[qt/qt/qtwebengine-chromium]: Summary of bulk changes made

Git repository change summary for qt/qt/qtwebengine-chromium
Pushed by mirror-service into branch '140-based'.
Changed from b98388cbd717a66285bca425304520e774828801 to 13faa8ef1eb0706ec48248bfe2b0f3d8da2a873e
Acknowledgement was received that this change introduces only existing code that has been pushed to another public open source repository.

This change contains the following new commits:

Git commit 2d97bb0f1c1525c404001c693639afc8e24a8c6a by Michal Klocek (on behalf of Kevin McNee) on 31/07/2026 at 11:08..
[Backport] CVE-2026-14040: Use after free in BrowserTag

Manual cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/7829969:
Prevent id collision in AppView pending embed requests

The requests are stored in a global map, but the guest instance ids are
scoped to a profile. We now include the profile's unique token as part
of the key to prevent collisions across profiles.

Fixed: 497488593
Change-Id: Ib3b54d15d0ecba1733c53ffed1bdbb4082f59b12
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7829969
Auto-Submit: Kevin McNee <[email protected]>
Reviewed-by: Giovanni Pezzino <[email protected]>
Commit-Queue: Giovanni Pezzino <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1628447}
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756352
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/2d97bb0f1c1525c404001c693639afc8e24a8c6a

Git commit b6d0335c59e59fb6161d1e5083430ed1f6c0922f by Michal Klocek (on behalf of Avi Drissman) on 31/07/2026 at 11:10..
[backport] CVE-2026-13998: Incorrect security UI in File Input

Prevent key repeats from triggering the save panel

To address https://crbug.com/40085079, https://crrev.com/c/875522 added
a delegate to prevent an open panel from triggering due to a held-down
Enter key.

This is a good idea, so extend this to the save panel as well.

Fixed: 514070501
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7856762
Task-number: QTBUG-147928
Change-Id: Ic34e57153f6871fc3bdfeda4201e40937d21b3a3
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756279
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/b6d0335c59e59fb6161d1e5083430ed1f6c0922f

Git commit 30d6932f52d9bf7db05db32a47d9a900d864f745 by Michal Klocek (on behalf of Andrea Orru) on 31/07/2026 at 11:10..
[backport] CVE-2026-13999: Inappropriate implementation in Extensions

Sanitize extension short name in LoadShortName

Fix a vulnerability where Extension::LoadShortName failed to sanitize
the extension's short name, allowing unterminated bidirectional control
characters and newlines.

Fixed: 514071697
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7885964
Task-number: QTBUG-147928
Change-Id: Ibf1d62da2456d1d96512da90818b1e54f363aa49
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756280
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/30d6932f52d9bf7db05db32a47d9a900d864f745

Git commit 6f13ddbe48720dbb5a745e2c1f3a7d1c2d3fd450 by Michal Klocek (on behalf of Matt Menke) on 31/07/2026 at 11:10..
[backport] CVE-2026-14001: Inappropriate implementation in Network

Fix handling of multiple X-Content-Type-Options headers.

Previously, we compared the unified/normalized header against "nosniff",
so if there were two nosniff headers, we'd compare "nosniff, nosniff"
against "nosniff", and get false, so would not respect the requested
behavior.

This CL makes us correctly look at only the first nosniff header,
which is consistent with the spec.

It also moves the logic to do this into net::ShouldSniffMimeType().
Previously, we had two locations independently looking for the
header and also calling into net::ShouldSniffMimeType(), which left
more room for bugs.

Bug: 514481943
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7863616
Task-number: QTBUG-147928
Change-Id: Ied73ddbfe2f4203d1c485deedb414c524a769a28
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756281
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/6f13ddbe48720dbb5a745e2c1f3a7d1c2d3fd450

Git commit ee58bf899d4191691e0ba7dc0c908ff5f19b1978 by Michal Klocek (on behalf of James Cook) on 31/07/2026 at 11:11..
[backport] CVE-2026-14003: Insufficient policy enforcement in Extensions

extensions: Fix bypass of user site restrictions in pageCapture API

PermissionData::CanCaptureVisiblePage(), when called from the
pageCapture API with CaptureRequirement::kPageCapture was not checking
if the user had blocked extension access to the page to capture.

