[qt/qt/qtwebengine-chromium]: Summary of bulk changes made

Git repository change summary for qt/qt/qtwebengine-chromium
Pushed by mirror-service into branch '140-based'.
Changed from 13faa8ef1eb0706ec48248bfe2b0f3d8da2a873e to 754591e4b2b7284eaa4e41d524595785ada23620
Acknowledgement was received that this change introduces only existing code that has been pushed to another public open source repository.

This change contains the following new commits:

Git commit 41a20d3d5cdba9666db7842806a15dc65cbf14c4 by Michael Brüning (on behalf of Guido Urdaneta) on 31/07/2026 at 12:21..
[Backport] CVE-2026-14043: Use after free in GetUserMedia

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/7865624:
Fix race in AudioOutputAuthorizationHandler

Ensure access to the `hashed_device_id_for_global_media_controls_` field
always occurs on the IO thread.

Fixed: 497632232
Change-Id: I7720576858dc857299a5e603da4ab267587a3f9c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7865624
Reviewed-by: Olga Sharonova <[email protected]>
Commit-Queue: Guido Urdaneta <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1635745}
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756353
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/41a20d3d5cdba9666db7842806a15dc65cbf14c4

Git commit be5845546d566d951075a465935d8290cf80d913 by Michael Brüning (on behalf of Shahbaz Youssefi) on 31/07/2026 at 12:21..
[Backport] CVE-2026-14044: Use after free in ANGLE

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/angle/angle/+/7841557:
Stop revalidating the sync object in ClientWaitSync

The entry point already gets the sync object to operate on, so the error
paths can directly use that instead of calling `GetSyncIfValid` to
validate and get it again.

This change also makes sure that a SyncID look up is not done in the
unlocked tail of the call.

Bug: chromium:497670996
Change-Id: If8a53f947a815acd51fb172f03ae5bdfc1dc8465
Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7841557
Reviewed-by: Geoff Lang <[email protected]>
Commit-Queue: Shahbaz Youssefi <[email protected]>
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756354
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/be5845546d566d951075a465935d8290cf80d913

Git commit 5d28f1d09ccd357a3cf565ddd95514a442b5dae6 by Michael Brüning (on behalf of Saifuddin Hitawala) on 31/07/2026 at 12:21..
[Backport] CVE-2026-17650: Use after free in Compositing

Manual cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/8085883:
[viz] Fix UAF through surface re-entrancy for referenced surfaces

Guard against UAF through vector modification over sync re-entrancy
in Surface::RecomputeActiveReferencedSurfaces. This can happen when
a dependent surface gets activated which causes referenced surfaces
to be recomputed and a pending surface on same frame to be activated
which overwrites the currently active frame's data and leads to
dangling refs. This change makes a local copy and adds unittest to
verify this.

Bug: 514442821
Change-Id: I5093537dbb0f627265c715ca326629db4f417d7f
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8085883
Reviewed-by: Vasiliy Telezhnikov <[email protected]>
Commit-Queue: Saifuddin Hitawala <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1661877}
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756585
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/5d28f1d09ccd357a3cf565ddd95514a442b5dae6

Git commit 2e1cdfcac63d66517978865ff02d47dc6f34415f by Michael Brüning (on behalf of Minoru Chikamune) on 31/07/2026 at 12:21..
[Backport] CVE-2026-17664: Insufficient validation of untrusted input in Loader

Manual cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/7894356:
Bugfix: This CL fixes a bug reported in crbug.com/500554346

[analysis]
https://docs.google.com/document/d/1Eo_0xvh-g7x0f_DyNhbYTSWbW1Gpdb3JQOv6XKqGtkU/edit?resourcekey=0-x0nLWecQ0NBc05J76n592g&tab=t.0#heading=h.4ouk0evxdnbl

