From 5f09697d4c92b52a2c190286ff43714eec3210ba Mon Sep 17 00:00:00 2001
From: Carmelo Messina <uazo@users.noreply.github.com>
Date: Mon, 19 Jan 2026 14:09:28 +0100
Subject: [PATCH] Patches for v144

---
 .../Add-bookmark-import-export-actions.patch  |   9 +-
 build/patches/Add-cromite-flags-support.patch |   4 +-
 .../Add-menu-item-to-bookmark-all-tabs.patch  |  14 +-
 .../Add-setting-to-clear-data-on-exit.patch   |  38 ++-
 ...tting-to-enable-Credman-for-passkeys.patch |  22 +-
 ...roid-fonts-fingerprinting-mitigation.patch |  80 +++++-
 .../Content-settings-infrastructure.patch     |  42 +--
 ...romite-Branding--improve-settings-ui.patch |  12 +-
 .../patches/Disable-all-predictors-code.patch | 270 ++++++++++++------
 ...Disable-fetching-of-all-field-trials.patch |   2 +-
 ...isable-speechSynthesis-getVoices-API.patch |   2 +-
 .../Enable-Do-Not-Track-by-default.patch      |   2 +-
 .../Enable-Global-Privacy-Control.patch       | 153 +++-------
 .../Enable-extension-in-incognito.patch       | 171 +++++++++--
 .../Enable-native-Android-autofill.patch      |  51 +++-
 .../Enable-network-isolation-features.patch   |  23 +-
 ...le-search-engine-settings-desktop-ui.patch |  51 +++-
 build/patches/Enable-snackbar-swipe.patch     |  21 +-
 ...al-support-for-extensions-on-Android.patch | 113 ++++++--
 build/patches/Eyeo-Adblock-for-Cromite.patch  |  87 +++---
 ...story-number-of-days-privacy-setting.patch |  29 +-
 .../patches/Improve-the-browser-sandbox.patch |  13 +-
 .../Move-navigation-bar-to-bottom.patch       |  59 ++--
 ...ulti-Screen-Window-Placement-API-fix.patch |  11 +-
 ...referrals-in-cross-origin-navigation.patch |   6 +-
 .../Remove-binary-blob-integrations.patch     |  10 +-
 .../Restore-chrome-password-store.patch       |  12 +-
 build/patches/Show-NTP-at-startup.patch       |   2 +-
 build/patches/Timezone-customization.patch    | 143 +++++++---
 .../Use-list-mode-for-tab-switcher.patch      |  47 ++-
 build/patches/User-agent-customization.patch  |  32 ++-
 build/patches/bromite-build-utils.patch       |   2 +-
 32 files changed, 1076 insertions(+), 457 deletions(-)

diff --git a/build/patches/Add-bookmark-import-export-actions.patch b/build/patches/Add-bookmark-import-export-actions.patch
index 5a290585..0bf83ec5 100644
--- a/build/patches/Add-bookmark-import-export-actions.patch
+++ b/build/patches/Add-bookmark-import-export-actions.patch
@@ -17,7 +17,7 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
  .../app/bookmarks/BookmarkActivity.java       |  32 ++
  .../native_page/NativePageFactory.java        |   9 +-
  chrome/browser/BUILD.gn                       |  11 +-
- .../bookmarks/android/bookmark_bridge.cc      | 192 ++++++++++++
+ .../bookmarks/android/bookmark_bridge.cc      | 193 ++++++++++++
  .../bookmarks/android/bookmark_bridge.h       |  30 +-
  .../browser/bookmarks/BookmarkBridge.java     |  39 +++
  .../browser/bookmarks/BookmarkDelegate.java   |  10 +
@@ -51,7 +51,7 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
  ui/shell_dialogs/select_file_dialog_linux.cc  |   4 +
  ui/shell_dialogs/select_file_dialog_linux.h   |   2 +
  ui/shell_dialogs/select_file_dialog_win.cc    |   5 +
- 40 files changed, 805 insertions(+), 24 deletions(-)
+ 40 files changed, 806 insertions(+), 24 deletions(-)
  create mode 100644 cromite_flags/chrome/browser/about_flags_cc/add-bookmark-import-export-actions.inc
  create mode 100644 cromite_flags/chrome/browser/flags/android/chrome_feature_list_cc/add-bookmark-import-export-actions.inc
  create mode 100644 cromite_flags/chrome/browser/flags/android/chrome_feature_list_h/add-bookmark-import-export-actions.inc
@@ -322,7 +322,7 @@ diff --git a/chrome/browser/bookmarks/android/bookmark_bridge.cc b/chrome/browse
  }
  
  void BookmarkBridge::Destroy(JNIEnv* env) {
-@@ -843,6 +869,172 @@ jint BookmarkBridge::GetTotalBookmarkCount(
+@@ -843,6 +869,173 @@ jint BookmarkBridge::GetTotalBookmarkCount(
    return count;
  }
  
@@ -450,7 +450,8 @@ diff --git a/chrome/browser/bookmarks/android/bookmark_bridge.cc b/chrome/browse
 +  }
 +
 +  std::vector<char> buffer(fileLength);
-+  if (-1 == file.ReadAtCurrentPos(buffer.data(), fileLength)) {
++  base::span<uint8_t> buffer_span = base::as_writable_byte_span(buffer);
++  if (-1 == file.ReadAtCurrentPos(buffer_span)) {
 +    select_file_dialog_->ShowToast("Could not read bookmarks file");
 +    return "";
 +  }
diff --git a/build/patches/Add-cromite-flags-support.patch b/build/patches/Add-cromite-flags-support.patch
index e9357a6f..0978f91f 100644
--- a/build/patches/Add-cromite-flags-support.patch
+++ b/build/patches/Add-cromite-flags-support.patch
@@ -1554,8 +1554,8 @@ diff --git a/components/webui/flags/resources/experiment.html.ts b/components/we
    return html`<!--_html_template_start_-->
  <div class="experiment" id="${this.feature_.internal_name}">
 -  <div class="flex-container">
-+  <div class="flex-container" class="${(this.feature_.is_cromite && this.feature_.is_new ? "cromite " : "")
-+                                       + (this.feature_.is_default_value_on ? "experiment-on" : "")}">
++  <div class="${"flex-container " + (this.feature_.is_cromite && this.feature_.is_new ? "cromite " : "")
++                                  + (this.feature_.is_default_value_on ? "experiment-on" : "")}">
      <div class="flex">
        ${this.showingSearchHit_? html`
          <h2 class="experiment-name clone" id="${this.getHeaderId_()}"
diff --git a/build/patches/Add-menu-item-to-bookmark-all-tabs.patch b/build/patches/Add-menu-item-to-bookmark-all-tabs.patch
index f09fc190..61c2190f 100644
--- a/build/patches/Add-menu-item-to-bookmark-all-tabs.patch
+++ b/build/patches/Add-menu-item-to-bookmark-all-tabs.patch
@@ -18,7 +18,7 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
  .../bookmark_ui_operations_helper.cc          |  2 +
  .../bookmark_bar_page_handler.cc              |  2 +
  components/bookmark_bar_strings.grdp          |  6 +++
- .../bookmarks/browser/bookmark_codec.cc       | 15 ++++++-
+ .../bookmarks/browser/bookmark_codec.cc       | 14 +++++-
  components/bookmarks/browser/bookmark_codec.h |  4 ++
  .../browser/bookmark_load_details.cc          | 15 +++++--
  .../bookmarks/browser/bookmark_load_details.h |  2 +
@@ -31,7 +31,7 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
  components/bookmarks/browser/bookmark_uuids.h |  1 +
  components/bookmarks/browser/model_loader.cc  |  9 +++-
  .../bookmark_specifics_conversions.cc         |  1 +
- 27 files changed, 252 insertions(+), 11 deletions(-)
+ 27 files changed, 251 insertions(+), 11 deletions(-)
 
 diff --git a/chrome/android/java/res/values/ids.xml b/chrome/android/java/res/values/ids.xml
 --- a/chrome/android/java/res/values/ids.xml
@@ -212,7 +212,7 @@ diff --git a/chrome/browser/bookmarks/android/bookmark_bridge.cc b/chrome/browse
    const BookmarkNode* reading_list_node =
        local_or_syncable_reading_list_manager_->GetRoot();
    if (IsPermanentFolderVisible(
-@@ -1228,6 +1259,17 @@ void BookmarkBridge::GetBookmarksOfType(
+@@ -1229,6 +1260,17 @@ void BookmarkBridge::GetBookmarksOfType(
    AddBookmarkNodesToBookmarkIdList(env, j_list, results);
  }
  
@@ -596,14 +596,6 @@ diff --git a/components/bookmarks/browser/bookmark_codec.cc b/components/bookmar
  
    // Need to reset the title as the title is persisted and restored from
    // the file.
-@@ -461,6 +473,7 @@ void BookmarkCodec::ReassignIDsIfRequired() {
-   }
- 
-   nodes_requiring_id_reassignment_.clear();
-+  ReassignIDsHelper(tabs_folder_node);
-   ids_reassigned_ = true;
- }
- 
 diff --git a/components/bookmarks/browser/bookmark_codec.h b/components/bookmarks/browser/bookmark_codec.h
 --- a/components/bookmarks/browser/bookmark_codec.h
 +++ b/components/bookmarks/browser/bookmark_codec.h
diff --git a/build/patches/Add-setting-to-clear-data-on-exit.patch b/build/patches/Add-setting-to-clear-data-on-exit.patch
index d122936e..e20e9f60 100644
--- a/build/patches/Add-setting-to-clear-data-on-exit.patch
+++ b/build/patches/Add-setting-to-clear-data-on-exit.patch
@@ -31,16 +31,17 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
  .../core/browsing_data_policies_utils.h       | 11 +++
  .../browsing_data/core/browsing_data_utils.cc | 31 ++++++++
  .../core/clear_browsing_data_tab.h            |  3 +-
+ components/browsing_data/core/features.h      |  1 +
  components/browsing_data/core/pref_names.cc   | 17 ++++
  components/browsing_data/core/pref_names.h    | 10 +++
  components/favicon/core/favicon_database.cc   |  9 +++
- components/favicon/core/favicon_database.h    |  2 +
+ components/favicon/core/favicon_database.h    |  3 +
  .../search_engines/template_url_service.cc    |  1 +
  content/browser/btm/btm_service_impl.cc       |  2 +-
- content/browser/storage_partition_impl.cc     |  1 +
+ content/browser/storage_partition_impl.cc     |  2 +
  .../public/browser/browsing_data_remover.h    |  7 +-
  .../Add-setting-to-clear-data-on-exit.inc     |  8 ++
- 36 files changed, 407 insertions(+), 34 deletions(-)
+ 37 files changed, 410 insertions(+), 34 deletions(-)
  create mode 100644 chrome/android/java/src/org/chromium/chrome/browser/browsing_data/ClearBrowsingDataFragmentAtStart.java
  create mode 100644 chrome/browser/ui/android/strings/cromite_android_chrome_strings_grd/Add-setting-to-clear-data-on-exit.grdp
  create mode 100644 cromite_flags/chrome/browser/about_flags_cc/Add-setting-to-clear-data-on-exit.inc
@@ -881,6 +882,17 @@ diff --git a/components/browsing_data/core/clear_browsing_data_tab.h b/component
  
  }  // namespace browsing_data
  
+diff --git a/components/browsing_data/core/features.h b/components/browsing_data/core/features.h
+--- a/components/browsing_data/core/features.h
++++ b/components/browsing_data/core/features.h
+@@ -19,6 +19,7 @@ BASE_DECLARE_FEATURE(kBrowsingDataModel);
+ // updates to history counter logic and removal of the bulk password deletion
+ // option from the dialog.
+ BASE_DECLARE_FEATURE(kDbdRevampDesktop);
++SET_CROMITE_FEATURE_DISABLED(kDbdRevampDesktop);
+ 
+ // When enabled, calls to browsingData.removePasswords extension API would
+ // result in an error response instead of a console warning.
 diff --git a/components/browsing_data/core/pref_names.cc b/components/browsing_data/core/pref_names.cc
 --- a/components/browsing_data/core/pref_names.cc
 +++ b/components/browsing_data/core/pref_names.cc
@@ -957,7 +969,15 @@ diff --git a/components/favicon/core/favicon_database.cc b/components/favicon/co
 diff --git a/components/favicon/core/favicon_database.h b/components/favicon/core/favicon_database.h
 --- a/components/favicon/core/favicon_database.h
 +++ b/components/favicon/core/favicon_database.h
-@@ -33,6 +33,8 @@ namespace favicon {
+@@ -9,6 +9,7 @@
+ #include <optional>
+ #include <vector>
+ 
++#include "base/feature_list.h"
+ #include "base/gtest_prod_util.h"
+ #include "base/memory/ref_counted.h"
+ #include "components/favicon/core/favicon_types.h"
+@@ -33,6 +34,8 @@ namespace favicon {
  // All earlier updates are ignored.
  static const int kFaviconUpdateLastRequestedAfterDays = 10;
  
@@ -992,7 +1012,15 @@ diff --git a/content/browser/btm/btm_service_impl.cc b/content/browser/btm/btm_s
 diff --git a/content/browser/storage_partition_impl.cc b/content/browser/storage_partition_impl.cc
 --- a/content/browser/storage_partition_impl.cc
 +++ b/content/browser/storage_partition_impl.cc
-@@ -1557,6 +1557,7 @@ void StoragePartitionImpl::Initialize(
+@@ -19,6 +19,7 @@
+ #include "base/containers/contains.h"
+ #include "base/dcheck_is_on.h"
+ #include "base/feature_list.h"
++#include "base/files/file_util.h"
+ #include "base/functional/bind.h"
+ #include "base/functional/callback_helpers.h"
+ #include "base/functional/concurrent_closures.h"
+@@ -1557,6 +1558,7 @@ void StoragePartitionImpl::Initialize(
                              .AppendASCII("Code Cache");
      }
      DCHECK_GE(settings.size_in_bytes(), 0);
diff --git a/build/patches/Add-setting-to-enable-Credman-for-passkeys.patch b/build/patches/Add-setting-to-enable-Credman-for-passkeys.patch
index b94191c7..204e8403 100644
--- a/build/patches/Add-setting-to-enable-Credman-for-passkeys.patch
+++ b/build/patches/Add-setting-to-enable-Credman-for-passkeys.patch
@@ -11,6 +11,7 @@ Conditional immediate support is disabled.
 License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 ---
  .../settings/PasswordSettings.java            | 27 +++++++++++++++++
+ .../touch_to_fill_controller.cc               |  2 ++
  ...etting-to-enable-Credman-for-passkeys.grdp | 12 ++++++++
  .../webauthn/AuthenticatorImpl.java           | 29 +++++++------------
  .../components/webauthn/WebauthnFeatures.java |  2 ++
@@ -20,7 +21,7 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
  components/webauthn/features.h                |  3 ++
  device/fido/features.cc                       |  2 ++
  .../authentication_credentials_container.cc   |  5 ++++
- 10 files changed, 73 insertions(+), 37 deletions(-)
+ 11 files changed, 75 insertions(+), 37 deletions(-)
  create mode 100644 chrome/browser/ui/android/strings/cromite_android_chrome_strings_grd/Add-setting-to-enable-Credman-for-passkeys.grdp
 
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/password_manager/settings/PasswordSettings.java b/chrome/android/java/src/org/chromium/chrome/browser/password_manager/settings/PasswordSettings.java
@@ -81,6 +82,25 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/password_manage
      private void displayManageAccountLink() {
          SyncService syncService = SyncServiceFactory.getForProfile(getProfile());
          if (syncService == null || !syncService.isEngineInitialized()) {
+diff --git a/chrome/browser/touch_to_fill/password_manager/touch_to_fill_controller.cc b/chrome/browser/touch_to_fill/password_manager/touch_to_fill_controller.cc
+--- a/chrome/browser/touch_to_fill/password_manager/touch_to_fill_controller.cc
++++ b/chrome/browser/touch_to_fill/password_manager/touch_to_fill_controller.cc
+@@ -312,6 +312,7 @@ void TouchToFillController::Reset() {
+   }
+   visibility_controller_->Reset();
+   credentials_.clear();
++  cred_man_delegate_ = nullptr;
+ }
+ 
+ void TouchToFillController::ActionCompleted() {
+@@ -319,6 +320,7 @@ void TouchToFillController::ActionCompleted() {
+     visibility_controller_->SetShown();
+   }
+   ttf_delegate_.reset();
++  cred_man_delegate_ = nullptr;
+ }
+ 
+ DisplayTarget TouchToFillController::GetResponsibleDisplayTarget(
 diff --git a/chrome/browser/ui/android/strings/cromite_android_chrome_strings_grd/Add-setting-to-enable-Credman-for-passkeys.grdp b/chrome/browser/ui/android/strings/cromite_android_chrome_strings_grd/Add-setting-to-enable-Credman-for-passkeys.grdp
 new file mode 100644
 --- /dev/null
diff --git a/build/patches/Android-fonts-fingerprinting-mitigation.patch b/build/patches/Android-fonts-fingerprinting-mitigation.patch
index c84c6fb7..1c483034 100644
--- a/build/patches/Android-fonts-fingerprinting-mitigation.patch
+++ b/build/patches/Android-fonts-fingerprinting-mitigation.patch
@@ -8,10 +8,12 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 ---
  .../common/ProductionSupportedFlagList.java   |    3 +
  .../component_updater/registration.cc         |    9 +
+ build/config/freetype/freetype.gni            |    2 +-
  .../java/res/xml/developer_preferences.xml    |    5 +
  chrome/browser/BUILD.gn                       |    7 +
  .../browser/component_updater/registration.cc |   10 +
  ...droid-fonts-fingerprinting-mitigation.grdp |    9 +
+ chrome/browser/ui/prefs/prefs_tab_helper.cc   |    9 +-
  chrome/renderer/BUILD.gn                      |    4 +
  .../installer_policies/BUILD.gn               |    7 +
  .../fonts_pack_component_installer.cc         |   96 +
@@ -29,10 +31,12 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
  content/child/BUILD.gn                        |    7 +
  content/renderer/BUILD.gn                     |    4 +
  .../renderer/renderer_blink_platform_impl.cc  |   55 +-
+ ...renderer_main_platform_delegate_android.cc |    2 +-
  ...ndroid-fonts-fingerprinting-mitigation.inc |   12 +
  ...ndroid-fonts-fingerprinting-mitigation.inc |    7 +
  ...ndroid-fonts-fingerprinting-mitigation.inc |    5 +
  skia/BUILD.gn                                 |   12 +
+ skia/ext/font_utils.cc                        |    1 +
  .../include/ports/SkFontConfigInterface.h     |    2 +
  .../skia/include/ports/SkFontMgr_android.h    |   42 +-
  .../skia/src/ports/SkFontConfigInterface.cpp  |    4 +
@@ -40,9 +44,10 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
  .../src/ports/SkFontConfigInterface_direct.h  |    1 +
  .../skia/src/ports/SkFontMgr_android.cpp      |  278 ++-
  .../skia/src/ports/SkFontMgr_android_data.cpp | 1640 +++++++++++++++++
+ .../skia/src/ports/SkFontMgr_android_ndk.cpp  |    2 +-
  .../src/ports/SkFontMgr_android_parser.cpp    |   49 +-
  .../skia/src/ports/SkFontMgr_android_parser.h |    5 +-
- 36 files changed, 2416 insertions(+), 76 deletions(-)
+ 41 files changed, 2424 insertions(+), 84 deletions(-)
  create mode 100644 chrome/browser/ui/android/strings/cromite_android_chrome_strings_grd/Android-fonts-fingerprinting-mitigation.grdp
  create mode 100644 components/component_updater/installer_policies/fonts_pack_component_installer.cc
  create mode 100644 components/component_updater/installer_policies/fonts_pack_component_installer.h
@@ -90,6 +95,16 @@ diff --git a/android_webview/nonembedded/component_updater/registration.cc b/and
    component_installer_list.push_back(
        std::make_unique<
            component_updater::OriginTrialsComponentInstallerPolicy>());
+diff --git a/build/config/freetype/freetype.gni b/build/config/freetype/freetype.gni
+--- a/build/config/freetype/freetype.gni
++++ b/build/config/freetype/freetype.gni
+@@ -26,5 +26,5 @@ declare_args() {
+   #   https://crbug.com/370816215
+   #
+   # Note: //build should not import directly from //pdf for layering reasons.
+-  enable_freetype = !is_android && !is_ios && (is_linux || !is_castos)
++  enable_freetype = !is_ios && (is_linux || !is_castos)
+ }
 diff --git a/chrome/android/java/res/xml/developer_preferences.xml b/chrome/android/java/res/xml/developer_preferences.xml
 --- a/chrome/android/java/res/xml/developer_preferences.xml
 +++ b/chrome/android/java/res/xml/developer_preferences.xml
@@ -158,6 +173,32 @@ new file mode 100644
 +        Replaces all system fonts with the same for all devices
 +    </message>
 +</grit-part>
+diff --git a/chrome/browser/ui/prefs/prefs_tab_helper.cc b/chrome/browser/ui/prefs/prefs_tab_helper.cc
+--- a/chrome/browser/ui/prefs/prefs_tab_helper.cc
++++ b/chrome/browser/ui/prefs/prefs_tab_helper.cc
+@@ -64,8 +64,7 @@
+ #include <windows.h>
+ #endif
+ 
+-#if BUILDFLAG(IS_MAC) || BUILDFLAG(IS_WIN) || BUILDFLAG(IS_LINUX) || \
+-    BUILDFLAG(IS_ANDROID) || BUILDFLAG(ENABLE_DESKTOP_ANDROID_EXTENSIONS)
++#if BUILDFLAG(IS_MAC) || BUILDFLAG(IS_WIN) || BUILDFLAG(IS_LINUX)
+ // If a font name in prefs default values starts with a comma, consider it's a
+ // comma-separated font list and resolve it to the first available font.
+ #define PREFS_FONT_LIST 1
+@@ -442,9 +441,9 @@ void PrefsTabHelper::RegisterProfilePrefs(
+         value = gfx::FontList::FirstAvailableOrFirst(value);
+       }
+ #else   // !PREFS_FONT_LIST
+-      DCHECK(!value.starts_with(','))
+-          << "This platform doesn't support default font lists. "
+-          << pref.pref_name << "=" << value;
++      // DCHECK(!value.starts_with(','))
++      //     << "This platform doesn't support default font lists. "
++      //     << pref.pref_name << "=" << value;
+ #endif  // PREFS_FONT_LIST
+       registry->RegisterStringPref(pref.pref_name, value);
+       fonts_with_defaults.insert(pref.pref_name);
 diff --git a/chrome/renderer/BUILD.gn b/chrome/renderer/BUILD.gn
 --- a/chrome/renderer/BUILD.gn
 +++ b/chrome/renderer/BUILD.gn
@@ -806,6 +847,18 @@ diff --git a/content/renderer/renderer_blink_platform_impl.cc b/content/renderer
  #endif
  
