Version in base suite: 150.0.7871.100-1~deb13u1
Version in overlay suite: 150.0.7871.114-1~deb13u1
Base version: chromium_150.0.7871.114-1~deb13u1
Target version: chromium_150.0.7871.124-1~deb13u1
Base file: /srv/ftp-master.debian.org/ftp/pool/main/c/chromium/chromium_150.0.7871.114-1~deb13u1.dsc
Target file: /srv/ftp-master.debian.org/policy/pool/main/c/chromium/chromium_150.0.7871.124-1~deb13u1.dsc
/srv/release.debian.org/tmp/hcY8mwSoct/chromium-150.0.7871.124/infra/config/generated/builders/ci/Linux ASan LSan Builder/targets/chromium.memory.json | 21
/srv/release.debian.org/tmp/hcY8mwSoct/chromium-150.0.7871.124/infra/config/generated/builders/ci/Linux ASan LSan Tests (1)/targets/chromium.memory.json | 21
/srv/release.debian.org/tmp/hcY8mwSoct/chromium-150.0.7871.124/infra/config/generated/builders/ci/Linux Builder (Wayland)/targets/chromium.linux.json | 23
/srv/release.debian.org/tmp/hcY8mwSoct/chromium-150.0.7871.124/infra/config/generated/builders/ci/Linux Builder (dbg)/targets/chromium.linux.json | 17
/srv/release.debian.org/tmp/hcY8mwSoct/chromium-150.0.7871.124/infra/config/generated/builders/ci/Linux Builder/targets/chromium.linux.json | 19
/srv/release.debian.org/tmp/hcY8mwSoct/chromium-150.0.7871.124/infra/config/generated/builders/ci/Linux TSan Builder/targets/chromium.memory.json | 21
/srv/release.debian.org/tmp/hcY8mwSoct/chromium-150.0.7871.124/infra/config/generated/builders/ci/Linux TSan Tests/targets/chromium.memory.json | 21
/srv/release.debian.org/tmp/hcY8mwSoct/chromium-150.0.7871.124/infra/config/generated/builders/ci/Linux Tests (dbg)(1)/targets/chromium.linux.json | 17
/srv/release.debian.org/tmp/hcY8mwSoct/chromium-150.0.7871.124/infra/config/generated/builders/ci/Linux Tests/targets/chromium.linux.json | 19
chromium-150.0.7871.124/BUILD.gn | 5
chromium-150.0.7871.124/DEPS | 10
chromium-150.0.7871.124/ash/strings/ash_strings_cs.xtb | 2
chromium-150.0.7871.124/ash/strings/ash_strings_es.xtb | 4
chromium-150.0.7871.124/ash/strings/ash_strings_fa.xtb | 2
chromium-150.0.7871.124/ash/strings/ash_strings_fr.xtb | 2
chromium-150.0.7871.124/ash/strings/ash_strings_ja.xtb | 2
chromium-150.0.7871.124/base/win/win_util.cc | 68
chromium-150.0.7871.124/base/win/win_util.h | 24
chromium-150.0.7871.124/build/util/LASTCHANGE | 2
chromium-150.0.7871.124/build/util/LASTCHANGE.committime | 2
chromium-150.0.7871.124/chrome/VERSION | 2
chromium-150.0.7871.124/chrome/app/generated_resources.grd | 6
chromium-150.0.7871.124/chrome/app/resources/chromium_strings_fa.xtb | 2
chromium-150.0.7871.124/chrome/app/resources/generated_resources_ca.xtb | 2
chromium-150.0.7871.124/chrome/app/resources/generated_resources_cs.xtb | 2
chromium-150.0.7871.124/chrome/app/resources/generated_resources_en-GB.xtb | 22
chromium-150.0.7871.124/chrome/app/resources/generated_resources_es.xtb | 2
chromium-150.0.7871.124/chrome/app/resources/generated_resources_eu.xtb | 2
chromium-150.0.7871.124/chrome/app/resources/generated_resources_fa.xtb | 2
chromium-150.0.7871.124/chrome/app/resources/generated_resources_fr.xtb | 4
chromium-150.0.7871.124/chrome/app/resources/generated_resources_hr.xtb | 2
chromium-150.0.7871.124/chrome/app/resources/generated_resources_hu.xtb | 4
chromium-150.0.7871.124/chrome/app/resources/generated_resources_id.xtb | 2
chromium-150.0.7871.124/chrome/app/resources/generated_resources_ne.xtb | 2
chromium-150.0.7871.124/chrome/app/resources/generated_resources_sw.xtb | 2
chromium-150.0.7871.124/chrome/app/resources/google_chrome_strings_fa.xtb | 2
chromium-150.0.7871.124/chrome/app/resources/google_chrome_strings_fr.xtb | 2
chromium-150.0.7871.124/chrome/app/resources/google_chrome_strings_hr.xtb | 2
chromium-150.0.7871.124/chrome/app/resources/google_chrome_strings_sw.xtb | 2
chromium-150.0.7871.124/chrome/browser/about_flags.cc | 4
chromium-150.0.7871.124/chrome/browser/ash/app_list/arc/arc_app_launcher.cc | 10
chromium-150.0.7871.124/chrome/browser/ash/app_list/arc/arc_app_launcher.h | 3
chromium-150.0.7871.124/chrome/browser/ash/fileapi/external_file_url_loader_factory.cc | 96
chromium-150.0.7871.124/chrome/browser/ash/fileapi/external_file_url_loader_factory_unittest.cc | 18
chromium-150.0.7871.124/chrome/browser/flag-metadata.json | 5
chromium-150.0.7871.124/chrome/browser/flag_descriptions.h | 4
chromium-150.0.7871.124/chrome/browser/glic/host/glic_ui.cc | 2
chromium-150.0.7871.124/chrome/browser/glic/host/host.cc | 5
chromium-150.0.7871.124/chrome/browser/glic/host/new_glic_api_browsertest.cc | 34
chromium-150.0.7871.124/chrome/browser/glic/service/metrics/glic_instance_metrics.cc | 4
chromium-150.0.7871.124/chrome/browser/lifetime/smart_restart_manager_browsertest.cc | 73
chromium-150.0.7871.124/chrome/browser/lifetime/smart_restart_policy.cc | 13
chromium-150.0.7871.124/chrome/browser/lifetime/smart_restart_policy_unittest.cc | 22
chromium-150.0.7871.124/chrome/browser/resources/chromeos/accessibility/strings/accessibility_strings_ja.xtb | 10
chromium-150.0.7871.124/chrome/browser/resources/glic/glic_api_impl/host/glic_api_host.ts | 3
chromium-150.0.7871.124/chrome/browser/resources/glic/glic_api_impl/host/host_from_client.ts | 3
chromium-150.0.7871.124/chrome/browser/resources/glic/glic_app_controller.ts | 17
chromium-150.0.7871.124/chrome/browser/resources/side_panel/read_anything/app/read_anything.d.ts | 13
chromium-150.0.7871.124/chrome/browser/resources/side_panel/read_anything/read_anything.ts | 2
chromium-150.0.7871.124/chrome/browser/resources/side_panel/read_anything/shared/metrics_browser_proxy.ts | 12
chromium-150.0.7871.124/chrome/browser/resources/side_panel/read_anything/shared/read_anything_logger.ts | 57
chromium-150.0.7871.124/chrome/browser/ssl/https_first_mode_settings_tracker.cc | 1
chromium-150.0.7871.124/chrome/browser/ssl/https_first_mode_settings_tracker_unittest.cc | 10
chromium-150.0.7871.124/chrome/browser/ui/android/strings/translations/android_chrome_strings_ca.xtb | 2
chromium-150.0.7871.124/chrome/browser/ui/android/strings/translations/android_chrome_strings_es.xtb | 4
chromium-150.0.7871.124/chrome/browser/ui/android/strings/translations/android_chrome_strings_fa.xtb | 2
chromium-150.0.7871.124/chrome/browser/ui/android/strings/translations/android_chrome_strings_fr.xtb | 2
chromium-150.0.7871.124/chrome/browser/ui/android/strings/translations/android_chrome_strings_ne.xtb | 2
chromium-150.0.7871.124/chrome/browser/ui/android/strings/translations/android_chrome_strings_zh-CN.xtb | 2
chromium-150.0.7871.124/chrome/browser/ui/ash/shelf/chrome_shelf_controller_unittest.cc | 107
chromium-150.0.7871.124/chrome/browser/ui/cocoa/BUILD.gn | 2
chromium-150.0.7871.124/chrome/browser/ui/cocoa/status_icons/status_icon_mac.h | 3
chromium-150.0.7871.124/chrome/browser/ui/cocoa/status_icons/status_icon_mac.mm | 50
chromium-150.0.7871.124/chrome/browser/ui/cocoa/status_icons/status_icon_mac_unittest.mm | 55
chromium-150.0.7871.124/chrome/browser/ui/cocoa/status_icons/status_icons_features.cc | 13
chromium-150.0.7871.124/chrome/browser/ui/cocoa/status_icons/status_icons_features.h | 20
chromium-150.0.7871.124/chrome/browser/ui/views/translate/translate_bubble_view.cc | 8
chromium-150.0.7871.124/chrome/browser/ui/views/translate/translate_bubble_view_unittest.cc | 35
chromium-150.0.7871.124/chrome/browser/ui/webui/new_tab_page/action_chips/action_chips_generator.cc | 34
chromium-150.0.7871.124/chrome/browser/ui/webui/new_tab_page/action_chips/action_chips_generator_unittest.cc | 114
chromium-150.0.7871.124/chrome/browser/ui/webui/new_tab_page/new_tab_page_ui.cc | 3
chromium-150.0.7871.124/chrome/browser/ui/webui/searchbox/webui_omnibox_interactive_uitest.cc | 4
chromium-150.0.7871.124/chrome/browser/ui/webui/side_panel/customize_chrome/customize_chrome_ui.cc | 3
chromium-150.0.7871.124/chrome/renderer/accessibility/read_anything/read_anything_app_controller.cc | 67
chromium-150.0.7871.124/chrome/renderer/accessibility/read_anything/read_anything_app_controller.h | 8
chromium-150.0.7871.124/chrome/renderer/accessibility/read_anything/read_anything_app_controller_browsertest.cc | 178
chromium-150.0.7871.124/chrome/renderer/accessibility/read_anything/read_anything_app_model.h | 11
chromium-150.0.7871.124/chromeos/CHROMEOS_LKGM | 2
chromium-150.0.7871.124/chromeos/ash/experiences/arc/crash_collector/arc_crash_collector_bridge.cc | 49
chromium-150.0.7871.124/chromeos/ash/experiences/arc/crash_collector/arc_crash_collector_bridge_unittest.cc | 31
chromium-150.0.7871.124/chromeos/profiles/arm.afdo.newest.txt | 2
chromium-150.0.7871.124/chromeos/profiles/atom.afdo.newest.txt | 2
chromium-150.0.7871.124/chromeos/profiles/bigcore.afdo.newest.txt | 2
chromium-150.0.7871.124/components/browser_ui/strings/android/translations/browser_ui_strings_es.xtb | 2
chromium-150.0.7871.124/components/browser_ui/strings/android/translations/browser_ui_strings_fr.xtb | 2
chromium-150.0.7871.124/components/pdf/renderer/pdf_accessibility_tree_builder_heuristic.cc | 8
chromium-150.0.7871.124/components/policy/core/common/policy_loader_win.cc | 8
chromium-150.0.7871.124/components/policy/resources/policy_templates_it.xtb | 2
chromium-150.0.7871.124/components/search/ntp_features.cc | 3
chromium-150.0.7871.124/components/search/ntp_features.h | 1
chromium-150.0.7871.124/components/strings/components_google_chrome_strings_de.xtb | 2
chromium-150.0.7871.124/components/strings/components_google_chrome_strings_ru.xtb | 4
chromium-150.0.7871.124/components/strings/components_strings_be.xtb | 2
chromium-150.0.7871.124/components/strings/components_strings_de.xtb | 2
chromium-150.0.7871.124/components/strings/components_strings_en-GB.xtb | 2
chromium-150.0.7871.124/components/strings/components_strings_es.xtb | 10
chromium-150.0.7871.124/components/strings/components_strings_fa.xtb | 2
chromium-150.0.7871.124/components/strings/components_strings_fr.xtb | 20
chromium-150.0.7871.124/components/strings/components_strings_hr.xtb | 4
chromium-150.0.7871.124/components/strings/components_strings_id.xtb | 8
chromium-150.0.7871.124/components/strings/components_strings_pt-BR.xtb | 12
chromium-150.0.7871.124/components/strings/components_strings_ru.xtb | 12
chromium-150.0.7871.124/components/strings/components_strings_th.xtb | 4
chromium-150.0.7871.124/components/strings/components_strings_zh-CN.xtb | 2
chromium-150.0.7871.124/components/strings/components_strings_zh-TW.xtb | 6
chromium-150.0.7871.124/content/browser/BUILD.gn | 2
chromium-150.0.7871.124/content/browser/blob_storage/blob_url_browsertest.cc | 112
chromium-150.0.7871.124/content/browser/browser_main_loop.cc | 20
chromium-150.0.7871.124/content/browser/child_process_security_policy_impl.cc | 28
chromium-150.0.7871.124/content/browser/child_process_security_policy_impl.h | 27
chromium-150.0.7871.124/content/browser/child_process_security_policy_unittest.cc | 95
chromium-150.0.7871.124/content/browser/loader/navigation_url_loader_impl.cc | 18
chromium-150.0.7871.124/content/browser/loader/navigation_url_loader_impl.h | 7
chromium-150.0.7871.124/content/browser/media/capture/mouse_cursor_overlay_controller_mac.mm | 16
chromium-150.0.7871.124/content/browser/network_context_client_base_impl.cc | 18
chromium-150.0.7871.124/content/browser/network_context_client_base_impl_unittest.cc | 38
chromium-150.0.7871.124/content/browser/renderer_host/render_frame_host_impl.cc | 7
chromium-150.0.7871.124/content/browser/scoped_browser_file_access.cc | 25
chromium-150.0.7871.124/content/browser/scoped_browser_file_access.h | 32
chromium-150.0.7871.124/content/browser/web_contents/web_contents_impl.cc | 8
chromium-150.0.7871.124/content/browser/web_contents/web_contents_impl_browsertest.cc | 88
chromium-150.0.7871.124/content/public/browser/child_process_security_policy.h | 1
chromium-150.0.7871.124/debian/changelog | 31
chromium-150.0.7871.124/debian/patches/series | 1
chromium-150.0.7871.124/debian/patches/upstream/libyuv-loongarch-fix-row_lsx.cc-and-row_lasx.cc.patch | 196
chromium-150.0.7871.124/gpu/BUILD.gn | 1
chromium-150.0.7871.124/gpu/command_buffer/service/shared_image/gl_texture_holder.cc | 38
chromium-150.0.7871.124/gpu/command_buffer/service/shared_image/gl_texture_holder.h | 3
chromium-150.0.7871.124/gpu/command_buffer/service/shared_image/gl_texture_holder_unittest.cc | 113
chromium-150.0.7871.124/gpu/config/gpu_lists_version.h | 2
chromium-150.0.7871.124/gpu/vulkan/vulkan_image_linux.cc | 75
chromium-150.0.7871.124/gpu/vulkan/vulkan_image_unittest.cc | 41
chromium-150.0.7871.124/infra/config/generated/builders/ci/linux-wayland-weston-rel-tests/targets/chromium.linux.json | 23
chromium-150.0.7871.124/infra/config/generated/builders/try/linux-rel/targets/chromium.linux.json | 19
chromium-150.0.7871.124/infra/config/generated/builders/try/linux-wayland-weston-rel/targets/chromium.linux.json | 23
chromium-150.0.7871.124/infra/config/generated/builders/try/linux_chromium_asan_rel_ng/targets/chromium.memory.json | 21
chromium-150.0.7871.124/infra/config/generated/builders/try/linux_chromium_compile_dbg_ng/targets/chromium.linux.json | 17
chromium-150.0.7871.124/infra/config/generated/builders/try/linux_chromium_dbg_ng/targets/chromium.linux.json | 17
chromium-150.0.7871.124/infra/config/generated/builders/try/linux_chromium_tsan_rel_ng/targets/chromium.memory.json | 21
chromium-150.0.7871.124/infra/config/generated/cq-usage/cq-tests.md | 6
chromium-150.0.7871.124/infra/config/generated/testing/gn_isolate_map.pyl | 6
chromium-150.0.7871.124/infra/config/targets/binaries.star | 7
chromium-150.0.7871.124/infra/config/targets/bundles.star | 6
chromium-150.0.7871.124/infra/config/targets/tests.star | 4
chromium-150.0.7871.124/media/gpu/windows/media_foundation_video_encode_accelerator_win.cc | 6
chromium-150.0.7871.124/services/network/public/cpp/features.cc | 3
chromium-150.0.7871.124/services/network/public/cpp/features.h | 5
chromium-150.0.7871.124/services/network/public/cpp/simple_url_loader.cc | 41
chromium-150.0.7871.124/services/network/public/cpp/simple_url_loader.h | 25
chromium-150.0.7871.124/skia/ext/skia_commit_hash.h | 2
chromium-150.0.7871.124/third_party/angle/src/libANGLE/renderer/vulkan/ContextVk.cpp | 1
chromium-150.0.7871.124/third_party/angle/src/libANGLE/renderer/vulkan/VertexArrayVk.cpp | 23
chromium-150.0.7871.124/third_party/angle/src/libANGLE/renderer/vulkan/VertexArrayVk.h | 2
chromium-150.0.7871.124/third_party/angle/src/tests/gl_tests/VertexAttributeTest.cpp | 178
chromium-150.0.7871.124/third_party/blink/renderer/core/dom/element.cc | 13
chromium-150.0.7871.124/third_party/blink/renderer/core/dom/element.h | 2
chromium-150.0.7871.124/third_party/blink/renderer/core/html/forms/html_input_element.cc | 1
chromium-150.0.7871.124/third_party/blink/renderer/core/html/forms/html_select_element.cc | 1
chromium-150.0.7871.124/third_party/blink/renderer/core/html/forms/html_text_area_element.cc | 1
chromium-150.0.7871.124/third_party/blink/renderer/core/layout/block_layout_algorithm.cc | 3
chromium-150.0.7871.124/third_party/blink/renderer/platform/peerconnection/rtc_video_decoder_factory.cc | 6
chromium-150.0.7871.124/third_party/blink/renderer/platform/peerconnection/rtc_video_decoder_factory_test.cc | 28
chromium-150.0.7871.124/third_party/blink/renderer/platform/runtime_enabled_features.json5 | 3
chromium-150.0.7871.124/third_party/libyuv/GEMINI.md | 44
chromium-150.0.7871.124/third_party/libyuv/README.chromium | 2
chromium-150.0.7871.124/third_party/libyuv/include/libyuv/cpu_id.h | 1
chromium-150.0.7871.124/third_party/libyuv/include/libyuv/row.h | 535
chromium-150.0.7871.124/third_party/libyuv/include/libyuv/row_sve.h | 12
chromium-150.0.7871.124/third_party/libyuv/include/libyuv/version.h | 2
chromium-150.0.7871.124/third_party/libyuv/libyuv.gypi | 2
chromium-150.0.7871.124/third_party/libyuv/source/compare_neon64.cc | 2
chromium-150.0.7871.124/third_party/libyuv/source/compare_win.cc | 20
chromium-150.0.7871.124/third_party/libyuv/source/convert.cc | 595
chromium-150.0.7871.124/third_party/libyuv/source/convert_argb.cc | 420
chromium-150.0.7871.124/third_party/libyuv/source/convert_from.cc | 55
chromium-150.0.7871.124/third_party/libyuv/source/convert_from_argb.cc | 372
chromium-150.0.7871.124/third_party/libyuv/source/convert_to_argb.cc | 223
chromium-150.0.7871.124/third_party/libyuv/source/convert_to_i420.cc | 26
chromium-150.0.7871.124/third_party/libyuv/source/cpu_id.cc | 7
chromium-150.0.7871.124/third_party/libyuv/source/planar_functions.cc | 408
chromium-150.0.7871.124/third_party/libyuv/source/rotate.cc | 97
chromium-150.0.7871.124/third_party/libyuv/source/rotate_argb.cc | 7
chromium-150.0.7871.124/third_party/libyuv/source/rotate_win.cc | 12
chromium-150.0.7871.124/third_party/libyuv/source/row_any.cc | 154
chromium-150.0.7871.124/third_party/libyuv/source/row_common.cc | 339
chromium-150.0.7871.124/third_party/libyuv/source/row_gcc.cc | 1621
chromium-150.0.7871.124/third_party/libyuv/source/row_lasx.cc | 62
chromium-150.0.7871.124/third_party/libyuv/source/row_lsx.cc | 63
chromium-150.0.7871.124/third_party/libyuv/source/row_neon.cc | 67
chromium-150.0.7871.124/third_party/libyuv/source/row_neon64.cc | 335
chromium-150.0.7871.124/third_party/libyuv/source/row_rvv.cc | 36
chromium-150.0.7871.124/third_party/libyuv/source/row_sme.cc | 7
chromium-150.0.7871.124/third_party/libyuv/source/row_sve.cc | 7
chromium-150.0.7871.124/third_party/libyuv/source/row_win.cc | 372
chromium-150.0.7871.124/third_party/libyuv/source/scale.cc | 107
chromium-150.0.7871.124/third_party/libyuv/source/scale_argb.cc | 20
chromium-150.0.7871.124/third_party/libyuv/source/scale_common.cc | 10
chromium-150.0.7871.124/third_party/libyuv/source/scale_gcc.cc | 62
chromium-150.0.7871.124/third_party/libyuv/source/scale_rgb.cc | 6
chromium-150.0.7871.124/third_party/libyuv/source/scale_uv.cc | 39
chromium-150.0.7871.124/third_party/libyuv/source/scale_win.cc | 20
chromium-150.0.7871.124/third_party/libyuv/unit_test/color_test.cc | 3
chromium-150.0.7871.124/third_party/libyuv/unit_test/convert_argb_test.cc | 373
chromium-150.0.7871.124/third_party/libyuv/unit_test/convert_test.cc | 266
chromium-150.0.7871.124/third_party/libyuv/unit_test/cpu_test.cc | 2
chromium-150.0.7871.124/third_party/libyuv/unit_test/planar_test.cc | 10
chromium-150.0.7871.124/third_party/libyuv/unit_test/rotate_test.cc | 14
chromium-150.0.7871.124/third_party/libyuv/unit_test/scale_argb_test.cc | 26
chromium-150.0.7871.124/third_party/libyuv/unit_test/scale_test.cc | 4
chromium-150.0.7871.124/third_party/libyuv/unit_test/unit_test.h | 5
chromium-150.0.7871.124/third_party/libyuv/util/cpuid.c | 35
chromium-150.0.7871.124/third_party/libyuv/util/ssim.cc | 34
chromium-150.0.7871.124/third_party/skia/src/gpu/ganesh/GrAttachment.h | 11
chromium-150.0.7871.124/third_party/skia/src/gpu/ganesh/GrCaps.cpp | 7
chromium-150.0.7871.124/third_party/skia/src/gpu/ganesh/GrCaps.h | 16
chromium-150.0.7871.124/third_party/skia/src/gpu/ganesh/gl/GrGLCaps.cpp | 13
chromium-150.0.7871.124/third_party/skia/src/gpu/ganesh/ops/OpsTask.cpp | 64
chromium-150.0.7871.124/third_party/skia/src/gpu/ganesh/vk/GrVkCaps.cpp | 15
chromium-150.0.7871.124/third_party/skia/src/text/gpu/SubRunAllocator.h | 67
chromium-150.0.7871.124/tools/binary_size/trybot_commit_size_checker.py | 4
chromium-150.0.7871.124/tools/metrics/histograms/enums.xml | 2
chromium-150.0.7871.124/tools/metrics/histograms/metadata/accessibility/histograms.xml | 95
chromium-150.0.7871.124/tools/metrics/histograms/metadata/enterprise/histograms.xml | 33
chromium-150.0.7871.124/tools/metrics/histograms/metadata/glic/histograms.xml | 34
chromium-150.0.7871.124/ui/base/ui_base_features.cc | 2
chromium-150.0.7871.124/ui/base/x/x11_drag_drop_client.cc | 12
chromium-150.0.7871.124/ui/base/x/x11_drag_drop_client.h | 3
chromium-150.0.7871.124/ui/gtk/BUILD.gn | 42
chromium-150.0.7871.124/ui/gtk/gtk.sigs | 1
chromium-150.0.7871.124/ui/gtk/gtk_compat.h | 5
chromium-150.0.7871.124/ui/gtk/gtk_ui.cc | 73
chromium-150.0.7871.124/ui/gtk/gtk_ui.h | 10
chromium-150.0.7871.124/ui/gtk/gtk_util.cc | 92
chromium-150.0.7871.124/ui/gtk/gtk_util.h | 27
chromium-150.0.7871.124/ui/gtk/gtk_util_unittest.cc | 93
chromium-150.0.7871.124/ui/gtk/run_all_unittests.cc | 27
chromium-150.0.7871.124/ui/ozone/platform/wayland/host/wayland_bubble.cc | 15
chromium-150.0.7871.124/ui/ozone/platform/wayland/host/wayland_data_drag_controller_unittest.cc | 32
chromium-150.0.7871.124/ui/ozone/platform/wayland/host/wayland_frame_manager.cc | 4
chromium-150.0.7871.124/ui/ozone/platform/wayland/host/wayland_popup.cc | 20
chromium-150.0.7871.124/ui/ozone/platform/wayland/host/wayland_toplevel_window.cc | 12
chromium-150.0.7871.124/ui/ozone/platform/wayland/host/wayland_window.cc | 15
chromium-150.0.7871.124/ui/ozone/platform/wayland/host/wayland_window_unittest.cc | 96
chromium-150.0.7871.124/ui/ozone/platform/x11/test/x11_drag_drop_client_unittest.cc | 98
chromium-150.0.7871.124/ui/ozone/platform/x11/x11_window.cc | 21
chromium-150.0.7871.124/v8/include/v8-version.h | 2
chromium-150.0.7871.124/v8/src/builtins/builtins-regexp-gen.cc | 3
chromium-150.0.7871.124/v8/src/compiler/backend/arm/instruction-selector-arm.cc | 11
chromium-150.0.7871.124/v8/src/compiler/backend/arm64/instruction-selector-arm64.cc | 7
chromium-150.0.7871.124/v8/src/execution/messages.cc | 10
chromium-150.0.7871.124/v8/src/objects/lookup-inl.h | 18
chromium-150.0.7871.124/v8/src/objects/lookup.h | 7
chromium-150.0.7871.124/v8/src/sandbox/cppheap-pointer-table.cc | 6
chromium-150.0.7871.124/v8/src/sandbox/external-pointer-table.cc | 6
chromium-150.0.7871.124/v8/tools/builtins-pgo/profiles/meta.json | 2
chromium-150.0.7871.124/v8/tools/builtins-pgo/profiles/x64-rl.profile |28353 +++----
chromium-150.0.7871.124/v8/tools/builtins-pgo/profiles/x64.profile |37219 ++++------
chromium-150.0.7871.124/v8/tools/builtins-pgo/profiles/x86-rl.profile |26143 +++----
chromium-150.0.7871.124/v8/tools/builtins-pgo/profiles/x86.profile |26254 +++----
269 files changed, 66722 insertions(+), 62602 deletions(-)
dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmp49i7wkxt/chromium_150.0.7871.114-1~deb13u1.dsc: no acceptable signature found
dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmp49i7wkxt/chromium_150.0.7871.124-1~deb13u1.dsc: no acceptable signature found
diff -Nru chromium-150.0.7871.114/BUILD.gn chromium-150.0.7871.124/BUILD.gn
--- chromium-150.0.7871.114/BUILD.gn 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/BUILD.gn 2026-07-13 21:36:30.000000000 +0000
@@ -15,6 +15,7 @@
import("//build/config/cronet/config.gni")
import("//build/config/dcheck_always_on.gni")
import("//build/config/features.gni")
+import("//build/config/linux/gtk/gtk.gni")
import("//build/config/rust.gni")
import("//build/config/sanitizers/sanitizers.gni")
import("//build/config/ui.gni")
@@ -320,6 +321,10 @@
]
}
+ if (use_gtk) {
+ deps += [ "//ui/gtk:gtk_unittests" ]
+ }
+
if (enterprise_watermark) {
deps += [ "//chrome/browser/enterprise/watermark:watermark_app" ]
}
diff -Nru chromium-150.0.7871.114/DEPS chromium-150.0.7871.124/DEPS
--- chromium-150.0.7871.114/DEPS 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/DEPS 2026-07-13 21:36:30.000000000 +0000
@@ -327,15 +327,15 @@
# Three lines of non-changing comments so that
# the commit queue can handle CLs rolling Skia
# and whatever else without interference from each other.
- 'skia_revision': '14d05ec761901b6e9e9193af8b347ab3a7f6fed0',
+ 'skia_revision': 'bee4c917220040e147f14964635ff92ce6c5a3f6',
# Three lines of non-changing comments so that
# the commit queue can handle CLs rolling V8
# and whatever else without interference from each other.
- 'v8_revision': 'ce0af5c0d181678bcda077c68d4beaec2854ad16',
+ 'v8_revision': '209c9cea0db17d8caf23e9d2c7de08c351609744',
# Three lines of non-changing comments so that
# the commit queue can handle CLs rolling ANGLE
# and whatever else without interference from each other.
- 'angle_revision': '8d3c5a8caebd836b99fa32062951a401910eba33',
+ 'angle_revision': '13e691adf3d4d3ebee2f7239731a07d3b9704956',
# Three lines of non-changing comments so that
# the commit queue can handle CLs rolling SwiftShader
# and whatever else without interference from each other.
@@ -2527,7 +2527,7 @@
Var('chromium_git') + '/webm/libwebp.git' + '@' + 'c00d83f6642e7838a12bb03bca94237f03cc2e00',
'src/third_party/libyuv':
- Var('chromium_git') + '/libyuv/libyuv.git' + '@' + '3c5fa6ef272f6077d76816ee3d6a697ef1d6d272',
+ Var('chromium_git') + '/libyuv/libyuv.git' + '@' + '8aeb3a9ca36341a640528e59b34b5d641080dca8',
'src/third_party/lss': {
'url': Var('chromium_git') + '/linux-syscall-support.git' + '@' + Var('lss_revision'),
@@ -3855,7 +3855,7 @@
'src/components/optimization_guide/internal': {
'url': Var('chrome_git') + '/chrome/components/optimization_guide.git' + '@' +
- '233b29133fa60b54aff6a5d5c28bca4dd64313e2',
+ 'f98bf054c58820c81cf4e4a6dda3112097c19574',
'condition': 'checkout_src_internal',
},
diff -Nru chromium-150.0.7871.114/ash/strings/ash_strings_cs.xtb chromium-150.0.7871.124/ash/strings/ash_strings_cs.xtb
--- chromium-150.0.7871.114/ash/strings/ash_strings_cs.xtb 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/ash/strings/ash_strings_cs.xtb 2026-07-13 21:36:30.000000000 +0000
@@ -1935,7 +1935,7 @@
Uvolněte místo na disku nebo v Nastavení přidělte víc místa pro disk s Linuxem
Soubor nelze stáhnout
Nepodařilo se vytvořit kontakt
-Lupa celé obrazovky
+Zvětšení obrazovky
Počasí (není k dispozici)
Zařízení USB Type-C (pravý port)
Autorizace se nezdařila
diff -Nru chromium-150.0.7871.114/ash/strings/ash_strings_es.xtb chromium-150.0.7871.124/ash/strings/ash_strings_es.xtb
--- chromium-150.0.7871.114/ash/strings/ash_strings_es.xtb 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/ash/strings/ash_strings_es.xtb 2026-07-13 21:36:30.000000000 +0000
@@ -500,7 +500,7 @@
Se ha producido un error.
Apaga Windows para desinstalar .
Instalar aplicación
-Ve a Ajustes
+Ir a Ajustes
Pulsa para cambiar el diseño del teclado.
Desinstalar
Vista previa de . Escritorio activo.
@@ -1626,7 +1626,7 @@
Esto permite que accedan y todas las aplicaciones y sitios web con los permisos de cámara y micrófono. Es posible que tengas que actualizar la página web o reiniciar la aplicación.
LTE+
No se ha podido verificar tu contraseña. Inténtalo de nuevo.
-Muéstrame cómo
+Ver cómo
Conector jack para micrófono
solicita tu atención.
La extensión externa requiere que esté instalada la versión o una versión posterior de Chrome.
diff -Nru chromium-150.0.7871.114/ash/strings/ash_strings_fa.xtb chromium-150.0.7871.124/ash/strings/ash_strings_fa.xtb
--- chromium-150.0.7871.114/ash/strings/ash_strings_fa.xtb 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/ash/strings/ash_strings_fa.xtb 2026-07-13 21:36:30.000000000 +0000
@@ -1895,7 +1895,7 @@
صفحه لمسی داخلی روشن است
بلوتوث روشن است
سنجاق کردن پنجره به راست
-پذیرش و ادامه
+پذیرفتن و ادامه
برای باز کردن قفل دستگاه، پین را وارد کنید.
{0,plural, =1{تا یک ساعت دیگر دستگاه را به نسخه قبلی بهروزرسانی کنید}one{تا # ساعت دیگر دستگاه را به نسخه قبلی بهروزرسانی کنید}other{تا # ساعت دیگر دستگاه را به نسخه قبلی بهروزرسانی کنید}}
به اینترنت متصل شوید و دوباره امتحان کنید
diff -Nru chromium-150.0.7871.114/ash/strings/ash_strings_fr.xtb chromium-150.0.7871.124/ash/strings/ash_strings_fr.xtb
--- chromium-150.0.7871.114/ash/strings/ash_strings_fr.xtb 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/ash/strings/ash_strings_fr.xtb 2026-07-13 21:36:30.000000000 +0000
@@ -1626,7 +1626,7 @@
L'accès est accordé à , ainsi qu'à l'ensemble des applis et sites Web ayant l'autorisation d'accéder à l'appareil photo et au micro. Vous devrez peut-être actualiser la page Web ou redémarrer l'appli.
LTE+
Impossible de valider votre mot de passe. Réessayez.
-Démonstration
+Voir comment faire
Connecteur micro
requiert votre attention.
L'extension externe nécessite que la version ou une version ultérieure de Chrome soit installée.
diff -Nru chromium-150.0.7871.114/ash/strings/ash_strings_ja.xtb chromium-150.0.7871.124/ash/strings/ash_strings_ja.xtb
--- chromium-150.0.7871.114/ash/strings/ash_strings_ja.xtb 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/ash/strings/ash_strings_ja.xtb 2026-07-13 21:36:30.000000000 +0000
@@ -898,7 +898,7 @@
検索+H
オフ
デスク が作成されました
-ブライユ点字ディスプレイが接続されています。
+点字ディスプレイが接続されています。
デザイン効果の設定
モバイルデータ通信を有効にすると、Bluetooth も有効になります
音声
diff -Nru chromium-150.0.7871.114/base/win/win_util.cc chromium-150.0.7871.124/base/win/win_util.cc
--- chromium-150.0.7871.114/base/win/win_util.cc 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/base/win/win_util.cc 2026-07-13 21:36:30.000000000 +0000
@@ -92,6 +92,18 @@
using QueryKeyFunction =
ScopedDeviceConvertibilityStateForTesting::QueryFunction;
+DSREG_JOIN_TYPE ToDSREGJoinType(
+ ScopedAzureADJoinStateForTesting::AzureADJoinType join_type) {
+ switch (join_type) {
+ case ScopedAzureADJoinStateForTesting::AzureADJoinType::kUnknown:
+ return DSREG_UNKNOWN_JOIN;
+ case ScopedAzureADJoinStateForTesting::AzureADJoinType::kDevice:
+ return DSREG_DEVICE_JOIN;
+ case ScopedAzureADJoinStateForTesting::AzureADJoinType::kWorkplace:
+ return DSREG_WORKPLACE_JOIN;
+ }
+}
+
// Sets the value of |property_key| to |property_value| in |property_store|.
bool SetPropVariantValueForPropertyStore(
IPropertyStore* property_store,
@@ -190,9 +202,8 @@
return &state;
}
-// TODO (crbug/1300219): return a DSREG_JOIN_TYPE* instead of bool*.
-bool* GetAzureADJoinStateStorage() {
- static bool state = [] {
+std::optional& GetAzureADJoinStateStorage() {
+ static std::optional state = [] {
base::ElapsedTimer timer;
// Mitigate the issues caused by loading DLLs on a background thread
@@ -202,14 +213,14 @@
ScopedNativeLibrary netapi32(
base::LoadSystemLibrary(FILE_PATH_LITERAL("netapi32.dll")));
if (!netapi32.is_valid()) {
- return false;
+ return std::optional(std::nullopt);
}
const auto net_get_aad_join_information_function =
reinterpret_cast(
netapi32.GetFunctionPointer("NetGetAadJoinInformation"));
if (!net_get_aad_join_information_function) {
- return false;
+ return std::optional(std::nullopt);
}
const auto net_free_aad_join_information_function =
@@ -220,16 +231,19 @@
DSREG_JOIN_INFO* join_info = nullptr;
HRESULT hr = net_get_aad_join_information_function(/*pcszTenantId=*/nullptr,
&join_info);
- const bool is_aad_joined = SUCCEEDED(hr) && join_info;
+ std::optional join_type = std::nullopt;
+ if (SUCCEEDED(hr) && join_info) {
+ join_type = join_info->joinType;
+ }
if (join_info) {
net_free_aad_join_information_function(join_info);
}
base::UmaHistogramTimes("EnterpriseCheck.AzureADJoinStatusCheckTime",
timer.Elapsed());
- return is_aad_joined;
+ return join_type;
}();
- return &state;
+ return state;
}
NativeLibrary PinUser32Internal(NativeLibraryLoadError* error) {
@@ -933,7 +947,13 @@
}
bool IsJoinedToAzureAD() {
- return *GetAzureADJoinStateStorage();
+ auto join_type = GetAzureADJoinStateStorage();
+ return join_type.has_value();
+}
+
+bool IsDeviceJoinedToAzureAD() {
+ const auto& join_type = GetAzureADJoinStateStorage();
+ return join_type && *join_type == DSREG_DEVICE_JOIN;
}
bool IsUser32AndGdi32Available() {
@@ -1286,11 +1306,35 @@
*GetRegisteredWithManagementStateStorage() = initial_state_;
}
-ScopedAzureADJoinStateForTesting::ScopedAzureADJoinStateForTesting(bool state)
- : initial_state_(std::exchange(*GetAzureADJoinStateStorage(), state)) {}
+ScopedAzureADJoinStateForTesting::ScopedAzureADJoinStateForTesting(
+ std::optional state)
+ : initial_state_([&] {
+ const auto& storage = GetAzureADJoinStateStorage();
+ if (!storage.has_value()) {
+ return std::optional(std::nullopt);
+ }
+ switch (*storage) {
+ case DSREG_UNKNOWN_JOIN:
+ return std::optional(AzureADJoinType::kUnknown);
+ case DSREG_DEVICE_JOIN:
+ return std::optional(AzureADJoinType::kDevice);
+ case DSREG_WORKPLACE_JOIN:
+ return std::optional(AzureADJoinType::kWorkplace);
+ }
+ }()) {
+ if (state.has_value()) {
+ GetAzureADJoinStateStorage() = ToDSREGJoinType(*state);
+ } else {
+ GetAzureADJoinStateStorage() = std::nullopt;
+ }
+}
ScopedAzureADJoinStateForTesting::~ScopedAzureADJoinStateForTesting() {
- *GetAzureADJoinStateStorage() = initial_state_;
+ if (initial_state_.has_value()) {
+ GetAzureADJoinStateStorage() = ToDSREGJoinType(*initial_state_);
+ } else {
+ GetAzureADJoinStateStorage() = std::nullopt;
+ }
}
ScopedDeviceConvertibilityStateForTesting::
diff -Nru chromium-150.0.7871.114/base/win/win_util.h chromium-150.0.7871.124/base/win/win_util.h
--- chromium-150.0.7871.114/base/win/win_util.h 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/base/win/win_util.h 2026-07-13 21:36:30.000000000 +0000
@@ -209,9 +209,16 @@
// Returns true if either the device is joined to Azure Active Directory (AD) or
// one or more Azure AD work accounts have been added on the device. This call
-// trigger some I/O when loading netapi32.dll to determine the management state.
+// triggers some I/O when loading netapi32.dll to determine the management
+// state.
BASE_EXPORT bool IsJoinedToAzureAD();
+// Returns true only if the device is joined to Azure Active Directory (AD).
+// Unlike IsJoinedToAzureAD(), this does not return true if there are only Azure
+// AD work accounts added. This call triggers some I/O when loading
+// netapi32.dll to determine the management state.
+BASE_EXPORT bool IsDeviceJoinedToAzureAD();
+
// Returns true if the machine is being managed by an MDM system.
BASE_EXPORT bool IsDeviceRegisteredWithManagement();
@@ -423,7 +430,14 @@
// object. The original state is restored upon destruction.
class BASE_EXPORT ScopedAzureADJoinStateForTesting {
public:
- explicit ScopedAzureADJoinStateForTesting(bool state);
+ enum class AzureADJoinType {
+ kUnknown,
+ kDevice,
+ kWorkplace,
+ };
+
+ explicit ScopedAzureADJoinStateForTesting(
+ std::optional state);
ScopedAzureADJoinStateForTesting(const ScopedAzureADJoinStateForTesting&) =
delete;
ScopedAzureADJoinStateForTesting& operator=(
@@ -431,13 +445,13 @@
~ScopedAzureADJoinStateForTesting();
private:
- const bool initial_state_;
+ const std::optional initial_state_;
};
// Allows changing the return values of convertibility functions for the
// lifetime of the object. The original state is restored upon destruction.