Refactor out an IsUrlBlockedByUser() method and call it to check if
the URL should be allowed. We can't use the existing PermissionData
methods like GetPageAccess() or CanRunOnPage() because those would
require the extension to declare host_permissions, and that's not
part of the API contract for chrome.pageCapture.

Given that the risk of this defect is low (an extension could capture
an MHTML version of a page), I don't think it's worth changing the API
contract to require host_permissions, since that would likely break
existing extensions using pageCapture.

A follow-up CL will remove some unnecessary ENABLE_EXTENSIONS
buildflag checks, as desktop Android now supports pageCapture. I left
them in for easier merging, if we need it.

Bug: 514503077
Test: added to unit_tests
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7871735
Task-number: QTBUG-147928
Change-Id: I2a4fe17de851adc996c4535e4e2c56e2e59086fd
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756284
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/ee58bf899d4191691e0ba7dc0c908ff5f19b1978

Git commit 8b50cc92d6c17831b5dee87a6beeee58cad37da7 by Michal Klocek (on behalf of Takashi Toyoshima) on 31/07/2026 at 11:11..
[backport] CVE-2026-14006: Use after free in Navigation

Fix throttle name reporting in NavigationRequest::Resume.

This CL ensures that we can correctly obtain the resuming throttle's
name for the crash key when `DumpWithoutCrashing()` is triggered in
`NavigationRequest::Resume`.

Previously, if `DumpWithoutCrashing()` was triggered after the response
body callback, the resuming throttle might have already been cleaned up,
preventing us from getting its name.

This is resolved by capturing the throttle's name before executing the
callback.

BUG=515423596

Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7890808
Task-number: QTBUG-147928
Change-Id: I30a0831c7a41821baa902286dd0eab855eb0c2b5
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756287
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/8b50cc92d6c17831b5dee87a6beeee58cad37da7

Git commit 0a3a4f3ac59f7086d544ba6299dfa62dbe7ef75f by Michal Klocek (on behalf of Brandon Jones) on 31/07/2026 at 11:11..
[backport] CVE-2026-14008: Uninitialized Use in WebXR

Disable GL_RASTERIZER_DISCARD when clearing XR targets

Prevents a scenario where uninitialized content may be exposed by
a page that sets GL_RASTERIZER_DISCARD prior to getting new WebXR
textures.

Bug: 516781007
Fixed: 516781007
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7884159
Task-number: QTBUG-147928
Change-Id: I8d84f165096994365c548ea4e6d4ead5b595d658
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756288
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/0a3a4f3ac59f7086d544ba6299dfa62dbe7ef75f

Git commit 5f4917fd08adc393c6ba117b39b0be417a249a65 by Michal Klocek (on behalf of Maria Kazinova) on 31/07/2026 at 11:11..
[backport] CVE-2026-14009: Insufficient data validation in Passwords

Prevent crashes on detached frame in PasswordAutofillAgent

Description: This CL adds checks to ensure render_frame() is valid
before accessing it in PasswordAutofillAgent. During filling
operations, script execution can cause the frame to be detached. If
destruction of the agent is delayed (e.g., during nested loops like
printing), subsequent accesses to the detached frame can cause crashes.

NO_IFTTT=Crash fix on non-iOS, no need to update iOS code.

Fixed: 516819850
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7883070
Task-number: QTBUG-147928
Change-Id: I7cf1b25f90b42e6601e9099768c1bedab3773e88
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756289
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/5f4917fd08adc393c6ba117b39b0be417a249a65

Git commit 1aee9b29d312dd6ead3c294fa1fb8a9e0b8d2795 by Michal Klocek (on behalf of Eugene Zemtsov) on 31/07/2026 at 11:12..
[backport] CVE-2026-14010: Uninitialized Use in Codecs

media: Zero-initialize trailing padding in MF VEA input buffers

MFT input buffers are sized to the encoder's reported minimum size
(cbSize), but only written up to the frame allocation size. The
remaining trailing padding is left uninitialized and can be compressed
and leaked in the output video stream.