  #if BUILDFLAG(IS_WIN) || BUILDFLAG(IS_LINUX)
+diff --git a/content/renderer/renderer_main_platform_delegate_android.cc b/content/renderer/renderer_main_platform_delegate_android.cc
+--- a/content/renderer/renderer_main_platform_delegate_android.cc
++++ b/content/renderer/renderer_main_platform_delegate_android.cc
+@@ -35,7 +35,7 @@ void RendererMainPlatformDelegate::PlatformInitialize() {
+   // Android 14+ user devices with updated system fonts will call statx and
+   // possibly other system calls that are not allowed in the sandbox.
+   // See https://crbug.com/40618213 for details.
+-  [[maybe_unused]] auto mgr = skia::DefaultFontMgr();
++  // [[maybe_unused]] auto mgr = skia::DefaultFontMgr();
+ }
+ 
+ void RendererMainPlatformDelegate::PlatformUninitialize() {
 diff --git a/cromite_flags/chrome/browser/about_flags_cc/Android-fonts-fingerprinting-mitigation.inc b/cromite_flags/chrome/browser/about_flags_cc/Android-fonts-fingerprinting-mitigation.inc
 new file mode 100644
 --- /dev/null
@@ -867,6 +920,17 @@ diff --git a/skia/BUILD.gn b/skia/BUILD.gn
    if (is_linux || is_chromeos || is_android) {
      # Retain the files for the SkFontMgr_Android on linux to emulate android
      # fonts. See content/zygote/zygote_main_linux.cc
+diff --git a/skia/ext/font_utils.cc b/skia/ext/font_utils.cc
+--- a/skia/ext/font_utils.cc
++++ b/skia/ext/font_utils.cc
+@@ -59,6 +59,7 @@ SkFontMgr* g_fontmgr_override = nullptr;
+ #if BUILDFLAG(IS_ANDROID)
+ // https://crbug.com/461659286 Failure to create any font causes crash.
+ BASE_FEATURE(kUseAndroidNDKFontAPI, base::FEATURE_DISABLED_BY_DEFAULT);
++SET_CROMITE_FEATURE_DISABLED(kUseAndroidNDKFontAPI);
+ #endif
+ 
+ }  // namespace
 diff --git a/third_party/skia/include/ports/SkFontConfigInterface.h b/third_party/skia/include/ports/SkFontConfigInterface.h
 --- a/third_party/skia/include/ports/SkFontConfigInterface.h
 +++ b/third_party/skia/include/ports/SkFontConfigInterface.h
@@ -3051,6 +3115,18 @@ new file mode 100644
 +
 +    return false;
 +}
+diff --git a/third_party/skia/src/ports/SkFontMgr_android_ndk.cpp b/third_party/skia/src/ports/SkFontMgr_android_ndk.cpp
+--- a/third_party/skia/src/ports/SkFontMgr_android_ndk.cpp
++++ b/third_party/skia/src/ports/SkFontMgr_android_ndk.cpp
+@@ -996,7 +996,7 @@ public:
+         }
+ 
+         std::vector<std::unique_ptr<FontFamily>> xmlFamilies;
+-        SkFontMgr_Android_Parser::GetSystemFontFamilies(xmlFamilies);
++        SkFontMgr_Android_Parser::GetSystemFontFamilies(xmlFamilies, /*custom*/ nullptr);
+ 
+         skia_private::THashMap<SkString, std::unique_ptr<SkStreamAsset>> streamForPath;
+ 
 diff --git a/third_party/skia/src/ports/SkFontMgr_android_parser.cpp b/third_party/skia/src/ports/SkFontMgr_android_parser.cpp
 --- a/third_party/skia/src/ports/SkFontMgr_android_parser.cpp
 +++ b/third_party/skia/src/ports/SkFontMgr_android_parser.cpp
@@ -3129,7 +3205,7 @@ diff --git a/third_party/skia/src/ports/SkFontMgr_android_parser.cpp b/third_par
  void SkFontMgr_Android_Parser::GetSystemFontFamilies(
 -        std::vector<std::unique_ptr<FontFamily>>& fontFamilies)
 +        std::vector<std::unique_ptr<FontFamily>>& fontFamilies,
-+                                                     const SkFontMgr_Android_CustomFonts* custom)
++        const SkFontMgr_Android_CustomFonts* custom)
  {
      // Version 21 of the system font configuration does not need any fallback configuration files.
      SkString basePath(getenv("ANDROID_ROOT"));
diff --git a/build/patches/Content-settings-infrastructure.patch b/build/patches/Content-settings-infrastructure.patch
index 31e3d6b3..481e2061 100644
--- a/build/patches/Content-settings-infrastructure.patch
+++ b/build/patches/Content-settings-infrastructure.patch
@@ -13,9 +13,8 @@ Require: bromite-build-utils.patch
 ---
  .../ChromeSiteSettingsDelegate.java           |  17 +-
  ...page_specific_content_settings_delegate.cc |   2 +-
- chrome/browser/resources/settings/BUILD.gn    |   2 +-
  .../privacy_page/privacy_page_index.html      |   1 +
- .../privacy_page/privacy_page_index.ts        |  82 +++-
+ .../privacy_page/privacy_page_index.ts        |  83 +++-
  chrome/browser/resources/settings/route.ts    |   2 +
  ...settings_category_default_radio_group.html |  12 +
  .../settings_category_default_radio_group.ts  |  23 +-
@@ -85,7 +84,7 @@ Require: bromite-build-utils.patch
  .../platform/web_content_settings_client.h    |  13 +
  .../execution_context/execution_context.cc    |  16 +
  .../execution_context/execution_context.h     |   5 +
- 74 files changed, 1962 insertions(+), 106 deletions(-)
+ 73 files changed, 1962 insertions(+), 105 deletions(-)
  create mode 100644 components/browser_ui/settings/android/java/res/layout/preference_spinner_single_widget.xml
  create mode 100644 components/browser_ui/site_settings/android/java/src/org/chromium/components/browser_ui/site_settings/BromiteCustomContentSetting.java
  create mode 100644 components/browser_ui/site_settings/android/java/src/org/chromium/components/browser_ui/site_settings/BromiteCustomContentSettingImpl.java
@@ -149,25 +148,6 @@ diff --git a/chrome/browser/content_settings/page_specific_content_settings_dele
    rules->mixed_content_rules.push_back(ContentSettingPatternSource(
        ContentSettingsPattern::Wildcard(), ContentSettingsPattern::Wildcard(),
        content_settings::ContentSettingToValue(CONTENT_SETTING_BLOCK),
-diff --git a/chrome/browser/resources/settings/BUILD.gn b/chrome/browser/resources/settings/BUILD.gn
---- a/chrome/browser/resources/settings/BUILD.gn
-+++ b/chrome/browser/resources/settings/BUILD.gn
-@@ -360,6 +360,7 @@ build_webui("build") {
-     "privacy_sandbox/privacy_sandbox_browser_proxy.ts",
-     "relaunch_mixin.ts",
-     "reset_page/reset_browser_proxy.ts",
-+    "site_settings/site_settings_util.ts",
-     "route.ts",
-     "router.ts",
-     "safety_hub/safety_hub_browser_proxy.ts",
-@@ -373,7 +374,6 @@ build_webui("build") {
-     "site_settings/constants.ts",
-     "site_settings/site_settings_mixin.ts",
-     "site_settings/site_settings_browser_proxy.ts",
--    "site_settings/site_settings_util.ts",
-     "site_settings/website_usage_browser_proxy.ts",
-     "time.ts",
-     "tooltip_mixin.ts",
 diff --git a/chrome/browser/resources/settings/privacy_page/privacy_page_index.html b/chrome/browser/resources/settings/privacy_page/privacy_page_index.html
 --- a/chrome/browser/resources/settings/privacy_page/privacy_page_index.html
 +++ b/chrome/browser/resources/settings/privacy_page/privacy_page_index.html
@@ -175,12 +155,20 @@ diff --git a/chrome/browser/resources/settings/privacy_page/privacy_page_index.h
      </zoom-levels>
    </template>
  
-+  <div id="bromite-placeholder"/>
++  <div id="bromite-placeholder"></div>
  </cr-view-manager>
 diff --git a/chrome/browser/resources/settings/privacy_page/privacy_page_index.ts b/chrome/browser/resources/settings/privacy_page/privacy_page_index.ts
 --- a/chrome/browser/resources/settings/privacy_page/privacy_page_index.ts
 +++ b/chrome/browser/resources/settings/privacy_page/privacy_page_index.ts
-@@ -29,6 +29,8 @@ import {PrivacyGuideAvailabilityMixin} from './privacy_guide/privacy_guide_avail
+@@ -9,6 +9,7 @@ import '../settings_page/settings_section.js';
+ import '../settings_shared.css.js';
+ import './privacy_guide/privacy_guide_promo.js';
+ import './privacy_page.js';
++import '../controls/settings_dropdown_menu.js';
+ 
+ import {PrefsMixin} from '/shared/settings/prefs/prefs_mixin.js';
+ import type {CrViewManagerElement} from 'chrome://resources/cr_elements/cr_view_manager/cr_view_manager.js';
+@@ -29,6 +30,8 @@ import {PrivacyGuideAvailabilityMixin} from './privacy_guide/privacy_guide_avail
  import type {PrivacyGuideBrowserProxy} from './privacy_guide/privacy_guide_browser_proxy.js';
  import {MAX_PRIVACY_GUIDE_PROMO_IMPRESSION, PrivacyGuideBrowserProxyImpl} from './privacy_guide/privacy_guide_browser_proxy.js';
  import {getTemplate} from './privacy_page_index.html.js';
@@ -189,7 +177,7 @@ diff --git a/chrome/browser/resources/settings/privacy_page/privacy_page_index.t
  
  // clang-format off
  // <if expr="is_chromeos">
-@@ -53,8 +55,86 @@ export class SettingsPrivacyPageIndexElement extends
+@@ -53,8 +56,86 @@ export class SettingsPrivacyPageIndexElement extends
      return 'settings-privacy-page-index';
    }
  
@@ -399,7 +387,7 @@ diff --git a/chrome/browser/resources/settings/site_settings/site_details.html b
              label="$i18n{siteSettingsLocalNetworkAccess}">
          </site-details-permission>
        </template>
-+      <div id="bromite-placeholder"/>
++      <div id="bromite-placeholder"></div>
      </div>
    </settings-subpage>
 diff --git a/chrome/browser/resources/settings/site_settings/site_details.ts b/chrome/browser/resources/settings/site_settings/site_details.ts
@@ -2546,7 +2534,7 @@ diff --git a/components/browser_ui/site_settings/android/java/src/org/chromium/c
 +            if (preference instanceof ChromeSwitchPreference) {
 +                ((ChromeSwitchPreference)switchPreference).setChecked(value != ContentSetting.BLOCK);
 +            } else {
-+                BromiteCustomContentSettingImpl.setWebSitePreferenceValue(content_type, preference, value);
++                BromiteCustomContentSettingImpl.setWebSitePreferenceValue(contentType, preference, value);
 +            }
 +            if (preference instanceof ChromeSwitchPreference && contentType == mHighlightedPermission) {
 +                ((ChromeSwitchPreference)switchPreference).setBackgroundColor(
diff --git a/build/patches/Cromite-Branding--improve-settings-ui.patch b/build/patches/Cromite-Branding--improve-settings-ui.patch
index 8422cac8..2bc5c4f6 100644
--- a/build/patches/Cromite-Branding--improve-settings-ui.patch
+++ b/build/patches/Cromite-Branding--improve-settings-ui.patch
@@ -8,10 +8,10 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 ---
  chrome/android/chrome_java_resources.gni      |   2 +-
  .../android/java/res/xml/main_preferences.xml |   4 +-
- .../res/xml/privacy_preferences_cromite.xml   | 197 ++++++++++++++++++
+ .../res/xml/privacy_preferences_cromite.xml   | 191 ++++++++++++++++++
  .../privacy/settings/PrivacySettings.java     |   6 +-
  .../Cromite-settings-ui.grdp                  |  15 ++
- 5 files changed, 219 insertions(+), 5 deletions(-)
+ 5 files changed, 213 insertions(+), 5 deletions(-)
  create mode 100644 chrome/android/java/res/xml/privacy_preferences_cromite.xml
  create mode 100644 chrome/browser/ui/android/strings/cromite_android_chrome_strings_grd/Cromite-settings-ui.grdp
 
@@ -52,7 +52,7 @@ diff --git a/chrome/android/java/res/xml/privacy_preferences_cromite.xml b/chrom
 new file mode 100644
 --- /dev/null
 +++ b/chrome/android/java/res/xml/privacy_preferences_cromite.xml
-@@ -0,0 +1,197 @@
+@@ -0,0 +1,191 @@
 +<?xml version="1.0" encoding="utf-8"?><!--
 +Copyright 2022 The Chromium Authors
 +Use of this source code is governed by a BSD-style license that can be
@@ -223,12 +223,6 @@ new file mode 100644
 +        android:fragment="org.chromium.components.privacy_sandbox.TrackingProtectionSettings"
 +        app:isPreferenceVisible="false" />
 +    <Preference
-+        android:key="incognito_tracking_protections"
-+        android:title="@string/incognito_tracking_protections_link_row_label"
-+        android:summary="@string/incognito_tracking_protections_link_row_sublabel"
-+        android:fragment="org.chromium.components.privacy_sandbox.IncognitoTrackingProtectionsFragment"
-+        app:isPreferenceVisible="false" />
-+    <Preference
 +        android:key="privacy_sandbox"
 +        android:title="@string/ad_privacy_link_row_label"
 +        android:summary="@string/ad_privacy_link_row_sub_label"
diff --git a/build/patches/Disable-all-predictors-code.patch b/build/patches/Disable-all-predictors-code.patch
index bd78da8d..4402f5c8 100644
--- a/build/patches/Disable-all-predictors-code.patch
+++ b/build/patches/Disable-all-predictors-code.patch
@@ -5,82 +5,86 @@ Subject: Disable all predictors code
 Original License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 ---
- chrome/browser/BUILD.gn                          |  3 ---
- .../background_download_service_factory.cc       |  2 +-
- .../preloading_model_keyed_service.cc            |  3 +++
- .../preloading_model_keyed_service_factory.cc    |  4 +---
- .../optimization_guide/chrome_hints_manager.cc   |  1 +
- .../model_validator_keyed_service.cc             |  6 +++++-
- .../optimization_guide_keyed_service.cc          |  1 -
- .../password_change_delegate_impl.cc             |  2 ++
- chrome/browser/permissions/BUILD.gn              |  2 --
- .../permissions/chrome_permissions_client.cc     |  2 --
- .../passage_embedder_delegate.cc                 |  2 ++
- .../permissions_ai_ui_selector.cc                |  5 +++++
- .../permissions_ai_ui_selector.h                 |  5 ++++-
- .../prediction_model_handler_provider.cc         | 12 +++++++++---
- .../prediction_model_handler_provider.h          |  2 ++
- .../quiet_notification_permission_ui_state.cc    |  4 ++--
- .../predictors/autocomplete_action_predictor.cc  |  2 ++
- .../predictors/loading_predictor_config.cc       |  4 ++--
- chrome/browser/predictors/predictors_features.cc |  3 +--
- .../search_prefetch/field_trial_settings.cc      |  4 ++++
- .../search_prefetch_url_loader_interceptor.cc    |  1 +
- .../chrome_browser_main_extra_parts_profiles.cc  |  1 -
- chrome/browser/safe_browsing/BUILD.gn            |  1 -
- ...fication_content_detection_service_factory.cc |  6 ++++++
- .../preloading/AndroidPrerenderManager.java      |  1 +
- .../ui/autofill/chrome_autofill_client.cc        | 13 +------------
- chrome/browser/ui/tab_helpers.cc                 |  1 -
- .../autofill_ml_internals_page_handler.cc        |  2 ++
- .../autofill_ml_internals_page_handler.h         |  3 +++
- .../autofill_ml_internals_ui.cc                  |  3 +++
- .../read_anything/read_aloud_app_model.cc        | 16 ++++++++++++++--
- .../read_anything/read_aloud_app_model.h         |  9 ++++++++-
- .../read_anything_app_controller.cc              | 10 ++++++++++
- .../read_anything/read_anything_app_controller.h |  4 ++++
- chrome/test/BUILD.gn                             |  2 --
- chrome/utility/BUILD.gn                          |  2 +-
- chrome/utility/services.cc                       |  8 --------
- components/BUILD.gn                              |  2 +-
- .../core/browser/foundations/autofill_manager.cc |  6 ++++++
- .../core/browser/foundations/autofill_manager.h  |  3 +++
- .../autofill_optimization_guide_decider.cc       |  5 +++--
- .../field_classification_model_handler.cc        | 12 ++++++++----
- .../field_classification_model_handler.h         | 10 ++++++++--
- .../browser/aim_eligibility_service_features.cc  |  1 +
- .../omnibox/browser/autocomplete_controller.cc   |  4 ++++
- .../omnibox/browser/base_search_provider.cc      |  4 ++--
- .../prediction_model_download_manager.cc         |  6 ++++--
- .../delivery/prediction_model_fetcher_impl.cc    |  1 +
- .../core/hints/hints_fetcher.cc                  |  1 +
- .../core/hints/hints_manager.cc                  |  2 ++
- .../core/optimization_guide_features.cc          | 12 ++++++------
- components/optimization_guide/features.gni       |  3 +--
- .../core/page_content_annotations_features.cc    |  4 ++++
- .../page_content_annotations_model_manager.cc    |  1 +
- .../notification_content_detection/BUILD.gn      |  4 ----
- .../service_worker_main_resource_loader.cc       |  1 +
- .../Disable-all-predictors-code.inc              |  2 ++
- .../Disable-all-predictors-code.inc              |  1 +
- .../Disable-all-predictors-code.inc              |  1 +
- .../Disable-all-predictors-code.inc              |  1 +
- .../features_cc/Disable-all-predictors-code.inc  |  5 +++++
- .../features_cc/Disable-all-predictors-code.inc  |  1 +
- .../features_cc/Disable-all-predictors-code.inc  |  1 +
- .../features_cc/Disable-all-predictors-code.inc  |  2 ++
- media/webrtc/BUILD.gn                            |  5 +++++
- media/webrtc/helpers.cc                          |  3 ++-
- services/on_device_model/ml/BUILD.gn             |  2 +-
- services/on_device_model/ml/ts_model.cc          |  4 ++--
- services/on_device_model/safety/BUILD.gn         |  2 +-
- services/webnn/BUILD.gn                          |  2 +-
- services/webnn/features.gni                      |  2 +-
- services/webnn/webnn_context_provider_impl.cc    | 13 +------------
- .../core/html/parser/html_document_parser.cc     |  1 +
- .../document_speculation_rules.cc                |  1 +
- .../platform/runtime_enabled_features.json5      |  2 +-
- 75 files changed, 188 insertions(+), 97 deletions(-)
+ chrome/browser/BUILD.gn                        |  3 ---
+ .../background_download_service_factory.cc     |  2 +-
+ .../preloading_model_keyed_service.cc          |  3 +++
+ .../preloading_model_keyed_service_factory.cc  |  4 +---
+ .../optimization_guide/chrome_hints_manager.cc |  1 +
+ .../model_validator_keyed_service.cc           |  6 +++++-
+ .../optimization_guide_keyed_service.cc        |  1 -
+ .../password_change_delegate_impl.cc           |  2 ++
+ chrome/browser/permissions/BUILD.gn            |  2 --
+ .../permissions/chrome_permissions_client.cc   |  2 --
+ .../passage_embedder_delegate.cc               |  2 ++
+ .../permissions_ai_ui_selector.cc              |  5 +++++
+ .../permissions_ai_ui_selector.h               |  5 ++++-
+ .../prediction_model_handler_provider.cc       | 12 +++++++++---
+ .../prediction_model_handler_provider.h        |  2 ++
+ .../quiet_notification_permission_ui_state.cc  |  4 ++--
+ .../autocomplete_action_predictor.cc           |  2 ++
+ .../predictors/loading_predictor_config.cc     |  4 ++--
+ .../browser/predictors/predictors_features.cc  |  3 +--
+ .../search_prefetch/field_trial_settings.cc    |  4 ++++
+ .../search_prefetch_url_loader_interceptor.cc  |  1 +
+ ...chrome_browser_main_extra_parts_profiles.cc |  1 -
+ chrome/browser/safe_browsing/BUILD.gn          |  1 -
+ ...cation_content_detection_service_factory.cc |  6 ++++++
+ .../preloading/AndroidPrerenderManager.java    |  1 +
+ .../ui/autofill/chrome_autofill_client.cc      | 13 +------------
+ chrome/browser/ui/tab_helpers.cc               |  1 -
+ .../autofill_ml_internals_page_handler.cc      |  2 ++
+ .../autofill_ml_internals_page_handler.h       |  3 +++
+ .../autofill_ml_internals_ui.cc                |  3 +++
+ .../read_anything/read_aloud_app_model.cc      | 16 ++++++++++++++--
+ .../read_anything/read_aloud_app_model.h       |  9 ++++++++-
+ .../read_anything_app_controller.cc            | 10 ++++++++++
+ .../read_anything_app_controller.h             |  4 ++++
+ chrome/test/BUILD.gn                           |  2 --
+ chrome/utility/BUILD.gn                        |  2 +-
+ chrome/utility/services.cc                     |  8 --------
+ components/BUILD.gn                            |  2 +-
+ .../browser/foundations/autofill_manager.cc    |  6 ++++++
+ .../browser/foundations/autofill_manager.h     |  3 +++
+ .../autofill_optimization_guide_decider.cc     |  5 +++--
+ .../field_classification_model_handler.cc      | 12 ++++++++----
+ .../field_classification_model_handler.h       | 10 ++++++++--
+ .../aim_eligibility_service_features.cc        |  1 +
+ .../omnibox/browser/autocomplete_controller.cc |  4 ++++
+ .../omnibox/browser/base_search_provider.cc    |  4 ++--
+ .../prediction_model_download_manager.cc       |  6 ++++--
+ .../delivery/prediction_model_fetcher_impl.cc  |  1 +
+ .../core/hints/hints_fetcher.cc                |  1 +
+ .../core/hints/hints_manager.cc                |  2 ++
+ .../core/optimization_guide_features.cc        | 11 +++++------
+ components/optimization_guide/features.gni     |  3 +--
+ .../core/page_content_annotations_features.cc  |  7 +++++++
+ .../page_content_annotations_model_manager.cc  |  1 +
+ .../notification_content_detection/BUILD.gn    |  4 ----
+ components/viz/service/BUILD.gn                |  4 ++--
+ components/viz/service/gl/gpu_service_impl.cc  | 18 ------------------
+ content/browser/BUILD.gn                       |  6 +++---
+ content/browser/gpu/gpu_process_host.cc        |  6 +++---
+ .../service_worker_main_resource_loader.cc     |  1 +
+ .../Disable-all-predictors-code.inc            |  2 ++
+ .../Disable-all-predictors-code.inc            |  1 +
+ .../Disable-all-predictors-code.inc            |  1 +
+ .../Disable-all-predictors-code.inc            |  1 +
+ .../Disable-all-predictors-code.inc            |  5 +++++
+ .../Disable-all-predictors-code.inc            |  1 +
+ .../Disable-all-predictors-code.inc            |  1 +
+ .../Disable-all-predictors-code.inc            |  2 ++
+ media/webrtc/BUILD.gn                          |  5 +++++
+ media/webrtc/helpers.cc                        |  3 ++-
+ services/on_device_model/ml/BUILD.gn           |  2 +-
+ services/on_device_model/ml/ts_model.cc        |  4 ++--
+ services/on_device_model/safety/BUILD.gn       |  2 +-
+ services/webnn/BUILD.gn                        |  2 +-
+ services/webnn/features.gni                    |  2 +-
+ services/webnn/webnn_context_provider_impl.cc  | 13 +------------
+ .../core/html/parser/html_document_parser.cc   |  1 +
+ .../document_speculation_rules.cc              |  1 +
+ .../platform/runtime_enabled_features.json5    |  2 +-
+ 79 files changed, 198 insertions(+), 123 deletions(-)
  create mode 100644 cromite_flags/chrome/browser/browser_features_cc/Disable-all-predictors-code.inc
  create mode 100644 cromite_flags/chrome/browser/flags/android/chrome_feature_list_cc/Disable-all-predictors-code.inc
  create mode 100644 cromite_flags/chrome/common/chrome_features_cc/Disable-all-predictors-code.inc
@@ -1316,13 +1320,12 @@ diff --git a/components/optimization_guide/core/optimization_guide_features.cc b
  }
  
  RequestContextSet GetAllowedContextsForPersonalizedMetadata() {
-@@ -603,5 +598,10 @@ std::optional<base::TimeDelta> GetMainFrameGetAIPageContentTimeout() {
+@@ -603,5 +598,9 @@ std::optional<base::TimeDelta> GetMainFrameGetAIPageContentTimeout() {
    return kGetAIPageContentMainFrameTimeoutParam.Get();
  }
  
 +SET_CROMITE_FEATURE_DISABLED(kOptimizationHints);
 +SET_CROMITE_FEATURE_DISABLED(kOptimizationTargetPrediction);
-+SET_CROMITE_FEATURE_DISABLED(kPushNotifications);
 +SET_CROMITE_FEATURE_DISABLED(kPreventLongRunningPredictionModels);
 +SET_CROMITE_FEATURE_DISABLED(kOptimizationGuideFetchingForSRP);
  }  // namespace features
@@ -1343,14 +1346,45 @@ diff --git a/components/optimization_guide/features.gni b/components/optimizatio
 diff --git a/components/page_content_annotations/core/page_content_annotations_features.cc b/components/page_content_annotations/core/page_content_annotations_features.cc
 --- a/components/page_content_annotations/core/page_content_annotations_features.cc
 +++ b/components/page_content_annotations/core/page_content_annotations_features.cc
-@@ -326,4 +326,8 @@ bool IsSupportedCountryForFeature(const std::string& country_code,
+@@ -69,6 +69,7 @@ const base::FeatureParam<std::string> kPageContentExtractionTriggeringMode{
+ 
+ bool IsSupportedLocale(const std::string& locale,
+                        const std::string& supported_locales) {
++  if ((true)) return false;
+   if (supported_locales == "*") {
+     return true;
+   }
+@@ -88,6 +89,7 @@ bool IsSupportedLocale(const std::string& locale,
+ 
+ bool IsSupportedCountry(const std::string& country_code,
+                         const std::string& supported_countries) {
++  if ((true)) return false;
+   if (supported_countries == "*") {
+     return true;
+   }
+@@ -295,6 +297,7 @@ bool IsSupportedLocaleForFeature(
+     const std::string& locale,
+     const base::Feature& feature,
+     const std::string& default_value = "de,en,es,fr,it,nl,pt,tr") {
++  if ((true)) return false;
+   if (!base::FeatureList::IsEnabled(feature)) {
+     return false;
+   }
+@@ -312,6 +315,7 @@ bool IsSupportedLocaleForFeature(
+ bool IsSupportedCountryForFeature(const std::string& country_code,
+                                   const base::Feature& feature,
+                                   const std::string& default_value) {
++  if ((true)) return false;
+   if (!base::FeatureList::IsEnabled(feature)) {
+     return false;
+   }
+@@ -326,4 +330,7 @@ bool IsSupportedCountryForFeature(const std::string& country_code,
    return IsSupportedCountry(country_code, value);
  }
  