-class BASE_EXPORT
- [[maybe_unused, nodiscard]] ScopedDeviceConvertibilityStateForTesting {
+class BASE_EXPORT [[maybe_unused, nodiscard]]
+ScopedDeviceConvertibilityStateForTesting {
public:
using QueryFunction = bool (*)();
ScopedDeviceConvertibilityStateForTesting(
diff -Nru chromium-150.0.7871.114/build/util/LASTCHANGE chromium-150.0.7871.124/build/util/LASTCHANGE
--- chromium-150.0.7871.114/build/util/LASTCHANGE 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/build/util/LASTCHANGE 2026-07-13 21:36:30.000000000 +0000
@@ -1,2 +1,2 @@
-LASTCHANGE=f405107495a07cb1bfcf687d4af8d91117098db6-refs/branch-heads/7871@{#2955}
+LASTCHANGE=9261fd0a595ac4964ea84e6bd4a025c1173a2ffa-refs/branch-heads/7871@{#3359}
LASTCHANGE_YEAR=2026
diff -Nru chromium-150.0.7871.114/build/util/LASTCHANGE.committime chromium-150.0.7871.124/build/util/LASTCHANGE.committime
--- chromium-150.0.7871.114/build/util/LASTCHANGE.committime 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/build/util/LASTCHANGE.committime 2026-07-13 21:36:30.000000000 +0000
@@ -1 +1 @@
-1783446230
\ No newline at end of file
+1783978590
\ No newline at end of file
diff -Nru chromium-150.0.7871.114/chrome/VERSION chromium-150.0.7871.124/chrome/VERSION
--- chromium-150.0.7871.114/chrome/VERSION 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/VERSION 2026-07-13 21:36:30.000000000 +0000
@@ -1,4 +1,4 @@
MAJOR=150
MINOR=0
BUILD=7871
-PATCH=114
+PATCH=124
diff -Nru chromium-150.0.7871.114/chrome/app/generated_resources.grd chromium-150.0.7871.124/chrome/app/generated_resources.grd
--- chromium-150.0.7871.114/chrome/app/generated_resources.grd 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/app/generated_resources.grd 2026-07-13 21:36:30.000000000 +0000
@@ -8732,6 +8732,12 @@
Write, plan, code, and more
+
+ Do more with AI Mode
+
+
+ Create, plan, summarize
+
Disable suggestions
diff -Nru chromium-150.0.7871.114/chrome/app/resources/chromium_strings_fa.xtb chromium-150.0.7871.124/chrome/app/resources/chromium_strings_fa.xtb
--- chromium-150.0.7871.114/chrome/app/resources/chromium_strings_fa.xtb 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/app/resources/chromium_strings_fa.xtb 2026-07-13 21:36:30.000000000 +0000
@@ -381,7 +381,7 @@
هنگام مرور «درحالت ناشناس»، Chromium قبلاز اینکه سایت را ازطریق اتصال ناامن بار کند به شما هشدار میدهد
سرویس داخلی بهروزرسان Chromium
جستجویتان را با افزودن چند زبانه، فایل، و ابزار عمیقتر کنید
-با «Gemini در Chromium»، خلاصه سریعی از این سند دریافت کنید و سؤال بپرسید
+با «Gemini در Chromium»، مروری کوتاه از این سند دریافت کنید و سؤال بپرسید
Chromium چند توصیه ایمنی برای بررسی پیدا کرد
دیگر نمایههای Chromium
ChromiumOS نتوانست دادههای Chromium را در «حساب Google» شما ذخیره کند زیرا جزئیات ورود به سیستم حسابتان بهروز نیست
diff -Nru chromium-150.0.7871.114/chrome/app/resources/generated_resources_ca.xtb chromium-150.0.7871.124/chrome/app/resources/generated_resources_ca.xtb
--- chromium-150.0.7871.114/chrome/app/resources/generated_resources_ca.xtb 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/app/resources/generated_resources_ca.xtb 2026-07-13 21:36:30.000000000 +0000
@@ -11289,7 +11289,7 @@
Imatges
És possible que revisors humans vegin les dades enviades a Google per millorar la tecnologia de la IA de Chrome
Les dades de navegació s'han suprimit automàticament
-Gemini Spark tindrà accés als mateixos llocs web que tu, inclosos els llocs web en què tens la sessió iniciada. Compartirà la informació necessària amb tercers, que podria incloure informació personal que et sembli sensible.
+Gemini Spark tindrà accés als mateixos llocs web que tu, inclosos els llocs web en què tinguis la sessió iniciada. Compartirà la informació necessària amb tercers, la qual podria incloure informació personal que podries considerar sensible.
Suprimir el compte
penja un fitxer
Aixeca el dit i torna-ho a provar.
diff -Nru chromium-150.0.7871.114/chrome/app/resources/generated_resources_cs.xtb chromium-150.0.7871.124/chrome/app/resources/generated_resources_cs.xtb
--- chromium-150.0.7871.114/chrome/app/resources/generated_resources_cs.xtb 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/app/resources/generated_resources_cs.xtb 2026-07-13 21:36:30.000000000 +0000
@@ -7500,7 +7500,7 @@
Aktualizační operace se nezdařila
Sdílejte soubory a další obsah se zařízeními v okolí. Další informace
Povolit prostředí přístup k mikrofonu
-Lupa celé obrazovky
+Zvětšení obrazovky
Otevřít stažený soubor
{NUM_GROUPS,plural, =1{Zachovat skupinu karet?}few{Zachovat skupiny karet?}many{Zachovat skupiny karet?}other{Zachovat skupiny karet?}}
Ke správě přístupových klíčů použijte novější verzi systému Windows
diff -Nru chromium-150.0.7871.114/chrome/app/resources/generated_resources_en-GB.xtb chromium-150.0.7871.124/chrome/app/resources/generated_resources_en-GB.xtb
--- chromium-150.0.7871.114/chrome/app/resources/generated_resources_en-GB.xtb 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/app/resources/generated_resources_en-GB.xtb 2026-07-13 21:36:30.000000000 +0000
@@ -948,7 +948,7 @@
Are you sure that you want to exit?
Text-to-speech voice settings
Try now
-New Incognito window
+New Incognito Window
Big mouse cursor
Turn on Caret Browsing?
Enable glide typing
@@ -1558,7 +1558,7 @@
New tab to the right
You won't see tab groups on this page again
Welcome,
-Pin tab
+Pin Tab
Open &File...
Reload &Frame
No SIM card inserted
@@ -2774,7 +2774,7 @@
Chrome with this Google Account
Firmware
&Redo
-Mute site
+Mute Site
A URL is required
Join and open
Tools and actions
@@ -2830,7 +2830,7 @@
Stacked
No usage data
These apps will be used to record your screen:
-Duplicate tab
+Duplicate Tab
Cheesecake
Reset permissions
Read comfortably with minimal distractions
@@ -3885,7 +3885,7 @@
Ice-cream
This setting is disabled because parental controls are on
Video Files
-Show tabs vertically
+Show Tabs Vertically
You'll be signed out of this site, including in open tabs
I have read and agree to the Google Terms of Service and Chrome and Chrome OS additional Terms of Service.
Serial number
@@ -4646,7 +4646,7 @@
No internet connection
ctrl
Show in finder
-Close other tabs
+Close Other Tabs
File incomplete
Storage and power
Your parent's choices won't apply once you sign out
@@ -4896,7 +4896,7 @@
Limited types of data are shared between sites to measure the performance of their ads, such as whether you made a purchase after visiting a site
Failed to send feedback. Retrying…
To stop others from using your password, change it on
-&Delete browsing data…
+&Delete Browsing Data…
Predictive writing
Feedback
Your organisation limits what you can save
@@ -8991,7 +8991,7 @@
Try the following tips:
Enter your password
Your administrator doesn't allow this language
-New tab
+New Tab
Recent chats and threads
Unfortunately, is unable to recover your settings. To fix the error, must reset your device with Powerwash.
Linux port forwarding
@@ -10095,7 +10095,7 @@
Display and text size
To open this link, choose an app
More actions for
-Show search shortcuts
+Show Search Shortcuts
Did not try
Web app installs aren't supported in Incognito mode
Select a collection
@@ -10719,7 +10719,7 @@
View site details for from the list
While the hotspot is on, your will:
Instead of entering your Google Account password to sign in, you can create a PIN for this
-New window
+New Window
Never translate this site
Default
Site not working?
@@ -11314,7 +11314,7 @@
Lift then try again.
Customise Chrome
Duration:
-Show all
+Show All
{NUM_EXTENSIONS,plural, =1{To manage it, open Extensions}other{To manage them, open Extensions}}
Manage languages in Chrome OS settings
This will delete of data stored by sites
diff -Nru chromium-150.0.7871.114/chrome/app/resources/generated_resources_es.xtb chromium-150.0.7871.124/chrome/app/resources/generated_resources_es.xtb
--- chromium-150.0.7871.114/chrome/app/resources/generated_resources_es.xtb 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/app/resources/generated_resources_es.xtb 2026-07-13 21:36:30.000000000 +0000
@@ -2070,7 +2070,7 @@
Como has configurado varios interruptores, se ha desactivado la búsqueda automática.
Permisos de archivos multimedia para ""
Habilitar el servicio de recuperación de datos.
-Ve a Ajustes
+Ir a Ajustes
Ajustes de accesibilidad del teclado
Modificar los datos que se copian y se pegan
El buscador actual gestiona tu página Nueva pestaña
diff -Nru chromium-150.0.7871.114/chrome/app/resources/generated_resources_eu.xtb chromium-150.0.7871.124/chrome/app/resources/generated_resources_eu.xtb
--- chromium-150.0.7871.114/chrome/app/resources/generated_resources_eu.xtb 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/app/resources/generated_resources_eu.xtb 2026-07-13 21:36:30.000000000 +0000
@@ -9982,7 +9982,7 @@
Inportatu
Deitu zure gailutik
Hustu cachea eta kargatu berriro cachea erabili gabe
- datan sortu zenuen sarbide-gako hau
+Data honetan sortu zenuen sarbide-gako hau:
JavaScript-en optimizazioa erabiltzeko baimenik ez dutenak
Erabili buruaren mugimenduak eta aurpegierak Chromebook-a kontrolatzeko. Lortu informazio gehiago
Webguneak zure hizkuntzetan
diff -Nru chromium-150.0.7871.114/chrome/app/resources/generated_resources_fa.xtb chromium-150.0.7871.124/chrome/app/resources/generated_resources_fa.xtb
--- chromium-150.0.7871.114/chrome/app/resources/generated_resources_fa.xtb 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/app/resources/generated_resources_fa.xtb 2026-07-13 21:36:30.000000000 +0000
@@ -7379,7 +7379,7 @@
باز کردن در شبکههای Wi-Fi
برای اطمینان از اینکه همیشه میتوانید از گذرواژههای ذخیرهشده در حسابتان () استفاده کنید، هویت خود را درستیسنجی کنید
نه، همچنان کار کردن در این نمایه
-پذیرش و ادامه
+پذیرفتن و ادامه
Gemini قادر نخواهد بود تکالیفی را که به ورود به سیستم در نیاز دارند انجام دهد.
حالت خواندن در این صفحه دردسترس نیست
پیوندهای پشتیبانیشده
diff -Nru chromium-150.0.7871.114/chrome/app/resources/generated_resources_fr.xtb chromium-150.0.7871.124/chrome/app/resources/generated_resources_fr.xtb
--- chromium-150.0.7871.114/chrome/app/resources/generated_resources_fr.xtb 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/app/resources/generated_resources_fr.xtb 2026-07-13 21:36:30.000000000 +0000
@@ -8351,7 +8351,7 @@
est géré par votre administrateur
Les notifications sont désactivées dans les réglages système Mac
Les sites demandent généralement à installer des applis Web pour améliorer votre expérience
-Poser une question à Google concernant cette page :
+Poser une question à Google sur cette page :
(non configuré)
Augmenter la luminosité
Ajouter des fichiers journaux Chrome dans l'archive.
@@ -9026,7 +9026,7 @@
Aucun onglet issu d'autres appareils
Gestion de l'impression
Vous pouvez désormais gérer vos groupes d'onglets, vos discussions Gemini et vos fils de discussion en Mode IA au même endroit. Vous pouvez retirer cet élément à tout moment.
-Poser une question à Google concernant cette page
+Poser une question à Google sur cette page
Les sites listés ci-dessous appliquent un paramètre personnalisé
{NUM_PASSWORDS,plural, =1{1 mot de passe non importé}one{{NUM_PASSWORDS} mot de passe non importé}other{{NUM_PASSWORDS} mots de passe non importés}}
Autoriser les applis Android à contrôler les périphériques USB sur ce Chromebook
diff -Nru chromium-150.0.7871.114/chrome/app/resources/generated_resources_hr.xtb chromium-150.0.7871.124/chrome/app/resources/generated_resources_hr.xtb
--- chromium-150.0.7871.114/chrome/app/resources/generated_resources_hr.xtb 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/app/resources/generated_resources_hr.xtb 2026-07-13 21:36:30.000000000 +0000
@@ -7293,7 +7293,7 @@
Uređivanje prečaca
Onemogući automatsko pokretanje
Promijenjena je veličina prozora pri dnu
-Ukloni iz programa Chrome
+Ukloni iz Chromea
Broj aktivnosti održavanja
Automatsko otkrivanje putem web-proxyja
Koristit ćete zaporku za na . Zaporku koristite samo ako smatrate da je pouzdana domena.
diff -Nru chromium-150.0.7871.114/chrome/app/resources/generated_resources_hu.xtb chromium-150.0.7871.124/chrome/app/resources/generated_resources_hu.xtb
--- chromium-150.0.7871.114/chrome/app/resources/generated_resources_hu.xtb 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/app/resources/generated_resources_hu.xtb 2026-07-13 21:36:30.000000000 +0000
@@ -110,7 +110,7 @@
Válasszon másik képernyőt
Navigációs billentyűparancs
Megnyitás másik böngészőben másodperc múlva
-Külön nézetek
+Nézetek szétválasztása
USB-eszköz észlelve
Eszközeit, szerkesztőit és IDE-jeit a vállalkozása által kezelt környezetben futtathatja eszközén. További információ
Az oldalakon szövegkurzorral navigálhat
@@ -6961,7 +6961,7 @@
Csoport konvertálása könyvjelzőmappává
A kép kivonata nincs beállítva
A Google-fiókjával jelentkezhet be Chromebookján
-Külön nézetek
+Nézetek szétválasztása
jelszó megerősítése
memória megtakarítva
Az illetéktelen kézbe került jelszavak előfordulásának ellenőrzéséhez jelentkezzen be Google-fiókjába
diff -Nru chromium-150.0.7871.114/chrome/app/resources/generated_resources_id.xtb chromium-150.0.7871.124/chrome/app/resources/generated_resources_id.xtb
--- chromium-150.0.7871.114/chrome/app/resources/generated_resources_id.xtb 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/app/resources/generated_resources_id.xtb 2026-07-13 21:36:30.000000000 +0000
@@ -10577,7 +10577,7 @@
Buka &Lokasi...
Untuk kembali ke layar sebelumnya, geser dari bagian samping kiri.
Menu aplikasi
-Masa berlaku
+Berlaku hingga
Konten dari halaman sandi dan info terkait dikirim ke Google dan ditinjau secara manual. Sandi Anda dienkripsi dan tidak akan dilihat oleh siapa pun.
Beri tahu kami alasan Anda mengizinkan cookie pihak ketiga di situs ini
peluncur + backspace
diff -Nru chromium-150.0.7871.114/chrome/app/resources/generated_resources_ne.xtb chromium-150.0.7871.124/chrome/app/resources/generated_resources_ne.xtb
--- chromium-150.0.7871.114/chrome/app/resources/generated_resources_ne.xtb 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/app/resources/generated_resources_ne.xtb 2026-07-13 21:36:30.000000000 +0000
@@ -11030,7 +11030,7 @@
भाइरस पत्ता लाग्यो
साइटहरूले सामान्यतया गेम वा हेड्स-अप निर्देशन जस्ता AR सुविधाहरू प्रदान गर्न तपाईंको क्यामेराको स्थिति ट्र्याक गर्छन्
पहिले नै यस कम्प्युटरमा यो खाता प्रयोग गर्दै हुनुहुन्छ।
-साइट तथा विज्ञापनदाताहरू उनीहरूका विज्ञापनहरूको पर्फर्मेन्स मापन गर्न सक्छन्
+साइट तथा विज्ञापनदाताहरू आफ्ना विज्ञापनहरूको पर्फर्मेन्स मापन गर्न सक्छन्
यस ट्याबमा पुस्तक चिन्ह लगाउनुहोस्...
डिभाइसको क्यामेरा प्रयोग गरी QR कोड स्क्यान गर्नुहोस् वा आफ्नो सेवा प्रदायकले उपलब्ध गराएको एक्टिभेसन कोड हाल्नुहोस्।
चिचेन इट्जा
diff -Nru chromium-150.0.7871.114/chrome/app/resources/generated_resources_sw.xtb chromium-150.0.7871.124/chrome/app/resources/generated_resources_sw.xtb
--- chromium-150.0.7871.114/chrome/app/resources/generated_resources_sw.xtb 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/app/resources/generated_resources_sw.xtb 2026-07-13 21:36:30.000000000 +0000
@@ -10114,7 +10114,7 @@
Tayari umesajili kifaa hiki. Huhitaji kukisajili tena.
Tovuti zisizotambuliwa
Rejesha kurasa?
-Iulize Google
+Uliza Google
Hifadhi kwenye Akaunti yako ya Google
Weka mapendeleo ya mandhari ya skrini yako
Kitufe cha Tuma maoni
diff -Nru chromium-150.0.7871.114/chrome/app/resources/google_chrome_strings_fa.xtb chromium-150.0.7871.124/chrome/app/resources/google_chrome_strings_fa.xtb
--- chromium-150.0.7871.114/chrome/app/resources/google_chrome_strings_fa.xtb 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/app/resources/google_chrome_strings_fa.xtb 2026-07-13 21:36:30.000000000 +0000
@@ -150,7 +150,7 @@
نمیتوان همان نسخه Google Chrome را که اکنون در حال اجراست نصب کرد. لطفاً Google Chrome را ببندید و دوباره سعی کنید.
این کار دادههای محصول مرورتان را برای همیشه از این دستگاه حذف میکند. برای بازیابی دادههایتان در فرصتی دیگر، با وارد سیستم Chrome شوید.
نصبکننده بارگیریشده در حافظه نهان ذخیره نشد. خطا: .
-با «Gemini در Chrome»، خلاصه سریعی از این سند دریافت کنید و سؤال بپرسید
+با «Gemini در Chrome»، مروری کوتاه از این سند دریافت کنید و سؤال بپرسید
سیستم
گذرواژهها، نشانکها، و سابقه را در همه دستگاهها کاملاً همگامسازی کنید. با بهروز کردن مرورگر پیشفرض به Chrome، بهراحتی به ویژگیهایی که میشناسید و دوست دارید دسترسی پیدا کنید. Chrome برای دسترسی سریع به نوار وظیفه سنجاق خواهد شد.
ChromeOS
diff -Nru chromium-150.0.7871.114/chrome/app/resources/google_chrome_strings_fr.xtb chromium-150.0.7871.124/chrome/app/resources/google_chrome_strings_fr.xtb
--- chromium-150.0.7871.114/chrome/app/resources/google_chrome_strings_fr.xtb 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/app/resources/google_chrome_strings_fr.xtb 2026-07-13 21:36:30.000000000 +0000
@@ -639,7 +639,7 @@
Désactivée • Chrome ne peut pas vérifier d'où vient cette extension
Programme d'installation de
Vous pouvez utiliser Chrome chaque fois que vous cliquez sur des liens dans des messages, des documents et d'autres applis
-Poser une question à Google concernant cette page
+Poser une question à Google sur cette page
Une application qui risque de modifier le fonctionnement de Chrome a été ajoutée via un autre programme sur votre ordinateur
diff -Nru chromium-150.0.7871.114/chrome/app/resources/google_chrome_strings_hr.xtb chromium-150.0.7871.124/chrome/app/resources/google_chrome_strings_hr.xtb
--- chromium-150.0.7871.114/chrome/app/resources/google_chrome_strings_hr.xtb 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/app/resources/google_chrome_strings_hr.xtb 2026-07-13 21:36:30.000000000 +0000
@@ -511,7 +511,7 @@
Chrome se ne može pokrenuti zbog pogreške prilikom otvaranja vašeg profila. Pokušajte ponovo pokrenuti Chrome.
Chrome treba dopuštenje za mapiranje vaše okoline i praćenje vaših ruku
Proširenje traži da se prijavite u Chrome
-Ukloni iz programa Chrome
+Ukloni iz Chromea
Postavite Google Chrome kao zadani preglednik i prikvačite ga na traku sa zadacima
Chrome više nije vaš zadani preglednik. Neka Chrome bude zadani preglednik?
Dok je ova kartica bila neaktivna, memorija je oslobođena kako bi Chrome ostao brz. Možete odabrati da ta web-lokacija uvijek bude neaktivna.
diff -Nru chromium-150.0.7871.114/chrome/app/resources/google_chrome_strings_sw.xtb chromium-150.0.7871.124/chrome/app/resources/google_chrome_strings_sw.xtb
--- chromium-150.0.7871.114/chrome/app/resources/google_chrome_strings_sw.xtb 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/app/resources/google_chrome_strings_sw.xtb 2026-07-13 21:36:30.000000000 +0000
@@ -724,7 +724,7 @@
Hifadhi ikiwa picha
Chrome hutumia seva za Google, tovuti inapoomba viungo vipakiwe mapema kwenye ukurasa wake kwa njia ya faragha. Hali hii huficha utambulisho wako usionekane na tovuti inayopakiwa mapema lakini Google hufahamu tovuti zinazopakiwa mapema.
Faili hii ni hatari, kwa hivyo Chrome imeizuia.
-Iulize Google
+Uliza Google
Tafsiri kwa
Hupunguza utendaji lakini huifanya Chrome istahimili zaidi mashambulio
Uliza chochote
diff -Nru chromium-150.0.7871.114/chrome/browser/about_flags.cc chromium-150.0.7871.124/chrome/browser/about_flags.cc
--- chromium-150.0.7871.114/chrome/browser/about_flags.cc 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/browser/about_flags.cc 2026-07-13 21:36:30.000000000 +0000
@@ -7246,6 +7246,10 @@
kNtpSharepointModuleVariations,
"DesktopNtpModules")},
+ {"ntp-starter-chip", flag_descriptions::kNtpStarterChipName,
+ flag_descriptions::kNtpStarterChipDescription, kOsDesktop,
+ FEATURE_VALUE_TYPE(ntp_features::kNtpStarterChip)},
+
{"ntp-tab-groups-module", flag_descriptions::kNtpTabGroupsModuleName,
flag_descriptions::kNtpTabGroupsModuleDescription, kOsDesktop,
FEATURE_WITH_PARAMS_VALUE_TYPE(ntp_features::kNtpTabGroupsModule,
diff -Nru chromium-150.0.7871.114/chrome/browser/ash/app_list/arc/arc_app_launcher.cc chromium-150.0.7871.124/chrome/browser/ash/app_list/arc/arc_app_launcher.cc
--- chromium-150.0.7871.114/chrome/browser/ash/app_list/arc/arc_app_launcher.cc 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/browser/ash/app_list/arc/arc_app_launcher.cc 2026-07-13 21:36:30.000000000 +0000
@@ -125,6 +125,11 @@
app_registry_cache_observer_.Reset();
arc_app_list_prefs_observer_.Reset();
+ // proxy->Launch / proxy->LaunchAppWithIntent can synchronously call
+ // ShelfModel::ReplaceShelfItemDelegate (e.g. via the ARC deferred-launch
+ // spinner path), which can destroy the ArcPlaystoreShortcutShelfItemController
+ // that owns |this|. Guard the trailing member write with a weak pointer.
+ auto weak_this = weak_ptr_factory_.GetWeakPtr();
if (launch_intent_) {
proxy->LaunchAppWithIntent(
app_id_, ui::EF_NONE, std::move(launch_intent_), launch_source_,
@@ -134,6 +139,11 @@
std::make_unique(display_id_));
}
+ if (!weak_this) {
+ // |this| was destroyed during the synchronous launch chain.
+ return true;
+ }
+
app_launched_ = true;
return true;
}
diff -Nru chromium-150.0.7871.114/chrome/browser/ash/app_list/arc/arc_app_launcher.h chromium-150.0.7871.124/chrome/browser/ash/app_list/arc/arc_app_launcher.h
--- chromium-150.0.7871.114/chrome/browser/ash/app_list/arc/arc_app_launcher.h 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/browser/ash/app_list/arc/arc_app_launcher.h 2026-07-13 21:36:30.000000000 +0000
@@ -10,6 +10,7 @@
#include
#include "base/memory/raw_ptr.h"
+#include "base/memory/weak_ptr.h"
#include "base/scoped_observation.h"
#include "chrome/browser/ash/app_list/arc/arc_app_list_prefs.h"
#include "chrome/browser/ash/app_list/arc/arc_app_utils.h"
@@ -83,6 +84,8 @@
base::ScopedObservation
arc_app_list_prefs_observer_{this};
+
+ base::WeakPtrFactory weak_ptr_factory_{this};
};
#endif // CHROME_BROWSER_ASH_APP_LIST_ARC_ARC_APP_LAUNCHER_H_
diff -Nru chromium-150.0.7871.114/chrome/browser/ash/fileapi/external_file_url_loader_factory.cc chromium-150.0.7871.124/chrome/browser/ash/fileapi/external_file_url_loader_factory.cc
--- chromium-150.0.7871.114/chrome/browser/ash/fileapi/external_file_url_loader_factory.cc 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/browser/ash/fileapi/external_file_url_loader_factory.cc 2026-07-13 21:36:30.000000000 +0000
@@ -7,9 +7,9 @@
#include
#include "base/byte_size.h"
-#include "base/compiler_specific.h"
#include "base/files/file_path.h"
#include "base/functional/bind.h"
+#include "base/memory/raw_span.h"
#include "base/numerics/safe_conversions.h"
#include "base/task/sequenced_task_runner.h"
#include "chrome/browser/ash/file_manager/fileapi_util.h"
@@ -46,20 +46,6 @@
constexpr size_t kDefaultPipeSize = 65536;
-// An IOBuffer that doesn't own its data and accepts void* pointers.
-class MojoPipeIOBuffer : public net::IOBuffer {
- public:
- MojoPipeIOBuffer(void* data, size_t size)
- : net::IOBuffer(UNSAFE_TODO(base::span(static_cast(data), size))) {
- }
-
- MojoPipeIOBuffer(const MojoPipeIOBuffer&) = delete;
- MojoPipeIOBuffer& operator=(const MojoPipeIOBuffer&) = delete;
-
- protected:
- ~MojoPipeIOBuffer() override = default;
-};
-
// A helper class to read data from a FileStreamReader, and write it to a
// Mojo data pipe.
class FileSystemReaderDataPipeProducer {
@@ -71,6 +57,8 @@
base::OnceCallback callback)
: producer_handle_(std::move(producer_handle)),
stream_reader_(std::move(stream_reader)),
+ read_buffer_(
+ base::MakeRefCounted(kDefaultPipeSize)),
remaining_bytes_(remaining_bytes),
pipe_watcher_(std::make_unique(
FROM_HERE,
@@ -91,42 +79,47 @@
void Write() {
while (remaining_bytes_ > 0) {
- if (!producer_handle_.is_valid())
- CompleteWithResult(net::ERR_FAILED);
- base::span pipe_buffer;
- MojoResult result = producer_handle_->BeginWriteData(
- kDefaultPipeSize, MOJO_BEGIN_WRITE_DATA_FLAG_NONE, pipe_buffer);
- // If we can't synchronously get the buffer to write to, stop for now and
- // wait for the SimpleWatcher to notify us that the pipe is writable.
- if (result == MOJO_RESULT_SHOULD_WAIT) {
- pipe_watcher_->ArmOrNotify();
- return;
+ // Flush any previously read data to the pipe before reading more.
+ while (!pending_write_.empty()) {
+ size_t bytes_written = 0;
+ MojoResult result = producer_handle_->WriteData(
+ pending_write_, MOJO_WRITE_DATA_FLAG_NONE, bytes_written);
+ // If the pipe is full, stop for now and wait for the SimpleWatcher to
+ // notify us that the pipe is writable.
+ if (result == MOJO_RESULT_SHOULD_WAIT) {
+ pipe_watcher_->ArmOrNotify();
+ return;
+ }
+ if (result != MOJO_RESULT_OK) {
+ CompleteWithResult(MojoResultToErrorCode(result));
+ return;
+ }
+ pending_write_ = pending_write_.subspan(bytes_written);
+ remaining_bytes_ -= base::checked_cast(bytes_written);
+ total_bytes_written_ += base::ByteSize(bytes_written);
}
- if (result != MOJO_RESULT_OK) {
- CompleteWithResult(MojoResultToErrorCode(result));
- return;
+ if (remaining_bytes_ <= 0) {
+ break;
}
-
- DCHECK(base::IsValueInRangeForNumericType(pipe_buffer.size()));
- scoped_refptr io_buffer =
- base::MakeRefCounted(pipe_buffer.data(),
- pipe_buffer.size());
+ const int bytes_to_read = base::checked_cast(
+ std::min(read_buffer_->size(), remaining_bytes_));
const int read_size = stream_reader_->Read(
- io_buffer.get(),
- std::min(pipe_buffer.size(), remaining_bytes_),
+ read_buffer_.get(), bytes_to_read,
base::BindOnce(
&FileSystemReaderDataPipeProducer::OnPendingReadComplete,
weak_ptr_factory_.GetWeakPtr()));
// Read will return ERR_IO_PENDING if the read couldn't be completed
// synchronously. In that case return, and OnPendingReadComplete will
// be called when the read is complete.
- if (read_size == net::ERR_IO_PENDING)
+ if (read_size == net::ERR_IO_PENDING) {
return;
- net::Error write_error = FinishWrite(read_size);
- if (write_error != net::OK) {
- CompleteWithResult(write_error);
+ }
+ if (read_size <= 0) {
+ CompleteWithResult(static_cast(read_size));
return;
}
+ pending_write_ =
+ read_buffer_->first(base::checked_cast(read_size));
}
CompleteWithResult(net::OK);
}
@@ -134,24 +127,13 @@
base::ByteSize total_bytes_written() { return total_bytes_written_; }
private:
- net::Error FinishWrite(int read_size) {
- MojoResult result =
- producer_handle_->EndWriteData(std::max(0, read_size));
- if (read_size <= 0)
- return static_cast(read_size);
- if (result != MOJO_RESULT_OK)
- return MojoResultToErrorCode(result);
- remaining_bytes_ -= read_size;
- total_bytes_written_ += base::ByteSize(base::as_unsigned(read_size));
- return net::OK;
- }
-
void OnPendingReadComplete(int read_result) {
- net::Error result = FinishWrite(read_result);
- if (result != net::OK) {
- CompleteWithResult(result);
+ if (read_result <= 0) {
+ CompleteWithResult(static_cast(read_result));
return;
}
+ pending_write_ =
+ read_buffer_->first(base::checked_cast(read_result));
Write();
}
@@ -191,6 +173,12 @@
mojo::ScopedDataPipeProducerHandle producer_handle_;
std::unique_ptr stream_reader_;
+ // The buffer passed to `stream_reader_` is owned here so that its storage
+ // remains valid for as long as any reference to it is retained, even if a
+ // pending read outlives this object.
+ scoped_refptr read_buffer_;
+ // Subspan of `read_buffer_` that still needs to be written to the pipe.
+ base::raw_span pending_write_;
int64_t remaining_bytes_;
base::ByteSize total_bytes_written_;
std::unique_ptr pipe_watcher_;
diff -Nru chromium-150.0.7871.114/chrome/browser/ash/fileapi/external_file_url_loader_factory_unittest.cc chromium-150.0.7871.124/chrome/browser/ash/fileapi/external_file_url_loader_factory_unittest.cc
--- chromium-150.0.7871.114/chrome/browser/ash/fileapi/external_file_url_loader_factory_unittest.cc 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/browser/ash/fileapi/external_file_url_loader_factory_unittest.cc 2026-07-13 21:36:30.000000000 +0000
@@ -179,6 +179,24 @@
EXPECT_EQ(net::ERR_INVALID_URL, client.completion_status().error_code);
}
+TEST_F(ExternalFileURLLoaderFactoryTest, DisconnectWhileReadPending) {
+ network::TestURLLoaderClient client;
+ mojo::PendingRemote loader =
+ CreateURLLoaderAndStart(&client, CreateRequest(kTestUrl));
+
+ // Wait until the response head and body pipe have been delivered. At this
+ // point the loader has begun streaming file contents into the data pipe.
+ client.RunUntilResponseBodyArrived();
+ ASSERT_TRUE(client.response_body().is_valid());
+
+ // Drop the URLLoader pipe to tear down the loader while file reads may still
+ // be in flight, then drain any remaining work.
+ loader.reset();
+ base::RunLoop().RunUntilIdle();
+
+ EXPECT_FALSE(client.has_received_completion());
+}
+
TEST_F(ExternalFileURLLoaderFactoryTest, RangeHeader) {
network::TestURLLoaderClient client;
network::ResourceRequest request = CreateRequest(kTestUrl);
diff -Nru chromium-150.0.7871.114/chrome/browser/flag-metadata.json chromium-150.0.7871.124/chrome/browser/flag-metadata.json
--- chromium-150.0.7871.114/chrome/browser/flag-metadata.json 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/browser/flag-metadata.json 2026-07-13 21:36:30.000000000 +0000
@@ -7041,6 +7041,11 @@
"expiry_milestone": 151
},
{
+ "name": "ntp-starter-chip",
+ "owners": [ "rtatum@google.com", "chrome-desktop-ntp@google.com" ],
+ "expiry_milestone": 160
+ },
+ {
"name": "ntp-tab-groups-module",
"owners": [ "tiborg@chromium.org", "dpenning@chromium.org" ],
"expiry_milestone": 150
diff -Nru chromium-150.0.7871.114/chrome/browser/flag_descriptions.h chromium-150.0.7871.124/chrome/browser/flag_descriptions.h
--- chromium-150.0.7871.114/chrome/browser/flag_descriptions.h 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/browser/flag_descriptions.h 2026-07-13 21:36:30.000000000 +0000
@@ -6581,6 +6581,10 @@
inline constexpr char kNtpSharepointModuleDescription[] =
"Shows the Sharepoint module on the New Tab Page.";
+inline constexpr char kNtpStarterChipName[] = "NTP Starter Chip";
+inline constexpr char kNtpStarterChipDescription[] =
+ "Enables the starter chip on the New Tab Page.";
+
inline constexpr char kNtpTabGroupsModuleName[] = "NTP Tab Groups Module";
inline constexpr char kNtpTabGroupsModuleDescription[] =
"Shows the Tab Groups module on the New Tab Page.";
diff -Nru chromium-150.0.7871.114/chrome/browser/glic/host/glic_ui.cc chromium-150.0.7871.124/chrome/browser/glic/host/glic_ui.cc
--- chromium-150.0.7871.114/chrome/browser/glic/host/glic_ui.cc 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/browser/glic/host/glic_ui.cc 2026-07-13 21:36:30.000000000 +0000
@@ -258,6 +258,8 @@
source->AddBoolean("showErrorAllowed", is_internal_google_account ||
profile->GetPrefs()->GetBoolean(
prefs::kGlicShowErrorAllowed));
+ const bool completed_fre = GlicEnabling::HasConsentedForProfile(profile);
+ source->AddBoolean("completedFre", completed_fre);
#if BUILDFLAG(IS_ANDROID)
const bool is_android_mobile =
GetGlicFormFactor(ui::GetDeviceFormFactor()) == mojom::FormFactor::kPhone;
diff -Nru chromium-150.0.7871.114/chrome/browser/glic/host/host.cc chromium-150.0.7871.124/chrome/browser/glic/host/host.cc
--- chromium-150.0.7871.114/chrome/browser/glic/host/host.cc 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/browser/glic/host/host.cc 2026-07-13 21:36:30.000000000 +0000
@@ -14,6 +14,7 @@
#include "base/notimplemented.h"
#include "base/trace_event/trace_event.h"
#include "chrome/browser/glic/fre/glic_fre_controller.h"
+#include "chrome/browser/glic/glic_pref_names.h"
#include "chrome/browser/glic/glic_profile_manager.h"
#include "chrome/browser/glic/host/context/glic_pin_candidate_provider.h"
#include "chrome/browser/glic/host/context/glic_screenshot_capturer.h"
@@ -25,6 +26,7 @@
#include "chrome/browser/glic/host/host.h"
#include "chrome/browser/glic/host/webui_contents_container.h"
#include "chrome/browser/glic/public/features.h"
+#include "chrome/browser/glic/public/glic_enabling.h"
#include "chrome/browser/glic/public/glic_instance_metrics_backwards_compatibility.h"
#include "chrome/browser/glic/public/glic_keyed_service.h"
#include "chrome/browser/glic/public/glic_keyed_service_factory.h"
@@ -594,6 +596,9 @@
void Host::WebUiStateChanged(GlicPageHandler* page_handler,
mojom::WebUiState new_state) {
base::UmaHistogramEnumeration("Glic.PanelWebUiState", new_state);
+ if (!GlicEnabling::HasConsentedForProfile(profile_)) {
+ base::UmaHistogramEnumeration("Glic.Fre.PanelWebUiState", new_state);
+ }
// UI State has changed
primary_webui_state_ = new_state;
observers_.Notify(&Observer::WebUiStateChanged, primary_webui_state_);
diff -Nru chromium-150.0.7871.114/chrome/browser/glic/host/new_glic_api_browsertest.cc chromium-150.0.7871.124/chrome/browser/glic/host/new_glic_api_browsertest.cc
--- chromium-150.0.7871.114/chrome/browser/glic/host/new_glic_api_browsertest.cc 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/browser/glic/host/new_glic_api_browsertest.cc 2026-07-13 21:36:30.000000000 +0000
@@ -11,6 +11,7 @@
#include "chrome/browser/browser_process.h"
#include "chrome/browser/enterprise/browser_management/management_service_factory.h"
#include "chrome/browser/glic/glic_enums.h"
+#include "chrome/browser/glic/glic_pref_names.h"
#include "chrome/browser/glic/host/auth_controller.h"
#include "chrome/browser/glic/host/glic.mojom.h"
#include "chrome/browser/glic/host/glic_features.mojom-features.h"
@@ -135,6 +136,11 @@
};
namespace {
+using ::base::Bucket;
+using ::base::BucketsAre;
+using ::testing::IsEmpty;
+using ::testing::Pair;
+using ::testing::UnorderedElementsAre;
std::vector GetTestSuiteNames() {
std::vector names = {
@@ -869,15 +875,37 @@
}
IN_PROC_BROWSER_TEST_P(NewGlicApiTest, testInitializeFails) {
+ service()->enabling().SetCompletedFre(prefs::FreStatus::kNotStarted);
glic::GlicHistogramTester histogram_tester;
ASSERT_OK(OpenGlicForActiveTab());
ExecuteJsTest({
.params = base::Value(base::DictValue().Set("failWith", "error")),
});
ASSERT_OK(WaitForWebUiState(mojom::WebUiState::kError));
- EXPECT_GT(histogram_tester.GetBucketCount("Glic.PanelWebUiState.Error",
- 6 /*CLIENT_ERROR*/),
- 0);
+ // Verify non-FRE error metric is recorded immediately.
+ EXPECT_THAT(histogram_tester.GetAllSamples("Glic.PanelWebUiState.Error"),
+ BucketsAre(Bucket(6 /*CLIENT_ERROR*/, 1)));
+
+ // Verify WebUiState transitions and error metrics update immediately during
+ // the session before the panel closes.
+ EXPECT_THAT(
+ histogram_tester.GetAllSamplesForPrefix("Glic.Fre.PanelWebUiState"),
+ UnorderedElementsAre(
+ Pair("Glic.Fre.PanelWebUiState",
+ BucketsAre(Bucket(1 /*kBeginLoad*/, 1),
+ Bucket(2 /*kShowLoading*/, 1),
+ Bucket(4 /*kFinishLoading*/, 1),
+ Bucket(5 /*kError*/, 1),
+ Bucket(13 /*kGuestError*/, 1))),
+ Pair("Glic.Fre.PanelWebUiState.Error",
+ BucketsAre(Bucket(6 /*CLIENT_ERROR*/, 1)))));
+
+ // Close Glic and verify FinishState is recorded.
+ CloseAllEmbeddersAndPreventDeletion();
+ ASSERT_OK(WaitForGlicClose());
+ EXPECT_THAT(
+ histogram_tester.GetAllSamples("Glic.Fre.PanelWebUiState.FinishState"),
+ BucketsAre(Bucket(5 /*kError*/, 1)));
}
// Flaky on slower bots / builds.
diff -Nru chromium-150.0.7871.114/chrome/browser/glic/service/metrics/glic_instance_metrics.cc chromium-150.0.7871.124/chrome/browser/glic/service/metrics/glic_instance_metrics.cc
--- chromium-150.0.7871.114/chrome/browser/glic/service/metrics/glic_instance_metrics.cc 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/browser/glic/service/metrics/glic_instance_metrics.cc 2026-07-13 21:36:30.000000000 +0000
@@ -648,6 +648,10 @@
LogEvent(GlicInstanceEvent::kClose);
base::UmaHistogramEnumeration("Glic.PanelWebUiState.FinishState3",
last_web_ui_state_);
+ if (!GlicEnabling::HasConsentedForProfile(profile_)) {
+ base::UmaHistogramEnumeration("Glic.Fre.PanelWebUiState.FinishState",
+ last_web_ui_state_);
+ }
}
bool GlicInstanceMetrics::MarkShownAndCheckIfFirstTime(EmbedderKey key) {
diff -Nru chromium-150.0.7871.114/chrome/browser/lifetime/smart_restart_manager_browsertest.cc chromium-150.0.7871.124/chrome/browser/lifetime/smart_restart_manager_browsertest.cc
--- chromium-150.0.7871.114/chrome/browser/lifetime/smart_restart_manager_browsertest.cc 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/browser/lifetime/smart_restart_manager_browsertest.cc 2026-07-13 21:36:30.000000000 +0000
@@ -10,6 +10,7 @@
#include "base/time/default_clock.h"
#include "base/time/default_tick_clock.h"
#include "chrome/browser/browser_process.h"
+#include "chrome/browser/enterprise/browser_management/management_service_factory.h"
#include "chrome/browser/lifetime/browser_shutdown.h"
#include "chrome/browser/lifetime/restartability_monitor.h"
#include "chrome/browser/profiles/keep_alive/profile_keep_alive_types.h"
@@ -31,6 +32,7 @@
#include "components/performance_manager/public/decorators/page_live_state_decorator.h"
#include "components/performance_manager/public/graph/page_node.h"
#include "components/performance_manager/public/performance_manager.h"
+#include "components/policy/core/common/management/scoped_management_service_override_for_testing.h"
#include "components/prefs/pref_service.h"
#include "components/site_engagement/content/site_engagement_score.h"
#include "content/public/test/browser_test.h"
@@ -99,18 +101,27 @@
void SetUpOnMainThread() override {
InProcessBrowserTest::SetUpOnMainThread();
+ // Explicitly set the default to unmanaged.
