[AUTO][FILECONTROL] - version 135.0.7049.42 (#1973)

[AUTO][FILECONTROL] - version 135.0.7049.42
2025-04-02 05:37:52 -03:00
parent 51e12980ba 8fd9667f72
commit 8157ce8a05
149 changed files with 3499 additions and 4010 deletions
@@ -1 +1 @@
-134.0.6998.108
+135.0.7049.42
@@ -215,7 +215,7 @@ std::string GetUserAgent() {
  // "Version/4.0" had been hardcoded in the legacy WebView.
  std::string product = "Version/4.0 " + GetProduct();
  if (base::CommandLine::ForCurrentProcess()->HasSwitch(
-          switches::kUseMobileUserAgent)) {
+          embedder_support::kUseMobileUserAgent)) {
    product += " Mobile";
  }

@@ -870,7 +870,7 @@ AwContentBrowserClient::CreateLoginDelegate(
    scoped_refptr<net::HttpResponseHeaders> response_headers,
    bool first_auth_attempt,
    content::GuestPageHolder* guest,
-    LoginAuthRequiredCallback auth_required_callback) {
+    content::LoginDelegate::LoginAuthRequiredCallback auth_required_callback) {
  return std::make_unique<AwHttpAuthHandler>(auth_info, web_contents,
                                             first_auth_attempt,
                                             std::move(auth_required_callback));
@@ -131,7 +131,7 @@ void AwFieldTrials::RegisterFeatureOverrides(base::FeatureList* feature_list) {
      blink::features::kLowLatencyWebGLImageChromium);

  // Disable Shared Storage on WebView.
-  aw_feature_overrides.DisableFeature(blink::features::kSharedStorageAPI);
+  aw_feature_overrides.DisableFeature(network::features::kSharedStorageAPI);

  // Disable scrollbar-color on WebView.
  aw_feature_overrides.DisableFeature(blink::features::kScrollbarColor);
@@ -306,7 +306,7 @@ void AwFieldTrials::RegisterFeatureOverrides(base::FeatureList* feature_list) {
      base::features::kPartitionAllocMemoryTagging);

  // Disable Topics on WebView.
-  aw_feature_overrides.DisableFeature(blink::features::kBrowsingTopics);
+  aw_feature_overrides.DisableFeature(network::features::kBrowsingTopics);

  // Sharing ANGLE's Vulkan queue is not supported on WebView.
  aw_feature_overrides.DisableFeature(::features::kVulkanFromANGLE);
@@ -315,4 +315,11 @@ void AwFieldTrials::RegisterFeatureOverrides(base::FeatureList* feature_list) {
  // a kill switch. https://crbug.com/393606977
  aw_feature_overrides.DisableFeature(
      internal::kFileSystemAccessDirectoryIterationBlocklistCheck);
+
+  // Viz has no internal differentiation for WebView. We will roll out these
+  // combined features separately.
+  aw_feature_overrides.DisableFeature(
+      ::features::kDrawImmediatelyWhenInteractive);
+  aw_feature_overrides.DisableFeature(
+      ::features::kAckOnSurfaceActivationWhenInteractive);
 }
@@ -31,8 +31,8 @@
 #include "base/time/time.h"
 #include "base/trace_event/trace_event.h"
 #include "build/build_config.h"
-#include "build/chromeos_buildflags.h"
 #include "chrome/browser/autocomplete/zero_suggest_cache_service_factory.h"
+#include "chrome/browser/autofill/autofill_entity_data_manager_factory.h"
 #include "chrome/browser/autofill/personal_data_manager_factory.h"
 #include "chrome/browser/autofill/strike_database_factory.h"
 #include "chrome/browser/bookmarks/bookmark_model_factory.h"
@@ -185,14 +185,12 @@
 #if !BUILDFLAG(IS_ANDROID)
 #include "chrome/browser/new_tab_page/microsoft_auth/microsoft_auth_service.h"
 #include "chrome/browser/new_tab_page/microsoft_auth/microsoft_auth_service_factory.h"
-#include "chrome/browser/user_annotations/user_annotations_service_factory.h"
 #include "chrome/browser/user_education/browser_user_education_storage_service.h"
 #include "chrome/browser/web_applications/web_app.h"
 #include "chrome/browser/web_applications/web_app_command_scheduler.h"
 #include "chrome/browser/web_applications/web_app_provider.h"
 #include "chrome/browser/web_applications/web_app_registrar.h"
 #include "chrome/browser/web_applications/web_app_utils.h"
-#include "components/user_annotations/user_annotations_service.h"
 #include "content/public/browser/isolated_web_apps_policy.h"
 #include "content/public/browser/storage_partition_config.h"
 #endif  // !BUILDFLAG(IS_ANDROID)
@@ -206,20 +204,20 @@
 #include "chrome/browser/extensions/activity_log/activity_log.h"
 #endif  // BUILDFLAG(ENABLE_EXTENSIONS)

-#if BUILDFLAG(IS_CHROMEOS_ASH)
+#if BUILDFLAG(IS_CHROMEOS)
 #include "chrome/browser/ash/net/system_proxy_manager.h"
 #include "chrome/browser/ash/profiles/profile_helper.h"
 #include "chrome/browser/browser_process_platform_part.h"
 #include "chromeos/ash/components/cryptohome/cryptohome_parameters.h"
 #include "chromeos/ash/components/dbus/attestation/attestation_client.h"
 #include "chromeos/ash/components/dbus/attestation/interface.pb.h"
-#include "chromeos/ash/components/dbus/constants/attestation_constants.h"  // nogncheck
-#include "chromeos/ash/components/dbus/dbus_thread_manager.h"  // nogncheck
+#include "chromeos/ash/components/dbus/constants/attestation_constants.h"
+#include "chromeos/ash/components/dbus/dbus_thread_manager.h"
 #include "chromeos/components/mahi/public/cpp/mahi_manager.h"
 #include "chromeos/constants/chromeos_features.h"
 #include "components/user_manager/user.h"
 #include "device/fido/cros/credential_store.h"
-#endif  // BUILDFLAG(IS_CHROMEOS_ASH)
+#endif  // BUILDFLAG(IS_CHROMEOS)

 #if BUILDFLAG(IS_WIN)
 #include "chrome/browser/media/cdm_document_service_impl.h"
@@ -897,6 +895,10 @@ void ChromeBrowsingDataRemoverDelegate::RemoveEmbedderData(
        ContentSettingsType::REVOKED_ABUSIVE_NOTIFICATION_PERMISSIONS,
        delete_begin_, delete_end_, website_settings_filter);

+    host_content_settings_map_->ClearSettingsForOneTypeWithPredicate(
+        ContentSettingsType::REVOKED_DISRUPTIVE_NOTIFICATION_PERMISSIONS,
+        delete_begin_, delete_end_, website_settings_filter);
+
    host_content_settings_map_->ClearSettingsForOneTypeWithPredicate(
        ContentSettingsType::NOTIFICATION_PERMISSION_REVIEW, delete_begin_,
        delete_end_, website_settings_filter);
@@ -970,7 +972,7 @@ void ChromeBrowsingDataRemoverDelegate::RemoveEmbedderData(
              TracingDataType::kSecurePaymentConfirmationCredentials));
    }

-#if BUILDFLAG(IS_CHROMEOS_ASH)
+#if BUILDFLAG(IS_CHROMEOS)
    if (ash::SystemProxyManager::Get()) {
      // Sends a request to the System-proxy daemon to clear the proxy user
      // credentials. System-proxy retrieves proxy username and password from
@@ -981,7 +983,7 @@ void ChromeBrowsingDataRemoverDelegate::RemoveEmbedderData(
      // them from the NetworkService when needed.
      ash::SystemProxyManager::Get()->ClearUserCredentials();
    }
-#endif  // BUILDFLAG(IS_CHROMEOS_ASH)
+#endif  // BUILDFLAG(IS_CHROMEOS)

    if (credential_store_) {
      credential_store_->DeleteCredentials(
@@ -1073,8 +1075,12 @@ void ChromeBrowsingDataRemoverDelegate::RemoveEmbedderData(
    if (web_data_service.get()) {
      web_data_service->RemoveFormElementsAddedBetween(delete_begin_,
                                                       delete_end_);
-      web_data_service->RemoveEntityInstancesModifiedBetween(delete_begin_,
-                                                             delete_end_);
+      if (autofill::EntityDataManager* entity_data_manager =
+              autofill::AutofillEntityDataManagerFactory::GetForProfile(
+                  profile_)) {
+        entity_data_manager->RemoveEntityInstancesModifiedBetween(delete_begin_,
+                                                                  delete_end_);
+      }
      // Clear out the Autofill StrikeDatabase in its entirety.
      // TODO(crbug.com/40594007): Respect |delete_begin_| and |delete_end_| and
      // only clear out entries whose last strikes were created in that
@@ -1096,13 +1102,6 @@ void ChromeBrowsingDataRemoverDelegate::RemoveEmbedderData(
          FROM_HERE, base::DoNothing(),
          CreateTaskCompletionClosure(TracingDataType::kAutofillData));
    }
-#if !BUILDFLAG(IS_ANDROID)
-    if (auto* user_annotations_service =
-            UserAnnotationsServiceFactory::GetForProfile(profile_)) {
-      user_annotations_service->RemoveAnnotationsInRange(delete_begin_,
-                                                         delete_end_);
-    }
-#endif
  }

  //////////////////////////////////////////////////////////////////////////////
@@ -1200,7 +1199,7 @@ void ChromeBrowsingDataRemoverDelegate::RemoveEmbedderData(
      }
    }

-#if BUILDFLAG(IS_CHROMEOS_ASH)
+#if BUILDFLAG(IS_CHROMEOS)
    // If the cache from the browser is cleared. Mahi should clear its cache.
    if (filter_builder->MatchesMostOriginsAndDomains() &&
        chromeos::features::IsMahiEnabled() && chromeos::MahiManager::Get()) {
@@ -1216,7 +1215,7 @@ void ChromeBrowsingDataRemoverDelegate::RemoveEmbedderData(
    // Licenses.
    base::RecordAction(UserMetricsAction("ClearBrowsingData_ContentLicenses"));

-#if BUILDFLAG(IS_CHROMEOS_ASH)
+#if BUILDFLAG(IS_CHROMEOS)
    // On Chrome OS, delete any content protection platform keys.
    // Platform keys do not support filtering by domain, so skip this if
    // clearing only a specified set of sites.
@@ -1249,7 +1248,7 @@ void ChromeBrowsingDataRemoverDelegate::RemoveEmbedderData(
                         std::move(clear_platform_keys_callback)));
      }
    }
-#endif  // BUILDFLAG(IS_CHROMEOS_ASH)
+#endif  // BUILDFLAG(IS_CHROMEOS)

 #if BUILDFLAG(IS_ANDROID)
    cdm::MediaDrmStorageImpl::ClearMatchingLicenses(
@@ -1749,7 +1748,7 @@ bool ChromeBrowsingDataRemoverDelegate::IsForAllTime() const {
  return delete_begin_ == base::Time() && delete_end_ == base::Time::Max();
 }

-#if BUILDFLAG(IS_CHROMEOS_ASH)
+#if BUILDFLAG(IS_CHROMEOS)
 void ChromeBrowsingDataRemoverDelegate::OnClearPlatformKeys(
    base::OnceClosure done,
    bool result) {
@@ -1761,7 +1760,7 @@ void ChromeBrowsingDataRemoverDelegate::OnClearPlatformKeys(
 std::unique_ptr<device::fido::PlatformCredentialStore>
 ChromeBrowsingDataRemoverDelegate::MakeCredentialStore() {
  return
-#if BUILDFLAG(IS_CHROMEOS_ASH)
+#if BUILDFLAG(IS_CHROMEOS)
      std::make_unique<
          device::fido::cros::PlatformAuthenticatorCredentialStore>();
 #else
@@ -58,6 +58,8 @@
 #include "chrome/browser/browsing_data/chrome_browsing_data_model_delegate.h"
 #include "chrome/browser/browsing_data/chrome_browsing_data_remover_constants.h"
 #include "chrome/browser/browsing_topics/browsing_topics_service_factory.h"
+#include "chrome/browser/btm/btm_browser_signin_detector.h"
+#include "chrome/browser/btm/stateful_bounce_counter.h"
 #include "chrome/browser/captive_portal/captive_portal_service_factory.h"
 #include "chrome/browser/child_process_host_flags.h"
 #include "chrome/browser/chrome_browser_main_extra_parts_nacl_deprecation.h"
@@ -71,8 +73,6 @@
 #include "chrome/browser/defaults.h"
 #include "chrome/browser/device_api/device_service_impl.h"
 #include "chrome/browser/device_api/managed_configuration_service.h"
-#include "chrome/browser/dips/dips_browser_signin_detector.h"
-#include "chrome/browser/dips/stateful_bounce_counter.h"
 #include "chrome/browser/download/chrome_download_manager_delegate.h"
 #include "chrome/browser/download/download_prefs.h"
 #include "chrome/browser/enterprise/browser_management/management_service_factory.h"
@@ -148,15 +148,11 @@
 #include "chrome/browser/renderer_host/chrome_navigation_ui_data.h"
 #include "chrome/browser/renderer_preferences_util.h"
 #include "chrome/browser/request_header_integrity/buildflags.h"
-#include "chrome/browser/safe_browsing/chrome_ping_manager_factory.h"
-#include "chrome/browser/safe_browsing/cloud_content_scanning/deep_scanning_utils.h"
-#include "chrome/browser/safe_browsing/delayed_warning_navigation_throttle.h"
-#include "chrome/browser/safe_browsing/safe_browsing_service.h"
 #include "chrome/browser/safe_browsing/url_checker_delegate_impl.h"
-#include "chrome/browser/safe_browsing/url_lookup_service_factory.h"
 #include "chrome/browser/search/search.h"
 #include "chrome/browser/search_engines/template_url_service_factory.h"
 #include "chrome/browser/segmentation_platform/chrome_browser_main_extra_parts_segmentation_platform.h"
+#include "chrome/browser/serial/chrome_serial_delegate.h"
 #include "chrome/browser/sharing/sms/sms_remote_fetcher.h"
 #include "chrome/browser/signin/chrome_signin_proxying_url_loader_factory.h"
 #include "chrome/browser/signin/chrome_signin_url_loader_throttle.h"
@@ -185,6 +181,7 @@
 #include "chrome/browser/ui/browser_navigator.h"
 #include "chrome/browser/ui/browser_navigator_params.h"
 #include "chrome/browser/ui/chrome_select_file_policy.h"
+#include "chrome/browser/ui/color/chrome_color_id.h"
 #include "chrome/browser/ui/lens/lens_overlay_side_panel_navigation_throttle.h"
 #include "chrome/browser/ui/login/http_auth_coordinator.h"
 #include "chrome/browser/ui/login/login_navigation_throttle.h"
@@ -303,7 +300,6 @@
 #include "components/safe_browsing/content/browser/async_check_tracker.h"
 #include "components/safe_browsing/content/browser/browser_url_loader_throttle.h"
 #include "components/safe_browsing/content/browser/password_protection/password_protection_commit_deferring_condition.h"
-#include "components/safe_browsing/content/browser/safe_browsing_navigation_throttle.h"
 #include "components/safe_browsing/content/browser/ui_manager.h"
 #include "components/safe_browsing/core/browser/hashprefix_realtime/hash_realtime_service.h"
 #include "components/safe_browsing/core/browser/realtime/policy_engine.h"
@@ -403,6 +399,7 @@
 #include "services/network/public/cpp/features.h"
 #include "services/network/public/cpp/is_potentially_trustworthy.h"
 #include "services/network/public/cpp/network_switches.h"
+#include "services/network/public/cpp/permissions_policy/permissions_policy_declaration.h"
 #include "services/network/public/cpp/resource_request.h"
 #include "services/network/public/cpp/self_deleting_url_loader_factory.h"
 #include "services/network/public/cpp/web_sandbox_flags.h"
@@ -415,7 +412,6 @@
 #include "third_party/blink/public/common/loader/url_loader_throttle.h"
 #include "third_party/blink/public/common/navigation/navigation_policy.h"
 #include "third_party/blink/public/common/permissions/permission_utils.h"
-#include "third_party/blink/public/common/permissions_policy/permissions_policy.h"
 #include "third_party/blink/public/common/switches.h"
 #include "third_party/blink/public/mojom/browsing_topics/browsing_topics.mojom.h"
 #include "third_party/blink/public/mojom/use_counter/metrics/web_feature.mojom.h"
@@ -425,6 +421,7 @@
 #include "ui/base/l10n/l10n_util.h"
 #include "ui/base/page_transition_types.h"
 #include "ui/base/resource/resource_bundle.h"
+#include "ui/color/color_provider.h"
 #include "ui/color/color_provider_key.h"
 #include "ui/gfx/switches.h"
 #include "ui/native_theme/native_theme.h"
@@ -476,7 +473,6 @@
 #include "chrome/browser/ash/arc/fileapi/arc_content_file_system_backend_delegate.h"
 #include "chrome/browser/ash/arc/fileapi/arc_documents_provider_backend_delegate.h"
 #include "chrome/browser/ash/boca/on_task/on_task_locked_session_navigation_throttle.h"
-#include "chrome/browser/ash/crosapi/browser_util.h"
 #include "chrome/browser/ash/drive/fileapi/drivefs_file_system_backend_delegate.h"
 #include "chrome/browser/ash/file_system_provider/fileapi/backend_delegate.h"
 #include "chrome/browser/ash/fileapi/external_file_url_loader_factory.h"
@@ -549,6 +545,7 @@

 #if !BUILDFLAG(IS_ANDROID)
 #include "chrome/browser/digital_credentials/digital_identity_provider_desktop.h"
+#include "chrome/browser/picture_in_picture/auto_picture_in_picture_tab_helper.h"
 #include "chrome/browser/preloading/preview/preview_navigation_throttle.h"
 #include "chrome/browser/ui/webui/ntp_microsoft_auth/ntp_microsoft_auth_response_capture_navigation_throttle.h"
 #include "chrome/browser/web_applications/isolated_web_apps/chrome_content_browser_client_isolated_web_apps_part.h"
@@ -560,6 +557,8 @@
 #endif  // !BUILDFLAG(IS_ANDROID)

 #if BUILDFLAG(IS_CHROMEOS)
+#include "ash/multi_capture/multi_capture_service.h"
+#include "ash/shell.h"
 #include "base/debug/leak_annotations.h"
 #include "chrome/browser/apps/app_service/app_install/app_install_navigation_throttle.h"
 #include "chrome/browser/apps/intent_helper/chromeos_disabled_apps_throttle.h"
@@ -571,12 +570,12 @@
 #include "chrome/browser/file_system_access/cloud_identifier/cloud_identifier_util_cros.h"
 #include "chrome/browser/policy/system_features_disable_list_policy_handler.h"
 #include "chrome/browser/smart_card/chromeos_smart_card_delegate.h"
+#include "chrome/browser/web_applications/chromeos_web_app_experiments.h"
 #include "chrome/browser/web_applications/web_app_tab_helper.h"
 #include "chrome/common/chromeos/extensions/chromeos_system_extension_info.h"
 #include "chromeos/ash/components/quickoffice/quickoffice_prefs.h"
 #include "chromeos/components/kiosk/kiosk_utils.h"
 #include "chromeos/constants/chromeos_features.h"
-#include "content/public/browser/chromeos/multi_capture_service.h"
 #include "third_party/cros_system_api/switches/chrome_switches.h"
 #endif

@@ -592,7 +591,6 @@
 #include "chrome/browser/page_info/web_view_side_panel_throttle.h"
 #include "chrome/browser/search/instant_service.h"
 #include "chrome/browser/search/instant_service_factory.h"
-#include "chrome/browser/serial/chrome_serial_delegate.h"
 #include "chrome/browser/ui/browser.h"
 #include "chrome/browser/ui/browser_dialogs.h"
 #include "chrome/browser/ui/browser_finder.h"
@@ -743,6 +741,12 @@
 #include "chrome/browser/safe_browsing/chrome_enterprise_url_lookup_service.h"
 #include "chrome/browser/safe_browsing/chrome_enterprise_url_lookup_service_factory.h"
 #include "chrome/browser/safe_browsing/chrome_password_protection_service.h"
+#include "chrome/browser/safe_browsing/chrome_ping_manager_factory.h"
+#include "chrome/browser/safe_browsing/cloud_content_scanning/deep_scanning_utils.h"
+#include "chrome/browser/safe_browsing/delayed_warning_navigation_throttle.h"
+#include "chrome/browser/safe_browsing/safe_browsing_service.h"
+#include "chrome/browser/safe_browsing/url_lookup_service_factory.h"
+#include "components/safe_browsing/content/browser/safe_browsing_navigation_throttle.h"
 #endif