This change zero-initializes the trailing padding bytes beyond the
written pixel payload in both CPU and GPU input paths.

It also replaces a hardcoded NV12 size calculation in the GPU path with
a dynamic VideoFrame::AllocationSize call to calculate the written
payload size cleanly.

Bug: 516924151
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7877627
Task-number: QTBUG-147928
Change-Id: I60fb6a8fd7f19cedde7fdcddb40de50fc78502c6
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756290
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/1aee9b29d312dd6ead3c294fa1fb8a9e0b8d2795

Git commit 096327ccd2f8ddb27e3b0bbd7c5ec2120f702f30 by Michal Klocek (on behalf of Ilya Nikolaevskiy) on 31/07/2026 at 11:12..
[backport] CVE-2026-14011: Out of bounds read in SurfaceCapture

Ensure custom strides fit inside the provided buffer

Fixed: 516944556
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7890379
Task-number: QTBUG-147928
Change-Id: I964141af3d97fe1323e69846aee9cf7417e7846b
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756291
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/096327ccd2f8ddb27e3b0bbd7c5ec2120f702f30

Git commit 71eaacf3479009e656560d24c5bda4b7a0e272d7 by Michal Klocek (on behalf of Rune Lillesveen) on 31/07/2026 at 11:12..
[backport] CVE-2026-14012: Side-channel information leakage in CSS

Disallow scroll-state() queries on autofill preview effects

Could potentially be used to leak information about autofill data.

Treat autofill-previewed form controls as if they are not scroll
containers for scroll-state() queries for scrolled/scrollable.

Bug: 517110749
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7879906
Task-number: QTBUG-147928
Change-Id: I6afceb3948c81e357d2efa69414b999955413c05
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756292
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/71eaacf3479009e656560d24c5bda4b7a0e272d7

Git commit 1c051ff36d3eaad48d07f4f4f879a793d7e5ac5d by Michal Klocek (on behalf of Philip Rogers) on 31/07/2026 at 11:12..
[backport] CVE-2026-14013: Inappropriate implementation in SVG

Skip overflow clip for SVG viewport containers doing occlusion tests

This patch skips overflow clips when hit testing SVG viewport
containers for occlusion. This ensures that we consider visual overflow
for these occlusion hit tests.

Fixed: 517114175
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7880272
Task-number: QTBUG-147928
Change-Id: I6394e4b6dcbd4535eb70c695f46b98f942f8c39c
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756293
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/1c051ff36d3eaad48d07f4f4f879a793d7e5ac5d

Git commit 59c535b770b90bee8cc06325847d76a9820fa20c by Michal Klocek (on behalf of Alexander Cooper) on 31/07/2026 at 11:12..
[backport] CVE-2026-14015: Inappropriate implementation in WebRTC

Fix race condition in CroppingWindowCapturer

https://webrtc-review.googlesource.com/c/src/+/467820 fixed an issue
where the captured window may have moved during capture, and thus the
frame would have the window at it's original location (e.g. when
CaptureFrame was called), but we cropped to it's new location (e.g. when
OnCaptureResult was called), thus potential leaking pixels. This
addresses the inverse of that. If we actually capture closer to when
`OnCaptureResult` is called and the window has moved, we could now be
capturing the old location where the window no longer is and is thus
leaking pixels. Since we cannot assert whether capture happened closer
to `CaptureFrame` or `OnCaptureResult`, we simply attempt to recapture
the frame if the window position has moved between these two calls.

Fixed: chromium:517207235
Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/476400
Task-number: QTBUG-147928
Change-Id: I98f41c709b0bcf0285e258e7421af3481692a1ba
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756294
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/59c535b770b90bee8cc06325847d76a9820fa20c

Git commit ec1792112742b08068605b38f2512faa4a345565 by Michal Klocek (on behalf of Alex Moshchuk) on 31/07/2026 at 11:13..
[backport] CVE-2026-14017: Inappropriate implementation in Navigation

Clear child frames when unload ACK is received during inner delegate attach.

