[AUTO][FILECONTROL] - version 138.0.7204.50 (#2170)

[AUTO][FILECONTROL] - version 138.0.7204.50

tools/under-control/src/RELEASE

@@ -1 +1 @@
-137.0.7151.104
+138.0.7204.50

tools/under-control/src/android_webview/browser/aw_content_browser_client.cc

@@ -34,6 +34,7 @@
 #include "android_webview/browser/network_service/aw_proxying_restricted_cookie_manager.h"
 #include "android_webview/browser/network_service/aw_proxying_url_loader_factory.h"
 #include "android_webview/browser/network_service/aw_url_loader_throttle.h"
+#include "android_webview/browser/network_service/net_helpers.h"
 #include "android_webview/browser/prefetch/aw_prefetch_service_delegate.h"
 #include "android_webview/browser/safe_browsing/aw_safe_browsing_navigation_throttle.h"
 #include "android_webview/browser/safe_browsing/aw_url_checker_delegate_impl.h"
@@ -94,6 +95,7 @@
 #include "content/public/browser/frame_type.h"
 #include "content/public/browser/navigation_handle.h"
 #include "content/public/browser/navigation_throttle.h"
+#include "content/public/browser/navigation_throttle_registry.h"
 #include "content/public/browser/network_service_instance.h"
 #include "content/public/browser/prefetch_service_delegate.h"
 #include "content/public/browser/render_frame_host.h"
@@ -111,6 +113,7 @@
 #include "mojo/public/cpp/bindings/pending_associated_receiver.h"
 #include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "net/android/network_library.h"
+#include "net/cookies/cookie_setting_override.h"
 #include "net/cookies/site_for_cookies.h"
 #include "net/http/http_util.h"
 #include "net/net_buildflags.h"
@@ -174,8 +177,8 @@ BASE_FEATURE(kWebViewOptimizeXrwNavigationFlow,
 // navigation, and forwards it to the proxying loader factory.
 class XrwNavigationThrottle : public content::NavigationThrottle {
  public:
-  explicit XrwNavigationThrottle(content::NavigationHandle* handle)
-      : NavigationThrottle(handle) {}
+  explicit XrwNavigationThrottle(content::NavigationThrottleRegistry& registry)
+      : NavigationThrottle(registry) {}
   ~XrwNavigationThrottle() override {
     AwProxyingURLLoaderFactory::ClearXrwResultForNavigation(
         navigation_handle()->GetNavigationId());
@@ -183,8 +186,12 @@ class XrwNavigationThrottle : public content::NavigationThrottle {
 
   ThrottleCheckResult WillStartRequest() override {
     auto* handle = navigation_handle();
+    content::OriginTrialsControllerDelegate* delegate =
+        handle->GetWebContents()
+            ->GetBrowserContext()
+            ->GetOriginTrialsControllerDelegate();
     AwProxyingURLLoaderFactory::SetXrwResultForNavigation(
-        handle->GetURL(),
+        delegate, handle->GetURL(),
         handle->IsInOutermostMainFrame()
             ? blink::mojom::ResourceType::kMainFrame
             : blink::mojom::ResourceType::kSubFrame,
@@ -420,17 +427,12 @@ bool AwContentBrowserClient::IsHandledURL(const GURL& url) {
   const std::string scheme = url.scheme();
   DCHECK_EQ(scheme, base::ToLowerASCII(scheme));
   static const char* const kProtocolList[] = {
-    url::kHttpScheme,
-    url::kHttpsScheme,
+      url::kHttpScheme,         url::kHttpsScheme,
 #if BUILDFLAG(ENABLE_WEBSOCKETS)
-    url::kWsScheme,
-    url::kWssScheme,
+      url::kWsScheme,           url::kWssScheme,
 #endif  // BUILDFLAG(ENABLE_WEBSOCKETS)
-    url::kDataScheme,
-    url::kBlobScheme,
-    url::kFileSystemScheme,
-    content::kChromeUIScheme,
-    url::kContentScheme,
+      url::kDataScheme,         url::kBlobScheme,    url::kFileSystemScheme,
+      content::kChromeUIScheme, url::kContentScheme,
   };
   if (scheme == url::kFileScheme) {
     // Return false for the "special" file URLs, so they can be loaded
@@ -490,15 +492,21 @@ gfx::ImageSkia AwContentBrowserClient::GetDefaultFavicon() {
 content::GeneratedCodeCacheSettings
 AwContentBrowserClient::GetGeneratedCodeCacheSettings(
     content::BrowserContext* context) {
-  // WebView limits the main HTTP cache to 20MB; we need to set a comparable
-  // limit for the code cache since the source file needs to be in the HTTP
-  // cache for the code cache entry to be used. There are two code caches that
-  // both use this value, so we pass 10MB to keep the total disk usage to
-  // roughly 2x what it was before the code cache was implemented.
-  // TODO(crbug.com/41419561): webview should have smarter cache sizing logic.
   AwBrowserContext* browser_context = static_cast<AwBrowserContext*>(context);
+  // We need to set a comparable limit for the code cache since the source file
+  // needs to be in the HTTP cache for the code cache entry to be used. There
+  // are two code caches that both use this value, so we pass half the the HTTP
+  // cache size limit to keep the total cache usage to roughly 2x the HTTP cache
+  // limit.
+  int code_cache_limit = 0.5 * GetHttpCacheSize();
+  if (base::FeatureList::IsEnabled(
+          features::kWebViewCacheSizeLimitDerivedFromAppCacheQuota)) {
+    code_cache_limit = features::kWebViewCodeCacheSizeLimitMultiplier.Get() *
+                       GetHttpCacheSize();
+  }
+
   return content::GeneratedCodeCacheSettings(
-      true, 10 * 1024 * 1024, browser_context->GetHttpCachePath());
+      true, code_cache_limit, browser_context->GetHttpCachePath());
 }
 
