248938eddc98385228 by Michael Brüning on 29/07/2026 at 10:45..
[fixup] [Backport] CVE-2026-14421: Uninitialized Use in Dawn

Remove unneeded use of undefiend SaturateAsMinMaxF16 toggle.

Also correct to IsQualcomm_PCI instead of IsQualcommPCI.

It was introduced later as a polyfill for a feature that is not
present in this codebase.

Change-Id: If2b32891bf57d3b666baf2696e1e1e1875966a5d
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756231
Reviewed-by: Michal Klocek <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/45c4458ab2fe326a2fd9c8248938eddc98385228

Git commit ba7ac37c693dcd272150bcd9b77d6945f7264bc1 by Michal Klocek on 29/07/2026 at 10:46..
[fixup][rust][harfbuzz] Build harfbuzz without rust

Fix compilation with msvc.

Change-Id: I9c46f9ce80200bbb2f5cdf9b3b1cc7e9cff42714
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756226
Reviewed-by: Michael Brüning <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/ba7ac37c693dcd272150bcd9b77d6945f7264bc1