 #if BUILDFLAG(ENABLE_OFFLINE_PAGES)
@@ -1345,25 +1349,28 @@ bool IsErrorPageAutoReloadEnabled() {
 void NotifyMultiCaptureStarted(const std::string& label,
                               content::WebContents* web_contents,
                               const webapps::AppId* app_id) {
-  if (app_id &&
-      video_capture::mojom::MultiCaptureServiceClient::Version_ >=
-          video_capture::mojom::MultiCaptureServiceClient::MethodMinVersions::
-              kMultiCaptureStartedFromAppMinVersion) {
-    content::GetMultiCaptureService().NotifyMultiCaptureStartedFromApp(
-        label, *app_id,
-        web_app::WebAppProvider::GetForWebContents(web_contents)
-            ->registrar_unsafe()
-            .GetAppShortName(*app_id));
+  if (app_id) {
+    CHECK_DEREF(ash::Shell::Get())
+        .multi_capture_service()
+        ->NotifyMultiCaptureStartedFromApp(
+            label, *app_id,
+            web_app::WebAppProvider::GetForWebContents(web_contents)
+                ->registrar_unsafe()
+                .GetAppShortName(*app_id));
  } else {
    // TODO(b/319317165): Remove this case once the pivot to web apps is
    // complete.
-    content::GetMultiCaptureService().NotifyMultiCaptureStarted(
-        label, url::Origin::Create(web_contents->GetLastCommittedURL()));
+    CHECK_DEREF(ash::Shell::Get())
+        .multi_capture_service()
+        ->NotifyMultiCaptureStarted(
+            label, url::Origin::Create(web_contents->GetLastCommittedURL()));
  }
 }

 void NotifyMultiCaptureStopped(const std::string& label) {
-  content::GetMultiCaptureService().NotifyMultiCaptureStopped(label);
+  CHECK_DEREF(ash::Shell::Get())
+      .multi_capture_service()
+      ->NotifyMultiCaptureStopped(label);
 }

 bool IsSubAppsPermissionGrantedByAdmins(content::WebContents* contents) {
@@ -1890,12 +1897,13 @@ ChromeContentBrowserClient::GetStoragePartitionConfigForSite(
 #if BUILDFLAG(ENABLE_EXTENSIONS)
  if (content::SiteIsolationPolicy::ShouldUrlUseApplicationIsolationLevel(
          browser_context, site)) {
-    CHECK(site.SchemeIs(chrome::kIsolatedAppScheme));
+    CHECK(url::Origin::Create(site).scheme() == chrome::kIsolatedAppScheme);
    ASSIGN_OR_RETURN(const auto iwa_url_info,
                     web_app::IsolatedWebAppUrlInfo::Create(site), [&](auto) {
                       LOG(ERROR) << "Invalid isolated-app URL: " << site;
                       return default_storage_partition_config;
                     });
+
    return iwa_url_info.storage_partition_config(browser_context);
  }
 #endif
@@ -2420,7 +2428,7 @@ size_t ChromeContentBrowserClient::GetProcessCountToIgnoreForLimit() {
 #endif
 }

-std::optional<blink::ParsedPermissionsPolicy>
+std::optional<network::ParsedPermissionsPolicy>
 ChromeContentBrowserClient::GetPermissionsPolicyForIsolatedWebApp(
    content::WebContents* web_contents,
    const url::Origin& app_origin) {
@@ -2440,13 +2448,13 @@ ChromeContentBrowserClient::GetPermissionsPolicyForIsolatedWebApp(
      registrar.FindAllAppsNestedInUrl(
          app_origin.GetURL(), web_app::WebAppFilter::InstalledInChrome());
  if (app_ids_for_origin.empty()) {
-    return blink::ParsedPermissionsPolicy();
+    return network::ParsedPermissionsPolicy();
  }

  return registrar.GetPermissionsPolicy(app_ids_for_origin[0]);
 #else
  NOTIMPLEMENTED();
-  return blink::ParsedPermissionsPolicy();
+  return network::ParsedPermissionsPolicy();
 #endif
 }

@@ -2819,7 +2827,7 @@ void ChromeContentBrowserClient::AppendExtraCommandLineSwitches(
      if (prefs->GetBoolean(policy::policy_prefs::
                                kForcePermissionPolicyUnloadDefaultEnabled)) {
        command_line->AppendSwitch(
-            blink::switches::kForcePermissionPolicyUnloadDefaultEnabled);
+            network::switches::kForcePermissionPolicyUnloadDefaultEnabled);
      }

      if (prefs->GetBoolean(prefs::kWebAudioOutputBufferingEnabled)) {
@@ -2902,19 +2910,23 @@ void ChromeContentBrowserClient::AppendExtraCommandLineSwitches(
 #endif  // BUILDFLAG(IS_ANDROID)

 #if !BUILDFLAG(IS_ANDROID)
-      // Make the {WebAuthenticationRemoteProxiedRequestsAllowed or
-      // WebAuthenticationRemoteDesktopAllowedOrigins} policy enable the
-      // experimental WebAuthenticationRemoteDesktopSupport Blink runtime
+      // Make the WebAuthenticationRemoteProxiedRequestsAllowed policy enable
+      // the experimental WebAuthenticationRemoteDesktopSupport Blink runtime
      // feature.
      if (prefs->GetBoolean(
-              webauthn::pref_names::kRemoteProxiedRequestsAllowed) ||
-          (base::FeatureList::IsEnabled(
-               device::kWebAuthnRemoteDesktopAllowedOriginsPolicy) &&
-           !prefs->GetList(webauthn::pref_names::kRemoteDesktopAllowedOrigins)
-                .empty())) {
+              webauthn::pref_names::kRemoteProxiedRequestsAllowed)) {
        command_line->AppendSwitch(switches::kWebAuthRemoteDesktopSupport);
      }
 #endif
+      // Make the WebAuthenticationRemoteDesktopAllowedOrigins policy enable the
+      // experimental WebAuthenticationRemoteDesktopSupport Blink runtime
+      // feature.
+      if (base::FeatureList::IsEnabled(
+              device::kWebAuthnRemoteDesktopAllowedOriginsPolicy) &&
+          !prefs->GetList(webauthn::pref_names::kRemoteDesktopAllowedOrigins)
+               .empty()) {
+        command_line->AppendSwitch(switches::kWebAuthRemoteDesktopSupport);
+      }
    }

    MaybeAppendBlinkSettingsSwitchForFieldTrial(browser_command_line,
@@ -3947,25 +3959,18 @@ bool UpdatePreferredColorScheme(WebPreferences* web_prefs,
  web_prefs->preferred_color_scheme =
      ToBlinkPreferredColorScheme(native_theme->GetPreferredColorScheme());

-  bool using_different_colored_frame = false;
  Profile* profile =
      Profile::FromBrowserContext(web_contents->GetBrowserContext());
  CHECK(profile);
-  if (ThemeService* theme_service =
-          ThemeServiceFactory::GetForProfile(profile)) {
-    using_different_colored_frame = !theme_service->UsingDefaultTheme() ||
-                                    theme_service->GetUserColor().has_value() ||
-                                    theme_service->UsingDeviceTheme();
-  }

-  // Update based on the ColorProvider associated with `web_contents`. Depends
-  // on the browser color mode settings and whether the user profile has set a
-  // custom coloring for the browser ui.
+  // Update the preferred root scrollbar color based on the lightness level of
+  // the toolbar's color.
  web_prefs->preferred_root_scrollbar_color_scheme =
-      web_contents->GetColorMode() == ui::ColorProviderKey::ColorMode::kLight ||
-              using_different_colored_frame
-          ? blink::mojom::PreferredColorScheme::kLight
-          : blink::mojom::PreferredColorScheme::kDark;
+      color_utils::IsDark(
+          web_contents->GetColorProvider().GetColor(kColorToolbar))
+          ? blink::mojom::PreferredColorScheme::kDark
+          : blink::mojom::PreferredColorScheme::kLight;
+
 #endif  // BUILDFLAG(IS_ANDROID)

 #if !BUILDFLAG(IS_ANDROID)
@@ -4290,6 +4295,10 @@ ChromeContentBrowserClient::GetTtsControllerDelegate() {
 void ChromeContentBrowserClient::MaybeOverrideManifest(
    content::RenderFrameHost* render_frame_host,
    blink::mojom::ManifestPtr& manifest) {
+#if BUILDFLAG(IS_CHROMEOS)
+  web_app::ChromeOsWebAppExperiments::MaybeOverrideManifest(render_frame_host,
+                                                            manifest);
+#endif
 #if !BUILDFLAG(IS_ANDROID)
  Profile* profile =
      Profile::FromBrowserContext(render_frame_host->GetBrowserContext());
@@ -5138,13 +5147,6 @@ void ChromeContentBrowserClient::SessionEnding(
 bool ChromeContentBrowserClient::ShouldEnableAudioProcessHighPriority() {
  return IsAudioProcessHighPriorityEnabled();
 }
-
-bool ChromeContentBrowserClient::ShouldUseFontDataManager(
-    const GURL& site_url) {
-  return IsTopChromeWebUIURL(site_url) &&
-         base::FeatureList::IsEnabled(features::kFontDataService);
-}
-
 #endif  // BUILDFLAG(IS_WIN)

 void ChromeContentBrowserClient::
@@ -5461,6 +5463,7 @@ ChromeContentBrowserClient::CreateThrottlesForNavigation(
      &throttles);
 #endif

+#if BUILDFLAG(SAFE_BROWSING_AVAILABLE)
  // g_browser_process->safe_browsing_service() may be null in unittests.
  safe_browsing::SafeBrowsingUIManager* ui_manager =
      g_browser_process->safe_browsing_service()
@@ -5476,6 +5479,7 @@ ChromeContentBrowserClient::CreateThrottlesForNavigation(
        std::make_unique<safe_browsing::DelayedWarningNavigationThrottle>(
            handle));
  }
+#endif

 #if BUILDFLAG(IS_WIN) || BUILDFLAG(IS_MAC) || BUILDFLAG(IS_LINUX)
  MaybeAddThrottle(browser_switcher::BrowserSwitcherNavigationThrottle::
@@ -5771,7 +5775,9 @@ bool ChromeContentBrowserClient::IsPluginAllowedToUseDevChannelAPIs(
 void ChromeContentBrowserClient::InitOnUIThread() {
  DCHECK_CURRENTLY_ON(BrowserThread::UI);

+#if BUILDFLAG(SAFE_BROWSING_AVAILABLE)
  safe_browsing_service_ = g_browser_process->safe_browsing_service();
+#endif

  // Initialize `network_contexts_parent_directory_`.
  base::FilePath user_data_dir;
@@ -5883,10 +5889,14 @@ ChromeContentBrowserClient::MaybeCreateSafeBrowsingURLLoaderThrottle(
  safe_browsing::RealTimeUrlLookupServiceBase* url_lookup_service =
      GetUrlLookupService(browser_context, is_enterprise_lookup_enabled,
                          is_consumer_lookup_enabled);
+#if BUILDFLAG(SAFE_BROWSING_AVAILABLE)
  safe_browsing::HashRealTimeService* hash_realtime_service =
      safe_browsing_service_
          ? safe_browsing_service_->GetHashRealTimeService(profile)
          : nullptr;
+#else
+  safe_browsing::HashRealTimeService* hash_realtime_service = nullptr;
+#endif
  safe_browsing::hash_realtime_utils::HashRealTimeSelection
      hash_realtime_selection =
          safe_browsing::hash_realtime_utils::DetermineHashRealTimeSelection(
@@ -6893,6 +6903,13 @@ content::UsbDelegate* ChromeContentBrowserClient::GetUsbDelegate() {
  return usb_delegate_.get();
 }

+content::SerialDelegate* ChromeContentBrowserClient::GetSerialDelegate() {
+  if (!serial_delegate_) {
+    serial_delegate_ = std::make_unique<ChromeSerialDelegate>();
+  }
+  return serial_delegate_.get();
+}
+
 content::PrivateNetworkDeviceDelegate*
 ChromeContentBrowserClient::GetPrivateNetworkDeviceDelegate() {
  if (!private_network_device_delegate_) {
@@ -6926,8 +6943,6 @@ bool ChromeContentBrowserClient::IsSecurityLevelAcceptableForWebAuthn(
      SecurityStateTabHelper::FromWebContents(web_contents);
  security_state::SecurityLevel security_level = helper->GetSecurityLevel();
  return security_level == security_state::SecurityLevel::SECURE ||
-         security_level ==
-             security_state::SecurityLevel::SECURE_WITH_POLICY_INSTALLED_CERT ||
         base::CommandLine::ForCurrentProcess()->HasSwitch(
             switches::kIgnoreCertificateErrors);
 }
@@ -6948,12 +6963,6 @@ void ChromeContentBrowserClient::CreateManagedConfigurationService(
                                          std::move(receiver));
 }

-content::SerialDelegate* ChromeContentBrowserClient::GetSerialDelegate() {
-  if (!serial_delegate_)
-    serial_delegate_ = std::make_unique<ChromeSerialDelegate>();
-  return serial_delegate_.get();
-}
-
 content::HidDelegate* ChromeContentBrowserClient::GetHidDelegate() {
  if (!hid_delegate_)
    hid_delegate_ = std::make_unique<ChromeHidDelegate>();
@@ -7012,7 +7021,7 @@ ChromeContentBrowserClient::CreateLoginDelegate(
    scoped_refptr<net::HttpResponseHeaders> response_headers,
    bool first_auth_attempt,
    content::GuestPageHolder* guest,
-    LoginAuthRequiredCallback auth_required_callback) {
+    content::LoginDelegate::LoginAuthRequiredCallback auth_required_callback) {
 #if BUILDFLAG(IS_CHROMEOS)
  // Negotiate challenge is handled via GSSAPI library, which can not receive
  // external credentials. However, on ChromeOS we can suggest the user to
@@ -7111,6 +7120,20 @@ ChromeContentBrowserClient::CreateWindowForVideoPictureInPicture(
  return content::VideoOverlayWindow::Create(controller);
 }

+media::PictureInPictureEventsInfo::AutoPipReason
+ChromeContentBrowserClient::GetAutoPipReason(
+    const content::WebContents& web_contents) const {
+#if BUILDFLAG(IS_ANDROID)
+  return media::PictureInPictureEventsInfo::AutoPipReason::kUnknown;
+#else
+  auto* auto_pip_tab_helper =
+      AutoPictureInPictureTabHelper::FromWebContents(&web_contents);
+  return auto_pip_tab_helper
+             ? auto_pip_tab_helper->GetAutoPipTriggerReason()
+             : media::PictureInPictureEventsInfo::AutoPipReason::kUnknown;
+#endif  // BUILDFLAG(IS_ANDROID)
+}
+
 void ChromeContentBrowserClient::RegisterRendererPreferenceWatcher(
    content::BrowserContext* browser_context,
    mojo::PendingRemote<blink::mojom::RendererPreferenceWatcher> watcher) {
@@ -7256,6 +7279,7 @@ ChromeContentBrowserClient::GetSafeBrowsingUrlCheckerDelegate(
  if (!safe_browsing_enabled_for_profile && !should_check_on_sb_disabled)
    return nullptr;

+#if BUILDFLAG(SAFE_BROWSING_AVAILABLE)
  // |safe_browsing_service_| may be unavailable in tests.
  if (safe_browsing_service_ && !safe_browsing_url_checker_delegate_) {
    safe_browsing_url_checker_delegate_ =
@@ -7263,6 +7287,7 @@ ChromeContentBrowserClient::GetSafeBrowsingUrlCheckerDelegate(
            safe_browsing_service_->database_manager(),
            safe_browsing_service_->ui_manager());
  }
+#endif

  // Update allowlist domains.
  if (safe_browsing_url_checker_delegate_) {
@@ -7278,6 +7303,7 @@ ChromeContentBrowserClient::GetUrlLookupService(
    content::BrowserContext* browser_context,
    bool is_enterprise_lookup_enabled,
    bool is_consumer_lookup_enabled) {
+#if BUILDFLAG(SAFE_BROWSING_AVAILABLE)
  // |safe_browsing_service_| may be unavailable in tests.
  if (!safe_browsing_service_) {
    return nullptr;
@@ -7291,6 +7317,7 @@ ChromeContentBrowserClient::GetUrlLookupService(
    return safe_browsing::RealTimeUrlLookupServiceFactory::GetForProfile(
        profile);
  }
+#endif
  return nullptr;
 }

@@ -7302,6 +7329,7 @@ ChromeContentBrowserClient::GetAsyncCheckTracker(
    safe_browsing::hash_realtime_utils::HashRealTimeSelection
        hash_realtime_selection,
    content::FrameTreeNodeId frame_tree_node_id) {
+#if BUILDFLAG(SAFE_BROWSING_AVAILABLE)
  content::WebContents* contents = wc_getter.Run();
  if (!contents || !safe_browsing_service_ ||
      !safe_browsing_service_->ui_manager()) {
@@ -7326,6 +7354,9 @@ ChromeContentBrowserClient::GetAsyncCheckTracker(
      contents, safe_browsing_service_->ui_manager().get(),
      safe_browsing::AsyncCheckTracker::
          IsPlatformEligibleForSyncCheckerCheckAllowlist());
+#else
+  return nullptr;
+#endif
 }

 void ChromeContentBrowserClient::ReportLegacyTechEvent(
@@ -8594,10 +8625,10 @@ bool ShouldBrowserContextEnableDips(content::BrowserContext* browser_context) {

 void ChromeContentBrowserClient::OnDipsServiceCreated(
    content::BrowserContext* browser_context,
-    content::BtmService* dips_service) {
+    content::BtmService* btm_service) {
  // Create BtmBrowserSigninDetector.
  CHECK(BtmBrowserSigninDetector::Get(browser_context));
-  dips::StatefulBounceCounter::CreateFor(dips_service);
+  btm::StatefulBounceCounter::CreateFor(btm_service);
 }

 static_assert(content::ContentBrowserClient::kDefaultDipsRemoveMask ==
@@ -8863,6 +8894,14 @@ ChromeContentBrowserClient::OverrideForInternalWebUI(content::WebUI* web_ui,
  return std::make_unique<InternalDebugPagesDisabledUI>(web_ui, url.host());
 }

+bool ChromeContentBrowserClient::ShouldEnableSubframeZoom() {
+#if BUILDFLAG(ENABLE_PDF)
+  return chrome_pdf::features::IsOopifPdfEnabled();
+#else
+  return false;
+#endif
+}
+
 #if BUILDFLAG(ENABLE_PDF)
 std::optional<network::CrossOriginEmbedderPolicy>
 ChromeContentBrowserClient::MaybeOverrideLocalURLCrossOriginEmbedderPolicy(
@@ -59,13 +59,7 @@
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/profiles/profile_key.h"
 #include "chrome/browser/resource_coordinator/tab_helper.h"
-#include "chrome/browser/safe_browsing/chrome_password_reuse_detection_manager_client.h"
-#include "chrome/browser/safe_browsing/chrome_safe_browsing_tab_observer_delegate.h"
 #include "chrome/browser/safe_browsing/safe_browsing_navigation_observer_manager_factory.h"
-#include "chrome/browser/safe_browsing/safe_browsing_service.h"
-#include "chrome/browser/safe_browsing/tailored_security/tailored_security_service_factory.h"
-#include "chrome/browser/safe_browsing/tailored_security/tailored_security_url_observer.h"
-#include "chrome/browser/safe_browsing/trigger_creator.h"
 #include "chrome/browser/sessions/session_tab_helper_factory.h"
 #include "chrome/browser/site_protection/site_protection_metrics_observer.h"
 #include "chrome/browser/ssl/chrome_security_blocking_page_factory.h"
@@ -145,7 +139,6 @@
 #include "components/permissions/permission_request_manager.h"
 #include "components/safe_browsing/content/browser/async_check_tracker.h"
 #include "components/safe_browsing/content/browser/safe_browsing_navigation_observer.h"
-#include "components/safe_browsing/content/browser/safe_browsing_tab_observer.h"
 #include "components/safe_browsing/core/common/features.h"
 #include "components/search/ntp_features.h"
 #include "components/site_engagement/content/site_engagement_helper.h"
@@ -184,6 +177,7 @@
 #include "chrome/browser/ui/javascript_dialogs/javascript_tab_modal_dialog_manager_delegate_android.h"
 #include "components/facilitated_payments/core/features/features.h"
 #include "components/fingerprinting_protection_filter/common/fingerprinting_protection_filter_features.h"
+#include "components/ip_protection/common/ip_protection_status.h"
 #include "components/sensitive_content/android/android_sensitive_content_client.h"
 #include "components/sensitive_content/features.h"
 #include "components/webapps/browser/android/app_banner_manager_android.h"
@@ -279,6 +273,16 @@
 #include "components/tpcd/enterprise_reporting/enterprise_reporting_tab_helper.h"
 #endif