[reasoning]
https://docs.google.com/document/d/116U7-f0JMNXnubCLB2t2duFOkpOFyM3Mm9t5Dqw0Ppg/edit?resourcekey=0-LhL0UerWZJhm0HDpLv9zmg&tab=t.0

Bug: 500554346
Change-Id: Icdd5a534474c03b1050d4b5521e74f29f614ec86
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7894356
Reviewed-by: Kouhei Ueno <[email protected]>
Commit-Queue: Minoru Chikamune <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1640599}
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756758
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/2e1cdfcac63d66517978865ff02d47dc6f34415f

Git commit 51a5d542214430748b01b3ed417f90167e2ba3d4 by Michael Brüning (on behalf of Yuzu Saijo) on 31/07/2026 at 12:22..
[Backport] CVE-2026-17665: Use after free in V8

Manual cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/7894097:
[bfcache] Prevent JS callbacks from running when context is frozen

Before this CL, JavaScript callbacks were only stopped when context is
paused. This CL changes it so that they stop running when context is
frozen, too.

Migrating from `IsContextPaused()` to `IsContextFrozenOrPaused()` is the
general approach we take.

Bug: 511277457
Change-Id: I0b7cc83324d27591b034c31fa190106b61442174
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7894097
Reviewed-by: Kentaro Hara <[email protected]>
Reviewed-by: Yuki Shiino <[email protected]>
Commit-Queue: Yuzu Saijo <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1648072}
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756759
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/51a5d542214430748b01b3ed417f90167e2ba3d4

Git commit 58f76e6891ea0606808eb9d101c1b842025aa67f by Michael Brüning (on behalf of Shahbaz Youssefi) on 31/07/2026 at 12:22..
[Backport] CVE-2026-17668: Uninitialized Use in ANGLE

Manual cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/angle/angle/+/7901643:
Vulkan: Fix cubemap base-level change vs redefinition

If any face of the cubemap was redefined, the entire level was dropped
instead of just that face.

Fix credit [email protected]

Bug: chromium:513134019
Change-Id: I870dd23ba3ca791a9456d00984b75290d361b315
Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7901643
Reviewed-by: Charlie Lao <[email protected]>
Reviewed-by: Amirali Abdolrashidi <[email protected]>
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756760
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/58f76e6891ea0606808eb9d101c1b842025aa67f

Git commit da91d15281369800a4123ec957068796addba591 by Michael Brüning (on behalf of Shahbaz Youssefi) on 31/07/2026 at 12:22..
[Backport] CVE-2026-17671: Insufficient validation of untrusted input in ANGLE

Manual cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/angle/angle/+/7914802:
Vulkan: Fix advanced blend validation + backend skip

Advanced blend is only valid when used with draw buffer 0.  When
enabled, non-0 draw buffers shouldn't be enabled.

In the Vulkan backend, blend is skipped for disabled draw buffers
because Vulkan's validation is less forgiving to mixing blend and
advanced blend for disabled attachments (See
VUID-VkPipelineColorBlendAttachmentState-advancedBlendIndependentBlend-01407)

Bug: chromium:513257423
Change-Id: I9671015fef16bcb7b170b182905d481c37c2371d
Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7914802
Reviewed-by: Amirali Abdolrashidi <[email protected]>
Commit-Queue: Shahbaz Youssefi <[email protected]>
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756761
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/da91d15281369800a4123ec957068796addba591

Git commit 34d75b77b1e1ae4139c58f95bbdf223814529d62 by Michael Brüning (on behalf of Shahbaz Youssefi) on 31/07/2026 at 12:22..
[Backport] CVE-2026-17676: Inappropriate implementation in ANGLE

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/angle/angle/+/7921634:
Vulkan: Fix MSRTT when all attachments are disabled

The render pass was considered single-sampled in that case when the
render pass starts, which is incorrect.  This was caught by an ASSERT
when resolve attachments were being added to this
mistakenly-single-sampled attachment.