 void AwContentBrowserClient::AllowCertificateError(
@@ -661,62 +669,50 @@ void AwContentBrowserClient::OverrideWebPreferences(
       (delegate) ? delegate->isModalContextMenu() : false;
 }
 
-std::vector<std::unique_ptr<content::NavigationThrottle>>
-AwContentBrowserClient::CreateThrottlesForNavigation(
-    content::NavigationHandle* navigation_handle) {
-  std::vector<std::unique_ptr<content::NavigationThrottle>> throttles;
+void AwContentBrowserClient::CreateThrottlesForNavigation(
+    content::NavigationThrottleRegistry& registry) {
   // We allow intercepting only navigations within main frames. This
   // is used to post onPageStarted. We handle shouldOverrideUrlLoading
   // via a sync IPC.
-  if (navigation_handle->IsInMainFrame()) {
+  content::NavigationHandle& navigation_handle = registry.GetNavigationHandle();
+  if (navigation_handle.IsInMainFrame()) {
     // MetricsNavigationThrottle requires that it runs before
     // NavigationThrottles that may delay or cancel navigations, so only
     // NavigationThrottles that don't delay or cancel navigations (e.g.
     // throttles that are only observing callbacks without affecting navigation
     // behavior) should be added before MetricsNavigationThrottle.
-    throttles.push_back(page_load_metrics::MetricsNavigationThrottle::Create(
-        navigation_handle));
+    // TODO(https://crbug.com/412524375): This assumption is fragile. This
+    // should be cared by adding an attribute flag to
+    // NavigationThrottleRegistry::AddThrottle().
+    page_load_metrics::MetricsNavigationThrottle::CreateAndAdd(registry);
   }
   // Use Synchronous mode for the navigation interceptor, since this class
   // doesn't actually call into an arbitrary client, it just posts a task to
   // call onPageStarted. shouldOverrideUrlLoading happens earlier (see
   // ContentBrowserClient::ShouldOverrideUrlLoading).
-  std::unique_ptr<content::NavigationThrottle> intercept_navigation_throttle =
-      navigation_interception::InterceptNavigationDelegate::
-          MaybeCreateThrottleFor(navigation_handle,
-                                 navigation_interception::SynchronyMode::kSync);
-  if (intercept_navigation_throttle) {
-    throttles.push_back(std::move(intercept_navigation_throttle));
-  }
+  navigation_interception::InterceptNavigationDelegate::MaybeCreateAndAdd(
+      registry, navigation_interception::SynchronyMode::kSync);
 
-  throttles.push_back(std::make_unique<PolicyBlocklistNavigationThrottle>(
-      navigation_handle,
-      AwBrowserContext::FromWebContents(navigation_handle->GetWebContents())));
+  registry.AddThrottle(std::make_unique<PolicyBlocklistNavigationThrottle>(
+      registry,
+      AwBrowserContext::FromWebContents(navigation_handle.GetWebContents())));
 