+#if BUILDFLAG(SAFE_BROWSING_AVAILABLE)
+#include "chrome/browser/safe_browsing/chrome_password_reuse_detection_manager_client.h"
+#include "chrome/browser/safe_browsing/chrome_safe_browsing_tab_observer_delegate.h"
+#include "chrome/browser/safe_browsing/safe_browsing_service.h"
+#include "chrome/browser/safe_browsing/tailored_security/tailored_security_service_factory.h"
+#include "chrome/browser/safe_browsing/tailored_security/tailored_security_url_observer.h"
+#include "chrome/browser/safe_browsing/trigger_creator.h"
+#include "components/safe_browsing/content/browser/safe_browsing_tab_observer.h"
+#endif
+
 using content::WebContents;

 namespace {
@@ -355,6 +359,11 @@ void TabHelpers::AttachTabHelpers(WebContents* web_contents) {
        TrackingProtectionSettingsFactory::GetForProfile(profile),
        profile->IsIncognitoProfile());
  }
+
+  // Only create the IpProtectionStatus if the User Bypass feature is enabled.
+  if (net::features::kIpPrivacyEnableUserBypass.Get()) {
+    ip_protection::IpProtectionStatus::CreateForWebContents(web_contents);
+  }
 #endif  // BUILDFLAG(IS_ANDROID)
  if (breadcrumbs::IsEnabled(g_browser_process->local_state())) {
    BreadcrumbManagerTabHelper::CreateForWebContents(web_contents);
@@ -366,7 +375,9 @@ void TabHelpers::AttachTabHelpers(WebContents* web_contents) {
  if (!autofill_client_provider.uses_platform_autofill()) {
    ChromePasswordManagerClient::CreateForWebContents(web_contents);
  }
+#if BUILDFLAG(SAFE_BROWSING_AVAILABLE)
  ChromePasswordReuseDetectionManagerClient::CreateForWebContents(web_contents);
+#endif
  CreateSubresourceFilterWebContentsHelper(web_contents);
 #if BUILDFLAG(ENABLE_RLZ)
  ChromeRLZTrackerWebContentsObserver::CreateForWebContentsIfNeeded(
@@ -486,14 +497,17 @@ void TabHelpers::AttachTabHelpers(WebContents* web_contents) {
  //     See https://crbug.com/910288.
  resource_coordinator::ResourceCoordinatorTabHelper::CreateForWebContents(
      web_contents);
+#if BUILDFLAG(SAFE_BROWSING_AVAILABLE)
  safe_browsing::SafeBrowsingNavigationObserver::MaybeCreateForWebContents(
      web_contents, HostContentSettingsMapFactory::GetForProfile(profile),
      safe_browsing::SafeBrowsingNavigationObserverManagerFactory::
          GetForBrowserContext(profile),
      profile->GetPrefs(), g_browser_process->safe_browsing_service());
+#endif
  site_protection::SiteProtectionMetricsObserver::CreateForWebContents(
      web_contents);

+#if BUILDFLAG(SAFE_BROWSING_AVAILABLE)
  if (base::FeatureList::IsEnabled(
          safe_browsing::kTailoredSecurityIntegration)) {
    safe_browsing::TailoredSecurityUrlObserver::CreateForWebContents(
@@ -515,6 +529,7 @@ void TabHelpers::AttachTabHelpers(WebContents* web_contents) {
      std::make_unique<safe_browsing::ChromeSafeBrowsingTabObserverDelegate>());
  safe_browsing::TriggerCreator::MaybeCreateTriggersForWebContents(
      profile, web_contents);
+#endif  // BUILDFLAG(SAFE_BROWSING_AVAILABLE)
  SafetyTipWebContentsObserver::CreateForWebContents(web_contents);
  SearchEngineTabHelper::CreateForWebContents(web_contents);
  if (site_engagement::SiteEngagementService::IsEnabled()) {
@@ -5,7 +5,7 @@
 // API which provides support for ChromeOS Accessibility features in the
 // browser.

-[platforms=("chromeos", "lacros"),
+[platforms=("chromeos"),
  implemented_in="chrome/browser/chromeos/extensions/accessibility_service_private/accessibility_service_private.h"]

 namespace accessibilityServicePrivate {
@@ -134,6 +134,16 @@ namespace autofillPrivate {
    LOYALTY_MEMBERSHIP_PROGRAM,
    LOYALTY_MEMBERSHIP_PROVIDER,
    LOYALTY_MEMBERSHIP_ID,
+    VEHICLE_OWNER_TAG,
+    VEHICLE_LICENSE_PLATE,
+    VEHICLE_VIN,
+    VEHICLE_MAKE,
+    VEHICLE_MODEL,
+    DRIVERS_LICENSE_NAME_TAG,
+    DRIVERS_LICENSE_REGION,
+    DRIVERS_LICENSE_NUMBER,
+    DRIVERS_LICENSE_EXPIRATION_DATE_TAG,
+    DRIVERS_LICENSE_ISSUE_DATE_TAG,
    MAX_VALID_FIELD_TYPE
  };

@@ -308,14 +318,86 @@ namespace autofillPrivate {
    AutofillMetadata? metadata;
  };

-  // User annotations entry data. Corresponds to the eponymous message from
-  // components/optimization_guide/proto/features/common_quality_data.proto.
-  dictionary UserAnnotationsEntry {
-    long entryId;
-    DOMString key;
+  // Contains the attribute type name and other relevant information about the
+  // attribute type. It is part of the `EntityInstance` API.
+  dictionary AttributeType {
+    // Contains the value of an `AttributeTypeName` on the C++ side.
+    long typeName;
+    // The type name as a human readable string.
+    DOMString typeNameAsString;
+  };
+
+  // Contains the entity type name and other relevant information about the
+  // entity type. It is part of the `EntityInstance` API.
+  dictionary EntityType {
+    // Contains the value of an `EntityTypeName` on the C++ side.
+    long typeName;
+    // The type name as a human readable string.
+    DOMString typeNameAsString;
+    // The i18n string representation of "Add <entity>". Used in the entity
+    // adding settings UI. The string cannot be constructed dynamically,
+    // because the entity string might need declension in some languages.
+    DOMString addEntityString;
+    // The i18n string representation of "Edit <entity>". Used in the entity
+    // editing settings UI. The string cannot be constructed dynamically,
+    // because the entity string might need declension in some languages.
+    DOMString editEntityString;
+  };
+
+  // An attribute instance is a typed string value with additional metadata.
+  // It is associated with an `EntityInstance`.
+  dictionary AttributeInstance {
+    // Contains the attribute type name and other relevant information about the
+    // attribute type.
+    AttributeType type;
+    // The attribute value.
    DOMString value;
  };

+  // An entity instance entry which can be saved in the "Autofill with AI"
+  // section of the settings UI.
+  dictionary EntityInstance {
+    // Contains the entity type name and other relevant information about the
+    // entity type.
+    EntityType type;
+    // The attribute instances of this entity instance.
+    AttributeInstance[] attributes;
+    // The guid of the entity instance.
+    DOMString guid;
+    // The nickname of the entity instance.
+    DOMString nickname;
+  };
+
+  // Contains the minimum amount of information needed to display an entity
+  // instance, along with the guid. The guid is needed to retrieve the complete
+  // information of the entity instance.
+  dictionary EntityInstanceWithLabels {
+    // The guid of the entity instance.
+    DOMString guid;
+    // The enitity instance label.
+    DOMString entityLabel;
+    // The enitity instance sublabel.
+    DOMString entitySubLabel;
+  };
+
+  // A Pay Over Time Issuer entry which can be displayed in the autofill
+  // section of the settings UI.
+  dictionary PayOverTimeIssuerEntry {
+    // Unique identifier for the Pay Over Time issuer.
+    DOMString? issuerId;
+
+    // The Pay Over Time issuer's instrument ID from the GPay server,
+    // if applicable.
+    DOMString? instrumentId;
+
+    // The Pay Over Time issuer's display name.
+    DOMString? displayName;
+
+    // The Pay Over Time issuer image source.
+    DOMString? imageSrc;
+  };
+
+  callback VoidCallback = void();
  callback GetAccountInfoCallback = void(optional AccountInfo accountInfo);
  callback GetCountryListCallback = void(CountryEntry[] countries);
  callback GetAddressComponentsCallback = void(AddressComponents components);
@@ -325,10 +407,13 @@ namespace autofillPrivate {
  callback IsValidIbanCallback = void(boolean isValid);
  callback GetCreditCardCallback = void(optional CreditCardEntry card);
  callback CheckForDeviceAuthCallback = void(boolean isDeviceAuthAvailable);
-  callback GetUserAnnotationsEntriesCallback = void(UserAnnotationsEntry[] items);
-  callback hasUserAnnotationsEntriesCallback = void(boolean hasEntries);
  callback isUserEligibleForAutofillImprovementsCallback = void(boolean eligible);
-  callback annotationsBootstrappingCallback = void(boolean bootstrapped);
+  callback LoadEntityInstancesCallback = void(EntityInstanceWithLabels[] entries);
+  callback GetEntityInstanceByGuid = void(EntityInstance entity);
+  callback GetAllEntityTypesCallback = void(EntityType[] entities);
+  callback GetAllAttributeTypesForEntityCallback =
+      void(AttributeType[] attributes);
+  callback GetPayOverTimeIssuerListCallback = void(PayOverTimeIssuerEntry[] entries);

  interface Functions {
    // Gets currently signed-in user profile info, no value is returned if
@@ -388,12 +473,12 @@ namespace autofillPrivate {
        GetCreditCardListCallback callback);

    // Gets the list of IBANs.
-    // `callback`: Callback which will be called with the list of IBANs.
+    // |callback|: Callback which will be called with the list of IBANs.
    static void getIbanList(
        GetIbanListCallback callback);

    // Returns true if the given `ibanValue` is a valid IBAN.
-    // `callback`: Callback which will be called with the result of IBAN
+    // |callback|: Callback which will be called with the result of IBAN
    // validation.
    static void isValidIban(
        DOMString ibanValue, IsValidIbanCallback callback);
@@ -418,6 +503,12 @@ namespace autofillPrivate {
    // ids.
    static void removeVirtualCard(DOMString cardId);

+    // Gets the list of Pay Over Time Issuers.
+    // |callback|: Callback which will be called with the list of
+    //             Pay Over Time Issuers.
+    static void getPayOverTimeIssuerList(
+        GetPayOverTimeIssuerListCallback callback);
+
    // Authenticates the user via device authentication and if successful, it
    // will then flip the mandatory auth toggle.
    static void authenticateUserAndFlipMandatoryAuthToggle();
@@ -442,30 +533,38 @@ namespace autofillPrivate {
    // `syncer::UserSelectableType::kAutofill` in `SyncUserSettings`.
    static void setAutofillSyncToggleEnabled(boolean enabled);

-    // Returns the list of user annotations entries.
-    static void getUserAnnotationsEntries(
-        GetUserAnnotationsEntriesCallback callback);
-
-    // Returns if there are any saved user annotations entries.
-    static void hasUserAnnotationsEntries(
-        hasUserAnnotationsEntriesCallback callback);
-
    // Returns if the user is eligible for autofill improvements.
    static void isUserEligibleForAutofillImprovements(
        isUserEligibleForAutofillImprovementsCallback callback);

-    // Deletes the user annotations entry by its id.
-    static void deleteUserAnnotationsEntry(long entryId);
-
-    // Deletes all user annotations entries.
-    static void deleteAllUserAnnotationsEntries();
-
    // Notifies autofill client about the prediction improvements pre changing.
    static void predictionImprovementsIphFeatureUsed();

-    // Triggers bootstrapping of user annotations. Returns true if
-    // bootstrapping was successful (entries were added), false otherwise.
-    static void triggerAnnotationsBootstrapping(annotationsBootstrappingCallback callback);
+    // Adds a new entity instance if it doesn't exist yet. Otherwise, it updates
+    // the entity instance.
+    static void addOrUpdateEntityInstance(
+        EntityInstance entityInstance, optional VoidCallback callback);
+
+    // Deletes an entity instance by its guid.
+    static void removeEntityInstance(
+        DOMString guid, optional VoidCallback callback);
+
+    // Returns all of the user's entity instances with labels.
+    static void loadEntityInstances(LoadEntityInstancesCallback callback);
+
+    // Returns the entity instance by its guid.
+    static void getEntityInstanceByGuid(
+        DOMString guid, GetEntityInstanceByGuid callback);
+
+    // Returns a list of all possible entity types. Used for the user to decide
+    // what entity instance to add.
+    static void getAllEntityTypes(GetAllEntityTypesCallback callback);
+
+    // Returns a list of all possible attributes that can be set on an entity.
+    // Used for adding/editing a new entity instance.
+    static void getAllAttributeTypesForEntity(
+        long entityTypeName,
+        GetAllAttributeTypesForEntityCallback callback);
  };

  interface Events {
@@ -474,10 +573,12 @@ namespace autofillPrivate {
    // `addressEntries`: the updated list of addresses.
    // `creditCardEntries`: the updated list of credit cards.
    // `ibans`: the updated list of IBANs.
+    // `payOverTimeIssuers`: the updated list of Pay Over Time issuers
    // `accountInfo`: account info if the user is signed-in or no value if not.
    static void onPersonalDataChanged(AddressEntry[] addressEntries,
        CreditCardEntry[] creditCardEntries,
        IbanEntry[] ibans,
+        PayOverTimeIssuerEntry[] payOverTimeIssuers,
        optional AccountInfo accountInfo);
  };
 };
@@ -824,6 +824,14 @@ namespace autotestPrivate {

  callback OverrideOrcaResponseForTestingCallback = void(boolean success);

+  // Request data containing the mock responses from
+  // overrideScannerResponsesForTesting.
+  dictionary ScannerResponseArray {
+    DOMString[] responses;
+  };
+
+  callback OverrideScannerResponsesForTestingCallback = void(boolean success);
+
  interface Functions {
    // Must be called to allow autotestPrivateAPI events to be fired.
    static void initializeEvents();
@@ -1628,6 +1636,12 @@ namespace autotestPrivate {
        OrcaResponseArray array,
        OverrideOrcaResponseForTestingCallback callback);

+    // Overrides the response from Scanner Provider and returns the boolean
+    // value that indicates if the overriding is successful or not.
+    static void overrideScannerResponsesForTesting(
+        ScannerResponseArray array,
+        OverrideScannerResponsesForTestingCallback callback);
+
    // ARC set interactive enable/disable state.
    // |enabled|: Enable ARC interactive.
    // |callback|: Called when the operation sent to ARC by mojo.
@@ -5,6 +5,7 @@
 // developerPrivate API.
 // This is a private API exposing developing and debugging functionalities for
 // apps and extensions.
+[implemented_in = "chrome/browser/extensions/api/developer_private/developer_private_functions.h"]
 namespace developerPrivate {

  // DEPRECATED: Prefer ExtensionType.
@@ -252,10 +253,13 @@ namespace developerPrivate {
    DisableReasons disableReasons;
    AccessModifier errorCollection;
    AccessModifier fileAccess;
+    boolean fileAccessPendingChange;
    HomePage homePage;
    DOMString iconUrl;
    DOMString id;
    AccessModifier incognitoAccess;
+    AccessModifier userScriptsAccess;
+    boolean incognitoAccessPendingChange;
    DOMString[] installWarnings;
    boolean isCommandRegistrationHandledExternally;
    DOMString? launchUrl;
@@ -344,6 +348,7 @@ namespace developerPrivate {
    DOMString extensionId;
    boolean? fileAccess;
    boolean? incognitoAccess;
+    boolean? userScriptsAccess;
    boolean? errorCollection;
    HostAccess? hostAccess;
    boolean? showAccessRequestsInToolbar;
@@ -4,7 +4,7 @@

 // Use the <code>chrome.documentScan</code> API to discover and retrieve
 // images from attached document scanners.
-[platforms=("chromeos", "lacros"),
+[platforms=("chromeos"),
 implemented_in="chrome/browser/extensions/api/document_scan/document_scan_api.h"]
 namespace documentScan {
  dictionary ScanOptions {
@@ -6,7 +6,7 @@
 // settings for Kiosk sessions.
 // Note: This API is only available to extensions installed by enterprise
 // policy in ChromeOS Kiosk sessions.
-[platforms = ("chromeos", "lacros"),
+[platforms = ("chromeos"),
 implemented_in = "chrome/browser/extensions/api/enterprise_kiosk_input/enterprise_kiosk_input_api.h"]
 namespace enterprise.kioskInput {
  dictionary SetCurrentInputMethodOptions {
@@ -6,7 +6,7 @@
 // information about your current network.
 // Note: This API is only available to extensions force-installed by enterprise
 // policy.
-[platforms = ("chromeos", "lacros"),
+[platforms = ("chromeos"),
 implemented_in = "chrome/browser/extensions/api/enterprise_networking_attributes/enterprise_networking_attributes_api.h"]
 namespace enterprise.networkingAttributes {
  [noinline_doc] dictionary NetworkDetails {
@@ -6,7 +6,7 @@
 // install certificates for these keys. The certificates will be managed by the
 // platform and can be used for TLS authentication, network access or by other
 // extension through $(ref:platformKeys chrome.platformKeys).
-[platforms = ("chromeos", "lacros")]
+[platforms = ("chromeos")]
 namespace enterprise.platformKeys {
  [nocompile] dictionary Token {
    // Uniquely identifies this <code>Token</code>.
@@ -3,7 +3,7 @@
 // found in the LICENSE file.

 // Internal API for platform keys and certificate management.
-[ platforms = ("chromeos", "lacros"),
+[ platforms = ("chromeos"),
  implemented_in = "chrome/browser/extensions/api/enterprise_platform_keys/enterprise_platform_keys_api.h" ]
 namespace enterprise.platformKeysInternal {
  dictionary Hash {
@@ -107,14 +107,14 @@ namespace enterprise.reportingPrivate {

  // Captures the type of event so it can be associated with user or device in
  // Chrome for reporting purposes
-  [platforms = ("chromeos", "lacros")]
+  [platforms = ("chromeos")]
  enum EventType { DEVICE, USER };

  // Composite object that captures the information we need to report events.
  // Some fields like the record and priority are serialized to avoid any
  // dependency on proto definitions here, given the fact that they will likely
  // change in the future. These will be deserialized and validated in Chrome.
-  [platforms = ("chromeos", "lacros")]
+  [platforms = ("chromeos")]
  dictionary EnqueueRecordRequest {
    // Serialized record data binary based on the proto definition in
    // //components/reporting/proto/synced/record.proto.
@@ -389,7 +389,7 @@ namespace enterprise.reportingPrivate {
    // |request|: Composite object that captures everything
    // we need for uploading records.
    // |callback|: Callback that is triggered upon completion
-    [platforms = ("chromeos", "lacros")]
+    [platforms = ("chromeos")]
    static void enqueueRecord(
        EnqueueRecordRequest request,
        optional DoneCallback callback);
@@ -420,7 +420,7 @@ enum BulkPinStage {
 // It's usually MyFiles. When SkyVault is enabled the admin might
 // choose between Google Drive and OneDrive.
 // NOTE: This is independent of the Downloads folder which is mostly used
-// in the browser (lacros or ash).
+// in the browser.
 enum DefaultLocation {
  my_files,
  google_drive,
@@ -3,7 +3,7 @@
 // found in the LICENSE file.