Bug: chromium:513920298
Change-Id: I0886bf0c5e075729188dc53de678effaf6fa352c
Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7921634
Reviewed-by: Charlie Lao <[email protected]>
Commit-Queue: Shahbaz Youssefi <[email protected]>
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756762
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/34d75b77b1e1ae4139c58f95bbdf223814529d62

Git commit edcf4c7ed2f1d08b419453eac1494d3e68304f0e by Michael Brüning (on behalf of haoyuewang) on 31/07/2026 at 12:22..
[Backport] CVE-2026-17673: Integer overflow in QUIC

Manual cherry-pick of quiche upstream commit
31bcbe18e357974ea51e068867ba98ccea05fef0 (no public review URL; PiperOrigin-RevId: 924870001):
No public description

PiperOrigin-RevId: 924870001
Change-Id: Ie0a53d8b06ce1be3a9e5c5afcacd0d472c228b2a
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756763
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/edcf4c7ed2f1d08b419453eac1494d3e68304f0e

Git commit fc43d01cb6536d8754c32ffdeb2acde1f8747ced by Michael Brüning (on behalf of Stacy Gaikovaia) on 31/07/2026 at 12:22..
[Backport] CVE-2026-17689: Uninitialized Use in ANGLE

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/angle/angle/+/7909294:
Replace mFunctions->clear in clearRenderbuffer

Bug: angleproject:517045160
Change-Id: Ie38d168d96544e9fd549118cfec9ff03d0e0540d
Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7909294
Commit-Queue: Shahbaz Youssefi <[email protected]>
Reviewed-by: Shahbaz Youssefi <[email protected]>
Reviewed-by: Geoff Lang <[email protected]>
Commit-Queue: Stacy Gaikovaia <[email protected]>
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756764
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/fc43d01cb6536d8754c32ffdeb2acde1f8747ced

Git commit acad4d3982c5e01feef366cf2fd621ee65d7c787 by Michael Brüning (on behalf of Geoff Lang) on 31/07/2026 at 12:22..
[Backport] CVE-2026-17691: Out of bounds write in ANGLE

Manual cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/angle/angle/+/8004731:
D3D: Handle uniforms that are optimized out by TranslatorHLSL

If a uniform is dead code eliminated during HLSL generation, it will not
be in the list of uniforms in ShaderD3D. Handle this case by skipping
uniform generation in ProgramExecutableD3D.

Fixed: chromium:517321292
Change-Id: Ibbba686c28fee3bafa235ff64dbee456eac7c2cf
Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/8004731
Reviewed-by: Shahbaz Youssefi <[email protected]>
Commit-Queue: Geoff Lang <[email protected]>
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756765
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/acad4d3982c5e01feef366cf2fd621ee65d7c787

Git commit 82ecde577cea3455414b9bc72aca20a3e8e7b6b5 by Michael Brüning (on behalf of Rohan Raja) on 31/07/2026 at 12:23..
[Backport] CVE-2026-17692: Use after free in DataTransfer

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/7885158:
Fix data race in ClipboardFormatType on Windows

ClipboardFormatType::FileContentAtIndexType() inserts into a
process-global std::map<LONG, ClipboardFormatType> from both the browser
UI thread (SetFileContents, drag-over predicates) and base::ThreadPool
workers (ExtractVirtualFiles -> CopyFileContentsToHGlobal) without any
synchronization.

Serialize entry into FileContentAtIndexType() with a function-local
static base::NoDestructor<base::Lock> taken via base::AutoLock. This
matches the existing locking pattern used elsewhere in
ui/base/clipboard/ (Clipboard::ClipboardMapLock() in clipboard.cc,
clipboard_android.cc, clipboard_non_backed.cc).