 +SET_CROMITE_FEATURE_DISABLED(kPageContentAnnotations);
-+SET_CROMITE_FEATURE_DISABLED(kRemotePageMetadata);
 +SET_CROMITE_FEATURE_DISABLED(kPageContentAnnotationsValidation);
-+SET_CROMITE_FEATURE_DISABLED(kPageContentAnnotationsPersistSalientImageMetadata);
++SET_CROMITE_FEATURE_DISABLED(kRemotePageMetadata);
  }  // namespace page_content_annotations::features
 diff --git a/components/page_content_annotations/core/page_content_annotations_model_manager.cc b/components/page_content_annotations/core/page_content_annotations_model_manager.cc
 --- a/components/page_content_annotations/core/page_content_annotations_model_manager.cc
@@ -1377,6 +1411,80 @@ diff --git a/components/safe_browsing/content/browser/notification_content_detec
    ]
  
    deps = [
+diff --git a/components/viz/service/BUILD.gn b/components/viz/service/BUILD.gn
+--- a/components/viz/service/BUILD.gn
++++ b/components/viz/service/BUILD.gn
+@@ -315,8 +315,8 @@ viz_component("service") {
+     "//services/metrics/public/mojom",
+     "//services/tracing/public/cpp",
+     "//services/viz/privileged/mojom",
+-    "//services/webnn:webnn_service",
+-    "//services/webnn/public/mojom",
++    #"//services/webnn:webnn_service",
++    #"//services/webnn/public/mojom",
+     "//skia",
+     "//skia:skcms",
+     "//third_party/blink/public/common",
+diff --git a/components/viz/service/gl/gpu_service_impl.cc b/components/viz/service/gl/gpu_service_impl.cc
+--- a/components/viz/service/gl/gpu_service_impl.cc
++++ b/components/viz/service/gl/gpu_service_impl.cc
+@@ -649,24 +649,6 @@ void GpuServiceImpl::BindWebNNContextProvider(
+                        std::move(pending_receiver), client_id));
+     return;
+   }
+-
+-  if (!webnn_context_provider_) {
+-    scoped_refptr<gpu::SharedContextState> shared_context_state =
+-        GetContextState();
+-    // `shared_context_state` may be nullptr if there is no GPU acceleration.
+-    // For such case, WebNN CPU backend, e.g. TFLite XNNPACK, is still useful.
+-
+-    // TODO(crbug.com/345352987): manage `WebNNContextProviderImpl` instance per
+-    // `client_id` in order to support memory metrics.
+-    webnn_context_provider_ = webnn::WebNNContextProviderImpl::Create(
+-        std::move(shared_context_state), gpu_feature_info_, gpu_info_,
+-        shared_image_manager(),
+-        base::BindOnce(&GpuServiceImpl::LoseAllContexts, weak_ptr_),
+-        main_runner(), GetGpuScheduler(), client_id, gpu_host_);
+-  }
+-
+-  webnn_context_provider_->BindWebNNContextProvider(
+-      std::move(pending_receiver));
+ }
+ 
+ void GpuServiceImpl::GetVideoMemoryUsageStats(
+diff --git a/content/browser/BUILD.gn b/content/browser/BUILD.gn
+--- a/content/browser/BUILD.gn
++++ b/content/browser/BUILD.gn
+@@ -270,9 +270,9 @@ source_set("browser") {
+     "//services/viz/public/cpp/gpu",
+     "//services/viz/public/mojom",
+     "//services/webnn:buildflags",
+-    "//services/webnn:webnn_service",
+-    "//services/webnn:webnn_switches",
+-    "//services/webnn/public/mojom",
++    # "//services/webnn:webnn_service",
++    # "//services/webnn:webnn_switches",
++    # "//services/webnn/public/mojom",
+     "//skia",
+     "//skia/public/mojom",
+     "//sql",
+diff --git a/content/browser/gpu/gpu_process_host.cc b/content/browser/gpu/gpu_process_host.cc
+--- a/content/browser/gpu/gpu_process_host.cc
++++ b/content/browser/gpu/gpu_process_host.cc
+@@ -1346,9 +1346,9 @@ bool GpuProcessHost::LaunchGpuProcess() {
+   cmd_line->CopySwitchesFrom(browser_command_line, kSwitchNames);
+   cmd_line->CopySwitchesFrom(browser_command_line,
+                              switches::kGLSwitchesCopiedFromGpuProcessHost);
+-  cmd_line->CopySwitchesFrom(
+-      browser_command_line,
+-      switches::GetWebNNSwitchesCopiedFromGpuProcessHost());
++  // cmd_line->CopySwitchesFrom(
++  //     browser_command_line,
++  //     switches::GetWebNNSwitchesCopiedFromGpuProcessHost());
+ 
+   if (browser_command_line.HasSwitch(switches::kDisableFrameRateLimit))
+     cmd_line->AppendSwitch(switches::kDisableGpuVsync);
 diff --git a/content/browser/service_worker/service_worker_main_resource_loader.cc b/content/browser/service_worker/service_worker_main_resource_loader.cc
 --- a/content/browser/service_worker/service_worker_main_resource_loader.cc
 +++ b/content/browser/service_worker/service_worker_main_resource_loader.cc
diff --git a/build/patches/Disable-fetching-of-all-field-trials.patch b/build/patches/Disable-fetching-of-all-field-trials.patch
index 69b66683..6355ea0d 100644
--- a/build/patches/Disable-fetching-of-all-field-trials.patch
+++ b/build/patches/Disable-fetching-of-all-field-trials.patch
@@ -448,7 +448,7 @@ new file mode 100644
 --- /dev/null
 +++ b/cromite_flags/net/base/features_cc/Disable-fetching-of-all-field-trials.inc
 @@ -0,0 +1 @@
-+SET_CROMITE_FEATURE_DISABLED(kTpcdTrialSettings);
++// empty file
 diff --git a/cromite_flags/services/network/public/cpp/features_cc/Disable-fetching-of-all-field-trials.inc b/cromite_flags/services/network/public/cpp/features_cc/Disable-fetching-of-all-field-trials.inc
 new file mode 100644
 --- /dev/null
diff --git a/build/patches/Disable-speechSynthesis-getVoices-API.patch b/build/patches/Disable-speechSynthesis-getVoices-API.patch
index 8f3ebe6c..a89f4e09 100644
--- a/build/patches/Disable-speechSynthesis-getVoices-API.patch
+++ b/build/patches/Disable-speechSynthesis-getVoices-API.patch
@@ -172,7 +172,7 @@ diff --git a/third_party/blink/renderer/modules/speech/speech_synthesis.cc b/thi
 -        MakeGarbageCollected<SpeechSynthesisVoice>(std::move(mojom_voice)));
 +  bool allowed = !base::FeatureList::IsEnabled(features::kDisableSpeechSynthesisVoiceList);
 +  if (allowed) {
-+    auto* frame = GetSupplementable()->GetFrame();
++    auto* frame = local_dom_window_->GetFrame();
 +    if (frame) {
 +      blink::WebContentSettingsClient* settings = frame->GetContentSettingsClient();
 +      if (settings) allowed = !settings->IsTimezoneChanged();
diff --git a/build/patches/Enable-Do-Not-Track-by-default.patch b/build/patches/Enable-Do-Not-Track-by-default.patch
index e8481bcf..fc532313 100644
--- a/build/patches/Enable-Do-Not-Track-by-default.patch
+++ b/build/patches/Enable-Do-Not-Track-by-default.patch
@@ -17,6 +17,6 @@ diff --git a/chrome/browser/ui/browser_ui_prefs.cc b/chrome/browser/ui/browser_u
 -      prefs::kEnableDoNotTrack, false,
 +      prefs::kEnableDoNotTrack, true,
        user_prefs::PrefRegistrySyncable::SYNCABLE_PREF);
+   registry->RegisterBooleanPref(prefs::kEnableGPC, true);
  #if !BUILDFLAG(IS_CHROMEOS) && !BUILDFLAG(IS_ANDROID)
-   registry->RegisterBooleanPref(prefs::kPrintPreviewUseSystemDefaultPrinter,
 --
diff --git a/build/patches/Enable-Global-Privacy-Control.patch b/build/patches/Enable-Global-Privacy-Control.patch
index 62e9290e..a00da6b0 100644
--- a/build/patches/Enable-Global-Privacy-Control.patch
+++ b/build/patches/Enable-Global-Privacy-Control.patch
@@ -12,21 +12,17 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
  .../privacy/settings/PrivacySettings.java     |   9 ++
  chrome/app/settings_strings.grdp              |  15 +++
  .../api/settings_private/prefs_util.cc        |   1 +
- chrome/browser/renderer_preferences_util.cc   |   3 +
+ chrome/browser/renderer_preferences_util.cc   |   2 +
  chrome/browser/resources/settings/BUILD.gn    |   1 +
  .../settings/privacy_page/cookies_page.html   |   2 +
  .../settings/privacy_page/cookies_page.ts     |   1 +
  .../settings/privacy_page/gpc_toggle.html     |  32 +++++
  .../settings/privacy_page/gpc_toggle.ts       | 112 ++++++++++++++++++
  .../Enable-Global-Privacy-Control.grdp        |  15 +++
- chrome/browser/ui/prefs/pref_watcher.cc       |   4 +
- chrome/browser/ui/prefs/pref_watcher.h        |   2 +
+ chrome/browser/ui/browser_ui_prefs.cc         |   1 +
+ chrome/browser/ui/prefs/pref_watcher.cc       |   2 +
  .../settings_localized_strings_provider.cc    |   3 +
- .../tracking_protection_prefs.cc              |   1 +
- .../tracking_protection_prefs.h               |   2 +
- .../tracking_protection_settings.cc           |  15 +++
- .../tracking_protection_settings.h            |   3 +
- .../tracking_protection_settings_observer.h   |   2 +
+ chrome/common/pref_names.h                    |   2 +
  .../browser_initiated_resource_request.cc     |   6 +
  content/renderer/render_frame_impl.cc         |   4 +
  .../blink/common/loader/loader_constants.cc   |   1 +
@@ -46,7 +42,7 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
  .../web_service_worker_fetch_context_impl.cc  |   3 +
  ...shared_worker_global_scope_context_impl.cc |   3 +
  .../platform/runtime_enabled_features.json5   |   5 +
- 42 files changed, 391 insertions(+)
+ 38 files changed, 366 insertions(+)
  create mode 100644 chrome/android/java/res/xml/gpc_preferences.xml
  create mode 100644 chrome/android/java/src/org/chromium/chrome/browser/privacy/settings/GpcSettings.java
  create mode 100644 chrome/browser/resources/settings/privacy_page/gpc_toggle.html
@@ -240,13 +236,12 @@ diff --git a/chrome/browser/extensions/api/settings_private/prefs_util.cc b/chro
 diff --git a/chrome/browser/renderer_preferences_util.cc b/chrome/browser/renderer_preferences_util.cc
 --- a/chrome/browser/renderer_preferences_util.cc
 +++ b/chrome/browser/renderer_preferences_util.cc
-@@ -152,6 +152,9 @@ void UpdateFromSystemSettings(blink::RendererPreferences* prefs,
+@@ -152,6 +152,8 @@ void UpdateFromSystemSettings(blink::RendererPreferences* prefs,
    prefs->referrers_policy = pref_service->GetInteger(prefs::kReferrersPolicy);
    prefs->enable_do_not_track =
        pref_service->GetBoolean(prefs::kEnableDoNotTrack);
 +  prefs->enable_gpc =
-+      TrackingProtectionSettingsFactory::GetForProfile(profile)
-+          ->IsGPCEnabled();
++      pref_service->GetBoolean(prefs::kEnableGPC);
    prefs->enable_encrypted_media =
        pref_service->GetBoolean(prefs::kEnableEncryptedMedia);
    prefs->webrtc_ip_handling_policy = blink::ToWebRTCIPHandlingPolicy(
@@ -458,32 +453,29 @@ new file mode 100644
 +Please note that it only applies to the states of California (under CCPA and CPRA) and Colorado (under CoPA).
 +      </message>
 +</grit-part>
+diff --git a/chrome/browser/ui/browser_ui_prefs.cc b/chrome/browser/ui/browser_ui_prefs.cc
+--- a/chrome/browser/ui/browser_ui_prefs.cc
++++ b/chrome/browser/ui/browser_ui_prefs.cc
+@@ -141,6 +141,7 @@ void RegisterBrowserUserPrefs(user_prefs::PrefRegistrySyncable* registry) {
+   registry->RegisterBooleanPref(
+       prefs::kEnableDoNotTrack, false,
+       user_prefs::PrefRegistrySyncable::SYNCABLE_PREF);
++  registry->RegisterBooleanPref(prefs::kEnableGPC, true);
+ #if !BUILDFLAG(IS_CHROMEOS) && !BUILDFLAG(IS_ANDROID)
+   registry->RegisterBooleanPref(prefs::kPrintPreviewUseSystemDefaultPrinter,
+                                 false);
 diff --git a/chrome/browser/ui/prefs/pref_watcher.cc b/chrome/browser/ui/prefs/pref_watcher.cc
 --- a/chrome/browser/ui/prefs/pref_watcher.cc
 +++ b/chrome/browser/ui/prefs/pref_watcher.cc
-@@ -199,6 +199,10 @@ void PrefWatcher::OnNativeThemeUpdated(ui::NativeTheme* observed_theme) {
-   UpdateRendererPreferences();
- }
+@@ -150,6 +150,8 @@ PrefWatcher::PrefWatcher(Profile* profile) : profile_(profile) {
+                                      renderer_callback);
+   profile_pref_change_registrar_.Add(prefs::kEnableDoNotTrack,
+                                      renderer_callback);
++  profile_pref_change_registrar_.Add(prefs::kEnableGPC,
++                                     renderer_callback);
  
-+void PrefWatcher::OnGPCEnabledChanged() {
-+  UpdateRendererPreferences();
-+}
-+
- void PrefWatcher::UpdateRendererPreferences() {
-   for (PrefsTabHelper* helper : tab_helpers_) {
-     helper->UpdateRendererPreferences();
-diff --git a/chrome/browser/ui/prefs/pref_watcher.h b/chrome/browser/ui/prefs/pref_watcher.h
---- a/chrome/browser/ui/prefs/pref_watcher.h
-+++ b/chrome/browser/ui/prefs/pref_watcher.h
-@@ -41,6 +41,8 @@ class PrefWatcher : public KeyedService,
-   // ui::NativeThemeObserver:
-   void OnNativeThemeUpdated(ui::NativeTheme* observed_theme) override;
- 
-+  void OnGPCEnabledChanged() override;
-+
-   void UpdateRendererPreferences();
-   void OnWebPrefChanged(const std::string& pref_name);
-   void OnLiveCaptionEnabledPrefChanged(const std::string& pref_name);
+ #if !BUILDFLAG(IS_MAC)
+   profile_pref_change_registrar_.Add(prefs::kFullscreenAllowed,
 diff --git a/chrome/browser/ui/webui/settings/settings_localized_strings_provider.cc b/chrome/browser/ui/webui/settings/settings_localized_strings_provider.cc
 --- a/chrome/browser/ui/webui/settings/settings_localized_strings_provider.cc
 +++ b/chrome/browser/ui/webui/settings/settings_localized_strings_provider.cc
@@ -497,93 +489,18 @@ diff --git a/chrome/browser/ui/webui/settings/settings_localized_strings_provide
        // TODO(crbug.com/40122957): This string is no longer used. Remove.
        {"permissionsPageTitle", IDS_SETTINGS_PERMISSIONS},
        {"siteSettingsSublabel", IDS_SETTINGS_PERMISSIONS_DESCRIPTION},
-diff --git a/components/privacy_sandbox/tracking_protection_prefs.cc b/components/privacy_sandbox/tracking_protection_prefs.cc
---- a/components/privacy_sandbox/tracking_protection_prefs.cc
-+++ b/components/privacy_sandbox/tracking_protection_prefs.cc
-@@ -16,6 +16,7 @@ void RegisterProfilePrefs(PrefRegistrySimple* registry) {
-   registry->RegisterBooleanPref(
-       prefs::kFingerprintingProtectionEnabled, true,
-       user_prefs::PrefRegistrySyncable::SYNCABLE_PREF);
-+  registry->RegisterBooleanPref(prefs::kEnableGPC, true);
-   registry->RegisterBooleanPref(
-       prefs::kIpProtectionEnabled, true,
-       user_prefs::PrefRegistrySyncable::SYNCABLE_PREF);
-diff --git a/components/privacy_sandbox/tracking_protection_prefs.h b/components/privacy_sandbox/tracking_protection_prefs.h
---- a/components/privacy_sandbox/tracking_protection_prefs.h
-+++ b/components/privacy_sandbox/tracking_protection_prefs.h
-@@ -101,6 +101,8 @@ inline constexpr char kIpProtectionInitializedByDogfood[] =
- inline constexpr char kFingerprintingProtectionEnabled[] =
-     "tracking_protection.fingerprinting_protection_enabled";
+diff --git a/chrome/common/pref_names.h b/chrome/common/pref_names.h
+--- a/chrome/common/pref_names.h
++++ b/chrome/common/pref_names.h
+@@ -1558,6 +1558,8 @@ inline constexpr char kEnableReferrers[] = "enable_referrers";
+ // Whether to send the DNT header.
+ inline constexpr char kEnableDoNotTrack[] = "enable_do_not_track";
  
 +inline constexpr char kEnableGPC[] = "enable_gpc";
 +
- // Whether User Bypass 3PC exceptions have been migrated to Tracking Protection
- // exceptions.
- inline constexpr char kUserBypass3pcExceptionsMigrated[] =
-diff --git a/components/privacy_sandbox/tracking_protection_settings.cc b/components/privacy_sandbox/tracking_protection_settings.cc
---- a/components/privacy_sandbox/tracking_protection_settings.cc
-+++ b/components/privacy_sandbox/tracking_protection_settings.cc
-@@ -48,6 +48,11 @@ TrackingProtectionSettings::TrackingProtectionSettings(
-       base::BindRepeating(
-           &TrackingProtectionSettings::OnIpProtectionPrefChanged,
-           base::Unretained(this)));
-+  pref_change_registrar_.Add(
-+      prefs::kEnableGPC,
-+      base::BindRepeating(
-+          &TrackingProtectionSettings::OnGPCEnabledPrefChanged,
-+          base::Unretained(this)));
-   pref_change_registrar_.Add(
-       prefs::kBlockAll3pcToggleEnabled,
-       base::BindRepeating(
-@@ -135,6 +140,16 @@ void TrackingProtectionSettings::OnEnterpriseControlForPrefsChanged() {
-   }
- }
- 
-+bool TrackingProtectionSettings::IsGPCEnabled() const {
-+  return pref_service_->GetBoolean(prefs::kEnableGPC);
-+}
-+
-+void TrackingProtectionSettings::OnGPCEnabledPrefChanged() {
-+  for (auto& observer : observers_) {
-+    observer.OnGPCEnabledChanged();
-+  }
-+}
-+
- void TrackingProtectionSettings::OnIpProtectionPrefChanged() {
-   for (auto& observer : observers_) {
-     observer.OnIpProtectionEnabledChanged();
-diff --git a/components/privacy_sandbox/tracking_protection_settings.h b/components/privacy_sandbox/tracking_protection_settings.h
---- a/components/privacy_sandbox/tracking_protection_settings.h
-+++ b/components/privacy_sandbox/tracking_protection_settings.h
-@@ -49,6 +49,8 @@ class TrackingProtectionSettings : public KeyedService {
-   void AddObserver(TrackingProtectionSettingsObserver* observer);
-   void RemoveObserver(TrackingProtectionSettingsObserver* observer);
- 
-+  bool IsGPCEnabled() const;
-+
-   // Returns whether tracking protection for 3PCD (prefs + UX) is enabled.
-   bool IsTrackingProtection3pcdEnabled() const;
- 
-@@ -70,6 +72,7 @@ class TrackingProtectionSettings : public KeyedService {
-   void OnEnterpriseControlForPrefsChanged();
- 
-   // Callbacks for pref observation.
-+  void OnGPCEnabledPrefChanged();
-   void OnBlockAllThirdPartyCookiesPrefChanged();
-   void OnTrackingProtection3pcdPrefChanged();
-   void OnIpProtectionPrefChanged();
-diff --git a/components/privacy_sandbox/tracking_protection_settings_observer.h b/components/privacy_sandbox/tracking_protection_settings_observer.h
---- a/components/privacy_sandbox/tracking_protection_settings_observer.h
-+++ b/components/privacy_sandbox/tracking_protection_settings_observer.h
-@@ -21,6 +21,8 @@ class TrackingProtectionSettingsObserver {
- 
-   virtual ~TrackingProtectionSettingsObserver() = default;
- 
-+  virtual void OnGPCEnabledChanged() {}
-+
-   // For observation of IP protection.
-   virtual void OnIpProtectionEnabledChanged() {}
- 
+ // Whether to allow the use of Encrypted Media Extensions (EME), except for the
+ // use of Clear Key key sytems, which is always allowed as required by the spec.
+ // TODO(crbug.com/40549758): This pref was used as a WebPreference which is why
 diff --git a/content/browser/loader/browser_initiated_resource_request.cc b/content/browser/loader/browser_initiated_resource_request.cc
 --- a/content/browser/loader/browser_initiated_resource_request.cc
 +++ b/content/browser/loader/browser_initiated_resource_request.cc
diff --git a/build/patches/Enable-extension-in-incognito.patch b/build/patches/Enable-extension-in-incognito.patch
index 0d504580..9d0dcbf2 100644
--- a/build/patches/Enable-extension-in-incognito.patch
+++ b/build/patches/Enable-extension-in-incognito.patch
@@ -7,7 +7,7 @@ Full activation of incognito mode in experimental extension
 License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 ---
  .../chrome/browser/ChromeTabbedActivity.java  | 40 +++++++-
- .../chrome/browser/app/ChromeActivity.java    | 24 ++++-
+ .../chrome/browser/app/ChromeActivity.java    | 28 ++++--
  .../customtabs/BaseCustomTabActivity.java     |  2 +-
  .../BaseCustomTabRootUiCoordinator.java       |  4 +-
  .../CustomTabIntentDataProvider.java          |  3 +
@@ -25,12 +25,14 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
  .../ui/extensions/ExtensionActionsBridge.java |  6 ++
  .../android/tab_model/tab_model_jni_bridge.cc |  4 +
  .../ExtensionActionListCoordinator.java       |  4 +-
- .../ExtensionActionListMediator.java          | 16 ++--
+ .../ExtensionActionListMediator.java          | 24 ++---
  .../ExtensionToolbarCoordinator.java          |  7 +-
  .../ExtensionToolbarCoordinatorImpl.java      |  5 +-
- .../ChromeAndroidTaskTrackerImpl.java         | 93 ++++++++++++++-----
- .../ChromeAndroidTaskTracker.java             |  6 +-
- 24 files changed, 213 insertions(+), 56 deletions(-)
+ .../extensions/ExtensionsMenuCoordinator.java |  4 +-
+ .../extensions/ExtensionsMenuMediator.java    | 14 +--
+ .../ChromeAndroidTaskTrackerImpl.java         | 97 ++++++++++++++-----
+ .../ChromeAndroidTaskTracker.java             |  7 +-
+ 26 files changed, 234 insertions(+), 70 deletions(-)
 
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java b/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java
@@ -161,6 +163,24 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/app/ChromeActiv
      }
  