+ platform_management_ =
+ std::make_unique(
+ policy::ManagementServiceFactory::GetForPlatform(),
+ policy::EnterpriseManagementAuthority::NONE);
+
// Inject our fake detector into the manager.
manager_ = std::make_unique(&fake_upgrade_detector_);
}
void TearDownOnMainThread() override {
manager_.reset();
+ platform_management_.reset();
InProcessBrowserTest::TearDownOnMainThread();
}
base::test::ScopedFeatureList feature_list_;
FakeUpgradeDetector fake_upgrade_detector_;
std::unique_ptr manager_;
+ std::unique_ptr
+ platform_management_;
};
class SmartRestartManagerBrowserTest : public SmartRestartManagerTestBase {
@@ -160,6 +171,40 @@
}
IN_PROC_BROWSER_TEST_F(SmartRestartManagerBrowserTest,
+ BlocksRestartOnZeroWindowWhenManaged) {
+ base::HistogramTester histogram_tester;
+ policy::ScopedManagementServiceOverrideForTesting platform_management(
+ policy::ManagementServiceFactory::GetForPlatform(),
+ policy::EnterpriseManagementAuthority::CLOUD);
+
+ // 1. Setup: Pending update.
+ fake_upgrade_detector_.SetUpgradeAvailable();
+
+ // 2. Action: Close all windows.
+ PrefService* local_state = g_browser_process->local_state();
+ EXPECT_FALSE(local_state->GetBoolean(prefs::kRestartInBackgroundOnShutdown));
+
+ CloseBrowserSynchronously(browser());
+
+ // 3. Verification: Manager should not start zero-window timer or set prefs
+ // when managed. Wait brief duration to ensure no timer fires or background
+ // restart is triggered.
+ base::RunLoop run_loop;
+ base::SingleThreadTaskRunner::GetCurrentDefault()->PostDelayedTask(
+ FROM_HERE, run_loop.QuitClosure(), base::Seconds(2));
+ run_loop.Run();
+
+ EXPECT_FALSE(local_state->GetBoolean(prefs::kRestartInBackgroundOnShutdown));
+ EXPECT_FALSE(local_state->GetBoolean(prefs::kRestartLastSessionOnShutdown));
+
+ histogram_tester.ExpectTotalCount(
+ "Session.SmartRestart.ZeroWindow.ExecutionOutcome", 0);
+
+ // Cleanup to prevent actual restart during teardown.
+ browser_shutdown::SetTryingToQuit(false);
+}
+
+IN_PROC_BROWSER_TEST_F(SmartRestartManagerBrowserTest,
CancelsRestartOnWindowOpen) {
base::HistogramTester histogram_tester;
// 1. Setup: Pending update.
@@ -314,6 +359,34 @@
}
IN_PROC_BROWSER_TEST_F(SmartRestartManagerBrowserTest,
+ BlocksRestartOnLockScreenWhenManaged) {
+ base::HistogramTester histogram_tester;
+ policy::ScopedManagementServiceOverrideForTesting platform_management(
+ policy::ManagementServiceFactory::GetForPlatform(),
+ policy::EnterpriseManagementAuthority::CLOUD);
+
+ // 1. Setup: Pending update.
+ fake_upgrade_detector_.SetUpgradeAvailable();
+
+ // 2. Action: Simulate Lock.
+ PrefService* local_state = g_browser_process->local_state();
+ EXPECT_FALSE(local_state->GetBoolean(prefs::kRestartLastSessionOnShutdown));
+
+ manager_->SetLockedStateForTesting(true);
+
+ // 3. Verification: Wait for timer to execute and verify outcome is blocked by
+ // policy.
+ EXPECT_TRUE(base::test::RunUntil([&]() {
+ return histogram_tester.GetBucketCount(
+ "Session.SmartRestart.Lock.ExecutionOutcome",
+ static_cast(ExtendedExecutionOutcome::kBlockedByPolicy)) ==
+ 1;
+ }));
+
+ EXPECT_FALSE(local_state->GetBoolean(prefs::kRestartLastSessionOnShutdown));
+}
+
+IN_PROC_BROWSER_TEST_F(SmartRestartManagerBrowserTest,
BlockOnLockScreenHighDisruption) {
base::HistogramTester histogram_tester;
// 1. Setup: Pending update and a "High Disruption" blocker (e.g. Incognito).
diff -Nru chromium-150.0.7871.114/chrome/browser/lifetime/smart_restart_policy.cc chromium-150.0.7871.124/chrome/browser/lifetime/smart_restart_policy.cc
--- chromium-150.0.7871.114/chrome/browser/lifetime/smart_restart_policy.cc 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/browser/lifetime/smart_restart_policy.cc 2026-07-13 21:36:30.000000000 +0000
@@ -7,6 +7,7 @@
#include
#include "build/build_config.h"
+#include "chrome/browser/enterprise/browser_management/management_service_factory.h"
#include "chrome/browser/profiles/profile.h"
#include "chrome/browser/ui/profiles/profile_picker.h"
#include "chrome/browser/ui/startup/startup_browser_creator.h"
@@ -56,6 +57,12 @@
// static
ExtendedExecutionOutcome SmartRestartPolicy::CanLockScreenRestartProceed(
const ExtendedRestartabilityState& state) {
+ // Exclude managed enterprise environments to respect administrative update
+ // controls.
+ if (policy::ManagementServiceFactory::GetForPlatform()->IsManaged()) {
+ return ExtendedExecutionOutcome::kBlockedByPolicy;
+ }
+
// Ensure the browser isn't in a delicate startup or profile-picking state.
if (StartupBrowserCreator::InSynchronousProfileLaunch()) {
return ExtendedExecutionOutcome::kBlockedByPolicy;
@@ -83,6 +90,12 @@
#if BUILDFLAG(IS_MAC)
// static
bool SmartRestartPolicy::CanZeroWindowRestartProceed() {
+ // Exclude managed enterprise environments to respect administrative update
+ // controls.
+ if (policy::ManagementServiceFactory::GetForPlatform()->IsManaged()) {
+ return false;
+ }
+
// 1. Ensure the browser isn't in a delicate startup or profile-picking state.
if (StartupBrowserCreator::InSynchronousProfileLaunch() ||
ProfilePicker::IsOpen()) {
diff -Nru chromium-150.0.7871.114/chrome/browser/lifetime/smart_restart_policy_unittest.cc chromium-150.0.7871.124/chrome/browser/lifetime/smart_restart_policy_unittest.cc
--- chromium-150.0.7871.114/chrome/browser/lifetime/smart_restart_policy_unittest.cc 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/browser/lifetime/smart_restart_policy_unittest.cc 2026-07-13 21:36:30.000000000 +0000
@@ -4,7 +4,9 @@
#include "chrome/browser/lifetime/smart_restart_policy.h"
+#include "chrome/browser/enterprise/browser_management/management_service_factory.h"
#include "chrome/browser/lifetime/restartability_monitor.h"
+#include "components/policy/core/common/management/scoped_management_service_override_for_testing.h"
#include "testing/gtest/include/gtest/gtest.h"
namespace smart_restart {
@@ -52,4 +54,24 @@
SmartRestartPolicy::ShouldRestart(state));
}
+TEST(SmartRestartPolicyTest, BlockLockScreenWhenManaged) {
+ policy::ScopedManagementServiceOverrideForTesting platform_management(
+ policy::ManagementServiceFactory::GetForPlatform(),
+ policy::EnterpriseManagementAuthority::CLOUD);
+
+ ExtendedRestartabilityState state;
+ EXPECT_EQ(ExtendedExecutionOutcome::kBlockedByPolicy,
+ SmartRestartPolicy::CanLockScreenRestartProceed(state));
+}
+
+#if BUILDFLAG(IS_MAC)
+TEST(SmartRestartPolicyTest, BlockZeroWindowWhenManaged) {
+ policy::ScopedManagementServiceOverrideForTesting platform_management(
+ policy::ManagementServiceFactory::GetForPlatform(),
+ policy::EnterpriseManagementAuthority::CLOUD);
+
+ EXPECT_FALSE(SmartRestartPolicy::CanZeroWindowRestartProceed());
+}
+#endif // BUILDFLAG(IS_MAC)
+
} // namespace smart_restart
diff -Nru chromium-150.0.7871.114/chrome/browser/resources/chromeos/accessibility/strings/accessibility_strings_ja.xtb chromium-150.0.7871.124/chrome/browser/resources/chromeos/accessibility/strings/accessibility_strings_ja.xtb
--- chromium-150.0.7871.114/chrome/browser/resources/chromeos/accessibility/strings/accessibility_strings_ja.xtb 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/browser/resources/chromeos/accessibility/strings/accessibility_strings_ja.xtb 2026-07-13 21:36:30.000000000 +0000
@@ -100,7 +100,7 @@
前の図
ピッチを上げる
次の文
-ブライユ点字の次の行
+点字の次の行
.input {$$COUNT :number} .match $$COUNT 1{{個のチルダ}} *{{{$$COUNT} 個のチルダ}}
前のページにスクロールします
スクロールバー
@@ -642,7 +642,7 @@
、選択されたメニュー項目のラジオボタン
のため、 できません
読み上げのログを有効にする
-ブライユ点字表示をページ上部に移動
+点字表示をページ上部に移動
読み上げの音量を上げる
ウェブ コンテンツ
次は左 Shift キーです。このキーは Ctrl キーのすぐ上にあります。次へ進むには、左 Shift キーを押してください。
@@ -664,7 +664,7 @@
表紙
次に進むには、タッチガイドで [次のレッスン] ボタンを探して、ダブルタップしてください。
点字表示が有効になっています
-ブライユ点字の前の行
+点字の前の行
行
コーンシルク
見出し 2
@@ -852,7 +852,7 @@
索引
明るさを下げる
ターコイズ
-ブライユ点字表示をページ下部に移動
+点字表示をページ下部に移動
.input {$$COUNT :number} .match $$COUNT 1{{個の左丸かっこ}} *{{{$$COUNT} 個の左丸かっこ}}
ダーク バイオレット
リネン
@@ -1008,7 +1008,7 @@
現在の列の先頭に移動
見出し
現在のページの URL を読み上げる
-ブライユ点字キャプションを切り替える
+点字キャプションを切り替える
クレジット
現在再生中のメディア ウィジェットをすべて一時停止します
次の表
diff -Nru chromium-150.0.7871.114/chrome/browser/resources/glic/glic_api_impl/host/glic_api_host.ts chromium-150.0.7871.124/chrome/browser/resources/glic/glic_api_impl/host/glic_api_host.ts
--- chromium-150.0.7871.114/chrome/browser/resources/glic/glic_api_impl/host/glic_api_host.ts 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/browser/resources/glic/glic_api_impl/host/glic_api_host.ts 2026-07-13 21:36:30.000000000 +0000
@@ -76,6 +76,9 @@
// Returns the current zoom level of the webview.
getZoom(): Promise;
+
+ // Called when the user completes the onboarding flow.
+ onboardingCompleted?(): void;
}
diff -Nru chromium-150.0.7871.114/chrome/browser/resources/glic/glic_api_impl/host/host_from_client.ts chromium-150.0.7871.124/chrome/browser/resources/glic/glic_api_impl/host/host_from_client.ts
--- chromium-150.0.7871.114/chrome/browser/resources/glic/glic_api_impl/host/host_from_client.ts 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/browser/resources/glic/glic_api_impl/host/host_from_client.ts 2026-07-13 21:36:30.000000000 +0000
@@ -768,6 +768,9 @@
glicBrowserSetOnboardingCompleted(): void {
this.handler.setOnboardingCompleted();
+ if (this.embedder.onboardingCompleted) {
+ this.embedder.onboardingCompleted();
+ }
}
glicBrowserSubscribeToTabData(
diff -Nru chromium-150.0.7871.114/chrome/browser/resources/glic/glic_app_controller.ts chromium-150.0.7871.124/chrome/browser/resources/glic/glic_app_controller.ts
--- chromium-150.0.7871.114/chrome/browser/resources/glic/glic_app_controller.ts 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/browser/resources/glic/glic_app_controller.ts 2026-07-13 21:36:30.000000000 +0000
@@ -122,6 +122,7 @@
export class GlicAppController implements WebviewDelegate, ApiHostEmbedder {
loadingTimer: number|undefined;
+ private isFreCompleted: boolean = loadTimeData.getBoolean('completedFre');
// This is used to simulate no connection for tests.
private simulateNoConnection: boolean =
@@ -330,7 +331,17 @@
return;
}
chrome.histograms.recordEnumerationValue(
- 'Glic.PanelWebUiState.Error', reason, WebUiErrorReason.MAX_VALUE + 1);
+ 'Glic.PanelWebUiState.Error',
+ reason,
+ WebUiErrorReason.MAX_VALUE + 1,
+ );
+ if (!this.isFreCompleted) {
+ chrome.histograms.recordEnumerationValue(
+ 'Glic.Fre.PanelWebUiState.Error',
+ reason,
+ WebUiErrorReason.MAX_VALUE + 1,
+ );
+ }
this.setState(WebUiState.kError);
}
@@ -749,6 +760,10 @@
});
}
+ onboardingCompleted(): void {
+ this.isFreCompleted = true;
+ }
+
webClientWarmed(): void {
if (this.state === WebUiState.kBeginLoad ||
this.state === WebUiState.kFinishLoading ||
diff -Nru chromium-150.0.7871.114/chrome/browser/resources/side_panel/read_anything/app/read_anything.d.ts chromium-150.0.7871.124/chrome/browser/resources/side_panel/read_anything/app/read_anything.d.ts
--- chromium-150.0.7871.114/chrome/browser/resources/side_panel/read_anything/app/read_anything.d.ts 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/browser/resources/side_panel/read_anything/app/read_anything.d.ts 2026-07-13 21:36:30.000000000 +0000
@@ -80,10 +80,6 @@
let highContrastTheme: number;
let lowContrastLightTheme: number;
let lowContrastDarkTheme: number;
- let undefinedPresentationState: number;
- let inHiddenPresentationState: number;
- let inSidePanelPresentationState: number;
- let inImmersiveOverlayPresentationState: number;
let autoHighlighting: number;
let wordHighlighting: number;
let phraseHighlighting: number;
@@ -133,6 +129,9 @@
// Indicates if this page is a Google doc.
let isGoogleDocs: boolean;
+ // Indicates if this page is a PDF.
+ let isPdf: boolean;
+
// Fonts supported by the user's current language.
let supportedFonts: string[];
@@ -179,6 +178,12 @@
// distillation method.
let distillationTypeReadability: number;
+ // The active presentation state of Reading mode.
+ let activePresentationState: number;
+ let inHiddenPresentationState: number;
+ let inSidePanelPresentationState: number;
+ let inImmersiveOverlayPresentationState: number;
+
// Returns the AXTree mapping segments for the distilled block at the given
// index. A segment links a character range within the block to its AXnode.
function getAxMapping(index: number): Array<
diff -Nru chromium-150.0.7871.114/chrome/browser/resources/side_panel/read_anything/read_anything.ts chromium-150.0.7871.124/chrome/browser/resources/side_panel/read_anything/read_anything.ts
--- chromium-150.0.7871.114/chrome/browser/resources/side_panel/read_anything/read_anything.ts 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/browser/resources/side_panel/read_anything/read_anything.ts 2026-07-13 21:36:30.000000000 +0000
@@ -73,5 +73,5 @@
export {getNewIndex, isActivationKey, isArrow, isBackwardArrow, isForwardArrow, isHorizontalArrow, isVerticalArrow} from './shared/keyboard_util.js';
export type {MetricsBrowserProxy} from './shared/metrics_browser_proxy.js';
export {MetricsBrowserProxyImpl, ReadAloudSettingsChange, ReadAnythingNewPage, ReadAnythingSettingsChange, ReadAnythingSpeechError, ReadAnythingVoiceType} from './shared/metrics_browser_proxy.js';
-export {LinkStatus, ReadAnythingLogger, SpeechControls, TimeFrom} from './shared/read_anything_logger.js';
+export {LinkStatus, PageType, ReadAnythingLogger, SpeechControls, TimeFrom, ViewMode} from './shared/read_anything_logger.js';
export {calculateTextBounds, getMostCommonPitch, isRectMostlyVisible, isRectVisible, MOSTLY_VISIBLE_PERCENT} from './shared/rect_calculations.js';
diff -Nru chromium-150.0.7871.114/chrome/browser/resources/side_panel/read_anything/shared/metrics_browser_proxy.ts chromium-150.0.7871.124/chrome/browser/resources/side_panel/read_anything/shared/metrics_browser_proxy.ts
--- chromium-150.0.7871.114/chrome/browser/resources/side_panel/read_anything/shared/metrics_browser_proxy.ts 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/browser/resources/side_panel/read_anything/shared/metrics_browser_proxy.ts 2026-07-13 21:36:30.000000000 +0000
@@ -12,6 +12,9 @@
'Accessibility.ReadAnything.DistilledPageStructure.NumberParagraphs',
SPEECH_ERROR = 'Accessibility.ReadAnything.SpeechError',
SPEECH_PLAYBACK = 'Accessibility.ReadAnything.SpeechPlaybackSession',
+ PDF_HEADING_TO_PARAGRAPH_RATIO =
+ 'Accessibility.ReadAnything.Pdf.HeadingToParagraphRatio',
+ PDF_NUMBER_PARAGRAPHS = 'Accessibility.ReadAnything.Pdf.NumberParagraphs',
SPEECH_SETTINGS_CHANGE =
'Accessibility.ReadAnything.ReadAloud.SettingsChange',
TEXT_SETTINGS_CHANGE = 'Accessibility.ReadAnything.SettingsChange',
@@ -149,7 +152,8 @@
recordNewPage(): void;
recordNewPageWithSpeech(): void;
recordSpeechError(error: ReadAnythingSpeechError): void;
- recordSpeechPlaybackLength(time: number): void;
+ recordSpeechPlaybackLength(umaName: string, time: number): void;
+ recordSpeechPlaybackLengthLegacy(time: number): void;
recordSpeechSettingsChange(settingsChange: ReadAloudSettingsChange): void;
recordSpeechStopSource(source: number): void;
recordTextSettingsChange(settingsChange: ReadAnythingSettingsChange): void;
@@ -240,7 +244,11 @@
chrome.metricsPrivate.recordSmallCount(UmaName.VOICE_SPEED, index);
}
- recordSpeechPlaybackLength(time: number) {
+ recordSpeechPlaybackLength(umaName: string, time: number) {
+ chrome.metricsPrivate.recordLongTime(umaName, time);
+ }
+
+ recordSpeechPlaybackLengthLegacy(time: number) {
chrome.metricsPrivate.recordLongTime(UmaName.SPEECH_PLAYBACK, time);
}
diff -Nru chromium-150.0.7871.114/chrome/browser/resources/side_panel/read_anything/shared/read_anything_logger.ts chromium-150.0.7871.124/chrome/browser/resources/side_panel/read_anything/shared/read_anything_logger.ts
--- chromium-150.0.7871.114/chrome/browser/resources/side_panel/read_anything/shared/read_anything_logger.ts 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/browser/resources/side_panel/read_anything/shared/read_anything_logger.ts 2026-07-13 21:36:30.000000000 +0000
@@ -28,6 +28,16 @@
TOO_MANY_MATCHES = 'TooManyMatches',
}
+export enum PageType {
+ PDF = 'PDF',
+ WEB_PAGE = 'WebPage',
+}
+
+export enum ViewMode {
+ FULL_PAGE = 'FullPage',
+ SIDE_PANEL = 'SidePanel',
+}
+
// Handles the business logic for logging.
export class ReadAnythingLogger {
private metrics: MetricsBrowserProxy = MetricsBrowserProxyImpl.getInstance();
@@ -185,7 +195,28 @@
logSpeechPlaySession(startTime: number, voice: SpeechSynthesisVoice|null) {
this.logVoiceTypeUsedForReading_(voice);
this.logLanguageUsedForReading_(voice?.lang);
- this.metrics.recordSpeechPlaybackLength(Date.now() - startTime);
+
+ const playbackTime = Date.now() - startTime;
+ this.metrics.recordSpeechPlaybackLengthLegacy(playbackTime);
+ if (!chrome.readingMode.isImmersiveEnabled) {
+ return;
+ }
+
+ const activePresentationState = chrome.readingMode.activePresentationState;
+ const isImmersiveState = activePresentationState ===
+ chrome.readingMode.inImmersiveOverlayPresentationState;
+ if (!isImmersiveState &&
+ activePresentationState !==
+ chrome.readingMode.inSidePanelPresentationState) {
+ return;
+ }
+
+ const pageType =
+ chrome.readingMode.isPdf ? PageType.PDF : PageType.WEB_PAGE;
+ const viewMode =
+ isImmersiveState ? ViewMode.FULL_PAGE : ViewMode.SIDE_PANEL;
+ const umaName = `${UmaName.SPEECH_PLAYBACK}.${pageType}In${viewMode}`;
+ this.metrics.recordSpeechPlaybackLength(umaName, playbackTime);
}
logSpeechControlClick(control: SpeechControls) {
@@ -232,6 +263,9 @@
this.metrics.recordCount(UmaName.UNIQUE_HEADER_TAGS, uniqueHeaderTags);
this.logTopTwoHeaderMetrics_(headerCounts);
+ if (chrome.readingMode.isPdf) {
+ this.logPdfDistilledPageStructure_(headerCounts, paragraphs.length);
+ }
}
// The "top two" headers in a hierarchy represent the first two non-zero
@@ -270,6 +304,27 @@
topTwoHeadersHaveMinimumTwoItems);
}
+ private logPdfDistilledPageStructure_(
+ headerCounts: Array<{tag: string, count: number}>,
+ paragraphCount: number) {
+ for (const header of headerCounts) {
+ const headingLevel = header.tag.toUpperCase();
+ this.metrics.recordCount(
+ `Accessibility.ReadAnything.Pdf.Headings.${headingLevel}`,
+ header.count);
+ }
+ this.metrics.recordCount(UmaName.PDF_NUMBER_PARAGRAPHS, paragraphCount);
+
+ if (paragraphCount > 0) {
+ const totalHeaderCount =
+ headerCounts.reduce((sum, item) => sum + item.count, 0);
+ const headingToParagraphRatio =
+ Math.round((totalHeaderCount / paragraphCount) * 100);
+ this.metrics.recordCount(
+ UmaName.PDF_HEADING_TO_PARAGRAPH_RATIO, headingToParagraphRatio);
+ }
+ }
+
static getHeaderCounts(wordCountContainer: Element):
Array<{tag: string, count: number}> {
return [
diff -Nru chromium-150.0.7871.114/chrome/browser/ssl/https_first_mode_settings_tracker.cc chromium-150.0.7871.124/chrome/browser/ssl/https_first_mode_settings_tracker.cc
--- chromium-150.0.7871.114/chrome/browser/ssl/https_first_mode_settings_tracker.cc 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/browser/ssl/https_first_mode_settings_tracker.cc 2026-07-13 21:36:30.000000000 +0000
@@ -822,6 +822,7 @@
// TODO(crbug.com/41488885): Check if this service is needed for
// Ash Internals.
.WithAshInternals(ProfileSelection::kOriginalOnly)
+ .WithGuest(ProfileSelection::kOffTheRecordOnly)
.Build()) {
DependsOn(
safe_browsing::AdvancedProtectionStatusManagerFactory::GetInstance());
diff -Nru chromium-150.0.7871.114/chrome/browser/ssl/https_first_mode_settings_tracker_unittest.cc chromium-150.0.7871.124/chrome/browser/ssl/https_first_mode_settings_tracker_unittest.cc
--- chromium-150.0.7871.114/chrome/browser/ssl/https_first_mode_settings_tracker_unittest.cc 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/browser/ssl/https_first_mode_settings_tracker_unittest.cc 2026-07-13 21:36:30.000000000 +0000
@@ -1474,3 +1474,13 @@
histograms.ExpectTotalCount(
"Security.HttpsFirstMode.SettingImplicitlyChanged", 2);
}
+
+TEST_F(HttpsFirstModeSettingsTrackerTest, GuestOTRProfileHasService) {
+ TestingProfile::Builder builder;
+ builder.SetGuestSession();
+ std::unique_ptr guest_profile = builder.Build();
+ // For a guest OTR profile, the factory should still return a service
+ // instance.
+ EXPECT_TRUE(HttpsFirstModeServiceFactory::GetForProfile(
+ guest_profile->GetPrimaryOTRProfile(true)));
+}
diff -Nru chromium-150.0.7871.114/chrome/browser/ui/android/strings/translations/android_chrome_strings_ca.xtb chromium-150.0.7871.124/chrome/browser/ui/android/strings/translations/android_chrome_strings_ca.xtb
--- chromium-150.0.7871.114/chrome/browser/ui/android/strings/translations/android_chrome_strings_ca.xtb 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/browser/ui/android/strings/translations/android_chrome_strings_ca.xtb 2026-07-13 21:36:30.000000000 +0000
@@ -1356,7 +1356,7 @@
Previsualitza la imatge Novetat
Tab
Obre a
-Vull rebre notificacions
+Notifica-m'ho
Copia la imatge
Introduïu la vostra contrasenya
Afegeix
diff -Nru chromium-150.0.7871.114/chrome/browser/ui/android/strings/translations/android_chrome_strings_es.xtb chromium-150.0.7871.124/chrome/browser/ui/android/strings/translations/android_chrome_strings_es.xtb
--- chromium-150.0.7871.114/chrome/browser/ui/android/strings/translations/android_chrome_strings_es.xtb 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/browser/ui/android/strings/translations/android_chrome_strings_es.xtb 2026-07-13 21:36:30.000000000 +0000
@@ -340,7 +340,7 @@
Prueba a buscar en el Centro de Ayuda
Inicia sesión para sacarle el máximo partido a Chrome
Las descripciones de imágenes están activadas
-Ve a Ajustes
+Ir a Ajustes
Notificaciones
Historial de navegación
Verás tu estado de inicio de sesión, datos de navegación y datos del sitio de en Chrome.
@@ -1088,7 +1088,7 @@
Encuentra tus archivos y páginas en la sección Descargas con el botón Más opciones
No leído: disponible sin conexión
Gestionar pestañas abiertas
-Muéstrame cómo
+Ver cómo
necesita tu permiso para ejecutar
Has iniciado sesión como . Error de cuenta de Google. Abre la configuración.
Es posible que el historial de búsqueda y otros tipos de actividad se guarden en tu cuenta de Google
diff -Nru chromium-150.0.7871.114/chrome/browser/ui/android/strings/translations/android_chrome_strings_fa.xtb chromium-150.0.7871.124/chrome/browser/ui/android/strings/translations/android_chrome_strings_fa.xtb
--- chromium-150.0.7871.114/chrome/browser/ui/android/strings/translations/android_chrome_strings_fa.xtb 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/browser/ui/android/strings/translations/android_chrome_strings_fa.xtb 2026-07-13 21:36:30.000000000 +0000
@@ -1778,7 +1778,7 @@
پیوست کردن عکس دوربین
اسناد
اشتراک لغو شد
-اضافه شد
+افزوده شده
ازآنجاییکه صفحات پیشبارگیریشده رمزگذاری شدهاند، Google هیچ اطلاعاتی درباره محتوای صفحه پیشبارگیریشده دریافت نخواهد کرد. سرورهای Google مطلع خواهد شد که کدام سایتها خصوصی پیشبارگیری میشوند. از این اطلاعات فقط برای پیشبارگیری صفحات استفاده میشود و با سایر اطلاعات «حساب Google» شما پیوند داده نمیشود.
حذف
دیدن برگههای دیگر
diff -Nru chromium-150.0.7871.114/chrome/browser/ui/android/strings/translations/android_chrome_strings_fr.xtb chromium-150.0.7871.124/chrome/browser/ui/android/strings/translations/android_chrome_strings_fr.xtb
--- chromium-150.0.7871.114/chrome/browser/ui/android/strings/translations/android_chrome_strings_fr.xtb 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/browser/ui/android/strings/translations/android_chrome_strings_fr.xtb 2026-07-13 21:36:30.000000000 +0000
@@ -1088,7 +1088,7 @@
Recherchez vos fichiers et vos pages dans les téléchargements, à partir du bouton "Plus d'options"
Non lu - Disponible hors connexion
Gérer les onglets ouverts
-Démonstration
+Voir comment faire
a besoin de votre autorisation pour exécuter
Connecté en tant que . Erreur liée au compte Google. Ouvre les paramètres.
L'historique des recherches et d'autres formes d'activité peuvent être enregistrés dans votre compte Google
diff -Nru chromium-150.0.7871.114/chrome/browser/ui/android/strings/translations/android_chrome_strings_ne.xtb chromium-150.0.7871.124/chrome/browser/ui/android/strings/translations/android_chrome_strings_ne.xtb
--- chromium-150.0.7871.114/chrome/browser/ui/android/strings/translations/android_chrome_strings_ne.xtb 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/browser/ui/android/strings/translations/android_chrome_strings_ne.xtb 2026-07-13 21:36:30.000000000 +0000
@@ -1957,7 +1957,7 @@
खतरनाक मानिने साइट, डाउनलोड र एक्स्टेन्सनहरूबाट सुरक्षित राख्छ। कुनै पेजले केही शङ्कास्पद क्रियाकलाप गरेमा उक्त पेजको सामग्रीका URL र बिटहरू Google सुरक्षित ब्राउजिङमा पठाइन्छन्।
कार प्रोफाइल लकविनै जारी राख्ने हो?
बारम्बार हेरिएका
-साइट तथा विज्ञापनदाताहरू उनीहरूका विज्ञापनहरूको पर्फर्मेन्स मापन गर्न सक्छन्
+साइट तथा विज्ञापनदाताहरू आफ्ना विज्ञापनहरूको पर्फर्मेन्स मापन गर्न सक्छन्
Chrome लाई डिफल्ट ब्राउजर बनाउनुहोस्
अन्डू गर्नुहोस्
सारेर यहाँ ल्याउनुहोस्\u2026
diff -Nru chromium-150.0.7871.114/chrome/browser/ui/android/strings/translations/android_chrome_strings_zh-CN.xtb chromium-150.0.7871.124/chrome/browser/ui/android/strings/translations/android_chrome_strings_zh-CN.xtb
--- chromium-150.0.7871.114/chrome/browser/ui/android/strings/translations/android_chrome_strings_zh-CN.xtb 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/browser/ui/android/strings/translations/android_chrome_strings_zh-CN.xtb 2026-07-13 21:36:30.000000000 +0000
@@ -1063,7 +1063,7 @@
以的身份加入
显示近期活动的底部动作条
无法在多个窗口中关闭
-借助增强型保护功能,再添一层保障,有效抵御在线威胁
+借助增强型保护功能,再添一层保障,抵御网络威胁
安全检查
如果 Chrome 发现您使用的某个密码已被发布到网上,就会发出警告。在这个过程中,您的密码和用户名始终加密,任何人员/任何一方(包括 Google)都无法读取。
选择所需的“安全浏览”功能保护级别
diff -Nru chromium-150.0.7871.114/chrome/browser/ui/ash/shelf/chrome_shelf_controller_unittest.cc chromium-150.0.7871.124/chrome/browser/ui/ash/shelf/chrome_shelf_controller_unittest.cc
--- chromium-150.0.7871.114/chrome/browser/ui/ash/shelf/chrome_shelf_controller_unittest.cc 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/browser/ui/ash/shelf/chrome_shelf_controller_unittest.cc 2026-07-13 21:36:30.000000000 +0000
@@ -4793,6 +4793,113 @@
arc_app_test_.PostProfileTearDown();
}
+// Regression test for a heap-use-after-free in ArcAppLauncher::MaybeLaunchApp.
+// When the ArcPlaystoreShortcutShelfItemController owns the ArcAppLauncher via
+// its |playstore_launcher_| member (because the constructor's MaybeLaunchApp
+// returned false), a later observer-driven MaybeLaunchApp call can synchronously
+// replace the shelf item delegate (via AddSpinnerToShelf ->
+// ReplaceShelfItemDelegate), destroying the controller and the launcher while
+// MaybeLaunchApp is still on the stack. The subsequent |app_launched_ = true|
+// write at the end of MaybeLaunchApp is then a UAF write to the freed |this|.
+TEST_F(ChromeShelfControllerArcDefaultAppsTest, PlayStoreDeferredLaunchUAF) {
+ // Add ARC host app to enable Play Store default app.
+ extension_registrar_->AddExtension(arc_support_host_.get());
+ arc_app_test_.PreProfileSetUp();
+ arc_app_test_.PostProfileSetUp(profile());
+ ArcAppListPrefs* const prefs = arc_app_test_.arc_app_list_prefs();
+ EXPECT_TRUE(prefs->IsRegistered(arc::kPlayStoreAppId));
+
+ InitShelfController();
+
+ EnablePlayStore(true);
+
+ // Play Store is registered as a default app with |ready == false| (ARC has
+ // not yet sent an app-list refresh). This is the precondition for entering
+ // the deferred-launch / spinner branch in arc::LaunchAppWithIntent.
+ std::unique_ptr app_info =
+ prefs->GetApp(arc::kPlayStoreAppId);
+ ASSERT_TRUE(app_info);
+ ASSERT_FALSE(app_info->ready);
+
+ // Pin Play Store. Its shelf delegate is an
+ // ArcPlaystoreShortcutShelfItemController (see ChromeShelfItemFactory).
+ PinAppWithIDToShelf(arc::kPlayStoreAppId);
+ EXPECT_TRUE(shelf_controller_->IsAppPinned(arc::kPlayStoreAppId));
+ EXPECT_FALSE(shelf_controller_->GetShelfSpinnerController()->HasApp(
+ arc::kPlayStoreAppId));
+
+ auto* proxy = apps::AppServiceProxyFactory::GetForProfile(profile());
+
+ // Step 1: simulate a state in which the Play Store entry in the
+ // AppRegistryCache has readiness != kReady. A compromised ARCVM controlling
+ // arc::mojom::AppHost can cause this by publishing the Play Store with
+ // |suspended = true|, which makes ArcApps::GetReadiness() return
+ // kDisabledByPolicy. We model that here by publishing the readiness delta
+ // directly to the cache.
+ {
+ std::vector deltas;
+ auto app = std::make_unique(apps::AppType::kArc,
+ arc::kPlayStoreAppId);
+ app->readiness = apps::Readiness::kDisabledByPolicy;
+ deltas.push_back(std::move(app));
+ proxy->OnApps(std::move(deltas), apps::AppType::kArc,
+ /*should_notify_initialized=*/false);
+ }
+
+ // Step 2: simulate the user clicking the pinned Play Store shelf icon.
+ // ArcPlaystoreShortcutShelfItemController::ItemSelected constructs an
+ // ArcAppLauncher with deferred_launch_allowed=true. The constructor's
+ // MaybeLaunchApp returns false because AppRegistryCache readiness is
+ // kDisabledByPolicy (blocked at the kReady/kDisabledByLocalSettings gate),
+ // so the launcher is moved into the controller's |playstore_launcher_|
+ // member -- its lifetime is now tied to the shelf delegate.
+ ash::ShelfItemDelegate* item_delegate =
+ model_->GetShelfItemDelegate(ash::ShelfID(arc::kPlayStoreAppId));
+ ASSERT_TRUE(item_delegate);
+ SelectItem(item_delegate);
+ // The constructor path must NOT have launched (no spinner yet); otherwise
+ // |playstore_launcher_| was never populated and the UAF cannot occur.
+ ASSERT_FALSE(shelf_controller_->GetShelfSpinnerController()->HasApp(
+ arc::kPlayStoreAppId));
+ // Delegate must still be the original ArcPlaystoreShortcutShelfItemController.
+ ASSERT_EQ(item_delegate,
+ model_->GetShelfItemDelegate(ash::ShelfID(arc::kPlayStoreAppId)));
+
+ // Step 3: simulate the ARCVM flipping the Play Store back to unsuspended,
+ // which causes ArcApps to republish it as kReady to the AppRegistryCache.
+ // AppRegistryCache fires OnAppUpdate on the owned ArcAppLauncher, which
+ // re-reads prefs (still ready==false) and calls MaybeLaunchApp(..., kReady).
+ // MaybeLaunchApp then calls proxy->Launch(kPlayStoreAppId) which routes to
+ // ArcApps::Launch -> arc::LaunchAppWithIntent. Because |app_info->ready| is
+ // false, the deferred branch calls AddSpinnerToShelf, which (since the Play
+ // Store item exists with STATUS_CLOSED) calls
+ // ShelfModel::ReplaceShelfItemDelegate. That destroys the
+ // ArcPlaystoreShortcutShelfItemController -- and with it, the ArcAppLauncher
+ // currently executing MaybeLaunchApp. Control then returns to
+ // arc_app_launcher.cc and writes |app_launched_ = true| to the freed object.
+ //
+ // Under ASan this is detected as heap-use-after-free (WRITE of size 1).
+ {
+ std::vector deltas;
+ auto app = std::make_unique(apps::AppType::kArc,
+ arc::kPlayStoreAppId);
+ app->readiness = apps::Readiness::kReady;
+ deltas.push_back(std::move(app));
+ proxy->OnApps(std::move(deltas), apps::AppType::kArc,
+ /*should_notify_initialized=*/false);
+ }
+
+ // If we get here without ASan firing, at least verify the synchronous chain
+ // ran end-to-end (the spinner replaced the Play Store delegate).
+ EXPECT_TRUE(shelf_controller_->GetShelfSpinnerController()->HasApp(
+ arc::kPlayStoreAppId));
+ EXPECT_NE(item_delegate,
+ model_->GetShelfItemDelegate(ash::ShelfID(arc::kPlayStoreAppId)));
+
+ arc_app_test_.PreProfileTearDown();
+ arc_app_test_.PostProfileTearDown();
+}
+
TEST_F(ChromeShelfControllerArcDefaultAppsTest, PlayStoreLaunchMetric) {
extension_registrar_->AddExtension(arc_support_host_.get());
// TODO(crbug.com/454468678): This should be called before profile is created.
diff -Nru chromium-150.0.7871.114/chrome/browser/ui/cocoa/BUILD.gn chromium-150.0.7871.124/chrome/browser/ui/cocoa/BUILD.gn
--- chromium-150.0.7871.114/chrome/browser/ui/cocoa/BUILD.gn 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/browser/ui/cocoa/BUILD.gn 2026-07-13 21:36:30.000000000 +0000
@@ -41,6 +41,7 @@
"share_menu_controller.h",
"simple_message_box_cocoa.h",
"status_icons/status_icon_mac.h",
+ "status_icons/status_icons_features.h",
"tab_contents/web_drag_bookmark_handler_mac.h",
"tab_group_menu_bridge.h",
"tab_menu_bridge.h",
@@ -101,6 +102,7 @@
"share_menu_controller.mm",
"simple_message_box_cocoa.mm",
"status_icons/status_icon_mac.mm",
+ "status_icons/status_icons_features.cc",
"status_icons/status_tray_mac.h",
"status_icons/status_tray_mac.mm",
"tab_contents/web_drag_bookmark_handler_mac.mm",
diff -Nru chromium-150.0.7871.114/chrome/browser/ui/cocoa/status_icons/status_icon_mac.h chromium-150.0.7871.124/chrome/browser/ui/cocoa/status_icons/status_icon_mac.h
--- chromium-150.0.7871.114/chrome/browser/ui/cocoa/status_icons/status_icon_mac.h 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/browser/ui/cocoa/status_icons/status_icon_mac.h 2026-07-13 21:36:30.000000000 +0000
@@ -38,6 +38,7 @@
void SetOpenMenuWithSecondaryClick(
bool open_menu_with_secondary_click) override;
void SetImageTemplate(bool is_template) override;
+ void SetVisible(bool visible);
// StatusIconMenuModel::Observer overrides:
void OnMenuStateChanged() override;
@@ -62,6 +63,8 @@
FRIEND_TEST_ALL_PREFIXES(StatusIconMacTest, CreateMenu);
FRIEND_TEST_ALL_PREFIXES(StatusIconMacTest, MenuToolTip);
FRIEND_TEST_ALL_PREFIXES(StatusIconMacTest, SecondaryClickMenuNoToolTip);
+ FRIEND_TEST_ALL_PREFIXES(StatusIconMacTest,
+ Os26_StatusIconHiddenInFullscreen);
void CreateMenu(ui::MenuModel* model);
diff -Nru chromium-150.0.7871.114/chrome/browser/ui/cocoa/status_icons/status_icon_mac.mm chromium-150.0.7871.124/chrome/browser/ui/cocoa/status_icons/status_icon_mac.mm
--- chromium-150.0.7871.114/chrome/browser/ui/cocoa/status_icons/status_icon_mac.mm 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/browser/ui/cocoa/status_icons/status_icon_mac.mm 2026-07-13 21:36:30.000000000 +0000
@@ -10,10 +10,12 @@
#include
#include "base/check.h"
+#include "base/feature_list.h"
#include "base/mac/mac_util.h"
#include "base/memory/raw_ptr.h"
#include "base/strings/sys_string_conversions.h"
#include "chrome/browser/status_icons/status_tray.h"
+#include "chrome/browser/ui/cocoa/status_icons/status_icons_features.h"
#include "ui/gfx/image/image.h"
#include "ui/gfx/image/image_skia.h"
#import "ui/menus/cocoa/menu_controller.h"
@@ -88,6 +90,31 @@
OBJC_ASSOCIATION_RETAIN);
_statusIcon = icon;
+
+ // Hide the status bar icon when transitioning into fullscreen and show it
+ // after leaving fullscreen. This is a workaround for a macOS 26.x-only bug
+ // where entering fullscreen with a visible status bar icon can cause an
+ // _NSFullScreenTransitionOverlayWindow to remain visible after exiting from
+ // fullscreen (crbug.com/494614152).
+ //
+ // Displaying the icon any earlier (e.g., on NSWindowWillExitFullScreen) may
+ // also trigger this bug, so the icon isn't shown until fullscreen is exited.
+ if (base::FeatureList::IsEnabled(features::kHideStatusIconMacInFullscreen)) {
+ if (@available(macOS 26, *)) {
+ if (!@available(macOS 27, *)) {
+ [NSNotificationCenter.defaultCenter
+ addObserver:self
+ selector:@selector(windowWillEnterFullScreen:)
+ name:NSWindowWillEnterFullScreenNotification
+ object:nil];
+ [NSNotificationCenter.defaultCenter
+ addObserver:self
+ selector:@selector(windowDidExitFullScreen:)
+ name:NSWindowDidExitFullScreenNotification
+ object:nil];
+ }
+ }
+ }
return self;
}
@@ -96,9 +123,14 @@
}
- (void)reset {
+ [NSNotificationCenter.defaultCenter removeObserver:self];
_statusIcon = nullptr;
}
+- (void)dealloc {
+ [NSNotificationCenter.defaultCenter removeObserver:self];
+}
+
- (void)handleClick:(id)sender {
[self handleClick:sender isRightButton:NO];
}
@@ -127,6 +159,18 @@
// never gets here.