-  std::unique_ptr<AwSafeBrowsingNavigationThrottle> safe_browsing_throttle =
-      AwSafeBrowsingNavigationThrottle::MaybeCreateThrottleFor(
-          navigation_handle);
-  if (safe_browsing_throttle) {
-    throttles.push_back(std::move(safe_browsing_throttle));
-  }
+  AwSafeBrowsingNavigationThrottle::MaybeCreateAndAdd(registry);
   if (base::FeatureList::IsEnabled(kWebViewOptimizeXrwNavigationFlow)) {
-    throttles.push_back(
-        std::make_unique<XrwNavigationThrottle>(navigation_handle));
+    registry.AddThrottle(std::make_unique<XrwNavigationThrottle>(registry));
   }
 
-  if ((navigation_handle->GetNavigatingFrameType() ==
+  if ((navigation_handle.GetNavigatingFrameType() ==
            FrameType::kPrimaryMainFrame ||
-       navigation_handle->GetNavigatingFrameType() == FrameType::kSubframe) &&
-      navigation_handle->GetURL().SchemeIsHTTPOrHTTPS()) {
+       navigation_handle.GetNavigatingFrameType() == FrameType::kSubframe) &&
+      navigation_handle.GetURL().SchemeIsHTTPOrHTTPS()) {
     AwSupervisedUserUrlClassifier* urlClassifier =
         AwSupervisedUserUrlClassifier::GetInstance();
     if (urlClassifier->ShouldCreateThrottle()) {
-      throttles.push_back(std::make_unique<AwSupervisedUserThrottle>(
-          navigation_handle, urlClassifier));
+      registry.AddThrottle(
+          std::make_unique<AwSupervisedUserThrottle>(registry, urlClassifier));
     }
   }
-
-  return throttles;
 }
 
 std::unique_ptr<content::PrefetchServiceDelegate>
@@ -959,11 +955,9 @@ bool AwContentBrowserClient::HandleExternalProtocol(
                     web_contents->GetBrowserContext()));
 
   // Pass WebContentsKey to look up AwContentsIoThreadClient in
-  // WebContentsToIoThreadClientMap later. Currently this is used only when a
-  // page is being prerendered.
-  // TODO(crbug.com/373474043): Use this even for non-prerendered pages.
+  // WebContentsToIoThreadClientMap later.
   std::optional<WebContentsKey> web_contents_key;
-  if (web_contents && web_contents->IsPrerenderedFrame(frame_tree_node_id)) {
+  if (web_contents) {
     web_contents_key = GetWebContentsKey(*web_contents);
   }
 
@@ -1167,13 +1161,9 @@ void AwContentBrowserClient::WillCreateURLLoaderFactory(
     }
 
     // Pass WebContentsKey to look up AwContentsIoThreadClient in
-    // WebContentsToIoThreadClientMap later. Currently this is used only when a
-    // page is being prerendered.
-    // TODO(crbug.com/373474043): Use this even for non-prerendered pages.
+    // WebContentsToIoThreadClientMap later.
     std::optional<WebContentsKey> web_contents_key;
-    if (web_contents->IsPrerenderedFrame(frame->GetFrameTreeNodeId())) {
-      web_contents_key = GetWebContentsKey(*web_contents);
-    }
+    web_contents_key = GetWebContentsKey(*web_contents);
 
     auto xrw_allowlist_matcher =
         AwSettings::FromWebContents(web_contents)->xrw_allowlist_matcher();
@@ -1476,7 +1466,14 @@ bool AwContentBrowserClient::IsFullCookieAccessAllowed(
     content::BrowserContext* browser_context,
     content::WebContents* web_contents,
     const GURL& url,
-    const blink::StorageKey& storage_key) {
+    const blink::StorageKey& storage_key,
+    net::CookieSettingOverrides overrides) {
+  return AreThirdPartyCookiesGenerallyAllowed(browser_context, web_contents);
+}
+
+bool AwContentBrowserClient::AreThirdPartyCookiesGenerallyAllowed(
+    content::BrowserContext* browser_context,
+    content::WebContents* web_contents) {
   if (!web_contents) {
     // We do not allow third-party cookie access from service workers.
     return false;