      @Override
+@@ -2032,7 +2048,7 @@ public abstract class ChromeActivity extends AsyncInitializationActivity
+ 
+         getProfileProviderSupplier().runSyncOrOnAvailable(this::initializeManualFillingComponent);
+ 
+-        var chromeAndroidTask = getChromeAndroidTaskSupplier().get();
++        var chromeAndroidTask = mChromeAndroidTaskSupplierInternal.get();
+         if (chromeAndroidTask != null) {
+             chromeAndroidTask.onNativeInitializationFinished();
+         }
+@@ -2076,7 +2092,7 @@ public abstract class ChromeActivity extends AsyncInitializationActivity
+                     && DeviceFormFactor.isNonMultiDisplayContextOnTablet(this)) {
+                 HostZoomMap.setTransparentZoomAdjustment(
+                         ContentFeatureList.sAndroidMonitorZoomScalingFactor.getValue() / 100.0f);
+-            } else if (DeviceInfo.isDesktop()) {
++            } else if (DeviceInfo.isDesktopFalse()) {
+                 HostZoomMap.setTransparentZoomAdjustment(
+                         ContentFeatureList.sAndroidDesktopZoomScalingFactor.getValue() / 100.0f);
+             }
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/customtabs/BaseCustomTabActivity.java b/chrome/android/java/src/org/chromium/chrome/browser/customtabs/BaseCustomTabActivity.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/customtabs/BaseCustomTabActivity.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/customtabs/BaseCustomTabActivity.java
@@ -561,6 +581,24 @@ diff --git a/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/brow
          ExtensionActionPopupContents contents =
                  ExtensionActionPopupContents.create(task, actionId, tabId);
          assert mCurrentPopup == null;
+@@ -129,13 +131,13 @@ class ExtensionActionListMediator implements Destroyable {
+     }
+ 
+     private void onContextClick(ListMenuButton buttonView, String actionId) {
+-        ChromeAndroidTask task = mTaskSupplier.get();
+-        if (task == null) {
++        Tab currentTab = mExtensionActionsUpdateHelper.getCurrentTab();
++        if (currentTab == null) {
+             return;
+         }
+ 
+-        Tab currentTab = mExtensionActionsUpdateHelper.getCurrentTab();
+-        if (currentTab == null) {
++        ChromeAndroidTask task = mTaskSupplier.apply(currentTab);
++        if (task == null) {
+             return;
+         }
+ 
 diff --git a/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/extensions/ExtensionToolbarCoordinator.java b/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/extensions/ExtensionToolbarCoordinator.java
 --- a/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/extensions/ExtensionToolbarCoordinator.java
 +++ b/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/extensions/ExtensionToolbarCoordinator.java
@@ -626,10 +664,87 @@ diff --git a/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/brow
              ObservableSupplier<@Nullable Profile> profileSupplier,
              ObservableSupplier<@Nullable Tab> currentTabSupplier,
              TabCreator tabCreator,
+diff --git a/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/extensions/ExtensionsMenuCoordinator.java b/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/extensions/ExtensionsMenuCoordinator.java
+--- a/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/extensions/ExtensionsMenuCoordinator.java
++++ b/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/extensions/ExtensionsMenuCoordinator.java
+@@ -44,6 +44,8 @@ import org.chromium.ui.modelutil.PropertyModelChangeProcessor;
+ import org.chromium.ui.modelutil.SimpleRecyclerViewAdapter;
+ import org.chromium.ui.widget.RectProvider;
+ 
++import java.util.function.Function;
++
+ /**
+  * Coordinator for the extensions menu, accessed from the puzzle icon in the toolbar. This class is
+  * responsible for the button and the menu.
+@@ -84,7 +86,7 @@ public class ExtensionsMenuCoordinator implements Destroyable {
+             ListMenuButton extensionsMenuButton,
+             MaterialDivider extensionsMenuTabSwitcherDivider,
+             ThemeColorProvider themeColorProvider,
+-            OneshotSupplier<ChromeAndroidTask> taskSupplier,
++            Function<Tab, ChromeAndroidTask> taskSupplier,
+             ObservableSupplier<@Nullable Profile> profileSupplier,
+             ObservableSupplier<@Nullable Tab> currentTabSupplier,
+             TabCreator tabCreator,
+diff --git a/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/extensions/ExtensionsMenuMediator.java b/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/extensions/ExtensionsMenuMediator.java
+--- a/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/extensions/ExtensionsMenuMediator.java
++++ b/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/extensions/ExtensionsMenuMediator.java
+@@ -30,6 +30,8 @@ import org.chromium.ui.modelutil.MVCListAdapter.ModelList;
+ import org.chromium.ui.modelutil.PropertyModel;
+ import org.chromium.ui.widget.RectProvider;
+ 
++import java.util.function.Function;
++
+ /**
+  * Mediator for the extensions menu. This class is responsible for listening to changes in the
+  * extensions and updating the model accordingly.
+@@ -38,7 +40,7 @@ import org.chromium.ui.widget.RectProvider;
+ class ExtensionsMenuMediator implements Destroyable {
+     private final ActionsUpdateDelegate mActionsUpdateDelegate = new ActionsUpdateDelegate();
+     private final Context mContext;
+-    private final OneshotSupplier<ChromeAndroidTask> mTaskSupplier;
++    private final Function<Tab, ChromeAndroidTask> mTaskSupplier;
+     private final ObservableSupplier<@Nullable Profile> mProfileSupplier;
+     private final Runnable mOnUpdateFinishedRunnable;
+     private final Callback<Boolean> mOnExtensionsAvailableCallback;
+@@ -49,7 +51,7 @@ class ExtensionsMenuMediator implements Destroyable {
+ 
+     public ExtensionsMenuMediator(
+             Context context,
+-            OneshotSupplier<ChromeAndroidTask> taskSupplier,
++            Function<Tab, ChromeAndroidTask> taskSupplier,
+             ObservableSupplier<@Nullable Profile> profileSupplier,
+             ObservableSupplier<@Nullable Tab> currentTabSupplier,
+             ModelList extensionModels,
+@@ -112,13 +114,13 @@ class ExtensionsMenuMediator implements Destroyable {
+     }
+ 
+     private void onPrimaryClick(ListMenuButton buttonView, String actionId) {
+-        ChromeAndroidTask task = mTaskSupplier.get();
+-        if (task == null) {
++        Tab currentTab = mExtensionActionsUpdateHelper.getCurrentTab();
++        if (currentTab == null) {
+             return;
+         }
+ 
+-        Tab currentTab = mExtensionActionsUpdateHelper.getCurrentTab();
+-        if (currentTab == null) {
++        ChromeAndroidTask task = mTaskSupplier.apply(currentTab);
++        if (task == null) {
+             return;
+         }
+ 
 diff --git a/chrome/browser/ui/browser_window/internal/android/java/src/org/chromium/chrome/browser/ui/browser_window/ChromeAndroidTaskTrackerImpl.java b/chrome/browser/ui/browser_window/internal/android/java/src/org/chromium/chrome/browser/ui/browser_window/ChromeAndroidTaskTrackerImpl.java
 --- a/chrome/browser/ui/browser_window/internal/android/java/src/org/chromium/chrome/browser/ui/browser_window/ChromeAndroidTaskTrackerImpl.java
 +++ b/chrome/browser/ui/browser_window/internal/android/java/src/org/chromium/chrome/browser/ui/browser_window/ChromeAndroidTaskTrackerImpl.java
-@@ -32,6 +32,30 @@ import java.util.Map;
+@@ -19,6 +19,7 @@ import org.chromium.base.ResettersForTesting;
+ import org.chromium.build.annotations.NullMarked;
+ import org.chromium.build.annotations.Nullable;
+ import org.chromium.chrome.browser.multiwindow.MultiInstanceManager;
++import org.chromium.chrome.browser.tabmodel.TabModel;
+ import org.chromium.chrome.browser.ui.browser_window.ChromeAndroidTask.PendingTaskInfo;
+ import org.chromium.ui.base.ActivityWindowAndroid;
+ 
+@@ -32,6 +33,30 @@ import java.util.Map;
  @NullMarked
  final class ChromeAndroidTaskTrackerImpl implements ChromeAndroidTaskTracker {
  
@@ -660,7 +775,7 @@ diff --git a/chrome/browser/ui/browser_window/internal/android/java/src/org/chro
      private static @Nullable ChromeAndroidTaskTrackerImpl sInstance;
  
      private static boolean sPausePendingTaskActivityCreationForTesting;
-@@ -50,7 +74,7 @@ final class ChromeAndroidTaskTrackerImpl implements ChromeAndroidTaskTracker {
+@@ -50,7 +75,7 @@ final class ChromeAndroidTaskTrackerImpl implements ChromeAndroidTaskTracker {
       * ChromeAndroidTask}'s ID when it is alive, and is different from its ID in the pending state.
       */
      @GuardedBy("mTasksLock")
@@ -669,17 +784,17 @@ diff --git a/chrome/browser/ui/browser_window/internal/android/java/src/org/chro
  
      /**
       * Maps pending {@link ChromeAndroidTask} IDs to their instances. This reflects the {@link
-@@ -82,7 +106,8 @@ final class ChromeAndroidTaskTrackerImpl implements ChromeAndroidTaskTracker {
+@@ -82,7 +107,8 @@ final class ChromeAndroidTaskTrackerImpl implements ChromeAndroidTaskTracker {
          int taskId = getTaskId(activityScopedObjects.mActivityWindowAndroid);
  
          synchronized (mTasksLock) {
 -            var existingTask = mTasks.get(taskId);
-+            var key = new Key(taskId, tabModel);
++            var key = new Key(taskId, activityScopedObjects.mTabModel);
 +            var existingTask = mTasksCromite.get(key);
              if (existingTask != null) {
                  assert existingTask.getBrowserWindowType() == browserWindowType
                          : "The browser window type of an existing task can't be changed.";
-@@ -94,12 +119,12 @@ final class ChromeAndroidTaskTrackerImpl implements ChromeAndroidTaskTracker {
+@@ -94,12 +120,12 @@ final class ChromeAndroidTaskTrackerImpl implements ChromeAndroidTaskTracker {
                  ChromeAndroidTask pendingTask = mPendingTasks.remove(pendingId);
                  assert pendingTask != null : "Invalid pendingId provided.";
                  pendingTask.setActivityScopedObjects(activityScopedObjects);
@@ -694,7 +809,7 @@ diff --git a/chrome/browser/ui/browser_window/internal/android/java/src/org/chro
              mObservers.forEach((observer) -> observer.onTaskAdded(newTask));
              return newTask;
          }
-@@ -139,29 +164,30 @@ final class ChromeAndroidTaskTrackerImpl implements ChromeAndroidTaskTracker {
+@@ -139,29 +165,30 @@ final class ChromeAndroidTaskTrackerImpl implements ChromeAndroidTaskTracker {
  
      @Override
      @Nullable
@@ -738,7 +853,7 @@ diff --git a/chrome/browser/ui/browser_window/internal/android/java/src/org/chro
              // If the ActivityWindowAndroid that's passed in isn't the ActivityWindowAndroid held by
              // this ChromeAndroidTask, don't do anything.
              //
-@@ -180,6 +206,17 @@ final class ChromeAndroidTaskTrackerImpl implements ChromeAndroidTaskTracker {
+@@ -180,6 +207,17 @@ final class ChromeAndroidTaskTrackerImpl implements ChromeAndroidTaskTracker {
              // the right time to clear and destroy the ActivityWindowAndroid held by the
              // ChromeAndroidTask.
              if (task.getActivityWindowAndroid() != activityWindowAndroid) {
@@ -756,7 +871,7 @@ diff --git a/chrome/browser/ui/browser_window/internal/android/java/src/org/chro
                  return;
              }
  
-@@ -195,7 +232,7 @@ final class ChromeAndroidTaskTrackerImpl implements ChromeAndroidTaskTracker {
+@@ -195,7 +233,7 @@ final class ChromeAndroidTaskTrackerImpl implements ChromeAndroidTaskTracker {
              //
              // In the future, we can register a Task listener when a ChromeAndroidTask is created,
              // then destroy it when notified of the Task removal.
@@ -765,7 +880,7 @@ diff --git a/chrome/browser/ui/browser_window/internal/android/java/src/org/chro
          }
      }
  
-@@ -259,8 +296,8 @@ final class ChromeAndroidTaskTrackerImpl implements ChromeAndroidTaskTracker {
+@@ -259,8 +297,8 @@ final class ChromeAndroidTaskTrackerImpl implements ChromeAndroidTaskTracker {
       */
      void removeAllForTesting() {
          synchronized (mTasksLock) {
@@ -776,7 +891,7 @@ diff --git a/chrome/browser/ui/browser_window/internal/android/java/src/org/chro
              mPendingTasks.forEach((taskId, task) -> task.destroy());
              mPendingTasks.clear();
          }
-@@ -299,11 +336,17 @@ final class ChromeAndroidTaskTrackerImpl implements ChromeAndroidTaskTracker {
+@@ -299,11 +337,17 @@ final class ChromeAndroidTaskTrackerImpl implements ChromeAndroidTaskTracker {
      }
  
      @GuardedBy("mTasksLock")
@@ -798,7 +913,17 @@ diff --git a/chrome/browser/ui/browser_window/internal/android/java/src/org/chro
          }
      }
  
-@@ -403,7 +446,7 @@ final class ChromeAndroidTaskTrackerImpl implements ChromeAndroidTaskTracker {
+@@ -339,7 +383,8 @@ final class ChromeAndroidTaskTrackerImpl implements ChromeAndroidTaskTracker {
+             AndroidBrowserWindowCreateParams createParams) {
+         switch (createParams.getWindowType()) {
+             case BrowserWindowType.NORMAL:
+-                for (ChromeAndroidTask task : mTasks.values()) {
++                List<ChromeAndroidTask> tasks = new ArrayList<>(mTasksCromite.values());
++                for (ChromeAndroidTask task : tasks) {
+                     boolean isIncognito = createParams.getProfile().isIncognitoBranded();
+                     var intent = task.createIntentForNormalBrowserWindow(isIncognito);
+                     if (intent != null) {
+@@ -403,7 +448,7 @@ final class ChromeAndroidTaskTrackerImpl implements ChromeAndroidTaskTracker {
      /** Returns all PENDING and ALIVE Tasks. */
      @GuardedBy("mTasksLock")
      private List<ChromeAndroidTask> getAllTasksLocked() {
@@ -810,7 +935,15 @@ diff --git a/chrome/browser/ui/browser_window/internal/android/java/src/org/chro
 diff --git a/chrome/browser/ui/browser_window/public/android/java/src/org/chromium/chrome/browser/ui/browser_window/ChromeAndroidTaskTracker.java b/chrome/browser/ui/browser_window/public/android/java/src/org/chromium/chrome/browser/ui/browser_window/ChromeAndroidTaskTracker.java
 --- a/chrome/browser/ui/browser_window/public/android/java/src/org/chromium/chrome/browser/ui/browser_window/ChromeAndroidTaskTracker.java
 +++ b/chrome/browser/ui/browser_window/public/android/java/src/org/chromium/chrome/browser/ui/browser_window/ChromeAndroidTaskTracker.java
-@@ -83,7 +83,7 @@ public interface ChromeAndroidTaskTracker {
+@@ -8,6 +8,7 @@ import org.chromium.base.JniOnceCallback;
+ import org.chromium.build.annotations.NullMarked;
+ import org.chromium.build.annotations.Nullable;
+ import org.chromium.chrome.browser.ui.browser_window.ChromeAndroidTask.ActivityScopedObjects;
++import org.chromium.chrome.browser.tabmodel.TabModel;
+ import org.chromium.ui.base.ActivityWindowAndroid;
+ 
+ /**
+@@ -83,7 +84,7 @@ public interface ChromeAndroidTaskTracker {
       *
       * @param taskId Same as defined by {@link android.app.TaskInfo#taskId}.
       */
@@ -819,7 +952,7 @@ diff --git a/chrome/browser/ui/browser_window/public/android/java/src/org/chromi
  
      /**
       * Removes from the internal collection the {@link ChromeAndroidTask} with the given {@code
-@@ -91,7 +91,7 @@ public interface ChromeAndroidTaskTracker {
+@@ -91,7 +92,7 @@ public interface ChromeAndroidTaskTracker {
       *
       * @param taskId Same as defined by {@link android.app.TaskInfo#taskId}.
       */
@@ -828,7 +961,7 @@ diff --git a/chrome/browser/ui/browser_window/public/android/java/src/org/chromi
  
      /**
       * Called when an {@link ActivityWindowAndroid} is destroyed.
-@@ -100,6 +100,8 @@ public interface ChromeAndroidTaskTracker {
+@@ -100,6 +101,8 @@ public interface ChromeAndroidTaskTracker {
       */
      void onActivityWindowAndroidDestroy(ActivityWindowAndroid activityWindowAndroid);
  
diff --git a/build/patches/Enable-native-Android-autofill.patch b/build/patches/Enable-native-Android-autofill.patch
index 0da68e7a..be730093 100644
--- a/build/patches/Enable-native-Android-autofill.patch
+++ b/build/patches/Enable-native-Android-autofill.patch
@@ -15,15 +15,16 @@ See also: https://github.com/bromite/bromite/issues/547
 Original License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 ---
- .../settings/PasswordSettings.java            | 84 ++++++++++++++++++-
+ .../settings/PasswordSettings.java            | 84 +++++++++++++++++-
  .../chrome/browser/settings/MainSettings.java | 17 +---
- .../chromium/chrome/browser/tab/TabImpl.java  | 42 ++++++++--
+ .../chromium/chrome/browser/tab/TabImpl.java  | 42 +++++++--
  chrome/browser/android/tab_android.cc         |  4 +-
  chrome/browser/autofill/android/BUILD.gn      |  2 +-
  .../autofill/AutofillClientProviderUtils.java |  2 +-
  ...AutofillThirdPartyModeContentProvider.java |  1 +
+ .../glic/actor_form_filling_service_impl.cc   | 16 ++--
  .../strings/android_chrome_strings.grd        |  6 ++
- .../ui/autofill/autofill_client_provider.cc   | 83 +-----------------
+ .../ui/autofill/autofill_client_provider.cc   | 87 +------------------
  .../ui/autofill/autofill_client_provider.h    |  6 --
  chrome/browser/ui/tab_helpers.cc              |  4 +-
  components/android_autofill/browser/BUILD.gn  |  1 +
@@ -44,7 +45,7 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
  .../foundations/browser_autofill_manager.h    |  2 +
  .../autofill/core/common/autofill_prefs.cc    |  4 +-
  .../autofill/core/common/autofill_prefs.h     |  5 ++
- 29 files changed, 238 insertions(+), 121 deletions(-)
+ 30 files changed, 246 insertions(+), 133 deletions(-)
  create mode 100644 components/android_autofill/browser/java/src/org/chromium/components/autofill/BrowserSelectionActionMenuDelegate.java
 
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/password_manager/settings/PasswordSettings.java b/chrome/android/java/src/org/chromium/chrome/browser/password_manager/settings/PasswordSettings.java
@@ -352,6 +353,32 @@ diff --git a/chrome/browser/autofill/android/java/src/org/chromium/chrome/browse
          if (createContentUri().equals(uri)) {
              final String[] columns = {AUTOFILL_THIRD_PARTY_MODE_COLUMN};
              MatrixCursor cursor = new MatrixCursor(columns, 1);
+diff --git a/chrome/browser/autofill/glic/actor_form_filling_service_impl.cc b/chrome/browser/autofill/glic/actor_form_filling_service_impl.cc
+--- a/chrome/browser/autofill/glic/actor_form_filling_service_impl.cc
++++ b/chrome/browser/autofill/glic/actor_form_filling_service_impl.cc
+@@ -369,14 +369,14 @@ GetAutofillManager(const tabs::TabInterface& tab) {
+   if (!profile) {
+     return base::unexpected(kAutofillNotAvailable);
+   }
+-  if (AutofillClientProviderFactory::GetForProfile(profile)
+-          .uses_platform_autofill()) {
+-    // This is currently only possible on Android platforms, but this check
+-    // guards against this becoming applicable for Desktop platforms as well.
+-    // It is a requirement for the cast to `BrowserAutofillManager` to be
+-    // safe.
+-    return base::unexpected(kAutofillNotAvailable);
+-  }
++  // if (AutofillClientProviderFactory::GetForProfile(profile)
++  //         .uses_platform_autofill()) {
++  //   // This is currently only possible on Android platforms, but this check
++  //   // guards against this becoming applicable for Desktop platforms as well.
++  //   // It is a requirement for the cast to `BrowserAutofillManager` to be
++  //   // safe.
++  //   return base::unexpected(kAutofillNotAvailable);
++  // }
+ 
+   ContentAutofillClient* const client =
+       ContentAutofillClient::FromWebContents(tab.GetContents());
 diff --git a/chrome/browser/ui/android/strings/android_chrome_strings.grd b/chrome/browser/ui/android/strings/android_chrome_strings.grd
 --- a/chrome/browser/ui/android/strings/android_chrome_strings.grd
 +++ b/chrome/browser/ui/android/strings/android_chrome_strings.grd
@@ -382,9 +409,8 @@ diff --git a/chrome/browser/ui/autofill/autofill_client_provider.cc b/chrome/bro
  
  namespace autofill {
 -namespace {
- 
-+AutofillClientProvider::AutofillClientProvider(PrefService* prefs) {
- #if BUILDFLAG(IS_ANDROID)
+-
+-#if BUILDFLAG(IS_ANDROID)
 -void RecordAvailabilityStatus(AndroidAutofillAvailabilityStatus availability) {
 -  base::UmaHistogramEnumeration("Autofill.AndroidAutofillAvailabilityStatus",
 -                                availability);
@@ -423,7 +449,7 @@ diff --git a/chrome/browser/ui/autofill/autofill_client_provider.cc b/chrome/bro
 -        base::android::AttachCurrentThread());
 -  }
 -}
--
+ 
 -AndroidAutofillAvailabilityStatus GetAndroidAutofillAvailabilityStatus(
 -    PrefService& prefs) {
 -  return static_cast<AndroidAutofillAvailabilityStatus>(
@@ -433,7 +459,8 @@ diff --git a/chrome/browser/ui/autofill/autofill_client_provider.cc b/chrome/bro
 -#endif  // BUILDFLAG(IS_ANDROID)
 -
 -bool UsesVirtualViewStructureForAutofill(PrefService& prefs) {
--#if BUILDFLAG(IS_ANDROID)
++AutofillClientProvider::AutofillClientProvider(PrefService* prefs) {
+ #if BUILDFLAG(IS_ANDROID)
 -  const AndroidAutofillAvailabilityStatus availability =
 -      GetAndroidAutofillAvailabilityStatus(prefs);
 -  RecordAvailabilityStatus(availability);
@@ -459,7 +486,7 @@ diff --git a/chrome/browser/ui/autofill/autofill_client_provider.cc b/chrome/bro
  #endif  // BUILDFLAG(IS_ANDROID)
  }
  
-@@ -103,15 +32,7 @@ AutofillClientProvider::~AutofillClientProvider() = default;
+@@ -103,19 +32,7 @@ AutofillClientProvider::~AutofillClientProvider() = default;
  
  void AutofillClientProvider::CreateClientForWebContents(
      content::WebContents* web_contents) {
@@ -475,6 +502,10 @@ diff --git a/chrome/browser/ui/autofill/autofill_client_provider.cc b/chrome/bro
  }
  
  }  // namespace autofill
+-
+-#if BUILDFLAG(IS_ANDROID)
+-DEFINE_JNI(AutofillClientProviderUtils)
+-#endif
 diff --git a/chrome/browser/ui/autofill/autofill_client_provider.h b/chrome/browser/ui/autofill/autofill_client_provider.h
 --- a/chrome/browser/ui/autofill/autofill_client_provider.h
 +++ b/chrome/browser/ui/autofill/autofill_client_provider.h
diff --git a/build/patches/Enable-network-isolation-features.patch b/build/patches/Enable-network-isolation-features.patch
index eaf3e68f..994547a6 100644
--- a/build/patches/Enable-network-isolation-features.patch
+++ b/build/patches/Enable-network-isolation-features.patch
@@ -9,12 +9,12 @@ PartitionNelAndReportingByNetworkIsolationKey, kSplitCacheByNavigationInitiator
 
 License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 ---
- .../browser/net/profile_network_context_service.cc |  4 ++--
- .../Enable-network-isolation-features.inc          |  9 +++++++++
- .../Enable-network-isolation-features.inc          |  1 +
- net/http/http_cache.cc                             | 14 +++++++++-----
- net/http/http_cache.h                              |  2 +-
- 5 files changed, 22 insertions(+), 8 deletions(-)
+ .../net/profile_network_context_service.cc        |  4 ++--
+ .../Enable-network-isolation-features.inc         |  7 +++++++
+ .../Enable-network-isolation-features.inc         |  1 +
+ net/http/http_cache.cc                            | 15 ++++++++++-----
+ net/http/http_cache.h                             |  2 +-
+ 5 files changed, 21 insertions(+), 8 deletions(-)
  create mode 100644 cromite_flags/net/base/features_cc/Enable-network-isolation-features.inc
  create mode 100644 cromite_flags/services/network/public/cpp/features_cc/Enable-network-isolation-features.inc
 