Previously, receiving OnUnloadACK when is_inner_delegate_attached()
was true (e.g., during MimeHandlerView attach) dispatched
RenderFrameDeleted() on the placeholder RFH, but it didn't actually
ensure that it had no children at this point. A compromised renderer
could attach child frames to the placeholder frame and then fail to
detach them before sending the unload ACK. Guard against this in the
browser process with an explicit call to `ResetChildren()`, similar to
how this is already enforced on the other paths that dispatch
`RenderFrameDeleted()`. Also add a defense-in-depth CHECK to
`RenderFrameHostImpl::RenderFrameDeleted()` to ensure there are no
children at that point.

Bug: 517241992
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7877263
Task-number: QTBUG-147929
Change-Id: I69db54629de01923fd5181b3d1225af16b3bb90a
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756683
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/ec1792112742b08068605b38f2512faa4a345565

Git commit 430c1d3be9892b661f7dc528ea459ed667ddc084 by Michal Klocek (on behalf of Alexander Cooper) on 31/07/2026 at 11:13..
[backport] CVE-2026-14020: Insufficient validation of untrusted input in WebXR

Check page visibility during session request validation

Validates that the requesting frame's visibility state is set to
visible when processing a VRService::RequestSession Mojo call in
VRServiceImpl, maintaining proper alignment with renderer-side
session requirements.

Fixed: 517598518
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7885957
Task-number: QTBUG-147929
Change-Id: Ibcaafa8dbdbec3a53e556a9459d3658edc3ffa24
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756684
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/430c1d3be9892b661f7dc528ea459ed667ddc084

Git commit be5491fa450d8431a0d7c53d33740057dd3f4cf2 by Michal Klocek (on behalf of Chris Fredrickson) on 31/07/2026 at 11:13..
[backport] CVE-2026-14022: Insufficient validation of untrusted input in Network

Add explicit validation at start of GetCookiesString

I've also audited all of the methods in the mojo interface, and made
sure that they all call ValidateAccessToCookiesAt before doing anything
else (with the exception of AddChangeListener, which silently returns
for calls whose `url` is empty).

Fixed: 517791835
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7882551
Task-number: QTBUG-147929
Change-Id: Iefbbc79db8ed82a0e541717627cab285d6afe02c
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756685
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/be5491fa450d8431a0d7c53d33740057dd3f4cf2

Git commit 35fc3dc4cfcfc032edf54afd445820c6d58602e1 by Michal Klocek (on behalf of Daniel Vogelheim) on 31/07/2026 at 11:13..
[backport][parts] CVE-2026-14023: Insufficient validation of untrusted input in SanitizerAPI

setHTML + setHTMLUnsafe use HTML fragment parser.

setHTML and setHTMLUnsafe should always use HTML syntax.

Also, conservatively always match localname + namespace, but not
prefix. The current implementation uses QualifiedName::operator==
in several places, where QualifedName::Matches (which ignores prefix)
should have been used. Sanitizer API consistently ignores the prefix.

Bug: 518063436
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7890038
Task-number: QTBUG-147929
Change-Id: Ifca1067fa1edcc127b861543fbef42d9f62a213b
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756686
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/35fc3dc4cfcfc032edf54afd445820c6d58602e1

Git commit cc62bcb6e63a41f5cb16221bb59e4dda1f8b43cd by Michal Klocek (on behalf of Shahbaz Youssefi) on 31/07/2026 at 11:16..
[backport] Dependency for CVE-2026-14384

Vulkan: Respect short-circuit more safely

Previously, if the LHS of `&&`/`||` or true/false expression of `?:`
didn't have side effects, non-short-circuiting SPIR-V instructions were
generated.  This is not completely safe, as an expression without side
effect might still be invalid to execute, such as loading from an array
with an out-of-bounds index.