tools/under-control/src/android_webview/browser/aw_field_trials.cc

@@ -14,6 +14,7 @@
 #include "base/path_service.h"
 #include "components/history/core/browser/features.h"
 #include "components/metrics/persistent_histograms.h"
+#include "components/payments/content/android/payment_feature_map.h"
 #include "components/permissions/features.h"
 #include "components/safe_browsing/core/common/features.h"
 #include "components/translate/core/common/translate_util.h"
@@ -147,8 +148,9 @@ void AwFieldTrials::RegisterFeatureOverrides(base::FeatureList* feature_list) {
   // kVulkan in case it becomes enabled by default.
   aw_feature_overrides.DisableFeature(::features::kVulkan);
 
-  aw_feature_overrides.DisableFeature(::features::kWebPayments);
   aw_feature_overrides.DisableFeature(::features::kServiceWorkerPaymentApps);
+  aw_feature_overrides.EnableFeature(
+      ::payments::android::kAndroidPaymentIntentsOmitDeprecatedParameters);
 
   // WebView does not support overlay fullscreen yet for video overlays.
   aw_feature_overrides.DisableFeature(media::kOverlayFullscreenVideo);
@@ -217,8 +219,6 @@ void AwFieldTrials::RegisterFeatureOverrides(base::FeatureList* feature_list) {
 
   // FedCM is not yet supported on WebView.
   aw_feature_overrides.DisableFeature(::features::kFedCm);
-  aw_feature_overrides.DisableFeature(
-      blink::features::kFedCmWithStorageAccessAPI);
 
   // TODO(crbug.com/40272633): Web MIDI permission prompt for all usage.
   aw_feature_overrides.DisableFeature(blink::features::kBlockMidiByDefault);
@@ -322,4 +322,9 @@ void AwFieldTrials::RegisterFeatureOverrides(base::FeatureList* feature_list) {
   // Disable draw cutout edge-to-edge on WebView. Safe area insets are not
   // handled correctly when WebView is drawing edge-to-edge.
   aw_feature_overrides.DisableFeature(features::kDrawCutoutEdgeToEdge);
+
+  // This is enabled for WebView to improve crbug.com/418159642.
+  // TODO(crbug.com/422161917): Revert this for the ablation study.
+  aw_feature_overrides.EnableFeature(
+      features::kServiceWorkerBackgroundUpdateForRegisteredStorageKeys);
 }

tools/under-control/src/chrome/android/java/AndroidManifest.xml

@@ -628,8 +628,13 @@ by a child template that "extends" this file.
             android:theme="@style/Theme.AppCompat.NoActionBar">
         </activity>
         {% endif %}
+        <!--
+         The windowSoftInputMode is set to adjustNothing to avoid visual glitch when the
+         fullscreen sign-in is started when a keyboard is shown on the screen. See https://crbug.com/414419626
+        -->
         <activity android:name="org.chromium.chrome.browser.signin.SigninAndHistorySyncActivity"
             android:theme="@style/Theme.Chromium.SigninAndHistorySyncActivity"
+            android:windowSoftInputMode="adjustNothing"
             android:configChanges="orientation|keyboardHidden|keyboard|screenSize|mcc|mnc|screenLayout|smallestScreenSize|uiMode"
             android:exported="false">
         </activity>
@@ -1002,6 +1007,9 @@ by a child template that "extends" this file.
                 <action android:name="org.chromium.chrome.browser.notifications.PRE_UNSUBSCRIBE" />
                 <action android:name="org.chromium.chrome.browser.notifications.SHOW_ORIGINAL_NOTIFICATION" />
                 <action android:name="org.chromium.chrome.browser.notifications.UNDO_UNSUBSCRIBE" />
+                <action android:name="org.chromium.chrome.browser.notifications.REPORT_AS_SAFE" />
+                <action android:name="org.chromium.chrome.browser.notifications.REPORT_WARNED_NOTIFICATION_AS_SPAM" />
+                <action android:name="org.chromium.chrome.browser.notifications.REPORT_UNWARNED_NOTIFICATION_AS_SPAM" />
             </intent-filter>
         </receiver>
 