Bug: 517350808
Change-Id: I97c18ed25c782d8c43458020f8913623c7a20ba1
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7885158
Reviewed-by: Rakesh Goulikar <[email protected]>
Reviewed-by: Sambamurthy Bandaru <[email protected]>
Commit-Queue: Rohan Raja <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1646746}
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756766
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/82ecde577cea3455414b9bc72aca20a3e8e7b6b5

Git commit 98a3171f44e7658638ee15e76700c8f62d637b6a by Michael Brüning (on behalf of Shahbaz Youssefi) on 31/07/2026 at 12:23..
[Backport] CVE-2026-17695: Inappropriate implementation in ANGLE

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/angle/angle/+/7977471:
MSL/AST: Handle non-unary/binary expr in loop-forward-progress

Bug: chromium:517543052
Change-Id: Idf3bb42ea56e9fd62cad2bd914f9221ff32226e0
Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7977471
Reviewed-by: Yuxin Hu <[email protected]>
Commit-Queue: Shahbaz Youssefi <[email protected]>
Auto-Submit: Shahbaz Youssefi <[email protected]>
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756767
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/98a3171f44e7658638ee15e76700c8f62d637b6a

Git commit 9f1eb4981224224e0f7f9313f18124932bf12b02 by Michael Brüning (on behalf of Le Hoang Quyen) on 31/07/2026 at 12:23..
[Backport] CVE-2026-17701: Out of bounds read in ANGLE

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/angle/angle/+/7901455:
Metal: enable EGL_EXT_create_context_robustness

Element array's OOB indices are already prevented by the front-end
as long as a context is created with
EGL_CONTEXT_OPENGL_ROBUST_ACCESS_EXT attrib.

The only incomplete implementation of this extension is that the
extension expects OOB access in buffers to execute silently or trigger
context loss. However, because the Metal backend doesn't implement
GL_KHR_robust_buffer_access_behavior, the front-end will simply throw
GL_INVALID_OPERATION in those cases. This is reflected in these dEQP
tests:
- EGL.functional.robustness.reset_context.fixed_function_pipeline.\
reset_status.index_buffer_out_of_bounds
- EGL.functional.robustness.reset_context.fixed_function_pipeline.\
reset_status.vertex_buffer_out_of_bounds

Bug: chromium:517972648
Change-Id: Ia7b6e07d3f8b34f7a1669c5e576f168ad6deb159
Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7901455
Reviewed-by: Shahbaz Youssefi <[email protected]>
Reviewed-by: Geoff Lang <[email protected]>
Commit-Queue: Quyen Le <[email protected]>
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756768
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/9f1eb4981224224e0f7f9313f18124932bf12b02

Git commit c6ab33f080f655239598be939494ff4d4a31f245 by Michael Brüning (on behalf of Greg Daniel) on 31/07/2026 at 12:23..
[Backport] CVE-2026-17702: Inappropriate implementation in Skia

Manual cherry-pick of patch originally reviewed on
https://skia-review.googlesource.com/c/skia/+/1297216:
[Ganesh] If a resolve task fails to execute unwind the dirty tracking.

If a flush fails for some reason then we can get in an inconsistent
state with our dirty rect tracking for msaa resolves and mip maps.
This happens because we immediately update the proxies tracking of these
values when we recording a resolve task. But if that resolve task
never executes for some reason then we can end up in a bad state.

This changes makes it so that if a resolve task is ended without ever
executing, then it resets the proxies state to what it was before.

Technically if the draws before the resolve also never execute we will
now be marking a region dirty that isn't neccessarily dirty. This
could cause an extra resolve on future draws but is safe. However in
practice is flushes fail, clients will usually either tear everything
down (and thus it doesn't matter), or repeat the same draws again
(which would end up with the same resolve rect anyways). So this
possible extra resolve doesn't have a large real world impact.