 // Use the <code>chrome.login</code> API to launch and exit user sessions.
-[platforms=("chromeos", "lacros"),
+[platforms=("chromeos"),
 implemented_in="chrome/browser/chromeos/extensions/login_screen/login/login_api.h"]
 namespace login {
  callback VoidCallback = void ();
@@ -4,7 +4,7 @@

 // Use the <code>chrome.loginScreenStorage</code> API to store persistent data
 // from the login screen or inject data into the session.
-[platforms=("chromeos", "lacros"),
+[platforms=("chromeos"),
 implemented_in="chrome/browser/chromeos/extensions/login_screen/login_screen_storage/login_screen_storage_api.h"]
 namespace loginScreenStorage {
  callback StoreCallback = void ();
@@ -4,7 +4,7 @@

 // Use the <code>chrome.loginState</code> API to read and monitor the login
 // state.
-[platforms=("chromeos", "lacros"),
+[platforms=("chromeos"),
 implemented_in="chrome/browser/chromeos/extensions/login_screen/login_state/login_state_api.h"]
 namespace loginState {
  enum ProfileType {
@@ -4,17 +4,18 @@

 // Use the <code>chrome.printing</code> API to send print jobs to printers
 // installed on Chromebook.
-[platforms=("chromeos", "lacros"),
+[platforms=("chromeos"),
 implemented_in="chrome/browser/extensions/api/printing/printing_api.h"]
 namespace printing {
  dictionary SubmitJobRequest {
    // The print job to be submitted.
-    // The only supported content type is "application/pdf", and the
+    // Supported content types are "application/pdf" and "image/png". The
    // <a href="https://developers.google.com/cloud-print/docs/cdd#cjt">Cloud Job Ticket</a>
    // shouldn't include <code>FitToPageTicketItem</code>,
-    // <code>PageRangeTicketItem</code>, <code>ReverseOrderTicketItem</code>
-    // and <code>VendorTicketItem</code> fields since they are
-    // irrelevant for native printing. All other fields must be present.
+    // <code>PageRangeTicketItem</code> and <code>ReverseOrderTicketItem</code>
+    // fields since they are irrelevant for native printing.
+    // <code>VendorTicketItem</code> is optional. All other fields must be
+    // present.
    printerProvider.PrintJob job;

    // Used internally to store the blob uuid after parameter customization and
@@ -153,6 +154,7 @@ namespace printing {
  callback CancelJobCallback = void();
  callback GetPrintersCallback = void(Printer[] printers);
  callback GetPrinterInfoCallback = void(GetPrinterInfoResponse response);
+  callback getJobStatusCallback = void(JobStatus status);

  interface Functions {
    // Submits the job for printing. If the extension is not listed in
@@ -183,6 +185,14 @@ namespace printing {
    static void getPrinterInfo(
        DOMString printerId,
        GetPrinterInfoCallback callback);
+
+    // Returns the status of the print job. This call will fail with a runtime
+    // error if the print job with the given `jobId` doesn't exist.
+    // `jobId`: The id of the print job to return the status of. This should be
+    // the same id received in a $(ref:SubmitJobResponse).
+    static void getJobStatus(
+        DOMString jobId,
+        getJobStatusCallback callback);
  };

  interface Properties {
@@ -10,7 +10,7 @@
 // used for all lock screen settings.
 // Note: This API can not be used to actually unlock the device.

-[platforms=("chromeos", "lacros")]
+[platforms=("chromeos")]
 namespace quickUnlockPrivate {
  dictionary TokenInfo {
    // The authentication token that can be passed to $(ref:setModes) calls.
@@ -1,30 +0,0 @@
-// Copyright 2022 The Chromium Authors
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Used by gnubbyd in ash and lacros.  Stores small amounts of data in ash prefs
-// which is shared by ash and lacros versions of the extension.
-// TODO(b/231890240): Once Terminal SWA runs in lacros rather than ash, we can
-// migrate gnubbyd back to using chrome.storage.local and remove this private
-// API.
-[platforms=("chromeos", "lacros"),
- implemented_in="chrome/browser/extensions/api/shared_storage/shared_storage_private_api.h"]
-namespace sharedStoragePrivate {
-
-  callback GetCallback = void (object items);
-  callback SetCallback = void ();
-  callback RemoveCallback = void ();
-
-  interface Functions {
-    // Gets all items from shared extension local storage.
-    static void get(GetCallback callback);
-
-    // Sets given items into shared extension local storage.
-    static void set(object items, SetCallback callback);
-
-    // Removes item from shared extension local storage.
-    static void remove(
-        DOMString[] keys, RemoveCallback callback);
-  };
-};
-
@@ -11,7 +11,7 @@
 // [3] https://github.com/WICG/web-smart-card/blob/main/README.md#web-idl
 //
 // TODO(crbug.com/40247152): Add API for the remaining SCard* functions.
-[platforms=("chromeos", "lacros"),
+[platforms=("chromeos"),
 implemented_in="chrome/browser/chromeos/extensions/smart_card_provider_private/smart_card_provider_private_api.h"]
 namespace smartCardProviderPrivate {

@@ -4,7 +4,7 @@

 // Use the <code>chrome.systemLog</code> API to record Chrome system logs from
 // extensions.
-[platforms=("chromeos", "lacros"),
+[platforms=("chromeos"),
 implemented_in="chrome/browser/chromeos/extensions/system_log/system_log_api.h"]
 namespace systemLog {
  callback VoidCallback = void ();
@@ -3,7 +3,7 @@
 // found in the LICENSE file.

 // Private API for trusted extensions/apps to do desk related operations.
-[platforms=("chromeos","lacros"),
+[platforms=("chromeos"),
 implemented_in="chrome/browser/chromeos/extensions/wm/wm_desks_private_api.h"]
 namespace wmDesksPrivate {
  enum SavedDeskType {
@@ -1257,7 +1257,7 @@ policies:
  1256: PdfViewerOutOfProcessIframeEnabled
  1257: LockScreenAutoStartOnlineReauth
  1258: KeyboardFocusableScrollersEnabled
-  1259: ExtensibleEnterpriseSSOEnabled
+  1259: ExtensibleEnterpriseSSOBlocklist
  1260: CSSCustomStateDeprecatedSyntaxEnabled
  1261: MemorySaverModeSavings
  1262: KioskVisionTelemetryEnabled
@@ -1325,7 +1325,7 @@ policies:
  1324: WebRtcIPHandlingUrl
  1325: GenAIPhotoEditingSettings
  1326: PartitionedBlobUrlUsage
-  1327: GlicSettings
+  1327: ''
  1328: DefaultControlledFrameSetting
  1329: ControlledFrameAllowedForUrls
  1330: ControlledFrameBlockedForUrls
@@ -1333,6 +1333,9 @@ policies:
  1332: WebAuthenticationRemoteDesktopAllowedOrigins
  1333: ServiceWorkerToControlSrcdocIframeEnabled
  1334: ProvisionManagedClientCertificateForBrowser
+  1335: GeminiSettings
+  1336: GenAISmartGroupingSettings
+  1337: GenAiChromeOsSmartActionsSettings

 atomic_groups:
  1: Homepage
@@ -15,7 +15,7 @@ desc: |-
  If you must use the policy, please file a bug on crbug.com explaining your
  use case and CC {janiceliu, awillia}@chromium.org. The policy is scheduled to
  be offered through <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph>
-  version 138, after which the old implementation will be removed.
+  version 140, after which the old implementation will be removed.

  NOTE: Only newly-started renderer processes will reflect changes to this
  policy while the browser is running.
@@ -28,11 +28,6 @@ features:
  dynamic_refresh: true
  per_profile: true

-future_on:
- - chrome.*
- - chrome_os
- - android
-
 items:
 - caption: Partition Blob URLs during fetching and navigation.
  value: true
@@ -47,6 +42,11 @@ owners:
 schema:
  type: boolean

+supported_on:
+- chrome.*:135-
+- chrome_os:135-
+- android:135-
+
 tags: []

 type: main
@@ -61,6 +61,7 @@ features:
  dynamic_refresh: true
  per_profile: true
 future_on:
+- android
 - fuchsia
 owners:
 - finnur@chromium.org
@@ -0,0 +1,34 @@
+caption: Settings for Gemini integration
+desc: |-
+  Enables Gemini app integration
+
+  0/unset = Gemini integration will be available for users
+
+  1 = Gemini integration will not be available for users
+owners:
+- salg@google.com
+- ssid@chromium.org
+- file://components/policy/OWNERS
+example_value: 1
+future_on:
+- android
+- chrome.*
+- chrome_os
+features:
+  dynamic_refresh: true
+  per_profile: true
+type: int-enum
+schema:
+  type: integer
+  enum:
+  - 0
+  - 1
+items:
+- caption: Enable Gemini integration.
+  name: Enabled
+  value: 0
+- caption: Do not enable Gemini integration.
+  name: Disabled
+  value: 1
+default: 0
+tags: []
@@ -0,0 +1,43 @@
+caption: Settings for Generative AI Smart Grouping feature
+desc: |-
+  This policy controls the settings of the Generative AI Smart Grouping feature for <ph name="PRODUCT_OS_NAME">$1<ex>Google ChromeOS</ex></ph>.
+
+  0 = Allow the feature to be used, while allowing Google to use relevant data to improve its AI models. Relevant data may include prompts, inputs, outputs, source materials, and written feedback, depending on the feature. It may also be reviewed by humans to improve AI models. 0 is the default value, except when noted below.
+
+  1 = Allow the feature to be used, but does not allow Google to improve models using users' content (including prompts, inputs, outputs, source materials, and written feedback). 1 is the default value for Enterprise users managed by <ph name="GOOGLE_ADMIN_CONSOLE_PRODUCT_NAME">Google Admin console</ph> and for Education accounts managed by <ph name="GOOGLE_WORKSPACE_PRODUCT_NAME">Google Workspace</ph>.
+
+  2 = Do not allow the feature.
+
+  If the policy is unset, its behavior is determined by the <ph name="GEN_AI_DEFAULT_SETTINGS_POLICY_NAME">GenAiDefaultSettings</ph> policy.
+
+  For more information on data handling for generative AI features, please see https://support.google.com/chrome/a?p=generative_ai_settings.
+
+default: 0
+example_value: 2
+features:
+  dynamic_refresh: true
+  per_profile: true
+owners:
+- hctsai@google.com
+- hcyang@google.com
+- file://ash/wm/coral/OWNERS
+items:
+- caption: Allow Generative AI overview window grouping and improve AI models.
+  name: Allowed
+  value: 0
+- caption: Allow Generative AI overview window grouping without improving AI models.
+  name: AllowedWithoutLogging
+  value: 1
+- caption: Do not allow Generative AI overview window grouping.
+  name: Disabled
+  value: 2
+schema:
+  enum:
+  - 0
+  - 1
+  - 2
+  type: integer
+future_on:
+- chrome_os
+tags: []
+type: int-enum
@@ -0,0 +1,41 @@
+caption: Settings for Scanner feature
+desc: |-
+  This policy controls the settings of the Scanner feature for <ph name="PRODUCT_OS_NAME">$1<ex>Google ChromeOS</ex></ph>.
+
+  0 = Allow the feature to be used, while allowing Google to use relevant data to improve its AI models. Relevant data may include prompts, inputs, outputs, source materials, and written feedback, depending on the feature. It may also be reviewed by humans to improve AI models. 0 is the default value, except when noted below.
+
+  1 = Allow the feature to be used, but does not allow Google to improve models using users' content (including prompts, inputs, outputs, source materials, and written feedback). 1 is the default value for Enterprise users managed by <ph name="GOOGLE_ADMIN_CONSOLE_PRODUCT_NAME">Google Admin console</ph> and for Education accounts managed by <ph name="GOOGLE_WORKSPACE_PRODUCT_NAME">Google Workspace</ph>.
+
+  2 = Do not allow the feature.
+
+  If the policy is unset, its behavior is determined by the <ph name="GEN_AI_DEFAULT_SETTINGS_POLICY_NAME">GenAiDefaultSettings</ph> policy.
+
+  For more information on data handling for generative AI features, please see https://support.google.com/chrome/a?p=generative_ai_settings.
+
+default: 0
+example_value: 2
+features:
+  dynamic_refresh: true
+  per_profile: true
+owners:
+- file://ash/scanner/OWNERS
+items:
+- caption: Allow Scanner and improve AI models.
+  name: Allowed
+  value: 0
+- caption: Allow Scanner without improving AI models.
+  name: AllowedWithoutLogging
+  value: 1
+- caption: Do not allow Scanner.
+  name: Disabled
+  value: 2
+schema:
+  enum:
+  - 0
+  - 1
+  - 2
+  type: integer
+future_on:
+- chrome_os
+tags: []
+type: int-enum
@@ -28,7 +28,6 @@ features:
  per_profile: true
 future_on:
 - fuchsia
- ios
 items:
 - caption: No special restrictions. Default.
  name: DefaultDownloadSecurity
@@ -62,6 +61,7 @@ supported_on:
 - chrome.*:61-
 - chrome_os:61-
 - android:131-
+- ios:135-
 tags:
 - local-data-access
 type: int-enum
@@ -1,5 +1,7 @@
-caption: Enterprise search aggregator settings
+caption: Enterprise search aggregator settings (Beta)
 desc: |-
+  This is a beta feature. As this is a feature in development, available to our trusted testers, please be aware that it may undergo changes and updates.
+
  This policy allows administrators to set a designated enterprise search aggregator that will provide search recommendations and results within the address bar when triggered by a specific keyword. Users can initiate a search by typing the keyword specified in the <ph name="SHORTCUT_SEARCH_AGGREGATOR_SETTINGS_FIELD">shortcut</ph> field with or without the @ prefix (e.g. <ph name="SHORTCUT_EXAMPLE_SEARCH_AGGREGATOR_SETTINGS">@work</ph>), followed by Space or Tab, in the address bar.

  The following fields are required: <ph name="NAME_SEARCH_AGGREGATOR_SETTINGS_FIELD">name</ph>, <ph name="SHORTCUT_SEARCH_AGGREGATOR_SETTINGS_FIELD">shortcut</ph>, <ph name="SEARCH_URL_SEARCH_AGGREGATOR_SETTINGS_FIELD">search_url</ph>, <ph name="SUGGEST_URL_SEARCH_AGGREGATOR_SETTINGS_FIELD">suggest_url</ph>.
@@ -14,6 +16,8 @@ desc: |-

  The <ph name="ICON_URL_SEARCH_AGGREGATOR_SETTINGS_FIELD">icon_url</ph> field specifies the URL to an image that will be used on the search suggestions. A default icon will be used when this field is not set. It's recommended to use a favicon (example <ph name="ICON_URL_EXAMPLE">https://www.google.com/favicon.ico</ph>).

+  The <ph name="REQUIRE_SHORTCUT_SEARCH_AGGREGATOR_SETTINGS_FIELD">require_shortcut</ph> field specifies whether the address bar <ph name="SHORTCUT_SEARCH_AGGREGATOR_SETTINGS_FIELD">shortcut</ph> is required to see search recommendations. If this field is not set, the address bar <ph name="SHORTCUT_SEARCH_AGGREGATOR_SETTINGS_FIELD">shortcut</ph> is not required.
+
  On <ph name="MS_WIN_NAME">Microsoft® Windows®</ph>, this policy is only available on instances that are joined to a <ph name="MS_AD_NAME">Microsoft® Active Directory®</ph> domain, joined to <ph name="MS_AAD_NAME">Microsoft® Azure® Active Directory®</ph> or enrolled in <ph name="CHROME_ENTERPRISE_CORE_NAME">Chrome Enterprise Core</ph>.

  On <ph name="MAC_OS_NAME">macOS</ph>, this policy is only available on instances that are managed via MDM, joined to a domain via MCX or enrolled in <ph name="CHROME_ENTERPRISE_CORE_NAME">Chrome Enterprise Core</ph>.
@@ -24,11 +28,13 @@ example_value:
  search_url: https://www.aggregator.com/search?q=site%3Awikipedia.com+{searchTerms}
  suggest_url: https://www.aggregator.com/suggest?q={searchTerms}
  icon_url: https://www.google.com/favicon.ico
+  require_shortcut: true
 features:
  dynamic_refresh: true
  per_profile: true
 owners:
 - ftirelo@chromium.org
+- alexwchen@chromium.org
 - jdonnelly@chromium.org
 - mahmadi@chromium.org
 schema:
@@ -44,13 +50,15 @@ schema:
      type: string
    icon_url:
      type: string
+    require_shortcut:
+      type: boolean
  required:
  - name
  - shortcut
  - suggest_url
  - search_url
-future_on:
- chrome.*
- chrome_os
+supported_on:
+- chrome.*:135-
+- chrome_os:135-
 tags: []
 type: dict
@@ -3,28 +3,33 @@ caption: Disable download file type extension-based warnings for specified file
 desc: |-
  You can enable this policy to create a dictionary of file type extensions with a corresponding list of domains that will be exempted from file type extension-based download warnings. This lets enterprise administrators block file type extension-based download warnings for files that are associated with a listed domain. For example, if  the "jnlp" extension is associated with "website1.com", users would not see a warning when downloading "jnlp" files from "website1.com", but see a download warning when downloading "jnlp" files from "website2.com".

-        Files with file type extensions specified for domains identified by this policy will still be subject to non-file type extension-based security warnings such as mixed-content download warnings and Safe Browsing warnings.
+  Files with file type extensions specified for domains identified by this policy will still be subject to non-file type extension-based security warnings such as mixed-content download warnings and Safe Browsing warnings.

-        If you disable this policy or don't configure it, file types that trigger extension-based download warnings will show warnings to the user.
+  If you disable this policy or don't configure it, file types that trigger extension-based download warnings will show warnings to the user.

-        If you enable this policy:
+  If you enable this policy:

-        * The URL pattern should be formatted according to https://cloud.google.com/docs/chrome-enterprise/policies/url-patterns.
-        * The file type extension entered must be in lower-cased ASCII. The leading separator should not be included when listing the file type extension, so list "jnlp" should be used instead of ".jnlp".
+  * The URL pattern should be formatted according to https://cloud.google.com/docs/chrome-enterprise/policies/url-patterns.

-        Example:
+  * The file type extension entered must be in lower-cased ASCII. The leading separator should not be included when listing the file type extension, so list "jnlp" should be used instead of ".jnlp".

-        The following example value would prevent file type extension-based download warnings on swf, exe, and jnlp extensions for *.example.com domains. It will show the user a file type extension-based download warning on any other domain for exe and jnlp files, but not for swf files.
+  Example:

-        [
-          { "file_extension": "jnlp", "domains": ["example.com"] },
-          { "file_extension": "exe", "domains": ["example.com"] },
-          { "file_extension": "swf", "domains": ["*"] }
-        ]
+  The following example value would prevent file type extension-based download warnings on "exe" and "jnlp" extensions for *.example.com domains, and on "swf" extensions for all domains. It will show the user a file type extension-based download warning on any other domain for exe and jnlp files, but not for swf files.