}
+- (void)windowWillEnterFullScreen:(NSNotification*)notification {
+ if (_statusIcon) {
+ _statusIcon->SetVisible(false);
+ }
+}
+
+- (void)windowDidExitFullScreen:(NSNotification*)notification {
+ if (_statusIcon) {
+ _statusIcon->SetVisible(true);
+ }
+}
+
@end
StatusIconMac::StatusIconMac() = default;
@@ -196,6 +240,12 @@
[item().button.image setTemplate:is_template];
}
+void StatusIconMac::SetVisible(bool visible) {
+ if (item_) {
+ item_.visible = visible;
+ }
+}
+
void StatusIconMac::OnMenuStateChanged() {
// Recreate menu to reflect changes to the menu model.
CreateMenu(menu_model_);
diff -Nru chromium-150.0.7871.114/chrome/browser/ui/cocoa/status_icons/status_icon_mac_unittest.mm chromium-150.0.7871.124/chrome/browser/ui/cocoa/status_icons/status_icon_mac_unittest.mm
--- chromium-150.0.7871.114/chrome/browser/ui/cocoa/status_icons/status_icon_mac_unittest.mm 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/browser/ui/cocoa/status_icons/status_icon_mac_unittest.mm 2026-07-13 21:36:30.000000000 +0000
@@ -8,7 +8,9 @@
#include "base/strings/string_util.h"
#include "base/strings/sys_string_conversions.h"
+#include "base/test/scoped_feature_list.h"
#include "chrome/browser/status_icons/status_icon_menu_model.h"
+#include "chrome/browser/ui/cocoa/status_icons/status_icons_features.h"
#import "chrome/browser/ui/cocoa/test/cocoa_test_helper.h"
#include "chrome/grit/chrome_unscaled_resources.h"
#include "testing/gmock/include/gmock/gmock.h"
@@ -80,3 +82,56 @@
EXPECT_NSEQ(base::SysUTF16ToNSString(tool_tip), icon->item().button.toolTip);
}
+
+// Regression test for crbug.com/494614152.
+TEST_F(StatusIconMacTest, Os26_StatusIconHiddenInFullscreen) {
+ if (!@available(macOS 26, *)) {
+ GTEST_SKIP() << "This test only applies to macOS 26 (Tahoe).";
+ }
+ if (@available(macOS 27, *)) {
+ GTEST_SKIP() << "This test only applies to macOS 26 (Tahoe).";
+ }
+
+ base::test::ScopedFeatureList feature_list;
+ feature_list.InitAndEnableFeature(features::kHideStatusIconMacInFullscreen);
+
+ std::unique_ptr icon = std::make_unique();
+ ui::ResourceBundle& rb = ui::ResourceBundle::GetSharedInstance();
+ gfx::ImageSkia* image = rb.GetImageSkiaNamed(IDR_STATUS_TRAY_ICON);
+ icon->SetImage(*image);
+ icon->SetVisible(true);
+ EXPECT_TRUE(icon->item().visible);
+
+ // The icon is hidden when notified that the window will enter fullscreen.
+ [NSNotificationCenter.defaultCenter
+ postNotificationName:NSWindowWillEnterFullScreenNotification
+ object:nil];
+ EXPECT_FALSE(icon->item().visible);
+
+ // The icon is shown when the window exits fullscreen.
+ [NSNotificationCenter.defaultCenter
+ postNotificationName:NSWindowDidExitFullScreenNotification
+ object:nil];
+ EXPECT_TRUE(icon->item().visible);
+
+ // If only notified when a window has entered fullscreen, the icon doesn't
+ // change its visibility. This is because
+ // NSWindowWillEnterFullScreenNotification should always precede
+ // NSWindowDidEnterFullScreenNotification.
+ [NSNotificationCenter.defaultCenter
+ postNotificationName:NSWindowDidEnterFullScreenNotification
+ object:nil];
+ EXPECT_TRUE(icon->item().visible);
+
+ // Notification that the window is leaving fullscreen is not enough to display
+ // the icon again. This is to prevent the non-interactive window from
+ // appearing, and will be handled by NSWindowDidExitFullScreenNotification.
+ [NSNotificationCenter.defaultCenter
+ postNotificationName:NSWindowWillEnterFullScreenNotification
+ object:nil];
+ EXPECT_FALSE(icon->item().visible);
+ [NSNotificationCenter.defaultCenter
+ postNotificationName:NSWindowWillExitFullScreenNotification
+ object:nil];
+ EXPECT_FALSE(icon->item().visible);
+}
diff -Nru chromium-150.0.7871.114/chrome/browser/ui/cocoa/status_icons/status_icons_features.cc chromium-150.0.7871.124/chrome/browser/ui/cocoa/status_icons/status_icons_features.cc
--- chromium-150.0.7871.114/chrome/browser/ui/cocoa/status_icons/status_icons_features.cc 1970-01-01 00:00:00.000000000 +0000
+++ chromium-150.0.7871.124/chrome/browser/ui/cocoa/status_icons/status_icons_features.cc 2026-07-13 21:36:30.000000000 +0000
@@ -0,0 +1,13 @@
+// Copyright 2026 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/ui/cocoa/status_icons/status_icons_features.h"
+
+namespace features {
+
+BASE_FEATURE(kHideStatusIconMacInFullscreen,
+ "HideStatusIconMacInFullscreen",
+ base::FEATURE_ENABLED_BY_DEFAULT);
+
+} // namespace features
diff -Nru chromium-150.0.7871.114/chrome/browser/ui/cocoa/status_icons/status_icons_features.h chromium-150.0.7871.124/chrome/browser/ui/cocoa/status_icons/status_icons_features.h
--- chromium-150.0.7871.114/chrome/browser/ui/cocoa/status_icons/status_icons_features.h 1970-01-01 00:00:00.000000000 +0000
+++ chromium-150.0.7871.124/chrome/browser/ui/cocoa/status_icons/status_icons_features.h 2026-07-13 21:36:30.000000000 +0000
@@ -0,0 +1,20 @@
+// Copyright 2026 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_UI_COCOA_STATUS_ICONS_STATUS_ICONS_FEATURES_H_
+#define CHROME_BROWSER_UI_COCOA_STATUS_ICONS_STATUS_ICONS_FEATURES_H_
+
+#include "base/feature_list.h"
+
+namespace features {
+
+// Workaround for macOS 26.x-only bug where displaying a visible status bar icon
+// during fullscreen can cause a frozen window to remain on screen after exiting
+// fullscreen. When enabled, hides all Chrome status tray icons while the
+// browser window is in fullscreen.
+BASE_DECLARE_FEATURE(kHideStatusIconMacInFullscreen);
+
+} // namespace features
+
+#endif // CHROME_BROWSER_UI_COCOA_STATUS_ICONS_STATUS_ICONS_FEATURES_H_
diff -Nru chromium-150.0.7871.114/chrome/browser/ui/views/translate/translate_bubble_view.cc chromium-150.0.7871.124/chrome/browser/ui/views/translate/translate_bubble_view.cc
--- chromium-150.0.7871.114/chrome/browser/ui/views/translate/translate_bubble_view.cc 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/browser/ui/views/translate/translate_bubble_view.cc 2026-07-13 21:36:30.000000000 +0000
@@ -240,6 +240,14 @@
}
views::View* TranslateBubbleView::GetInitiallyFocusedView() {
+ // Focus the selected tab of the tabbed pane (source / target language tabs)
+ // initially when visible. Focus should not fall back to default focus
+ // traversal because it may set focus to the "Choose target language" button.
+ if (tabbed_pane_ && tabbed_pane_->GetVisible() &&
+ tabbed_pane_->GetSelectedTabIndex() !=
+ views::TabbedPaneTabStrip::kNoSelectedTab) {
+ return tabbed_pane_->GetTabAt(tabbed_pane_->GetSelectedTabIndex());
+ }
return GetCurrentView()->GetNextFocusableView();
}
diff -Nru chromium-150.0.7871.114/chrome/browser/ui/views/translate/translate_bubble_view_unittest.cc chromium-150.0.7871.124/chrome/browser/ui/views/translate/translate_bubble_view_unittest.cc
--- chromium-150.0.7871.114/chrome/browser/ui/views/translate/translate_bubble_view_unittest.cc 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/browser/ui/views/translate/translate_bubble_view_unittest.cc 2026-07-13 21:36:30.000000000 +0000
@@ -220,6 +220,19 @@
return nullptr;
}
+views::TabbedPane* GetTabbedPane(views::View* view) {
+ if (views::IsViewClass(view)) {
+ return static_cast(view);
+ }
+ for (views::View* child : view->children()) {
+ views::TabbedPane* tabbed_pane = GetTabbedPane(child);
+ if (tabbed_pane) {
+ return tabbed_pane;
+ }
+ }
+ return nullptr;
+}
+
} // namespace
class TranslateBubbleViewTest : public ChromeViewsTestBase {
@@ -792,8 +805,16 @@
EXPECT_TRUE(list_view->children().empty());
}
+// TODO(crbug.com/527306844): Re-enable this test.
+#if BUILDFLAG(IS_WIN) && !defined(NDEBUG)
+#define MAYBE_ListShowsUpAgainWhenTypingAfterLanguageSelection \
+ DISABLED_ListShowsUpAgainWhenTypingAfterLanguageSelection
+#else
+#define MAYBE_ListShowsUpAgainWhenTypingAfterLanguageSelection \
+ ListShowsUpAgainWhenTypingAfterLanguageSelection
+#endif
TEST_F(TranslateBubbleViewTest,
- ListShowsUpAgainWhenTypingAfterLanguageSelection) {
+ MAYBE_ListShowsUpAgainWhenTypingAfterLanguageSelection) {
base::test::ScopedFeatureList features(translate::kTranslateLanguageSearchUI);
CreateAndShowBubble();
SwitchView(TranslateBubbleModel::VIEW_STATE_TARGET_LANGUAGE);
@@ -861,3 +882,15 @@
EXPECT_EQ(l10n_util::GetStringUTF16(IDS_TRANSLATE_BUBBLE_NO_RESULTS),
static_cast(child)->GetText());
}
+
+TEST_F(TranslateBubbleViewTest, InitialFocus) {
+ base::test::ScopedFeatureList features(translate::kTranslateLanguageSearchUI);
+ CreateAndShowBubble();
+
+ // The initially focused view should be the selected tab (index 0).
+ views::View* initially_focused = bubble_->GetInitiallyFocusedView();
+ ASSERT_TRUE(initially_focused);
+ views::TabbedPane* tabbed_pane = GetTabbedPane(bubble_);
+ ASSERT_TRUE(tabbed_pane);
+ EXPECT_EQ(tabbed_pane->GetTabAt(0), initially_focused);
+}
diff -Nru chromium-150.0.7871.114/chrome/browser/ui/webui/new_tab_page/action_chips/action_chips_generator.cc chromium-150.0.7871.124/chrome/browser/ui/webui/new_tab_page/action_chips/action_chips_generator.cc
--- chromium-150.0.7871.114/chrome/browser/ui/webui/new_tab_page/action_chips/action_chips_generator.cc 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/browser/ui/webui/new_tab_page/action_chips/action_chips_generator.cc 2026-07-13 21:36:30.000000000 +0000
@@ -44,6 +44,7 @@
#include "content/public/browser/web_contents.h"
#include "third_party/omnibox_proto/groups.pb.h"
#include "third_party/omnibox_proto/page_vertical.pb.h"
+#include "third_party/omnibox_proto/suggest_inventory.pb.h"
#include "third_party/omnibox_proto/suggest_template_info.pb.h"
#include "third_party/omnibox_proto/types.pb.h"
#include "ui/base/l10n/l10n_util.h"
@@ -263,6 +264,35 @@
return CreateImageCreationChip(suggestion);
}
+ActionChipPtr CreateStarterChip() {
+ ActionChipPtr chip = ActionChip::New();
+ chip->suggestion = std::string();
+ chip->suggest_template_info = SuggestTemplateInfo::New();
+ chip->suggest_template_info->type_icon = IconType::kSearchLoopWithSparkle;
+ chip->suggest_template_info->primary_text =
+ action_chips::mojom::FormattedString::New();
+ chip->suggest_template_info->primary_text->text =
+ l10n_util::GetStringUTF8(IDS_NTP_ACTION_CHIP_STARTER_HEADING);
+ chip->suggest_template_info->secondary_text =
+ action_chips::mojom::FormattedString::New();
+ chip->suggest_template_info->secondary_text->text =
+ l10n_util::GetStringUTF8(IDS_NTP_ACTION_CHIP_STARTER_BODY);
+ chip->suggest_template_info->preferred_inventory =
+ omnibox::SUGGEST_INVENTORY_AIM_CONVERSATION_STARTERS;
+ return chip;
+}
+
+std::optional CreateStarterChipIfEligible(
+ std::string_view suggestion,
+ const AimEligibilityService* aim_eligibility_service) {
+ if (base::FeatureList::IsEnabled(ntp_features::kNtpStarterChip) &&
+ aim_eligibility_service &&
+ aim_eligibility_service->IsCreateImagesEligible()) {
+ return CreateStarterChip();
+ }
+ return std::nullopt;
+}
+
ActionChipPtr CreateCanvasChip(std::string_view suggestion) {
ActionChipPtr chip = ActionChip::New();
chip->suggestion = std::string();
@@ -336,6 +366,7 @@
using GeneratorFn = const base::FunctionRef(
std::string_view, const AimEligibilityService*)>;
static const GeneratorFn kNewGenerators[] = {
+ &CreateStarterChipIfEligible,
&CreateImageCreationChipIfEligible,
&CreateCanvasChipIfEligible,
&CreateDeepSearchChipIfEligible,
@@ -346,7 +377,8 @@
};
const base::span generators =
- base::FeatureList::IsEnabled(ntp_features::kNtpNextCanvasChip)
+ base::FeatureList::IsEnabled(ntp_features::kNtpNextCanvasChip) ||
+ base::FeatureList::IsEnabled(ntp_features::kNtpStarterChip)
? base::span(kNewGenerators)
: base::span(kOldGenerators);
for (const GeneratorFn generator : generators) {
diff -Nru chromium-150.0.7871.114/chrome/browser/ui/webui/new_tab_page/action_chips/action_chips_generator_unittest.cc chromium-150.0.7871.124/chrome/browser/ui/webui/new_tab_page/action_chips/action_chips_generator_unittest.cc
--- chromium-150.0.7871.114/chrome/browser/ui/webui/new_tab_page/action_chips/action_chips_generator_unittest.cc 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/browser/ui/webui/new_tab_page/action_chips/action_chips_generator_unittest.cc 2026-07-13 21:36:30.000000000 +0000
@@ -239,6 +239,21 @@
return *kInstance;
}
+const ActionChipPtr& GetStaticStarterChip() {
+ static const base::NoDestructor kInstance(CreateActionChip(
+ /*suggestion=*/"",
+ SuggestTemplateInfo::New(IconType::kSearchLoopWithSparkle,
+ CreateFormattedString(l10n_util::GetStringUTF8(
+ IDS_NTP_ACTION_CHIP_STARTER_HEADING)),
+ CreateFormattedString(l10n_util::GetStringUTF8(
+ IDS_NTP_ACTION_CHIP_STARTER_BODY)),
+ std::nullopt,
+ omnibox::SuggestInventory::
+ SUGGEST_INVENTORY_AIM_CONVERSATION_STARTERS),
+ /*tab=*/nullptr));
+ return *kInstance;
+}
+
// A container to store WebContents and its dependency.
// The main usage is to populate TabInterface.
class TabFixture {
@@ -785,6 +800,105 @@
std::abs(net::ERR_TIMED_OUT), 1);
}
+TEST(ActionChipGeneratorTest,
+ NewEndpointFailureFallsBackToStaticChipsWithStarterChip) {
+ const GURL page_url("https://www.google.com/");
+ const std::u16string page_title(u"Google");
+
+ // With Canvas disabled.
+ {
+ EnvironmentFixture env;
+ TabFixture tab_fixture(page_url, page_title);
+ GeneratorFixture generator_fixture;
+
+ EXPECT_CALL(generator_fixture.mock_aim_eligibility_service(),
+ IsCreateImagesEligible())
+ .WillRepeatedly(Return(true));
+ EXPECT_CALL(generator_fixture.mock_aim_eligibility_service(),
+ IsDeepSearchEligible())
+ .WillRepeatedly(Return(false));
+
+ EXPECT_CALL(generator_fixture.mock_service(),
+ GetActionChipSuggestions(Eq(page_title), Eq(page_url), _, _, _))
+ .WillOnce(WithArg<4>(
+ [](base::OnceCallback
+ callback) {
+ std::move(callback).Run(
+ base::unexpected(RemoteSuggestionsServiceSimple::NetworkError{
+ .net_error = net::ERR_TIMED_OUT}));
+ return nullptr;
+ }));
+
+ base::test::ScopedFeatureList list;
+ list.InitWithFeaturesAndParameters(
+ {{ntp_features::kNtpNextFeatures,
+ {{ntp_features::kNtpNextShowStaticTextParam.name, "false"}}}},
+ /*disabled_features=*/{});
+ base::test::ScopedFeatureList starter_chip_feature_list;
+ starter_chip_feature_list.InitAndEnableFeature(
+ ntp_features::kNtpStarterChip);
+
+ base::RunLoop run_loop;
+ std::vector actual;
+ generator_fixture.GenerateActionChips(&tab_fixture.mock_tab(), run_loop,
+ actual);
+ run_loop.Run();
+
+ EXPECT_THAT(actual,
+ ElementsAre(Eq(std::cref(GetStaticStarterChip())),
+ Eq(std::cref(GetStaticImageGenerationChip()))));
+ }
+
+ // With Canvas enabled.
+ {
+ EnvironmentFixture env;
+ TabFixture tab_fixture(page_url, page_title);
+ GeneratorFixture generator_fixture;
+
+ EXPECT_CALL(generator_fixture.mock_aim_eligibility_service(),
+ IsCreateImagesEligible())
+ .WillRepeatedly(Return(true));
+ EXPECT_CALL(generator_fixture.mock_aim_eligibility_service(),
+ IsCanvasEligible())
+ .WillRepeatedly(Return(true));
+ EXPECT_CALL(generator_fixture.mock_aim_eligibility_service(),
+ IsDeepSearchEligible())
+ .WillRepeatedly(Return(false));
+
+ EXPECT_CALL(generator_fixture.mock_service(),
+ GetActionChipSuggestions(Eq(page_title), Eq(page_url), _, _, _))
+ .WillOnce(WithArg<4>(
+ [](base::OnceCallback
+ callback) {
+ std::move(callback).Run(
+ base::unexpected(RemoteSuggestionsServiceSimple::NetworkError{
+ .net_error = net::ERR_TIMED_OUT}));
+ return nullptr;
+ }));
+
+ base::test::ScopedFeatureList list;
+ list.InitWithFeaturesAndParameters(
+ {{ntp_features::kNtpNextFeatures,
+ {{ntp_features::kNtpNextShowStaticTextParam.name, "false"}}},
+ {ntp_features::kNtpNextCanvasChip, {}},
+ {ntp_features::kNtpStarterChip, {}}},
+ /*disabled_features=*/{});
+
+ base::RunLoop run_loop;
+ std::vector actual;
+ generator_fixture.GenerateActionChips(&tab_fixture.mock_tab(), run_loop,
+ actual);
+ run_loop.Run();
+
+ EXPECT_THAT(actual,
+ ElementsAre(Eq(std::cref(GetStaticStarterChip())),
+ Eq(std::cref(GetStaticImageGenerationChip())),
+ Eq(std::cref(GetStaticCanvasChip()))));
+ }
+}
+
TEST(ActionChipGeneratorTest, NewEndpointOptOutReturnsEndpointChips) {
EnvironmentFixture env;
const GURL page_url("https://www.google.com/");
diff -Nru chromium-150.0.7871.114/chrome/browser/ui/webui/new_tab_page/new_tab_page_ui.cc chromium-150.0.7871.124/chrome/browser/ui/webui/new_tab_page/new_tab_page_ui.cc
--- chromium-150.0.7871.114/chrome/browser/ui/webui/new_tab_page/new_tab_page_ui.cc 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/browser/ui/webui/new_tab_page/new_tab_page_ui.cc 2026-07-13 21:36:30.000000000 +0000
@@ -739,6 +739,9 @@
}
if (aim_eligibility_service->IsCreateImagesEligible()) {
num_tools_eligible++;
+ if (base::FeatureList::IsEnabled(ntp_features::kNtpStarterChip)) {
+ num_tools_eligible++;
+ }
}
if (base::FeatureList::IsEnabled(ntp_features::kNtpNextCanvasChip) &&
aim_eligibility_service->IsCanvasEligible()) {
diff -Nru chromium-150.0.7871.114/chrome/browser/ui/webui/searchbox/webui_omnibox_interactive_uitest.cc chromium-150.0.7871.124/chrome/browser/ui/webui/searchbox/webui_omnibox_interactive_uitest.cc
--- chromium-150.0.7871.114/chrome/browser/ui/webui/searchbox/webui_omnibox_interactive_uitest.cc 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/browser/ui/webui/searchbox/webui_omnibox_interactive_uitest.cc 2026-07-13 21:36:30.000000000 +0000
@@ -511,7 +511,9 @@
}
// TODO(crbug.com/505548434, crbug.com/517370516): Flaky on Mac, Win and Linux.
-#if BUILDFLAG(IS_MAC) || BUILDFLAG(IS_WIN) || BUILDFLAG(IS_LINUX)
+// TODO(crbug.com/524892796): Broken on ChromeOS.
+#if BUILDFLAG(IS_MAC) || BUILDFLAG(IS_WIN) || BUILDFLAG(IS_LINUX) || \
+ BUILDFLAG(IS_CHROMEOS)
#define MAYBE_ClassicContextMenuOpensDeepSearch \
DISABLED_ClassicContextMenuOpensDeepSearch
#else
diff -Nru chromium-150.0.7871.114/chrome/browser/ui/webui/side_panel/customize_chrome/customize_chrome_ui.cc chromium-150.0.7871.124/chrome/browser/ui/webui/side_panel/customize_chrome/customize_chrome_ui.cc
--- chromium-150.0.7871.114/chrome/browser/ui/webui/side_panel/customize_chrome/customize_chrome_ui.cc 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/browser/ui/webui/side_panel/customize_chrome/customize_chrome_ui.cc 2026-07-13 21:36:30.000000000 +0000
@@ -315,6 +315,9 @@
}
if (aim_eligibility_service->IsCreateImagesEligible()) {
num_tools_eligible++;
+ if (base::FeatureList::IsEnabled(ntp_features::kNtpStarterChip)) {
+ num_tools_eligible++;
+ }
}
if (base::FeatureList::IsEnabled(ntp_features::kNtpNextCanvasChip) &&
aim_eligibility_service->IsCanvasEligible()) {
diff -Nru chromium-150.0.7871.114/chrome/renderer/accessibility/read_anything/read_anything_app_controller.cc chromium-150.0.7871.124/chrome/renderer/accessibility/read_anything/read_anything_app_controller.cc
--- chromium-150.0.7871.114/chrome/renderer/accessibility/read_anything/read_anything_app_controller.cc 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/renderer/accessibility/read_anything/read_anything_app_controller.cc 2026-07-13 21:36:30.000000000 +0000
@@ -445,9 +445,8 @@
/* recompute_display_nodes= */ true));
pdf_draw_debouncer_ = std::make_unique(
FROM_HERE, base::Milliseconds(kPdfDrawDebounceMs),
- base::BindRepeating(&ReadAnythingAppController::Draw,
- weak_ptr_factory_.GetWeakPtr(),
- /* recompute_display_nodes= */ false));
+ base::BindRepeating(&ReadAnythingAppController::OnPdfDebounceFinished,
+ weak_ptr_factory_.GetWeakPtr()));
renderer_load_triggered_time_ms_ = base::TimeTicks::Now();
distiller_ = std::make_unique(
render_frame,
@@ -778,6 +777,9 @@
model_.set_should_map_rendered_text_to_tree_for_readability(false);
}
model_.ResetAXTreeAnchors();
+ } else if (state == read_anything::mojom::ReadAnythingDistillationState::
+ kDistillationWithContent) {
+ model_.set_page_start_time(base::TimeTicks::Now());
}
}
@@ -806,7 +808,7 @@
model_.SetRootTreeId(tree_id);
model_.SetUkmSourceIdForTree(tree_id, ukm_source_id);
model_.set_is_pdf(is_pdf);
- if (is_pdf) {
+ if (is_pdf && !IsHidden()) {
pdf_draw_debouncer_->Reset();
}
@@ -822,6 +824,7 @@
model_.ClearPendingUpdates();
model_.set_requires_distillation(false);
model_.set_page_finished_loading(false);
+ model_.set_page_start_time(std::nullopt);
// Reset the distillation method for the new page. Every navigation
// starts with the flag-determined distillation method before potentially
@@ -1112,7 +1115,7 @@
}
DrawEmptyState();
}
- } else {
+ } else if (!model_.is_pdf() || !pdf_draw_debouncer_->IsRunning()) {
if (features::IsImmersiveReadAnythingEnabled()) {
SetDistillationState(read_anything::mojom::ReadAnythingDistillationState::
kDistillationWithContent);
@@ -1136,6 +1139,27 @@
ProcessPendingUpdatesIfAllowed();
}
+void ReadAnythingAppController::OnPdfDebounceFinished() {
+ if (IsHidden()) {
+ return;
+ }
+
+ if (model_.is_empty()) {
+ DrawEmptyState();
+ } else {
+ Draw(/*recompute_display_nodes=*/false);
+ }
+
+ if (features::IsImmersiveReadAnythingEnabled()) {
+ SetDistillationState(
+ model_.is_empty()
+ ? read_anything::mojom::ReadAnythingDistillationState::
+ kDistillationEmpty
+ : read_anything::mojom::ReadAnythingDistillationState::
+ kDistillationWithContent);
+ }
+}
+
bool ReadAnythingAppController::PostProcessSelection() {
// It's possible for the active tree to be destroyed in-between when
// OnAXTreeDistilled returns early if the model doesn't contain the active
@@ -1384,6 +1408,8 @@
.SetProperty("lineFocusCursorLine",
&ReadAnythingAppController::LineFocusCursorLine)
.SetProperty("maxLineWidth", &ReadAnythingAppController::MaxLineWidth)
+ .SetProperty("activePresentationState",
+ &ReadAnythingAppController::ActivePresentationState)
.SetProperty("inHiddenPresentationState",
&ReadAnythingAppController::InHiddenPresentationState)
.SetProperty("inSidePanelPresentationState",
@@ -1393,6 +1419,7 @@
&ReadAnythingAppController::InImmersiveOverlayPresentationState)
.SetProperty("speechRate", &ReadAnythingAppController::SpeechRate)
.SetProperty("isGoogleDocs", &ReadAnythingAppController::IsGoogleDocs)
+ .SetProperty("isPdf", &ReadAnythingAppController::IsPdf)
.SetProperty("isImmersiveEnabled",
&ReadAnythingAppController::IsImmersiveEnabled)
.SetProperty("isImprovedReadAloudEnabled",
@@ -1829,6 +1856,10 @@
return a11y::kMaxLineWidth;
}
+int ReadAnythingAppController::ActivePresentationState() const {
+ return std::to_underlying(model_.active_presentation_state());
+}
+
int ReadAnythingAppController::InHiddenPresentationState() const {
return std::to_underlying(
read_anything::mojom::ReadAnythingPresentationState::kInactive);
@@ -2082,6 +2113,10 @@
return model_.IsDocs();
}
+bool ReadAnythingAppController::IsPdf() const {
+ return model_.is_pdf();
+}
+
std::vector ReadAnythingAppController::GetSupportedFonts() {
return model_.supported_fonts();
}
@@ -2845,6 +2880,7 @@
return;
}
+ LogPageDuration();
LogLineFocusSession();
RecordNumSelections();
RecordEstimatedWordsHeard();
@@ -2881,6 +2917,27 @@
}
}
+void ReadAnythingAppController::LogPageDuration() {
+ if (!model_.page_start_time().has_value()) {
+ return;
+ }
+
+ base::TimeDelta duration =
+ base::TimeTicks::Now() - model_.page_start_time().value();
+ model_.set_page_start_time(std::nullopt);
+ std::string page_type = model_.is_pdf() ? "Pdf" : "WebPage";
+ std::string view_mode =
+ (model_.active_presentation_state() ==
+ read_anything::mojom::ReadAnythingPresentationState::kInImmersiveOverlay)
+ ? "FullPage"
+ : "SidePanel";
+ std::string histogram_name =
+ absl::StrFormat("Accessibility.ReadAnything.PageDuration.%sIn%s",
+ page_type.c_str(), view_mode.c_str());
+ base::UmaHistogramCustomTimes(histogram_name, duration, base::Seconds(1),
+ base::Hours(24), /*buckets=*/100);
+}
+
void ReadAnythingAppController::AddLineFocusScrollDistance(int distance) {
if (IsLineFocusEnabled()) {
model_.set_line_focus_scroll_distance(model_.line_focus_scroll_distance() +
diff -Nru chromium-150.0.7871.114/chrome/renderer/accessibility/read_anything/read_anything_app_controller.h chromium-150.0.7871.124/chrome/renderer/accessibility/read_anything/read_anything_app_controller.h
--- chromium-150.0.7871.114/chrome/renderer/accessibility/read_anything/read_anything_app_controller.h 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/renderer/accessibility/read_anything/read_anything_app_controller.h 2026-07-13 21:36:30.000000000 +0000
@@ -268,6 +268,7 @@
int LineFocusStaticLine() const;
int LineFocusCursorLine() const;
int MaxLineWidth() const;
+ int ActivePresentationState() const;
int InHiddenPresentationState() const;
int InSidePanelPresentationState() const;
int InImmersiveOverlayPresentationState() const;
@@ -317,6 +318,7 @@
void OnRenderedTextBlocksAvailable(const std::vector& blocks);
v8::Local GetAXMapping(int index);
bool IsGoogleDocs() const;
+ bool IsPdf() const;
bool IsImmersiveEnabled() const;
bool IsImprovedReadAloudEnabled() const;
bool IsTsTextSegmentationEnabled() const;
@@ -541,6 +543,10 @@
void LogSpeechStop(int source);
+ // Logs the duration a user spent reading a page, broken down by page type
+ // (PDF vs WebPage) and view mode (FullPage overlay vs SidePanel).
+ void LogPageDuration();
+
// Methods for logging line focus session info.
void StartLineFocusSession();
void LogLineFocusSession();
@@ -551,6 +557,8 @@
void OnUrlInformationSet();
+ void OnPdfDebounceFinished();
+
// Stores a screenshot of the page and triggers distillation to record protos.
// This function is not used in production and is behind the disabled
// `DataCollectionModeForScreen2x` flag.
diff -Nru chromium-150.0.7871.114/chrome/renderer/accessibility/read_anything/read_anything_app_controller_browsertest.cc chromium-150.0.7871.124/chrome/renderer/accessibility/read_anything/read_anything_app_controller_browsertest.cc
--- chromium-150.0.7871.114/chrome/renderer/accessibility/read_anything/read_anything_app_controller_browsertest.cc 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/renderer/accessibility/read_anything/read_anything_app_controller_browsertest.cc 2026-07-13 21:36:30.000000000 +0000
@@ -237,6 +237,7 @@
void Distill() { controller_->Distill(); }
void ProcessModelUpdates() { controller_->ProcessModelUpdates(); }
+ bool IsControllerHidden() const { return controller_->IsHidden(); }
void SendBatchUpdates() {
std::vector batch_updates;
@@ -3651,6 +3652,139 @@
EXPECT_EQ(model().unprocessed_selections_from_reading_mode(), 0);
}
+TEST_F(ReadAnythingAppControllerImmersiveTest,
+ OnAXTreeDistilled_PdfDebouncerRunning_DoesNotSetDistillationState) {
+ controller().OnGetPresentationState(
+ read_anything::mojom::ReadAnythingPresentationState::kInImmersiveOverlay);
+ EXPECT_CALL(page_handler_,
+ OnDistillationStateChanged(
+ read_anything::mojom::ReadAnythingDistillationState::
+ kDistillationInProgress))
+ .Times(1);
+
+ // Set up a PDF and start the debouncer.
+ controller().OnActiveAXTreeIDChanged(tree_id_, ukm::kInvalidSourceId,
+ /*is_pdf=*/true);
+ page_handler_.FlushForTesting();
+ Mock::VerifyAndClearExpectations(&page_handler_);
+
+ // Call OnAXTreeDistilled. Since the debouncer is running, distillation state
+ // should NOT change.
+ EXPECT_CALL(page_handler_, OnDistillationStateChanged(testing::_)).Times(0);
+ controller().OnAXTreeDistilled(tree_id_, {1});
+ page_handler_.FlushForTesting();
+}
+
+TEST_F(ReadAnythingAppControllerImmersiveTest,
+ OnPdfDebounceFinished_UpdatesDistillationState) {
+ controller().OnGetPresentationState(
+ read_anything::mojom::ReadAnythingPresentationState::kInImmersiveOverlay);
+ EXPECT_CALL(page_handler_,
+ OnDistillationStateChanged(
+ read_anything::mojom::ReadAnythingDistillationState::
+ kDistillationInProgress))
+ .Times(1);
+
+ // Set up a PDF and start the debouncer.
+ controller().OnActiveAXTreeIDChanged(tree_id_, ukm::kInvalidSourceId,
+ /*is_pdf=*/true);
+ page_handler_.FlushForTesting();
+ Mock::VerifyAndClearExpectations(&page_handler_);
+
+ // Call OnAXTreeDistilled while debouncer is running -> state doesn't change.
+ EXPECT_CALL(page_handler_, OnDistillationStateChanged(testing::_)).Times(0);
+ controller().OnAXTreeDistilled(tree_id_, {1});
+ page_handler_.FlushForTesting();
+ Mock::VerifyAndClearExpectations(&page_handler_);
+
+ // Now, let the debouncer finish.
+ // The distillation state should be updated to kDistillationWithContent.
+ EXPECT_CALL(page_handler_,
+ OnDistillationStateChanged(
+ read_anything::mojom::ReadAnythingDistillationState::
+ kDistillationWithContent))
+ .Times(1);
+ task_environment_.FastForwardBy(base::Milliseconds(500));
+ page_handler_.FlushForTesting();
+}
+
+TEST_F(ReadAnythingAppControllerImmersiveTest,
+ OnActiveAXTreeIDChanged_DoesNotStartDebouncerIfHidden) {
+ // Start in inactive state (hidden).
+ controller().OnGetPresentationState(
+ read_anything::mojom::ReadAnythingPresentationState::kInactive);
+ EXPECT_TRUE(IsControllerHidden());
+ EXPECT_CALL(page_handler_,
+ OnDistillationStateChanged(
+ read_anything::mojom::ReadAnythingDistillationState::
+ kDistillationInProgress))
+ .Times(1);
+
+ controller().OnActiveAXTreeIDChanged(tree_id_, ukm::kInvalidSourceId,
+ /*is_pdf=*/true);
+ page_handler_.FlushForTesting();
+
+ // The debouncer should NOT be running.
+ EXPECT_CALL(page_handler_, OnDistillationStateChanged(testing::_)).Times(0);
+ task_environment_.FastForwardBy(base::Milliseconds(500));
+ page_handler_.FlushForTesting();
+}
+
+TEST_F(ReadAnythingAppControllerImmersiveTest,
+ OnPdfDebounceFinished_DoesNotDrawOrUpdateStateIfHidden) {
+ // Start in immersive overlay (not hidden).
+ controller().OnGetPresentationState(
+ read_anything::mojom::ReadAnythingPresentationState::kInImmersiveOverlay);
+ EXPECT_FALSE(IsControllerHidden());
+
+ static constexpr ui::AXNodeID kId = 4;
+ ui::AXNodeData node;
+ node.id = kId;
+ SendUpdateWithNodes({std::move(node)});
+ model().Reset({kId});
+ EXPECT_CALL(page_handler_,
+ OnDistillationStateChanged(
+ read_anything::mojom::ReadAnythingDistillationState::
+ kDistillationInProgress))
+ .Times(1);
+
+ // Set up a PDF and start the debouncer.
+ controller().OnActiveAXTreeIDChanged(tree_id_, ukm::kInvalidSourceId,
+ /*is_pdf=*/true);
+ page_handler_.FlushForTesting();
+ Mock::VerifyAndClearExpectations(&page_handler_);
+
+ // Deactivate (hide) the controller.
+ controller().OnGetPresentationState(
+ read_anything::mojom::ReadAnythingPresentationState::kInactive);
+ EXPECT_TRUE(IsControllerHidden());
+
+ // Distillation state should not be changed by OnPdfDebounceFinished if
+ // hidden.
+ EXPECT_CALL(
+ page_handler_,
+ OnDistillationStateChanged(
+ read_anything::mojom::ReadAnythingDistillationState::kNotAttempted))
+ .Times(1);
+ controller().SetDistillationState(
+ read_anything::mojom::ReadAnythingDistillationState::kNotAttempted);
+ page_handler_.FlushForTesting();
+ Mock::VerifyAndClearExpectations(&page_handler_);
+
+ // We expect NO calls to OnDistillationStateChanged when the timer fires.
+ EXPECT_CALL(page_handler_, OnDistillationStateChanged(testing::_)).Times(0);
+
+ // Fast forward to trigger the debouncer.
+ task_environment_.FastForwardBy(base::Milliseconds(500));
+ page_handler_.FlushForTesting();
+
+ // Verification: The display nodes should still be empty (Draw wasn't called)
+ // and the distillation state remains kNotAttempted.
+ EXPECT_FALSE(model().display_node_ids().contains(kId));
+ EXPECT_EQ(model().distillation_state(),
+ read_anything::mojom::ReadAnythingDistillationState::kNotAttempted);
+}
+
class ReadAnythingAppControllerV8SegmentationTest
: public ReadAnythingAppControllerTest {
public:
@@ -5506,3 +5640,47 @@
EXPECT_FALSE(model().requires_readability_distillation());
EXPECT_TRUE(controller().GetDomDistillerContentHtml().empty());
}
+
+TEST_F(ReadAnythingAppControllerTest, LogPageDuration_PdfInSidePanel) {
+ base::HistogramTester histograms;
+
+ model().set_is_pdf(true);
+ model().set_active_presentation_state(
+ read_anything::mojom::ReadAnythingPresentationState::kInSidePanel);
+ model().set_page_start_time(base::TimeTicks::Now() - base::Seconds(15));
+
+ EXPECT_CALL(page_handler_, AckReadingModeHidden());
+ controller().OnReadingModeHidden(true);
+
+ histograms.ExpectTotalCount(
+ "Accessibility.ReadAnything.PageDuration.PdfInSidePanel", 1);
+ EXPECT_FALSE(model().page_start_time().has_value());
+}
+
+TEST_F(ReadAnythingAppControllerTest, LogPageDuration_WebPageInFullPage) {
+ base::HistogramTester histograms;
+
+ model().set_is_pdf(false);
+ model().set_active_presentation_state(
+ read_anything::mojom::ReadAnythingPresentationState::kInImmersiveOverlay);
+ model().set_page_start_time(base::TimeTicks::Now() - base::Seconds(30));
+
+ controller().OnTabWillDetach();
+
+ histograms.ExpectTotalCount(
+ "Accessibility.ReadAnything.PageDuration.WebPageInFullPage", 1);
+ EXPECT_FALSE(model().page_start_time().has_value());
+}
+
+TEST_F(ReadAnythingAppControllerTest, LogPageDuration_NoStartTimeNoLog) {
+ base::HistogramTester histograms;
+
+ EXPECT_FALSE(model().page_start_time().has_value());
+
+ controller().OnTabWillDetach();
+
+ histograms.ExpectTotalCount(
+ "Accessibility.ReadAnything.PageDuration.PdfInSidePanel", 0);
+ histograms.ExpectTotalCount(
+ "Accessibility.ReadAnything.PageDuration.WebPageInFullPage", 0);
+}
diff -Nru chromium-150.0.7871.114/chrome/renderer/accessibility/read_anything/read_anything_app_model.h chromium-150.0.7871.124/chrome/renderer/accessibility/read_anything/read_anything_app_model.h
--- chromium-150.0.7871.114/chrome/renderer/accessibility/read_anything/read_anything_app_model.h 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chrome/renderer/accessibility/read_anything/read_anything_app_model.h 2026-07-13 21:36:30.000000000 +0000
@@ -274,6 +274,13 @@
words_distilled_ = words_distilled;
}
+ std::optional page_start_time() const {
+ return page_start_time_;
+ }
+ void set_page_start_time(std::optional time) {
+ page_start_time_ = time;
+ }
+
std::optional line_focus_session_start_time() const {
return line_focus_session_start_time_;
}
@@ -976,6 +983,10 @@
int words_heard_ = 0;
int words_distilled_ = 0;
+ // The time when the page successfully distills. Used to measure the time
+ // spent on a page with Reading mode.
+ std::optional page_start_time_;
+
// Line focus session information. Used for logging.
std::optional line_focus_session_start_time_;
int line_focus_mouse_distance_ = 0;
diff -Nru chromium-150.0.7871.114/chromeos/CHROMEOS_LKGM chromium-150.0.7871.124/chromeos/CHROMEOS_LKGM
--- chromium-150.0.7871.114/chromeos/CHROMEOS_LKGM 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chromeos/CHROMEOS_LKGM 2026-07-13 21:36:30.000000000 +0000
@@ -1 +1 @@
-16700.38.0
\ No newline at end of file
+16700.45.0
\ No newline at end of file
diff -Nru chromium-150.0.7871.114/chromeos/ash/experiences/arc/crash_collector/arc_crash_collector_bridge.cc chromium-150.0.7871.124/chromeos/ash/experiences/arc/crash_collector/arc_crash_collector_bridge.cc
--- chromium-150.0.7871.114/chromeos/ash/experiences/arc/crash_collector/arc_crash_collector_bridge.cc 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chromeos/ash/experiences/arc/crash_collector/arc_crash_collector_bridge.cc 2026-07-13 21:36:30.000000000 +0000
@@ -15,6 +15,7 @@
#include "base/logging.h"
#include "base/no_destructor.h"
#include "base/process/launch.h"
+#include "base/strings/string_util.h"
#include "base/strings/stringprintf.h"
#include "base/task/task_traits.h"
#include "base/task/thread_pool.h"
@@ -86,6 +87,22 @@
}
}
+// Only allow visible ASCII characters as parameters for crash reporter.