Bug: b/517973093
Change-Id: Icc54310b87061471631f7a81adcfe661794a4e9c
Reviewed-on: https://skia-review.googlesource.com/c/skia/+/1297216
Reviewed-by: Thomas Smith <[email protected]>
Commit-Queue: Greg Daniel <[email protected]>
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756769
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/c6ab33f080f655239598be939494ff4d4a31f245

Git commit a7289a399390f23363ca80f77a9ac7c43995c23a by Michael Brüning (on behalf of Zhenyao Mo) on 31/07/2026 at 12:23..
[Backport] CVE-2026-17704: Use after free in ANGLE

Manual cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/angle/angle/+/7897336:
Vulkan: Fix Use-After-Free in TextureVk::releaseImage

finalizeImageLayoutInAllSharedContexts() may re-entrantly invoke
ContextVk::flushAndSubmitCommands() -> submitCommands(), which can
dereference FramebufferVk::mRenderTargetCache.mDepthStencilRenderTarget
pointing into the texture's mSingleLayerRenderTargets vectors.

This CL moves finalizeImageLayoutInAllSharedContexts() prior to
releaseImageViews() in TextureVk::releaseImage(), ensuring the
render targets are not freed when the re-entrant submit occurs.

A regression test is included to verify this behavior.

Bug: chromium:519259107
Change-Id: I69f90e3688cd02933cb93c5adc3ae56421944db4
Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7897336
Reviewed-by: Geoff Lang <[email protected]>
Reviewed-by: Shahbaz Youssefi <[email protected]>
Reviewed-by: Charlie Lao <[email protected]>
Auto-Submit: Zhenyao Mo <[email protected]>
Commit-Queue: Zhenyao Mo <[email protected]>
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756770
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/a7289a399390f23363ca80f77a9ac7c43995c23a

Git commit e5622c9e48ec396f7da3953ceca89fcd7af5982c by Michael Brüning (on behalf of Min Qin) on 31/07/2026 at 12:23..
[Backport] CVE-2026-17709: Race in Downloads

Manual cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/7905881:
Open and copy temporary file atomically in MakeCopyOfDownloadFile.

This CL does the following:
1. Create and open the temporary file atomically using
   base::CreateAndOpenTemporaryFileInDir, which returns an open
   base::File.
2. Open the source file.
3. Copy the contents using base::CopyFileContents, which operates
   directly on the open file descriptors.

This prevents the path-reopening race condition and is secure on all
platforms.

Bug: 519981494
Test: components_unittests --gtest_filter=DownloadItemTest.CopyDownload
Change-Id: I48e908ae4711653e76c08f0ccafe3dfeda01163c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7905881
Reviewed-by: Yaw Frempong <[email protected]>
Reviewed-by: Lily Chen <[email protected]>
Commit-Queue: Min Qin <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1642651}
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756771
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/e5622c9e48ec396f7da3953ceca89fcd7af5982c

Git commit ec029f7fc9bcbeb471311dfb7d55f3e651507cdc by Michael Brüning (on behalf of Min Qin) on 31/07/2026 at 12:23..
[Backport] CVE-2026-17710: Inappropriate implementation in MHTML

Manual cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/7933724:
[base] Add O_NOFOLLOW when opening a temp file for MHTML download

MHTML generation on macOS uses base::CreateTemporaryFile() which
immediately closes the created file descriptor. This CL adds
`FLAG_NO_FOLLOW` to `base::File::Flags` and implements it on POSIX using
`O_NOFOLLOW`. It then uses this flag when reopening the MHTML file in
`MHTMLGenerationManager`, preventing symlink following

Bug: 519991712
Change-Id: I9aa70954e6ed5e80a3499ae5fabce8b1fba175ad
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7933724
Reviewed-by: Lei Zhang <[email protected]>
Commit-Queue: Min Qin <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1647183}
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756772
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/ec029f7fc9bcbeb471311dfb7d55f3e651507cdc

Git commit 714d8435e1d61089bf9219c9be61ddabd8a0821a by Michael Brüning (on behalf of Gregory Dardyk) on 31/07/2026 at 12:23..
[Backport] CVE-2026-17713: Insufficient validation of untrusted input in Accessibility

Manual cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/7916047:
Add Mojom enum validation for accessibility IntAttributes in AXNodeData traits

A compromised renderer process can send arbitrary integer values for
enum attributes inside AXNodeData::int_attributes. When browser-side
code calls GetIntAttribute(...) and casts the returned int to a Mojom
enum, invalid values can lead to Undefined Behavior or out-of-bounds
table lookups.