-        Note that while the preceding example shows the suppression of file type extension-based download warnings for "swf" files for all domains, applying suppression of such warnings for all domains for any dangerous file type extension is not recommended due to security concerns. It is shown in the example merely to demonstrate the ability to do so.
+  [
+    { "file_extension": "jnlp", "domains": ["example.com"] },
+    { "file_extension": "exe", "domains": ["example.com"] },
+    { "file_extension": "swf", "domains": ["*"] }
+  ]

-        If this policy is enabled alongside <ph name="DOWNLOAD_RESTRICTIONS_POLICY_NAME">DownloadRestrictions</ph> and DownloadRestrictions is set to block dangerous file types, download blocks determined by DownloadRestrictions take precedence. For example, if this policy is set to enable "exe" extension downloads from "website1.com", and DownloadRestrictions is set to block malicious downloads and dangerous file types, then "exe" extension downloads will still be blocked in all domains. If DownloadRestrictions is not set to block dangerous file types, then file types specified in this policy will be exempted from file-type extension-based download warnings in the specified domains. Read more about DownloadRestrictions (https://chromeenterprise.google/policies/?policy=DownloadRestrictions).
+  Note that while the preceding example shows the suppression of file type extension-based download warnings for "swf" files for all domains, applying suppression of such warnings for all domains for any dangerous file type extension is not recommended due to security concerns. It is shown in the example merely to demonstrate the ability to do so.
+
+  If this policy is enabled alongside <ph name="DOWNLOAD_RESTRICTIONS_POLICY_NAME">DownloadRestrictions</ph>, then the exemptions to file type extension-based warnings specified by this policy take precedence over a <ph name="DOWNLOAD_RESTRICTIONS_POLICY_NAME">DownloadRestrictions</ph> setting that would block dangerous file types. The exemptions specified by this policy only apply to the "block dangerous file types" behavior specified by values 1 and 2 of <ph name="DOWNLOAD_RESTRICTIONS_POLICY_NAME">DownloadRestrictions</ph>.
+
+  For example, if this policy specifies an exemption for "exe" downloads from "website1.com", and <ph name="DOWNLOAD_RESTRICTIONS_POLICY_NAME">DownloadRestrictions</ph> is set to block malicious downloads and dangerous file types (value 1), then "exe" downloads from "website1.com" will be exempt from file type extension-based blocking but will still be blocked if they are malicious.
+
+  More information about <ph name="DOWNLOAD_RESTRICTIONS_POLICY_NAME">DownloadRestrictions</ph> can be found at https://chromeenterprise.google/policies/?policy=DownloadRestrictions.
 example_value:
 - domains:
  - https://example.com
@@ -40,7 +45,7 @@ features:
 future_on:
 - fuchsia
 owners:
- flowerhorne@google.com
+- chlily@chromium.org
 schema:
  items:
    $ref: DomainFiletypePair
@@ -18,7 +18,7 @@ schema:
  items:
    $ref: UsbDeviceId
  type: array
-future_on:
- chrome_os
+supported_on:
+- chrome_os:135-
 tags: []
 type: dict
@@ -1,32 +0,0 @@
-caption: Control <ph name="GLIC">Glic</ph> access
-desc: |-
-  If this policy is Enabled or not set, users are able to use the
-  <ph name="GLIC">Glic</ph> feature. Setting this policy to Disabled prevents
-  users from interacting with <ph name="GLIC">Glic</ph>; the button in the tab
-  strip is hidden and <ph name="GLIC">Glic</ph> is unavailable via keyboard
-  shortcut unless enabled in another profile.
-owners:
- bokan@chromium.org
- file://chrome/browser/glic/OWNERS
-example_value: 0
-future_on:
- chrome.*
-features:
-  dynamic_refresh: true
-  per_profile: true
-type: int-enum
-schema:
-  type: integer
-  enum:
-  - 0
-  - 1
-items:
- caption: Enable use of <ph name="GLIC">Glic</ph>
-  name: Enabled
-  value: 0
- caption: Disable use of <ph name="GLIC">Glic</ph>.
-  name: Disabled
-  value: 1
-default: 0
-tags:
- google-sharing
@@ -62,6 +62,36 @@ items:
 - caption: Recorder (supported since version 130)
  name: recorder
  value: recorder
+- caption: Gmail (supported since version 135)
+  name: gmail
+  value: gmail
+- caption: Google Docs (supported since version 135)
+  name: google_docs
+  value: google_docs
+- caption: Google Slides (supported since version 135)
+  name: google_slides
+  value: google_slides
+- caption: Google Sheets (supported since version 135)
+  name: google_sheets
+  value: google_sheets
+- caption: Google Drive (supported since version 135)
+  name: google_drive
+  value: google_drive
+- caption: Google Keep (supported since version 135)
+  name: google_keep
+  value: google_keep
+- caption: Google Calendar (supported since version 135)
+  name: google_calendar
+  value: google_calendar
+- caption: Google Chat (supported since version 135)
+  name: google_chat
+  value: google_chat
+- caption: YouTube (supported since version 135)
+  name: youtube
+  value: youtube
+- caption: Google Maps (supported since version 135)
+  name: google_maps
+  value: google_maps
 owners:
 - file://components/policy/OWNERS
 - ayaelattar@chromium.org
@@ -82,6 +112,16 @@ schema:
    - print_jobs
    - key_shortcuts
    - recorder
+    - gmail
+    - google_docs
+    - google_slides
+    - google_sheets
+    - google_drive
+    - google_keep
+    - google_calendar
+    - google_chat
+    - youtube
+    - google_maps
    type: string
  type: array
 supported_on:
@@ -21,6 +21,6 @@ owners:
 schema:
  type: boolean
 supported_on:
- chrome.win:65-
+- chrome.win:65-135
 tags: []
 type: main
@@ -16,6 +16,7 @@ features:
 future_on:
 - chrome.*
 - chrome_os
+- android
 example_value:
 - https://remotedesktop.google.com
 - https://vdi.corp.example
@@ -0,0 +1,49 @@
+caption: Blocklist of identity providers that cannot use Extensible Enterprise SSO for the browser
+
+desc: |-
+  Disable single sign-on using <ph name="EXTENSIBLE_ENTERPRISE_SSO_PRODUCT_NAME">Extensible Enterprise SSO</ph> for the listed identity providers.
+
+  By adding the value <ph name="POLICY_VALUE_ALL">'all'</ph>, all supported identity providers for SSO are disabled.
+
+  By adding the value <ph name="POLICY_VALUE_MICROSOFT">'microsoft'</ph>, support for single sign-on for Microsoft® cloud identity provider in Chrome is disabled.
+
+  By leaving this policy unset, all identity providers that are supported by <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> will be enabled.
+
+  For identity providers that are enabled in <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> and configured on the device the administrator, users who sign into their once using that identity provider, on any application that supports <ph name="EXTENSIBLE_ENTERPRISE_SSO_PRODUCT_NAME">Extensible Enterprise SSO</ph>, can be signed into web properties using that identity provider automatically. Information pertaining to the user's authencitation information is transmitted to the user's cloud identity provider for each authentication event.
+
+  Notes:
+
+  <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> does not support Single Sign-on using <ph name="EXTENSIBLE_ENTERPRISE_SSO_PRODUCT_NAME">Extensible Enterprise SSO</ph> in Incognito or Guest modes.
+
+  <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> only supports Single Sign-on using <ph name="EXTENSIBLE_ENTERPRISE_SSO_PRODUCT_NAME">Extensible Enterprise SSO</ph> for the following identity providers: Microsoft.
+
+  This feature is available starting in <ph name="MAC_OS_NAME">macOS</ph> 10.15.
+
+owners:
+- ydago@chromium.org
+- file://components/policy/OWNERS
+
+supported_on:
+- chrome.mac:135-
+
+features:
+  dynamic_refresh: true
+  per_profile: false
+type: string-enum-list
+schema:
+  items:
+    enum:
+    - all
+    - microsoft
+    type: string
+  type: array
+items:
+- caption: All identity providers
+  name: all
+  value: all
+- caption: Microsoft® cloud identity provider
+  name: microsoft
+  value: microsoft
+example_value:
+- all
+tags: []
@@ -1,37 +0,0 @@
-owners:
- ydago@chromium.org
- file://components/policy/OWNERS
-caption: Enable extensible Enterprise SSO support
-desc: |-
-  Configures automatic user sign-in for accounts with authentication providers by an Enterprise SSO Extension.
-
-  By setting this policy to 1 (<ph name="POLICY_VALUE_ENABLED">Enabled</ph>) or leaving it unset, authentication providers with an SSO extension on the device will use that extension to authenticate users trying to sign in.
-
-  By setting this policy to 0 (<ph name="POLICY_VALUE_DISABLED">Disabled</ph>), automatic sign-in as described above is disabled.
-
-  This feature is available starting in MacOS Catalina.
-
-  Note: This policy doesn't apply to Incognito or Guest modes.
-future_on:
- chrome.mac
-
-features:
-  dynamic_refresh: true
-  per_profile: false
-type: int-enum
-schema:
-  enum:
-  - 0
-  - 1
-  type: integer
-items:
- caption: Disable extensible Enterprise SSO support
-  name: Disabled
-  value: 0
- caption: Enable extensible Enterprise SSO support
-  name: Enabled
-  value: 1
-
-default: 1
-example_value: 0
-tags: []
@@ -69,14 +69,14 @@
 #include "content/browser/browser_main_loop.h"
 #include "content/browser/browser_plugin/browser_plugin_embedder.h"
 #include "content/browser/browser_plugin/browser_plugin_guest.h"
+#include "content/browser/btm/btm_bounce_detector.h"
+#include "content/browser/btm/btm_navigation_flow_detector.h"
 #include "content/browser/child_process_security_policy_impl.h"
 #include "content/browser/closewatcher/close_listener_manager.h"
 #include "content/browser/compositor/surface_utils.h"
 #include "content/browser/device_posture/device_posture_provider_impl.h"
 #include "content/browser/devtools/protocol/page_handler.h"
 #include "content/browser/devtools/render_frame_devtools_agent_host.h"
-#include "content/browser/dips/dips_bounce_detector.h"
-#include "content/browser/dips/dips_navigation_flow_detector.h"
 #include "content/browser/display_cutout/display_cutout_host_impl.h"
 #include "content/browser/dom_storage/dom_storage_context_wrapper.h"
 #include "content/browser/dom_storage/session_storage_namespace_impl.h"
@@ -177,6 +177,7 @@
 #include "partition_alloc/buildflags.h"
 #include "ppapi/buildflags/buildflags.h"
 #include "services/device/public/mojom/wake_lock.mojom.h"
+#include "services/network/public/cpp/features.h"
 #include "services/network/public/cpp/request_destination.h"
 #include "services/network/public/cpp/web_sandbox_flags.h"
 #include "services/network/public/mojom/network_context.mojom.h"
@@ -711,6 +712,14 @@ void RecordRendererUnresponsiveMetrics(
      rph_priority);
 }

+// Helper function to simplify getting the correct HostZoomMapImpl for a
+// RenderFrameHost. Implemented here to be close to its only consumer,
+// GetPendingZoomLevel().
+HostZoomMapImpl* HostZoomMapForRenderFrameHost(const RenderFrameHost* rfh) {
+  return static_cast<HostZoomMapImpl*>(
+      HostZoomMap::Get(rfh->GetSiteInstance()));
+}
+
 }  // namespace

 // This is a small helper class created while a JavaScript dialog is showing
@@ -1311,18 +1320,31 @@ WebContentsImpl::WebContentsImpl(BrowserContext* browser_context)
      std::make_unique<ScreenChangeMonitor>(base::BindRepeating(
          &WebContentsImpl::OnScreensChange, base::Unretained(this)));

-  if (base::FeatureList::IsEnabled(blink::features::kSharedStorageAPI)) {
+  if (base::FeatureList::IsEnabled(network::features::kSharedStorageAPI)) {
    SharedStorageBudgetCharger::CreateForWebContents(this);
  }

  if (input::IsTransferInputToVizSupported()) {
-    GetHostFrameSinkManager()->SetupRenderInputRouterDelegateConnection(
-        compositor_frame_sink_grouping_id_,
-        rir_delegate_client_receiver_.BindNewPipeAndPassRemote(),
-        rir_delegate_remote_.BindNewPipeAndPassReceiver());
+    SetupRenderInputRouterDelegateConnection();
  }
 }

+void WebContentsImpl::SetupRenderInputRouterDelegateConnection() {
+  // Handles setting up GPU mojo endpoint connections. In general, the number of
+  // retries for setting up these mojo connections is capped by the maximum
+  // number of attempts to restart the GPU process, see
+  // GpuProcessHost::GetFallbackCrashLimit().
+  rir_delegate_client_receiver_.reset();
+  rir_delegate_remote_.reset();
+  GetHostFrameSinkManager()->SetupRenderInputRouterDelegateConnection(
+      compositor_frame_sink_grouping_id_,
+      rir_delegate_client_receiver_.BindNewPipeAndPassRemote(),
+      rir_delegate_remote_.BindNewPipeAndPassReceiver());
+  rir_delegate_client_receiver_.set_disconnect_handler(
+      base::BindOnce(&WebContentsImpl::SetupRenderInputRouterDelegateConnection,
+                     weak_factory_.GetWeakPtr()));
+}
+
 WebContentsImpl::~WebContentsImpl() {
  TRACE_EVENT0("content", "WebContentsImpl::~WebContentsImpl");
  WebContentsOfBrowserContext::Detach(*this);
@@ -2243,12 +2265,9 @@ void WebContentsImpl::UpdateZoomIfNecessary(const std::string& scheme,
                                            RenderFrameHostImpl* rfh) {
  OPTIONAL_TRACE_EVENT2("content", "WebContentsImpl::UpdateZoomIfNecessary",
                        "scheme", scheme, "host", host);
-  NavigationEntry* entry = rfh->GetController().GetLastCommittedEntry();
-  if (!entry) {
-    return;
-  }

-  GURL url = HostZoomMap::GetURLFromEntry(entry);
+  // The following code expects that rfh has its own independent zoom.
+  GURL url = HostZoomMap::GetURLForRenderFrameHost(rfh->GetGlobalId());
  if (host != net::GetHostOrSpecFromURL(url) ||
      (!scheme.empty() && !url.SchemeIs(scheme))) {
    return;
@@ -3502,6 +3521,18 @@ const blink::web_pref::WebPreferences WebContentsImpl::ComputeWebPreferences(

 #if BUILDFLAG(IS_ANDROID)
  prefs.long_press_link_select_text = long_press_link_select_text_;
+
+  if (base::FeatureList::IsEnabled(
+          features::kRestrictOrientationLockToPhones)) {
+    // Only lock fullscreen orientation if the provider allows it, and if the
+    // prefs currently want to do so.  While current behavior happens to match
+    // exactly with the provider claiming to support orientation lock, we still
+    // want to give the cache the opportunity to turn it off for other reasons.
+    // For example, if a foldable is folded, then the prefs cache should notify
+    // us that the behavior may have changed.
+    prefs.video_fullscreen_orientation_lock_enabled &=
+        screen_orientation_provider_->IsOrientationLockSupported();
+  }
 #endif

 #if BUILDFLAG(IS_ANDROID)
@@ -3726,7 +3757,7 @@ void WebContentsImpl::OnVibrate(RenderFrameHostImpl* rfh) {
  observers_.NotifyObservers(&WebContentsObserver::VibrationRequested);
 }

-std::optional<blink::ParsedPermissionsPolicy>
+std::optional<network::ParsedPermissionsPolicy>
 WebContentsImpl::GetPermissionsPolicyForIsolatedWebApp(
    RenderFrameHostImpl* source) {
  WebExposedIsolationInfo weii =
@@ -4087,6 +4118,12 @@ void WebContentsImpl::RenderWidgetWasResized(
                             width_changed);
 }

+bool WebContentsImpl::PreHandleMouseEvent(const blink::WebMouseEvent& event) {
+  OPTIONAL_TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("content.verbose"),
+                        "WebContentsImpl::PreHandleMouseEvent");
+  return delegate_ ? delegate_->PreHandleMouseEvent(this, event) : false;
+}
+
 KeyboardEventProcessingResult WebContentsImpl::PreHandleKeyboardEvent(
    const input::NativeWebKeyboardEvent& event) {
  OPTIONAL_TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("content.verbose"),
@@ -7151,6 +7188,15 @@ void WebContentsImpl::OnFirstContentfulPaintInPrimaryMainFrame() {
      &WebContentsObserver::OnFirstContentfulPaintInPrimaryMainFrame);
 }

+gfx::NativeWindow WebContentsImpl::GetOwnerNativeWindow() {
+  return GetTopLevelNativeWindow();
+}
+
+media::PictureInPictureEventsInfo::AutoPipReason
+WebContentsImpl::GetAutoPipReason() const {
+  return GetContentClient()->browser()->GetAutoPipReason(*this);
+}
+
 void WebContentsImpl::NotifyChangedNavigationState(
    InvalidateTypes changed_flags) {
  NotifyNavigationStateChanged(changed_flags);
@@ -8656,15 +8702,35 @@ void WebContentsImpl::RunFileChooser(
 }

 double WebContentsImpl::GetPendingZoomLevel(RenderWidgetHostImpl* rwh) {
-  // TODO(372932834): This needs to be modified for the PDF-in-OOPIF case, as
-  // while the PDF will have its own RenderWidgetHost, the associated
-  // RenderFrameHost won't always be at the root of a FrameTree (and the
-  // FrameTree won't be of type kGuest).
-  // Note: this could involve (something like) detecting that the rfh for `rwh`
-  // is *not* a frame-tree root, but *does* have a temporary zoom level set in
-  // HostZoomMap.
-  RenderFrameHostImpl* rfh =
-      rwh->frame_tree()->root()->current_frame_host()->GetOutermostMainFrame();
+  RenderFrameHostImpl* rfh = nullptr;
+  // Find the RenderFrameHost for `rwh`.
+  ForEachRenderFrameHostImplWithAction(
+      [rwh, &rfh](RenderFrameHostImpl* render_frame_host) {
+        if (render_frame_host->GetRenderWidgetHost() == rwh) {
+          rfh = render_frame_host;
+          return RenderFrameHost::FrameIterationAction::kStop;
+        }
+        return RenderFrameHost::FrameIterationAction::kContinue;
+      });
+
+  if (rfh) {
+    // Find nearest ancestor that has independent zoom.
+    // Use GetParentOrOuterDocument() instead of GetParent() in order
+    // to "step out of" any fenced frames that are encountered.
+    while (!HostZoomMapForRenderFrameHost(rfh)->IsIndependentZoomFrameTreeNode(
+               rfh->GetFrameTreeNodeId()) &&
+           rfh->GetParentOrOuterDocument()) {
+      rfh = rfh->GetParentOrOuterDocument();
+    }
+  } else {
+    // Not finding a `rfh` suggests that `rwh` is still in the process of being
+    // set up, or is for a newly created RenderWidgetHost without a
+    // RenderFrameHost (e.g. for a <select> tag popup>), and that this function
+    // will be called again when there is a findable `rfh` for `rwh`. For now,
+    // just return the zoom level of this WebContents, as that will most often
+    // be right.
+    return HostZoomMap::GetZoomLevel(this);
+  }

  GURL url;
  if (rfh->IsInBackForwardCache()) {
@@ -8680,21 +8746,28 @@ double WebContentsImpl::GetPendingZoomLevel(RenderWidgetHostImpl* rwh) {
    // and All/FencedFrameAutomaticBeaconBrowserTest.MessageExceedsLengthLimit/
    // fencedframe.
    url = rfh->GetLastCommittedURL();
-  } else {
+  } else if (!rfh->GetParent()) {
+    // Only use the pending entry if `rfh` is a main frame, otherwise the
+    // resulting url is from outside the independently zoomed subtree, and
+    // may result in the wrong zoom level.
    NavigationEntry* pending_entry = rfh->GetController().GetPendingEntry();
    if (!pending_entry) {
      return HostZoomMap::GetZoomLevel(this, rfh->GetGlobalId());
    }
    url = pending_entry->GetURL();
+  } else {
+    // In this case `rfh` is for an independently-zoomed subframe. Call
+    // GetZoomLevel(WebContents*, RenderFrameHost*) in case `rfh` uses temporary
+    // zoom.
+    return HostZoomMap::GetZoomLevel(this, rfh->GetGlobalId());
  }
 #if BUILDFLAG(IS_ANDROID)
-  return HostZoomMap::GetForWebContents(this)
+  return HostZoomMapForRenderFrameHost(rfh)
      ->GetZoomLevelForHostAndSchemeAndroid(url.scheme(),
                                            net::GetHostOrSpecFromURL(url));
 #else
-  return HostZoomMap::Get(rfh->GetSiteInstance())
-      ->GetZoomLevelForHostAndScheme(url.scheme(),
-                                     net::GetHostOrSpecFromURL(url));
+  return HostZoomMapForRenderFrameHost(rfh)->GetZoomLevelForHostAndScheme(
+      url.scheme(), net::GetHostOrSpecFromURL(url));
 #endif
 }

@@ -11406,8 +11479,8 @@ void WebContentsImpl::CancelPreviewByMojoBinderPolicy(
  }
 }

-void WebContentsImpl::OnCanResizeFromWebAPIChanged() {
-  delegate_->OnCanResizeFromWebAPIChanged();
+void WebContentsImpl::OnWebApiWindowResizableChanged() {
+  delegate_->OnWebApiWindowResizableChanged();
 }