+const char kValidCharacters[] =
+ "!\"#$%&'()*+,-./"
+ "0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`"
+ "abcdefghijklmnopqrstuvwxyz{|}~";
+const size_t kMaxValidLength = 255;
+bool ValidateString(const std::string& str) {
+ if (str.empty() || str.length() > kMaxValidLength) {
+ return false;
+ }
+ if (!base::ContainsOnlyChars(str, kValidCharacters)) {
+ return false;
+ }
+ return true;
+}
+
} // namespace
namespace arc {
@@ -141,6 +158,10 @@
void ArcCrashCollectorBridge::DumpCrash(const std::string& type,
mojo::ScopedHandle pipe,
std::optional uptime) {
+ if (!ValidateString(type)) {
+ LOG(ERROR) << "Invalid type " << type;
+ return;
+ }
base::ThreadPool::PostTask(
FROM_HERE, {base::WithBaseSyncPrimitives()},
base::BindOnce(&RunJavaCrashReporter, type,
@@ -152,6 +173,10 @@
int32_t pid,
int64_t timestamp,
mojo::ScopedHandle minidump_fd) {
+ if (!ValidateString(exec_name)) {
+ LOG(ERROR) << "Invalid exec_name " << exec_name;
+ return;
+ }
base::ThreadPool::PostTask(
FROM_HERE, {base::WithBaseSyncPrimitives()},
base::BindOnce(
@@ -175,10 +200,26 @@
const std::string& board,
const std::string& cpu_abi,
const std::optional& fingerprint) {
- device_ = device;
- board_ = board;
- cpu_abi_ = cpu_abi;
- fingerprint_ = fingerprint;
+ if (ValidateString(device)) {
+ device_ = device;
+ } else {
+ LOG(ERROR) << "Invalid device " << device;
+ }
+ if (ValidateString(board)) {
+ board_ = board;
+ } else {
+ LOG(ERROR) << "Invalid board " << board;
+ }
+ if (ValidateString(cpu_abi)) {
+ cpu_abi_ = cpu_abi;
+ } else {
+ LOG(ERROR) << "Invalid cpu_abi " << cpu_abi;
+ }
+ if (!fingerprint || ValidateString(fingerprint.value())) {
+ fingerprint_ = fingerprint;
+ } else {
+ LOG(ERROR) << "Invalid fingerprint " << fingerprint.value();
+ }
}
std::vector ArcCrashCollectorBridge::CreateCrashReporterArgs() {
diff -Nru chromium-150.0.7871.114/chromeos/ash/experiences/arc/crash_collector/arc_crash_collector_bridge_unittest.cc chromium-150.0.7871.124/chromeos/ash/experiences/arc/crash_collector/arc_crash_collector_bridge_unittest.cc
--- chromium-150.0.7871.114/chromeos/ash/experiences/arc/crash_collector/arc_crash_collector_bridge_unittest.cc 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chromeos/ash/experiences/arc/crash_collector/arc_crash_collector_bridge_unittest.cc 2026-07-13 21:36:30.000000000 +0000
@@ -47,6 +47,19 @@
std::optional("fingerprint"));
}
+// Tests that SetBuildProperties doesn't crash even if given invalid parameters.
+TEST_F(ArcCrashCollectorBridgeTest, SetInvalidBuildProperties) {
+ ASSERT_NE(nullptr, bridge());
+ bridge()->SetBuildProperties("device\nwith\nnewline", "board", "cpu_abi",
+ std::optional("fingerprint"));
+ bridge()->SetBuildProperties("device", "board with space", "cpu_abi",
+ std::optional("fingerprint"));
+ bridge()->SetBuildProperties("device", "board", "cpu_abi\twith\ttab",
+ std::optional("fingerprint"));
+ bridge()->SetBuildProperties("device\nwith\nnewline", "board", "cpu_abi",
+ std::optional("finger\nprint"));
+}
+
// Tests that DumpCrash doesn't crash.
// TODO(khmel): Test the behavior beyond just "no crash".
TEST_F(ArcCrashCollectorBridgeTest, DumpCrash) {
@@ -56,6 +69,15 @@
bridge()->DumpCrash("type", mojo::ScopedHandle(), std::nullopt);
}
+// Tests that DumpCrash doesn't crash with an invalid crash type.
+// TODO(khmel): Test the behavior beyond just "no crash".
+TEST_F(ArcCrashCollectorBridgeTest, DumpCrashInvalidCrashType) {
+ ASSERT_NE(nullptr, bridge());
+ bridge()->SetBuildProperties("device", "board", "cpu_abi",
+ std::optional());
+ bridge()->DumpCrash("bad\ntype", mojo::ScopedHandle(), std::nullopt);
+}
+
// Tests that DumpNativeCrash doesn't crash.
// TODO(khmel): Test the behavior beyond just "no crash".
TEST_F(ArcCrashCollectorBridgeTest, DumpNativeCrash) {
@@ -66,6 +88,15 @@
mojo::ScopedHandle());
}
+// Tests that DumpNativeCrash doesn't crash.
+// TODO(khmel): Test the behavior beyond just "no crash".
+TEST_F(ArcCrashCollectorBridgeTest, DumpNativeCrashInvalidExecName) {
+ ASSERT_NE(nullptr, bridge());
+ bridge()->SetBuildProperties("device", "board", "cpu_abi",
+ std::optional());
+ bridge()->DumpNativeCrash("bad\nexec\bname", getpid(), /*timestamp=*/42,
+ mojo::ScopedHandle());
+}
// Tests that DumpKernelCrash doesn't crash.
// TODO(khmel): Test the behavior beyond just "no crash".
TEST_F(ArcCrashCollectorBridgeTest, DumpKernelCrash) {
diff -Nru chromium-150.0.7871.114/chromeos/profiles/arm.afdo.newest.txt chromium-150.0.7871.124/chromeos/profiles/arm.afdo.newest.txt
--- chromium-150.0.7871.114/chromeos/profiles/arm.afdo.newest.txt 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chromeos/profiles/arm.afdo.newest.txt 2026-07-13 21:36:30.000000000 +0000
@@ -1 +1 @@
-chromeos-chrome-arm-none-150-7871.57-1783303824-benchmark-150.0.7871.96-r1-redacted.afdo.xz
+chromeos-chrome-arm-none-150-7871.57-1783303824-benchmark-150.0.7871.120-r1-redacted.afdo.xz
diff -Nru chromium-150.0.7871.114/chromeos/profiles/atom.afdo.newest.txt chromium-150.0.7871.124/chromeos/profiles/atom.afdo.newest.txt
--- chromium-150.0.7871.114/chromeos/profiles/atom.afdo.newest.txt 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chromeos/profiles/atom.afdo.newest.txt 2026-07-13 21:36:30.000000000 +0000
@@ -1 +1 @@
-chromeos-chrome-amd64-atom-150-7871.57-1783314180-benchmark-150.0.7871.96-r1-redacted.afdo.xz
+chromeos-chrome-amd64-atom-150-7871.118-1783914765-benchmark-150.0.7871.123-r1-redacted.afdo.xz
diff -Nru chromium-150.0.7871.114/chromeos/profiles/bigcore.afdo.newest.txt chromium-150.0.7871.124/chromeos/profiles/bigcore.afdo.newest.txt
--- chromium-150.0.7871.114/chromeos/profiles/bigcore.afdo.newest.txt 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/chromeos/profiles/bigcore.afdo.newest.txt 2026-07-13 21:36:30.000000000 +0000
@@ -1 +1 @@
-chromeos-chrome-amd64-bigcore-150-7871.57-1783310501-benchmark-150.0.7871.96-r1-redacted.afdo.xz
+chromeos-chrome-amd64-bigcore-150-7871.118-1783912225-benchmark-150.0.7871.123-r1-redacted.afdo.xz
diff -Nru chromium-150.0.7871.114/components/browser_ui/strings/android/translations/browser_ui_strings_es.xtb chromium-150.0.7871.124/components/browser_ui/strings/android/translations/browser_ui_strings_es.xtb
--- chromium-150.0.7871.114/components/browser_ui/strings/android/translations/browser_ui_strings_es.xtb 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/components/browser_ui/strings/android/translations/browser_ui_strings_es.xtb 2026-07-13 21:36:30.000000000 +0000
@@ -449,7 +449,7 @@
bloqueado
Hoja inferior de las tarjetas de la página Nueva pestaña
Si se activa, los sitios pueden solicitar permiso para acceder a otras aplicaciones y servicios de este dispositivo. Si se desactiva, los sitios no pueden acceder a otras aplicaciones y servicios de este dispositivo.
-Muéstrame cómo
+Ver cómo
Descargas automáticas
Ignora la solicitud de un sitio web para no ampliar la imagen
Los sitios son más lentos, pero más seguros
diff -Nru chromium-150.0.7871.114/components/browser_ui/strings/android/translations/browser_ui_strings_fr.xtb chromium-150.0.7871.124/components/browser_ui/strings/android/translations/browser_ui_strings_fr.xtb
--- chromium-150.0.7871.114/components/browser_ui/strings/android/translations/browser_ui_strings_fr.xtb 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/components/browser_ui/strings/android/translations/browser_ui_strings_fr.xtb 2026-07-13 21:36:30.000000000 +0000
@@ -449,7 +449,7 @@
bloquée
Bottom sheet des cartes de la page Nouvel onglet
Lorsque cette option est activée, les sites peuvent demander à accéder à d'autres applis et services sur cet appareil. Lorsque cette option est désactivée, les sites ne peuvent pas accéder à d'autres applis ni services sur cet appareil.
-Démonstration
+Voir comment faire
Téléchargements automatiques
Ignore la demande d'un site d'empêcher les zooms avant
Les sites sont plus lents, mais plus sécurisés
diff -Nru chromium-150.0.7871.114/components/pdf/renderer/pdf_accessibility_tree_builder_heuristic.cc chromium-150.0.7871.124/components/pdf/renderer/pdf_accessibility_tree_builder_heuristic.cc
--- chromium-150.0.7871.114/components/pdf/renderer/pdf_accessibility_tree_builder_heuristic.cc 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/components/pdf/renderer/pdf_accessibility_tree_builder_heuristic.cc 2026-07-13 21:36:30.000000000 +0000
@@ -13,9 +13,12 @@
#include "base/check_op.h"
#include "base/feature_list.h"
#include "base/memory/raw_ref.h"
+#include "base/metrics/histogram_functions.h"
+#include "base/timer/elapsed_timer.h"
#include "components/pdf/renderer/pdf_accessibility_tree_builder.h"
#include "pdf/accessibility_structs.h"
#include "pdf/pdf_features.h"
+#include "third_party/abseil-cpp/absl/cleanup/cleanup.h"
#include "ui/accessibility/ax_enums.mojom-shared.h"
#include "ui/accessibility/ax_node_data.h"
#include "ui/gfx/geometry/point_f.h"
@@ -245,6 +248,11 @@
: builder_(builder) {}
void PdfAccessibilityTreeBuilderHeuristic::BuildPageTree() {
+ base::ElapsedTimer timer;
+ absl::Cleanup run_on_exit = [&timer] {
+ base::UmaHistogramTimes("Accessibility.PDF.Heuristic.BuildPageTreeTime",
+ timer.Elapsed());
+ };
ComputeParagraphAndHeadingThresholds(builder_->text_runs(),
&heading_font_size_threshold_,
¶graph_spacing_threshold_);
diff -Nru chromium-150.0.7871.114/components/policy/core/common/policy_loader_win.cc chromium-150.0.7871.124/components/policy/core/common/policy_loader_win.cc
--- chromium-150.0.7871.114/components/policy/core/common/policy_loader_win.cc 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/components/policy/core/common/policy_loader_win.cc 2026-07-13 21:36:30.000000000 +0000
@@ -173,6 +173,10 @@
base::UmaHistogramBoolean("EnterpriseCheck.IsManagedOrEnterpriseDevice",
base::IsManagedOrEnterpriseDevice());
+ const bool is_enterprise_device2 =
+ base::win::IsEnrolledToDomain() || base::win::IsDeviceJoinedToAzureAD();
+ base::UmaHistogramBoolean("EnterpriseCheck.IsManagedOrEnterpriseDevice2",
+ base::IsManagedDevice() || is_enterprise_device2);
base::UmaHistogramBoolean("EnterpriseCheck.IsDomainJoined", IsDomainJoined());
base::UmaHistogramBoolean("EnterpriseCheck.InDomain",
base::win::IsEnrolledToDomain());
@@ -180,8 +184,12 @@
base::win::IsDeviceRegisteredWithManagement());
base::UmaHistogramBoolean("EnterpriseCheck.IsEnterpriseUser",
base::IsEnterpriseDevice());
+ base::UmaHistogramBoolean("EnterpriseCheck.IsEnterpriseUser2",
+ is_enterprise_device2);
base::UmaHistogramBoolean("EnterpriseCheck.IsJoinedToAzureAD",
base::win::IsJoinedToAzureAD());
+ base::UmaHistogramBoolean("EnterpriseCheck.IsJoinedToAzureAD2",
+ base::win::IsDeviceJoinedToAzureAD());
{
WindowsProfileType profile_type = kApiFailure;
diff -Nru chromium-150.0.7871.114/components/policy/resources/policy_templates_it.xtb chromium-150.0.7871.124/components/policy/resources/policy_templates_it.xtb
--- chromium-150.0.7871.114/components/policy/resources/policy_templates_it.xtb 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/components/policy/resources/policy_templates_it.xtb 2026-07-13 21:36:30.000000000 +0000
@@ -6427,7 +6427,7 @@
Se viene impostata su Disattivata, la proprietà CSS "zoom" utilizzerà il comportamento precedente pre-standardizzato.
-Questa policy è una sospensione temporanea per consentire la migrazione dei contenuti web al nuovo comportamento. Esiste anche una prova dell'origine ("DisableStandardizedBrowserZoom") che corrisponde al comportamento quando questa policy è impostata su Disattivata. Questa policy verrà rimossa e il comportamento "Attivata" verrà reso permanente nella versione 134.
+Questa policy è una sospensione temporanea per consentire la migrazione dei contenuti web al nuovo comportamento. Esiste anche un origin trial ("DisableStandardizedBrowserZoom") che corrisponde al comportamento quando questa policy è impostata su Disattivata. Questa policy verrà rimossa e il comportamento "Attivata" verrà reso permanente nella versione 134.
Utilizza UsbDeviceId nel nuovo codice.
Consenti l'unione delle policy del dizionario provenienti da origini diverse
Consenti l'autenticazione per HTTP
diff -Nru chromium-150.0.7871.114/components/search/ntp_features.cc chromium-150.0.7871.124/components/search/ntp_features.cc
--- chromium-150.0.7871.114/components/search/ntp_features.cc 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/components/search/ntp_features.cc 2026-07-13 21:36:30.000000000 +0000
@@ -239,6 +239,9 @@
// If enabled, the Canvas action chip will be shown.
BASE_FEATURE(kNtpNextCanvasChip, base::FEATURE_DISABLED_BY_DEFAULT);
+// If enabled, the starter chip will be shown.
+BASE_FEATURE(kNtpStarterChip, base::FEATURE_DISABLED_BY_DEFAULT);
+
// If enabled, the OGB loader will request for the async bar parts payload type.
BASE_FEATURE(kNtpOneGoogleBarAsyncBarParts, base::FEATURE_DISABLED_BY_DEFAULT);
diff -Nru chromium-150.0.7871.114/components/search/ntp_features.h chromium-150.0.7871.124/components/search/ntp_features.h
--- chromium-150.0.7871.114/components/search/ntp_features.h 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/components/search/ntp_features.h 2026-07-13 21:36:30.000000000 +0000
@@ -73,6 +73,7 @@
BASE_DECLARE_FEATURE(kNtpMicrosoftAuthenticationModule);
BASE_DECLARE_FEATURE(kNtpNextFeatures);
BASE_DECLARE_FEATURE(kNtpNextCanvasChip);
+BASE_DECLARE_FEATURE(kNtpStarterChip);
BASE_DECLARE_FEATURE(kNtpOneGoogleBarAsyncBarParts);
BASE_DECLARE_FEATURE(kNtpFooter);
BASE_DECLARE_FEATURE(kNtpTabGroupsModule);
diff -Nru chromium-150.0.7871.114/components/strings/components_google_chrome_strings_de.xtb chromium-150.0.7871.124/components/strings/components_google_chrome_strings_de.xtb
--- chromium-150.0.7871.114/components/strings/components_google_chrome_strings_de.xtb 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/components/strings/components_google_chrome_strings_de.xtb 2026-07-13 21:36:30.000000000 +0000
@@ -27,7 +27,7 @@
diese Option für eine verbesserte Leistung wieder zu aktivieren.
Öffne das Chrome-Menü > „“ > „“ > „“ > „Netzwerk und Internet“ > „Proxy“ und hebe die Auswahl von „Einstellungen automatisch erkennen“ auf.
Dies ist eine sichere Chrome-Seite
-Chrome-Tipp: Erweitertes Safe Browsing
+Chrome-Tipp: erweitertes Safe Browsing
Chrome wird durch das Open-Source-Projekt Chromium ermöglicht.
Chrome wird auch durch andere Open-Source-Software ermöglicht.
Google Chrome versucht, die Einstellungen für das Ausfüllen von Zahlungsmethoden zu ändern.
diff -Nru chromium-150.0.7871.114/components/strings/components_google_chrome_strings_ru.xtb chromium-150.0.7871.124/components/strings/components_google_chrome_strings_ru.xtb
--- chromium-150.0.7871.114/components/strings/components_google_chrome_strings_ru.xtb 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/components/strings/components_google_chrome_strings_ru.xtb 2026-07-13 21:36:30.000000000 +0000
@@ -12,7 +12,7 @@
Эти страницы, предназначенные для разработчиков Chrome, могут тестироваться или поддерживаться нерегулярно. Чтобы включить их, перейдите по адресу chrome://chrome-urls, нажмите на кнопку включения отладочных страниц, а затем вернитесь сюда.
Разрешите доступ к сети для Chrome
в настройках брандмауэра или антивируса.
-Объектив для поиска
+Совет от Chrome: ищите с Объективом
Перейдите в раздел "Приложения > Системные настройки > Сеть", выберите активную сеть, нажмите "Подробнее" и снимите флажки напротив всех прокси-серверов, которые используются.
Эта страница была заблокирована браузером Chrome.
Выберите
@@ -36,7 +36,7 @@
Сеть и интернет > Прокси-сервер
и отключите параметр "Определять параметры автоматически".
Вы просматриваете безопасную страницу Chrome
-Используйте улучшенный Безопасный просмотр
+Совет от Chrome: улучшенный Безопасный просмотр
Браузер Chrome создан на основе проекта Chromium с открытым исходным кодом.
Chrome также работает благодаря другому программному обеспечению с открытым исходным кодом.
Google Chrome пытается изменить настройки автоматического ввода платежных данных.
diff -Nru chromium-150.0.7871.114/components/strings/components_strings_be.xtb chromium-150.0.7871.124/components/strings/components_strings_be.xtb
--- chromium-150.0.7871.114/components/strings/components_strings_be.xtb 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/components/strings/components_strings_be.xtb 2026-07-13 21:36:30.000000000 +0000
@@ -2240,7 +2240,7 @@
Відэа ў фармаце MP4
Піцэрыі
Канверт Kaku 4
-Каб аўтаматычна запоўніць спосабы аплаты, пацвердзіце сваю асобу
+Спраўджваць асобу для аўтаматычнага запаўнення спосабаў аплаты
A7
Шыфраваць сінхранізаваныя паролі з дапамогай даных Уліковага запісу Google
Няправільны URL-адрас. Патрабуецца URL-адрас са стандартнай структурай, напрыклад http://example.com ці https://example.com.
diff -Nru chromium-150.0.7871.114/components/strings/components_strings_de.xtb chromium-150.0.7871.124/components/strings/components_strings_de.xtb
--- chromium-150.0.7871.114/components/strings/components_strings_de.xtb 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/components/strings/components_strings_de.xtb 2026-07-13 21:36:30.000000000 +0000
@@ -2457,7 +2457,7 @@
Versionsstring in Zwischenablage kopiert
Ein Elternteil oder Erziehungsberechtigter muss dir erlauben, diese Website zu besuchen.
Heimwerken
-Du kannst deine Passwörter speichern und automatisch ausfüllen lassen, um dich einfacher auf Websites und in Apps anzumelden
+Du kannst deine Passwörter speichern und automatisch eintragen lassen, um dich einfacher auf Websites und in Apps anzumelden
Zum Einblenden des Cursors || + || drücken
Aktualisiere Chrome, um deine geteilten Tabgruppen weiterhin verwenden zu können
Brillen
diff -Nru chromium-150.0.7871.114/components/strings/components_strings_en-GB.xtb chromium-150.0.7871.124/components/strings/components_strings_en-GB.xtb
--- chromium-150.0.7871.114/components/strings/components_strings_en-GB.xtb 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/components/strings/components_strings_en-GB.xtb 2026-07-13 21:36:30.000000000 +0000
@@ -4202,7 +4202,7 @@
Try the following tips:
From your administrator: ''
Reload and show anyway
-New tab
+New Tab
Biological sciences
Use a passkey
Mergers and acquisitions
diff -Nru chromium-150.0.7871.114/components/strings/components_strings_es.xtb chromium-150.0.7871.124/components/strings/components_strings_es.xtb
--- chromium-150.0.7871.114/components/strings/components_strings_es.xtb 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/components/strings/components_strings_es.xtb 2026-07-13 21:36:30.000000000 +0000
@@ -962,7 +962,7 @@
Servicios jurídicos
Otros datos de Google
Sensores de luz y movimiento no permitidos
-Ve a Ajustes
+Ir a Ajustes
La URL de búsqueda no es válida.
En tu cuenta de Google ()
Mensaje de la extensión
@@ -1843,7 +1843,7 @@
Consulta los términos de aquí
Tus archivos locales se eliminarán dentro de minutos
Ciencia
-Muéstrame cómo
+Ver cómo
No compartir
No se permite copiar contenido de este sitio
Elige el idioma al que quieres traducir
@@ -2967,7 +2967,7 @@
Error al cargar la configuración de la política
Botón Preguntar a Google sobre esta página, actívalo para preguntar a Google sobre esta página
Token de administración de dispositivos no válido
-Muéstrame cómo
+Ver cómo
Contenido engañoso bloqueado.
Móvil
Términos y condiciones del vendedor
@@ -4149,7 +4149,7 @@
Adelante
Restricciones básicas del certificado
Sobre italiano
-Función Autocompletar mejorada
+Función Autocompletar mejorado
Suministros para escuelas y equipamiento para aulas
, pulsa Tabulador y, después, Intro para cerrar el consejo de Chrome.
Comercio e industria
@@ -4754,7 +4754,7 @@
Más información:
Micrófono permitido esta vez
-Guarda tu información en y realiza tareas más rápido, como rellenar formularios en los productos de Google. Puedes en de .
+Guarda tu información en y completa tareas más rápido, como rellenar formularios en los productos de Google. Puedes en de .
Cambiar
¿Permitir la anulación del teclado?
diff -Nru chromium-150.0.7871.114/components/strings/components_strings_fa.xtb chromium-150.0.7871.124/components/strings/components_strings_fa.xtb
--- chromium-150.0.7871.114/components/strings/components_strings_fa.xtb 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/components/strings/components_strings_fa.xtb 2026-07-13 21:36:30.000000000 +0000
@@ -3433,7 +3433,7 @@
تأیید کردن خودکار ایمیلهای شما
دو منگنه در چپ
حذف ورودی
-کنشهای دسترسی به دستگاه مثل ورود به سیستم (ازجمله دلایل ورود ناموفق به سیستم)، خروج از سیستم، قفل کردن، و باز کردن قفل.
+کنشهای دسترسی دستگاه مثل ورود به سیستم (ازجمله دلایل ورود ناموفق به سیستم)، خروج از سیستم، قفل کردن، و باز کردن قفل.
دوباره امتحان کنید
مدیریت پنجره
دسترسی به سرور توسعه برای این برنامه ممکن نیست
diff -Nru chromium-150.0.7871.114/components/strings/components_strings_fr.xtb chromium-150.0.7871.124/components/strings/components_strings_fr.xtb
--- chromium-150.0.7871.114/components/strings/components_strings_fr.xtb 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/components/strings/components_strings_fr.xtb 2026-07-13 21:36:30.000000000 +0000
@@ -483,7 +483,7 @@
Essayez de contacter l'administrateur système.
, , , date d'expiration :
Ordinateur
-Mettez à jour le Known Traveler Number
+Mettre à jour le Known Traveler Number
Pour quitter le plein écran, faites glisser depuis le haut, puis appuyez sur le bouton Retour
Gérez les cartes de fidélité...
Cette règle doit être spécifiée avec une chaîne valide lorsque la règle DnsOverHttpsMode est définie sur .
@@ -1568,7 +1568,7 @@
souhaite voir le texte et les images copiés dans le presse-papiers
Surligneur
Masquer les paramètres avancés
-, appuyer sur Entrée pour poser des questions à Google à propos de cette page
+, appuyer sur Entrée pour poser une question à Google sur cette page
Impossible d'accéder à ce PDF. Texte extrait, optimisé par l'IA de Google.
Chimie
, actuellement ouvert, appuyez sur la touche tabulation, puis sur Entrée pour passer à l'onglet ouvert
@@ -2350,7 +2350,7 @@
Moteurs de recherche
– Demander à
Aucun résultat trouvé
-Mettez à jour le passeport
+Mettre à jour le passeport
Sports de combat
Côté
@@ -2965,9 +2965,9 @@
Passer à la position exacte
Enregistrez vos informations pour gagner du temps dans les produits Google. Elles seront enregistrées dans pour .
Échec du chargement des paramètres de la règle.
-Bouton Poser des questions à Google à propos de cette page, activer pour poser des questions à Google concernant cette page
+Bouton Poser une question à Google sur cette page, activer pour poser une question à Google sur cette page
Jeton de gestion de l'appareil non valide.
-Démonstration
+Voir comment faire
Contenu trompeur bloqué.
Mobile
Conditions d'utilisation du vendeur
@@ -3344,7 +3344,7 @@
Gérer les paramètres
Gérez les sites qui resteront toujours actifs et pour lesquels la mémoire ne sera pas libérée
Logo Google Pay
-Mettez à jour la carte d'identité
+Mettre à jour la carte d'identité
Enregistrer le passeport
Pour utiliser le Gestionnaire de mots de passe de Google avec votre système d'exploitation, relancez Chrome et autorisez l'accès au gestionnaire de mots de passe de votre ordinateur. Vos onglets s'ouvriront alors de nouveau.
Service de composition d'impression
@@ -3930,7 +3930,7 @@
fichiers de l'appareil photo, des téléchargements et des captures d'écran
PRC 32K
Réessayer
-Mettez à jour le permis de conduire
+Mettre à jour le permis de conduire
Dernière visite
{PAYMENT_METHOD,plural, =0{}=1{ et autre}one{ et autre}other{ et autres}}
@@ -4124,7 +4124,7 @@
{COUNT,plural, =0{Les cookies seront de nouveau bloqués aujourd'hui}=1{Les cookies seront de nouveau bloqués demain}one{Les cookies seront de nouveau bloqués dans # jour}other{Les cookies seront de nouveau bloqués dans # jours}}
Services d'habillement
( x mm)
-Mettez à jour le véhicule
+Mettre à jour le véhicule
Bouton "Gérer la synchronisation" à activer pour gérer les infos que vous synchronisez dans les paramètres Chrome
En savoir plus sur ce problème.
Jeu du dino, appuyer sur la barre d'espace pour jouer
@@ -4238,7 +4238,7 @@
Moins de
Impossible de traiter cette demande via à l'heure actuelle.
Délai de téléchargement dépassé
-Poser une question à Google concernant cette page
+Poser une question à Google sur cette page
Modèles Gemini 3
La valeur est hors limites.
Épais
@@ -4984,7 +4984,7 @@
Saisissez @gemini pour discuter avec Gemini
Plus tard
Enveloppe C8
-Mettez à jour le numéro de recours
+Mettre à jour le numéro de recours
: appuyer sur Tabulation, puis Entrée pour mettre à jour Chrome depuis les paramètres du navigateur
Ajoutez un niveau de sécurité accru contre les menaces en ligne.
Enregistrez le titre de transport dans Wallet
diff -Nru chromium-150.0.7871.114/components/strings/components_strings_hr.xtb chromium-150.0.7871.124/components/strings/components_strings_hr.xtb
--- chromium-150.0.7871.114/components/strings/components_strings_hr.xtb 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/components/strings/components_strings_hr.xtb 2026-07-13 21:36:30.000000000 +0000
@@ -596,7 +596,7 @@
Spremanje videozapisa nije uspjelo
Automatska slika u slici
Može tražiti dopuštenje za slanje obavijesti
-Izbriši spremljene sigurnosne kodove
+Izbrišite spremljene sigurnosne kodove
Privremeno ste dopustili ovoj web-lokaciji upotrebu kolačića trećih strana, što znači da će biti manje zaštite pregledavanja, ali će značajke web-lokacije vjerojatnije funkcionirati u skladu s očekivanjima.
Knjige i književnost
Dizajn
@@ -2239,7 +2239,7 @@
MP4 videozapis
Pizzerije
Omotnica Kaku 4
-Potvrdite svoj identitet da biste mogli automatski popunjavati načine plaćanja
+Traži potvrdu mojeg identiteta radi automatskog popunjavanja načina plaćanja
A7
Šifriranje sinkroniziranih zaporki s Google računom
URL nije važeći. URL mora imati standardnu shemu, na primjer http://example.com ili https://example.com.
diff -Nru chromium-150.0.7871.114/components/strings/components_strings_id.xtb chromium-150.0.7871.124/components/strings/components_strings_id.xtb
--- chromium-150.0.7871.114/components/strings/components_strings_id.xtb 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/components/strings/components_strings_id.xtb 2026-07-13 21:36:30.000000000 +0000
@@ -607,7 +607,7 @@
Memblokir juga akan memblokir topik terkait, meskipun topik tersebut aktif
A3x3
Tambahkan metode pembayaran
-Temukan, amankan, atau hapus perangkat Anda
+Temukan dan amankan perangkat, atau hapus datanya
Komedi Live
Skor tertinggi Anda adalah .
Bantu sempurnakan keamanan di web untuk semua orang dengan mengirimkan URL beberapa halaman yang Anda kunjungi, informasi sistem terbatas, dan beberapa konten halaman ke Google. Kebijakan privasi
@@ -1308,7 +1308,7 @@
Daftar penerbit Beli Sekarang Bayar Nanti ditutup.
Informasi Sertifikat
Olahraga Ekstrem
-Simpan info Anda di dan selesaikan berbagai aktivitas lebih cepat, seperti mengisi formulir di berbagai produk Google. Anda dapat mengelola info Anda di untuk
+Simpan info Anda di dan lakukan berbagai hal lebih cepat, misalnya mengisi formulir di produk-produk Google. Anda dapat mengelola info Anda di untuk
Histori Chrome Desktop Jarak Jauh, termasuk stempel waktu, host, dan ID sesi klien
Anda biasanya terhubung ke situs dengan aman, tetapi Chrome tidak dapat menggunakan koneksi yang aman untuk saat ini. Penyerang mungkin mencoba menyadap atau mengubah koneksi jaringan Anda. Pelajari lebih lanjut peringatan ini
Diskon untuk
@@ -4750,7 +4750,7 @@
Terjadi peristiwa ekstensi
Konfigurasi jaringan tidak valid dan tidak dapat diimpor. Detail tambahan:
Mikrofon diizinkan kali ini
-Simpan info Anda di dan selesaikan berbagai hal lebih cepat, seperti mengisi formulir di seluruh produk Google. Anda dapat di untuk .
+Simpan info Anda di dan lakukan berbagai hal lebih cepat, misalnya mengisi formulir di produk-produk Google. Anda dapat di untuk .
Ubah
Izinkan penggantian keyboard?
@@ -4904,7 +4904,7 @@
Halaman per set
Tambahkan kendaraan
Chrome memiliki fitur keamanan bawaan untuk melindungi Anda saat menjelajah — seperti Google Safe Browsing, yang baru-baru ini menemukan software berbahaya di situs yang Anda coba kunjungi.
-Masa berlaku
+Berlaku hingga
Perangkat HID
Envelope Kaku 1
Plester Pemasangan
diff -Nru chromium-150.0.7871.114/components/strings/components_strings_pt-BR.xtb chromium-150.0.7871.124/components/strings/components_strings_pt-BR.xtb
--- chromium-150.0.7871.114/components/strings/components_strings_pt-BR.xtb 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/components/strings/components_strings_pt-BR.xtb 2026-07-13 21:36:30.000000000 +0000
@@ -745,7 +745,7 @@
Acesso completo de administrador
Não foi possível estabelecer uma conexão segura com este site
A impressão desse conteúdo está bloqueada pela política do administrador
-Em para
+Na para
Reparo e manutenção de veículos
Vincular sua conta
Verifique sua conexão com a Internet
@@ -781,7 +781,7 @@
A página foi impressa
Atualize o Chrome para continuar usando seus grupos de guias compartilhados
Compre, traduza e identifique o que você quiser usando a câmera.
-Preenchimento automático do Google
+Preench. auto. do Google
Escalada e montanhismo
Edição de arquivos
Cães
@@ -1307,7 +1307,7 @@
A lista de emissores da opção "Compre agora, pague depois" está fechada.
Informações do certificado
Esportes radicais
-Salve suas informações na e agilize ações como o preenchimento de formulários em produtos do Google. Você pode gerenciar suas informações no para
+Salve suas informações na e agilize ações como o preenchimento de formulários em produtos do Google. Você pode gerenciar suas informações na para
o histórico da Área de trabalho remota do Google Chrome, incluindo carimbos de data/hora, hosts e IDs de sessões de clientes.
A conexão com estes sites costuma ser segura, mas o Chrome não conseguiu garantir isso desta vez. Um invasor pode estar tentando espionar ou modificar sua conexão de rede. Saiba mais sobre este aviso
Redução de no preço deste produto:
@@ -2083,7 +2083,7 @@
Pode pedir para usar e mover a câmera
20 x 33 cm
Rótulos
-Salvar o número de passageiro conhecido
+Salvar número de identificação do passageiro (KTN)
Invasores no site que você tentou acessar podem induzir você a instalar um software ou compartilhar dados como senhas, telefone ou números de cartões de crédito.
Envelope (grosso)
Para pesquisar seu histórico de navegação com mais eficiência, ative o
@@ -3769,7 +3769,7 @@
Você não fez login
Fitness
Fazer o download de vários arquivos
-Número de reparação
+Número de retificação
Usuário:
Informe o motivo do download (obrigatório)
A senha que você usou foi encontrada em uma violação de dados. Para proteger suas contas, o Gerenciador de senhas recomenda que você revise as senhas salvas.
@@ -4984,7 +4984,7 @@
Digite @gemini para conversar com o Gemini
Lembrar mais tarde
Envelope C8
-Atualizar número de reparação
+Atualizar número de retificação
. Pressione "Tab" e depois "Enter" para atualizar o Chrome pelas configurações dele
Mais proteção contra ameaças on-line.
Salvar bilhete de transporte na Carteira
diff -Nru chromium-150.0.7871.114/components/strings/components_strings_ru.xtb chromium-150.0.7871.124/components/strings/components_strings_ru.xtb
--- chromium-150.0.7871.114/components/strings/components_strings_ru.xtb 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/components/strings/components_strings_ru.xtb 2026-07-13 21:36:30.000000000 +0000
@@ -483,7 +483,7 @@
Обратитесь за помощью к системному администратору.
, , , действительна до
Компьютер
-Обновить номер Known Traveler Number?
+Обновить номер известного пассажира (Known Traveler Number)?
Чтобы выйти из полноэкранного режима, проведите по экрану сверху вниз и нажмите кнопку "Назад".
Перейти к картам постоянного клиента
Необходимо указать значение и ввести действительную строку, если для правила DnsOverHttpsMode выбрано значение .
@@ -767,7 +767,7 @@
На следующем шаге разблокируйте экран, например с помощью отпечатка пальца. Вы также можете .
Важная информация
Защита электронной почты
-Номер Known Traveler Number
+Номер известного пассажира (Known Traveler Number)
Возникла непредвиденная проблема. Подробнее о загрузке файлов на Диск…
Кнопка "Не нравится". Нажмите Ввод, чтобы открыть форму и подробно описать, почему вам не нравится эта подсказка.
с обратной стороны карты
@@ -1364,7 +1364,7 @@
Перейти на страницу
Показать результаты за последние 30 дней
Этикетки (самоклеящиеся)
-Сохранить данные Redress Number?
+Сохранить уникальный номер пассажира (Redress Number)?
Теперь поисковая система по умолчанию – .
Локальная сеть
– Поиск по разделу ""
@@ -2082,7 +2082,7 @@
Разрешено отправлять запрос на использование камеры и ее перемещение
8 x 13 дюймов
Этикетки
-Сохранить номер Known Traveler Number?
+Сохранить номер известного пассажира (Known Traveler Number)?
На этом сайте злоумышленники могут обманом заставить вас установить ПО или раскрыть личную информацию, например пароль, номер телефона или данные кредитной карты.
Конверт (плотный)
Чтобы ещё эффективнее искать информацию в истории браузера, включите параметр
@@ -3713,7 +3713,7 @@
Обязательное поле
Идентификатор персонализации
Спортивные товары
-Сохранить данные водительского удостоверения?
+Сохранить водительское удостоверение?
JavaScript
последовательные порты
CVC-код
@@ -3768,7 +3768,7 @@
Вход в аккаунт не выполнен
Фитнес
скачивание нескольких файлов
-Данные Redress Number
+Redress Number
Пользователь:
Укажите, зачем вы хотите скачать файл (обязательно)
Пароль, который вы только что использовали, был раскрыт в результате утечки данных. Чтобы защитить свои аккаунты, проверьте сохраненные пароли в Менеджере паролей.
diff -Nru chromium-150.0.7871.114/components/strings/components_strings_th.xtb chromium-150.0.7871.124/components/strings/components_strings_th.xtb
--- chromium-150.0.7871.114/components/strings/components_strings_th.xtb 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/components/strings/components_strings_th.xtb 2026-07-13 21:36:30.000000000 +0000
@@ -4215,7 +4215,7 @@
กอล์ฟ
นำบัตรเครดิตออกจาก Chrome ไหม
สีดำ
-เลขประจำตัวผู้ที่อยู่ในกลุ่มเสี่ยง
+หมายเลข Redress
โหมด Google AI
อุปกรณ์กีฬาฤดูหนาว
ปุ่ม "นำคำแนะนำออก" กด Enter เพื่อนำคำแนะนำนี้ออก
@@ -4983,7 +4983,7 @@
พิมพ์ @gemini เพื่อแชทกับ Gemini
เตือนฉันภายหลัง
Envelope C8
-อัปเดตเลขประจำตัวผู้ที่อยู่ในกลุ่มเสี่ยง
+อัปเดตหมายเลข Redress
กด Tab ตามด้วย Enter เพื่ออัปเดต Chrome จากการตั้งค่า Chrome
เพิ่มการป้องกันภัยคุกคามทางออนไลน์อีกชั้นหนึ่ง
บันทึกตั๋วโดยสารลงใน Wallet
diff -Nru chromium-150.0.7871.114/components/strings/components_strings_zh-CN.xtb chromium-150.0.7871.124/components/strings/components_strings_zh-CN.xtb
--- chromium-150.0.7871.114/components/strings/components_strings_zh-CN.xtb 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/components/strings/components_strings_zh-CN.xtb 2026-07-13 21:36:30.000000000 +0000
@@ -4981,7 +4981,7 @@
C8 信封
更新身份纠正识别号
,依次按 Tab 键和 Enter 键即可前往 Chrome 设置以更新 Chrome
-增添一层额外的安全保障,防范在线威胁
+多一层保障,抵御网络威胁
将交通票券保存到钱包
书签
手动插槽
diff -Nru chromium-150.0.7871.114/components/strings/components_strings_zh-TW.xtb chromium-150.0.7871.124/components/strings/components_strings_zh-TW.xtb
--- chromium-150.0.7871.114/components/strings/components_strings_zh-TW.xtb 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/components/strings/components_strings_zh-TW.xtb 2026-07-13 21:36:30.000000000 +0000
@@ -779,7 +779,7 @@
正在擷取項目...
列印頁面
請更新 Chrome,才能繼續使用共用分頁群組
-使用相機購物、翻譯及辨識所見內容。
+用相機翻譯、辨認眼前的一切,看到心儀商品輕鬆買。
使用 Google 自動填入功能
攀岩與登山運動
檔案編輯
@@ -2194,7 +2194,7 @@
即時字幕
搜尋結果
為維護安全性,貴機構不允許在 Chrome 中重複使用密碼。Chrome 會將密碼加密處理,以保護使用者隱私。
-你的搜尋引擎是 。如要瞭解如何刪除搜尋記錄,請查看搜尋引擎的操作說明 (如果有的話)。
+你的搜尋引擎是 。你可以查看搜尋引擎的操作說明 (如有),瞭解如何刪除搜尋記錄。
發起討論串
這項設定標示為可安裝,但沒有映像檔可供這個架構使用,因此無法安裝。
使用者評論
@@ -2457,7 +2457,7 @@
已將版本字串複製到剪貼簿
你必須獲得家長或監護人許可,才能造訪這個網站
居家修繕
-儲存及自動填寫密碼,輕鬆登入網站和應用程式
+儲存並自動填入密碼,輕鬆登入網站和應用程式
按下 || + || 即可顯示游標
如要繼續使用共用分頁群組,請更新 Chrome
眼鏡
diff -Nru chromium-150.0.7871.114/content/browser/BUILD.gn chromium-150.0.7871.124/content/browser/BUILD.gn
--- chromium-150.0.7871.114/content/browser/BUILD.gn 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/content/browser/BUILD.gn 2026-07-13 21:36:30.000000000 +0000
@@ -2149,6 +2149,8 @@
"scheduler/responsiveness/watcher.h",
"scoped_active_url.cc",
"scoped_active_url.h",
+ "scoped_browser_file_access.cc",
+ "scoped_browser_file_access.h",
"screen_details/screen_change_monitor.cc",
"screen_details/screen_change_monitor.h",
"screen_orientation/screen_orientation_provider.cc",
diff -Nru chromium-150.0.7871.114/content/browser/blob_storage/blob_url_browsertest.cc chromium-150.0.7871.124/content/browser/blob_storage/blob_url_browsertest.cc
--- chromium-150.0.7871.114/content/browser/blob_storage/blob_url_browsertest.cc 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/content/browser/blob_storage/blob_url_browsertest.cc 2026-07-13 21:36:30.000000000 +0000
@@ -15,6 +15,7 @@
#include "content/browser/devtools/render_frame_devtools_agent_host.h"
#include "content/browser/permissions/permission_controller_impl.h"
#include "content/browser/renderer_host/render_frame_host_impl.h"
+#include "content/browser/storage_partition_impl.h"
#include "content/browser/web_contents/web_contents_impl.h"
#include "content/public/browser/browser_context.h"
#include "content/public/common/content_switches.h"
@@ -24,17 +25,26 @@
#include "content/public/test/content_browser_test.h"
#include "content/public/test/content_browser_test_content_browser_client.h"
#include "content/public/test/content_browser_test_utils.h"
+#include "content/public/test/navigation_handle_observer.h"
#include "content/public/test/test_devtools_protocol_client.h"
#include "content/public/test/test_utils.h"
#include "content/shell/browser/shell.h"
#include "content/test/content_browser_test_utils_internal.h"
+#include "mojo/public/cpp/bindings/receiver_set.h"
+#include "mojo/public/cpp/bindings/remote.h"
#include "net/base/net_errors.h"
#include "net/dns/mock_host_resolver.h"
+#include "net/http/http_response_headers.h"
#include "net/test/embedded_test_server/embedded_test_server.h"
+#include "net/url_request/redirect_info.h"
+#include "services/network/public/mojom/url_loader.mojom.h"
+#include "services/network/public/mojom/url_response_head.mojom.h"
+#include "storage/browser/blob/blob_url_registry.h"
#include "storage/browser/blob/features.h"
#include "testing/gmock/include/gmock/gmock.h"
#include "testing/gtest/include/gtest/gtest.h"
#include "third_party/blink/public/common/features.h"
+#include "third_party/blink/public/mojom/blob/blob.mojom.h"
#include "url/gurl.h"
#include "url/origin.h"
@@ -229,6 +239,108 @@
EXPECT_FALSE(base::MatchPattern(window_location, "*spoof*"));
}
+namespace {
+
+// A blink::mojom::Blob implementation that, when Load() is called, responds
+// with a redirect to `redirect_target_` instead of a blob body. This simulates
+// a Blob endpoint that does not behave like a real blob.