@@ -36,7 +36,7 @@ diff --git a/cromite_flags/net/base/features_cc/Enable-network-isolation-feature
 new file mode 100644
 --- /dev/null
 +++ b/cromite_flags/net/base/features_cc/Enable-network-isolation-features.inc
-@@ -0,0 +1,9 @@
+@@ -0,0 +1,7 @@
 +SET_CROMITE_FEATURE_ENABLED(kSplitCodeCacheByNetworkIsolationKey);
 +SET_CROMITE_FEATURE_ENABLED(kPartitionConnectionsByNetworkIsolationKey);
 +
@@ -44,8 +44,6 @@ new file mode 100644
 +
 +// enable http cache partition
 +SET_CROMITE_FEATURE_ENABLED(kSplitCacheByNetworkIsolationKey);
-+// but disable cache for cross-site main frame navigation
-+SET_CROMITE_FEATURE_ENABLED(kSplitCacheByCrossSiteMainFrameNavigationBoolean);
 diff --git a/cromite_flags/services/network/public/cpp/features_cc/Enable-network-isolation-features.inc b/cromite_flags/services/network/public/cpp/features_cc/Enable-network-isolation-features.inc
 new file mode 100644
 --- /dev/null
@@ -64,18 +62,19 @@ diff --git a/net/http/http_cache.cc b/net/http/http_cache.cc
      const GURL& url,
      int load_flags,
      const NetworkIsolationKey& network_isolation_key,
-@@ -757,8 +757,8 @@ std::string HttpCache::GenerateCacheKey(
+@@ -757,8 +757,9 @@ std::string HttpCache::GenerateCacheKey(
        const bool is_initiator_cross_site =
            !net::SchemefulSite::IsSameSite(*initiator, url::Origin::Create(url));
        if (is_initiator_cross_site) {
 -        is_cross_site_main_frame_navigation_prefix =
 -            kCrossSiteMainFrameNavigationPrefix;
++        // disable cache for cross-site main frame navigation
 +        // LOG(INFO) << "---initiator_site cs=" << base::StrCat({"ni_", initiator->Serialize(), " "});
 +        return "";
        }
      }
      isolation_key = base::StrCat(
-@@ -777,10 +777,12 @@ std::string HttpCache::GenerateCacheKey(
+@@ -777,10 +778,12 @@ std::string HttpCache::GenerateCacheKey(
    // Strip out the reference, username, and password sections of the URL and
    // concatenate with the credential_key, the post_key, and the network
    // isolation key if we are splitting the cache.
@@ -89,7 +88,7 @@ diff --git a/net/http/http_cache.cc b/net/http/http_cache.cc
  }
  
  // static
-@@ -800,11 +802,13 @@ std::optional<std::string> HttpCache::GenerateCacheKeyInternal(
+@@ -800,11 +803,13 @@ std::optional<std::string> HttpCache::GenerateCacheKeyInternal(
    const int64_t upload_data_identifier =
        request.upload_data_stream ? request.upload_data_stream->identifier()
                                   : int64_t{0};
diff --git a/build/patches/Enable-search-engine-settings-desktop-ui.patch b/build/patches/Enable-search-engine-settings-desktop-ui.patch
index 1805d209..79383277 100644
--- a/build/patches/Enable-search-engine-settings-desktop-ui.patch
+++ b/build/patches/Enable-search-engine-settings-desktop-ui.patch
@@ -17,6 +17,7 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
  chrome/browser/resources/BUILD.gn             |   7 +
  chrome/browser/resources/settings/BUILD.gn    |   2 +-
  .../resources/settings/page_visibility.ts     |  36 ++-
+ .../settings/people_page/sync_controls.ts     |   6 +-
  .../search_engine_edit_dialog.html            |   6 +
  .../search_page/search_engine_edit_dialog.ts  |   7 +-
  .../search_engines_browser_proxy.ts           |   8 +-
@@ -60,7 +61,7 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
  content/browser/webui/web_ui_impl.cc          |  16 +-
  content/browser/webui/web_ui_impl.h           |   3 +
  content/public/browser/web_ui.h               |   1 +
- third_party/polymer/v3_0/BUILD.gn             |  12 +-
+ third_party/polymer/v3_0/BUILD.gn             |  18 +-
  ui/base/template_expressions.cc               |  21 +-
  ui/webui/BUILD.gn                             |   7 +
  ui/webui/resources/BUILD.gn                   |  28 ++
@@ -79,7 +80,7 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
  ui/webui/resources/images/BUILD.gn            |   2 +-
  ui/webui/resources/js/BUILD.gn                |   2 +-
  ui/webui/resources/js/load_time_data.ts       |  17 +-
- 72 files changed, 1148 insertions(+), 73 deletions(-)
+ 73 files changed, 1159 insertions(+), 74 deletions(-)
  create mode 100644 chrome/app/settings_strings_android.grdp
  create mode 100644 chrome/browser/search_engines/android/java/res/layout/search_engine_layout.xml
  create mode 100644 chrome/browser/ui/webui/settings/settings_localized_strings_provider_android.cc
@@ -531,6 +532,39 @@ diff --git a/chrome/browser/resources/settings/page_visibility.ts b/chrome/brows
      return undefined;
    }
  
+diff --git a/chrome/browser/resources/settings/people_page/sync_controls.ts b/chrome/browser/resources/settings/people_page/sync_controls.ts
+--- a/chrome/browser/resources/settings/people_page/sync_controls.ts
++++ b/chrome/browser/resources/settings/people_page/sync_controls.ts
+@@ -31,8 +31,10 @@ import {RouteObserverMixin} from '../router.js';
+ 
+ import {PluralStringProxyImpl} from 'chrome://resources/js/plural_string_proxy.js';
+ import {sanitizeInnerHtml} from 'chrome://resources/js/parse_html_subset.js';
++// <if expr="not is_android">
+ import {BatchUploadPromoProxy} from 'chrome://resources/js/batch_upload_promo/batch_upload_promo_proxy.js';
+ // </if>
++// </if>
+ 
+ // clang-format on
+ 
+@@ -166,7 +168,7 @@ export class SettingsSyncControlsElement extends
+     this.addWebUiListener(
+         'sync-prefs-changed', this.handleSyncPrefsChanged_.bind(this));
+ 
+-    // <if expr="not is_chromeos">
++    // <if expr="not is_chromeos and not is_android">
+     if (loadTimeData.getBoolean('unoPhase2FollowUp')) {
+       BatchUploadPromoProxy.getInstance()
+           .callbackRouter.onLocalDataCountChanged.addListener(
+@@ -261,7 +263,9 @@ export class SettingsSyncControlsElement extends
+ 
+     // Prevent navigation to href='#' and open the batch upload dialog instead.
+     event.preventDefault();
++// <if expr="not is_android">
+     BatchUploadPromoProxy.getInstance().handler.onBatchUploadPromoClicked();
++// </if>
+   }
+   // </if>
+ 
 diff --git a/chrome/browser/resources/settings/search_page/search_engine_edit_dialog.html b/chrome/browser/resources/settings/search_page/search_engine_edit_dialog.html
 --- a/chrome/browser/resources/settings/search_page/search_engine_edit_dialog.html
 +++ b/chrome/browser/resources/settings/search_page/search_engine_edit_dialog.html
@@ -2069,6 +2103,19 @@ diff --git a/third_party/polymer/v3_0/BUILD.gn b/third_party/polymer/v3_0/BUILD.
  if (is_chromeos_ash) {
    js_files += [
      "iron-a11y-announcer/iron-a11y-announcer.js",
+@@ -237,6 +247,12 @@ ts_library("library") {
+         [ "components-chromium/iron-fit-behavior/iron-fit-behavior.d.ts" ]
+   }
+ 
++  if (is_android) {
++    definitions += [
++        "components-chromium/iron-collapse/iron-collapse.d.ts",
++    ]
++  }
++
+   if (is_chromeos_ash) {
+     definitions += [
+       "components-chromium/iron-a11y-announcer/iron-a11y-announcer.d.ts",
 diff --git a/ui/base/template_expressions.cc b/ui/base/template_expressions.cc
 --- a/ui/base/template_expressions.cc
 +++ b/ui/base/template_expressions.cc
diff --git a/build/patches/Enable-snackbar-swipe.patch b/build/patches/Enable-snackbar-swipe.patch
index e0b50078..93f23b85 100644
--- a/build/patches/Enable-snackbar-swipe.patch
+++ b/build/patches/Enable-snackbar-swipe.patch
@@ -6,13 +6,13 @@ Allows swipe of snackbar notifications
 
 License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 ---
- .../ui/messages/snackbar/SnackbarView.java    | 84 +++++++++++++++++--
- 1 file changed, 76 insertions(+), 8 deletions(-)
+ .../ui/messages/snackbar/SnackbarView.java    | 85 +++++++++++++++++--
+ 1 file changed, 77 insertions(+), 8 deletions(-)
 
 diff --git a/chrome/browser/ui/messages/android/java/src/org/chromium/chrome/browser/ui/messages/snackbar/SnackbarView.java b/chrome/browser/ui/messages/android/java/src/org/chromium/chrome/browser/ui/messages/snackbar/SnackbarView.java
 --- a/chrome/browser/ui/messages/android/java/src/org/chromium/chrome/browser/ui/messages/snackbar/SnackbarView.java
 +++ b/chrome/browser/ui/messages/android/java/src/org/chromium/chrome/browser/ui/messages/snackbar/SnackbarView.java
-@@ -10,9 +10,11 @@ import android.animation.Animator;
+@@ -10,13 +10,16 @@ import android.animation.Animator;
  import android.animation.AnimatorListenerAdapter;
  import android.animation.ObjectAnimator;
  import android.app.Activity;
@@ -24,7 +24,12 @@ diff --git a/chrome/browser/ui/messages/android/java/src/org/chromium/chrome/bro
  import android.view.Gravity;
  import android.view.LayoutInflater;
  import android.view.SurfaceView;
-@@ -33,6 +35,9 @@ import org.chromium.chrome.browser.ui.edge_to_edge.EdgeToEdgeController;
+ import android.view.View;
++import android.view.View.OnClickListener;
+ import android.view.View.OnLayoutChangeListener;
+ import android.view.ViewGroup;
+ import android.widget.FrameLayout;
+@@ -33,6 +36,9 @@ import org.chromium.chrome.browser.ui.edge_to_edge.EdgeToEdgeController;
  import org.chromium.chrome.browser.ui.edge_to_edge.EdgeToEdgeControllerFactory;
  import org.chromium.chrome.ui.messages.R;
  import org.chromium.components.browser_ui.styles.SemanticColorUtils;
@@ -34,7 +39,7 @@ diff --git a/chrome/browser/ui/messages/android/java/src/org/chromium/chrome/bro
  import org.chromium.components.browser_ui.widget.text.TemplatePreservingTextView;
  import org.chromium.ui.base.WindowAndroid;
  import org.chromium.ui.edge_to_edge.EdgeToEdgePadAdjuster;
-@@ -46,7 +51,7 @@ import org.chromium.ui.interpolators.Interpolators;
+@@ -46,7 +52,7 @@ import org.chromium.ui.interpolators.Interpolators;
  // TODO (jianli): Change this class and its methods back to package protected after the offline
  // indicator experiment is done.
  @NullMarked
@@ -43,7 +48,7 @@ diff --git a/chrome/browser/ui/messages/android/java/src/org/chromium/chrome/bro
      private static final int MAX_LINES = 5;
      private static final int DEFAULT_LINES = 2;
  
-@@ -88,6 +93,16 @@ public class SnackbarView implements InsetObserver.WindowInsetObserver {
+@@ -88,6 +94,16 @@ public class SnackbarView implements InsetObserver.WindowInsetObserver {
                  }
              };
  
@@ -60,7 +65,7 @@ diff --git a/chrome/browser/ui/messages/android/java/src/org/chromium/chrome/bro
      /**
       * Creates an instance of the {@link SnackbarView}.
       *
-@@ -147,13 +162,12 @@ public class SnackbarView implements InsetObserver.WindowInsetObserver {
+@@ -147,13 +163,12 @@ public class SnackbarView implements InsetObserver.WindowInsetObserver {
  
          // Make sure clicks are not consumed by content beneath the container view.
          mContainerView.setClickable(true);
@@ -80,7 +85,7 @@ diff --git a/chrome/browser/ui/messages/android/java/src/org/chromium/chrome/bro
          mSnackbarView = mContainerView.findViewById(R.id.snackbar);
          mAnimationDuration =
                  mContainerView.getResources().getInteger(android.R.integer.config_mediumAnimTime);
-@@ -508,4 +522,58 @@ public class SnackbarView implements InsetObserver.WindowInsetObserver {
+@@ -508,4 +523,58 @@ public class SnackbarView implements InsetObserver.WindowInsetObserver {
      public @Nullable EdgeToEdgePadAdjuster getEdgeToEdgePadAdjusterForTesting() {
          return mEdgeToEdgePadAdjuster;
      }
diff --git a/build/patches/Experimental-support-for-extensions-on-Android.patch b/build/patches/Experimental-support-for-extensions-on-Android.patch
index 8ff7fa6d..49bdaede 100644
--- a/build/patches/Experimental-support-for-extensions-on-Android.patch
+++ b/build/patches/Experimental-support-for-extensions-on-Android.patch
@@ -53,6 +53,7 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
  .../browser/chrome_content_browser_client.cc  |  4 +-
  chrome/browser/devtools/BUILD.gn              |  2 +-
  .../chrome_download_manager_delegate.cc       |  2 +-
+ .../download_offline_content_provider.cc      |  4 +-
  chrome/browser/extensions/BUILD.gn            | 12 +++-
  .../chrome_extensions_api_client_android.cc   |  2 +-
  .../extensions/extension_management.cc        |  8 ++-
@@ -81,6 +82,7 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
  chrome/browser/ui/BUILD.gn                    |  6 +-
  .../browser/ui/android/context_menu_helper.cc | 12 +++-
  .../browser/ui/android/context_menu_helper.h  |  4 +-
+ .../desktop_site/DesktopSiteUtils.java        |  4 +-
  chrome/browser/ui/android/extensions/BUILD.gn |  4 +-
  .../extensions/extension_actions_bridge.cc    | 23 ++++++
  .../extensions/extension_actions_bridge.h     |  1 +
@@ -108,7 +110,7 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
  chrome/browser/ui/browser_window/BUILD.gn     |  2 +-
  .../ui/browser_window/internal/BUILD.gn       |  2 +-
  chrome/browser/ui/prefs/BUILD.gn              |  4 +-
- chrome/browser/ui/prefs/prefs_tab_helper.cc   | 10 +--
+ chrome/browser/ui/prefs/prefs_tab_helper.cc   |  8 +--
  chrome/browser/ui/tabs/tab_list_interface.h   |  4 +-
  chrome/browser/ui/webid/BUILD.gn              |  2 +-
  .../browser/ui/webui/chrome_web_ui_configs.cc |  4 +-
@@ -122,7 +124,7 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
  chrome/common/webui_url_constants.h           |  2 +-
  .../sandbox_status_extension_android.cc       |  3 +-
  .../sandbox_status_extension_android.h        |  1 +
- chrome/test/BUILD.gn                          | 14 ++--
+ chrome/test/BUILD.gn                          | 16 ++---
  chrome/version.gni                            |  4 +-
  .../core/browser/host_content_settings_map.cc |  6 ++
  .../embedder_support/view/ContentView.java    |  2 +-
@@ -136,6 +138,7 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
  .../configuration_policy_handler_list.cc      |  2 +-
  .../common/cloud/cloud_policy_constants.cc    |  2 +-
  components/policy/core/common/features.cc     |  2 +-
+ .../policy/core/common/policy_merger.cc       |  4 +-
  .../service/variations_service_client.cc      |  2 +-
  .../installable/installable_icon_fetcher.cc   |  6 +-
  .../installable/installable_icon_fetcher.h    |  2 +-
@@ -171,7 +174,7 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
  tools/grit/grit_args.gni                      |  3 +-
  .../cpp_bundle_generator.py                   |  2 +-
  .../ui/widget/PopupSpecCalculator.java        |  9 ++-
- .../ui/test/util/UiDisableIfSkipCheck.java    |  2 +-
+ .../ui/test/util/UiDisableIfSkipCheck.java    |  8 +--
  .../chromium/ui/test/util/UiRestriction.java  |  2 +-
  ui/base/accelerators/command.cc               |  2 +-
  ui/base/device_form_factor_android.cc         |  2 +-
@@ -181,7 +184,7 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
  ui/webui/resources/cr_elements/BUILD.gn       |  2 +-
  .../cr_elements/cr_toolbar/cr_toolbar.css     |  6 ++
  ui/webui/resources/css/BUILD.gn               |  2 +-
- 169 files changed, 557 insertions(+), 278 deletions(-)
+ 172 files changed, 566 insertions(+), 287 deletions(-)
  create mode 100644 chrome/browser/ui/android/strings/cromite_android_chrome_strings_grd/Enable-extensions-Android.grdp
  create mode 100644 chrome/browser/ui/android/strings/cromite_android_chrome_strings_grd/Extensions-Android.grdp
  create mode 100644 cromite_flags/chrome/browser/about_flags_cc/Extensions-Android.inc
@@ -1048,6 +1051,27 @@ diff --git a/chrome/browser/download/chrome_download_manager_delegate.cc b/chrom
      action = DownloadPathReservationTracker::UNIQUIFY;
    }
  
+diff --git a/chrome/browser/download/download_offline_content_provider.cc b/chrome/browser/download/download_offline_content_provider.cc
+--- a/chrome/browser/download/download_offline_content_provider.cc
++++ b/chrome/browser/download/download_offline_content_provider.cc
+@@ -46,7 +46,7 @@
+ #include "content/public/common/content_features.h"
+ #include "ui/base/device_form_factor.h"
+ 
+-#if BUILDFLAG(ENABLE_DESKTOP_ANDROID_EXTENSIONS)
++#if BUILDFLAG(ENABLE_DESKTOP_ANDROID_EXTENSIONS_CROMITE)
+ #include "chrome/browser/download/download_core_service.h"
+ #include "chrome/browser/download/download_core_service_factory.h"
+ #endif
+@@ -490,7 +490,7 @@ void DownloadOfflineContentProvider::OnDownloadUpdated(DownloadItem* item) {
+     return;
+   }
+ 
+-#if BUILDFLAG(ENABLE_DESKTOP_ANDROID_EXTENSIONS)
++#if BUILDFLAG(ENABLE_DESKTOP_ANDROID_EXTENSIONS_CROMITE)
+   // On desktop Android, the extensions chrome.download.setUiOptions() function
+   // can disable UI updates.
+   // TODO(crbug.com/459823225): Expand the IsDangerous() check to other
 diff --git a/chrome/browser/extensions/BUILD.gn b/chrome/browser/extensions/BUILD.gn
 --- a/chrome/browser/extensions/BUILD.gn
 +++ b/chrome/browser/extensions/BUILD.gn
@@ -1645,6 +1669,27 @@ diff --git a/chrome/browser/ui/android/context_menu_helper.h b/chrome/browser/ui
    std::unique_ptr<extensions::ExtensionMenuModel> extension_menu_model_;
  #endif  // BUILDFLAG(ENABLE_DESKTOP_ANDROID_EXTENSIONS)
  
+diff --git a/chrome/browser/ui/android/desktop_site/java/src/org/chromium/chrome/browser/desktop_site/DesktopSiteUtils.java b/chrome/browser/ui/android/desktop_site/java/src/org/chromium/chrome/browser/desktop_site/DesktopSiteUtils.java
+--- a/chrome/browser/ui/android/desktop_site/java/src/org/chromium/chrome/browser/desktop_site/DesktopSiteUtils.java
++++ b/chrome/browser/ui/android/desktop_site/java/src/org/chromium/chrome/browser/desktop_site/DesktopSiteUtils.java
+@@ -115,7 +115,7 @@ public class DesktopSiteUtils {
+      */
+     static boolean shouldDefaultEnableGlobalSetting(double displaySizeInInches, Context context) {
+         // Desktop Android always requests desktop sites.
+-        if (DeviceInfo.isDesktop()) {
++        if (DeviceInfo.isDesktopFalse()) {
+             return true;
+         }
+ 
+@@ -195,7 +195,7 @@ public class DesktopSiteUtils {
+         boolean isOnExternalDisplay = isOnExternalDisplay(activity);
+         if (isOnExternalDisplay
+                 || smallestScreenWidthDp < DeviceFormFactor.MINIMUM_TABLET_WIDTH_DP
+-                || DeviceInfo.isDesktop()) {
++                || DeviceInfo.isDesktopFalse()) {
+             return;
+         }
+         PrefService prefService = UserPrefs.get(profile);
 diff --git a/chrome/browser/ui/android/extensions/BUILD.gn b/chrome/browser/ui/android/extensions/BUILD.gn
 --- a/chrome/browser/ui/android/extensions/BUILD.gn
 +++ b/chrome/browser/ui/android/extensions/BUILD.gn
@@ -2234,16 +2279,7 @@ diff --git a/chrome/browser/ui/prefs/BUILD.gn b/chrome/browser/ui/prefs/BUILD.gn
 diff --git a/chrome/browser/ui/prefs/prefs_tab_helper.cc b/chrome/browser/ui/prefs/prefs_tab_helper.cc
 --- a/chrome/browser/ui/prefs/prefs_tab_helper.cc
 +++ b/chrome/browser/ui/prefs/prefs_tab_helper.cc
-@@ -65,7 +65,7 @@
- #endif
- 
- #if BUILDFLAG(IS_MAC) || BUILDFLAG(IS_WIN) || BUILDFLAG(IS_LINUX) || \
--    BUILDFLAG(IS_ANDROID) || BUILDFLAG(ENABLE_DESKTOP_ANDROID_EXTENSIONS)
-+    BUILDFLAG(IS_ANDROID) || BUILDFLAG(ENABLE_DESKTOP_ANDROID_EXTENSIONS_CROMITE)
- // If a font name in prefs default values starts with a comma, consider it's a
- // comma-separated font list and resolve it to the first available font.
- #define PREFS_FONT_LIST 1
-@@ -79,7 +79,7 @@ using content::WebContents;
+@@ -78,7 +78,7 @@ using content::WebContents;
  
  namespace {
  
@@ -2252,7 +2288,7 @@ diff --git a/chrome/browser/ui/prefs/prefs_tab_helper.cc b/chrome/browser/ui/pre
  // Registers a preference under the path |pref_name| for each script used for
  // per-script font prefs.
  // For example, for WEBKIT_WEBPREFS_FONTS_SERIF ("fonts.serif"):
-@@ -152,7 +152,7 @@ constexpr auto kFontDefaults = std::to_array<FontDefault>({
+@@ -151,7 +151,7 @@ constexpr auto kFontDefaults = std::to_array<FontDefault>({
      {prefs::kWebKitFantasyFontFamily, IDS_FANTASY_FONT_FAMILY},
      {prefs::kWebKitMathFontFamily, IDS_MATH_FONT_FAMILY},
  #if BUILDFLAG(IS_CHROMEOS) || BUILDFLAG(IS_MAC) || BUILDFLAG(IS_WIN) || \
@@ -2261,7 +2297,7 @@ diff --git a/chrome/browser/ui/prefs/prefs_tab_helper.cc b/chrome/browser/ui/pre
      {prefs::kWebKitStandardFontFamilyJapanese,
       IDS_STANDARD_FONT_FAMILY_JAPANESE},
      {prefs::kWebKitFixedFontFamilyJapanese, IDS_FIXED_FONT_FAMILY_JAPANESE},
-@@ -291,7 +291,7 @@ void OverrideFontFamily(blink::web_pref::WebPreferences* prefs,
+@@ -290,7 +290,7 @@ void OverrideFontFamily(blink::web_pref::WebPreferences* prefs,
    (*map)[script] = base::UTF8ToUTF16(pref_value);
  }
  
@@ -2270,7 +2306,7 @@ diff --git a/chrome/browser/ui/prefs/prefs_tab_helper.cc b/chrome/browser/ui/pre
  void RegisterLocalizedFontPref(user_prefs::PrefRegistrySyncable* registry,
                                 const char* path,
                                 int default_message_id) {
-@@ -452,7 +452,7 @@ void PrefsTabHelper::RegisterProfilePrefs(
+@@ -451,7 +451,7 @@ void PrefsTabHelper::RegisterProfilePrefs(
    }
  