Bug: angleproject:465831139
Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7228207
Task-number: QTBUG-147929
Change-Id: I5c865919d7a36523ba25ea50151a9451aef46e36
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756687
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/cc62bcb6e63a41f5cb16221bb59e4dda1f8b43cd

Git commit ebadde0633ce217ae85a8e4e1d591677fdf5d9bc by Michal Klocek (on behalf of Zhenyao Mo) on 31/07/2026 at 11:16..
[backport] CVE-2026-14384: Out of bounds read in ANGLE

Use full logic for HLSL short-circuit unfolding.

The full logic is implemented in OutputSPIRV.cpp, so moving that into
TIntermNode and TIntermOperator, so both sides can use it.

Bug: b/497543485
Change-Id: I4e9e2ab84d28193f3cd459356748727f48e7a450
Task-number: QTBUG-147929
Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7816349
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756688
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/ebadde0633ce217ae85a8e4e1d591677fdf5d9bc

Git commit c23e272bae6a404678668b8425b492123e04632a by Michal Klocek (on behalf of Amirali Abdolrashidi) on 31/07/2026 at 11:16..
[backport] Dependency for CVE-2026-14388:

Vulkan: Fix non-aligned buffer offset wrt stride

  It has been observed in some cases that when copying an entire
vertex buffer for conversion using CPU, there is a possibility that
the end of the copy range falls out of the buffer bounds due to the
copy size being calculated due to the max vertex count, which comes
from GetVertexCountForRange(). If the offset for the data (e.g., set
in glVertexAttribPointer()) is not aligned with the stride, the data
range calculated from the vertex count can fall outside the bounds.

This change will limit the source data size to the buffer bounds to
avoid out-of-bound memory accesses in such cases.

* Updated CalculateMaxVertexCountForConversion() so the intended
  source data size does not exceed the source buffer limit.

* Added unit test to demonstrate that a draw using a vertex buffer
  with an offset not aligned with stride results in a correct draw
  without out-of-bound access.
  * VertexAttributeTest.BufferOffsetNonAlignedWithStride

Bug: angleproject:468923885
Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7263864
Task-number: QTBUG-147929
Change-Id: I5f2e92bd0c923173d5d1191cf189401e34508fe1
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756689
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/c23e272bae6a404678668b8425b492123e04632a

Git commit 9c74a7ce67d7318ffcf05e668a68a5eb1d436267 by Michal Klocek (on behalf of Tzarial) on 31/07/2026 at 11:16..
[backport] CVE-2026-14388: Out of bounds read in ANGLE

Vulkan: Fix out-of-bounds read in divisor emulation

GetVertexCountForRange previously calculated the number of vertices by
ceiling the available buffer bytes divided by the stride:
`(bytes + stride - 1) / stride`. This formula over-counts the number of
available vertices when the remaining buffer space is enough for the
start of a vertex but not its full format size, resulting in the last
vertex's format-size read extending past the end of the buffer.

This over-counted value was then used in StreamVertexDataWithDivisor,
leading to an out-of-bounds read during the last instance's attribute
copy if the buffer ended near a memory allocation boundary.

This CL updates the vertex count calculation to correctly determine the
maximum number of vertices whose format-size reads fully fit within the
given buffer range. It also removes redundant and flawed clamping logic
in CalculateMaxVertexCountForConversion that was attempting to handle
this case.

Bug: b/500476886
Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7823123
Task-number: QTBUG-147929
Change-Id: Ibc55ec1edb6a6d1268a9badcefc6b20318eab300
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756690
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/9c74a7ce67d7318ffcf05e668a68a5eb1d436267

Git commit 9c3857fe94255dc8d9ee225cc2d131e340dabfb0 by Michal Klocek (on behalf of Greg Daniel) on 31/07/2026 at 11:16..
[backport] CVE-2026-14389: Integer overflow in Skia

Fix potential integer overflows in SurfaceContext using SkSafeMath

Bug: b/500505046
Reviewed-on: https://skia-review.googlesource.com/c/skia/+/1223518
Task-number: QTBUG-147929
Change-Id: I68462f3a73f2e1491151c7b9c5fc68fadb9d04a6
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756691
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/9c3857fe94255dc8d9ee225cc2d131e340dabfb0

Git commit 71871d1d3c4cc5a5fbca06658ab22807fcd75727 by Michal Klocek (on behalf of Zhenyao Mo) on 31/07/2026 at 11:16..
[backport] CVE-2026-14391: Integer overflow in ANGLE

D3D11: Defend against potential integer overflow in a function.

