[qt/qt/qtwebengine]: Summary of bulk changes made

Git repository change summary for qt/qt/qtwebengine
Pushed by mirror-service into branch '6.140'.
Changed from 4086e3338036f2163053d1d1dda7432700c4e859 to 4cc49f42c1fef1f2b2482e62ecfbcfb7f1b029e9
Acknowledgement was received that this change introduces only existing code that has been pushed to another public open source repository.

This change contains the following new commits:

Git commit d4d00a91f57d489c77c1b13012e46a5585b05257 by Michal Klocek (on behalf of Dennis Kim) on 17/08/2026 at 14:59..
[ohos][qtpdf] Add QtPdf build support for OHOS

Wire OpenHarmony (OHOS) into the QtPdf CMake build: mark it a supported
QtPdf platform, pass the OHOS gn toolchain args, and route it through
the Linux link-options path.

QtToolchainHelpers.cmake maps the gn target_os to ohos, passes the OHOS
target_cpu, SDK sysroot and musl_sysroot, and keeps the Rust build off
for OHOS (Chromium's rust.gni has no rust_abi_target for it).
src/pdf/CMakeLists.txt sets use_blink=false and enable_pdf=false for
OHOS, since QtPdf uses pdfium directly and needs neither blink nor
Chromium's in-tree PDF viewer.

configure.cmake accepts OHOS as a supported QtPdf platform with Clang,
and Functions.cmake routes OHOS through the same gn link options as
Linux and Android.

Task-number: QTBUG-148157
Change-Id: I48d13bcc5ee68a834617d8c07520d0a4ca744237
Reviewed-by: Michal Klocek <[email protected]>
Reviewed-by: Liang Qi <[email protected]>
(cherry picked from commit 6cb939e859446e3054c31774a97b0538ad9c434e)
Reviewed-by: Allan Sandfeld Jensen <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine/-/commit/d4d00a91f57d489c77c1b13012e46a5585b05257

Git commit 9c3a3625581a4577033f08641664b315062d991f by Michal Klocek on 17/08/2026 at 15:00..
Update Chromium

Submodule src/3rdparty cbf4306f..a0e9609f:
* Revert "[fixup] Fix QtWebEngine build on all platforms"
* [fixup][Backport] Dependency for CVE-2026-14407 (1/3)
* [Backport][parts] CVE-2026-13909: Insufficient policy enforcement in DevTools
* CVE-2026-14414: Insufficient validation of untrusted input in Skia
* [fixup][Backport] Dependency for CVE-2026-14407 (1/3)
* [Backport] CVE-2026-13875: Insufficient validation of untrusted input in GPU
* [fixup] Fix QtWebEngine build on all platforms
* [Backport] CVE-2026-14407: Inappropriate implementation in V8
* [Backport] Dependency for CVE-2026-14407 (3/3)
* [Backport] Dependency for CVE-2026-14407 (2/3)
* [Backport] Dependency for CVE-2026-14407 (1/3)
* [backport] CVE-2026-14016: Insufficient policy enforcement in SVG (2/2)
* [backport] CVE-2026-14016: Insufficient policy enforcement in SVG (1/2)
* [backport] CVE-2026-14004: Inappropriate implementation in CSS
* [backport] Dependency for CVE-2026-14004
* [backport] CVE-2026-14002: Inappropriate implementation in Geolocation
* [backport] Dependency for CVE-2026-14002
* [backport] CVE-2026-13976: Heap buffer overflow in Storage

Fixes: QTBUG-147760
Fixes: QTBUG-147859
Fixes: QTBUG-147892
Fixes: QTBUG-147901
Fixes: QTBUG-147902
Fixes: QTBUG-147903
Fixes: QTBUG-147928
Fixes: QTBUG-147929
Fixes: QTBUG-147930
Fixes: QTBUG-148187
Fixes: QTBUG-148189
Fixes: QTBUG-148190
Fixes: QTBUG-148314
Fixes: QTBUG-148315
Fixes: QTBUG-148316
Fixes: QTBUG-148515
Fixes: QTBUG-148516
Fixes: QTBUG-148581
Pick-to: 6.11
Change-Id: I609d349be6608784b94860887f96b3d729e6ea8e
Reviewed-by: Michael Brüning <[email protected]>
(cherry picked from commit a9a9091ef003d4e3c70559978f5d69668367bc4c)
Reviewed-by: Allan Sandfeld Jensen <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine/-/commit/9c3a3625581a4577033f08641664b315062d991f

Git commit 8f06b8275d4ca57f24e862f206c074c148891238 by Michal Klocek (on behalf of Allan Sandfeld Jensen) on 17/08/2026 at 15:00..
Avoid using the term extension directly about the API

This emphasises this is meant to be used differently and just provides
a way to access the extension-compatible API, but not necessary to use
to extend the user application.