  // Register font prefs.  This is only configurable on desktop Chrome.
@@ -2549,7 +2585,12 @@ diff --git a/chrome/test/BUILD.gn b/chrome/test/BUILD.gn
        sources += [
          # These API tests can't be part of platform_browser_tests because they
          # run in interactive_ui_tests on Win/Mac/Linux.
-@@ -8063,7 +8063,7 @@ test("unit_tests") {
+@@ -8059,11 +8059,11 @@ test("unit_tests") {
+       deps += [ "//chrome/browser/android/extensions:android" ]
+     }
+ 
+-    if (!is_android || is_desktop_android) {
++    if (!is_android || is_desktop_android_cromite) {
        deps += [ "//chrome/browser/ui/browser_window/internal:unit_tests" ]
      }
  
@@ -2743,6 +2784,27 @@ diff --git a/components/policy/core/common/features.cc b/components/policy/core/
  BASE_FEATURE(kFuturePoliciesOnDesktopAndroid,
               base::FEATURE_DISABLED_BY_DEFAULT);
  #endif  // BUILDFLAG(IS_DESKTOP_ANDROID)
+diff --git a/components/policy/core/common/policy_merger.cc b/components/policy/core/common/policy_merger.cc
+--- a/components/policy/core/common/policy_merger.cc
++++ b/components/policy/core/common/policy_merger.cc
+@@ -21,7 +21,7 @@ namespace policy {
+ namespace {
+ 
+ #if !BUILDFLAG(IS_IOS) && !BUILDFLAG(IS_FUCHSIA) && (!BUILDFLAG(IS_ANDROID) || \
+-    BUILDFLAG(IS_DESKTOP_ANDROID))
++    BUILDFLAG(IS_DESKTOP_ANDROID_CROMITE))
+ constexpr const char* kDictionaryPoliciesToMerge[] = {
+ #if BUILDFLAG(IS_CHROMEOS)
+     key::kExtensionSettings,       key::kDeviceLoginScreenPowerManagement,
+@@ -190,7 +190,7 @@ void PolicyListMerger::DoMerge(PolicyMap::Entry* policy) const {
+ PolicyDictionaryMerger::PolicyDictionaryMerger(
+     base::flat_set<std::string> policies_to_merge)
+ #if BUILDFLAG(IS_IOS) || BUILDFLAG(IS_FUCHSIA) || \
+-    (BUILDFLAG(IS_ANDROID) && !BUILDFLAG(IS_DESKTOP_ANDROID))
++    (BUILDFLAG(IS_ANDROID) && !BUILDFLAG(IS_DESKTOP_ANDROID_CROMITE))
+     : policies_to_merge_(std::move(policies_to_merge)){}
+ #else
+     : policies_to_merge_(std::move(policies_to_merge)),
 diff --git a/components/variations/service/variations_service_client.cc b/components/variations/service/variations_service_client.cc
 --- a/components/variations/service/variations_service_client.cc
 +++ b/components/variations/service/variations_service_client.cc
@@ -3352,7 +3414,20 @@ diff --git a/ui/android/java/src/org/chromium/ui/widget/PopupSpecCalculator.java
 diff --git a/ui/android/javatests/src/org/chromium/ui/test/util/UiDisableIfSkipCheck.java b/ui/android/javatests/src/org/chromium/ui/test/util/UiDisableIfSkipCheck.java
 --- a/ui/android/javatests/src/org/chromium/ui/test/util/UiDisableIfSkipCheck.java
 +++ b/ui/android/javatests/src/org/chromium/ui/test/util/UiDisableIfSkipCheck.java
-@@ -38,7 +38,7 @@ public class UiDisableIfSkipCheck extends DisableIfSkipCheck {
+@@ -28,17 +28,17 @@ public class UiDisableIfSkipCheck extends DisableIfSkipCheck {
+                 () -> {
+                     switch (type) {
+                         case DeviceFormFactor.PHONE:
+-                            return !DeviceInfo.isDesktop() && !isTablet();
++                            return !DeviceInfo.isDesktopFalse() && !isTablet();
+                         case DeviceFormFactor.ONLY_TABLET:
+-                            return !DeviceInfo.isDesktop() && isTablet();
++                            return !DeviceInfo.isDesktopFalse() && isTablet();
+                         case DeviceFormFactor.DESKTOP:
+-                            return DeviceInfo.isDesktop();
++                            return DeviceInfo.isDesktopFalse();
+                         case DeviceFormFactor.DESKTOP_FREEFORM:
+                             return UiRestriction.isDesktopFreeform();
                          case DeviceFormFactor.TABLET_OR_DESKTOP:
                              return isTablet();
                          case DeviceFormFactor.PHONE_OR_TABLET:
diff --git a/build/patches/Eyeo-Adblock-for-Cromite.patch b/build/patches/Eyeo-Adblock-for-Cromite.patch
index 6beb1825..0bfc7b21 100644
--- a/build/patches/Eyeo-Adblock-for-Cromite.patch
+++ b/build/patches/Eyeo-Adblock-for-Cromite.patch
@@ -29,7 +29,7 @@ suit Cromite logic.
  ...hrome_browser_main_extra_parts_profiles.cc |    2 -
  chrome/browser/resources/settings/BUILD.gn    |    2 +
  .../settings/adblock_page/adblock_page.html   |  218 +
- .../settings/adblock_page/adblock_page.ts     |  311 +
+ .../settings/adblock_page/adblock_page.ts     |  319 +
  .../resources/settings/page_visibility.ts     |    1 +
  chrome/browser/resources/settings/route.ts    |    4 +
  chrome/browser/resources/settings/router.ts   |    1 +
@@ -47,7 +47,7 @@ suit Cromite logic.
  .../content/browser/adblock_blocking_page.h   |   75 +
  .../browser/adblock_content_browser_client.h  |  241 +-
  .../browser/adblock_internals_page_handler.cc |    9 +-
- .../browser/adblock_url_loader_factory.cc     |   71 +-
+ .../browser/adblock_url_loader_factory.cc     |   72 +-
  .../adblock_web_ui_controller_factory.cc      |    1 +
  .../browser/adblock_webcontents_observer.cc   |   63 +-
  .../browser/adblock_webcontents_observer.h    |    5 +-
@@ -96,7 +96,7 @@ suit Cromite logic.
  .../adblock/core/sitekey_storage_impl.cc      |   17 +-
  .../core/subscription/conversion_executors.h  |    1 +
  .../filtering_configuration_maintainer.h      |    4 +
- ...filtering_configuration_maintainer_impl.cc |   35 +-
+ ...filtering_configuration_maintainer_impl.cc |   36 +-
  .../filtering_configuration_maintainer_impl.h |    4 +-
  .../preloaded_subscription_provider_impl.cc   |    4 +-
  ...recommended_subscription_installer_impl.cc |    1 +
@@ -131,7 +131,7 @@ suit Cromite logic.
  .../renderer/core/exported/web_document.cc    |   13 +-
  .../blink/renderer/core/html/html_element.cc  |    8 +-
  .../definitions/adblock_private.d.ts          |   14 +
- 126 files changed, 9332 insertions(+), 687 deletions(-)
+ 126 files changed, 9342 insertions(+), 687 deletions(-)
  rename chrome/browser/adblock/android/java/res/xml/{adblock_preferences.xml => eyeo_adblock_preferences.xml} (59%)
  create mode 100644 chrome/browser/resources/settings/adblock_page/adblock_page.html
  create mode 100644 chrome/browser/resources/settings/adblock_page/adblock_page.ts
@@ -1311,7 +1311,7 @@ new file mode 100644
 +                    </div>
 +                </div>
 +            </cr-expand-button>
-+            <iron-collapse opened="{{recommendedSubscriptions}}">
++            <cr-collapse opened="{{recommendedSubscriptions}}">
 +                <div class="list-frame vertical-list">
 +                    <template is="dom-repeat" items="[[subscriptions]]">
 +                        <div class="list-item">
@@ -1335,7 +1335,7 @@ new file mode 100644
 +                        </div>
 +                    </template>
 +                </div>
-+            </iron-collapse>
++            </cr-collapse>
 +        </div>
 +        <div>
 +            <cr-expand-button class="cr-row first" expanded="{{allowedDomainsOpened}}" data-qa="allowed-domains-menu-item">
@@ -1346,7 +1346,7 @@ new file mode 100644
 +                    Support your favorite websites by adding them to this list. You might see ads on them.
 +                </div>
 +            </cr-expand-button>
-+            <iron-collapse opened="{{allowedDomainsOpened}}">
++            <cr-collapse opened="{{allowedDomainsOpened}}">
 +                <div class="list-frame vertical-list">
 +                    <template is="dom-repeat" items="{{allowedDomains}}">
 +                        <div class="list-item">
@@ -1370,7 +1370,7 @@ new file mode 100644
 +                        </div>
 +                    </div>
 +                </div>
-+            </iron-collapse>
++            </cr-collapse>
 +        </div>
 +        <div>
 +            <cr-expand-button class="cr-row first" expanded="{{customSubscriptionsOpened}}" data-qa="custom-subscriptions-menu-item">
@@ -1381,7 +1381,7 @@ new file mode 100644
 +                    Add custom filter urls
 +                </div>
 +            </cr-expand-button>
-+            <iron-collapse opened="{{customSubscriptionsOpened}}">
++            <cr-collapse opened="{{customSubscriptionsOpened}}">
 +                <div class="list-frame vertical-list">
 +                    <template is="dom-repeat" items="{{customSubscriptions}}">
 +                        <div class="list-item">
@@ -1411,7 +1411,7 @@ new file mode 100644
 +                        </div>
 +                    </div>
 +                </div>
-+            </iron-collapse>
++            </cr-collapse>
 +        </div>
 +        <div>
 +            <cr-expand-button class="cr-row first" expanded="{{customFiltersOpened}}" data-qa="custom-filters-menu-item">
@@ -1422,7 +1422,7 @@ new file mode 100644
 +                    Add custom filter commands
 +                </div>
 +            </cr-expand-button>
-+            <iron-collapse opened="{{customFiltersOpened}}">
++            <cr-collapse opened="{{customFiltersOpened}}">
 +                <div class="list-frame vertical-list">
 +                    <template is="dom-repeat" items="{{customFilters}}">
 +                        <div class="list-item">
@@ -1446,7 +1446,7 @@ new file mode 100644
 +                        </div>
 +                    </div>
 +                </div>
-+            </iron-collapse>
++            </cr-collapse>
 +        </div>
 +
 +    </div>
@@ -1456,7 +1456,7 @@ diff --git a/chrome/browser/resources/settings/adblock_page/adblock_page.ts b/ch
 new file mode 100644
 --- /dev/null
 +++ b/chrome/browser/resources/settings/adblock_page/adblock_page.ts
-@@ -0,0 +1,311 @@
+@@ -0,0 +1,319 @@
 +/*
 +    This file is part of Bromite.
 +
@@ -1473,12 +1473,20 @@ new file mode 100644
 +    You should have received a copy of the GNU General Public License
 +    along with Bromite. If not, see <https://www.gnu.org/licenses/>.
 +*/
-+import 'chrome://resources/cr_elements/cr_button/cr_button.js';
-+import 'chrome://resources/cr_elements/cr_shared_style.css.js';
-+import 'chrome://resources/polymer/v3_0/iron-collapse/iron-collapse.js';
 +import 'chrome://resources/polymer/v3_0/iron-flex-layout/iron-flex-layout-classes.js';
 +import 'chrome://resources/polymer/v3_0/iron-icon/iron-icon.js';
++import 'chrome://resources/cr_elements/cr_button/cr_button.js';
++import 'chrome://resources/cr_elements/cr_shared_style.css.js';
++import 'chrome://resources/cr_elements/cr_collapse/cr_collapse.js';
++import 'chrome://resources/cr_elements/cr_toggle/cr_toggle.js';
++import 'chrome://resources/cr_elements/cr_expand_button/cr_expand_button.js';
++import 'chrome://resources/cr_elements/cr_checkbox/cr_checkbox.js';
++import 'chrome://resources/cr_elements/cr_input/cr_input.js';
++import 'chrome://resources/cr_elements/cr_toast/cr_toast_manager.js';
 +import '../settings_shared.css.js';
++import '../settings_page/settings_section.js';
++import '../controls/settings_toggle_button.js';
++import '../controls/settings_dropdown_menu.js';
 +
 +import {I18nMixin} from 'chrome://resources/cr_elements/i18n_mixin.js';
 +import {BaseMixin} from '../base_mixin.js';
@@ -2914,15 +2922,18 @@ diff --git a/components/adblock/content/browser/adblock_internals_page_handler.c
 diff --git a/components/adblock/content/browser/adblock_url_loader_factory.cc b/components/adblock/content/browser/adblock_url_loader_factory.cc
 --- a/components/adblock/content/browser/adblock_url_loader_factory.cc
 +++ b/components/adblock/content/browser/adblock_url_loader_factory.cc
-@@ -117,7 +117,6 @@ ContentType ToAdblockResourceType(const network::ResourceRequest& request) {
+@@ -115,9 +115,9 @@ ContentType ToAdblockResourceType(const network::ResourceRequest& request) {
+     case network::mojom::RequestDestination::kReport:
+     case network::mojom::RequestDestination::kSpeculationRules:
      case network::mojom::RequestDestination::kWebIdentity:
++    case network::mojom::RequestDestination::kEmailVerification:
        return ContentType::Other;
    }
 -  return ContentType::Other;
  }
  
  bool IsPopup(const RequestInitiator& initiator) {
-@@ -145,8 +144,7 @@ bool IsPopup(const RequestInitiator& initiator) {
+@@ -145,8 +145,7 @@ bool IsPopup(const RequestInitiator& initiator) {
  // to allow any port to make this code working with our browser tests which run
  // a custom http(s)s server.
  bool AcceptableAdsBlockthroughFiltersHitDetected(const GURL& request_url) {
@@ -2932,7 +2943,7 @@ diff --git a/components/adblock/content/browser/adblock_url_loader_factory.cc b/
  }
  
  }  // namespace
-@@ -220,8 +218,13 @@ class AdblockURLLoaderFactory::InProgressRequest
+@@ -220,8 +219,13 @@ class AdblockURLLoaderFactory::InProgressRequest
    void OnRequestError(int error_code);
    void CheckFilterMatch(CheckFilterMatchCallback callback);
    void ProcessResponseHeaders(
@@ -2946,7 +2957,7 @@ diff --git a/components/adblock/content/browser/adblock_url_loader_factory.cc b/
    void CheckRewriteFilterMatch(CheckRewriteFilterMatchCallback callback);
    void OnRequestUrlClassified(CheckFilterMatchCallback callback,
                                FilterMatchResult result);
-@@ -246,6 +249,7 @@ class AdblockURLLoaderFactory::InProgressRequest
+@@ -246,6 +250,7 @@ class AdblockURLLoaderFactory::InProgressRequest
    GURL request_url_;
    int request_id_;
    bool is_document_request_;
@@ -2954,7 +2965,7 @@ diff --git a/components/adblock/content/browser/adblock_url_loader_factory.cc b/
    ContentType adblock_resource_type_;
    const raw_ptr<AdblockURLLoaderFactory> factory_;
    // There are the mojo pipe endpoints between this proxy and the renderer.
-@@ -275,6 +279,7 @@ AdblockURLLoaderFactory::InProgressRequest::InProgressRequest(
+@@ -275,6 +280,7 @@ AdblockURLLoaderFactory::InProgressRequest::InProgressRequest(
      : request_url_(request.url),
        request_id_(request_id),
        is_document_request_(IsDocumentRequest(request)),
@@ -2962,7 +2973,7 @@ diff --git a/components/adblock/content/browser/adblock_url_loader_factory.cc b/
        adblock_resource_type_(ToAdblockResourceType(request)),
        factory_(factory),
        target_client_(std::move(client)),
-@@ -358,7 +363,9 @@ void AdblockURLLoaderFactory::InProgressRequest::OnReceiveResponse(
+@@ -358,7 +364,9 @@ void AdblockURLLoaderFactory::InProgressRequest::OnReceiveResponse(
    VLOG(1) << "[eyeo] Sending headers for processing: " << request_url_;
    client_receiver_.Pause();
    const scoped_refptr<net::HttpResponseHeaders>& headers = head->headers;
@@ -2972,7 +2983,7 @@ diff --git a/components/adblock/content/browser/adblock_url_loader_factory.cc b/
        headers, base::BindOnce(&InProgressRequest::OnProcessHeadersResult,
                                weak_factory_.GetWeakPtr(), std::move(head),
                                std::move(body), std::move(cached_metadata)));
-@@ -405,6 +412,7 @@ void AdblockURLLoaderFactory::InProgressRequest::CheckFilterMatch(
+@@ -405,6 +413,7 @@ void AdblockURLLoaderFactory::InProgressRequest::CheckFilterMatch(
    auto subscription_service = factory_->config_.subscription_service;
    if (is_document_request_) {
      if (IsPopup(initiator)) {
@@ -2980,7 +2991,7 @@ diff --git a/components/adblock/content/browser/adblock_url_loader_factory.cc b/
        auto* host = initiator.GetRenderFrameHost();
        factory_->config_.resource_classifier->CheckPopupFilterMatch(
            subscription_service->GetCurrentSnapshot(), request_url_, *host,
-@@ -415,13 +423,12 @@ void AdblockURLLoaderFactory::InProgressRequest::CheckFilterMatch(
+@@ -415,13 +424,12 @@ void AdblockURLLoaderFactory::InProgressRequest::CheckFilterMatch(
                base::BindOnce(&AdblockURLLoaderFactory::InProgressRequest::
                                   PostFilterMatchCallbackToUI,
                               weak_factory_.GetWeakPtr(), std::move(callback))));
@@ -2998,7 +3009,7 @@ diff --git a/components/adblock/content/browser/adblock_url_loader_factory.cc b/
          adblock_resource_type_, initiator,
          base::BindOnce(
              &AdblockURLLoaderFactory::InProgressRequest::OnRequestUrlClassified,
-@@ -429,10 +436,10 @@ void AdblockURLLoaderFactory::InProgressRequest::CheckFilterMatch(
+@@ -429,10 +437,10 @@ void AdblockURLLoaderFactory::InProgressRequest::CheckFilterMatch(
              base::BindOnce(&AdblockURLLoaderFactory::InProgressRequest::
                                 PostFilterMatchCallbackToUI,
                             weak_factory_.GetWeakPtr(), std::move(callback))));
@@ -3010,7 +3021,7 @@ diff --git a/components/adblock/content/browser/adblock_url_loader_factory.cc b/
      const scoped_refptr<net::HttpResponseHeaders>& headers,
      ProcessResponseHeadersCallback callback) {
    if (IsRequestInitiatorDestroyed()) {
-@@ -441,6 +448,37 @@ void AdblockURLLoaderFactory::InProgressRequest::ProcessResponseHeaders(
+@@ -441,6 +449,37 @@ void AdblockURLLoaderFactory::InProgressRequest::ProcessResponseHeaders(
      return;
    }
  
@@ -3048,7 +3059,7 @@ diff --git a/components/adblock/content/browser/adblock_url_loader_factory.cc b/
    auto subscription_service = factory_->config_.subscription_service;
    factory_->config_.resource_classifier->CheckResponseFilterMatch(
        subscription_service->GetCurrentSnapshot(), request_url_,
-@@ -619,6 +657,7 @@ void AdblockURLLoaderFactory::InProgressRequest::Start(
+@@ -619,6 +658,7 @@ void AdblockURLLoaderFactory::InProgressRequest::Start(
              ? net::RedirectInfo::FirstPartyURLPolicy::UPDATE_URL_ON_REDIRECT
              : net::RedirectInfo::FirstPartyURLPolicy::NEVER_CHANGE_URL,
          request.referrer_policy, request.referrer.spec(),
@@ -3056,7 +3067,7 @@ diff --git a/components/adblock/content/browser/adblock_url_loader_factory.cc b/
          kInternalRedirectStatusCode, rewrite.value(),
          absl::nullopt /* referrer_policy_header */,
          false /* insecure_scheme_was_upgraded */, false /* copy_fragment */,
-@@ -661,6 +700,10 @@ void AdblockURLLoaderFactory::InProgressRequest::Start(
+@@ -661,6 +701,10 @@ void AdblockURLLoaderFactory::InProgressRequest::Start(
    VLOG(1) << "[eyeo] Checking filter match for: " << request.url << " ("
            << request.resource_type << ")";
  
@@ -3067,7 +3078,7 @@ diff --git a/components/adblock/content/browser/adblock_url_loader_factory.cc b/
    CheckFilterMatch(base::BindOnce(
        &InProgressRequest::OnRequestFilterMatchResult,
        weak_factory_.GetWeakPtr(), std::move(target_loader), options, request,
-@@ -729,10 +772,12 @@ void AdblockURLLoaderFactory::InProgressRequest::ApplyPostBlockingBehavior()
+@@ -729,10 +773,12 @@ void AdblockURLLoaderFactory::InProgressRequest::ApplyPostBlockingBehavior()
    // some cleanup to preserve good user experience.
    if (frame) {
      if (is_document_request_) {
@@ -11984,7 +11995,15 @@ diff --git a/components/adblock/core/subscription/filtering_configuration_mainta
 diff --git a/components/adblock/core/subscription/filtering_configuration_maintainer_impl.cc b/components/adblock/core/subscription/filtering_configuration_maintainer_impl.cc
 --- a/components/adblock/core/subscription/filtering_configuration_maintainer_impl.cc
 +++ b/components/adblock/core/subscription/filtering_configuration_maintainer_impl.cc
-@@ -273,9 +273,22 @@ void FilteringConfigurationMaintainerImpl::RemoveDuplicateSubscriptions() {
+@@ -19,6 +19,7 @@
+ 
+ #include "base/functional/bind.h"
+ #include "base/logging.h"
++#include "base/strings/string_util.h"
+ #include "base/trace_event/common/trace_event_common.h"
+ #include "base/trace_event/trace_event.h"
+ #include "components/adblock/core/subscription/subscription_collection_impl.h"
+@@ -273,9 +274,22 @@ void FilteringConfigurationMaintainerImpl::RemoveDuplicateSubscriptions() {
                          unique_subscriptions.end());
  }
  
@@ -12008,7 +12027,7 @@ diff --git a/components/adblock/core/subscription/filtering_configuration_mainta
  
    // Run recommended subscription update check first so
    // we don't update lists that would get removed.
-@@ -313,7 +326,6 @@ void FilteringConfigurationMaintainerImpl::RunUpdateCheck() {
+@@ -313,7 +327,6 @@ void FilteringConfigurationMaintainerImpl::RunUpdateCheck() {
                                       AcceptableAdsUrl();
                              }) &&
        persistent_metadata_->IsExpired(AcceptableAdsUrl())) {
@@ -12016,7 +12035,7 @@ diff --git a/components/adblock/core/subscription/filtering_configuration_mainta
    }
  }
  
-@@ -405,15 +417,6 @@ void FilteringConfigurationMaintainerImpl::SubscriptionAddedToStorage(
+@@ -405,15 +418,6 @@ void FilteringConfigurationMaintainerImpl::SubscriptionAddedToStorage(
    subscription_updated_callback_.Run(subscription->GetSourceUrl());
  }
  