 FrameTreeNodeId WebContentsImpl::GetOuterDelegateFrameTreeNodeId() {
@@ -11656,7 +11729,8 @@ std::unique_ptr<PrerenderHandle> WebContentsImpl::StartPrerendering(
      should_warm_up_compositor, should_prepare_paint_tree,
      std::move(url_match_predicate),
      std::move(prerender_navigation_handle_callback),
-      base::MakeRefCounted<PreloadPipelineInfo>());
+      base::MakeRefCounted<PreloadPipelineInfo>(
+          /*planned_max_preloading_type=*/PreloadingType::kPrerender));
 #if BUILDFLAG(IS_ANDROID)
  attributes.additional_headers = std::move(additional_headers);
 #else
@@ -11812,12 +11886,6 @@ net::handles::NetworkHandle WebContentsImpl::GetTargetNetwork() {
  return target_network_;
 }

-void WebContentsImpl::DisconnectFileSelectListenerIfAny() {
-  if (active_file_chooser_) {
-    active_file_chooser_->FileSelectionCanceled();
-  }
-}
-
 // static
 void WebContentsImpl::UpdateAttributionSupportAllRenderers() {
  for (WebContentsImpl* web_contents : GetAllWebContents()) {
@@ -203,9 +203,9 @@ void SetRuntimeFeaturesFromChromiumFeatures() {
          {wf::EnableEyeDropperAPI, raw_ref(features::kEyeDropper),
           kSetOnlyIfOverridden},
          {wf::EnableFedCm, raw_ref(features::kFedCm), kSetOnlyIfOverridden},
-          {wf::EnableFedCmButtonMode, raw_ref(features::kFedCmButtonMode),
+          {wf::EnableFedCm, raw_ref(features::kFedCmButtonMode),
           kSetOnlyIfOverridden},
-          {wf::EnableFedCmAuthz, raw_ref(features::kFedCmAuthz),
+          {wf::EnableFedCm, raw_ref(features::kFedCmAuthz),
           kSetOnlyIfOverridden},
          {wf::EnableFedCmDelegation, raw_ref(features::kFedCmDelegation),
           kDefault},
@@ -374,6 +374,13 @@ void SetRuntimeFeaturesFromChromiumFeatures() {
          {"OriginIsolationHeader", raw_ref(features::kOriginIsolationHeader)},
          {"ReduceAcceptLanguage",
           raw_ref(network::features::kReduceAcceptLanguage)},
+          {"Serial",
+#if BUILDFLAG(IS_ANDROID)
+           raw_ref(device::features::kBluetoothRfcommAndroid)
+#else
+           raw_ref(device::features::kSerial)
+#endif
+          },
          {"SerialPortConnected", raw_ref(features::kSerialPortConnected)},
          {"SignatureBasedIntegrity",
           raw_ref(network::features::kSRIMessageSignatureEnforcement)},
@@ -571,11 +578,11 @@ void ResolveInvalidConfigurations() {
  // Topics API cannot be enabled without the support of the browser process.
  // The Document API should be additionally gated by the
  // `kBrowsingTopicsDocumentAPI` feature.
-  if (!base::FeatureList::IsEnabled(blink::features::kBrowsingTopics)) {
+  if (!base::FeatureList::IsEnabled(network::features::kBrowsingTopics)) {
    LOG_IF(WARNING, WebRuntimeFeatures::IsTopicsAPIEnabled())
        << "Topics cannot be enabled in this configuration. Use --"
        << switches::kEnableFeatures << "="
-        << blink::features::kBrowsingTopics.name << " in addition.";
+        << network::features::kBrowsingTopics.name << " in addition.";
    WebRuntimeFeatures::EnableTopicsAPI(false);
    WebRuntimeFeatures::EnableTopicsDocumentAPI(false);
    WebRuntimeFeatures::EnableTopicsImgAPI(false);
@@ -592,12 +599,12 @@ void ResolveInvalidConfigurations() {
    }
  }

-  if (!base::FeatureList::IsEnabled(blink::features::kSharedStorageAPI)) {
+  if (!base::FeatureList::IsEnabled(network::features::kSharedStorageAPI)) {
    LOG_IF(WARNING, WebRuntimeFeatures::IsSharedStorageAPIEnabled())
        << "SharedStorage cannot be enabled in this "
           "configuration. Use --"
        << switches::kEnableFeatures << "="
-        << blink::features::kSharedStorageAPI.name << " in addition.";
+        << network::features::kSharedStorageAPI.name << " in addition.";
    WebRuntimeFeatures::EnableSharedStorageAPI(false);
  }

@@ -612,13 +619,13 @@ void ResolveInvalidConfigurations() {
    WebRuntimeFeatures::EnableAttributionReporting(false);
  }

-  if (!base::FeatureList::IsEnabled(blink::features::kInterestGroupStorage)) {
+  if (!base::FeatureList::IsEnabled(network::features::kInterestGroupStorage)) {
    LOG_IF(WARNING,
           WebRuntimeFeatures::IsAdInterestGroupAPIEnabledByRuntimeFlag())
        << "AdInterestGroupAPI cannot be enabled in this "
           "configuration. Use --"
        << switches::kEnableFeatures << "="
-        << blink::features::kInterestGroupStorage.name << " in addition.";
+        << network::features::kInterestGroupStorage.name << " in addition.";
    WebRuntimeFeatures::EnableAdInterestGroupAPI(false);
    WebRuntimeFeatures::EnableFledge(false);
  }
@@ -302,11 +302,11 @@ size_t ContentBrowserClient::GetProcessCountToIgnoreForLimit() {
  return 0;
 }

-std::optional<blink::ParsedPermissionsPolicy>
+std::optional<network::ParsedPermissionsPolicy>
 ContentBrowserClient::GetPermissionsPolicyForIsolatedWebApp(
    WebContents* web_contents,
    const url::Origin& app_origin) {
-  return blink::ParsedPermissionsPolicy();
+  return network::ParsedPermissionsPolicy();
 }

 bool ContentBrowserClient::ShouldTryToUseExistingProcessHost(
@@ -1039,10 +1039,6 @@ bool ContentBrowserClient::ShouldEnableAudioProcessHighPriority() {
  return false;
 }

-bool ContentBrowserClient::ShouldUseFontDataManager(const GURL& site_url) {
-  return false;
-}
-
 #endif  // BUILDFLAG(IS_WIN)

 std::vector<std::unique_ptr<blink::URLLoaderThrottle>>
@@ -1237,11 +1233,9 @@ void ContentBrowserClient::CreateSecurePaymentConfirmationService(
    mojo::PendingReceiver<payments::mojom::SecurePaymentConfirmationService>
        receiver) {}

-#if !BUILDFLAG(IS_ANDROID)
 SerialDelegate* ContentBrowserClient::GetSerialDelegate() {
  return nullptr;
 }
-#endif

 HidDelegate* ContentBrowserClient::GetHidDelegate() {
  return nullptr;
@@ -1305,7 +1299,7 @@ ContentBrowserClient::CreateClientCertStore(BrowserContext* browser_context) {

 std::unique_ptr<LoginDelegate> ContentBrowserClient::CreateLoginDelegate(
    const net::AuthChallengeInfo& auth_info,
-    content::WebContents* web_contents,
+    WebContents* web_contents,
    BrowserContext* browser_context,
    const GlobalRequestID& request_id,
    bool is_request_for_primary_main_frame_navigation,
@@ -1314,7 +1308,7 @@ std::unique_ptr<LoginDelegate> ContentBrowserClient::CreateLoginDelegate(
    scoped_refptr<net::HttpResponseHeaders> response_headers,
    bool first_auth_attempt,
    GuestPageHolder* guest,
-    LoginAuthRequiredCallback auth_required_callback) {
+    LoginDelegate::LoginAuthRequiredCallback auth_required_callback) {
  return nullptr;
 }

@@ -1341,6 +1335,11 @@ ContentBrowserClient::CreateWindowForVideoPictureInPicture(
  return nullptr;
 }

+media::PictureInPictureEventsInfo::AutoPipReason
+ContentBrowserClient::GetAutoPipReason(const WebContents& web_contents) const {
+  return media::PictureInPictureEventsInfo::AutoPipReason::kUnknown;
+}
+
 void ContentBrowserClient::RegisterRendererPreferenceWatcher(
    BrowserContext* browser_context,
    mojo::PendingRemote<blink::mojom::RendererPreferenceWatcher> watcher) {
@@ -1931,4 +1930,8 @@ ContentBrowserClient::MaybeOverrideLocalURLCrossOriginEmbedderPolicy(
  return std::nullopt;
 }

+bool ContentBrowserClient::ShouldEnableSubframeZoom() {
+  return false;
+}
+
 }  // namespace content
@@ -51,20 +51,6 @@ namespace app.runtime {
    sparky
  };

-  // An app can be launched with a specific action in mind, for example, to
-  // create a new note. The type of action the app was launched
-  // with is available inside of the |actionData| field from the LaunchData
-  // instance.
-  enum ActionType {
-    // The user wants to quickly take a new note.
-    new_note
-  };
-
-  // Optional data that includes action-specific launch information.
-  dictionary ActionData {
-    ActionType actionType;
-  };
-
  // Optional data for the launch. Either <code>items</code>, or
  // the pair (<code>url, referrerUrl</code>) can be present for any given
  // launch.
@@ -102,11 +88,6 @@ namespace app.runtime {

    // Where the app is launched from.
    LaunchSource? source;
-
-    // Contains data that specifies the <code>ActionType</code> this app was
-    // launched with. This is null if the app was not launched with a specific
-    // action intent.
-    ActionData? actionData;
  };

  // This object specifies details and operations to perform on the embedding
@@ -728,7 +728,7 @@ enum PositionType {
    IntentTextBoundaryType textBoundary;

    // A move direction associated with this AutomationIntent.
-    IntentMoveDirectionType moveDirection;
+    IntentMoveDirectionType? moveDirection;
  };

  // An event in the Automation tree.
@@ -81,8 +81,7 @@ namespace userScripts {
    DOMString[]? ids;
  };

-  // TODO(crbug.com/326657581): Remove nodoc.
-  [nodoc] dictionary InjectionTarget {
+  dictionary InjectionTarget {
    // Whether the script should inject into all frames within the tab. Defaults
    // to false. This must not be true if <code>frameIds</code> is specified.
    boolean? allFrames;
@@ -95,8 +94,7 @@ namespace userScripts {
    long tabId;
  };

-  // TODO(crbug.com/326657581): Remove nodoc.
-  [nodoc] dictionary InjectionResult {
+  dictionary InjectionResult {
    // The document associated with the injection.
    DOMString documentId;
    // The frame associated with the injection.
@@ -108,8 +106,7 @@ namespace userScripts {
    DOMString? error;
  };

-  // TODO(crbug.com/326657581): Remove nodoc.
-  [nodoc] dictionary UserScriptInjection {
+  dictionary UserScriptInjection {
    // Whether the injection should be triggered in the target as soon as
    // possible. Note that this is not a guarantee that injection will occur
    // prior to page load, as the page may have already loaded by the time the
@@ -209,11 +206,9 @@ namespace userScripts {
    // will inject without waiting, even if the page has not finished loading.
    // If the script evaluates to a promise, the browser will wait for the
    // promise to settle and return the resulting value.
-    // TODO(crbug.com/326657581): Remove nodoc.
-    [nodoc] static void execute(
+    static void execute(
        UserScriptInjection injection,
-        optional ExecuteCallback callback
-    );
+        optional ExecuteCallback callback);

    // Configures the <code>`USER_SCRIPT`</code> execution environment.
    // |properties|: Contains the user script world configuration.
@@ -385,8 +385,6 @@ void SetFeatureFlags() {
    SetV8FlagsFormatted("--scavenger-max-new-space-capacity-mb=%i",
                        features::kV8ScavengerMaxCapacity.Get());
  }
-  SetV8FlagsIfOverridden(features::kV8SeparateGCPhases, "--separate-gc-phases",
-                         "--no-separate-gc-phases");
  SetV8FlagsIfOverridden(features::kV8Sparkplug, "--sparkplug",
                         "--no-sparkplug");
  SetV8FlagsIfOverridden(features::kV8Turbofan, "--turbofan", "--no-turbofan");
@@ -491,10 +489,6 @@ void SetFeatureFlags() {
                         "--intel-jcc-erratum-mitigation",
                         "--no-intel-jcc-erratum-mitigation");

-  SetV8FlagsIfOverridden(features::kV8UpdateLimitAfterLoading,
-                         "--update-allocation-limits-after-loading",
-                         "--no-update-allocation-limits-after-loading");
-
  SetV8FlagsIfOverridden(features::kV8UseLibmTrigFunctions,
                         "--use-libm-trig-functions",
                         "--no-use-libm-trig-functions");
@@ -522,6 +516,7 @@ void SetFeatureFlags() {
                         "--no-js-duplicate-named-groups");
  SetV8FlagsIfOverridden(features::kJavaScriptPromiseTry, "--js-promise-try",
                         "--no-js-promise-try");
+  SetV8Flags("--js-float16array");

  // WebAssembly features.

@@ -555,6 +550,7 @@ void V8Initializer::Initialize(IsolateHolder::ScriptMode mode,
  // instrumentation initialization, see https://crbug.com/v8/11043. --js-flags
  // and other mandatory flags in `SetFlags` must be ordered after feature flag
  // overrides.
+  SetV8Flags("--js-explicit-resource-management");
  if (!disallow_v8_feature_flag_overrides) {
    SetFeatureFlags();
  }
@@ -1522,6 +1522,13 @@ void NetworkContext::QueueReportInternal(
    return;
  }

+  // Reporting is disallowed if network access is disabled for the nonce.
+  if (network_anonymization_key.GetNonce().has_value() &&
+      !IsNetworkForNonceAndUrlAllowed(
+          network_anonymization_key.GetNonce().value(), url)) {
+    return;
+  }
+
  std::string reported_user_agent = "";
  if (request_context->http_user_agent_settings() != nullptr) {
    reported_user_agent =
@@ -1547,6 +1554,14 @@ void NetworkContext::QueueSignedExchangeReport(
  if (!logging_service) {
    return;
  }
+
+  // Reporting is disallowed if network access is disabled for the nonce.
+  if (network_anonymization_key.GetNonce().has_value() &&
+      !IsNetworkForNonceAndUrlAllowed(
+          network_anonymization_key.GetNonce().value(), report->outer_url)) {
+    return;
+  }
+
  std::string user_agent;
  if (url_request_context_->http_user_agent_settings() != nullptr) {
    user_agent =
@@ -1714,9 +1729,10 @@ void NetworkContext::SetCTPolicy(mojom::CTPolicyPtr ct_policy) {
                                         ct_policy->excluded_spkis);
 }

-int NetworkContext::CheckCTRequirementsForSignedExchange(
+int NetworkContext::CheckCTRequirements(
    net::CertVerifyResult& cert_verify_result,
-    const net::HostPortPair& host_port_pair) {
+    const net::HostPortPair& host_port_pair,
+    CTVerificationMode ct_verification_mode) {
  net::X509Certificate* verified_cert = cert_verify_result.verified_cert.get();

  net::TransportSecurityState::CTRequirementsStatus ct_requirement_status =
@@ -1736,6 +1752,13 @@ int NetworkContext::CheckCTRequirementsForSignedExchange(
    case net::TransportSecurityState::CT_REQUIREMENTS_MET:
      return net::OK;
    case net::TransportSecurityState::CT_NOT_REQUIRED:
+      switch (ct_verification_mode) {
+        case CTVerificationMode::kTlsCertificate:
+          return net::OK;
+        case CTVerificationMode::kSignedExchange:
+          // Proceed.
+          break;
+      }
      // CT is not required if the certificate does not chain to a publicly
      // trusted root certificate.
      if (!cert_verify_result.is_issued_by_known_root) {
@@ -2020,30 +2043,31 @@ void NetworkContext::CreateHostResolver(
      url_request_context_->net_log()));
 }

-void NetworkContext::VerifyCertForSignedExchange(
+void NetworkContext::VerifyCertInternal(
    const scoped_refptr<net::X509Certificate>& certificate,
-    const GURL& url,
+    const net::HostPortPair& host_port,
    const std::string& ocsp_result,
    const std::string& sct_list,
-    VerifyCertForSignedExchangeCallback callback) {
+    CTVerificationMode ct_verification_mode,
+    VerifyCertCallback callback) {
  uint64_t cert_verify_id = ++next_cert_verify_id_;
  CHECK_NE(0u, next_cert_verify_id_);  // The request ID should not wrap around.
  auto pending_cert_verify = std::make_unique<PendingCertVerify>();
  pending_cert_verify->callback = std::move(callback);
  pending_cert_verify->result = std::make_unique<net::CertVerifyResult>();
  pending_cert_verify->certificate = certificate;
-  pending_cert_verify->url = url;
+  pending_cert_verify->host_port = host_port;
  pending_cert_verify->ocsp_result = ocsp_result;
  pending_cert_verify->sct_list = sct_list;
+  pending_cert_verify->ct_verification_mode = ct_verification_mode;
  net::CertVerifier* cert_verifier =
      g_cert_verifier_for_testing ? g_cert_verifier_for_testing
                                  : url_request_context_->cert_verifier();
  int result = cert_verifier->Verify(
-      net::CertVerifier::RequestParams(certificate, url.host(),
-                                       0 /* cert_verify_flags */, ocsp_result,
-                                       sct_list),
+      net::CertVerifier::RequestParams(certificate, host_port.host(),
+                                       /*flags=*/0, ocsp_result, sct_list),
      pending_cert_verify->result.get(),
-      base::BindOnce(&NetworkContext::OnVerifyCertForSignedExchangeComplete,
+      base::BindOnce(&NetworkContext::OnVerifyCertComplete,
                     base::Unretained(this), cert_verify_id),
      &pending_cert_verify->request,
      net::NetLogWithSource::Make(url_request_context_->net_log(),
@@ -2051,10 +2075,30 @@ void NetworkContext::VerifyCertForSignedExchange(
  cert_verifier_requests_[cert_verify_id] = std::move(pending_cert_verify);

  if (result != net::ERR_IO_PENDING) {
-    OnVerifyCertForSignedExchangeComplete(cert_verify_id, result);
+    OnVerifyCertComplete(cert_verify_id, result);
  }
 }

+void NetworkContext::VerifyCert(
+    const scoped_refptr<net::X509Certificate>& certificate,
+    const net::HostPortPair& host_port,
+    const std::string& ocsp_result,
+    const std::string& sct_list,
+    VerifyCertCallback callback) {
+  VerifyCertInternal(certificate, host_port, ocsp_result, sct_list,
+                     CTVerificationMode::kTlsCertificate, std::move(callback));
+}
+
+void NetworkContext::VerifyCertForSignedExchange(
+    const scoped_refptr<net::X509Certificate>& certificate,
+    const net::HostPortPair& host_port,
+    const std::string& ocsp_result,
+    const std::string& sct_list,
+    VerifyCertCallback callback) {
+  VerifyCertInternal(certificate, host_port, ocsp_result, sct_list,
+                     CTVerificationMode::kSignedExchange, std::move(callback));
+}
+
 void NetworkContext::NotifyExternalCacheHit(const GURL& url,
                                            const std::string& http_method,
                                            const net::NetworkIsolationKey& key,
@@ -2591,6 +2635,7 @@ URLRequestContextOwner NetworkContext::MakeURLRequestContext(
  // case for any given NetworkContext: either PrefetchProxy, handling its
  // custom proxy configs, or IpProtection, using the proxy allowlist.
  auto* mdl_manager = network_service_->masked_domain_list_manager();
+  auto* prt_registry = network_service_->probabilistic_reveal_token_registry();
  bool requires_ipp_proxy_delegate =
      mdl_manager->IsEnabled() &&
      (params_->ip_protection_core_host ||
@@ -2606,7 +2651,8 @@ URLRequestContextOwner NetworkContext::MakeURLRequestContext(
    auto ip_protection_core_impl =
        std::make_unique<ip_protection::IpProtectionCoreImplMojo>(
            std::move(params_->ip_protection_control), core_host_remote,
-            mdl_manager, params_->enable_ip_protection);
+            mdl_manager, prt_registry, params_->enable_ip_protection,
+            params_->ip_protection_incognito);
    builder.set_proxy_delegate(
        std::make_unique<ip_protection::IpProtectionProxyDelegate>(
            ip_protection_core_impl.get()));
@@ -2770,11 +2816,15 @@ URLRequestContextOwner NetworkContext::MakeURLRequestContext(
  }

  if (session_cleanup_cookie_store) {
+    // If the pref service was registered and initialized use it.
+    // If not, use nullptr to indicate prefs aren't available.
    std::unique_ptr<net::CookieMonster> cookie_store =
        std::make_unique<net::CookieMonster>(
            session_cleanup_cookie_store.get(), net_log,
-            std::make_unique<KnownLegacyScopeDomainsPrefDelegate>(
-                pref_service.get()));
+            pref_service
+                ? std::make_unique<KnownLegacyScopeDomainsPrefDelegate>(
+                      pref_service.get())
+                : nullptr);
    if (params_->persist_session_cookies) {
      cookie_store->SetPersistSessionCookies(true);
    }
@@ -3119,9 +3169,7 @@ void NetworkContext::CanUploadDomainReliability(
                     std::move(callback)));
 }