This CL adds IsValidEnumIntAttribute(...) in ax_node_data_mojom_traits.cc
to validate all enum attributes using Mojo's generated IsKnownEnumValue.
By listing all IntAttribute enumerators without a default branch, future
additions to ax_enums.mojom will trigger a compiler warning until updated.

Bug: 520572766
Test: AXNodeDataMojomTraitsTest.IntAttributesValidEnumsBulk, AXNodeDataMojomTraitsTest.IntAttributesInvalidEnumsBulk, AXNodeDataMojomTraitsTest.IntAttributesValidTextStyle, AXNodeDataMojomTraitsTest.IntAttributesInvalidTextStyle

TAG=agy
CONV=cd67edb7-c1aa-4f6b-9b56-5bf461ab0ff9

Change-Id: I11a63a88cd39af7e9e6903bcf8e5e1b3b8ead2a3
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7916047
Reviewed-by: Peter Kotwicz <[email protected]>
Reviewed-by: David Tseng <[email protected]>
Commit-Queue: Gregory Dardyk <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1652660}
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756773
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/714d8435e1d61089bf9219c9be61ddabd8a0821a

Git commit 3941e20a2e2feb85644e442ea025f56b8db1c0f7 by Michael Brüning (on behalf of kylechar) on 31/07/2026 at 12:23..
[Backport] CVE-2026-17718: Use after free in ANGLE

Manual backport of patch originally reviewed on
https://chromium-review.googlesource.com/c/angle/angle/+/7955406:
vulkan: Fix UAF in VertexArrayVk

VertexArrayVk::mCurrentArrayBuffers caches pointer for streaming
attributes but the pointed to BufferHelper can be destroyed when a
different VAO is bound. The stale pointer is dereferenced, even if the
attribute isn't used by the current program, leading to a UAF. Ensure
that cache pointers are reset for all streaming attributes when binding
a VAO.

Bug: chromium:522079372
Change-Id: I71999b9455ab632affd3fdf8bbdf16aae472a78b
Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7955406
Reviewed-by: Shahbaz Youssefi <[email protected]>
Commit-Queue: Charlie Lao <[email protected]>
Commit-Queue: Kyle Charbonneau <[email protected]>
Reviewed-by: Charlie Lao <[email protected]>
Auto-Submit: Kyle Charbonneau <[email protected]>
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756774
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/3941e20a2e2feb85644e442ea025f56b8db1c0f7

Git commit aca7896d4485516c768ae9a06949f65bde199da1 by Michael Brüning (on behalf of Amirali Abdolrashidi) on 31/07/2026 at 12:24..
[Backport] CVE-2026-17721: Out of bounds write in ANGLE

Manual cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/angle/angle/+/7966117:
Vulkan: Fix layer index/count for update from FBO

  Currently, if glCopyTexSubImage3D() is called with a non-zero
z-offset and the CanCopyWithDraw() path (in copySubImageImpl()) is
not taken, stageSubresourceUpdateFromFramebuffer() in ImageHelper is
called, in which the buffer-to-image struct `copyToImage` is used to
stage an update. However, since the baseLayer in the ImageIndex object
(`index`) for the 3D texture has been initialized to the z-offset,
the related values in the struct (baseArrayLayer and layerCount) are
set up incorrectly.

* Updated stageSubresourceUpdateFromFramebuffer() so baseArrayLayer
  and layerCount are set to 0 and 1 unless the image is an array type,
  in which case the data from `index` is applied.