@@ -12032,7 +12051,7 @@ diff --git a/components/adblock/core/subscription/filtering_configuration_mainta
  void FilteringConfigurationMaintainerImpl::OnHeadRequestDone(
      const std::string version) {
    if (version.empty()) {
-@@ -426,20 +429,20 @@ void FilteringConfigurationMaintainerImpl::OnHeadRequestDone(
+@@ -426,20 +430,20 @@ void FilteringConfigurationMaintainerImpl::OnHeadRequestDone(
  
  void FilteringConfigurationMaintainerImpl::UninstallSubscription(
      const GURL& subscription_url) {
@@ -12057,7 +12076,7 @@ diff --git a/components/adblock/core/subscription/filtering_configuration_mainta
  }
  
  bool FilteringConfigurationMaintainerImpl::UninstallSubscriptionInternal(
-@@ -473,6 +476,8 @@ void FilteringConfigurationMaintainerImpl::SetCustomFilters() {
+@@ -473,6 +477,8 @@ void FilteringConfigurationMaintainerImpl::SetCustomFilters() {
    DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
  
    std::vector<std::string> filters = configuration_->GetCustomFilters();
diff --git a/build/patches/History-number-of-days-privacy-setting.patch b/build/patches/History-number-of-days-privacy-setting.patch
index adb8bd61..803ced29 100644
--- a/build/patches/History-number-of-days-privacy-setting.patch
+++ b/build/patches/History-number-of-days-privacy-setting.patch
@@ -16,7 +16,7 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
  .../history/history_service_factory.cc        |  2 +
  chrome/browser/profiles/profile_impl.cc       |  1 +
  .../settings/privacy_page/privacy_page.html   |  9 +++
- .../settings/privacy_page/privacy_page.ts     | 18 ++++++
+ .../settings/privacy_page/privacy_page.ts     | 19 ++++++
  .../strings/android_chrome_strings.grd        | 12 ++++
  .../settings_localized_strings_provider.cc    |  5 ++
  .../preference_spinner_single_line.xml        | 26 ++++++--
@@ -24,6 +24,7 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
  .../layout/preference_spinner_single_line.xml |  7 +++
  .../settings/SpinnerPreference.java           |  7 +++
  ...istory-number-of-days-privacy-setting.grdp | 18 ++++++
+ .../core/browser/browsing_history_service.cc  |  2 +-
  .../core/browser/expire_history_backend.cc    | 13 +++-
  .../core/browser/expire_history_backend.h     |  2 +
  .../history/core/browser/history_backend.cc   | 17 +++++
@@ -34,7 +35,7 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
  components/history/core/common/pref_names.h   |  1 +
  components/history_embeddings/sql_database.cc |  2 +-
  .../omnibox/browser/shortcuts_backend.cc      |  4 +-
- 24 files changed, 261 insertions(+), 14 deletions(-)
+ 25 files changed, 263 insertions(+), 15 deletions(-)
  create mode 100644 components/cromite_components_strings_grd/History-number-of-days-privacy-setting.grdp
 
 diff --git a/chrome/android/java/res/xml/privacy_preferences.xml b/chrome/android/java/res/xml/privacy_preferences.xml
@@ -220,7 +221,15 @@ diff --git a/chrome/browser/resources/settings/privacy_page/privacy_page.html b/
 diff --git a/chrome/browser/resources/settings/privacy_page/privacy_page.ts b/chrome/browser/resources/settings/privacy_page/privacy_page.ts
 --- a/chrome/browser/resources/settings/privacy_page/privacy_page.ts
 +++ b/chrome/browser/resources/settings/privacy_page/privacy_page.ts
-@@ -62,6 +62,23 @@ export class SettingsPrivacyPageElement extends SettingsPrivacyPageElementBase {
+@@ -8,6 +8,7 @@
+  * security settings.
+  */
+ import '/shared/settings/prefs/prefs.js';
++import '../controls/settings_dropdown_menu.js';
+ import 'chrome://resources/cr_elements/icons.html.js';
+ import 'chrome://resources/cr_elements/cr_link_row/cr_link_row.js';
+ import 'chrome://resources/cr_elements/cr_shared_style.css.js';
+@@ -62,6 +63,23 @@ export class SettingsPrivacyPageElement extends SettingsPrivacyPageElementBase {
  
    static get properties() {
      return {
@@ -244,7 +253,7 @@ diff --git a/chrome/browser/resources/settings/privacy_page/privacy_page.ts b/ch
        showClearBrowsingDataDialog_: Boolean,
        showPrivacyGuideDialog_: Boolean,
  
-@@ -95,6 +112,7 @@ export class SettingsPrivacyPageElement extends SettingsPrivacyPageElementBase {
+@@ -95,6 +113,7 @@ export class SettingsPrivacyPageElement extends SettingsPrivacyPageElementBase {
      };
    }
  
@@ -413,6 +422,18 @@ new file mode 100644
 +        Forever
 +    </message>
 +</grit-part>
+diff --git a/components/history/core/browser/browsing_history_service.cc b/components/history/core/browser/browsing_history_service.cc
+--- a/components/history/core/browser/browsing_history_service.cc
++++ b/components/history/core/browser/browsing_history_service.cc
+@@ -656,7 +656,7 @@ void BrowsingHistoryService::ReturnResultsToDriver(
+     MergeDuplicateResults(state.get(), &results);
+ 
+     const base::Time local_expiry_threshold =
+-        clock_->Now() - base::Days(HistoryBackend::kExpireDaysThreshold);
++        clock_->Now() - base::Days(90); // dont care
+     base::flat_map<HistoryEntry::EntryType, size_t> pre_expiry_counts;
+     base::flat_map<HistoryEntry::EntryType, size_t> post_expiry_counts;
+     for (const HistoryEntry& entry : results) {
 diff --git a/components/history/core/browser/expire_history_backend.cc b/components/history/core/browser/expire_history_backend.cc
 --- a/components/history/core/browser/expire_history_backend.cc
 +++ b/components/history/core/browser/expire_history_backend.cc
diff --git a/build/patches/Improve-the-browser-sandbox.patch b/build/patches/Improve-the-browser-sandbox.patch
index ef665fc1..f2efa71f 100644
--- a/build/patches/Improve-the-browser-sandbox.patch
+++ b/build/patches/Improve-the-browser-sandbox.patch
@@ -7,11 +7,11 @@ using the new flags on android
 
 License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 ---
- chrome/browser/net/system_network_context_manager.cc      | 2 +-
- .../common/features_cc/Improve-the-browser-sandbox.inc    | 2 ++
- .../content_features_cc/Improve-the-browser-sandbox.inc   | 1 +
- sandbox/policy/features.cc                                | 8 ++++++++
- 4 files changed, 12 insertions(+), 1 deletion(-)
+ chrome/browser/net/system_network_context_manager.cc     | 2 +-
+ .../common/features_cc/Improve-the-browser-sandbox.inc   | 2 ++
+ .../content_features_cc/Improve-the-browser-sandbox.inc  | 1 +
+ sandbox/policy/features.cc                               | 9 +++++++++
+ 4 files changed, 13 insertions(+), 1 deletion(-)
  create mode 100644 cromite_flags/content/common/features_cc/Improve-the-browser-sandbox.inc
  create mode 100644 cromite_flags/content/public/common/content_features_cc/Improve-the-browser-sandbox.inc
 
@@ -43,13 +43,14 @@ new file mode 100644
 diff --git a/sandbox/policy/features.cc b/sandbox/policy/features.cc
 --- a/sandbox/policy/features.cc
 +++ b/sandbox/policy/features.cc
-@@ -167,4 +167,12 @@ bool IsNetworkSandboxEnabled() {
+@@ -167,4 +167,13 @@ bool IsNetworkSandboxEnabled() {
  #endif  // BUILDFLAG(IS_MAC) || BUILDFLAG(IS_FUCHSIA)
  }
  
 +#if BUILDFLAG(IS_ANDROID)
 +SET_CROMITE_FEATURE_ENABLED(kUseRendererProcessPolicy);
 +SET_CROMITE_FEATURE_ENABLED(kRestrictRendererPoliciesInBaseline);
++SET_CROMITE_FEATURE_ENABLED(kAndroidGpuSandbox);
 +#endif
 +#if BUILDFLAG(IS_WIN)
 +SET_CROMITE_FEATURE_ENABLED(kNetworkServiceSandbox);
diff --git a/build/patches/Move-navigation-bar-to-bottom.patch b/build/patches/Move-navigation-bar-to-bottom.patch
index 53384cb2..b835ca41 100644
--- a/build/patches/Move-navigation-bar-to-bottom.patch
+++ b/build/patches/Move-navigation-bar-to-bottom.patch
@@ -37,7 +37,7 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
  .../layouts/LayoutManagerChromeTablet.java    |   7 +-
  .../layouts/ToolbarSwipeLayout.java           |  14 +-
  .../overlays/strip/ScrollDelegate.java        |   2 +-
- .../strip/StripLayoutHelperManager.java       |  37 ++++-
+ .../strip/StripLayoutHelperManager.java       |  39 ++++-
  .../scene_layer/StaticTabSceneLayer.java      |   7 +-
  .../scene_layer/TabListSceneLayer.java        |   8 +
  .../scene_layer/TabStripSceneLayer.java       |  20 ++-
@@ -71,7 +71,7 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
  .../android/res/layout/hub_layout.xml         |   9 +-
  .../android/res/layout/hub_toolbar_layout.xml |   4 +-
  chrome/browser/prefs/browser_prefs.cc         |   2 +-
- .../chrome/browser/ui/appmenu/AppMenu.java    |  38 ++++-
+ .../chrome/browser/ui/appmenu/AppMenu.java    |  39 ++++-
  .../ui/appmenu/AppMenuHandlerImpl.java        |  10 ++
  .../EdgeToEdgeControllerImpl.java             |   1 +
  .../ui/edge_to_edge/EdgeToEdgeUtils.java      |   2 +
@@ -104,7 +104,7 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
  .../render_widget_host_view_android.cc        |   3 +
  .../Move-navigation-bar-to-bottom.inc         |  17 ++
  .../renderer/core/frame/viewport_data.cc      |   1 +
- 91 files changed, 1060 insertions(+), 88 deletions(-)
+ 91 files changed, 1063 insertions(+), 88 deletions(-)
  create mode 100644 chrome/browser/hub/internal/android/java/src/org/chromium/chrome/browser/hub/ReversedLinearLayout.java
  create mode 100644 cromite_flags/chrome/browser/about_flags_cc/Move-navigation-bar-to-bottom.inc
 
@@ -1035,12 +1035,13 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/compositor/over
  
  import java.util.ArrayList;
  import java.util.List;
-@@ -276,12 +278,16 @@ public class StripLayoutHelperManager
+@@ -276,12 +278,17 @@ public class StripLayoutHelperManager
      // Drag-Drop
      private @Nullable TabStripDragHandler mTabStripDragHandler;
  
 +    private final Supplier<BrowserControlsManager> mBrowserControlsManagerSupplier;
 +    private final float mDpToPx;
++    private RectF mCachedViewport;
 +
      private class TabStripEventHandler implements AreaMotionEventHandler {
          @Override
@@ -1052,7 +1053,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/compositor/over
              if (mModelSelectorButton != null && mModelSelectorButton.onDown(x, y, buttons)) {
                  return;
              }
-@@ -306,6 +312,7 @@ public class StripLayoutHelperManager
+@@ -306,6 +313,7 @@ public class StripLayoutHelperManager
              if (DragDropGlobalState.hasValue()) {
                  return;
              }
@@ -1060,7 +1061,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/compositor/over
              if (mModelSelectorButton != null) {
                  mModelSelectorButton.drag(x, y);
              }
-@@ -317,6 +324,7 @@ public class StripLayoutHelperManager
+@@ -317,6 +325,7 @@ public class StripLayoutHelperManager
              if (DragDropGlobalState.hasValue()) {
                  return;
              }
@@ -1068,7 +1069,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/compositor/over
              long time = time();
              if (mModelSelectorButton != null && mModelSelectorButton.click(x, y, buttons)) {
                  mModelSelectorButton.handleClick(time, buttons, modifiers);
-@@ -330,6 +338,7 @@ public class StripLayoutHelperManager
+@@ -330,6 +339,7 @@ public class StripLayoutHelperManager
              if (DragDropGlobalState.hasValue()) {
                  return;
              }
@@ -1076,7 +1077,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/compositor/over
              getActiveStripLayoutHelper().fling(time(), velocityX);
          }
  
-@@ -338,6 +347,7 @@ public class StripLayoutHelperManager
+@@ -338,6 +348,7 @@ public class StripLayoutHelperManager
              if (DragDropGlobalState.hasValue()) {
                  return;
              }
@@ -1084,7 +1085,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/compositor/over
              getActiveStripLayoutHelper().onLongPress(x, y);
          }
  
-@@ -477,7 +487,8 @@ public class StripLayoutHelperManager
+@@ -477,7 +488,8 @@ public class StripLayoutHelperManager
              DataSharingTabManager dataSharingTabManager,
              BottomSheetController bottomSheetController,
              Supplier<ShareDelegate> shareDelegateSupplier,
@@ -1094,7 +1095,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/compositor/over
          mContext = context;
          Resources res = context.getResources();
          mManagerHost = managerHost;
-@@ -597,6 +608,8 @@ public class StripLayoutHelperManager
+@@ -597,6 +609,8 @@ public class StripLayoutHelperManager
                          multiInstanceManager,
                          shareDelegateSupplier,
                          TabGroupListBottomSheetCoordinator::new);
@@ -1103,7 +1104,15 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/compositor/over
  
          tabHoverCardViewStub.setOnInflateListener(
                  (viewStub, view) -> {
-@@ -861,6 +874,10 @@ public class StripLayoutHelperManager
+@@ -818,6 +832,7 @@ public class StripLayoutHelperManager
+             RectF viewport, RectF visibleViewport, ResourceManager resourceManager) {
+         assert mTabStripTreeProvider != null;
+         mResourceManager = resourceManager;
++        mCachedViewport = viewport;
+ 
+         // When refactor is enabled, the mSceneLayerYOffset / mSceneLayerVisibleHeight wil be
+         // calculated externally, so we can skip the adjustment here.
+@@ -861,6 +876,10 @@ public class StripLayoutHelperManager
                      getStripTransitionScrimColor(), mStripTransitionScrimOpacity);
          }
  
@@ -1114,18 +1123,18 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/compositor/over
          mTabStripTreeProvider.pushAndUpdateStrip(
                  this,
                  mLayerTitleCacheSupplier.get(),
-@@ -874,7 +891,9 @@ public class StripLayoutHelperManager
+@@ -874,7 +893,9 @@ public class StripLayoutHelperManager
                  mStripTransitionScrimOpacity,
                  getActiveStripLayoutHelper().getLeftPaddingToDraw(),
                  getActiveStripLayoutHelper().getRightPaddingToDraw(),
 -                mTopPadding);
 +                mTopPadding,
-+                viewport.height(),
++                mCachedViewport.height(),
 +                topControlsHeight);
      }
  
      private float getVisibleHeightDp(float topControlOffsetDp) {
-@@ -976,11 +995,21 @@ public class StripLayoutHelperManager
+@@ -976,11 +997,21 @@ public class StripLayoutHelperManager
                  mRightPadding,
                  mTopPadding);
  
@@ -2204,7 +2213,15 @@ diff --git a/chrome/browser/ui/android/appmenu/internal/java/src/org/chromium/ch
  import android.os.SystemClock;
  import android.view.Gravity;
  import android.view.KeyEvent;
-@@ -424,6 +425,13 @@ class AppMenu implements OnKeyListener {
+@@ -45,6 +46,7 @@ import org.chromium.build.annotations.NullMarked;
+ import org.chromium.build.annotations.Nullable;
+ import org.chromium.build.annotations.RequiresNonNull;
+ import org.chromium.chrome.browser.browser_controls.BrowserControlsStateProvider.ControlsPosition;
++import org.chromium.chrome.browser.flags.ChromeFeatureList;
+ import org.chromium.chrome.browser.ui.appmenu.internal.R;
+ import org.chromium.components.browser_ui.styles.SemanticColorUtils;
+ import org.chromium.components.browser_ui.widget.chips.ChipView;
+@@ -424,6 +426,13 @@ class AppMenu implements OnKeyListener {
              mListView.setVerticalScrollBarEnabled(false);
          }
  
@@ -2218,7 +2235,7 @@ diff --git a/chrome/browser/ui/android/appmenu/internal/java/src/org/chromium/ch
          int footerHeight = attachFooter(footer, (ViewGroup) contentView, menuWidth);
          int headerHeight = attachHeader(header, menuWidth);
  
-@@ -471,7 +479,8 @@ class AppMenu implements OnKeyListener {
+@@ -471,7 +480,8 @@ class AppMenu implements OnKeyListener {
                          anchorView,
                          anchorViewOffset);
  
@@ -2228,7 +2245,7 @@ diff --git a/chrome/browser/ui/android/appmenu/internal/java/src/org/chromium/ch
  
          int[] popupPosition =
                  getPopupPosition(
-@@ -483,8 +492,14 @@ class AppMenu implements OnKeyListener {
+@@ -483,8 +493,14 @@ class AppMenu implements OnKeyListener {
                          padding,
                          anchorView,
                          popupWidth,
@@ -2239,12 +2256,12 @@ diff --git a/chrome/browser/ui/android/appmenu/internal/java/src/org/chromium/ch
 +        if (ChromeFeatureList.sMoveTopToolbarToBottom.isEnabled()) {
 +            // due to some unknown behaviour, the popup must be resized to
 +            // allow selection without leaving touch
-+            mPopup.setHeight(popupHeight - 1);
++            popup.setHeight(popupHeight - 1);
 +        }
  
          mHierarchicalMenuController.setupFlyoutController(
                  /* flyoutHandler= */ flyoutHandler,
-@@ -609,11 +624,20 @@ class AppMenu implements OnKeyListener {
+@@ -609,11 +625,20 @@ class AppMenu implements OnKeyListener {
              Rect padding,
              View anchorView,
              int popupWidth,
@@ -2266,7 +2283,7 @@ diff --git a/chrome/browser/ui/android/appmenu/internal/java/src/org/chromium/ch
          int[] offsets = new int[2];
          // If we have a hardware menu button, locate the app menu closer to the estimated
          // hardware menu button location.
-@@ -744,7 +768,13 @@ class AppMenu implements OnKeyListener {
+@@ -744,7 +769,13 @@ class AppMenu implements OnKeyListener {
                          - mMenuSpec.footerHeight
                          - mMenuSpec.headerHeight
                          - anchorViewImpactHeight;
@@ -2275,7 +2292,7 @@ diff --git a/chrome/browser/ui/android/appmenu/internal/java/src/org/chromium/ch
 +            if (Build.VERSION.SDK_INT == Build.VERSION_CODES.N) {
 +                // due to an Android Nougat bug the popup does not appear above the anchorview.
 +                // the display is not pleasant, so we reduce the space
-+                availableScreenSpace -= anchorView.getHeight();
++                availableScreenSpace -= mMenuSpec.anchorView.getHeight();
 +            }
 +        }
          if (mIsByPermanentButton) availableScreenSpace -= mMenuSpec.padding.top;
diff --git a/build/patches/Multi-Screen-Window-Placement-API-fix.patch b/build/patches/Multi-Screen-Window-Placement-API-fix.patch
index 7598ae24..ab464b4c 100644
--- a/build/patches/Multi-Screen-Window-Placement-API-fix.patch
+++ b/build/patches/Multi-Screen-Window-Placement-API-fix.patch
@@ -9,11 +9,11 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 ---
  .../permissions/permission_service_impl.cc    |  1 -
  .../renderer_host/render_frame_host_impl.cc   |  3 +-
- .../core/frame/cached_permission_status.cc    |  4 +--
+ .../core/frame/cached_permission_status.cc    |  6 ++--
  .../core/frame/cached_permission_status.h     |  1 +
  .../blink/renderer/core/frame/screen.cc       | 35 +++++++++++++++++--
  .../blink/renderer/core/frame/screen.h        | 17 ++++++++-
- 6 files changed, 54 insertions(+), 7 deletions(-)
+ 6 files changed, 55 insertions(+), 8 deletions(-)
 
 diff --git a/content/browser/permissions/permission_service_impl.cc b/content/browser/permissions/permission_service_impl.cc
 --- a/content/browser/permissions/permission_service_impl.cc
@@ -47,10 +47,11 @@ diff --git a/third_party/blink/renderer/core/frame/cached_permission_status.cc b
        permission_observer_receivers_(this, local_dom_window) {
    CHECK(local_dom_window);
 -  CHECK(RuntimeEnabledFeatures::PermissionElementEnabled(local_dom_window) ||
-+  // CHECK(RuntimeEnabledFeatures::PermissionElementEnabled(local_dom_window) ||
-         RuntimeEnabledFeatures::GeolocationElementEnabled(local_dom_window) ||
+-        RuntimeEnabledFeatures::GeolocationElementEnabled(local_dom_window) ||
 -        RuntimeEnabledFeatures::UserMediaElementEnabled(local_dom_window));
-+        RuntimeEnabledFeatures::UserMediaElementEnabled(local_dom_window)); see https://source.chromium.org/chromium/chromium/src/+/81a9e9b66a03e12cb438eef0834f5e5f7a0506ee
++  // CHECK(RuntimeEnabledFeatures::PermissionElementEnabled(local_dom_window) ||
++  //      RuntimeEnabledFeatures::GeolocationElementEnabled(local_dom_window) ||
++  //      RuntimeEnabledFeatures::UserMediaElementEnabled(local_dom_window)); see https://source.chromium.org/chromium/chromium/src/+/81a9e9b66a03e12cb438eef0834f5e5f7a0506ee
  }
  
  void CachedPermissionStatus::Trace(Visitor* visitor) const {
diff --git a/build/patches/Remove-HTTP-referrals-in-cross-origin-navigation.patch b/build/patches/Remove-HTTP-referrals-in-cross-origin-navigation.patch
index 28c09dc6..f6f37bc7 100644
--- a/build/patches/Remove-HTTP-referrals-in-cross-origin-navigation.patch
+++ b/build/patches/Remove-HTTP-referrals-in-cross-origin-navigation.patch
@@ -462,7 +462,7 @@ diff --git a/chrome/browser/resources/settings/privacy_page/privacy_page.html b/
 diff --git a/chrome/browser/resources/settings/privacy_page/privacy_page.ts b/chrome/browser/resources/settings/privacy_page/privacy_page.ts
 --- a/chrome/browser/resources/settings/privacy_page/privacy_page.ts
 +++ b/chrome/browser/resources/settings/privacy_page/privacy_page.ts
-@@ -92,6 +92,17 @@ export class SettingsPrivacyPageElement extends SettingsPrivacyPageElementBase {
+@@ -93,6 +93,17 @@ export class SettingsPrivacyPageElement extends SettingsPrivacyPageElementBase {
          value: () => loadTimeData.getBoolean('isPrivacySandboxRestricted'),
        },
  
@@ -480,7 +480,7 @@ diff --git a/chrome/browser/resources/settings/privacy_page/privacy_page.ts b/ch
        isPrivacySandboxRestrictedNoticeEnabled_: {
          type: Boolean,
          value: () =>
-@@ -116,6 +127,7 @@ export class SettingsPrivacyPageElement extends SettingsPrivacyPageElementBase {
+@@ -117,6 +128,7 @@ export class SettingsPrivacyPageElement extends SettingsPrivacyPageElementBase {
    declare private showClearBrowsingDataDialog_: boolean;
    declare private showPrivacyGuideDialog_: boolean;
    declare private enableDeleteBrowsingDataRevamp_: boolean;
@@ -488,7 +488,7 @@ diff --git a/chrome/browser/resources/settings/privacy_page/privacy_page.ts b/ch
    declare private isPrivacySandboxRestricted_: boolean;
    declare private isPrivacySandboxRestrictedNoticeEnabled_: boolean;
    declare private dbdDeletionConfirmationToastLabel_: string;
-@@ -146,6 +158,12 @@ export class SettingsPrivacyPageElement extends SettingsPrivacyPageElementBase {
+@@ -147,6 +159,12 @@ export class SettingsPrivacyPageElement extends SettingsPrivacyPageElementBase {
      Router.getInstance().navigateTo(routes.COOKIES);
    }
  
diff --git a/build/patches/Remove-binary-blob-integrations.patch b/build/patches/Remove-binary-blob-integrations.patch
index 5f89fe92..3e31e8d0 100644
--- a/build/patches/Remove-binary-blob-integrations.patch
+++ b/build/patches/Remove-binary-blob-integrations.patch
@@ -97,7 +97,7 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
  .../components/webauthn/GmsCoreUtils.java     |  74 +-
  .../webauthn/IdentityCredentialsHelper.java   | 119 +--
  .../webauthn/WebauthnModeProvider.java        |  15 -
- .../cred_man/CredManMetricsHelper.java        |  15 -
+ .../cred_man/CredManMetricsHelper.java        |  17 +-
  .../push_messaging/push_messaging_manager.cc  |   2 +-
  content/public/android/BUILD.gn               |   4 -
  content/test/BUILD.gn                         |   4 -
@@ -111,7 +111,7 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
  .../gms/ChromiumPlayServicesAvailability.java |  17 +-
  third_party/androidx/customizations.gni       |  14 +-
  third_party/cardboard/BUILD.gn                |   4 -
- 87 files changed, 137 insertions(+), 2683 deletions(-)
+ 87 files changed, 138 insertions(+), 2684 deletions(-)
  create mode 100644 components/webauthn/android/java/src/org/chromium/components/webauthn/ConditionalUiState.java
 
 diff --git a/android_webview/expectations/system_webview_bundle.AndroidManifest.expected b/android_webview/expectations/system_webview_bundle.AndroidManifest.expected
@@ -3855,10 +3855,11 @@ diff --git a/components/webauthn/android/java/src/org/chromium/components/webaut
  