-void NetworkContext::OnVerifyCertForSignedExchangeComplete(
-    uint64_t cert_verify_id,
-    int result) {
+void NetworkContext::OnVerifyCertComplete(uint64_t cert_verify_id, int result) {
  auto iter = cert_verifier_requests_.find(cert_verify_id);
  CHECK(iter != cert_verifier_requests_.end(), base::NotFatalUntil::M130);

@@ -3131,13 +3179,13 @@ void NetworkContext::OnVerifyCertForSignedExchangeComplete(
  bool pkp_bypassed = false;
  if (result == net::OK) {
 #if BUILDFLAG(IS_CT_SUPPORTED)
-    int ct_result = CheckCTRequirementsForSignedExchange(
-        *pending_cert_verify->result,
-        net::HostPortPair::FromURL(pending_cert_verify->url));
+    int ct_result = CheckCTRequirements(
+        *pending_cert_verify->result, pending_cert_verify->host_port,
+        pending_cert_verify->ct_verification_mode);
 #endif  // BUILDFLAG(IS_CT_SUPPORTED)
    net::TransportSecurityState::PKPStatus pin_validity =
        url_request_context_->transport_security_state()->CheckPublicKeyPins(
-            pending_cert_verify->url.host(),
+            pending_cert_verify->host_port.host(),
            pending_cert_verify->result->is_issued_by_known_root,
            pending_cert_verify->result->public_key_hashes);
    switch (pin_validity) {
@@ -4314,9 +4314,9 @@ enum WebFeature {
  // The items above roughly this point are available in the M125 branch.

  kSharedStorageAPI_SelectURLOverallPageloadBudgetInsufficient = 4944,
-  kV8LanguageTranslator_Translate_Method = 4945,
-  kV8Translation_CanTranslate_Method = 4946,
-  kV8Translation_CreateTranslator_Method = 4947,
+  kOBSOLETE_V8LanguageTranslator_Translate_Method = 4945,
+  kOBSOLETE_V8Translation_CanTranslate_Method = 4946,
+  kOBSOLETE_V8Translation_CreateTranslator_Method = 4947,
  kIdentityDigitalCredentialsDeepLink = 4948,
  kV8WebView_GetExperimentalMediaIntegrityTokenProvider_Method = 4949,
  kV8MediaIntegrityTokenProvider_RequestToken_Method = 4950,
@@ -4478,7 +4478,7 @@ enum WebFeature {
  kWebAuthentication_AttestationFormats = 5098,
  kCssDisplayPropertyMultipleValues = 5099,
  kDocumentPolicyExpectNoLinkedResources = 5100,
-  kSelectionIsCollapsedBehaviorChange = 5101,
+  kOBSOLETE_SelectionIsCollapsedBehaviorChange = 5101,
  // The items above roughly this point are available in the M130 branch.

  kTopicsAPIAll = 5102,
@@ -4582,7 +4582,7 @@ enum WebFeature {
  kMoveEvent = 5196,
  kCanvas2DDrawText = 5197,
  kCanvas2DMeasureText = 5198,
-  kCrossPartitionBlobURLFetch = 5199,
+  kOBSOLETE_CrossPartitionBlobURLFetch = 5199,
  kCrossTopLevelSiteBlobURLNavigation = 5200,
  kGeolocationSucceeded = 5201,
  kGeolocationSucceededWithoutInjectionMitigation = 5202,
@@ -4682,9 +4682,44 @@ enum WebFeature {
  kV8Window_Close_Method = 5296,
  kV8Window_Focus_Method = 5297,
  kV8Window_PostMessage_Method = 5298,
+  kHTMLImageElementNaturalSizeDiffersForSvgImage = 5299,
  kWindowProxyIndexedGetter = 5300,
  kWindowProxyNamedGetter = 5301,
+  kV8AILanguageModelFactory_Availability_Method = 5302,
+  kV8AILanguageModelFactory_Params_Method = 5303,
+  kV8AISummarizerFactory_Availability_Method = 5304,
+  kV8AISummarizer_ExpectedInputLanguages_AttributeGetter = 5305,
+  kV8AISummarizer_ExpectedContextLanguages_AttributeGetter = 5306,
+  kV8AISummarizer_OutputLanguage_AttributeGetter = 5307,
+  kNestedScrollMarkers = 5308,
+  kV8GeolocationCoordinates_Latitude_AttributeGetter = 5309,
+  kV8GeolocationCoordinates_Longitude_AttributeGetter = 5310,
+  kV8GeolocationCoordinates_Altitude_AttributeGetter = 5311,
+  kV8GeolocationCoordinates_Accuracy_AttributeGetter = 5312,
+  kV8GeolocationCoordinates_AltitudeAccuracy_AttributeGetter = 5313,
+  kV8GeolocationCoordinates_Heading_AttributeGetter = 5314,
+  kV8GeolocationCoordinates_Speed_AttributeGetter = 5315,
+  kCSSEnvironmentVariable_SafeAreaMaxInsetBottom = 5316,
+  kV8AILanguageModel_ExpectedInputLanguages_AttributeGetter = 5317,
+  kV8AnimationTrigger_Constructor= 5318,
  kPrivateNetworkAccessInsecureResourceNotKnownPrivate = 5319,
+  kGeolocationGetCurrentPositionHighAccuracy = 5320,
+  kGeolocationWatchPositionHighAccuracy = 5321,
+  kColumnPseudoElement = 5322,
+  kScrollButtonPseudoElement = 5323,
+  kScrollMarkerPseudoElement = 5324,
+  kV8AITranslatorFactory_Availability_Method = 5325,
+  kGeolocationWouldSucceedWhenAdScriptInStack = 5326,
+  kAdScriptInStackOnWatchGeoLocation = 5327,
+  kDeviceBoundSessionRegistered = 5328,
+  kV8AILanguageDetectorFactory_Availability_Method = 5329,
+  kCrossPartitionSameOriginBlobURLFetch = 5330,
+  kWebAppManifestUpdate = 5331,
+  kCSSEnvironmentVariable_PreferredTextScale = 5332,
+  kButtonTypeAttrInvalidWithCommandOrCommandfor = 5333,
+  kCSSVarFallbackCycle = 5334,
+  kCSSAttrFallbackCycle = 5335,
+  kSpeculationRulesTargetHintBlank = 5372,

  // Add new features immediately above this line. Don't change assigned
  // numbers of any item, and don't reuse removed slots. Also don't add extra
@@ -1,8 +1,8 @@
 enum AriaNotifyInterrupt { "none", "all", "pending" };
-enum AriaNotifyPriority { "none", "important" };
+enum AriaNotifyPriority { "normal", "high" };

 dictionary AriaNotificationOptions {
  AriaNotifyInterrupt interrupt = "none";
-  AriaNotifyPriority priority = "none";
+  AriaNotifyPriority priority = "normal";
  DOMString notificationId = "";
 };
@@ -0,0 +1,20 @@
+// Copyright 2025 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// https://drafts.csswg.org/web-animations-2/#the-animationtrigger-interface
+
+enum AnimationTriggerType { "once", "repeat", "alternate", "state" };
+
+[
+    Exposed=Window,
+    RuntimeEnabled=AnimationTrigger
+] interface AnimationTrigger {
+  [CallWith=ExecutionContext, Measure, RaisesException] constructor(optional AnimationTriggerOptions options = {});
+  attribute AnimationTimeline? timeline;
+  attribute AnimationTriggerType type;
+  [CallWith=ExecutionContext, RaisesException=Setter] attribute (TimelineRangeOffset or DOMString) rangeStart;
+  [CallWith=ExecutionContext, RaisesException=Setter] attribute (TimelineRangeOffset or DOMString) rangeEnd;
+  [CallWith=ExecutionContext, RaisesException=Setter] attribute (TimelineRangeOffset or DOMString) exitRangeStart;
+  [CallWith=ExecutionContext, RaisesException=Setter] attribute (TimelineRangeOffset or DOMString) exitRangeEnd;
+};
@@ -0,0 +1,14 @@
+// Copyright 2025 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// https://drafts.csswg.org/web-animations-2/#the-animationtriggeroptions-dictionary
+
+dictionary AnimationTriggerOptions {
+  AnimationTriggerType type = "once";
+  AnimationTimeline? timeline;
+  (DOMString or TimelineRangeOffset) rangeStart = "normal";
+  (DOMString or TimelineRangeOffset) rangeEnd = "normal";
+  (DOMString or TimelineRangeOffset) exitRangeStart = "normal";
+  (DOMString or TimelineRangeOffset) exitRangeEnd = "normal";
+};
@@ -85,7 +85,7 @@ typedef (HTMLScriptElement or SVGScriptElement) HTMLOrSVGScriptElement;
   // https://wicg.github.io/sanitizer-api/#sanitizer-api
    // TODO(356601280): Merge the two setHTMLUnsafe variants into one, once the
    //   different RuntimeEnabled flags are both perma-enabled.
-    [RuntimeEnabled=SanitizerAPI,RaisesException,CallWith=ExecutionContext,MeasureAs=ParseHTMLUnsafe,CEReactions] static Document parseHTMLUnsafe(HTMLString html, SetHTMLOptions options);
+    [RuntimeEnabled=SanitizerAPI,RaisesException,CallWith=ExecutionContext,MeasureAs=ParseHTMLUnsafe,CEReactions] static Document parseHTMLUnsafe(HTMLString html, SetHTMLUnsafeOptions options);
    [RuntimeEnabled=SanitizerAPI,RaisesException,CallWith=ExecutionContext,MeasureAs=ParseHTMLSafe,CEReactions] static Document parseHTML(DOMString html, optional SetHTMLOptions options = {});

    // resource metadata management
@@ -29,8 +29,12 @@ dictionary CheckVisibilityOptions {

 // Options dictionary for setHTML and setHTMLUnsafe.
 // See: https://wicg.github.io/sanitizer-api/#configobject
+enum SanitizerPresets { "default" };
 dictionary SetHTMLOptions {
-  (Sanitizer or SanitizerConfig) sanitizer;
+  (Sanitizer or SanitizerConfig or SanitizerPresets) sanitizer = "default";
+};
+dictionary SetHTMLUnsafeOptions {
+  (Sanitizer or SanitizerConfig or SanitizerPresets) sanitizer = {};
 };

 // https://dom.spec.whatwg.org/#interface-element
@@ -108,7 +112,7 @@ dictionary SetHTMLOptions {
    // https://wicg.github.io/sanitizer-api/#sanitizer-api
    // TODO(vogelheim): Merge the two setHTMLUnsafe variants into one, once the
    //   different RuntimeEnabled flags are both perma-enabled.
-    [RuntimeEnabled=SanitizerAPI,RaisesException,MeasureAs=SetHTMLUnsafe,CEReactions] void setHTMLUnsafe(HTMLString html, SetHTMLOptions options);
+    [RuntimeEnabled=SanitizerAPI,RaisesException,MeasureAs=SetHTMLUnsafe,CEReactions] void setHTMLUnsafe(HTMLString html, SetHTMLUnsafeOptions options);
    [RuntimeEnabled=SanitizerAPI,RaisesException,MeasureAs=SetHTMLSafe,CEReactions] void setHTML(DOMString html, optional SetHTMLOptions options = {});

    // Declarative Shadow DOM getHTML() function.
@@ -127,8 +131,6 @@ dictionary SetHTMLOptions {
    // https://drafts.csswg.org/cssom-view/#dom-element-checkvisibility
    [MeasureAs=ElementCheckVisibility] boolean checkVisibility(optional CheckVisibilityOptions options = {});

-    // TODO(sunyunjia): Add default value for scrollIntoView() once
-    // crbug.com/734599 is fixed.
    void scrollIntoView(optional (ScrollIntoViewOptions or boolean) arg = {});
    [ImplementedAs=scrollTo] void scroll(optional ScrollToOptions options = {});
    [ImplementedAs=scrollTo] void scroll(unrestricted double x, unrestricted double y);
@@ -168,6 +170,7 @@ dictionary SetHTMLOptions {

    // Element Timing
    [CEReactions, Reflect=elementtiming] attribute DOMString elementTiming;
+    [RuntimeEnabled=ContainerTiming, CEReactions, Reflect=containertiming] attribute DOMString containerTiming;
 };

 Element includes ParentNode;
@@ -40,6 +40,7 @@ interface mixin GlobalEventHandlers {
  attribute EventHandler onchange;
  attribute EventHandler onclick;
  attribute EventHandler onclose;
+  [RuntimeEnabled=HTMLCommandAttributes] attribute EventHandler oncommand;
  attribute EventHandler oncontentvisibilityautostatechange;
  attribute EventHandler oncontextlost;
  attribute EventHandler oncontextmenu;
@@ -67,6 +67,7 @@ interface Observable {
  [CallWith=ScriptState, RaisesException] Observable switchMap(Mapper mapper);
  [CallWith=ScriptState] Observable inspect(optional ObservableInspectorUnion inspect_observer = {});
  [CallWith=ScriptState, RaisesException, ImplementedAs=catchImpl] Observable catch(CatchCallback callback);
+  [CallWith=ScriptState] Observable finally(VoidFunction callback);

  // Promise-returning operators.
  // See https://wicg.github.io/observable/#promise-returning-operators.
@@ -38,7 +38,7 @@ interface mixin ParentNode {
  [Unscopable, RaisesException, CEReactions] void prepend((Node or DOMString or TrustedScript)... nodes);
  [Unscopable, RaisesException, CEReactions] void append((Node or DOMString or TrustedScript)... nodes);
  [Unscopable, RaisesException, CEReactions] void replaceChildren((Node or DOMString or TrustedScript)... nodes);
-  [CEReactions, PerWorldBindings, RaisesException, RuntimeEnabled=AtomicMoveAPI, MeasureAs="WebDXFeature::kMoveBeforeAPI"] void moveBefore(Node node, Node? child);
+  [CEReactions, PerWorldBindings, RaisesException, MeasureAs="WebDXFeature::kMoveBeforeAPI"] void moveBefore(Node node, Node? child);

  [Affects=Nothing, RaisesException] Element? querySelector(DOMString selectors);
  [Affects=Nothing, NewObject, RaisesException] NodeList querySelectorAll(DOMString selectors);
@@ -4,8 +4,5 @@

 interface mixin PopoverInvokerElement {
  [CEReactions,Reflect=popovertarget] attribute Element? popoverTargetElement;
-  // See crbug.com/1418144. We need to change ReflectOnly based on a runtime flag, which isn't possible.
-  // See also crbug.com/1416284. When HTMLPopoverHint is removed as a flag, we should be able to go back to using [Reflect].
-  // [CEReactions,Reflect,ReflectOnly=("toggle","show","hide"),ReflectEmpty="toggle",ReflectInvalid="toggle",ReflectMissing="toggle"] attribute DOMString popoverTargetAction;
-  [CEReactions] attribute DOMString popoverTargetAction;
+  [CEReactions,Reflect,ReflectOnly=("toggle","show","hide"),ReflectEmpty="toggle",ReflectInvalid="toggle",ReflectMissing="toggle"] attribute DOMString popoverTargetAction;
 };
@@ -84,7 +84,7 @@ interface ShadowRoot : DocumentFragment {
                            (DOMString or ElementCreationOptions) options);

    [RaisesException,MeasureAs=SetHTMLUnsafe,CEReactions] void setHTMLUnsafe(HTMLString string);
-    [RuntimeEnabled=SanitizerAPI,RaisesException,MeasureAs=SetHTMLUnsafe,CEReactions] void setHTMLUnsafe(HTMLString html, SetHTMLOptions options);
+    [RuntimeEnabled=SanitizerAPI,RaisesException,MeasureAs=SetHTMLUnsafe,CEReactions] void setHTMLUnsafe(HTMLString html, SetHTMLUnsafeOptions options);
    [RuntimeEnabled=SanitizerAPI,RaisesException,MeasureAs=SetHTMLSafe,CEReactions] void setHTML(DOMString html, optional SetHTMLOptions options = {});

 };
@@ -3,7 +3,7 @@
 // found in the LICENSE file.

 [
-    RuntimeEnabled=HTMLInvokeTargetAttribute,
+    RuntimeEnabled=HTMLCommandAttributes,
    Exposed=Window
 ] interface CommandEvent : Event {
    constructor(DOMString type, optional CommandEventInit eventInitDict = {});
@@ -253,6 +253,8 @@
    "prioritychange",
    "processorerror",
    "progress",
+    "promptaction",
+    "promptdismiss",
    "push",
    "pushsubscriptionchange",
    "quicstream",
@@ -206,8 +206,6 @@
 #undef pow
 #include <cmath>  // for std::pow

-#include "build/chromeos_buildflags.h"
-
 // The following constants control parameters for automated scaling of webpages
 // (such as due to a double tap gesture or find in page etc.). These are
 // experimentally determined.
@@ -2956,9 +2954,7 @@ void WebViewImpl::UpdatePageDefinedViewportConstraints(

  UpdateMainFrameLayoutSize();

-  if (RuntimeEnabledFeatures::ViewportChangesUpdateTextAutosizingEnabled()) {
-    TextAutosizer::UpdatePageInfoInAllFrames(GetPage()->MainFrame());
-  }
+  TextAutosizer::UpdatePageInfoInAllFrames(GetPage()->MainFrame());
 }

 void WebViewImpl::UpdateMainFrameLayoutSize() {
@@ -14,5 +14,6 @@
  readonly attribute DOMString disposition;
  readonly attribute DOMString? message;
  [RuntimeEnabled=PotentialPermissionsPolicyReporting] readonly attribute DOMString? allowAttribute;
+  [RuntimeEnabled=PotentialPermissionsPolicyReporting] readonly attribute DOMString? srcAttribute;
  [CallWith=ScriptState] object toJSON();
 };
@@ -43,7 +43,7 @@
    // platforms that has not been explicitly specified and should always be
    // present.
    initial: {
-      valid_keys: ["Android", "Win", "ChromeOS_Ash", "ChromeOS_Lacros", "Mac", "Linux"],
+      valid_keys: ["Android", "Win", "ChromeOS", "Mac", "Linux"],
    },
    invalidate: {
      default: [],
@@ -126,8 +126,7 @@
        "Mac": "mojom::blink::EditingBehavior::kEditingMacBehavior",
        "Win": "mojom::blink::EditingBehavior::kEditingWindowsBehavior",
        "Android": "mojom::blink::EditingBehavior::kEditingAndroidBehavior",
-        "ChromeOS_Ash": "mojom::blink::EditingBehavior::kEditingChromeOSBehavior",
-        "ChromeOS_Lacros": "mojom::blink::EditingBehavior::kEditingChromeOSBehavior",
+        "ChromeOS": "mojom::blink::EditingBehavior::kEditingChromeOSBehavior",
        "default": "mojom::blink::EditingBehavior::kEditingUnixBehavior",
      },
      type: "mojom::EditingBehavior",
@@ -505,7 +504,7 @@
    {
      name: "accessibilityFontScaleFactor",
      initial: "1.0",
-      invalidate: ["TextAutosizing"],
+      invalidate: ["TextAutosizing", "FontScaleFactor"],
      type: "double",
    },