+class RedirectingBlob : public blink::mojom::Blob {
+ public:
+ explicit RedirectingBlob(const GURL& redirect_target)
+ : redirect_target_(redirect_target) {}
+
+ mojo::PendingRemote BindNewPipeAndPassRemote() {
+ mojo::PendingRemote remote;
+ receivers_.Add(this, remote.InitWithNewPipeAndPassReceiver());
+ return remote;
+ }
+
+ // blink::mojom::Blob:
+ void Clone(mojo::PendingReceiver receiver) override {
+ receivers_.Add(this, std::move(receiver));
+ }
+ void AsDataPipeGetter(
+ mojo::PendingReceiver) override {
+ NOTREACHED();
+ }
+ void ReadAll(mojo::ScopedDataPipeProducerHandle,
+ mojo::PendingRemote) override {
+ NOTREACHED();
+ }
+ void ReadRange(uint64_t,
+ uint64_t,
+ mojo::ScopedDataPipeProducerHandle,
+ mojo::PendingRemote) override {
+ NOTREACHED();
+ }
+ void Load(
+ mojo::PendingReceiver loader,
+ const std::string& method,
+ const net::HttpRequestHeaders&,
+ mojo::PendingRemote client) override {
+ loader_receiver_ = std::move(loader);
+ client_.reset();
+ client_.Bind(std::move(client));
+ net::RedirectInfo redirect_info;
+ redirect_info.status_code = net::HTTP_FOUND;
+ redirect_info.new_method = method;
+ redirect_info.new_url = redirect_target_;
+ redirect_info.new_site_for_cookies =
+ net::SiteForCookies::FromUrl(redirect_target_);
+ auto head = network::mojom::URLResponseHead::New();
+ head->headers = net::HttpResponseHeaders::TryToCreate(
+ "HTTP/1.1 302 Found\r\nLocation: " + redirect_target_.spec() + "\r\n");
+ head->encoded_data_length = 0;
+ head->bypass_redirect_checks = true;
+ client_->OnReceiveRedirect(redirect_info, std::move(head));
+ }
+ void ReadSideData(ReadSideDataCallback) override { NOTREACHED(); }
+ void CaptureSnapshot(CaptureSnapshotCallback callback) override {
+ std::move(callback).Run(0, std::nullopt);
+ }
+ void GetInternalUUID(GetInternalUUIDCallback callback) override {
+ std::move(callback).Run("");
+ }
+
+ private:
+ const GURL redirect_target_;
+ mojo::ReceiverSet receivers_;
+ mojo::PendingReceiver loader_receiver_;
+ mojo::Remote client_;
+};
+
+} // namespace
+
+// A blob never serves a redirect, so a navigation to a blob URL whose
+// underlying Blob endpoint replies with OnReceiveRedirect must not follow the
+// redirect, regardless of any flags carried in the response head.
+IN_PROC_BROWSER_TEST_F(BlobUrlBrowserTest,
+ NavigationToBlobUrlDoesNotFollowRedirect) {
+ GURL url = embedded_test_server()->GetURL("a.test", "/title1.html");
+ url::Origin origin = url::Origin::Create(url);
+ ASSERT_TRUE(NavigateToURL(shell(), url));
+
+ RenderFrameHostImpl* rfh = static_cast(
+ shell()->web_contents()->GetPrimaryMainFrame());
+
+ const GURL redirect_target("data:text/html,redirected");
+ RedirectingBlob blob(redirect_target);
+
+ const GURL blob_url("blob:" + origin.Serialize() +
+ "/33221100-0000-0000-0000-000000000000");
+ static_cast(rfh->GetStoragePartition())
+ ->GetBlobUrlRegistry()
+ ->AddUrlMapping(blob_url, blob.BindNewPipeAndPassRemote(),
+ blink::StorageKey::CreateFirstParty(origin), origin,
+ rfh->GetProcess()->GetDeprecatedID());
+
+ NavigationHandleObserver observer(shell()->web_contents(), blob_url);
+ EXPECT_FALSE(NavigateToURL(shell(), blob_url));
+ EXPECT_TRUE(observer.is_error());
+ EXPECT_EQ(net::ERR_UNSAFE_REDIRECT, observer.net_error_code());
+ EXPECT_NE(redirect_target, shell()->web_contents()->GetLastCommittedURL());
+}
+
IN_PROC_BROWSER_TEST_F(BlobUrlBrowserTest,
TestUseCounterForCrossPartitionSameOriginBlobURLFetch) {
GURL main_url = embedded_test_server()->GetURL(
diff -Nru chromium-150.0.7871.114/content/browser/browser_main_loop.cc chromium-150.0.7871.124/content/browser/browser_main_loop.cc
--- chromium-150.0.7871.114/content/browser/browser_main_loop.cc 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/content/browser/browser_main_loop.cc 2026-07-13 21:36:30.000000000 +0000
@@ -146,7 +146,9 @@
#include "services/audio/service.h"
#include "services/data_decoder/public/cpp/service_provider.h"
#include "services/data_decoder/public/mojom/data_decoder_service.mojom.h"
+#include "services/network/public/cpp/features.h"
#include "services/network/public/cpp/network_switches.h"
+#include "services/network/public/cpp/simple_url_loader.h"
#include "services/network/public/mojom/network_service.mojom.h"
#include "services/network/transitional_url_loader_factory_owner.h"
#include "services/tracing/public/cpp/background_tracing/background_tracing_manager.h"
@@ -825,6 +827,24 @@
RenderProcessHost::SetRunRendererInProcess(true);
#endif
+ // Set up the callbacks used by the network layer to track and validate
+ // file access for browser-initiated uploads.
+ if (base::FeatureList::IsEnabled(
+ network::features::kBrowserInitiatedFileUploadValidation)) {
+ network::SimpleURLLoader::FileUploadEventCallbacks callbacks;
+ callbacks.register_callback = base::BindRepeating(
+ [](const base::UnguessableToken& token, const base::FilePath& path) {
+ ChildProcessSecurityPolicyImpl::GetInstance()
+ ->GrantFileForBrowserUpload(token, path);
+ });
+ callbacks.revoke_callback =
+ base::BindRepeating([](const base::UnguessableToken& token) {
+ ChildProcessSecurityPolicyImpl::GetInstance()
+ ->RevokeFileForBrowserUpload(token);
+ });
+ network::SimpleURLLoader::SetFileUploadEventCallbacks(callbacks);
+ }
+
// Initialize origins that require process isolation. Must be done
// after base::FeatureList is initialized, but before any navigations can
// happen.
diff -Nru chromium-150.0.7871.114/content/browser/child_process_security_policy_impl.cc chromium-150.0.7871.124/content/browser/child_process_security_policy_impl.cc
--- chromium-150.0.7871.114/content/browser/child_process_security_policy_impl.cc 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/content/browser/child_process_security_policy_impl.cc 2026-07-13 21:36:30.000000000 +0000
@@ -26,6 +26,7 @@
#include "base/strings/string_split.h"
#include "base/strings/string_util.h"
#include "base/strings/stringprintf.h"
+#include "base/unguessable_token.h"
#include "build/build_config.h"
#include "content/browser/bad_message.h"
#include "content/browser/child_process_security_policy_impl.rs.h"
@@ -1831,6 +1832,33 @@
return HasPermissionsForFile(child_id, file, READ_FILE_GRANT);
}
+void ChildProcessSecurityPolicyImpl::GrantFileForBrowserUpload(
+ const base::UnguessableToken& owner_token,
+ const base::FilePath& file) {
+ base::AutoLock lock(lock_);
+ browser_granted_files_[file].push_back(owner_token);
+}
+
+void ChildProcessSecurityPolicyImpl::RevokeFileForBrowserUpload(
+ const base::UnguessableToken& owner_token) {
+ base::AutoLock lock(lock_);
+ for (auto it = browser_granted_files_.begin();
+ it != browser_granted_files_.end();) {
+ std::erase(it->second, owner_token);
+ if (it->second.empty()) {
+ browser_granted_files_.erase(it++);
+ } else {
+ it++;
+ }
+ }
+}
+
+bool ChildProcessSecurityPolicyImpl::CanReadFileForBrowserUpload(
+ const base::FilePath& file) {
+ base::AutoLock lock(lock_);
+ return browser_granted_files_.contains(file);
+}
+
bool ChildProcessSecurityPolicyImpl::CanReadAllFiles(
ChildProcessId child_id,
const std::vector& files) {
diff -Nru chromium-150.0.7871.114/content/browser/child_process_security_policy_impl.h chromium-150.0.7871.124/content/browser/child_process_security_policy_impl.h
--- chromium-150.0.7871.114/content/browser/child_process_security_policy_impl.h 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/content/browser/child_process_security_policy_impl.h 2026-07-13 21:36:30.000000000 +0000
@@ -23,6 +23,7 @@
#include "base/synchronization/lock.h"
#include "base/thread_annotations.h"
#include "base/time/time.h"
+#include "base/unguessable_token.h"
#include "content/browser/can_commit_status.h"
#include "content/browser/isolated_origin_util.h"
#include "content/browser/isolation_context.h"
@@ -32,6 +33,7 @@
#include "content/public/common/bindings_policy.h"
#include "content/public/common/child_process_id.h"
#include "storage/common/file_system/file_system_types.h"
+#include "third_party/abseil-cpp/absl/container/flat_hash_map.h"
#include "url/origin.h"
class GURL;
@@ -420,6 +422,20 @@
RenderProcessHost* process,
const scoped_refptr& body);
+ // Grants the network service the capability to upload a specific file on
+ // the browser's behalf. The owner_token ties the lifetime of the grant to
+ // an object (e.g. SimpleURLLoader) so it can be revoked when the object is
+ // destroyed.
+ void GrantFileForBrowserUpload(const base::UnguessableToken& owner_token,
+ const base::FilePath& file);
+
+ // Revokes all file accesses previously granted to the specific owner_token.
+ void RevokeFileForBrowserUpload(const base::UnguessableToken& owner_token);
+
+ // Verifies whether the browser process has granted the network service
+ // permission to upload the given file.
+ bool CanReadFileForBrowserUpload(const base::FilePath& file);
+
// Pseudo schemes are treated differently than other schemes because they
// cannot be requested like normal URLs. There is no mechanism for revoking
// pseudo schemes.
@@ -1231,6 +1247,17 @@
// improvement, and with it the BrowsingInstance cleanup here can also be
// improved.
base::TimeDelta browsing_instance_cleanup_delay_;
+
+ // Tracks files that the browser process has granted permission to the
+ // network service to upload on the user's behalf.
+ //
+ // Each file path maps to a list of tokens representing the active requests
+ // that have been granted access to this file. A token is added when a request
+ // is created, and it is removed from all associated file paths when the
+ // request is destroyed. Access is allowed as long as the file is present in
+ // this map.
+ absl::flat_hash_map>
+ browser_granted_files_ GUARDED_BY(lock_);
};
} // namespace content
diff -Nru chromium-150.0.7871.114/content/browser/child_process_security_policy_unittest.cc chromium-150.0.7871.124/content/browser/child_process_security_policy_unittest.cc
--- chromium-150.0.7871.114/content/browser/child_process_security_policy_unittest.cc 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/content/browser/child_process_security_policy_unittest.cc 2026-07-13 21:36:30.000000000 +0000
@@ -3486,6 +3486,101 @@
p->LookupAreV8OptimizationsDisabled(browsing_instance_id, origin));
}
+TEST_P(ChildProcessSecurityPolicyTest,
+ BrowserFileAccess_GrantAndRevokeSingleToken) {
+ auto* p = ChildProcessSecurityPolicyImpl::GetInstance();
+ base::FilePath file(TEST_PATH("/foo/bar"));
+ base::UnguessableToken token = base::UnguessableToken::Create();
+
+ EXPECT_FALSE(p->CanReadFileForBrowserUpload(file));
+
+ p->GrantFileForBrowserUpload(token, file);
+ EXPECT_TRUE(p->CanReadFileForBrowserUpload(file));
+
+ p->RevokeFileForBrowserUpload(token);
+ EXPECT_FALSE(p->CanReadFileForBrowserUpload(file));
+}
+
+TEST_P(ChildProcessSecurityPolicyTest,
+ BrowserFileAccess_MultipleTokensSameFile) {
+ auto* p = ChildProcessSecurityPolicyImpl::GetInstance();
+ base::FilePath file(TEST_PATH("/foo/bar"));
+ base::UnguessableToken token1 = base::UnguessableToken::Create();
+ base::UnguessableToken token2 = base::UnguessableToken::Create();
+
+ EXPECT_FALSE(p->CanReadFileForBrowserUpload(file));
+
+ p->GrantFileForBrowserUpload(token1, file);
+ p->GrantFileForBrowserUpload(token2, file);
+ EXPECT_TRUE(p->CanReadFileForBrowserUpload(file));
+
+ p->RevokeFileForBrowserUpload(token1);
+ EXPECT_TRUE(p->CanReadFileForBrowserUpload(file));
+
+ p->RevokeFileForBrowserUpload(token2);
+ EXPECT_FALSE(p->CanReadFileForBrowserUpload(file));
+}
+
+TEST_P(ChildProcessSecurityPolicyTest,
+ BrowserFileAccess_MultipleTokensDifferentFiles) {
+ auto* p = ChildProcessSecurityPolicyImpl::GetInstance();
+ base::FilePath file1(TEST_PATH("/foo/bar1"));
+ base::FilePath file2(TEST_PATH("/foo/bar2"));
+ base::UnguessableToken token1 = base::UnguessableToken::Create();
+ base::UnguessableToken token2 = base::UnguessableToken::Create();
+
+ p->GrantFileForBrowserUpload(token1, file1);
+ p->GrantFileForBrowserUpload(token2, file2);
+
+ EXPECT_TRUE(p->CanReadFileForBrowserUpload(file1));
+ EXPECT_TRUE(p->CanReadFileForBrowserUpload(file2));
+
+ p->RevokeFileForBrowserUpload(token1);
+ EXPECT_FALSE(p->CanReadFileForBrowserUpload(file1));
+ EXPECT_TRUE(p->CanReadFileForBrowserUpload(file2));
+
+ p->RevokeFileForBrowserUpload(token2);
+ EXPECT_FALSE(p->CanReadFileForBrowserUpload(file1));
+ EXPECT_FALSE(p->CanReadFileForBrowserUpload(file2));
+}
+
+TEST_P(ChildProcessSecurityPolicyTest,
+ BrowserFileAccess_OneTokenMultipleFiles) {
+ auto* p = ChildProcessSecurityPolicyImpl::GetInstance();
+ base::FilePath file1(TEST_PATH("/foo/bar1"));
+ base::FilePath file2(TEST_PATH("/foo/bar2"));
+ base::UnguessableToken token = base::UnguessableToken::Create();
+
+ p->GrantFileForBrowserUpload(token, file1);
+ p->GrantFileForBrowserUpload(token, file2);
+
+ EXPECT_TRUE(p->CanReadFileForBrowserUpload(file1));
+ EXPECT_TRUE(p->CanReadFileForBrowserUpload(file2));
+
+ p->RevokeFileForBrowserUpload(token);
+ EXPECT_FALSE(p->CanReadFileForBrowserUpload(file1));
+ EXPECT_FALSE(p->CanReadFileForBrowserUpload(file2));
+}
+
+TEST_P(ChildProcessSecurityPolicyTest,
+ BrowserFileAccess_RevokeNonExistentToken) {
+ auto* p = ChildProcessSecurityPolicyImpl::GetInstance();
+ base::FilePath file(TEST_PATH("/foo/bar"));
+ base::UnguessableToken valid_token = base::UnguessableToken::Create();
+ base::UnguessableToken invalid_token = base::UnguessableToken::Create();
+
+ p->GrantFileForBrowserUpload(valid_token, file);
+ EXPECT_TRUE(p->CanReadFileForBrowserUpload(file));
+
+ // Revoking a token that was never granted access shouldn't crash or modify
+ // other grants.
+ p->RevokeFileForBrowserUpload(invalid_token);
+ EXPECT_TRUE(p->CanReadFileForBrowserUpload(file));
+
+ p->RevokeFileForBrowserUpload(valid_token);
+ EXPECT_FALSE(p->CanReadFileForBrowserUpload(file));
+}
+
INSTANTIATE_TEST_SUITE_P(,
ChildProcessSecurityPolicyTest,
::testing::Values(RustPolicy::kCppOnly,
diff -Nru chromium-150.0.7871.114/content/browser/loader/navigation_url_loader_impl.cc chromium-150.0.7871.124/content/browser/loader/navigation_url_loader_impl.cc
--- chromium-150.0.7871.114/content/browser/loader/navigation_url_loader_impl.cc 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/content/browser/loader/navigation_url_loader_impl.cc 2026-07-13 21:36:30.000000000 +0000
@@ -1594,8 +1594,11 @@
? head->bypass_redirect_checks
: bypass_redirect_checks_;
- if (!bypass_redirect_checks &&
- !IsSafeRedirectTarget(url_, redirect_info.new_url)) {
+ if (url_.SchemeIsBlob()) {
+ // Loading a blob URL never produces a redirect.
+ error = net::ERR_UNSAFE_REDIRECT;
+ } else if (!bypass_redirect_checks &&
+ !IsSafeRedirectTarget(url_, redirect_info.new_url)) {
error = net::ERR_UNSAFE_REDIRECT;
} else if (--redirect_limit_ == 0) {
error = net::ERR_TOO_MANY_REDIRECTS;
@@ -2171,6 +2174,17 @@
network_loader_factory_ = CreateNetworkLoaderFactory(
browser_context_, storage_partition_, frame_tree_node,
ukm::SourceIdObj::FromInt64(ukm_source_id_), &bypass_redirect_checks_);
+
+ if (base::FeatureList::IsEnabled(
+ network::features::kBrowserInitiatedFileUploadValidation) &&
+ resource_request_->request_body) {
+ std::vector files =
+ resource_request_->request_body->GetReferencedFiles();
+ if (!files.empty()) {
+ scoped_browser_file_access_ =
+ std::make_unique(std::move(files));
+ }
+ }
}
// static
diff -Nru chromium-150.0.7871.114/content/browser/loader/navigation_url_loader_impl.h chromium-150.0.7871.124/content/browser/loader/navigation_url_loader_impl.h
--- chromium-150.0.7871.114/content/browser/loader/navigation_url_loader_impl.h 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/content/browser/loader/navigation_url_loader_impl.h 2026-07-13 21:36:30.000000000 +0000
@@ -14,6 +14,7 @@
#include "content/browser/loader/navigation_url_loader.h"
#include "content/browser/loader/response_head_update_params.h"
#include "content/browser/navigation_subresource_loader_params.h"
+#include "content/browser/scoped_browser_file_access.h"
#include "content/common/content_export.h"
#include "content/public/browser/frame_tree_node_id.h"
#include "content/public/browser/global_request_id.h"
@@ -592,6 +593,12 @@
// response.
ResponseHeadUpdateParams head_update_params_;
+ // If the navigation request includes a file upload, this object ensures the
+ // browser process is aware that the Network Service is allowed to read the
+ // files. The files are granted access upon creation and revoked when this
+ // loader is destroyed.
+ std::unique_ptr scoped_browser_file_access_;
+
base::WeakPtrFactory weak_factory_{this};
};
diff -Nru chromium-150.0.7871.114/content/browser/media/capture/mouse_cursor_overlay_controller_mac.mm chromium-150.0.7871.124/content/browser/media/capture/mouse_cursor_overlay_controller_mac.mm
--- chromium-150.0.7871.114/content/browser/media/capture/mouse_cursor_overlay_controller_mac.mm 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/content/browser/media/capture/mouse_cursor_overlay_controller_mac.mm 2026-07-13 21:36:30.000000000 +0000
@@ -50,7 +50,9 @@
_trackingArea.reset(trackingArea);
[nsView addTrackingArea:trackingArea];
NSEvent* (^mouseDragged)(NSEvent*) = ^NSEvent*(NSEvent* event) {
- self->_callback.Run([event locationInWindow]);
+ if (self->_callback) {
+ self->_callback.Run([event locationInWindow]);
+ }
return event;
};
@@ -77,15 +79,21 @@
}
- (void)mouseMoved:(NSEvent*)theEvent {
- _callback.Run([theEvent locationInWindow]);
+ if (_callback) {
+ _callback.Run([theEvent locationInWindow]);
+ }
}
- (void)mouseEntered:(NSEvent*)theEvent {
- _callback.Run([theEvent locationInWindow]);
+ if (_callback) {
+ _callback.Run([theEvent locationInWindow]);
+ }
}
- (void)mouseExited:(NSEvent*)theEvent {
- _callback.Run([theEvent locationInWindow]);
+ if (_callback) {
+ _callback.Run([theEvent locationInWindow]);
+ }
}
@end
diff -Nru chromium-150.0.7871.114/content/browser/network_context_client_base_impl.cc chromium-150.0.7871.124/content/browser/network_context_client_base_impl.cc
--- chromium-150.0.7871.114/content/browser/network_context_client_base_impl.cc 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/content/browser/network_context_client_base_impl.cc 2026-07-13 21:36:30.000000000 +0000
@@ -19,6 +19,7 @@
#include "content/public/common/content_client.h"
#include "mojo/public/cpp/bindings/remote.h"
#include "net/base/net_errors.h"
+#include "services/network/public/cpp/features.h"
#include "services/network/public/mojom/trust_tokens.mojom.h"
namespace content {
@@ -36,11 +37,20 @@
std::vector files;
uint32_t file_flags = base::File::FLAG_OPEN | base::File::FLAG_READ |
(async ? base::File::FLAG_ASYNC : 0);
- ChildProcessSecurityPolicy* cpsp = ChildProcessSecurityPolicy::GetInstance();
+ ChildProcessSecurityPolicyImpl* cpsp =
+ ChildProcessSecurityPolicyImpl::GetInstance();
for (const auto& file_path : file_paths) {
- if (!process_id.is_browser() &&
- !cpsp->CanReadFile(ToChildProcessId(process_id.renderer_process_id()),
- file_path)) {
+ bool access_denied = false;
+ if (base::FeatureList::IsEnabled(
+ network::features::kBrowserInitiatedFileUploadValidation) &&
+ process_id.is_browser()) {
+ access_denied = !cpsp->CanReadFileForBrowserUpload(file_path);
+ } else if (!process_id.is_browser()) {
+ access_denied = !cpsp->CanReadFile(
+ ToChildProcessId(process_id.renderer_process_id()), file_path);
+ }
+
+ if (access_denied) {
task_runner->PostTask(
FROM_HERE, base::BindOnce(std::move(callback), net::ERR_ACCESS_DENIED,
std::vector()));
diff -Nru chromium-150.0.7871.114/content/browser/network_context_client_base_impl_unittest.cc chromium-150.0.7871.124/content/browser/network_context_client_base_impl_unittest.cc
--- chromium-150.0.7871.114/content/browser/network_context_client_base_impl_unittest.cc 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/content/browser/network_context_client_base_impl_unittest.cc 2026-07-13 21:36:30.000000000 +0000
@@ -14,7 +14,9 @@
#include "base/strings/string_view_util.h"
#include "base/test/task_environment.h"
#include "base/test/test_file_util.h"
+#include "base/test/test_future.h"
#include "base/types/fixed_array.h"
+#include "base/unguessable_token.h"
#include "build/build_config.h"
#include "content/browser/child_process_security_policy_impl.h"
#include "content/public/browser/network_context_client_base.h"
@@ -223,19 +225,39 @@
EXPECT_EQ(0U, response.opened_files.size());
}
-TEST_F(NetworkContextClientBaseTest, UploadFromBrowserProcess) {
+TEST_F(NetworkContextClientBaseTest,
+ OnFileUploadRequested_BrowserProcess_AccessDenied) {
base::FilePath path = temp_dir_.GetPath().AppendASCII("filename");
CreateFile(path, kFileContent1);
- // No grant necessary for browser process.
- UploadResponse response;
+ base::test::TestFuture> future;
client_.OnFileUploadRequested(
network::OriginatingProcessId::browser(), false, {path},
- /*destination_url=*/GURL(), std::move(response.callback));
- task_environment_.RunUntilIdle();
- EXPECT_EQ(net::OK, response.error_code);
- ASSERT_EQ(1U, response.opened_files.size());
- ValidateFileContents(response.opened_files[0], kFileContent1);
+ /*destination_url=*/GURL(), future.GetCallback());
+ EXPECT_EQ(net::ERR_ACCESS_DENIED, future.Get<0>());
+ EXPECT_EQ(0U, future.Get<1>().size());
+}
+
+TEST_F(NetworkContextClientBaseTest,
+ OnFileUploadRequested_BrowserProcess_AccessGranted) {
+ base::FilePath path = temp_dir_.GetPath().AppendASCII("filename");
+ CreateFile(path, kFileContent1);
+
+ base::UnguessableToken token = base::UnguessableToken::Create();
+ ChildProcessSecurityPolicyImpl::GetInstance()->GrantFileForBrowserUpload(
+ token, path);
+
+ base::test::TestFuture> future;
+ client_.OnFileUploadRequested(
+ network::OriginatingProcessId::browser(), false, {path},
+ /*destination_url=*/GURL(), future.GetCallback());
+ EXPECT_EQ(net::OK, future.Get<0>());
+ std::vector opened_files = std::get<1>(future.Take());
+ ASSERT_EQ(1U, opened_files.size());
+ ValidateFileContents(opened_files[0], kFileContent1);
+
+ ChildProcessSecurityPolicyImpl::GetInstance()->RevokeFileForBrowserUpload(
+ token);
}
} // namespace content
diff -Nru chromium-150.0.7871.114/content/browser/renderer_host/render_frame_host_impl.cc chromium-150.0.7871.124/content/browser/renderer_host/render_frame_host_impl.cc
--- chromium-150.0.7871.114/content/browser/renderer_host/render_frame_host_impl.cc 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/content/browser/renderer_host/render_frame_host_impl.cc 2026-07-13 21:36:30.000000000 +0000
@@ -10423,9 +10423,16 @@
// The non-owning pointer |new_frame_tree| is valid in this stack frame at
// least until the call to ShowCreatedWindow() below.
+ base::WeakPtr weak_self = GetWeakPtr();
FrameTree* new_frame_tree =
delegate_->CreateNewWindow(this, *params, is_new_browsing_instance,
was_consumed, cloned_namespace.get());
+ if (!weak_self) {
+ // This RFH may be deleted after CreateNewWindow() due to a nested message
+ // loop (e.g. showing the new window closes the window hosting `this`). See
+ // crbug.com/527676561.
+ return;
+ }
transient_allow_popup_.Deactivate();
diff -Nru chromium-150.0.7871.114/content/browser/scoped_browser_file_access.cc chromium-150.0.7871.124/content/browser/scoped_browser_file_access.cc
--- chromium-150.0.7871.114/content/browser/scoped_browser_file_access.cc 1970-01-01 00:00:00.000000000 +0000
+++ chromium-150.0.7871.124/content/browser/scoped_browser_file_access.cc 2026-07-13 21:36:30.000000000 +0000
@@ -0,0 +1,25 @@
+// Copyright 2026 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/scoped_browser_file_access.h"
+
+#include "content/browser/child_process_security_policy_impl.h"
+
+namespace content {
+
+ScopedBrowserFileAccess::ScopedBrowserFileAccess(
+ std::vector files)
+ : owner_token_(base::UnguessableToken::Create()) {
+ auto* policy = ChildProcessSecurityPolicyImpl::GetInstance();
+ for (const auto& file : files) {
+ policy->GrantFileForBrowserUpload(owner_token_, file);
+ }
+}
+
+ScopedBrowserFileAccess::~ScopedBrowserFileAccess() {
+ ChildProcessSecurityPolicyImpl::GetInstance()->RevokeFileForBrowserUpload(
+ owner_token_);
+}
+
+} // namespace content
diff -Nru chromium-150.0.7871.114/content/browser/scoped_browser_file_access.h chromium-150.0.7871.124/content/browser/scoped_browser_file_access.h
--- chromium-150.0.7871.114/content/browser/scoped_browser_file_access.h 1970-01-01 00:00:00.000000000 +0000
+++ chromium-150.0.7871.124/content/browser/scoped_browser_file_access.h 2026-07-13 21:36:30.000000000 +0000
@@ -0,0 +1,32 @@
+// Copyright 2026 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_SCOPED_BROWSER_FILE_ACCESS_H_
+#define CONTENT_BROWSER_SCOPED_BROWSER_FILE_ACCESS_H_
+
+#include
+
+#include "base/files/file_path.h"
+#include "base/unguessable_token.h"
+#include "content/common/content_export.h"
+
+namespace content {
+
+// A helper that grants the network service the capability to upload specific
+// files on the browser's behalf while the object is alive. This is useful for
+// browser-initiated uploads that do not use SimpleURLLoader.
+class CONTENT_EXPORT ScopedBrowserFileAccess {
+ public:
+ explicit ScopedBrowserFileAccess(std::vector files);
+ ScopedBrowserFileAccess(const ScopedBrowserFileAccess&) = delete;
+ ScopedBrowserFileAccess& operator=(const ScopedBrowserFileAccess&) = delete;
+ ~ScopedBrowserFileAccess();
+
+ private:
+ const base::UnguessableToken owner_token_;
+};
+
+} // namespace content
+
+#endif // CONTENT_BROWSER_SCOPED_BROWSER_FILE_ACCESS_H_
diff -Nru chromium-150.0.7871.114/content/browser/web_contents/web_contents_impl.cc chromium-150.0.7871.124/content/browser/web_contents/web_contents_impl.cc
--- chromium-150.0.7871.114/content/browser/web_contents/web_contents_impl.cc 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/content/browser/web_contents/web_contents_impl.cc 2026-07-13 21:36:30.000000000 +0000
@@ -5694,12 +5694,20 @@
bool was_blocked = false;
base::WeakPtr weak_new_contents =
new_contents_impl->weak_factory_.GetWeakPtr();
+ base::WeakPtr weak_this = weak_factory_.GetWeakPtr();
WebContentsImpl* contents_to_load = new_contents_impl;
if (delegate_) {
WebContents* web_contents_navigated = delegate_->AddNewContents(
this, std::move(new_contents), params.target_url, params.disposition,
*params.features, has_user_gesture, &was_blocked);
+ if (!weak_this) {
+ // `this` may be deleted after AddNewContents() due to a nested message
+ // loop (e.g. the window hosting the opener is closed). See
+ // crbug.com/527676561.
+ return nullptr;
+ }
+
if (base::FeatureList::IsEnabled(features::kPwaNavigationCapturing)) {
// The delegate may delete |new_contents_impl| during AddNewContents().
// If that occurs and there isn't a replacement contents returned, exit.
diff -Nru chromium-150.0.7871.114/content/browser/web_contents/web_contents_impl_browsertest.cc chromium-150.0.7871.124/content/browser/web_contents/web_contents_impl_browsertest.cc
--- chromium-150.0.7871.114/content/browser/web_contents/web_contents_impl_browsertest.cc 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/content/browser/web_contents/web_contents_impl_browsertest.cc 2026-07-13 21:36:30.000000000 +0000
@@ -3622,6 +3622,94 @@
namespace {
+// A WebContentsDelegate whose AddNewContents() runs a caller-provided closure
+// before returning. The closure is used to destroy the opener WebContents
+// synchronously, simulating the re-entrant destruction that can happen when
+// AddNewContents() spins a nested run loop (e.g. on Windows, showing the new
+// browser window dispatches native messages that can close the opener window).
+class DestroyOpenerOnAddNewContentsDelegate : public WebContentsDelegate {
+ public:
+ explicit DestroyOpenerOnAddNewContentsDelegate(base::OnceClosure on_add)
+ : on_add_(std::move(on_add)) {}
+
+ WebContents* AddNewContents(
+ WebContents* source,
+ std::unique_ptr new_contents,
+ const GURL& target_url,
+ WindowOpenDisposition disposition,
+ const blink::mojom::WindowFeatures& window_features,
+ bool user_gesture,
+ bool* was_blocked) override {
+ // Keep the new popup alive so that CreateNewWindow()'s `weak_new_contents`
+ // guard does NOT short-circuit. Otherwise the function would return early
+ // before reaching the code that dereferences the (now destroyed) opener,
+ // and the regression would not be exercised.
+ new_contents_ = std::move(new_contents);
+ WebContents* raw_new_contents = new_contents_.get();
+ if (on_add_) {
+ std::move(on_add_).Run();
+ }
+ return raw_new_contents;
+ }
+
+ private:
+ base::OnceClosure on_add_;
+ std::unique_ptr new_contents_;
+};
+
+} // namespace
+
+// Regression test for a use-after-free where the opener WebContents is
+// destroyed re-entrantly while WebContentsImpl::CreateNewWindow() is calling
+// WebContentsDelegate::AddNewContents(). With an opener-suppressed
+// (`noopener`) window.open(), CreateNewWindow() drives the new window through
+// the delegate and then keeps using `this` (and `delegate_`/`opener`) after
+// AddNewContents() returns. If the opener is torn down during that call, the
+// trailing code used to run on freed memory. See crbug.com/527676561.
+IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
+ CreateNewWindowOpenerDestroyedInAddNewContents) {
+ ASSERT_TRUE(embedded_test_server()->Start());
+
+ // Create an opener WebContents owned by the test, so the delegate can destroy
+ // it from within AddNewContents().
+ WebContents::CreateParams create_params(
+ shell()->web_contents()->GetBrowserContext());
+ create_params.desired_renderer_state =
+ WebContents::CreateParams::kInitializeAndWarmupRendererProcess;
+ std::unique_ptr opener(WebContents::Create(create_params));
+ WebContents* opener_ptr = opener.get();
+
+ base::RunLoop run_loop;
+ DestroyOpenerOnAddNewContentsDelegate delegate(
+ base::BindLambdaForTesting([&]() {
+ // Destroy the opener (`this` inside CreateNewWindow()) synchronously.
+ opener.reset();
+ run_loop.Quit();
+ }));
+ opener_ptr->SetDelegate(&delegate);
+
+ const GURL opener_url(
+ embedded_test_server()->GetURL("a.com", "/title1.html"));
+ ASSERT_TRUE(NavigateToURL(opener_ptr, opener_url));
+
+ // Open a new window with `noopener` so CreateNewWindow() takes the
+ // opener-suppressed path that shows/navigates the window via the delegate.
+ // The script is run fire-and-forget because the opener frame is destroyed
+ // while the window.open() IPC is being handled.
+ const GURL popup_url(
+ embedded_test_server()->GetURL("a.com", "/title2.html"));
+ ExecuteScriptAsync(
+ opener_ptr,
+ JsReplace("window.open($1, '_blank', 'noopener');", popup_url));
+
+ // The opener is destroyed during AddNewContents(). The test passes if this
+ // completes without a use-after-free (caught under ASAN).
+ run_loop.Run();
+ EXPECT_FALSE(opener);
+}
+
+namespace {
+
class OutgoingSetRendererPrefsMojoWatcher {
public:
explicit OutgoingSetRendererPrefsMojoWatcher(RenderViewHostImpl* rvh)
diff -Nru chromium-150.0.7871.114/content/public/browser/child_process_security_policy.h chromium-150.0.7871.124/content/public/browser/child_process_security_policy.h
--- chromium-150.0.7871.114/content/public/browser/child_process_security_policy.h 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/content/public/browser/child_process_security_policy.h 2026-07-13 21:36:30.000000000 +0000
@@ -101,6 +101,7 @@
// capability to upload the requested file.
virtual bool CanReadFile(ChildProcessId child_id,
const base::FilePath& file) = 0;
+
virtual bool CanCreateReadWriteFile(int child_id,
const base::FilePath& file) = 0;
diff -Nru chromium-150.0.7871.114/debian/changelog chromium-150.0.7871.124/debian/changelog
--- chromium-150.0.7871.114/debian/changelog 2026-07-10 05:45:42.000000000 +0000
+++ chromium-150.0.7871.124/debian/changelog 2026-07-15 03:16:33.000000000 +0000
@@ -1,3 +1,34 @@
+chromium (150.0.7871.124-1~deb13u1) trixie-security; urgency=high
+
+ [ Andres Salomon ]
+ * New upstream security release.
+ - CVE-2026-15764: Use after free in Ozone. Reported by Google.
+ - CVE-2026-15765: Use after free in Ozone. Reported by Google.
+ - CVE-2026-15766: Uninitialized Use in Skia. Reported by Google.
+ - CVE-2026-15767: Heap buffer overflow in libyuv. Reported by Google.
+ - CVE-2026-15768: Insufficient policy enforcement in HTML-in-Canvas.
+ Reported by Google.
+ - CVE-2026-15769: Insufficient validation of untrusted input in
+ Linux Toolkit Theming. Reported by Google.
+ - CVE-2026-15770: Uninitialized Use in V8. Reported by Google.
+ - CVE-2026-15771: Insufficient validation of untrusted input in Media.
+ Reported by Google.
+ - CVE-2026-15772: Use after free in GPU. Reported by Google.
+ - CVE-2026-15773: Use after free in Core.
+ Reported by xinchaotian of Microsoft.
+ - CVE-2026-15774: Use after free in Skia. Reported by Google.
+ - CVE-2026-15775: Insufficient policy enforcement in V8.
+ Reported by wang1r923096443@gmail.com.
+ - CVE-2026-15776: Type Confusion in V8.
+ Reported by Salvatore Gulizia (nickname: Serotav).
+ - CVE-2026-15777: Use after free in UI. Reported by Google.
+ - CVE-2026-15778: Insufficient validation of untrusted input in
+ Navigation. Reported by Google.
+ * d/patches/upstream/libyuv-loongarch-fix-row_lsx.cc-and-row_lasx.cc.patch:
+ drop, merged upstream.
+
+ -- Andres Salomon Tue, 14 Jul 2026 23:16:33 -0400
+
chromium (150.0.7871.114-1~deb13u1) trixie-security; urgency=high
[ Andres Salomon ]
diff -Nru chromium-150.0.7871.114/debian/patches/series chromium-150.0.7871.124/debian/patches/series
--- chromium-150.0.7871.114/debian/patches/series 2026-07-07 18:42:21.000000000 +0000
+++ chromium-150.0.7871.124/debian/patches/series 2026-07-15 03:16:33.000000000 +0000
@@ -36,7 +36,6 @@
upstream/sysroot.patch
upstream/ar-path1.patch
upstream/ar-path2.patch
-upstream/libyuv-loongarch-fix-row_lsx.cc-and-row_lasx.cc.patch
disable/tests.patch
disable/tests-swiftshader.patch
diff -Nru chromium-150.0.7871.114/debian/patches/upstream/libyuv-loongarch-fix-row_lsx.cc-and-row_lasx.cc.patch chromium-150.0.7871.124/debian/patches/upstream/libyuv-loongarch-fix-row_lsx.cc-and-row_lasx.cc.patch
--- chromium-150.0.7871.114/debian/patches/upstream/libyuv-loongarch-fix-row_lsx.cc-and-row_lasx.cc.patch 2026-07-07 18:42:10.000000000 +0000
+++ chromium-150.0.7871.124/debian/patches/upstream/libyuv-loongarch-fix-row_lsx.cc-and-row_lasx.cc.patch 1970-01-01 00:00:00.000000000 +0000
@@ -1,196 +0,0 @@
-From 3704304a68d23a662501d36a17db7178fb1d2039 Mon Sep 17 00:00:00 2001
-From: yuanhecai
-Date: Wed, 24 Jun 2026 21:24:31 +0800
-Subject: [PATCH] loongarch: fix row_lsx.cc and row_lasx.cc
-
-Remove custom ArgbConstants struct and use unified layout from row.h.
-
-Change-Id: I1fa0ed150a09ad659a5e7fff29cb4034e9c0638a
-Reviewed-on: https://chromium-review.googlesource.com/c/libyuv/libyuv/+/7997470
-Reviewed-by: Wan-Teh Chang
-Reviewed-by: Frank Barchard
----
- third_party/libyuv/source/row_lasx.cc | 40 ++++++++++++++------------
- third_party/libyuv/source/row_lsx.cc | 41 +++++++++++++++------------
- 2 files changed, 45 insertions(+), 36 deletions(-)
-
-diff --git a/third_party/libyuv/source/row_lasx.cc b/third_party/libyuv/source/row_lasx.cc
-index 94cb44ed19..d8b06689fb 100644
---- a/third_party/libyuv/source/row_lasx.cc
-+++ b/third_party/libyuv/source/row_lasx.cc
-@@ -2013,24 +2013,22 @@ void NV21ToARGBRow_LASX(const uint8_t* src_y,
- }
- }
-
--#ifndef ArgbConstants
--struct ArgbConstants {
-- uint8_t kRGBToY[4];
-- uint16_t kAddY;
-- uint16_t pad;
--};
--#define ArgbConstants ArgbConstants
--
- // RGB to JPeg coefficients
- // B * 0.1140 coefficient = 29
- // G * 0.5870 coefficient = 150
- // R * 0.2990 coefficient = 77
- // Add 0.5 = 0x80
- static const struct ArgbConstants kRgb24JPEGConstants = {{29, 150, 77, 0},
-- 128,
-- 0};
-+ {0},
-+ {0},
-+ {128},
-+ {0}};
-
--static const struct ArgbConstants kRawJPEGConstants = {{77, 150, 29, 0}, 128, 0};
-+static const struct ArgbConstants kRawJPEGConstants = {{77, 150, 29, 0},
-+ {0},
-+ {0},
-+ {128},
-+ {0}};
-
- // RGB to BT.601 coefficients
- // B * 0.1016 coefficient = 25
-@@ -2039,13 +2037,16 @@ static const struct ArgbConstants kRawJPEGConstants = {{77, 150, 29, 0}, 128, 0}
- // Add 16.5 = 0x1080
-
- static const struct ArgbConstants kRgb24I601Constants = {{25, 129, 66, 0},
-- 0x1080,
-- 0};
-+ {0},
-+ {0},
-+ {0x1080},
-+ {0}};
-
- static const struct ArgbConstants kRawI601Constants = {{66, 129, 25, 0},
-- 0x1080,
-- 0};
--#endif // ArgbConstants
-+ {0},
-+ {0},
-+ {0x1080},
-+ {0}};
-
- // ARGB expects first 3 values to contain RGB and 4th value is ignored.
