From e77ef4cb3afb280e945a4d3023a4bfc085fd3573 Mon Sep 17 00:00:00 2001
From: Carmelo Messina <uazo@users.noreply.github.com>
Date: Mon, 19 Jan 2026 14:16:28 +0100
Subject: [PATCH] Disable CpuPerformance api and DBSC

---
 build/cromite_patches_list.txt                |  2 ++
 .../Disable-device-bound-session.patch        | 25 ++++++++++++++++++
 .../Keep-disabled-CpuPerformance.patch        | 26 +++++++++++++++++++
 3 files changed, 53 insertions(+)
 create mode 100644 build/patches/Disable-device-bound-session.patch
 create mode 100644 build/patches/Keep-disabled-CpuPerformance.patch

diff --git a/build/cromite_patches_list.txt b/build/cromite_patches_list.txt
index ec6b0c0a..939e2208 100644
--- a/build/cromite_patches_list.txt
+++ b/build/cromite_patches_list.txt
@@ -304,6 +304,8 @@ Temp-disable-UseContextSnapshot.patch
 Enable-ClientHello-Segmentation.patch
 Disable-Sticky-User-Activation-Across-Same-Origin-Navigation.patch
 Supporting-Dangling-Ptr-Detection-via-BackupRefPtr.patch
+Disable-device-bound-session.patch
+Keep-disabled-CpuPerformance.patch
 
 # temporary or wip patches
 Temp-disable-predictive-back-gesture.patch
diff --git a/build/patches/Disable-device-bound-session.patch b/build/patches/Disable-device-bound-session.patch
new file mode 100644
index 00000000..c38e9c80
--- /dev/null
+++ b/build/patches/Disable-device-bound-session.patch
@@ -0,0 +1,25 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Mon, 19 Jan 2026 12:00:34 +0000
+Subject: Disable device bound session
+
+Disable DBSC due to potential privacy issues
+see https://w3c.github.io/webappsec-dbsc/#privacy-considerations
+
+License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
+---
+ net/features.gni | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/features.gni b/net/features.gni
+--- a/net/features.gni
++++ b/net/features.gni
+@@ -57,7 +57,7 @@ declare_args() {
+   chrome_root_store_only = is_win || is_mac || is_linux || is_chromeos
+ 
+   # DBSC is only supported on Windows, Linux and Mac for now.
+-  enable_device_bound_sessions = is_win || is_linux || is_mac
++  enable_device_bound_sessions = false
+ 
+   # Bracketed URIs parsing is only available for debug builds.
+   # TODO(crbug.com/365771838): Ensure tests are updated if needed if this
+--
diff --git a/build/patches/Keep-disabled-CpuPerformance.patch b/build/patches/Keep-disabled-CpuPerformance.patch
new file mode 100644
index 00000000..60d6b5ad
--- /dev/null
+++ b/build/patches/Keep-disabled-CpuPerformance.patch
@@ -0,0 +1,26 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Mon, 19 Jan 2026 12:01:31 +0000
+Subject: Keep disabled CpuPerformance
+
+Keep disabled CpuPerformance due to potential privacy issues
+see https://github.com/explainers-by-googlers/cpu-performance?tab=readme-ov-file#accessibility-privacy-and-security-considerations
+
+License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
+---
+ .../blink/renderer/platform/runtime_enabled_features.json5     | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/third_party/blink/renderer/platform/runtime_enabled_features.json5 b/third_party/blink/renderer/platform/runtime_enabled_features.json5
+--- a/third_party/blink/renderer/platform/runtime_enabled_features.json5
++++ b/third_party/blink/renderer/platform/runtime_enabled_features.json5
+@@ -1266,8 +1266,7 @@
+       // CPU Performance API, work in progress.
+       // https://chromestatus.com/feature/5189864286978048
+       // https://github.com/explainers-by-googlers/cpu-performance
+-      name: "CpuPerformance",
+-      status: "experimental"
++      status: "experimental", name: "CpuPerformance",
+     },
+     {
+       name: "CrashReportingStorageAPI",
+--