  /**
   * This class is responsible for emitting histograms regarding CredMan usage in
-@@ -105,19 +104,5 @@ public class CredManMetricsHelper {
+@@ -104,20 +103,6 @@ public class CredManMetricsHelper {
+     }
  
      public void reportGetCredentialMetrics(
-             @CredManGetRequestEnum int value, @CancellableUiState int cancellableUiState) {
+-            @CredManGetRequestEnum int value, @CancellableUiState int cancellableUiState) {
 -        assert !(cancellableUiState == CancellableUiState.NONE)
 -                        || !(value == CredManGetRequestEnum.SUCCESS_PASSWORD)
 -                : "Passwords cannot be received from modal requests!";
@@ -3873,6 +3874,7 @@ diff --git a/components/webauthn/android/java/src/org/chromium/components/webaut
 -                "WebAuthentication.Android.CredManConditionalRequest",
 -                value,
 -                CredManGetRequestEnum.NUM_ENTRIES);
++            @CredManGetRequestEnum int value, int cancellableUiState) {
      }
  }
 diff --git a/content/browser/push_messaging/push_messaging_manager.cc b/content/browser/push_messaging/push_messaging_manager.cc
diff --git a/build/patches/Restore-chrome-password-store.patch b/build/patches/Restore-chrome-password-store.patch
index a0dee635..324fa416 100644
--- a/build/patches/Restore-chrome-password-store.patch
+++ b/build/patches/Restore-chrome-password-store.patch
@@ -6209,14 +6209,14 @@ new file mode 100644
 diff --git a/components/autofill/core/common/autofill_features.cc b/components/autofill/core/common/autofill_features.cc
 --- a/components/autofill/core/common/autofill_features.cc
 +++ b/components/autofill/core/common/autofill_features.cc
-@@ -572,6 +572,7 @@ BASE_FEATURE(kAutofillEnableLoyaltyCardsFilling,
-              IS_WALLET_PASSES_SUPPORTED_PLATFORM
-                  ? base::FEATURE_ENABLED_BY_DEFAULT
-                  : base::FEATURE_DISABLED_BY_DEFAULT);
+@@ -401,6 +401,7 @@ BASE_FEATURE(kAutofillDeduplicateAccountAddresses,
+ // If enabled, other apps can open the Autofill Options in Chrome.
+ BASE_FEATURE(kAutofillDeepLinkAutofillOptions,
+              base::FEATURE_ENABLED_BY_DEFAULT);
 +SET_CROMITE_FEATURE_DISABLED(kAutofillDeepLinkAutofillOptions);
+ #endif  // BUILDFLAG(IS_ANDROID)
  
- #if BUILDFLAG(IS_ANDROID)
- // Controls if Chrome Autofill UI surfaces ignore touch events if something is
+ // Kill switch for Autofill address import.
 diff --git a/components/browser_ui/settings/android/java/src/org/chromium/components/browser_ui/settings/SettingsNavigation.java b/components/browser_ui/settings/android/java/src/org/chromium/components/browser_ui/settings/SettingsNavigation.java
 --- a/components/browser_ui/settings/android/java/src/org/chromium/components/browser_ui/settings/SettingsNavigation.java
 +++ b/components/browser_ui/settings/android/java/src/org/chromium/components/browser_ui/settings/SettingsNavigation.java
diff --git a/build/patches/Show-NTP-at-startup.patch b/build/patches/Show-NTP-at-startup.patch
index b0288017..923098f9 100644
--- a/build/patches/Show-NTP-at-startup.patch
+++ b/build/patches/Show-NTP-at-startup.patch
@@ -107,7 +107,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedAct
          mInactivityTrackerSupplier.set(
                  new ChromeInactivityTracker(
                          ChromePreferenceKeys.TABBED_ACTIVITY_LAST_BACKGROUNDED_TIME_MS_PREF));
-+        mInactivityTracker.setIsStartup(
++        mInactivityTrackerSupplier.get().setIsStartup(
 +            !CipherLazyHolder.sCipherInstance.restoreFromBundle(getSavedInstanceState()));
          TabUsageTracker.initialize(this.getLifecycleDispatcher(), tabModelSelector);
          TabGroupUsageTracker.initialize(
diff --git a/build/patches/Timezone-customization.patch b/build/patches/Timezone-customization.patch
index 1d77ce6e..757e7049 100644
--- a/build/patches/Timezone-customization.patch
+++ b/build/patches/Timezone-customization.patch
@@ -30,13 +30,14 @@ Require: Content-settings-infrastructure.patch
  .../common/content_settings_mojom_traits.cc   |   3 +-
  .../common/content_settings_mojom_traits.h    |   5 +
  .../content_settings/core/common/pref_names.h |   3 +
- .../renderer/content_settings_agent_impl.cc   |  77 +++++++
+ .../renderer/content_settings_agent_impl.cc   |  78 +++++++
  .../renderer/content_settings_agent_impl.h    |  11 +
  .../blink/renderer/core/timezone/build.gni    |   2 +
- .../timezone/external_timezone_controller.cc  |  37 ++++
+ .../timezone/external_timezone_controller.cc  |  40 ++++
  .../timezone/external_timezone_controller.h   |  34 +++
- .../core/timezone/timezone_controller.h       |   6 +-
- 26 files changed, 756 insertions(+), 2 deletions(-)
+ .../core/timezone/timezone_controller.cc      |  11 -
+ .../core/timezone/timezone_controller.h       |  12 +-
+ 27 files changed, 762 insertions(+), 17 deletions(-)
  create mode 100755 components/browser_ui/site_settings/android/java/res/layout/time_zone_select_dialog.xml
  create mode 100755 components/browser_ui/site_settings/android/java/res/layout/timezoneoverride_site_settings_preference.xml
  create mode 100755 components/browser_ui/site_settings/android/java/src/org/chromium/components/browser_ui/site_settings/TimezoneOverrideSiteSettingsPreference.java
@@ -855,7 +856,7 @@ diff --git a/components/content_settings/renderer/content_settings_agent_impl.cc
  
    blink::WebLocalFrame* frame = render_frame()->GetWebFrame();
    if (frame->Parent())
-@@ -465,4 +468,78 @@ void ContentSettingsAgentImpl::ClearBlockedContentSettings() {
+@@ -465,4 +468,79 @@ void ContentSettingsAgentImpl::ClearBlockedContentSettings() {
    cached_script_permissions_.clear();
  }
  
@@ -877,6 +878,20 @@ diff --git a/components/content_settings/renderer/content_settings_agent_impl.cc
 +    const std::string& timezone_override_value) {
 +  // base/i18n/icu_util.cc # 329
 +
++  if (setting == CONTENT_SETTING_ALLOW) {
++    // system time
++    if (timezone_override_) {
++      timezone_override_.reset();
++    }
++    return true;
++  }
++
++  // https://chromium-review.googlesource.com/c/chromium/src/+/7031664
++  if (blink::ExternalTimeZoneController::HasTimeZoneOverride()) {
++    DLOG(INFO) << "UpdateTimeZoneOverride: already set";
++    return false;
++  }
++
 +  /* timezone_id: third_party/icu/source/i18n/timezone.cpp
 +      We first try to lookup the zone ID in our system list.  If this
 +      * fails, we try to parse it as a custom string GMT[+-]hh:mm.  If
@@ -884,14 +899,7 @@ diff --git a/components/content_settings/renderer/content_settings_agent_impl.cc
 +      * user wants, but at least is a functioning TimeZone object.
 +      */
 +  std::string timezone_id;
-+
-+  if (setting == CONTENT_SETTING_ALLOW) {
-+    // system time
-+    if (timezone_override_) {
-+      timezone_override_.reset();
-+    }
-+    return true;
-+  } else if (setting == CONTENT_SETTING_BLOCK) {
++  if (setting == CONTENT_SETTING_BLOCK) {
 +    // timezone random
 +    UErrorCode ec = U_ZERO_ERROR;
 +    int32_t rawOffset = base::RandInt(-12, 11) * 3600 * 1000;
@@ -912,24 +920,18 @@ diff --git a/components/content_settings/renderer/content_settings_agent_impl.cc
 +      timezone_id = timezone_override_value;
 +  }
 +
-+  if (!blink::ExternalTimeZoneController::HasTimeZoneOverride()) {
-+    timezone_override_.reset();
-+    timezone_override_ =
-+        blink::ExternalTimeZoneController::SetTimeZoneOverride(timezone_id);
-+    if (!timezone_override_) {
-+      DLOG(WARNING) << "UpdateTimeZoneOverride - Invalid timezone id '"
-+                   << timezone_id << "'";
-+      return false;
-+    } else {
-+      DLOG(INFO)
-+          << "UpdateTimeZoneOverride - setting to '"
-+          << timezone_id << "'";
-+      return true;
-+    }
++  timezone_override_.reset();
++  timezone_override_ =
++      blink::ExternalTimeZoneController::SetTimeZoneOverride(timezone_id);
++  if (!timezone_override_) {
++    DLOG(WARNING) << "UpdateTimeZoneOverride - Invalid timezone id '"
++                  << timezone_id << "'";
++    return false;
 +  } else {
 +    DLOG(INFO)
-+        << "UpdateTimeZoneOverride: already set";
-+    return false;
++        << "UpdateTimeZoneOverride - setting to '"
++        << timezone_id << "'";
++    return true;
 +  }
 +}
 +
@@ -976,7 +978,7 @@ diff --git a/third_party/blink/renderer/core/timezone/external_timezone_controll
 new file mode 100644
 --- /dev/null
 +++ b/third_party/blink/renderer/core/timezone/external_timezone_controller.cc
-@@ -0,0 +1,37 @@
+@@ -0,0 +1,40 @@
 +// Copyright 2019 The Chromium Authors
 +// Use of this source code is governed by a BSD-style license that can be
 +// found in the LICENSE file.
@@ -994,17 +996,20 @@ new file mode 100644
 +// static
 +std::unique_ptr<ExternalTimeZoneController::TimeZoneOverride>
 +ExternalTimeZoneController::SetTimeZoneOverride(const std::string& timezone_id) {
++  DCHECK(IsMainThread());
 +  auto timezone = String(timezone_id.c_str());
 +
-+  auto timezone_override = TimeZoneController::SetTimeZoneOverride(timezone);
-+  if (!timezone_override) return nullptr;
++  auto result = TimeZoneController::SetTimeZoneOverride(timezone);
++  if (result.status != TimeZoneController::TimeZoneOverrideStatus::kSuccess)
++    return nullptr;
 +
-+  timezone_override->clear_at_destruction_ = false;
++  result.handle->clear_at_destruction_ = false;
 +  return std::unique_ptr<TimeZoneOverride>(new TimeZoneOverride());
 +}
 +
 +// static
 +bool ExternalTimeZoneController::HasTimeZoneOverride() {
++  DCHECK(IsMainThread());
 +  return TimeZoneController::HasTimeZoneOverride();
 +}
 +
@@ -1053,6 +1058,65 @@ new file mode 100644
 +}  // namespace blink
 +
 +#endif  // THIRD_PARTY_BLINK_RENDERER_CORE_TIMEZONE_EXTERNAL_TIMEZONE_CONTROLLER_H_
+diff --git a/third_party/blink/renderer/core/timezone/timezone_controller.cc b/third_party/blink/renderer/core/timezone/timezone_controller.cc
+--- a/third_party/blink/renderer/core/timezone/timezone_controller.cc
++++ b/third_party/blink/renderer/core/timezone/timezone_controller.cc
+@@ -141,8 +141,6 @@ TimeZoneController::TimeZoneOverrideResult
+ TimeZoneController::SetTimeZoneOverride(const String& timezone_id) {
+   DCHECK(!timezone_id.empty());
+ 
+-  base::AutoLock locker(instance().lock_);
+-
+   if (timezone_id == instance().TimeZoneIdOverride()) {
+     // Do nothing.
+     return {TimeZoneOverrideStatus::kSuccess, nullptr};
+@@ -168,20 +166,16 @@ TimeZoneController::SetTimeZoneOverride(const String& timezone_id) {
+ 
+ // static
+ bool TimeZoneController::HasTimeZoneOverride() {
+-  instance().lock_.AssertAcquired();
+   return !instance().override_timezone_id_.empty();
+ }
+ 
+ // static
+ const String& TimeZoneController::TimeZoneIdOverride() {
+-  instance().lock_.AssertAcquired();
+   return instance().override_timezone_id_;
+ }
+ 
+ // static
+ void TimeZoneController::ClearTimeZoneOverride() {
+-  base::AutoLock locker(instance().lock_);
+-
+   DCHECK(HasTimeZoneOverride());
+ 
+   if (!CanonicalEquals(instance().GetHostTimezoneId(),
+@@ -197,8 +191,6 @@ void TimeZoneController::ClearTimeZoneOverride() {
+ void TimeZoneController::ChangeTimeZoneOverride(const String& timezone_id) {
+   DCHECK(!timezone_id.empty());
+ 
+-  base::AutoLock locker(instance().lock_);
+-
+   if (!HasTimeZoneOverride()) {
+     VLOG(1) << "Cannot change if there are no existing timezone override.";
+     return;
+@@ -243,8 +235,6 @@ bool TimeZoneController::SetIcuTimeZoneAndNotifyV8(const String& timezone_id) {
+ void TimeZoneController::OnTimeZoneChange(const String& timezone_id) {
+   DCHECK(IsMainThread());
+ 
+-  base::AutoLock locker(instance().lock_);
+-
+   // Remember requested timezone id so we can set it when timezone
+   // override is removed.
+   instance().host_timezone_id_ = timezone_id;
+@@ -254,7 +244,6 @@ void TimeZoneController::OnTimeZoneChange(const String& timezone_id) {
+ }
+ 
+ const String& TimeZoneController::GetHostTimezoneId() {
+-  lock_.AssertAcquired();
+   if (host_timezone_id_.IsNull()) {
+     CHECK(base::FeatureList::IsEnabled(kLazyBlinkTimezoneInit));
+     host_timezone_id_ = GetCurrentTimezoneId();
 diff --git a/third_party/blink/renderer/core/timezone/timezone_controller.h b/third_party/blink/renderer/core/timezone/timezone_controller.h
 --- a/third_party/blink/renderer/core/timezone/timezone_controller.h
 +++ b/third_party/blink/renderer/core/timezone/timezone_controller.h
@@ -1083,4 +1147,17 @@ diff --git a/third_party/blink/renderer/core/timezone/timezone_controller.h b/th
    };
  
    struct TimeZoneOverrideResult {
+@@ -96,10 +100,8 @@ class CORE_EXPORT TimeZoneController final
+   // by Oilpan.
+   mojo::Receiver<device::mojom::blink::TimeZoneMonitorClient> receiver_{this};
+ 
+-  base::Lock lock_;
+-
+-  String host_timezone_id_ GUARDED_BY(lock_);
+-  String override_timezone_id_ GUARDED_BY(lock_);
++  String host_timezone_id_;
++  String override_timezone_id_;
+ };
+ 
+ }  // namespace blink
 --
diff --git a/build/patches/Use-list-mode-for-tab-switcher.patch b/build/patches/Use-list-mode-for-tab-switcher.patch
index 91b952aa..576b95ea 100644
--- a/build/patches/Use-list-mode-for-tab-switcher.patch
+++ b/build/patches/Use-list-mode-for-tab-switcher.patch
@@ -37,9 +37,11 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
  .../browser/ui/favicon/FaviconHelper.java     |  57 ++-
  .../Use-list-mode-for-tab-switcher.grdp       |   9 +
  .../browser/toolbar/top/ToolbarPhone.java     |   6 +-
+ components/browser_ui/styles/android/BUILD.gn |   1 +
+ .../java/res/drawable/ic_warning_red_16dp.xml |  26 ++
  .../layout/title_and_description_layout.xml   |  31 +-
  .../tab-switcher-list-mode.inc                |   3 +
- 32 files changed, 1152 insertions(+), 37 deletions(-)
+ 34 files changed, 1179 insertions(+), 37 deletions(-)
  create mode 100644 chrome/android/features/tab_ui/java/res/drawable/selected_tab_background.xml
  create mode 100644 chrome/android/features/tab_ui/java/res/drawable/selected_tab_background_incognito.xml
  create mode 100644 chrome/android/features/tab_ui/java/res/layout/tab_list_card_item.xml
@@ -47,6 +49,7 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
  create mode 100644 chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser/tasks/tab_management/TabListViewBinder.java
  create mode 100644 chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/cromite/sTabSwitcherListMode.java
  create mode 100644 chrome/browser/ui/android/strings/cromite_android_chrome_strings_grd/Use-list-mode-for-tab-switcher.grdp
+ create mode 100644 components/browser_ui/styles/android/java/res/drawable/ic_warning_red_16dp.xml
  create mode 100644 cromite_flags/chrome/browser/flags/android/chrome_feature_list_cc/tab-switcher-list-mode.inc
 
 diff --git a/chrome/android/features/tab_ui/BUILD.gn b/chrome/android/features/tab_ui/BUILD.gn
@@ -1714,6 +1717,48 @@ diff --git a/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/brow
          mHomeButtonDisplay.setClickable(!hasFocus);
          triggerUrlFocusAnimation(hasFocus);
      }
+diff --git a/components/browser_ui/styles/android/BUILD.gn b/components/browser_ui/styles/android/BUILD.gn
+--- a/components/browser_ui/styles/android/BUILD.gn
++++ b/components/browser_ui/styles/android/BUILD.gn
+@@ -251,6 +251,7 @@ android_resources("java_resources") {
+     "java/res/drawable/ic_visibility_off_black.xml",
+     "java/res/drawable/ic_volume_off_white_24dp.xml",
+     "java/res/drawable/ic_volume_on_white_24dp.xml",
++    "java/res/drawable/ic_warning_red_16dp.xml",
+     "java/res/drawable/ic_warning_red_24dp.xml",
+     "java/res/drawable/ic_warning_red_outline_32dp.xml",
+     "java/res/drawable/ic_web_24dp.xml",
+diff --git a/components/browser_ui/styles/android/java/res/drawable/ic_warning_red_16dp.xml b/components/browser_ui/styles/android/java/res/drawable/ic_warning_red_16dp.xml
+new file mode 100644
+--- /dev/null
++++ b/components/browser_ui/styles/android/java/res/drawable/ic_warning_red_16dp.xml
+@@ -0,0 +1,26 @@
++<?xml version="1.0" encoding="utf-8"?>
++<!--
++Copyright 2017 The Chromium Authors
++Use of this source code is governed by a BSD-style license that can be
++found in the LICENSE file.
++-->
++
++<vector xmlns:android="http://schemas.android.com/apk/res/android"
++    android:width="16dp"
++    android:height="16dp"
++    android:viewportWidth="16"
++    android:viewportHeight="16">
++
++    <path
++        android:pathData="M -1 -1 H 17 V 17 H -1 V -1 Z" />
++    <path
++        android:fillAlpha="0"
++        android:fillType="evenOdd"
++        android:strokeAlpha="0"
++        android:strokeWidth="1"
++        android:pathData="M 0 0 H 16 V 16 H 0 V 0 Z" />
++    <path
++        android:fillColor="@color/google_red_600"
++        android:fillType="evenOdd"
++        android:pathData="M0.5,14l15,0l-7.5,-13l-7.5,13l0,0zm8.5,-2l-2,0l0,-2l2,0l0,2l0,0zm0,-3l-2,0l0,-3l2,0l0,3l0,0z" />
++</vector>
 diff --git a/components/browser_ui/widget/android/java/res/layout/title_and_description_layout.xml b/components/browser_ui/widget/android/java/res/layout/title_and_description_layout.xml
 --- a/components/browser_ui/widget/android/java/res/layout/title_and_description_layout.xml
 +++ b/components/browser_ui/widget/android/java/res/layout/title_and_description_layout.xml
diff --git a/build/patches/User-agent-customization.patch b/build/patches/User-agent-customization.patch
index 01b74bd8..c93c4142 100644
--- a/build/patches/User-agent-customization.patch
+++ b/build/patches/User-agent-customization.patch
@@ -26,7 +26,7 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
  .../chromium/chrome/browser/tab/TabUtils.java |   8 +-
  .../browser/android/content/content_utils.cc  |  32 ++-
  .../preferences/browser_prefs_android.cc      |   7 +
- .../privacy_preferences_manager_impl.cc       | 126 ++++++++++++
+ .../privacy_preferences_manager_impl.cc       | 127 ++++++++++++
  ...ktop_site_web_contents_observer_android.cc |  11 +
  ...sktop_site_web_contents_observer_android.h |   2 +
  .../preferences/ChromePreferenceKeys.java     |   2 -
@@ -44,9 +44,9 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
  .../navigation_controller_android.h           |   1 +
  .../renderer_host/render_process_host_impl.cc |   1 +
  .../browser/web_contents/web_contents_impl.cc |   6 +-
- .../framehost/NavigationControllerImpl.java   |   3 +-
+ .../framehost/NavigationControllerImpl.java   |  17 +-
  content/renderer/render_thread_impl.cc        |   1 -
- 36 files changed, 803 insertions(+), 19 deletions(-)
+ 36 files changed, 811 insertions(+), 26 deletions(-)
  create mode 100644 chrome/android/java/res/layout/custom_useragent_preferences.xml
  create mode 100644 chrome/android/java/res/xml/useragent_preferences.xml
  create mode 100644 chrome/android/java/src/org/chromium/chrome/browser/settings/UserAgentPreferences.java
@@ -654,7 +654,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tab/TabImpl.jav
 +
 +            NavigationController navigationController = webContents.getNavigationController();
 +            navigationController.setUseDesktopUserAgent(
-+                usingDesktopUserAgent, !this.isNativePage(), UseDesktopUserAgentCaller.OTHER);
++                usingDesktopUserAgent, !this.isNativePage(), /*skipOnInitialNavigation*/ false);
 +        }
 +        else if (this.getPendingLoadParams() != null) {
 +            if (usingDesktopUserAgent) {
@@ -809,7 +809,7 @@ diff --git a/chrome/browser/android/preferences/privacy_preferences_manager_impl
  static jboolean JNI_PrivacyPreferencesManagerImpl_IsMetricsReportingEnabled(
      JNIEnv* env) {
    PrefService* local_state = g_browser_process->local_state();
-@@ -37,4 +63,104 @@ JNI_PrivacyPreferencesManagerImpl_IsMetricsReportingDisabledByPolicy(
+@@ -37,4 +63,105 @@ JNI_PrivacyPreferencesManagerImpl_IsMetricsReportingDisabledByPolicy(
           !local_state->GetBoolean(metrics::prefs::kMetricsReportingEnabled);
  }
  
@@ -838,6 +838,7 @@ diff --git a/chrome/browser/android/preferences/privacy_preferences_manager_impl
 +          /*user_agent*/ ua, /*metadata*/ blink::UserAgentMetadata(),
 +          cors_exempt_header_list,
 +          g_browser_process->GetOriginTrialsSettingsStorage()->GetSettings(),
++          ChromeContentBrowserClient().GetCpuPerformanceTier(),
 +          trace_id);
 +      }
 +    }
@@ -1324,6 +1325,27 @@ diff --git a/content/public/android/java/src/org/chromium/content/browser/frameh
                                      params.getInitiatorOrigin(),
                                      params.getHasUserGesture(),
                                      params.getShouldClearHistoryList(),
+@@ -266,13 +267,13 @@ import org.chromium.url.Origin;
+     public void setUseDesktopUserAgent(
+             boolean override, boolean reloadOnChange, boolean skipOnInitialNavigation) {
+         if (mNativeNavigationControllerAndroid != 0) {
+-            Log.i(
+-                    TAG,
+-                    "Thread dump for debugging, override: "
+-                            + override
+-                            + " reloadOnChange: "
+-                            + reloadOnChange);
+-            Thread.dumpStack();
++            // Log.i(
++            //         TAG,
++            //         "Thread dump for debugging, override: "
++            //                 + override
++            //                 + " reloadOnChange: "
++            //                 + reloadOnChange);
++            // Thread.dumpStack();
+ 
+             NavigationControllerImplJni.get()
+                     .setUseDesktopUserAgent(
 @@ -447,7 +448,7 @@ import org.chromium.url.Origin;
                  @Nullable String dataUrlAsString,
                  boolean canLoadLocalResources,
diff --git a/build/patches/bromite-build-utils.patch b/build/patches/bromite-build-utils.patch
index 3c9848d9..8ec63b3f 100644
--- a/build/patches/bromite-build-utils.patch
+++ b/build/patches/bromite-build-utils.patch
@@ -684,7 +684,7 @@ diff --git a/mojo/public/tools/mojom/mojom_parser.py b/mojo/public/tools/mojom/m
  
 +def _ResolveInclude(mojom_abspath, input_root_paths):
 +  mojom_abspath = _ResolveRelativeImportPath(mojom_abspath, mojom_abspath, input_root_paths)
-+  with codecs.open(mojom_abspath, encoding='utf-8') as f:
++  with open(mojom_abspath, encoding='utf-8') as f:
 +    src = f.read()
 +
 +    lines = src.splitlines();