@@ -1010,6 +1018,7 @@ by a child template that "extends" this file.
                   android:exported="false">
           <intent-filter>
             <action android:name="android.app.action.APP_BLOCK_STATE_CHANGED"/>
+            <action android:name="android.app.action.NOTIFICATION_CHANNEL_BLOCK_STATE_CHANGED" />
           </intent-filter>
         </receiver>
 
@@ -1201,7 +1210,7 @@ by a child template that "extends" this file.
             {{ self.chrome_activity_common() }}
             android:excludeFromRecents="true"
             android:noHistory="true"
-            android:launchMode="singleTask"
+            android:launchMode="singleInstancePerTask"
             android:exported="false"
             android:resizeableActivity="false"
             android:screenOrientation="landscape"

tools/under-control/src/chrome/browser/browsing_data/chrome_browsing_data_remover_delegate.cc

@@ -24,7 +24,6 @@
 #include "base/metrics/histogram_functions.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/metrics/user_metrics.h"
-#include "base/not_fatal_until.h"
 #include "base/strings/strcat.h"
 #include "base/task/bind_post_task.h"
 #include "base/task/thread_pool.h"
@@ -122,6 +121,8 @@
 #include "components/password_manager/core/browser/password_manager_metrics_util.h"
 #include "components/password_manager/core/browser/password_store/password_store_interface.h"
 #include "components/password_manager/core/browser/password_store/smart_bubble_stats_store.h"
+#include "components/payments/content/browser_binding/browser_bound_keys_deleter.h"
+#include "components/payments/content/browser_binding/browser_bound_keys_deleter_factory.h"
 #include "components/payments/content/payment_manifest_web_data_service.h"
 #include "components/performance_manager/public/user_tuning/prefs.h"
 #include "components/permissions/permission_actions_history.h"
@@ -753,6 +754,14 @@ void ChromeBrowsingDataRemoverDelegate::RemoveEmbedderData(
           base::DoNothing());
     }
 #endif  // !BUILDFLAG(IS_ANDROID)
+
+#if BUILDFLAG(IS_ANDROID)
+    if (payments::BrowserBoundKeyDeleter* browser_bound_key_deleter =
+            payments::BrowserBoundKeyDeleterFactory::GetForBrowserContext(
+                profile_)) {
+      browser_bound_key_deleter->RemoveInvalidBBKs();
+    }
+#endif  // BUILDFLAG(IS_ANDROID)
   }
 
   //////////////////////////////////////////////////////////////////////////////
@@ -908,6 +917,10 @@ void ChromeBrowsingDataRemoverDelegate::RemoveEmbedderData(
         delete_end, website_settings_filter);
 
 #if !BUILDFLAG(IS_ANDROID)
+    host_content_settings_map_->ClearSettingsForOneTypeWithPredicate(
+        ContentSettingsType::INITIALIZED_TRANSLATIONS, delete_begin_,
+        delete_end_, website_settings_filter);
+
     host_content_settings_map_->ClearSettingsForOneTypeWithPredicate(
         ContentSettingsType::INTENT_PICKER_DISPLAY, delete_begin_, delete_end_,
         website_settings_filter);
@@ -928,6 +941,10 @@ void ChromeBrowsingDataRemoverDelegate::RemoveEmbedderData(
         ContentSettingsType::ARE_SUSPICIOUS_NOTIFICATIONS_ALLOWLISTED_BY_USER,
         delete_begin_, delete_end_, website_settings_filter);
 
+    host_content_settings_map_->ClearSettingsForOneTypeWithPredicate(
+        ContentSettingsType::SUSPICIOUS_NOTIFICATION_IDS, delete_begin_,
+        delete_end_, website_settings_filter);
+
     PermissionDecisionAutoBlockerFactory::GetForProfile(profile_)
         ->RemoveEmbargoAndResetCounts(filter);
   }
@@ -1035,8 +1052,7 @@ void ChromeBrowsingDataRemoverDelegate::RemoveEmbedderData(
             kClearBrowsingData);
   }
 