VertexBuffer11::storeVertexAttributes().

Also, added a regression test for this.

Bug: b/506212452
Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7814021
Task-number: QTBUG-147929
Change-Id: Id82847ef730287515e64a3836e3479fc208ed704
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756692
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/71871d1d3c4cc5a5fbca06658ab22807fcd75727

Git commit 6cae82cb063594f0c5effc83a778117da3754ba0 by Michal Klocek (on behalf of Benedikt Meurer) on 31/07/2026 at 11:16..
[backport] Dependency for CVE-2026-14393 (1/2)

Guard against iterator invalidation when reporting console messages.

When reporting queue console messages to the frontend in the Runtime
agent, we might end up calling back into JavaScript (via some of the
ValueMirrors that still use side-effecting implementations), and that
can invalidate the deque iterators. This doesn't happen in current
Chromium versions, but it's still a good idea to guard against this
case.

Fixed: 446941355
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7137622
Task-number: QTBUG-147929
Change-Id: I779df1411f49cad70dbe5127527e27f2029caa37
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756693
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/6cae82cb063594f0c5effc83a778117da3754ba0

Git commit 6e15d000adeb8af28008bd2d68a4c0307eb996f5 by Michal Klocek (on behalf of Danil Somsikov) on 31/07/2026 at 11:17..
[backport] Dependency for CVE-2026-14393 (2/2)

Fix Use-After-Free in console message reporting.

When enabling the Runtime or Console agent, cached console messages are reported. The process of reporting a message can execute JavaScript, which might modify the console message storage (e.g., by calling `console.clear()`). To prevent Use-After-Free issues caused by iterating over a modified container, the current message us now copied and the index is re-checked against the container bounds. This ensures that the reporting loop operates on a stable set of messages, even if JavaScript re-enters and clears the console.

Bug: 485672657

Change-Id: Ic5a1887997901ca93df1e1f63c9dc148c9755d89
Task-number: QTBUG-147929
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7600292
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756694
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/6e15d000adeb8af28008bd2d68a4c0307eb996f5

Git commit f9cfc27f588495aed3bb6806b73e0a6813f60e7a by Michal Klocek (on behalf of Kim-Anh Tran) on 31/07/2026 at 11:17..
[backport] CVE-2026-14393: Use after free in V8 (1/2)

Fix potential UAF when accessing V8ConsoleMessageStorage

During console message handling a V8ConsoleMessageStorage may be removed
and recreated in a nested message loop (kicked off by a 'debugger' call
in JS code), leading to a UAF if we don't check the identity of the
storage object itself.

This adds the identity checks for storage whenever JS may have changed
the storage object.

Bug: 511255112
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7853603
Task-number: QTBUG-147929
Change-Id: I121eebd536f5e36f2df19467e0cb996a0f8962ac
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756695
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/f9cfc27f588495aed3bb6806b73e0a6813f60e7a

Git commit 7ca9066a71419dcdff9172ca513fcdafc7def115 by Michal Klocek (on behalf of Kim-Anh Tran) on 31/07/2026 at 11:17..
[backport] CVE-2026-14393: Use after free in V8 (2/2)

Add UAF regression tests and fix missing check in addMessage

This adds the tests for a previous CL that landed and adds one more
replacement for `hasConsoleMessageStorage`: https://crrev.com/c/7853603

Bug: 511255112
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7867241
Task-number: QTBUG-147929
Change-Id: I67488803eba14bd2ed88f2d057dc1355953cfeb2
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756696
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/7ca9066a71419dcdff9172ca513fcdafc7def115

Git commit 82911df914cf0dedf8c1052fc1f1ccce0dfde16d by Michal Klocek (on behalf of Geoff Lang) on 31/07/2026 at 11:17..
[backport] CVE-2026-14397: Out of bounds write in ANGLE (1/2)

GL: Always check for GL errors after buffer/texture allocs

Texture allocation functions already did this, but it was missing for
some buffer allocations.