Change-Id: Ie1f1309910e51dbc4ecc99f9d5b7b2fbd0fedb89
Reviewed-by: Moss Heim <[email protected]>
(cherry picked from commit d4cf8fa733e42a7fce5ffdaf817d32c3721c18b9)
Reviewed-by: Allan Sandfeld Jensen <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine/-/commit/8f06b8275d4ca57f24e862f206c074c148891238

Git commit 0bacc0d7f6b643a04866f621412eacbbd1db1b7f by Michal Klocek (on behalf of Qt Submodule Update Bot) on 17/08/2026 at 15:00..
Update dependencies on '6.12' in qt/qtwebengine

Change-Id: Ia4e3b081624c5144a67f8ccfca5c98e7f5150685
Reviewed-by: Allan Sandfeld Jensen <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine/-/commit/0bacc0d7f6b643a04866f621412eacbbd1db1b7f

Git commit 10c0a4513a493cd1641523d9eb33ba7eb60bb6b5 by Michal Klocek (on behalf of Allan Sandfeld Jensen) on 17/08/2026 at 15:00..
API review, move away from QSharedPointer

Avoid QSharedPointer, changing the backend to use std::shared_ptr.

Change-Id: I7f96a90478437cde2aba8f67e56044d664b7ba6b
Reviewed-by: Moss Heim <[email protected]>
(cherry picked from commit 90f39e195ce17ec50d1883427d2b9f4ae2e54b64)
Reviewed-by: Allan Sandfeld Jensen <[email protected]>
(cherry picked from commit 16fd8a4e97b409cf263d1a731b5e93c473bc4954)
https://invent.kde.org/qt/qt/qtwebengine/-/commit/10c0a4513a493cd1641523d9eb33ba7eb60bb6b5

Git commit 3c9470d0e7531d212b85767cdf567917d8155e75 by Michal Klocek (on behalf of Allan Sandfeld Jensen) on 17/08/2026 at 15:00..
Update Chromium for 151.0.7922.71 fixes

Submodule src/3rdparty a0e9609f4..5170777d2:
  > [Backport] CVE-2026-19172: Use after free in View
  > [backport] CVE-2026-17659: Inappropriate implementation in
SiteIsolation (4/4)
  > [backport] CVE-2026-17659: Inappropriate implementation in
SiteIsolation (3/4)
  > [backport] CVE-2026-17659: Inappropriate implementation in
SiteIsolation (2/4)
  > [backport] CVE-2026-17659: Inappropriate implementation in
SiteIsolation (1/4)
  > [backport] CVE-2026-17658: Use after free in V8
  > [backport] Dependency for CVE-2026-17658
  > [backport] CVE-2026-17657: Use after free in Navigation
  > [Backport] CVE-2026-17653: Use after free in Skia
  > [Backport] CVE-2026-17651: Insufficient validation of untrusted
input in Dawn
  > [Backport] CVE-2026-19151: Use after free in V8
  > [Backport] CVE-2026-19146: Uninitialized Use in GPU
  > [Backport] CVE-2026-19168: Inappropriate implementation in V8
  > [Backport] CVE-2026-19140: Use after free in GPU
  > [Backport] CVE-2026-19157: Out of bounds write in ANGLE
  > [Backport] CVE-2026-19154: Use after free in Skia

Task-number: QTBUG-148654
Pick-to: 6.11 6.11.2
Change-Id: I41bd0b83793acbcd1a6e3106995b56a66653ce74
Reviewed-by: Allan Sandfeld Jensen <[email protected]>
(cherry picked from commit 320e5b774d5ea521e7e8bfc388bbd96b2f1f2301)
https://invent.kde.org/qt/qt/qtwebengine/-/commit/3c9470d0e7531d212b85767cdf567917d8155e75

Git commit c718f9c1fc83053d20ecdbe447658abcb977216d by Michal Klocek (on behalf of Qt Submodule Update Bot) on 17/08/2026 at 15:01..
Update dependencies on '6.12' in qt/qtwebengine

Change-Id: I6b03a2644639aae6c623a67019d49b760a64f3c4
Reviewed-by: Allan Sandfeld Jensen <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine/-/commit/c718f9c1fc83053d20ecdbe447658abcb977216d

Git commit b844be3e8361ad834ad04da3d5f610b3482ee680 by Michal Klocek (on behalf of Allan Sandfeld Jensen) on 17/08/2026 at 15:01..
QWebEnginePage/Frame: add deprecation messages and grace period

Found in API-review.

Change-Id: Ie241a9ba7ed04589e1d6b44f3479d070e2eb85fa
Reviewed-by: Marc Mutz <[email protected]>
(cherry picked from commit 60eb977b8e47d7210db392206c324cd4c95c7d7d)
https://invent.kde.org/qt/qt/qtwebengine/-/commit/b844be3e8361ad834ad04da3d5f610b3482ee680

Git commit 4cc49f42c1fef1f2b2482e62ecfbcfb7f1b029e9 by Michal Klocek (on behalf of Qt Submodule Update Bot) on 17/08/2026 at 15:01..
Update dependencies on '6.12' in qt/qtwebengine

Change-Id: Iebc27dab8ae62a80d7f57d8f5821859f21af4b6a
Reviewed-by: Allan Sandfeld Jensen <[email protected]>
https://invent.kde.org/qt/qt/qtwebengine/-/commit/4cc49f42c1fef1f2b2482e62ecfbcfb7f1b029e9