-  CHECK(deferred_disable_passwords_auto_signin_cb_.is_null(),
-        base::NotFatalUntil::M125);
+  CHECK(deferred_disable_passwords_auto_signin_cb_.is_null());
   if ((remove_mask & content::BrowsingDataRemover::DATA_TYPE_COOKIES) &&
       !filter_builder->PartitionedCookiesOnly()) {
     // Unretained() is safe, this is only executed in OnTasksComplete() if the
@@ -1600,7 +1616,7 @@ void ChromeBrowsingDataRemoverDelegate::OnTaskComplete(
             SyncServiceFactory::GetForProfile(profile_);
         sync_service) {
       sync_service->GetUserSettings()->KeepAccountSettingsPrefsOnlyForUsers(
-          base::ToVector(gaia_ids, &signin::GaiaIdHash::FromGaiaId));
+          base::ToVector(gaia_ids));
     }
   }
 #endif  // !BUILDFLAG(IS_ANDROID)

tools/under-control/src/chrome/browser/chrome_browser_interface_binders.cc

@@ -29,7 +29,6 @@
 #include "chrome/browser/speech/on_device_speech_recognition_impl.h"
 #include "chrome/browser/translate/translate_frame_binder.h"
 #include "chrome/browser/ui/search_engines/search_engine_tab_helper.h"
-#include "chrome/browser/web_applications/web_app_utils.h"
 #include "chrome/common/buildflags.h"
 #include "chrome/common/pref_names.h"
 #include "chrome/services/speech/buildflags/buildflags.h"
@@ -47,7 +46,6 @@
 #include "components/performance_manager/embedder/binders.h"
 #include "components/performance_manager/embedder/performance_manager_registry.h"
 #include "components/prefs/pref_service.h"
-#include "components/reading_list/features/reading_list_switches.h"
 #include "components/security_state/content/content_utils.h"
 #include "components/security_state/content/security_state_tab_helper.h"
 #include "components/security_state/core/security_state.h"
@@ -70,6 +68,7 @@
 #include "third_party/blink/public/mojom/loader/navigation_predictor.mojom.h"
 #include "third_party/blink/public/mojom/payments/payment_request.mojom.h"
 #include "third_party/blink/public/mojom/payments/secure_payment_confirmation_service.mojom.h"
+#include "third_party/blink/public/mojom/persistent_renderer_prefs.mojom.h"
 #include "third_party/blink/public/mojom/prerender/prerender.mojom.h"
 #include "third_party/blink/public/public_buildflags.h"
 #include "ui/accessibility/accessibility_features.h"
@@ -98,6 +97,7 @@
 #else
 #include "chrome/browser/badging/badge_manager.h"
 #include "chrome/browser/payments/payment_request_factory.h"
+#include "chrome/browser/prefs/persistent_renderer_prefs_manager.h"
 #include "chrome/browser/ui/views/side_panel/customize_chrome/customize_chrome_utils.h"
 #include "chrome/browser/web_applications/web_install_service_impl.h"
 #endif  // BUILDFLAG(IS_ANDROID)
@@ -467,8 +467,6 @@ void PopulateChromeFrameBinders(
     map->Add<payments::mojom::PaymentRequest>(base::BindRepeating(
         &ForwardToJavaFrame<payments::mojom::PaymentRequest>));
   }
-  map->Add<blink::mojom::ShareService>(base::BindRepeating(
-      &ForwardToJavaWebContents<blink::mojom::ShareService>));
 
 #if BUILDFLAG(ENABLE_UNHANDLED_TAP)
   map->Add<blink::mojom::UnhandledTapNotifier>(
@@ -478,6 +476,8 @@ void PopulateChromeFrameBinders(
 #else
   map->Add<blink::mojom::BadgeService>(
       base::BindRepeating(&badging::BadgeManager::BindFrameReceiverIfAllowed));
+  map->Add<blink::mojom::PersistentRendererPrefsService>(
+      base::BindRepeating(&PersistentRendererPrefsManager::BindFrameReceiver));
   if (base::FeatureList::IsEnabled(features::kWebPayments)) {
     map->Add<payments::mojom::PaymentRequest>(
         base::BindRepeating(&payments::CreatePaymentRequest));
@@ -495,10 +495,12 @@ void PopulateChromeFrameBinders(
 #endif
 
 #if BUILDFLAG(IS_WIN) || BUILDFLAG(IS_CHROMEOS) || BUILDFLAG(IS_MAC)
-  if (base::FeatureList::IsEnabled(features::kWebShare)) {
     map->Add<blink::mojom::ShareService>(
         base::BindRepeating(&ShareServiceImpl::Create));
-  }
+#endif
+#if BUILDFLAG(IS_ANDROID)
+    map->Add<blink::mojom::ShareService>(base::BindRepeating(
+        &ForwardToJavaWebContents<blink::mojom::ShareService>));
 #endif
 
   map->Add<network_hints::mojom::NetworkHintsHandler>(

tools/under-control/src/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureList.java