Fixed: chromium:511772608
Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7836200
Task-number: QTBUG-147929
Change-Id: Ie916495054df8f00549c0da7f553edc42ee953f1
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756697
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/82911df914cf0dedf8c1052fc1f1ccce0dfde16d

Git commit 4cb6a0d6cb2831a6e8236e38924630ce33d5e0e9 by Michal Klocek (on behalf of Geoff Lang) on 31/07/2026 at 11:17..
[backport] CVE-2026-14397: Out of bounds write in ANGLE (2/2)

GL: More checks for GL errors after buffer/texture allocs

Missed these in 3aec5c7a15c41d14ae3e272e6f72a51545fa703b due to unsaved
buffers.

Fixed: chromium:511772608
Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7845476
Task-number: QTBUG-147929
Change-Id: Id1141caa970ab6d584ceb91e8857d2fa05400f49
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756698
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/4cb6a0d6cb2831a6e8236e38924630ce33d5e0e9

Git commit 64aa54e05fcc3233c1f97146d14f561ab7fa45fe by Michal Klocek (on behalf of dneto) on 31/07/2026 at 11:17..
[backport] CVE-2026-14399: Uninitialized Use in Dawn

Initialize all members of apply clear color value key

The struct is used in hash functions and key equality tests.
Ensure all members are initialized.

Fixed: 513006745
Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/308857
Task-number: QTBUG-147929
Change-Id: Id14674b1b7bd4c0168de05b7634a17556a6a6964
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756699
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/64aa54e05fcc3233c1f97146d14f561ab7fa45fe

Git commit 91a032877477d73d0055cb9cfed15a4d160aaf9d by Michal Klocek (on behalf of Tom Sepez) on 31/07/2026 at 11:17..
[backport] CVE-2026-14404: Inappropriate implementation in PDFium

Encode property names when generating a page.

Otherwise, the resulting document may not parse properly.

-- Gemini suggested patch and generated test.

Fixed: 513337989
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/147690
Task-number: QTBUG-14792
Change-Id: Ieef3174f9a0cd53bb0953d431d19a209aa70cad2
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756700
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/91a032877477d73d0055cb9cfed15a4d160aaf9d

Git commit 611c971584de797690e3358905af799c2a89d646 by Michal Klocek (on behalf of Benedikt Meurer) on 31/07/2026 at 11:17..
[backport] CVE-2026-14406: Out of bounds read in V8

Prevent data race on `CodeEntry::rare_data_`.

This adds an explicit memory barrier to `CodeEntry::EnsureRareData()`
for platforms with store-store reordering (e.g. arm64), where it's
otherwise possible to that the store to `rare_data_` becomes visible to
other threads before the field initialization completes.

Fixed: 513435594
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7849376
Task-number: QTBUG-147929
Change-Id: I78a45c35bed6a3a2459c1ec994393709027c5f22
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756701
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/611c971584de797690e3358905af799c2a89d646

Git commit 13faa8ef1eb0706ec48248bfe2b0f3d8da2a873e by Michal Klocek (on behalf of Stephen Chenney) on 31/07/2026 at 11:35..
[backport] Dependency for CVE-2026-14016

Privacy preserving filter operations

Filters may contain cross origin information, particularly
images and SVG content from external resources. These filters
should be ignored when drawing elements into the canvas.

Add taiting info to CompositorFilterOperations and copy the
existing tainting info from the Blink filter effects. Then
prevent tainted filters from being added to the paint effects.

Bug: 441381081
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7038800
Task-number: QTBUG-147928
Change-Id: I98d7ff7f0d1b1d74d30d6691b03b7a8d789fc469
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756296
Reviewed-by: Moss Heim <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/13faa8ef1eb0706ec48248bfe2b0f3d8da2a873e