* Added unit test to CopyTexImageTestES3: Snorm3DTextureNonZeroOffset
  * It copies from an FBO bound to an RGBA8 SNORM texture to a non-zero
    z-offset of a 3D RGB8 SNORM texture.
    * The SNORM formats take the CPU readback path on some platforms.
      (stageSubresourceUpdateFromFramebuffer())

Bug: chromium:523495723
Change-Id: I08bf787dca05d74a5ab22983dfd0563a0eff002d
Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7966117
Reviewed-by: Shahbaz Youssefi <[email protected]>
Commit-Queue: Amirali Abdolrashidi <[email protected]>
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756775
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/aca7896d4485516c768ae9a06949f65bde199da1

Git commit 5471bb201e84832d4bbe760aed084f1467db04f0 by Moss Heim (on behalf of Ken Russell) on 31/07/2026 at 12:39..
[Backport] CVE-2026-13923: Uninitialized Use in GPU

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/7836292:
Disable rasterizer discard during luma emulation texture copy.

The copy could otherwise be accidentally skipped.

Fixed: 511772034
Change-Id: I301da32524fb8949b516fb8f5d19765bec202673
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7836292
Reviewed-by: Brandon Jones <[email protected]>
Commit-Queue: Kenneth Russell <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1629062}
Task-number: QTBUG-147900
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756548
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/5471bb201e84832d4bbe760aed084f1467db04f0

Git commit e848ab90a056118a59aa87f3b5b6bc9b28142d47 by Moss Heim (on behalf of Min Qin) on 31/07/2026 at 12:39..
[Backport] CVE-2026-13925: Inappropriate implementation in Downloads

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/7855782:
Use the destination URL after redirection for quarantine

This CL fixes an issue that quarantine checks the initial URL, instead
of the destination URL when saving a page.

Bug: 511802911
Change-Id: I1a3deed127add6db81fe20882303954807575cab
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7855782
Reviewed-by: Shakti Sahu <[email protected]>
Commit-Queue: Min Qin <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1634445}
Task-number: QTBUG-147900
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756549
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/e848ab90a056118a59aa87f3b5b6bc9b28142d47

Git commit daf3f8dace7b1dcf0e7cd2d50ee51c5934da1f33 by Moss Heim (on behalf of Sangbaek Park) on 31/07/2026 at 12:39..
[Backport] CVE-2026-13931: Inappropriate implementation in Media

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/7884211:
media: Fix AudibilityBypassAuthorization surviving player disconnect

This CL addresses a security issue where a compromised renderer
could spoof its audibility status by reusing a media foundation
audibility bypass grant. Previously, the authorization was granted
per-document and survived the disconnection of the original media
player.

The fix introduces an AudibilityBypassTracker that ties the
bypass grant to a specific MediaPlayerId. When a new
MediaFoundationRenderer is created, a pending grant is added.
The first player claiming a bypass consumes the grant, making
it impossible for subsequent spoofed players to reuse it. The
grant is cleared when the authorized player disconnects.

Tests: { MediaWebContentsObserverTest.AudibilityBypass* }

Bug: 512997441, 512636302

Change-Id: If7eb3ed525c75911e86f1c3bdb3e281f329dbcfc
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7884211
Commit-Queue: Sangbaek Park <[email protected]>
Reviewed-by: Dale Curtis <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1639727}
Task-number: QTBUG-147900
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756550
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/daf3f8dace7b1dcf0e7cd2d50ee51c5934da1f33

Git commit 3f813a81f457b8e7d7fb9d344571353df858d566 by Moss Heim (on behalf of Kyle Charbonneau) on 31/07/2026 at 12:39..
[Backport] CVE-2026-13934: Insufficient validation of untrusted input in Dawn

Cherry-pick of patch originally reviewed on
https://dawn-review.googlesource.com/c/dawn/+/309015:
Add YCbCr sampler validation

VUID-VkSamplerCreateInfo-addressModeU-01646 enforces constraints on
address mode and anisotropy being disabled for YCbCr samplers. Enforce
those constraints in dawn validation and when creating VkSampler.

