[qt/qt/qtwebengine-chromium]: Summary of bulk changes made

Git repository change summary for qt/qt/qtwebengine-chromium
Pushed by mirror-service into branch '140-based'.
Changed from 86d69cad0d833f3a640cf4f132778b050f91dede to b98388cbd717a66285bca425304520e774828801
Acknowledgement was received that this change introduces only existing code that has been pushed to another public open source repository.

This change contains the following new commits:

Git commit 8c37899db55c3fb9d2d11c6afa06121b01be01b9 by Michael Brüning (on behalf of Michael Lippautz) on 31/07/2026 at 01:38..
[Backport] CVE-2026-14432: Use after free in V8

Manual backport of patch originally reviewed on
https://chromium-review.googlesource.com/c/v8/v8/+/7958340:
[sandbox] Fix race condition in TrustedPointerTableEntry

Fix a data race on TrustedPointerTable (TPT) between the concurrent
marker's Mark() and the mutator's Publish() / Unpublish().

Previously, a race could lead to dropping the mark bit which leads to
crashes on untagging and a possible infinite loop on corrupting the
table's free list.

This is resolved by:
1. Using compare_exchange_weak loops in Unpublish() and Publish() to
   ensure the mutator preserves any mark bit set concurrently by the GC.
2. Using a compare_exchange_weak loop in Mark() to retry on CAS
   failures and ensure the entry is never left unmarked.

Related: CppHeapPointerTable and ExternalPointerTable fixes in
493ea0b937d9a.

TAG=agy

Fixed: 524290062
Conversation-Id: ebf149d5-1e21-4658-91a6-3e944eddf98d
Change-Id: Iab8663f0e9b9b6aced1f7b6a8a2be8d2d560cd67
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7958340
Reviewed-by: Arash Kazemi <[email protected]>
Commit-Queue: Michael Lippautz <[email protected]>
Cr-Commit-Position: refs/heads/main@{#108091}
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756220
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/8c37899db55c3fb9d2d11c6afa06121b01be01b9

Git commit 5076f16a68a16541a76ba235563c4b067a7196a0 by Michael Brüning (on behalf of Alexander Cooper) on 31/07/2026 at 01:38..
[Backport] CVE-2026-14034: Inappropriate implementation in WebXR

Manual backport of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/7819354:
Ensure user activation is only extended when needed

Currently, VRServiceImpl unconditionally extends transient user
activation upon permission resolution and runtime installation, even if
these occurred silently/synchronously without requiring user
interaction.

This CL ensures that user activation is only extended if a permission
prompt was actually shown to the user or if the runtime installation
displayed UI that required user interaction.

To achieve this:
1. Introducing content::XrInstallResult to distinguish between
   successful installation that showed UI (kSuccessInstalled),
   already installed runtime with no UI (kSuccessAlreadyInstalled),
   and failure (kFailed).
2. Refactoring BrowserXRRuntimeImpl and ArCoreInstallHelper to return
   the appropriate XrInstallResult.
3. Refactoring VRServiceImpl::DoRequestPermissions to check the
   permission status of all requested permissions upfront. If no
   permissions require a prompt (status is not ASK), it short-circuits
   and avoids the asynchronous IPC, passing needs_prompt = false.
   Note that this does need to check device-side permissions and so the
   appropriate permission_util class was updated to allow the WebXR
   permissions that need device permissions to be queried, since this
   method was only used in this type of stack.
4. Only calling NotifyUserActivation() in VRServiceImpl if a
   permission prompt or installation UI was actually shown.

Bug: 496368832
Change-Id: I2b3c9fffe0f080918bf87a5da4f3957ad75498eb
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7819354
Reviewed-by: Alex Moshchuk <[email protected]>
Reviewed-by: Ravjit Uppal <[email protected]>
Commit-Queue: Alexander Cooper <[email protected]>
Reviewed-by: Brandon Jones <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1627181}
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756346
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/5076f16a68a16541a76ba235563c4b067a7196a0

Git commit 3c4b3cf6d5c71e950a210f77cac36505b376a457 by Michael Brüning (on behalf of Rob Pitkin) on 31/07/2026 at 01:38..
[Backport] CVE-2026-14035: Insufficient policy enforcement in Bluetooth

Manual cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/7814024:
Web Bluetooth: Abort pending watchAdvertisements on visibility loss

When a Web Bluetooth client calls watchAdvertisements(), if no active
discovery session exists, the request is placed in the
watch_advertisements_pending_clients_ queue.

If the page loses visibility, ClearAdvertisementClients() is called.
However, this function only cleared active clients and neglected
watch_advertisements_pending_clients_.