- void ARGBToYMatrixRow_LASX(const uint8_t* src_argb,
-@@ -2057,7 +2058,8 @@ void ARGBToYMatrixRow_LASX(const uint8_t* src_argb,
- "xvldrepl.b $xr0, %3, 0 \n\t" // load rgbconstants
- "xvldrepl.b $xr1, %3, 1 \n\t" // load rgbconstants
- "xvldrepl.b $xr2, %3, 2 \n\t" // load rgbconstants
-- "xvldrepl.h $xr3, %3, 4 \n\t" // load rgbconstants
-+ "xvldrepl.b $xr21, %3, 3 \n\t" // load rgbconstants
-+ "xvldrepl.h $xr3, %3, 96 \n\t" // load rgbconstants
- "xvld $xr20, %4, 0 \n\t" // load shuff
- "1: \n\t"
- "xvld $xr4, %0, 0 \n\t"
-@@ -2079,6 +2081,8 @@ void ARGBToYMatrixRow_LASX(const uint8_t* src_argb,
- "xvmaddwev.h.bu $xr13, $xr11, $xr1 \n\t"
- "xvmaddwod.h.bu $xr12, $xr8, $xr2 \n\t" // R
- "xvmaddwod.h.bu $xr13, $xr10, $xr2 \n\t"
-+ "xvmaddwod.h.bu $xr12, $xr9, $xr21 \n\t" // A
-+ "xvmaddwod.h.bu $xr13, $xr11, $xr21 \n\t"
- "addi.d %0, %0, 128 \n\t"
- "xvpickod.b $xr10, $xr13, $xr12 \n\t"
- "xvperm.w $xr11, $xr10, $xr20 \n\t"
-@@ -2119,7 +2123,7 @@ static void RGBAToYMatrixRow_LASX(const uint8_t* src_rgba,
- "xvldrepl.b $xr0, %3, 0 \n\t" // load rgbconstants
- "xvldrepl.b $xr1, %3, 1 \n\t" // load rgbconstants
- "xvldrepl.b $xr2, %3, 2 \n\t" // load rgbconstants
-- "xvldrepl.h $xr3, %3, 4 \n\t" // load rgbconstants
-+ "xvldrepl.h $xr3, %3, 96 \n\t" // load rgbconstants
- "xvld $xr20, %4, 0 \n\t" // load shuff
- "1: \n\t"
- "xvld $xr4, %0, 0 \n\t"
-diff --git a/third_party/libyuv/source/row_lsx.cc b/third_party/libyuv/source/row_lsx.cc
-index 41689578ac..a9051f0ce0 100644
---- a/third_party/libyuv/source/row_lsx.cc
-+++ b/third_party/libyuv/source/row_lsx.cc
-@@ -2798,24 +2798,23 @@ void HalfFloatRow_LSX(const uint16_t* src,
- }
- }
-
--#ifndef ArgbConstants
--struct ArgbConstants {
-- uint8_t kRGBToY[4];
-- uint16_t kAddY;
-- uint16_t pad;
--};
--#define ArgbConstants ArgbConstants
--
- // RGB to JPeg coefficients
- // B * 0.1140 coefficient = 29
- // G * 0.5870 coefficient = 150
- // R * 0.2990 coefficient = 77
- // Add 0.5 = 0x80
-+
- static const struct ArgbConstants kRgb24JPEGConstants = {{29, 150, 77, 0},
-- 128,
-- 0};
-+ {0},
-+ {0},
-+ {128},
-+ {0}};
-
--static const struct ArgbConstants kRawJPEGConstants = {{77, 150, 29, 0}, 128, 0};
-+static const struct ArgbConstants kRawJPEGConstants = {{77, 150, 29, 0},
-+ {0},
-+ {0},
-+ {128},
-+ {0}};
-
- // RGB to BT.601 coefficients
- // B * 0.1016 coefficient = 25
-@@ -2824,13 +2823,16 @@ static const struct ArgbConstants kRawJPEGConstants = {{77, 150, 29, 0}, 128, 0}
- // Add 16.5 = 0x1080
-
- static const struct ArgbConstants kRgb24I601Constants = {{25, 129, 66, 0},
-- 0x1080,
-- 0};
-+ {0},
-+ {0},
-+ {0x1080},
-+ {0}};
-
- static const struct ArgbConstants kRawI601Constants = {{66, 129, 25, 0},
-- 0x1080,
-- 0};
--#endif // ArgbConstants
-+ {0},
-+ {0},
-+ {0x1080},
-+ {0}};
-
- // ARGB expects first 3 values to contain RGB and 4th value is ignored.
- void ARGBToYMatrixRow_LSX(const uint8_t* src_argb,
-@@ -2841,7 +2843,8 @@ void ARGBToYMatrixRow_LSX(const uint8_t* src_argb,
- "vldrepl.b $vr0, %3, 0 \n\t" // load rgbconstants
- "vldrepl.b $vr1, %3, 1 \n\t" // load rgbconstants
- "vldrepl.b $vr2, %3, 2 \n\t" // load rgbconstants
-- "vldrepl.h $vr3, %3, 4 \n\t" // load rgbconstants
-+ "vldrepl.b $vr20, %3, 3 \n\t" // load rgbconstants
-+ "vldrepl.h $vr3, %3, 96 \n\t" // load rgbconstants
- "1: \n\t"
- "vld $vr4, %0, 0 \n\t"
- "vld $vr5, %0, 16 \n\t"
-@@ -2862,6 +2865,8 @@ void ARGBToYMatrixRow_LSX(const uint8_t* src_argb,
- "vmaddwev.h.bu $vr13, $vr11, $vr1 \n\t"
- "vmaddwod.h.bu $vr12, $vr8, $vr2 \n\t" // R
- "vmaddwod.h.bu $vr13, $vr10, $vr2 \n\t"
-+ "vmaddwod.h.bu $vr12, $vr9, $vr20 \n\t" // A
-+ "vmaddwod.h.bu $vr13, $vr11, $vr20 \n\t"
- "addi.d %0, %0, 64 \n\t"
- "vpickod.b $vr10, $vr13, $vr12 \n\t"
- "vst $vr10, %1, 0 \n\t"
-@@ -2900,7 +2905,7 @@ static void RGBAToYMatrixRow_LSX(const uint8_t* src_rgba,
- "vldrepl.b $vr0, %3, 0 \n\t" // load rgbconstants
- "vldrepl.b $vr1, %3, 1 \n\t" // load rgbconstants
- "vldrepl.b $vr2, %3, 2 \n\t" // load rgbconstants
-- "vldrepl.h $vr3, %3, 4 \n\t" // load rgbconstants
-+ "vldrepl.h $vr3, %3, 96 \n\t" // load rgbconstants
- "1: \n\t"
- "vld $vr4, %0, 0 \n\t"
- "vld $vr5, %0, 16 \n\t"
---
-2.53.0
-
diff -Nru chromium-150.0.7871.114/gpu/BUILD.gn chromium-150.0.7871.124/gpu/BUILD.gn
--- chromium-150.0.7871.114/gpu/BUILD.gn 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/gpu/BUILD.gn 2026-07-13 21:36:30.000000000 +0000
@@ -492,6 +492,7 @@
"command_buffer/service/shared_context_state_unittest.cc",
"command_buffer/service/shared_image/compound_image_backing_unittest.cc",
"command_buffer/service/shared_image/gl_repack_utils_unittest.cc",
+ "command_buffer/service/shared_image/gl_texture_holder_unittest.cc",
"command_buffer/service/shared_memory_region_wrapper_unittest.cc",
"command_buffer/service/sync_point_manager_unittest.cc",
"command_buffer/service/task_graph_unittest.cc",
diff -Nru chromium-150.0.7871.114/gpu/command_buffer/service/shared_image/gl_texture_holder.cc chromium-150.0.7871.124/gpu/command_buffer/service/shared_image/gl_texture_holder.cc
--- chromium-150.0.7871.114/gpu/command_buffer/service/shared_image/gl_texture_holder.cc 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/gpu/command_buffer/service/shared_image/gl_texture_holder.cc 2026-07-13 21:36:30.000000000 +0000
@@ -7,6 +7,7 @@
#include
#include "base/bits.h"
+#include "base/memory/raw_ptr.h"
#include "build/build_config.h"
#include "gpu/command_buffer/service/shared_context_state.h"
#include "gpu/command_buffer/service/shared_image/gl_repack_utils.h"
@@ -56,6 +57,29 @@
return bytes_per_pixel;
}
+class ScopedTemporaryFramebuffer {
+ public:
+ explicit ScopedTemporaryFramebuffer(gl::GLApi* api) : api_(api) {
+ api_->glGenFramebuffersEXTFn(1, &id_);
+ }
+
+ ScopedTemporaryFramebuffer(const ScopedTemporaryFramebuffer&) = delete;
+ ScopedTemporaryFramebuffer& operator=(const ScopedTemporaryFramebuffer&) =
+ delete;
+
+ ~ScopedTemporaryFramebuffer() {
+ if (id_ != 0) {
+ api_->glDeleteFramebuffersEXTFn(1, &id_);
+ }
+ }
+
+ GLuint id() const { return id_; }
+
+ private:
+ const raw_ptr api_;
+ GLuint id_ = 0;
+};
+
} // anonymous namespace
// static
@@ -399,9 +423,15 @@
}
gl::GLApi* api = gl::g_current_gl_context;
- GLuint framebuffer;
- api->glGenFramebuffersEXTFn(1, &framebuffer);
- gl::ScopedFramebufferBinder scoped_framebuffer_binder(framebuffer);
+ // ScopedTemporaryFramebuffer must be declared before ScopedFramebufferBinder
+ // so that when this scope exits, ScopedFramebufferBinder is destroyed first
+ // (restoring the previous framebuffer binding) before the temporary FBO is
+ // deleted. Some drivers retain an internal reference to the previously bound
+ // FBO across bind transitions; deleting it while bound can trigger a
+ // driver UAF (see https://crbug.com/525317502).
+ ScopedTemporaryFramebuffer temp_fbo(api);
+ gl::ScopedFramebufferBinder scoped_framebuffer_binder(temp_fbo.id());
+
// This uses GL_FRAMEBUFFER instead of GL_READ_FRAMEBUFFER as the target for
// GLES2 compatibility.
api->glFramebufferTexture2DEXTFn(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0,
@@ -480,8 +510,6 @@
pixels);
}
- api->glDeleteFramebuffersEXTFn(1, &framebuffer);
-
if (!unpack_buffer.empty()) {
DCHECK_GT(dst_stride, expected_stride);
UnpackPixelDataWithStride(size_, unpack_buffer, expected_stride, pixmap);
diff -Nru chromium-150.0.7871.114/gpu/command_buffer/service/shared_image/gl_texture_holder.h chromium-150.0.7871.124/gpu/command_buffer/service/shared_image/gl_texture_holder.h
--- chromium-150.0.7871.114/gpu/command_buffer/service/shared_image/gl_texture_holder.h 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/gpu/command_buffer/service/shared_image/gl_texture_holder.h 2026-07-13 21:36:30.000000000 +0000
@@ -7,6 +7,7 @@
#include "gpu/command_buffer/service/shared_image/gl_common_image_backing_factory.h"
#include "gpu/command_buffer/service/shared_image/shared_image_format_service_utils.h"
+#include "gpu/gpu_gles2_export.h"
#include "ui/gl/progress_reporter.h"
class GrPromiseImageTexture;
@@ -17,7 +18,7 @@
// Helper class that holds a single GL texture, that works with either
// validating or passthrough command decoder.
-class GLTextureHolder {
+class GPU_GLES2_EXPORT GLTextureHolder {
public:
// Returns the equivalent SharedImageFormat for plane specified by
// `plane_index`.
diff -Nru chromium-150.0.7871.114/gpu/command_buffer/service/shared_image/gl_texture_holder_unittest.cc chromium-150.0.7871.124/gpu/command_buffer/service/shared_image/gl_texture_holder_unittest.cc
--- chromium-150.0.7871.114/gpu/command_buffer/service/shared_image/gl_texture_holder_unittest.cc 1970-01-01 00:00:00.000000000 +0000
+++ chromium-150.0.7871.124/gpu/command_buffer/service/shared_image/gl_texture_holder_unittest.cc 2026-07-13 21:36:30.000000000 +0000
@@ -0,0 +1,113 @@
+// Copyright 2026 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "gpu/command_buffer/service/shared_image/gl_texture_holder.h"
+
+#include "base/memory/scoped_refptr.h"
+#include "components/viz/common/resources/shared_image_format.h"
+#include "gpu/command_buffer/service/shared_image/shared_image_format_service_utils.h"
+#include "gpu/command_buffer/service/texture_manager.h"
+#include "testing/gmock/include/gmock/gmock.h"
+#include "testing/gtest/include/gtest/gtest.h"
+#include "third_party/skia/include/core/SkBitmap.h"
+#include "ui/gl/gl_bindings.h"
+#include "ui/gl/gl_context_stub.h"
+#include "ui/gl/gl_mock.h"
+#include "ui/gl/gl_surface_stub.h"
+#include "ui/gl/test/gl_surface_test_support.h"
+
+namespace gpu {
+namespace {
+
+using ::testing::_;
+using ::testing::InSequence;
+using ::testing::Ne;
+using ::testing::NiceMock;
+using ::testing::Pointee;
+using ::testing::Return;
+using ::testing::SetArgPointee;
+
+class GLTextureHolderTest : public ::testing::Test {
+ protected:
+ void SetUp() override {
+ gl::SetGLGetProcAddressProc(gl::MockGLInterface::GetGLProcAddress);
+ display_ = gl::GLSurfaceTestSupport::InitializeOneOffWithMockBindings();
+ gl_ = std::make_unique>();
+ gl::MockGLInterface::SetGLInterface(gl_.get());
+
+ surface_ = base::MakeRefCounted();
+ context_ = base::MakeRefCounted();
+ context_->SetGLVersionString("OpenGL ES 2.0");
+ context_->SetExtensionsString("");
+ context_->Initialize(surface_.get(), {});
+ context_->MakeCurrent(surface_.get());
+
+ ON_CALL(*gl_, CheckFramebufferStatusEXT(_))
+ .WillByDefault(Return(GL_FRAMEBUFFER_COMPLETE));
+ }
+
+ void TearDown() override {
+ context_ = nullptr;
+ surface_ = nullptr;
+ gl::MockGLInterface::SetGLInterface(nullptr);
+ gl_.reset();
+ gl::GLSurfaceTestSupport::ShutdownGL(display_);
+ }
+
+ std::unique_ptr> gl_;
+ scoped_refptr context_;
+ scoped_refptr surface_;
+ raw_ptr display_ = nullptr;
+};
+
+// ReadbackToMemory creates a temporary FBO for glReadPixels. The previous
+// framebuffer binding must be restored before the temporary FBO is deleted so
+// that the temporary FBO is never the previously bound FBO at the next bind
+// transition. Some drivers retain an internal reference to the previously
+// bound FBO across bind transitions; see the
+// ensure_previous_framebuffer_not_deleted driver workaround.
+TEST_F(GLTextureHolderTest, ReadbackToMemoryRestoresFramebufferBeforeDelete) {
+ constexpr GLuint kTextureId = 11;
+ constexpr GLuint kTempFboId = 22;
+ constexpr GLint kPrevFboId = 33;
+ constexpr gfx::Size kSize(4, 4);
+
+ GLTextureHolder holder(viz::SinglePlaneFormat::kRGBA_8888, kSize,
+ /*is_passthrough=*/true,
+ /*progress_reporter=*/nullptr);
+ GLFormatDesc format_desc;
+ format_desc.data_format = GL_RGBA;
+ format_desc.data_type = GL_UNSIGNED_BYTE;
+ format_desc.target = GL_TEXTURE_2D;
+ auto texture = base::MakeRefCounted(kTextureId,
+ GL_TEXTURE_2D);
+ holder.InitializeWithTexture(format_desc, texture);
+
+ ON_CALL(*gl_, GetIntegerv(GL_FRAMEBUFFER_BINDING, _))
+ .WillByDefault(SetArgPointee<1>(kPrevFboId));
+
+ {
+ InSequence seq;
+ EXPECT_CALL(*gl_, GenFramebuffersEXT(1, _))
+ .WillOnce(SetArgPointee<1>(kTempFboId));
+ EXPECT_CALL(*gl_, BindFramebufferEXT(GL_FRAMEBUFFER, kTempFboId));
+ EXPECT_CALL(*gl_, ReadPixels(0, 0, kSize.width(), kSize.height(), GL_RGBA,
+ GL_UNSIGNED_BYTE, _));
+ // The previous framebuffer binding must be restored before the temporary
+ // FBO is deleted.
+ EXPECT_CALL(*gl_, BindFramebufferEXT(GL_FRAMEBUFFER, kPrevFboId));
+ EXPECT_CALL(*gl_, DeleteFramebuffersEXT(1, Pointee(kTempFboId)));
+ }
+
+ SkBitmap bitmap;
+ bitmap.allocPixels(SkImageInfo::Make(kSize.width(), kSize.height(),
+ kRGBA_8888_SkColorType,
+ kPremul_SkAlphaType));
+ EXPECT_TRUE(holder.ReadbackToMemory(bitmap.pixmap()));
+
+ texture->MarkContextLost();
+}
+
+} // namespace
+} // namespace gpu
diff -Nru chromium-150.0.7871.114/gpu/config/gpu_lists_version.h chromium-150.0.7871.124/gpu/config/gpu_lists_version.h
--- chromium-150.0.7871.114/gpu/config/gpu_lists_version.h 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/gpu/config/gpu_lists_version.h 2026-07-13 21:36:30.000000000 +0000
@@ -3,6 +3,6 @@
#ifndef GPU_CONFIG_GPU_LISTS_VERSION_H_
#define GPU_CONFIG_GPU_LISTS_VERSION_H_
-#define GPU_LISTS_VERSION "f405107495a07cb1bfcf687d4af8d91117098db6"
+#define GPU_LISTS_VERSION "9261fd0a595ac4964ea84e6bd4a025c1173a2ffa"
#endif // GPU_CONFIG_GPU_LISTS_VERSION_H_
diff -Nru chromium-150.0.7871.114/gpu/vulkan/vulkan_image_linux.cc chromium-150.0.7871.124/gpu/vulkan/vulkan_image_linux.cc
--- chromium-150.0.7871.114/gpu/vulkan/vulkan_image_linux.cc 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/gpu/vulkan/vulkan_image_linux.cc 2026-07-13 21:36:30.000000000 +0000
@@ -4,14 +4,9 @@
#include "gpu/vulkan/vulkan_image.h"
-#include
-#include
-
#include
#include
-#include "base/debug/dump_without_crashing.h"
-#include "base/feature_list.h"
#include "base/logging.h"
#include "gpu/vulkan/vulkan_device_queue.h"
#include "gpu/vulkan/vulkan_function_pointers.h"
@@ -19,10 +14,6 @@
namespace gpu {
-namespace {
-BASE_FEATURE(kVulkanValidateDmabufSize, base::FEATURE_ENABLED_BY_DEFAULT);
-} // namespace
-
// static
std::unique_ptr VulkanImage::CreateWithExternalMemoryAndModifiers(
VulkanDeviceQueue* device_queue,
@@ -96,42 +87,6 @@
external_image_create_info.pNext = &modifier_info;
}
- device_queue_ = device_queue;
- disjoint_planes_ = false;
-
- if (!CreateVkImage(size, format, usage, flags, image_tiling,
- &external_image_create_info)) {
- device_queue_ = nullptr;
- return false;
- }
-
- VkMemoryRequirements requirements = GetMemoryRequirements(0);
-
- // SECURITY: |gmb_handle| (including |size| and the fd) may originate from an
- // untrusted process. Verify that the dma-buf is at least large enough to back
- // an image of |size| before letting vkAllocateMemory import it with an
- // allocationSize derived from vkGetImageMemoryRequirements().
- // dma-bufs support lseek(SEEK_END) to report their allocation size; treat an
- // un-seekable fd as invalid since real dma-bufs always do.
- off_t fd_size = lseek(scoped_fd.get(), 0, SEEK_END);
- if (fd_size < 0) {
- DLOG(ERROR) << "lseek() on dma-buf fd failed.";
- Destroy();
- return false;
- }
- lseek(scoped_fd.get(), 0, SEEK_SET);
-
- if (static_cast(fd_size) < requirements.size) {
- LOG(ERROR) << "dma-buf (" << fd_size << " bytes) is too small for "
- << size.width() << "x" << size.height() << " VkImage "
- << "(requires " << requirements.size << " bytes)";
- base::debug::DumpWithoutCrashing();
- if (base::FeatureList::IsEnabled(kVulkanValidateDmabufSize)) {
- Destroy();
- return false;
- }
- }
-
int memory_fd = scoped_fd.release();
VkImportMemoryFdInfoKHR import_memory_fd_info = {
.sType = VK_STRUCTURE_TYPE_IMPORT_MEMORY_FD_INFO_KHR,
@@ -154,36 +109,18 @@
import_memory_fd_info.pNext = &export_memory_info;
}
- // Allocate device memory and bind it to the image. On Linux, if
- // |import_memory_fd_info| is provided, it will import the dma-buf FD.
- auto result = AllocateAndBindMemory(0, &requirements, &import_memory_fd_info);
+ VkMemoryRequirements* requirements = nullptr;
+ // TODO support multiple plane
+ auto result = InitializeSingleOrJointPlanes(
+ device_queue, size, format, usage, flags, image_tiling,
+ &external_image_create_info, &import_memory_fd_info, requirements);
// If vkAllocateMemory() returned successfully, the fd in scoped_fd should be
// owned by vulkan, otherwise take the ownership of the fd back.
if (result == kFailedBeforeAllocateMemory) {
scoped_fd.reset(memory_fd);
}
- if (result != kSuccess) {
- Destroy();
- return false;
- }
-
- // Get subresource layout for images with VK_IMAGE_TILING_LINEAR.
- // For images with VK_IMAGE_TILING_DRM_FORMAT_MODIFIER_EXT, the layout is
- // initialized in InitializeWithExternalMemoryAndModifiers(). For
- // VK_IMAGE_TILING_OPTIMAL the layout is not usable and
- // vkGetImageSubresourceLayout() is illegal.
- if (image_tiling == VK_IMAGE_TILING_LINEAR) {
- const VkImageSubresource image_subresource = {
- .aspectMask = VK_IMAGE_ASPECT_COLOR_BIT,
- .mipLevel = 0,
- .arrayLayer = 0,
- };
- vkGetImageSubresourceLayout(device_queue_->GetVulkanDevice(), image_,
- &image_subresource, &layouts_[0]);
- }
-
- return true;
+ return result;
}
bool VulkanImage::InitializeWithExternalMemoryAndModifiers(
diff -Nru chromium-150.0.7871.114/gpu/vulkan/vulkan_image_unittest.cc chromium-150.0.7871.124/gpu/vulkan/vulkan_image_unittest.cc
--- chromium-150.0.7871.114/gpu/vulkan/vulkan_image_unittest.cc 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/gpu/vulkan/vulkan_image_unittest.cc 2026-07-13 21:36:30.000000000 +0000
@@ -4,13 +4,7 @@
#include "gpu/vulkan/vulkan_image.h"
-#if BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_CHROMEOS)
-#include
-#include
-#endif
-
#include "base/logging.h"
-#include "base/test/scoped_feature_list.h"
#include "build/build_config.h"
#include "gpu/config/gpu_info_collector.h"
#include "gpu/config/gpu_test_config.h"
@@ -126,39 +120,4 @@
}
}
-#if BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_CHROMEOS)
-TEST_F(VulkanImageTest, RejectUndersizedDmaBuf) {
- auto* device_queue = GetDeviceQueue();
- if (!device_queue) {
- return;
- }
-
- // 1. Create a small anonymous file (memfd) to simulate an undersized dma-buf.
- int fd = memfd_create("undersized_dmabuf", 0);
- ASSERT_GE(fd, 0);
- base::ScopedFD scoped_fd(fd);
- // Give it a tiny size (e.g., 4KB).
- ASSERT_EQ(ftruncate(fd, 4096), 0);
-
- // 2. Construct a GpuMemoryBufferHandle claiming it's large (e.g., 1024x1024).
- constexpr gfx::Size image_size(1024, 1024);
- const int stride = image_size.width() * 4; // 4 bytes per pixel
- const uint64_t size = static_cast(stride) * image_size.height();
-
- gfx::NativePixmapHandle native_pixmap_handle;
- native_pixmap_handle.modifier = gfx::NativePixmapHandle::kNoModifier;
- native_pixmap_handle.planes.emplace_back(stride, 0, size,
- base::ScopedFD(dup(fd)));
-
- gfx::GpuMemoryBufferHandle gmb_handle(std::move(native_pixmap_handle));
-
- // 3. Verify that InitializeFromGpuMemoryBufferHandle rejects it.
- auto image = VulkanImage::CreateFromGpuMemoryBufferHandle(
- device_queue, std::move(gmb_handle), image_size, VK_FORMAT_R8G8B8A8_UNORM,
- VK_IMAGE_USAGE_SAMPLED_BIT, 0, VK_IMAGE_TILING_LINEAR,
- VK_QUEUE_FAMILY_IGNORED);
- EXPECT_FALSE(image);
-}
-#endif
-
} // namespace gpu
diff -Nru "/srv/release.debian.org/tmp/sZmebN6a_q/chromium-150.0.7871.114/infra/config/generated/builders/ci/Linux ASan LSan Builder/targets/chromium.memory.json" "/srv/release.debian.org/tmp/hcY8mwSoct/chromium-150.0.7871.124/infra/config/generated/builders/ci/Linux ASan LSan Builder/targets/chromium.memory.json"
--- "/srv/release.debian.org/tmp/sZmebN6a_q/chromium-150.0.7871.114/infra/config/generated/builders/ci/Linux ASan LSan Builder/targets/chromium.memory.json" 2026-07-07 17:43:50.000000000 +0000
+++ "/srv/release.debian.org/tmp/hcY8mwSoct/chromium-150.0.7871.124/infra/config/generated/builders/ci/Linux ASan LSan Builder/targets/chromium.memory.json" 2026-07-13 21:36:30.000000000 +0000
@@ -811,6 +811,27 @@
"args": [
"--test-launcher-print-test-stdio=always"
],
+ "experiment_percentage": 100,
+ "merge": {
+ "script": "//testing/merge_scripts/standard_gtest_merge.py"
+ },
+ "module_name": "//ui/gtk:gtk_unittests",
+ "module_scheme": "gtest",
+ "name": "gtk_unittests",
+ "retry_only_failed_tests": true,
+ "swarming": {
+ "dimensions": {
+ "os": "Ubuntu-22.04"
+ },
+ "service_account": "chromium-tester@chops-service-accounts.iam.gserviceaccount.com"
+ },
+ "test": "gtk_unittests",
+ "test_id_prefix": "ninja://ui/gtk:gtk_unittests/"
+ },
+ {
+ "args": [
+ "--test-launcher-print-test-stdio=always"
+ ],
"merge": {
"script": "//testing/merge_scripts/standard_gtest_merge.py"
},
diff -Nru "/srv/release.debian.org/tmp/sZmebN6a_q/chromium-150.0.7871.114/infra/config/generated/builders/ci/Linux ASan LSan Tests (1)/targets/chromium.memory.json" "/srv/release.debian.org/tmp/hcY8mwSoct/chromium-150.0.7871.124/infra/config/generated/builders/ci/Linux ASan LSan Tests (1)/targets/chromium.memory.json"
--- "/srv/release.debian.org/tmp/sZmebN6a_q/chromium-150.0.7871.114/infra/config/generated/builders/ci/Linux ASan LSan Tests (1)/targets/chromium.memory.json" 2026-07-07 17:43:50.000000000 +0000
+++ "/srv/release.debian.org/tmp/hcY8mwSoct/chromium-150.0.7871.124/infra/config/generated/builders/ci/Linux ASan LSan Tests (1)/targets/chromium.memory.json" 2026-07-13 21:36:30.000000000 +0000
@@ -811,6 +811,27 @@
"args": [
"--test-launcher-print-test-stdio=always"
],
+ "experiment_percentage": 100,
+ "merge": {
+ "script": "//testing/merge_scripts/standard_gtest_merge.py"
+ },
+ "module_name": "//ui/gtk:gtk_unittests",
+ "module_scheme": "gtest",
+ "name": "gtk_unittests",
+ "retry_only_failed_tests": true,
+ "swarming": {
+ "dimensions": {
+ "os": "Ubuntu-22.04"
+ },
+ "service_account": "chromium-tester@chops-service-accounts.iam.gserviceaccount.com"
+ },
+ "test": "gtk_unittests",
+ "test_id_prefix": "ninja://ui/gtk:gtk_unittests/"
+ },
+ {
+ "args": [
+ "--test-launcher-print-test-stdio=always"
+ ],
"merge": {
"script": "//testing/merge_scripts/standard_gtest_merge.py"
},
diff -Nru "/srv/release.debian.org/tmp/sZmebN6a_q/chromium-150.0.7871.114/infra/config/generated/builders/ci/Linux Builder/targets/chromium.linux.json" "/srv/release.debian.org/tmp/hcY8mwSoct/chromium-150.0.7871.124/infra/config/generated/builders/ci/Linux Builder/targets/chromium.linux.json"
--- "/srv/release.debian.org/tmp/sZmebN6a_q/chromium-150.0.7871.114/infra/config/generated/builders/ci/Linux Builder/targets/chromium.linux.json" 2026-07-07 17:43:50.000000000 +0000
+++ "/srv/release.debian.org/tmp/hcY8mwSoct/chromium-150.0.7871.124/infra/config/generated/builders/ci/Linux Builder/targets/chromium.linux.json" 2026-07-13 21:36:30.000000000 +0000
@@ -746,6 +746,25 @@
"test_id_prefix": "ninja://gpu:gpu_unittests/"
},
{
+ "experiment_percentage": 100,
+ "isolate_profile_data": true,
+ "merge": {
+ "script": "//testing/merge_scripts/standard_gtest_merge.py"
+ },
+ "module_name": "//ui/gtk:gtk_unittests",
+ "module_scheme": "gtest",
+ "name": "gtk_unittests",
+ "retry_only_failed_tests": true,
+ "swarming": {
+ "dimensions": {
+ "os": "Ubuntu-22.04"
+ },
+ "service_account": "chromium-tester@chops-service-accounts.iam.gserviceaccount.com"
+ },
+ "test": "gtk_unittests",
+ "test_id_prefix": "ninja://ui/gtk:gtk_unittests/"
+ },
+ {
"isolate_profile_data": true,
"merge": {
"script": "//testing/merge_scripts/standard_gtest_merge.py"
diff -Nru "/srv/release.debian.org/tmp/sZmebN6a_q/chromium-150.0.7871.114/infra/config/generated/builders/ci/Linux Builder (Wayland)/targets/chromium.linux.json" "/srv/release.debian.org/tmp/hcY8mwSoct/chromium-150.0.7871.124/infra/config/generated/builders/ci/Linux Builder (Wayland)/targets/chromium.linux.json"
--- "/srv/release.debian.org/tmp/sZmebN6a_q/chromium-150.0.7871.114/infra/config/generated/builders/ci/Linux Builder (Wayland)/targets/chromium.linux.json" 2026-07-07 17:43:50.000000000 +0000
+++ "/srv/release.debian.org/tmp/hcY8mwSoct/chromium-150.0.7871.124/infra/config/generated/builders/ci/Linux Builder (Wayland)/targets/chromium.linux.json" 2026-07-13 21:36:30.000000000 +0000
@@ -948,6 +948,29 @@
"--use-weston",
"--ozone-platform=wayland"
],
+ "experiment_percentage": 100,
+ "isolate_profile_data": true,
+ "merge": {
+ "script": "//testing/merge_scripts/standard_gtest_merge.py"
+ },
+ "module_name": "//ui/gtk:gtk_unittests",
+ "module_scheme": "gtest",
+ "name": "gtk_unittests",
+ "swarming": {
+ "dimensions": {
+ "os": "Ubuntu-22.04"
+ },
+ "service_account": "chromium-tester@chops-service-accounts.iam.gserviceaccount.com"
+ },
+ "test": "gtk_unittests",
+ "test_id_prefix": "ninja://ui/gtk:gtk_unittests/"
+ },
+ {
+ "args": [
+ "--no-xvfb",
+ "--use-weston",
+ "--ozone-platform=wayland"
+ ],
"isolate_profile_data": true,
"merge": {
"script": "//testing/merge_scripts/standard_gtest_merge.py"
diff -Nru "/srv/release.debian.org/tmp/sZmebN6a_q/chromium-150.0.7871.114/infra/config/generated/builders/ci/Linux Builder (dbg)/targets/chromium.linux.json" "/srv/release.debian.org/tmp/hcY8mwSoct/chromium-150.0.7871.124/infra/config/generated/builders/ci/Linux Builder (dbg)/targets/chromium.linux.json"
--- "/srv/release.debian.org/tmp/sZmebN6a_q/chromium-150.0.7871.114/infra/config/generated/builders/ci/Linux Builder (dbg)/targets/chromium.linux.json" 2026-07-07 17:43:50.000000000 +0000
+++ "/srv/release.debian.org/tmp/hcY8mwSoct/chromium-150.0.7871.124/infra/config/generated/builders/ci/Linux Builder (dbg)/targets/chromium.linux.json" 2026-07-13 21:36:30.000000000 +0000
@@ -632,6 +632,23 @@
"test_id_prefix": "ninja://gpu:gpu_unittests/"
},
{
+ "experiment_percentage": 100,
+ "merge": {
+ "script": "//testing/merge_scripts/standard_gtest_merge.py"
+ },
+ "module_name": "//ui/gtk:gtk_unittests",
+ "module_scheme": "gtest",
+ "name": "gtk_unittests",
+ "swarming": {
+ "dimensions": {
+ "os": "Ubuntu-22.04"
+ },
+ "service_account": "chromium-tester@chops-service-accounts.iam.gserviceaccount.com"
+ },
+ "test": "gtk_unittests",
+ "test_id_prefix": "ninja://ui/gtk:gtk_unittests/"
+ },
+ {
"merge": {
"script": "//testing/merge_scripts/standard_gtest_merge.py"
},
diff -Nru "/srv/release.debian.org/tmp/sZmebN6a_q/chromium-150.0.7871.114/infra/config/generated/builders/ci/Linux TSan Builder/targets/chromium.memory.json" "/srv/release.debian.org/tmp/hcY8mwSoct/chromium-150.0.7871.124/infra/config/generated/builders/ci/Linux TSan Builder/targets/chromium.memory.json"
--- "/srv/release.debian.org/tmp/sZmebN6a_q/chromium-150.0.7871.114/infra/config/generated/builders/ci/Linux TSan Builder/targets/chromium.memory.json" 2026-07-07 17:43:50.000000000 +0000
+++ "/srv/release.debian.org/tmp/hcY8mwSoct/chromium-150.0.7871.124/infra/config/generated/builders/ci/Linux TSan Builder/targets/chromium.memory.json" 2026-07-13 21:36:30.000000000 +0000
@@ -787,6 +787,27 @@
"args": [
"--test-launcher-print-test-stdio=always"
],
+ "experiment_percentage": 100,
+ "merge": {
+ "script": "//testing/merge_scripts/standard_gtest_merge.py"
+ },
+ "module_name": "//ui/gtk:gtk_unittests",
+ "module_scheme": "gtest",
+ "name": "gtk_unittests",
+ "retry_only_failed_tests": true,
+ "swarming": {
+ "dimensions": {
+ "os": "Ubuntu-22.04"
+ },
+ "service_account": "chromium-tester@chops-service-accounts.iam.gserviceaccount.com"
+ },
+ "test": "gtk_unittests",
+ "test_id_prefix": "ninja://ui/gtk:gtk_unittests/"
+ },
+ {
+ "args": [
+ "--test-launcher-print-test-stdio=always"
+ ],
"merge": {
"script": "//testing/merge_scripts/standard_gtest_merge.py"
},
diff -Nru "/srv/release.debian.org/tmp/sZmebN6a_q/chromium-150.0.7871.114/infra/config/generated/builders/ci/Linux TSan Tests/targets/chromium.memory.json" "/srv/release.debian.org/tmp/hcY8mwSoct/chromium-150.0.7871.124/infra/config/generated/builders/ci/Linux TSan Tests/targets/chromium.memory.json"
--- "/srv/release.debian.org/tmp/sZmebN6a_q/chromium-150.0.7871.114/infra/config/generated/builders/ci/Linux TSan Tests/targets/chromium.memory.json" 2026-07-07 17:43:50.000000000 +0000
+++ "/srv/release.debian.org/tmp/hcY8mwSoct/chromium-150.0.7871.124/infra/config/generated/builders/ci/Linux TSan Tests/targets/chromium.memory.json" 2026-07-13 21:36:30.000000000 +0000
@@ -787,6 +787,27 @@
"args": [
"--test-launcher-print-test-stdio=always"
],
+ "experiment_percentage": 100,
+ "merge": {
+ "script": "//testing/merge_scripts/standard_gtest_merge.py"
+ },
+ "module_name": "//ui/gtk:gtk_unittests",
+ "module_scheme": "gtest",
+ "name": "gtk_unittests",
+ "retry_only_failed_tests": true,
+ "swarming": {
+ "dimensions": {
+ "os": "Ubuntu-22.04"
+ },
+ "service_account": "chromium-tester@chops-service-accounts.iam.gserviceaccount.com"
+ },
+ "test": "gtk_unittests",
+ "test_id_prefix": "ninja://ui/gtk:gtk_unittests/"
+ },
+ {
+ "args": [
+ "--test-launcher-print-test-stdio=always"
+ ],
"merge": {
"script": "//testing/merge_scripts/standard_gtest_merge.py"
},
diff -Nru "/srv/release.debian.org/tmp/sZmebN6a_q/chromium-150.0.7871.114/infra/config/generated/builders/ci/Linux Tests/targets/chromium.linux.json" "/srv/release.debian.org/tmp/hcY8mwSoct/chromium-150.0.7871.124/infra/config/generated/builders/ci/Linux Tests/targets/chromium.linux.json"
--- "/srv/release.debian.org/tmp/sZmebN6a_q/chromium-150.0.7871.114/infra/config/generated/builders/ci/Linux Tests/targets/chromium.linux.json" 2026-07-07 17:43:50.000000000 +0000
+++ "/srv/release.debian.org/tmp/hcY8mwSoct/chromium-150.0.7871.124/infra/config/generated/builders/ci/Linux Tests/targets/chromium.linux.json" 2026-07-13 21:36:30.000000000 +0000
@@ -703,6 +703,25 @@
"test_id_prefix": "ninja://gpu:gpu_unittests/"
},
{
+ "experiment_percentage": 100,
+ "isolate_profile_data": true,
+ "merge": {
+ "script": "//testing/merge_scripts/standard_gtest_merge.py"
+ },
+ "module_name": "//ui/gtk:gtk_unittests",
+ "module_scheme": "gtest",
+ "name": "gtk_unittests",
+ "retry_only_failed_tests": true,
+ "swarming": {
+ "dimensions": {
+ "os": "Ubuntu-22.04"
+ },
+ "service_account": "chromium-tester@chops-service-accounts.iam.gserviceaccount.com"
+ },
+ "test": "gtk_unittests",
+ "test_id_prefix": "ninja://ui/gtk:gtk_unittests/"
+ },
+ {
"isolate_profile_data": true,
"merge": {
"script": "//testing/merge_scripts/standard_gtest_merge.py"
diff -Nru "/srv/release.debian.org/tmp/sZmebN6a_q/chromium-150.0.7871.114/infra/config/generated/builders/ci/Linux Tests (dbg)(1)/targets/chromium.linux.json" "/srv/release.debian.org/tmp/hcY8mwSoct/chromium-150.0.7871.124/infra/config/generated/builders/ci/Linux Tests (dbg)(1)/targets/chromium.linux.json"
--- "/srv/release.debian.org/tmp/sZmebN6a_q/chromium-150.0.7871.114/infra/config/generated/builders/ci/Linux Tests (dbg)(1)/targets/chromium.linux.json" 2026-07-07 17:43:50.000000000 +0000
+++ "/srv/release.debian.org/tmp/hcY8mwSoct/chromium-150.0.7871.124/infra/config/generated/builders/ci/Linux Tests (dbg)(1)/targets/chromium.linux.json" 2026-07-13 21:36:30.000000000 +0000
@@ -627,6 +627,23 @@
"test_id_prefix": "ninja://gpu:gpu_unittests/"
},
{
+ "experiment_percentage": 100,
+ "merge": {
+ "script": "//testing/merge_scripts/standard_gtest_merge.py"
+ },
+ "module_name": "//ui/gtk:gtk_unittests",
+ "module_scheme": "gtest",
+ "name": "gtk_unittests",
+ "swarming": {
+ "dimensions": {
+ "os": "Ubuntu-22.04"
+ },
+ "service_account": "chromium-tester@chops-service-accounts.iam.gserviceaccount.com"
+ },
+ "test": "gtk_unittests",
+ "test_id_prefix": "ninja://ui/gtk:gtk_unittests/"
+ },
+ {
"merge": {
"script": "//testing/merge_scripts/standard_gtest_merge.py"
},
diff -Nru chromium-150.0.7871.114/infra/config/generated/builders/ci/linux-wayland-weston-rel-tests/targets/chromium.linux.json chromium-150.0.7871.124/infra/config/generated/builders/ci/linux-wayland-weston-rel-tests/targets/chromium.linux.json
--- chromium-150.0.7871.114/infra/config/generated/builders/ci/linux-wayland-weston-rel-tests/targets/chromium.linux.json 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/infra/config/generated/builders/ci/linux-wayland-weston-rel-tests/targets/chromium.linux.json 2026-07-13 21:36:30.000000000 +0000
@@ -859,6 +859,29 @@
"--use-weston",
"--ozone-platform=wayland"
],
+ "experiment_percentage": 100,
+ "isolate_profile_data": true,
+ "merge": {
+ "script": "//testing/merge_scripts/standard_gtest_merge.py"
+ },
+ "module_name": "//ui/gtk:gtk_unittests",
+ "module_scheme": "gtest",
+ "name": "gtk_unittests",
+ "swarming": {
+ "dimensions": {
+ "os": "Ubuntu-22.04"
+ },
+ "service_account": "chromium-tester@chops-service-accounts.iam.gserviceaccount.com"
+ },
+ "test": "gtk_unittests",
+ "test_id_prefix": "ninja://ui/gtk:gtk_unittests/"
+ },
+ {
+ "args": [
+ "--no-xvfb",
+ "--use-weston",
+ "--ozone-platform=wayland"
+ ],
"isolate_profile_data": true,
"merge": {
"script": "//testing/merge_scripts/standard_gtest_merge.py"
diff -Nru chromium-150.0.7871.114/infra/config/generated/builders/try/linux-rel/targets/chromium.linux.json chromium-150.0.7871.124/infra/config/generated/builders/try/linux-rel/targets/chromium.linux.json
--- chromium-150.0.7871.114/infra/config/generated/builders/try/linux-rel/targets/chromium.linux.json 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/infra/config/generated/builders/try/linux-rel/targets/chromium.linux.json 2026-07-13 21:36:30.000000000 +0000