@@ -25,8 +25,9 @@ import java.util.Map;
 /**
  * A list of feature flags exposed to Java.
  *
- * <p>This class lists flags exposed to Java as String constants. They should match
- * |kFeaturesExposedToJava| in chrome/browser/flags/android/chrome_feature_list.cc.
+ * <p>This class lists flags exposed to Java as String constants. The String value of each feature
+ * name must exactly match the corresponding C++ feature name string |kFeaturesExposedToJava| in
+ * chrome/browser/flags/android/chrome_feature_list.cc.
  *
  * <p>This class also provides convenience methods to access values of flags and their field trial
  * parameters through {@link ChromeFeatureMap}.
@@ -153,12 +154,14 @@ public abstract class ChromeFeatureList {
 
     // Feature names.
     /* Alphabetical: */
-    public static final String ACT_USER_BYPASS_UX = "ActUserBypassUx";
+    public static final String ACCOUNT_FOR_SUPPRESSED_KEYBOARD_INSETS =
+            "AccountForSuppressedKeyboardInsets";
     public static final String ADAPTIVE_BUTTON_IN_TOP_TOOLBAR_CUSTOMIZATION_V2 =
             "AdaptiveButtonInTopToolbarCustomizationV2";
     public static final String ADAPTIVE_BUTTON_IN_TOP_TOOLBAR_PAGE_SUMMARY =
             "AdaptiveButtonInTopToolbarPageSummary";
-    public static final String ALLOW_NEW_INCOGNITO_TAB_INTENTS = "AllowNewIncognitoTabIntents";
+    public static final String ALLOW_TAB_CLOSING_UPON_MINIMIZATION =
+            "AllowTabClosingUponMinimization";
     public static final String ALWAYS_BLOCK_3PCS_INCOGNITO = "AlwaysBlock3pcsIncognito";
     public static final String ANDROID_APPEARANCE_SETTINGS = "AndroidAppearanceSettings";
     public static final String ANDROID_APP_INTEGRATION = "AndroidAppIntegration";
@@ -184,16 +187,22 @@ public abstract class ChromeFeatureList {
             "AndroidOmniboxFocusedNewTabPage";
     public static final String ANDROID_OPEN_PDF_INLINE_BACKPORT = "AndroidOpenPdfInlineBackport";
     public static final String ANDROID_PDF_ASSIST_CONTENT = "AndroidPdfAssistContent";
+    public static final String ANDROID_PROGRESS_BAR_VISUAL_UPDATE =
+            "AndroidProgressBarVisualUpdate";
     public static final String ANDROID_SURFACE_COLOR_UPDATE = "AndroidSurfaceColorUpdate";
-    public static final String ANDROID_TAB_DECLUTTER = "AndroidTabDeclutter";
     public static final String ANDROID_TAB_DECLUTTER_ARCHIVE_ALL_BUT_ACTIVE =
             "AndroidTabDeclutterArchiveAllButActiveTab";
     public static final String ANDROID_TAB_DECLUTTER_ARCHIVE_DUPLICATE_TABS =
             "AndroidTabDeclutterArchiveDuplicateTabs";
     public static final String ANDROID_TAB_DECLUTTER_ARCHIVE_TAB_GROUPS =
             "AndroidTabDeclutterArchiveTabGroups";
+    public static final String ANDROID_TAB_DECLUTTER_AUTO_DELETE = "AndroidTabDeclutterAutoDelete";
+    public static final String ANDROID_TAB_DECLUTTER_AUTO_DELETE_KILL_SWITCH =
+            "AndroidTabDeclutterAutoDeleteKillSwitch";
     public static final String ANDROID_TAB_DECLUTTER_DEDUPE_TAB_IDS_KILL_SWITCH =
             "AndroidTabDeclutterDedupeTabIdsKillSwitch";
+    public static final String ANDROID_TAB_DECLUTTER_PERFORMANCE_IMPROVEMENTS =
+            "AndroidTabDeclutterPerformanceImprovements";
     public static final String ANDROID_TAB_DECLUTTER_RESCUE_KILLSWITCH =
             "AndroidTabDeclutterRescueKillswitch";
     public static final String ANDROID_TAB_SKIP_SAVE_TABS_TASK_KILLSWITCH =