This CL ensures that all pending clients are aborted and cleared from
watch_advertisements_pending_clients_ during ClearAdvertisementClients(),
preventing visibility bypass.

Added a test to verify that pending requests are aborted when tab is hidden.

Bug: 496371586
Change-Id: I98945181d9eb132a4cec1869edfdb20ca269a2c9
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7814024
Reviewed-by: Matt Reynolds <[email protected]>
Commit-Queue: Rob Pitkin <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1625796}
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756347
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/3c4b3cf6d5c71e950a210f77cac36505b376a457

Git commit 9bd6943e8bbc00fd461829055af19d0d3b029f2f by Michael Brüning (on behalf of Rob Pitkin) on 31/07/2026 at 01:38..
[Backport] CVE-2026-14036: Insufficient policy enforcement in Bluetooth

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/7823004:
Web Bluetooth: Fix EXCLUDE_READS blocklist bypass in startNotifications

The Web Bluetooth specification dictates that if a characteristic's UUID
is blocklisted with EXCLUDE_READS, all read operations — including
startNotifications() — must be blocked.

While standard read requests check the blocklist,
WebBluetoothServiceImpl::RemoteCharacteristicStartNotifications lacked
this check. This allowed a malicious site to bypass the read restriction
by subscribing to notifications.

This change adds the missing check.

This change will block `startNotifications()` calls on characteristics
marked as `EXCLUDE_READS`. This might break existing web applications
that were relying on this unintended bypass.

Bug: 496411061
Change-Id: I3bd8ab14f948230e6543acde20d9f1adfdcf2df8
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7823004
Reviewed-by: Matt Reynolds <[email protected]>
Commit-Queue: Rob Pitkin <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1627359}
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756348
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/9bd6943e8bbc00fd461829055af19d0d3b029f2f

Git commit e5dc6b252f83f1c9a2571ba9cce0f036bd669c62 by Michael Brüning (on behalf of Zhenyao Mo) on 31/07/2026 at 01:38..
[Backport] CVE-2026-14037: Insufficient policy enforcement in GPU

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/7861920:
viz: Support TreesInViz check in BindLayerContext

Bug: 496522611
Change-Id: I149e96384d9c161c6353a936ca90863accf1400c

TEST=viz_unittests

Change-Id: I149e96384d9c161c6353a936ca90863accf1400c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7861920
Auto-Submit: Zhenyao Mo <[email protected]>
Commit-Queue: Vasiliy Telezhnikov <[email protected]>
Reviewed-by: Vasiliy Telezhnikov <[email protected]>
Commit-Queue: Zhenyao Mo <[email protected]>
Reviewed-by: Tzarial <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1633621}
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756349
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/e5dc6b252f83f1c9a2571ba9cce0f036bd669c62

Git commit fd649db54e853797de3cbd5cf2d28c27d9eb9ad4 by Michael Brüning (on behalf of Guido Urdaneta) on 31/07/2026 at 01:38..
[Backport] CVE-2026-14039: Insufficient policy enforcement in GetUserMedia

Manual cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/7867635:
Ensure setPreferredSink can only be called from top-level frames

Fixed: 497358012
Change-Id: Ic336d5eca007822a18179cbbf05646204c036df3
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7867635
Reviewed-by: Antonio Sartori <[email protected]>
Reviewed-by: Tony Herre <[email protected]>
Commit-Queue: Guido Urdaneta <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1634252}
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756350
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/fd649db54e853797de3cbd5cf2d28c27d9eb9ad4

Git commit b98388cbd717a66285bca425304520e774828801 by Michael Brüning (on behalf of Viktoriya Bryhider) on 31/07/2026 at 01:39..
[Backport] Dependency for CVE-2026-14040

Manual cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/7731292:
Add BrowserContext::UniqueToken() alongside UniqueId()

Introduce a new non-virtual UniqueToken() method on BrowserContext that
returns an UnguessableToken type. This is backed by a new unique_token_
field in BrowserContextImpl, from which the existing unique_id_ string
is now derived.

Mark the existing UniqueId() as deprecated in favor of UniqueToken().
Subsequent CLs will migrate all callers and then remove UniqueId().

Bug: 466132514
Change-Id: Ia3279c13fe9b495892ccf293fd78a83b8edcdc5f
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7731292
Commit-Queue: Viktoriya Bryhider <[email protected]>
Reviewed-by: Alex Moshchuk <[email protected]>
Reviewed-by: Liang Zhao <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1613050}
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756351
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/b98388cbd717a66285bca425304520e774828801