Bug: 513006636
Change-Id: I608a29e7e468bc06baae3fed45192bc5ad9144b0
Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/309015
Reviewed-by: Corentin Wallez <[email protected]>
Reviewed-by: Brandon Jones <[email protected]>
Commit-Queue: Corentin Wallez <[email protected]>
Task-number: QTBUG-147900
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756551
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/3f813a81f457b8e7d7fb9d344571353df858d566

Git commit 6ca05be29313e0288af74d90d5e23cc3355a258c by Moss Heim (on behalf of Wei Wang) on 31/07/2026 at 12:39..
[Backport] CVE-2026-13935: Side-channel information leakage in ComputePressure (1/3)

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/7863762:
[PATCH 1/4] Revert "compute pressure: Fix default value for own_contribution_estimate"

This reverts commit 6b927af55069ef711399423f6c76c263eb8d4219.

This feature is creating information leak. There is no active
development on this feature anymore, therefore it was decided to
revert the patches related to this feature.

Bug: 513009005
Change-Id: I91f22e30c4171778615e8673aee223de95eb2a28
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7863762
Reviewed-by: Matt Reynolds <[email protected]>
Reviewed-by: Reilly Grant <[email protected]>
Commit-Queue: Wang, Wei4 <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1635412}
Task-number: QTBUG-147900
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756552
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/6ca05be29313e0288af74d90d5e23cc3355a258c

Git commit e2da3ad39c62d8827b560b72c1168c63a07ec28a by Moss Heim (on behalf of Wei Wang) on 31/07/2026 at 12:39..
[Backport] CVE-2026-13935: Side-channel information leakage in ComputePressure (2/3)

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/7863881:
[PATCH 3/4] Revert "compute pressure: Add OwnContributionEstimate to API."

This reverts commit 07a693411a90509f07cc0cc59c93684262c5d902.

This feature is creating information leak. There is no active
development on this feature anymore, therefore it was decided to
revert the patches related to this feature.

Bug: 513009005
Change-Id: I3e57e1fb6d4160539c6c46ca5bd96bbd4468dbb2
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7863881
Reviewed-by: Alex Rudenko <[email protected]>
Commit-Queue: Wang, Wei4 <[email protected]>
Reviewed-by: Reilly Grant <[email protected]>
Reviewed-by: Matt Reynolds <[email protected]>
Reviewed-by: Philip Jägenstedt <[email protected]>
Reviewed-by: Ian Vollick <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1635414}
Task-number: QTBUG-147900
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756553
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/e2da3ad39c62d8827b560b72c1168c63a07ec28a

Git commit 754591e4b2b7284eaa4e41d524595785ada23620 by Moss Heim (on behalf of Wei Wang) on 31/07/2026 at 12:39..
[Backport] CVE-2026-13935: Side-channel information leakage in ComputePressure (3/3)

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/7863882:
[PATCH 4/4] Revert "compute pressure: Calculate ownContributionEstimate"

This reverts commit c18b6b45fa249d8f36e56d481d08c4cd90f510ce.

This feature is creating information leak. There is no active
development on this feature anymore, therefore it was decided to
revert the patches related to this feature.

Bug: 513009005
Change-Id: I84fcc6da05b8c80272120ed6e822eedc56bd61e2
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7863882
Reviewed-by: Yang Guo <[email protected]>
Reviewed-by: Reilly Grant <[email protected]>
Commit-Queue: Wang, Wei4 <[email protected]>
Reviewed-by: Mike West <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1635415}
Task-number: QTBUG-147900
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/756554
Reviewed-by: Kaloyan Chehlarski <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/754591e4b2b7284eaa4e41d524595785ada23620