[qt/qt/qtwebengine-chromium]: Summary of bulk changes made

Git repository change summary for qt/qt/qtwebengine-chromium
Pushed by mirror-service into branch '140-based'.
Changed from 678267c7edc0788a6b0065ac344557838a0fbfb4 to 0138fd533d1a9c13b3f37882761139e6cb5add8f
Acknowledgement was received that this change introduces only existing code that has been pushed to another public open source repository.

This change contains the following new commits:

Git commit 168c60722fbd478443a471f6a9471f6a56087560 by Michael Brüning on 05/08/2026 at 14:24..
CVE-2026-14414: Insufficient validation of untrusted input in Skia

Backport of band-aid fix outlined in https://issues.chromium.org/issues/513948227.

Change-Id: I1b217d02c6494efe5021531a373e39566eb9d294
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/757997
Reviewed-by: Allan Sandfeld Jensen <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/168c60722fbd478443a471f6a9471f6a56087560

Git commit 0138fd533d1a9c13b3f37882761139e6cb5add8f by Michael Brüning (on behalf of Danil Somsikov) on 05/08/2026 at 16:02..
[Backport][parts] CVE-2026-13909: Insufficient policy enforcement in DevTools

Manual backport of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/7802063:
Enforce security checks in DevTools child sessions and strengthen extension trust.

This change addresses a vulnerability where child sessions created via
the DevTools Target domain could bypass security restrictions normally
enforced on the root client.

Specifically:

1. Enforce checks in child sessions: TargetHandler::Session now
overrides MayAttachToRenderFrameHost, MayAttachToURL, and
MayAccessAllCookies to delegate these checks to the root client. This
prevents a compromised renderer from using child sessions to bypass
WebUI attachment or cookie access restrictions.

2. Strengthen extension trust: ExtensionIsTrusted in debugger_api.cc is
updated to verify that the extension is not from an unpacked location.
This prevents attackers from gaining "trusted" status by loading an
unpacked extension with the Perfetto UI extension ID.

3. Improve robustness: TargetHandler::Session::Attach now returns a
std::optional<std::string> to provide more robust error handling when
session creation fails.

Bug: 505933538
Change-Id: I00dad3f1515032eca5296e9aa2876bed2bf5c851
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7802063
Reviewed-by: Andrey Kosyakov <[email protected]>
Reviewed-by: Devlin Cronin <[email protected]>
Auto-Submit: Danil Somsikov <[email protected]>
Commit-Queue: Danil Somsikov <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1628501}
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/758087
Reviewed-by: Allan Sandfeld Jensen <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine-chromium/-/commit/0138fd533d1a9c13b3f37882761139e6cb5add8f