@@ -746,6 +746,25 @@
"test_id_prefix": "ninja://gpu:gpu_unittests/"
},
{
+ "experiment_percentage": 100,
+ "isolate_profile_data": true,
+ "merge": {
+ "script": "//testing/merge_scripts/standard_gtest_merge.py"
+ },
+ "module_name": "//ui/gtk:gtk_unittests",
+ "module_scheme": "gtest",
+ "name": "gtk_unittests",
+ "retry_only_failed_tests": true,
+ "swarming": {
+ "dimensions": {
+ "os": "Ubuntu-22.04"
+ },
+ "service_account": "chromium-tester@chops-service-accounts.iam.gserviceaccount.com"
+ },
+ "test": "gtk_unittests",
+ "test_id_prefix": "ninja://ui/gtk:gtk_unittests/"
+ },
+ {
"isolate_profile_data": true,
"merge": {
"script": "//testing/merge_scripts/standard_gtest_merge.py"
diff -Nru chromium-150.0.7871.114/infra/config/generated/builders/try/linux-wayland-weston-rel/targets/chromium.linux.json chromium-150.0.7871.124/infra/config/generated/builders/try/linux-wayland-weston-rel/targets/chromium.linux.json
--- chromium-150.0.7871.114/infra/config/generated/builders/try/linux-wayland-weston-rel/targets/chromium.linux.json 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/infra/config/generated/builders/try/linux-wayland-weston-rel/targets/chromium.linux.json 2026-07-13 21:36:30.000000000 +0000
@@ -864,6 +864,29 @@
"--use-weston",
"--ozone-platform=wayland"
],
+ "experiment_percentage": 100,
+ "isolate_profile_data": true,
+ "merge": {
+ "script": "//testing/merge_scripts/standard_gtest_merge.py"
+ },
+ "module_name": "//ui/gtk:gtk_unittests",
+ "module_scheme": "gtest",
+ "name": "gtk_unittests",
+ "swarming": {
+ "dimensions": {
+ "os": "Ubuntu-22.04"
+ },
+ "service_account": "chromium-tester@chops-service-accounts.iam.gserviceaccount.com"
+ },
+ "test": "gtk_unittests",
+ "test_id_prefix": "ninja://ui/gtk:gtk_unittests/"
+ },
+ {
+ "args": [
+ "--no-xvfb",
+ "--use-weston",
+ "--ozone-platform=wayland"
+ ],
"isolate_profile_data": true,
"merge": {
"script": "//testing/merge_scripts/standard_gtest_merge.py"
diff -Nru chromium-150.0.7871.114/infra/config/generated/builders/try/linux_chromium_asan_rel_ng/targets/chromium.memory.json chromium-150.0.7871.124/infra/config/generated/builders/try/linux_chromium_asan_rel_ng/targets/chromium.memory.json
--- chromium-150.0.7871.114/infra/config/generated/builders/try/linux_chromium_asan_rel_ng/targets/chromium.memory.json 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/infra/config/generated/builders/try/linux_chromium_asan_rel_ng/targets/chromium.memory.json 2026-07-13 21:36:30.000000000 +0000
@@ -811,6 +811,27 @@
"args": [
"--test-launcher-print-test-stdio=always"
],
+ "experiment_percentage": 100,
+ "merge": {
+ "script": "//testing/merge_scripts/standard_gtest_merge.py"
+ },
+ "module_name": "//ui/gtk:gtk_unittests",
+ "module_scheme": "gtest",
+ "name": "gtk_unittests",
+ "retry_only_failed_tests": true,
+ "swarming": {
+ "dimensions": {
+ "os": "Ubuntu-22.04"
+ },
+ "service_account": "chromium-tester@chops-service-accounts.iam.gserviceaccount.com"
+ },
+ "test": "gtk_unittests",
+ "test_id_prefix": "ninja://ui/gtk:gtk_unittests/"
+ },
+ {
+ "args": [
+ "--test-launcher-print-test-stdio=always"
+ ],
"merge": {
"script": "//testing/merge_scripts/standard_gtest_merge.py"
},
diff -Nru chromium-150.0.7871.114/infra/config/generated/builders/try/linux_chromium_compile_dbg_ng/targets/chromium.linux.json chromium-150.0.7871.124/infra/config/generated/builders/try/linux_chromium_compile_dbg_ng/targets/chromium.linux.json
--- chromium-150.0.7871.114/infra/config/generated/builders/try/linux_chromium_compile_dbg_ng/targets/chromium.linux.json 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/infra/config/generated/builders/try/linux_chromium_compile_dbg_ng/targets/chromium.linux.json 2026-07-13 21:36:30.000000000 +0000
@@ -632,6 +632,23 @@
"test_id_prefix": "ninja://gpu:gpu_unittests/"
},
{
+ "experiment_percentage": 100,
+ "merge": {
+ "script": "//testing/merge_scripts/standard_gtest_merge.py"
+ },
+ "module_name": "//ui/gtk:gtk_unittests",
+ "module_scheme": "gtest",
+ "name": "gtk_unittests",
+ "swarming": {
+ "dimensions": {
+ "os": "Ubuntu-22.04"
+ },
+ "service_account": "chromium-tester@chops-service-accounts.iam.gserviceaccount.com"
+ },
+ "test": "gtk_unittests",
+ "test_id_prefix": "ninja://ui/gtk:gtk_unittests/"
+ },
+ {
"merge": {
"script": "//testing/merge_scripts/standard_gtest_merge.py"
},
diff -Nru chromium-150.0.7871.114/infra/config/generated/builders/try/linux_chromium_dbg_ng/targets/chromium.linux.json chromium-150.0.7871.124/infra/config/generated/builders/try/linux_chromium_dbg_ng/targets/chromium.linux.json
--- chromium-150.0.7871.114/infra/config/generated/builders/try/linux_chromium_dbg_ng/targets/chromium.linux.json 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/infra/config/generated/builders/try/linux_chromium_dbg_ng/targets/chromium.linux.json 2026-07-13 21:36:30.000000000 +0000
@@ -632,6 +632,23 @@
"test_id_prefix": "ninja://gpu:gpu_unittests/"
},
{
+ "experiment_percentage": 100,
+ "merge": {
+ "script": "//testing/merge_scripts/standard_gtest_merge.py"
+ },
+ "module_name": "//ui/gtk:gtk_unittests",
+ "module_scheme": "gtest",
+ "name": "gtk_unittests",
+ "swarming": {
+ "dimensions": {
+ "os": "Ubuntu-22.04"
+ },
+ "service_account": "chromium-tester@chops-service-accounts.iam.gserviceaccount.com"
+ },
+ "test": "gtk_unittests",
+ "test_id_prefix": "ninja://ui/gtk:gtk_unittests/"
+ },
+ {
"merge": {
"script": "//testing/merge_scripts/standard_gtest_merge.py"
},
diff -Nru chromium-150.0.7871.114/infra/config/generated/builders/try/linux_chromium_tsan_rel_ng/targets/chromium.memory.json chromium-150.0.7871.124/infra/config/generated/builders/try/linux_chromium_tsan_rel_ng/targets/chromium.memory.json
--- chromium-150.0.7871.114/infra/config/generated/builders/try/linux_chromium_tsan_rel_ng/targets/chromium.memory.json 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/infra/config/generated/builders/try/linux_chromium_tsan_rel_ng/targets/chromium.memory.json 2026-07-13 21:36:30.000000000 +0000
@@ -787,6 +787,27 @@
"args": [
"--test-launcher-print-test-stdio=always"
],
+ "experiment_percentage": 100,
+ "merge": {
+ "script": "//testing/merge_scripts/standard_gtest_merge.py"
+ },
+ "module_name": "//ui/gtk:gtk_unittests",
+ "module_scheme": "gtest",
+ "name": "gtk_unittests",
+ "retry_only_failed_tests": true,
+ "swarming": {
+ "dimensions": {
+ "os": "Ubuntu-22.04"
+ },
+ "service_account": "chromium-tester@chops-service-accounts.iam.gserviceaccount.com"
+ },
+ "test": "gtk_unittests",
+ "test_id_prefix": "ninja://ui/gtk:gtk_unittests/"
+ },
+ {
+ "args": [
+ "--test-launcher-print-test-stdio=always"
+ ],
"merge": {
"script": "//testing/merge_scripts/standard_gtest_merge.py"
},
diff -Nru chromium-150.0.7871.114/infra/config/generated/cq-usage/cq-tests.md chromium-150.0.7871.124/infra/config/generated/cq-usage/cq-tests.md
--- chromium-150.0.7871.114/infra/config/generated/cq-usage/cq-tests.md 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/infra/config/generated/cq-usage/cq-tests.md 2026-07-13 21:36:30.000000000 +0000
@@ -836,6 +836,12 @@
* [mac_chromium_compile_dbg_ng](https://ci.chromium.org/ui/p/chromium-m150/builders/try/mac_chromium_compile_dbg_ng) ([definition](https://cs.chromium.org/search?q=file:/try/.*%5C.star$%20%22name%20=%20%5C%22mac_chromium_compile_dbg_ng%5C%22%22))
* [win-rel](https://ci.chromium.org/ui/p/chromium-m150/builders/try/win-rel) ([definition](https://cs.chromium.org/search?q=file:/try/.*%5C.star$%20%22name%20=%20%5C%22win-rel%5C%22%22))
+### gtk_unittests
+* [linux-rel](https://ci.chromium.org/ui/p/chromium-m150/builders/try/linux-rel) ([definition](https://cs.chromium.org/search?q=file:/try/.*%5C.star$%20%22name%20=%20%5C%22linux-rel%5C%22%22))
+* [linux_chromium_asan_rel_ng](https://ci.chromium.org/ui/p/chromium-m150/builders/try/linux_chromium_asan_rel_ng) ([definition](https://cs.chromium.org/search?q=file:/try/.*%5C.star$%20%22name%20=%20%5C%22linux_chromium_asan_rel_ng%5C%22%22))
+* [linux_chromium_compile_dbg_ng](https://ci.chromium.org/ui/p/chromium-m150/builders/try/linux_chromium_compile_dbg_ng) ([definition](https://cs.chromium.org/search?q=file:/try/.*%5C.star$%20%22name%20=%20%5C%22linux_chromium_compile_dbg_ng%5C%22%22))
+* [linux_chromium_tsan_rel_ng](https://ci.chromium.org/ui/p/chromium-m150/builders/try/linux_chromium_tsan_rel_ng) ([definition](https://cs.chromium.org/search?q=file:/try/.*%5C.star$%20%22name%20=%20%5C%22linux_chromium_tsan_rel_ng%5C%22%22))
+
### gwp_asan_unittests
* [android-x64-rel](https://ci.chromium.org/ui/p/chromium-m150/builders/try/android-x64-rel) ([definition](https://cs.chromium.org/search?q=file:/try/.*%5C.star$%20%22name%20=%20%5C%22android-x64-rel%5C%22%22))
* [android-x86-rel](https://ci.chromium.org/ui/p/chromium-m150/builders/try/android-x86-rel) ([definition](https://cs.chromium.org/search?q=file:/try/.*%5C.star$%20%22name%20=%20%5C%22android-x86-rel%5C%22%22))
diff -Nru chromium-150.0.7871.114/infra/config/generated/testing/gn_isolate_map.pyl chromium-150.0.7871.124/infra/config/generated/testing/gn_isolate_map.pyl
--- chromium-150.0.7871.114/infra/config/generated/testing/gn_isolate_map.pyl 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/infra/config/generated/testing/gn_isolate_map.pyl 2026-07-13 21:36:30.000000000 +0000
@@ -1208,6 +1208,12 @@
"../../tools/grit/grit/test_suite_all.py",
],
},
+ "gtk_unittests": {
+ "label": "//ui/gtk:gtk_unittests",
+ "type": "windowed_test_launcher",
+ "module_scheme": "gtest",
+ "skip_usage_check": True,
+ },
"gwp_asan_unittests": {
"label": "//components/gwp_asan:gwp_asan_unittests",
"type": "console_test_launcher",
diff -Nru chromium-150.0.7871.114/infra/config/targets/binaries.star chromium-150.0.7871.124/infra/config/targets/binaries.star
--- chromium-150.0.7871.114/infra/config/targets/binaries.star 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/infra/config/targets/binaries.star 2026-07-13 21:36:30.000000000 +0000
@@ -2555,6 +2555,13 @@
)
targets.binaries.windowed_test_launcher(
+ name = "gtk_unittests",
+ label = "//ui/gtk:gtk_unittests",
+ module_scheme = "gtest",
+ skip_usage_check = True,
+)
+
+targets.binaries.windowed_test_launcher(
name = "viz_unittests",
label = "//components/viz:viz_unittests",
module_scheme = "gtest",
diff -Nru chromium-150.0.7871.114/infra/config/targets/bundles.star chromium-150.0.7871.124/infra/config/targets/bundles.star
--- chromium-150.0.7871.114/infra/config/targets/bundles.star 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/infra/config/targets/bundles.star 2026-07-13 21:36:30.000000000 +0000
@@ -1651,9 +1651,15 @@
targets.bundle(
name = "chromium_gtests_for_linux_only",
targets = [
+ "gtk_unittests",
"ozone_unittests",
"ozone_x11_unittests",
],
+ per_test_modifications = {
+ "gtk_unittests": targets.mixin(
+ experiment_percentage = 100,
+ ),
+ },
)
targets.bundle(
diff -Nru chromium-150.0.7871.114/infra/config/targets/tests.star chromium-150.0.7871.124/infra/config/targets/tests.star
--- chromium-150.0.7871.114/infra/config/targets/tests.star 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/infra/config/targets/tests.star 2026-07-13 21:36:30.000000000 +0000
@@ -2750,6 +2750,10 @@
)
targets.tests.gtest_test(
+ name = "gtk_unittests",
+)
+
+targets.tests.gtest_test(
name = "views_ax_chromeos_browser_tests",
args = [
"--enable-features=ViewsAccessibilitySerializeOnDataChanged",
diff -Nru chromium-150.0.7871.114/media/gpu/windows/media_foundation_video_encode_accelerator_win.cc chromium-150.0.7871.124/media/gpu/windows/media_foundation_video_encode_accelerator_win.cc
--- chromium-150.0.7871.114/media/gpu/windows/media_foundation_video_encode_accelerator_win.cc 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/media/gpu/windows/media_foundation_video_encode_accelerator_win.cc 2026-07-13 21:36:30.000000000 +0000
@@ -3043,6 +3043,12 @@
D3D11_TEXTURE2D_DESC input_desc;
input_texture->GetDesc(&input_desc);
+ if (input_desc.Format != DXGI_FORMAT_NV12) {
+ LOG(ERROR) << "Format mismatch: source format " << input_desc.Format
+ << " is not DXGI_FORMAT_NV12";
+ return E_INVALIDARG;
+ }
+
if (visible_rect.x() < 0 || visible_rect.y() < 0 ||
visible_rect.right() > static_cast(input_desc.Width) ||
visible_rect.bottom() > static_cast(input_desc.Height)) {
diff -Nru chromium-150.0.7871.114/services/network/public/cpp/features.cc chromium-150.0.7871.124/services/network/public/cpp/features.cc
--- chromium-150.0.7871.114/services/network/public/cpp/features.cc 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/services/network/public/cpp/features.cc 2026-07-13 21:36:30.000000000 +0000
@@ -653,4 +653,7 @@
BASE_FEATURE(kDeclarativePerformanceObserver,
base::FEATURE_DISABLED_BY_DEFAULT);
+BASE_FEATURE(kBrowserInitiatedFileUploadValidation,
+ base::FEATURE_ENABLED_BY_DEFAULT);
+
} // namespace network::features
diff -Nru chromium-150.0.7871.114/services/network/public/cpp/features.h chromium-150.0.7871.124/services/network/public/cpp/features.h
--- chromium-150.0.7871.114/services/network/public/cpp/features.h 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/services/network/public/cpp/features.h 2026-07-13 21:36:30.000000000 +0000
@@ -442,6 +442,11 @@
COMPONENT_EXPORT(NETWORK_CPP_FLAGS_AND_SWITCHES)
BASE_DECLARE_FEATURE(kDeclarativePerformanceObserver);
+// Enables validating browser-initiated file upload requests from the network
+// service.
+COMPONENT_EXPORT(NETWORK_CPP_FLAGS_AND_SWITCHES)
+BASE_DECLARE_FEATURE(kBrowserInitiatedFileUploadValidation);
+
} // namespace network::features
#endif // SERVICES_NETWORK_PUBLIC_CPP_FEATURES_H_
diff -Nru chromium-150.0.7871.114/services/network/public/cpp/simple_url_loader.cc chromium-150.0.7871.124/services/network/public/cpp/simple_url_loader.cc
--- chromium-150.0.7871.114/services/network/public/cpp/simple_url_loader.cc 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/services/network/public/cpp/simple_url_loader.cc 2026-07-13 21:36:30.000000000 +0000
@@ -23,6 +23,7 @@
#include "base/memory/raw_ptr.h"
#include "base/memory/ref_counted.h"
#include "base/memory/weak_ptr.h"
+#include "base/no_destructor.h"
#include "base/numerics/safe_conversions.h"
#include "base/sequence_checker.h"
#include "base/strings/string_view_util.h"
@@ -46,6 +47,7 @@
#include "net/http/http_response_headers.h"
#include "net/traffic_annotation/network_traffic_annotation.h"
#include "services/network/public/cpp/data_element.h"
+#include "services/network/public/cpp/features.h"
#include "services/network/public/cpp/record_ontransfersizeupdate_utils.h"
#include "services/network/public/cpp/resource_request.h"
#include "services/network/public/cpp/simple_url_loader_stream_consumer.h"
@@ -65,6 +67,14 @@
namespace {
+// Returns the thread-safe global callbacks used by the embedder
+// to register and revoke access to uploaded files.
+SimpleURLLoader::FileUploadEventCallbacks& GetFileUploadEventCallbacks() {
+ static base::NoDestructor
+ callbacks;
+ return *callbacks;
+}
+
constexpr int64_t kReceivedBodySizeUnknown = -1;
// Used by tests to override the tick clock for the timeout timer.
@@ -454,6 +464,12 @@
// of zero means do not set a timeout.
base::TimeDelta timeout_duration_ = base::TimeDelta();
+ // A unique token generated for this loader to register file uploads in the
+ // browser process. If this loader uploads a file from the browser process,
+ // this token is mapped to the file path using the registered callback and
+ // passed to the Network Service to grant read access.
+ base::UnguessableToken owner_token_;
+
SEQUENCE_CHECKER(sequence_checker_);
base::WeakPtrFactory weak_ptr_factory_{this};
@@ -1302,7 +1318,12 @@
CHECK(url_loader_client_endpoints_->url_loader.is_valid());
}
-SimpleURLLoaderImpl::~SimpleURLLoaderImpl() {}
+SimpleURLLoaderImpl::~SimpleURLLoaderImpl() {
+ if (!owner_token_.is_empty() &&
+ GetFileUploadEventCallbacks().revoke_callback) {
+ GetFileUploadEventCallbacks().revoke_callback.Run(owner_token_);
+ }
+}
void SimpleURLLoaderImpl::DownloadToString(
mojom::URLLoaderFactory* url_loader_factory,
@@ -1534,6 +1555,14 @@
resource_request_->request_body->AppendFileRange(upload_file_path, offset,
length, base::Time());
+ if (GetFileUploadEventCallbacks().register_callback) {
+ if (owner_token_.is_empty()) {
+ owner_token_ = base::UnguessableToken::Create();
+ }
+ GetFileUploadEventCallbacks().register_callback.Run(owner_token_,
+ upload_file_path);
+ }
+
if (upload_content_type) {
resource_request_->headers.SetHeader(net::HttpRequestHeaders::kContentType,
*upload_content_type);
@@ -2081,8 +2110,14 @@
timeout_tick_clock_ = timeout_tick_clock;
}
-SimpleURLLoader::~SimpleURLLoader() {}
+// static
+void SimpleURLLoader::SetFileUploadEventCallbacks(
+ const FileUploadEventCallbacks& callbacks) {
+ GetFileUploadEventCallbacks() = callbacks;
+}
+
+SimpleURLLoader::~SimpleURLLoader() = default;
-SimpleURLLoader::SimpleURLLoader() {}
+SimpleURLLoader::SimpleURLLoader() = default;
} // namespace network
diff -Nru chromium-150.0.7871.114/services/network/public/cpp/simple_url_loader.h chromium-150.0.7871.124/services/network/public/cpp/simple_url_loader.h
--- chromium-150.0.7871.114/services/network/public/cpp/simple_url_loader.h 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/services/network/public/cpp/simple_url_loader.h 2026-07-13 21:36:30.000000000 +0000
@@ -16,7 +16,8 @@
#include "base/component_export.h"
#include "base/feature_list.h"
-#include "base/functional/callback_forward.h"
+#include "base/functional/callback.h"
+#include "base/unguessable_token.h"
#include "services/network/public/cpp/url_loader_completion_status.h"
#include "services/network/public/mojom/url_loader.mojom-forward.h"
#include "services/network/public/mojom/url_loader_factory.mojom-forward.h"
@@ -77,6 +78,22 @@
// 503 + Retry-After.
class COMPONENT_EXPORT(NETWORK_CPP) SimpleURLLoader {
public:
+ // Callbacks used to notify the embedder when a local file is being
+ // uploaded. These callbacks delegate file access registration and
+ // revocation to the embedder.
+ struct FileUploadEventCallbacks {
+ // Called when a file is attached to a request, giving the embedder a chance
+ // to register it for security validation. `owner_token` is an identifier
+ // that will be used to revoke access when the loader is destroyed.
+ base::RepeatingCallback
+ register_callback;
+
+ // Called when the loader is destroyed, notifying the embedder to revoke
+ // the file access previously registered with `owner_token`.
+ base::RepeatingCallback
+ revoke_callback;
+ };
// When a failed request should automatically be retried. These are intended
// to be ORed together.
enum RetryMode {
@@ -191,6 +208,12 @@
static void SetTimeoutTickClockForTest(
const base::TickClock* timeout_tick_clock);
+ // Configures the global callbacks used by all SimpleURLLoader instances to
+ // report embedder-initiated file uploads. This should be called once during
+ // startup.
+ static void SetFileUploadEventCallbacks(
+ const FileUploadEventCallbacks& callbacks);
+
SimpleURLLoader(const SimpleURLLoader&) = delete;
SimpleURLLoader& operator=(const SimpleURLLoader&) = delete;
diff -Nru chromium-150.0.7871.114/skia/ext/skia_commit_hash.h chromium-150.0.7871.124/skia/ext/skia_commit_hash.h
--- chromium-150.0.7871.114/skia/ext/skia_commit_hash.h 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/skia/ext/skia_commit_hash.h 2026-07-13 21:36:30.000000000 +0000
@@ -3,6 +3,6 @@
#ifndef SKIA_EXT_SKIA_COMMIT_HASH_H_
#define SKIA_EXT_SKIA_COMMIT_HASH_H_
-#define SKIA_COMMIT_HASH "14d05ec761901b6e9e9193af8b347ab3a7f6fed0"
+#define SKIA_COMMIT_HASH "bee4c917220040e147f14964635ff92ce6c5a3f6"
#endif // SKIA_EXT_SKIA_COMMIT_HASH_H_
diff -Nru chromium-150.0.7871.114/third_party/angle/src/libANGLE/renderer/vulkan/ContextVk.cpp chromium-150.0.7871.124/third_party/angle/src/libANGLE/renderer/vulkan/ContextVk.cpp
--- chromium-150.0.7871.114/third_party/angle/src/libANGLE/renderer/vulkan/ContextVk.cpp 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/third_party/angle/src/libANGLE/renderer/vulkan/ContextVk.cpp 2026-07-13 21:36:30.000000000 +0000
@@ -5766,6 +5766,7 @@
invalidateDefaultAttributes(context->getActiveDefaultAttribsMask());
ANGLE_TRY(onVertexArrayChange(vertexArrayVk->getCurrentEnabledAttribsMask()));
ANGLE_TRY(onIndexBufferChange(vertexArrayVk->getCurrentElementArrayBuffer()));
+ vertexArrayVk->resetInactiveStreamedAttribs(context);
break;
}
case gl::state::DIRTY_BIT_DRAW_INDIRECT_BUFFER_BINDING:
diff -Nru chromium-150.0.7871.114/third_party/angle/src/libANGLE/renderer/vulkan/VertexArrayVk.cpp chromium-150.0.7871.124/third_party/angle/src/libANGLE/renderer/vulkan/VertexArrayVk.cpp
--- chromium-150.0.7871.114/third_party/angle/src/libANGLE/renderer/vulkan/VertexArrayVk.cpp 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/third_party/angle/src/libANGLE/renderer/vulkan/VertexArrayVk.cpp 2026-07-13 21:36:30.000000000 +0000
@@ -1633,6 +1633,29 @@
return angle::Result::Continue;
}
+void VertexArrayVk::resetInactiveStreamedAttribs(const gl::Context *context)
+{
+ ContextVk *contextVk = vk::GetImpl(context);
+ const gl::AttributesMask activeAttribs =
+ context->getActiveClientAttribsMask() | context->getActiveBufferedAttribsMask();
+ const gl::AttributesMask inactiveStreamedAttribs = mStreamingVertexAttribsMask & ~activeAttribs;
+ if (inactiveStreamedAttribs.any())
+ {
+ vk::BufferHelper &emptyBuffer = contextVk->getEmptyBuffer();
+ for (size_t attribIndex : inactiveStreamedAttribs)
+ {
+ if (mCurrentArrayBuffers[attribIndex] != &emptyBuffer)
+ {
+ mCurrentArrayBuffers[attribIndex] = &emptyBuffer;
+ mCurrentArrayBufferSerial[attribIndex] = emptyBuffer.getBufferSerial();
+ mCurrentArrayBufferHandles[attribIndex] = emptyBuffer.getBuffer().getHandle();
+ mCurrentArrayBufferOffsets[attribIndex] = emptyBuffer.getOffset();
+ mCurrentArrayBufferSizes[attribIndex] = emptyBuffer.getSize();
+ }
+ }
+ }
+}
+
angle::Result VertexArrayVk::handleLineLoop(ContextVk *contextVk,
GLint firstVertex,
GLsizei vertexOrIndexCount,
diff -Nru chromium-150.0.7871.114/third_party/angle/src/libANGLE/renderer/vulkan/VertexArrayVk.h chromium-150.0.7871.124/third_party/angle/src/libANGLE/renderer/vulkan/VertexArrayVk.h
--- chromium-150.0.7871.114/third_party/angle/src/libANGLE/renderer/vulkan/VertexArrayVk.h 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/third_party/angle/src/libANGLE/renderer/vulkan/VertexArrayVk.h 2026-07-13 21:36:30.000000000 +0000
@@ -54,6 +54,8 @@
const void *indices,
gl::AttributesMask *strideDirtyAttribMaskOut);
+ void resetInactiveStreamedAttribs(const gl::Context *context);
+
angle::Result handleLineLoop(ContextVk *contextVk,
GLint firstVertex,
GLsizei vertexOrIndexCount,
diff -Nru chromium-150.0.7871.114/third_party/angle/src/tests/gl_tests/VertexAttributeTest.cpp chromium-150.0.7871.124/third_party/angle/src/tests/gl_tests/VertexAttributeTest.cpp
--- chromium-150.0.7871.114/third_party/angle/src/tests/gl_tests/VertexAttributeTest.cpp 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/third_party/angle/src/tests/gl_tests/VertexAttributeTest.cpp 2026-07-13 21:36:30.000000000 +0000
@@ -6426,7 +6426,7 @@
ASSERT_GL_NO_ERROR();
}
-class VertexAttributeResizeDefaultTest : public ANGLETest<>
+class VertexAttributeResizeTest : public ANGLETest<>
{
protected:
static constexpr char kVS1[] = R"(#version 300 es
@@ -6444,7 +6444,7 @@
out vec4 col;
void main() { col = vec4(0, 1, 0, 1); })";
- VertexAttributeResizeDefaultTest()
+ VertexAttributeResizeTest()
{
setWindowWidth(128);
setWindowHeight(128);
@@ -6457,7 +6457,7 @@
// Tests that cached pointers in VertexArrayVk are reset if the DynamicBuffer for default attribute
// is resized. See crbug.com/502812366.
-TEST_P(VertexAttributeResizeDefaultTest, ResizeAndSwitch)
+TEST_P(VertexAttributeResizeTest, ResizeAndSwitch)
{
// Program 1: Uses attribute 0 for vertex coords and draws red.
ANGLE_GL_PROGRAM(prog1, kVS1, kFS1);
@@ -6517,7 +6517,7 @@
// Tests that cache pointers in VertexArrayVk are reset if the DynamicBuffer for default attribute
// is resized. This also ensures there are no default active attributes when next draw after
// switching VAOs happen. See crbug.com/502812366.
-TEST_P(VertexAttributeResizeDefaultTest, ResizeAndSwitchWithNoDefaultAttribsActive)
+TEST_P(VertexAttributeResizeTest, ResizeAndSwitchWithNoDefaultAttribsActive)
{
// Program 1: Uses attribute 0 for vertex coords and draws red.
ANGLE_GL_PROGRAM(prog1, kVS1, kFS1);
@@ -6574,7 +6574,175 @@
EXPECT_PIXEL_COLOR_EQ(54, 54, GLColor::green);
}
-ANGLE_INSTANTIATE_TEST_ES3(VertexAttributeResizeDefaultTest);
+// Tests that cached pointers in VertexArrayVk are reset if the DynamicBuffer for a streamed
+// attribute is resized while the VAO is unbound and the attribute is inactive in the program
+// used for the next draw.
+TEST_P(VertexAttributeResizeTest, ResizeStreamedAttribAndSwitchProgram)
+{
+ // Program 1: active 0, 1, 3. FS Red
+ constexpr char kLocalVS1[] = R"(#version 300 es
+layout(location = 0) in vec4 pos;
+layout(location = 1) in vec4 a1;
+layout(location = 3) in vec4 a3;
+void main() { gl_Position = vec4(pos.xyz + a1.xyz + a3.xyz, pos.w); gl_PointSize = 2.0; })";
+
+ // Program 2: active 0, 3. FS Green
+ constexpr char kLocalVS2[] = R"(#version 300 es
+layout(location = 0) in vec4 pos;
+layout(location = 3) in vec4 a3;
+void main() { gl_Position = vec4(pos.xyz + a3.xyz, pos.w); gl_PointSize = 2.0; })";
+
+ // Program 3: active 0, 2, 4. FS Blue
+ constexpr char kLocalVS3[] = R"(#version 300 es
+layout(location = 0) in vec4 pos;
+layout(location = 2) in vec4 a2;
+layout(location = 4) in vec4 a4;
+void main() { gl_Position = vec4(pos.xyz + a2.xyz + a4.xyz, pos.w); gl_PointSize = 2.0; })";
+
+ constexpr char kLocalFS1[] = R"(#version 300 es
+precision mediump float;
+out vec4 col;
+void main() { col = vec4(1, 0, 0, 1); })";
+
+ constexpr char kLocalFS2[] = R"(#version 300 es
+precision mediump float;
+out vec4 col;
+void main() { col = vec4(0, 1, 0, 1); })";
+
+ constexpr char kLocalFS3[] = R"(#version 300 es
+precision mediump float;
+out vec4 col;
+void main() { col = vec4(0, 0, 1, 1); })";
+
+ ANGLE_GL_PROGRAM(prog1, kLocalVS1, kLocalFS1);
+ ANGLE_GL_PROGRAM(prog2, kLocalVS2, kLocalFS2);
+ ANGLE_GL_PROGRAM(prog3, kLocalVS3, kLocalFS3);
+
+ const std::vector positionData = {0.0f, 0.0f, 0.0f, 1.0f};
+ const std::vector zeroData = {0.0f, 0.0f, 0.0f, 0.0f};
+
+ // Step 1: Setup VAO 0 (default) and draw with prog1.
+ // Attribs 0, 1, 3 will be streamed.
+ glBindVertexArray(0);
+ glBindBuffer(GL_ARRAY_BUFFER, 0);
+
+ glEnableVertexAttribArray(0);
+ glVertexAttribPointer(0, 4, GL_FLOAT, GL_FALSE, 0, positionData.data());
+ glEnableVertexAttribArray(1);
+ glVertexAttribPointer(1, 4, GL_FLOAT, GL_FALSE, 0, zeroData.data());
+ glEnableVertexAttribArray(2);
+ glVertexAttribPointer(2, 4, GL_FLOAT, GL_FALSE, 0, zeroData.data());
+ glEnableVertexAttribArray(3);
+ glVertexAttribPointer(3, 4, GL_FLOAT, GL_FALSE, 0, zeroData.data());
+ glEnableVertexAttribArray(4);
+ glVertexAttribPointer(4, 4, GL_FLOAT, GL_FALSE, 0, zeroData.data());
+
+ glUseProgram(prog1);
+ glDrawArraysInstanced(GL_POINTS, 0, 1, 1);
+ ASSERT_GL_NO_ERROR();
+ EXPECT_PIXEL_COLOR_EQ(64, 64, GLColor::red);
+
+ // Step 2: Bind VAO 1, force resize of streamed buffer for attribute 1.
+ GLVertexArray vao1;
+ glBindVertexArray(vao1);
+
+ // Attrib 0: active, enabled, small buffer.
+ GLBuffer buf1;
+ glBindBuffer(GL_ARRAY_BUFFER, buf1);
+ std::vector positionData1 = {10.0f / 64.0f, 10.0f / 64.0f, 0.0f, 1.0f};
+ glBufferData(GL_ARRAY_BUFFER, positionData1.size() * sizeof(float), positionData1.data(),
+ GL_STREAM_DRAW);
+ glEnableVertexAttribArray(0);
+ glVertexAttribPointer(0, 4, GL_FLOAT, GL_FALSE, 0, nullptr);
+ glVertexAttribDivisor(1, 1200);
+
+ // Attrib 1: active, enabled, large buffer to force resize.
+ GLBuffer buf2;
+ glBindBuffer(GL_ARRAY_BUFFER, buf2);
+ std::vector largeData(16, 0.0f);
+ glBufferData(GL_ARRAY_BUFFER, largeData.size() * sizeof(float), largeData.data(),
+ GL_STREAM_DRAW);
+ glEnableVertexAttribArray(1);
+ glVertexAttribPointer(1, 4, GL_FLOAT, GL_FALSE, 0, nullptr);
+ glVertexAttribDivisor(1, 300);
+
+ glUseProgram(prog1);
+ glDrawArraysInstanced(GL_POINTS, 0, 1, 1200);
+ ASSERT_GL_NO_ERROR();
+ EXPECT_PIXEL_COLOR_EQ(74, 74, GLColor::red);
+
+ // Step 3: Bind VAO 0, draw with prog2 (active: 0, 3. Inactive: 1, 2, 4).
+ // Attrib 1 (stale) should be reset.
+ glBindVertexArray(0);
+ glUseProgram(prog2);
+ glDrawArrays(GL_POINTS, 0, 1);
+ ASSERT_GL_NO_ERROR();
+ EXPECT_PIXEL_COLOR_EQ(64, 64, GLColor::green);
+
+ // Step 4: Bind VAO 2, force resize of streamed buffer for attribute 3.
+ GLVertexArray vao2;
+ glBindVertexArray(vao2);
+
+ // Attrib 0: active, enabled, small buffer.
+ GLBuffer buf3;
+ glBindBuffer(GL_ARRAY_BUFFER, buf3);
+ std::vector positionData2 = {-10.0f / 64.0f, -10.0f / 64.0f, 0.0f, 1.0f};
+ glBufferData(GL_ARRAY_BUFFER, positionData2.size() * sizeof(float), positionData2.data(),
+ GL_STREAM_DRAW);
+ glEnableVertexAttribArray(0);
+ glVertexAttribPointer(0, 4, GL_FLOAT, GL_FALSE, 0, nullptr);
+ glVertexAttribDivisor(1, 1200);
+
+ // Attrib 3: active, enabled, large buffer.
+ GLBuffer buf4;
+ glBindBuffer(GL_ARRAY_BUFFER, buf4);
+ std::vector largerData(48, 0.0f);
+ glBufferData(GL_ARRAY_BUFFER, largerData.size() * sizeof(float), largerData.data(),
+ GL_STREAM_DRAW);
+ glEnableVertexAttribArray(3);
+ glVertexAttribPointer(3, 4, GL_FLOAT, GL_FALSE, 0, nullptr);
+ glVertexAttribDivisor(3, 100);
+
+ glUseProgram(prog2);
+ glDrawArraysInstanced(GL_POINTS, 0, 1, 1200);
+ ASSERT_GL_NO_ERROR();
+ EXPECT_PIXEL_COLOR_EQ(54, 54, GLColor::green);
+
+ // Step 5: Bind VAO 0, draw with prog3 (active: 0, 2, 4. Inactive: 1, 3).
+ // Attrib 3 (stale) should be reset.
+ glBindVertexArray(0);
+ glUseProgram(prog3);
+ glDrawArrays(GL_POINTS, 0, 1);
+ ASSERT_GL_NO_ERROR();
+ EXPECT_PIXEL_COLOR_EQ(64, 64, GLColor::blue);
+}
+
+// Ensure a large offset is not interpreted as negative.
+TEST_P(VertexAttributeTestES3, LargeAttribPointerOffsetNoCrash)
+{
+ ANGLE_GL_PROGRAM(program, essl1_shaders::vs::Simple(), essl1_shaders::fs::Red());
+ glUseProgram(program);
+
+ GLBuffer position;
+ constexpr std::array kTriangle = {-1, -1, 3, -1, -1, 3};
+ glBindBuffer(GL_ARRAY_BUFFER, position);
+ glBufferData(GL_ARRAY_BUFFER, sizeof(kTriangle), kTriangle.data(), GL_STATIC_DRAW);
+
+ GLint posLoc = glGetAttribLocation(program, essl1_shaders::PositionAttrib());
+ ASSERT_NE(-1, posLoc);
+ glEnableVertexAttribArray(posLoc);
+ glVertexAttribPointer(posLoc, 2, GL_FLOAT, GL_FALSE, 0,
+ reinterpret_cast(0x80000000));
+ glVertexAttribDivisor(posLoc, 256);
+
+ glDrawArrays(GL_TRIANGLES, 0, 3);
+ // Nothing that can be validated. The test shouldn't crash.
+ ASSERT_GL_NO_ERROR();
+
+ swapBuffers();
+}
+
+ANGLE_INSTANTIATE_TEST_ES3(VertexAttributeResizeTest);
GTEST_ALLOW_UNINSTANTIATED_PARAMETERIZED_TEST(VertexAttributeUint8Test);
ANGLE_INSTANTIATE_TEST_ES3_AND(VertexAttributeUint8Test,
diff -Nru chromium-150.0.7871.114/third_party/blink/renderer/core/dom/element.cc chromium-150.0.7871.124/third_party/blink/renderer/core/dom/element.cc
--- chromium-150.0.7871.114/third_party/blink/renderer/core/dom/element.cc 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/third_party/blink/renderer/core/dom/element.cc 2026-07-13 21:36:30.000000000 +0000
@@ -251,6 +251,7 @@
#include "third_party/blink/renderer/core/page/scrolling/root_scroller_controller.h"
#include "third_party/blink/renderer/core/page/scrolling/sync_scroll_attempt_heuristic.h"
#include "third_party/blink/renderer/core/page/spatial_navigation.h"
+#include "third_party/blink/renderer/core/paint/object_paint_invalidator.h"
#include "third_party/blink/renderer/core/paint/paint_layer.h"
#include "third_party/blink/renderer/core/paint/paint_layer_scrollable_area.h"
#include "third_party/blink/renderer/core/probe/core_probes.h"
@@ -4394,6 +4395,18 @@
DidChangeIsCanvasOrInCanvasSubtree();
}
+void Element::DidChangeIsCanvasOrInCanvasSubtree() {
+ if (auto* layout_object = GetLayoutObject()) {
+ layout_object->SetNeedsPaintPropertyUpdate();
+ if (layout_object->HasLayer()) {
+ To(layout_object)->Layer()->SetNeedsRepaint();
+ }
+ ObjectPaintInvalidator(*layout_object)
+ .InvalidateDisplayItemClient(*layout_object,
+ PaintInvalidationReason::kUncacheable);
+ }
+}
+
void Element::RemovedFrom(ContainerNode& insertion_point) {
bool was_in_document = insertion_point.isConnected();
if (Element* parent = DynamicTo(insertion_point)) {
diff -Nru chromium-150.0.7871.114/third_party/blink/renderer/core/dom/element.h chromium-150.0.7871.124/third_party/blink/renderer/core/dom/element.h
--- chromium-150.0.7871.114/third_party/blink/renderer/core/dom/element.h 2026-07-07 17:43:50.000000000 +0000
+++ chromium-150.0.7871.124/third_party/blink/renderer/core/dom/element.h 2026-07-13 21:36:30.000000000 +0000
@@ -1136,7 +1136,7 @@
return HasElementFlag(ElementFlags::kIsCanvasOrInCanvasSubtree);
}
// Called when `IsCanvasOrInCanvasSubtree()` has changed.
- virtual void DidChangeIsCanvasOrInCanvasSubtree() {}
+ virtual void DidChangeIsCanvasOrInCanvasSubtree();
// Like `IsCanvasOrInCanvasSubtree()`, but excludes the outermost