@@ -7,6 +7,6 @@ interface TextCluster {
    readonly attribute double y;
    readonly attribute unsigned long begin;
    readonly attribute unsigned long end;
-    readonly attribute DOMString align;
-    readonly attribute DOMString baseline;
+    readonly attribute CanvasTextAlign align;
+    readonly attribute CanvasTextBaseline baseline;
 };
@@ -25,9 +25,12 @@

 // https://html.spec.whatwg.org/C/#textmetrics

+enum CanvasTextAlign {"start", "end", "left", "right", "center"};
+enum CanvasTextBaseline {"top", "hanging", "middle", "alphabetic", "ideographic", "bottom"};
+
 dictionary TextClusterOptions {
-  DOMString align;
-  DOMString baseline;
+  CanvasTextAlign align;
+  CanvasTextBaseline baseline;
  double x;
  double y;
 };
@@ -36,8 +36,8 @@
    // FIXME: attribute HTMLMenuElement? menu;

    // Command Invokers
-    [RuntimeEnabled=HTMLInvokeTargetAttribute, CEReactions, Reflect=commandfor] attribute Element? commandForElement;
-    [RuntimeEnabled=HTMLInvokeTargetAttribute, CEReactions, Reflect] attribute DOMString command;
+    [RuntimeEnabled=HTMLCommandAttributes, CEReactions, Reflect=commandfor] attribute Element? commandForElement;
+    [RuntimeEnabled=HTMLCommandAttributes, CEReactions] attribute DOMString command;

    readonly attribute boolean willValidate;
    readonly attribute ValidityState validity;
@@ -33,5 +33,9 @@
    readonly attribute unsigned long length;
    getter Element? (unsigned long index);
    [ImplementedAs=NamedGetter] getter (HTMLCollection or Element)? namedItem(DOMString name);
+
+    // `nameOrIndex` is a `DOMString` in the spec IDL, but taking `any` allows
+    // us to use v8's array index checker/converter, which is much faster than
+    // the WTF equivalent.
    [CallWith=Isolate, RaisesException] (HTMLCollection or Element)? item(optional any nameOrIndex);
 };
@@ -69,11 +69,7 @@
    [MeasureAs=ElementTogglePopover,RaisesException] boolean togglePopover(optional (TogglePopoverOptions or boolean) options);
    [MeasureAs=ElementShowPopover,RaisesException] void showPopover(optional ShowPopoverOptions options);
    [MeasureAs=ElementHidePopover,RaisesException] void hidePopover();
-
-    // See crbug.com/1418144. We need to change ReflectOnly based on a runtime flag, which isn't possible.
-    // See also crbug.com/1416284. When HTMLPopoverHint is removed as a flag, we should be able to go back to using [Reflect].
-    // [CEReactions,Reflect,ReflectOnly=("auto","hint","manual"),ReflectEmpty="auto",ReflectInvalid="manual"] attribute DOMString? popover;
-    [CEReactions] attribute DOMString? popover;
+    [CEReactions,Reflect,ReflectOnly=("auto","hint","manual"),ReflectEmpty="auto",ReflectInvalid="manual"] attribute DOMString? popover;

    // Non-standard APIs
    [CEReactions, RaisesException=Setter, MeasureAs=HTMLElementInnerText, ImplementedAs=innerTextForBinding] attribute ([LegacyNullToEmptyString] DOMString or TrustedScript) innerText;
@@ -22,5 +22,10 @@ interface HTMLPermissionElement : HTMLElement {

  attribute EventHandler onresolve;
  attribute EventHandler ondismiss;
+
+  // New name for the events `onresolve` and `ondismiss`. We will keep both
+  // for backward compability and will remove the old events in M138.
+  attribute EventHandler onpromptaction;
+  attribute EventHandler onpromptdismiss;
  attribute EventHandler onvalidationstatuschange;
 };
@@ -10,7 +10,7 @@

  readonly attribute NavigationType navigationType;
  readonly attribute NavigationDestination destination;
-  [ImplementedAs=canIntercept] readonly attribute boolean canTransition;
+  [ImplementedAs=canIntercept, RuntimeEnabled=NavigateEventCanTransition] readonly attribute boolean canTransition;
  readonly attribute boolean canIntercept;
  readonly attribute boolean userInitiated;
  readonly attribute boolean hashChange;
@@ -23,5 +23,6 @@

  [RaisesException] void intercept(optional NavigationInterceptOptions options = {});
  [RaisesException, RuntimeEnabled=NavigateEventCommitBehavior] void commit();
+  [RaisesException, RuntimeEnabled=NavigateEventCommitBehavior] void redirect(USVString url);
  [RaisesException] void scroll();
 };
@@ -11,7 +11,7 @@
  sequence<NavigationHistoryEntry> entries();
  [RaisesException, MeasureAs=NavigationAPI] void updateCurrentEntry(NavigationUpdateCurrentEntryOptions options);
  readonly attribute NavigationTransition? transition;
-  [RuntimeEnabled=NavigationActivation] readonly attribute NavigationActivation? activation;
+  readonly attribute NavigationActivation? activation;

  readonly attribute boolean canGoBack;
  readonly attribute boolean canGoForward;
@@ -4,8 +4,7 @@

 // https://wicg.github.io/navigation-api/
 [
-  Exposed=Window,
-  RuntimeEnabled=NavigationActivation
+  Exposed=Window
 ] interface NavigationActivation {
  readonly attribute NavigationHistoryEntry? entry;
  readonly attribute NavigationHistoryEntry? from;
@@ -11,5 +11,5 @@
  readonly attribute USVString url;
  readonly attribute long long index;
  readonly attribute boolean sameDocument;
-  [CallWith=ScriptState] any getState();
+  [CallWith=Isolate] any getState();
 };
@@ -3,6 +3,4 @@ interface NavigationTransition {
  readonly attribute NavigationType navigationType;
  readonly attribute NavigationHistoryEntry from;
  [CallWith=ScriptState] readonly attribute Promise<undefined> finished;
-
-  // NavigationResult rollback(optional NavigationOptions options = {});
 };
@@ -514,7 +514,8 @@ void OriginTrialContext::AddForceEnabledTrials(

 bool OriginTrialContext::CanEnableTrialFromName(const StringView& trial_name) {
  if (trial_name == "FledgeBiddingAndAuctionServer") {
-    return base::FeatureList::IsEnabled(features::kInterestGroupStorage) &&
+    return base::FeatureList::IsEnabled(
+               network::features::kInterestGroupStorage) &&
           base::FeatureList::IsEnabled(
               features::kFledgeBiddingAndAuctionServer);
  }
@@ -522,8 +523,10 @@ bool OriginTrialContext::CanEnableTrialFromName(const StringView& trial_name) {
  if (trial_name == "FencedFrames")
    return base::FeatureList::IsEnabled(features::kFencedFrames);

-  if (trial_name == "AdInterestGroupAPI")
-    return base::FeatureList::IsEnabled(features::kInterestGroupStorage);
+  if (trial_name == "AdInterestGroupAPI") {
+    return base::FeatureList::IsEnabled(
+        network::features::kInterestGroupStorage);
+  }

  if (trial_name == "SpeculationRulesPrefetchFuture") {
    return base::FeatureList::IsEnabled(
@@ -565,6 +568,10 @@ bool OriginTrialContext::CanEnableTrialFromName(const StringView& trial_name) {
    return base::FeatureList::IsEnabled(features::kAIPromptAPIForExtension);
  }

+  if (trial_name == "SpeculationRulesTargetHint") {
+    return base::FeatureList::IsEnabled(features::kPrerender2InNewTab);
+  }
+
  if (trial_name == "TranslationAPI") {
 #if BUILDFLAG(IS_WIN) || BUILDFLAG(IS_MAC) || BUILDFLAG(IS_LINUX)
    return base::FeatureList::IsEnabled(features::kTranslationAPI);
@@ -35,7 +35,7 @@
    LegacyNoInterfaceObject,
    RuntimeEnabled=PagePopup
 ] interface PagePopupController {
-    void setValueAndClosePopup(long numberValue, DOMString stringValue);
+    void setValueAndClosePopup(long numberValue, DOMString stringValue, boolean is_keyboard_event);
    void setValue(DOMString value);
    void closePopup();
    DOMString localizeNumberString(DOMString numberString);
@@ -6,12 +6,12 @@
 // Extracted from: https://wicg.github.io/sanitizer-api/

 [
-  Exposed=(Window,Worker),
+  Exposed=Window,
  RuntimeEnabled=SanitizerAPI
 ]
 interface Sanitizer {
  [RaisesException]
-  constructor(optional SanitizerConfig config = {});
+  constructor(optional (SanitizerConfig or SanitizerPresets) configuration = "default");

  // Query configuration:
  SanitizerConfig get();
@@ -19,6 +19,6 @@ enum AncestorStatus {
    ImplementedAs=DOMScheduler
 ] interface Scheduler {
    [CallWith=ScriptState, MeasureAs=SchedulerPostTask, RaisesException] Promise<any> postTask(SchedulerPostTaskCallback callback, optional SchedulerPostTaskOptions options = {});
-    [RuntimeEnabled=SchedulerYield, MeasureAs=SchedulerYield, CallWith=ScriptState, RaisesException] Promise<undefined> yield();
+    [CallWith=ScriptState, MeasureAs=SchedulerYield, RaisesException] Promise<undefined> yield();
    [RuntimeEnabled=UnexposedTaskIds, CallWith=ScriptState, Exposed=Window] attribute unsigned long taskId;
 };
@@ -28,6 +28,9 @@
 [Exposed=Window]
 interface SVGAElement : SVGGraphicsElement {
    [ImplementedAs=svgTarget, Measure] readonly attribute SVGAnimatedString target;
+
+    [RuntimeEnabled=SvgAnchorElementRelAttributes, Reflect] attribute DOMString rel;
+    [RuntimeEnabled=SvgAnchorElementRelAttributes, SameObject, PutForwards=value] readonly attribute DOMTokenList relList;
 };

 SVGAElement includes SVGURIReference;
@@ -9,7 +9,7 @@ interface PerformanceEventTiming : PerformanceEntry {
    readonly attribute DOMHighResTimeStamp processingEnd;
    readonly attribute boolean cancelable;
    readonly attribute Node? target;
-    [MeasureAs=EventTimingInteractionId] readonly attribute unsigned long interactionId;
+    [MeasureAs=EventTimingInteractionId] readonly attribute unsigned long long interactionId;

    [CallWith=ScriptState, ImplementedAs=toJSONForBinding] object toJSON();
 };
@@ -29,5 +29,7 @@ interface PerformanceScriptTiming : PerformanceEntry {
    readonly attribute DOMString sourceURL;
    readonly attribute DOMString sourceFunctionName;
    readonly attribute long long sourceCharPosition;
+    [RuntimeEnabled=LongAnimationFrameSourceLineColumn] readonly attribute long long sourceLine;
+    [RuntimeEnabled=LongAnimationFrameSourceLineColumn] readonly attribute long long sourceColumn;
    [CallWith=ScriptState, ImplementedAs=toJSONForBinding] object toJSON();
 };
@@ -6,7 +6,7 @@
    ImplementedAs=ScopedViewTransition,
    RuntimeEnabled=ScopedViewTransitions
 ] partial interface Element {
-  [CallWith=ScriptState, RaisesException] ViewTransition startViewTransition();
-  [CallWith=ScriptState, RaisesException] ViewTransition startViewTransition(ViewTransitionCallback update);
-  [CallWith=ScriptState, RaisesException] ViewTransition startViewTransition(ViewTransitionOptions opts);
+  [MeasureAs="WebDXFeature::kDRAFT_ScopedViewTransitions", CallWith=ScriptState, RaisesException] ViewTransition startViewTransition();
+  [MeasureAs="WebDXFeature::kDRAFT_ScopedViewTransitions", CallWith=ScriptState, RaisesException] ViewTransition startViewTransition(ViewTransitionCallback update);
+  [MeasureAs="WebDXFeature::kDRAFT_ScopedViewTransitions", CallWith=ScriptState, RaisesException] ViewTransition startViewTransition(ViewTransitionOptions opts);
 };
@@ -72,7 +72,6 @@ dictionary AuctionAdConfig {
  Promise<record<USVString, unsigned long long>?> perBuyerTimeouts;
  Promise<record<USVString, unsigned long long>?> perBuyerCumulativeTimeouts;

-  [RuntimeEnabled=FledgeReportingTimeout]
  unsigned long long reportingTimeout;

  USVString sellerCurrency;
@@ -67,6 +67,8 @@ dictionary AuctionAdInterestGroup {
  long maxTrustedBiddingSignalsURLLength;
  [RuntimeEnabled=FledgeTrustedSignalsKVv2Support]
  USVString trustedBiddingSignalsCoordinator;
+  [RuntimeEnabled=FledgeClickiness]
+  sequence<USVString> viewAndClickCountsProviders;
  any userBiddingSignals;
  sequence<AuctionAd> ads;
  sequence<AuctionAd> adComponents;
@@ -4,12 +4,6 @@

 // https://github.com/webmachinelearning/prompt-api

-enum AICapabilityAvailability {
-  "readily",
-  "after-download",
-  "no"
-};
-
 [
  Exposed=(Window,Worker),
  SecureContext,
@@ -0,0 +1,9 @@
+// Copyright 2025 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// https://github.com/webmachinelearning/prompt-api
+// https://github.com/webmachinelearning/writing-assistance-apis
+// https://github.com/webmachinelearning/translation-api
+
+enum AIAvailability { "unavailable", "downloadable", "downloading", "available" };
@@ -0,0 +1,7 @@
+// Copyright 2025 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// https://github.com/webmachinelearning/prompt-api
+// TODO(crbug.com/395509560): remove `AICapabilityAvailability`.
+enum AICapabilityAvailability { "readily", "after-download", "no" };
@@ -24,7 +24,7 @@ interface AILanguageModel : EventTarget {
    RaisesException
  ]
  Promise<DOMString> prompt(
-    DOMString input,
+    AILanguageModelPromptInput input,
    optional AILanguageModelPromptOptions options = {}
  );
  [
@@ -33,7 +33,7 @@ interface AILanguageModel : EventTarget {
    RaisesException
  ]
  ReadableStream promptStreaming(
-    DOMString input,
+    AILanguageModelPromptInput input,
    optional AILanguageModelPromptOptions options = {}
  );

@@ -58,6 +58,8 @@ interface AILanguageModel : EventTarget {
  readonly attribute unsigned long topK;
  [Measure]
  readonly attribute float temperature;
+  [Measure]
+  readonly attribute FrozenArray<DOMString>? expectedInputLanguages;

  attribute EventHandler oncontextoverflow;

@@ -72,5 +74,5 @@ interface AILanguageModel : EventTarget {
    CallWith=ScriptState,
    RaisesException
  ]
-  void destroy();
+  undefined destroy();
 };
@@ -4,17 +4,47 @@

 // https://github.com/webmachinelearning/prompt-api

-dictionary AILanguageModelInitialPrompt {
-  required AILanguageModelInitialPromptRole role;
-  required DOMString content;
+// The argument to the prompt() method and others like it
+typedef (AILanguageModelPrompt or sequence<AILanguageModelPrompt>) AILanguageModelPromptInput;
+
+// Prompt lines
+typedef (
+  DOMString                     // interpreted as { role: "user", type: "text", content: providedValue }
+  or AILanguageModelPromptDict  // canonical form
+) AILanguageModelPrompt;
+
+// Prompt content inside the lines
+dictionary AILanguageModelPromptDict {
+  AILanguageModelPromptRole role = "user";
+  AILanguageModelPromptType type = "text";
+  required AILanguageModelPromptContent content;
 };

-dictionary AILanguageModelCreateOptions {
+enum AILanguageModelPromptRole { "system", "user", "assistant" };
+
+enum AILanguageModelPromptType { "text", "image", "audio" };
+
+typedef (
+  ImageBitmapSource
+  or AudioBuffer
+  or HTMLAudioElement
+  or BufferSource
+  or DOMString
+) AILanguageModelPromptContent;
+
+dictionary AILanguageModelCreateCoreOptions {
+  // Note: these two have custom out-of-range handling behavior, not in the IDL layer.
+  // They are unrestricted double so as to allow +Infinity without failing.
+  unrestricted double topK;
+  unrestricted double temperature;
+
+  sequence<DOMString> expectedInputLanguages;
+  sequence<AILanguageModelPromptType> expectedInputTypes;
+};
+
+dictionary AILanguageModelCreateOptions : AILanguageModelCreateCoreOptions {
  AbortSignal signal;
  AICreateMonitorCallback monitor;
-
-  [EnforceRange] unsigned long topK;
-  float temperature;
  DOMString systemPrompt;
-  sequence<AILanguageModelInitialPrompt> initialPrompts;
+  sequence<AILanguageModelPrompt> initialPrompts;
 };
@@ -4,9 +4,7 @@

 // https://github.com/webmachinelearning/prompt-api

-enum AILanguageModelInitialPromptRole { "system", "user", "assistant" };
-enum AILanguageModelPromptRole { "user", "assistant" };
-
+// TODO(crbug.com/390459309): remove `AILanguageModelCapabilities`.
 [
  Exposed=(Window,Worker),
  SecureContext,
@@ -35,6 +33,7 @@ interface AILanguageModelCapabilities {
  RuntimeEnabled=AIPromptAPI
 ]
 interface AILanguageModelFactory {
+  // TODO(crbug.com/390459309): remove `capabilities()`.
  [
    Measure,
    CallWith=ScriptState,
@@ -49,4 +48,18 @@ interface AILanguageModelFactory {
  Promise<AILanguageModel> create(
    optional AILanguageModelCreateOptions options = {}
  );
+  [
+    Measure,
+    CallWith=ScriptState,
+    RaisesException
+  ]
+  Promise<AIAvailability> availability(
+    optional AILanguageModelCreateCoreOptions options = {}
+  );
+  [
+    Measure,
+    CallWith=ScriptState,
+    RaisesException
+  ]
+  Promise<AILanguageModelParams?> params();
 };
@@ -0,0 +1,17 @@
+// Copyright 2025 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// https://github.com/webmachinelearning/prompt-api
+
+[
+  Exposed=(Window,Worker),
+  SecureContext,
+  RuntimeEnabled=AIPromptAPI
+]
+interface AILanguageModelParams {
+  readonly attribute unsigned long defaultTopK;
+  readonly attribute unsigned long maxTopK;
+  readonly attribute float defaultTemperature;
+  readonly attribute float maxTemperature;
+};
@@ -34,7 +34,9 @@ interface AIRewriterFactory {
    CallWith=ScriptState,
    RaisesException
  ]
-  Promise<AICapabilityAvailability> availability(optional AIRewriterCreateCoreOptions options = {});
+  Promise<AIAvailability> availability(
+    optional AIRewriterCreateCoreOptions options = {}
+  );
  [
    Measure,
    CallWith=ScriptState,
@@ -42,4 +42,10 @@ interface AISummarizer {
  readonly attribute AISummarizerFormat format;
  [Measure]
  readonly attribute AISummarizerLength length;
+  [Measure]
+  readonly attribute FrozenArray<DOMString>? expectedInputLanguages;
+  [Measure]
+  readonly attribute FrozenArray<DOMString>? expectedContextLanguages;
+  [Measure]
+  readonly attribute DOMString? outputLanguage;
 };
@@ -25,6 +25,10 @@ dictionary AISummarizerCreateCoreOptions {
  AISummarizerType type = "key-points";
  AISummarizerFormat format = "markdown";
  AISummarizerLength length = "short";
+
+  sequence<DOMString> expectedInputLanguages;
+  sequence<DOMString> expectedContextLanguages;
+  DOMString outputLanguage;
 };

 dictionary AISummarizerCreateOptions : AISummarizerCreateCoreOptions {
@@ -45,6 +49,17 @@ interface AISummarizerFactory {
    RaisesException
  ]
  Promise<AISummarizer> create(optional AISummarizerCreateOptions options = {});
+
+  [
+    Measure,
+    CallWith=ScriptState,
+    RaisesException
+  ]
+  Promise<AIAvailability> availability(
+    optional AISummarizerCreateCoreOptions options = {}
+  );
+
+  // TODO(crbug.com/390477782): Deprecate this method.
  [
    Measure,
    CallWith=ScriptState,
--- a/Show More
+++ b/Show More