@@ -245,12 +254,14 @@ public abstract class ChromeFeatureList {
     public static final String BACKGROUND_THREAD_POOL = "BackgroundThreadPool";
     public static final String BACK_FORWARD_CACHE = "BackForwardCache";
     public static final String BACK_FORWARD_TRANSITIONS = "BackForwardTransitions";
+    public static final String BATCH_TAB_RESTORE = "BatchTabRestore";
     public static final String BCIV_BOTTOM_CONTROLS = "AndroidBcivBottomControls";
     public static final String BIOMETRIC_AUTH_IDENTITY_CHECK = "BiometricAuthIdentityCheck";
     public static final String BLOCK_INTENTS_WHILE_LOCKED = "BlockIntentsWhileLocked";
     public static final String BOARDING_PASS_DETECTOR = "BoardingPassDetector";
     public static final String BOOKMARK_PANE_ANDROID = "BookmarkPaneAndroid";
     public static final String BOTTOM_BROWSER_CONTROLS_REFACTOR = "BottomBrowserControlsRefactor";
+    public static final String BROWSER_CONTROLS_DEBUGGING = "BrowserControlsDebugging";
     public static final String BROWSER_CONTROLS_EARLY_RESIZE = "BrowserControlsEarlyResize";
     public static final String BROWSER_CONTROLS_IN_VIZ = "AndroidBrowserControlsInViz";
     public static final String BROWSING_DATA_MODEL = "BrowsingDataModel";
@@ -300,6 +311,7 @@ public abstract class ChromeFeatureList {
     public static final String CCT_TOOLBAR_REFACTOR = "CCTToolbarRefactor";
     public static final String CHANGE_UNFOCUSED_PRIORITY = "ChangeUnfocusedPriority";
     public static final String CHROME_SURVEY_NEXT_ANDROID = "ChromeSurveyNextAndroid";
+    public static final String CLAMP_AUTOMOTIVE_SCALING = "ClampAutomotiveScaling";
     public static final String CLANK_STARTUP_LATENCY_INJECTION = "ClankStartupLatencyInjection";
     public static final String CLANK_WHATS_NEW = "ClankWhatsNew";
     public static final String CLEAR_BROWSING_DATA_ANDROID_SURVEY =
@@ -325,6 +337,7 @@ public abstract class ChromeFeatureList {
     public static final String CONTROLS_VISIBILITY_FROM_NAVIGATIONS =
             "ControlsVisibilityFromNavigations";
     public static final String CORMORANT = "Cormorant";
+    public static final String CPA_SPEC_UPDATE = "CpaSpecUpdate";
     public static final String CROSS_DEVICE_TAB_PANE_ANDROID = "CrossDeviceTabPaneAndroid";
     public static final String DARKEN_WEBSITES_CHECKBOX_IN_THEMES_SETTING =
             "DarkenWebsitesCheckboxInThemesSetting";
@@ -335,7 +348,6 @@ public abstract class ChromeFeatureList {
     public static final String DEFAULT_BROWSER_PROMO_ANDROID2 = "DefaultBrowserPromoAndroid2";
     public static final String DETAILED_LANGUAGE_SETTINGS = "DetailedLanguageSettings";
     public static final String DEVICE_AUTHENTICATOR_ANDROIDX = "DeviceAuthenticatorAndroidx";
-    public static final String DISABLE_COMPOSITED_PROGRESS_BAR = "DisableCompositedProgressBar";
     public static final String DISABLE_INSTANCE_LIMIT = "DisableInstanceLimit";
     public static final String DISABLE_LIST_TAB_SWITCHER = "DisableListTabSwitcher";
     public static final String DISCO_FEED_ENDPOINT = "DiscoFeedEndpoint";
@@ -346,15 +358,18 @@ public abstract class ChromeFeatureList {
     public static final String DRAW_KEY_NATIVE_EDGE_TO_EDGE = "DrawKeyNativeEdgeToEdge";
     public static final String DYNAMIC_SAFE_AREA_INSETS = "DynamicSafeAreaInsets";
     public static final String EDGE_TO_EDGE_BOTTOM_CHIN = "EdgeToEdgeBottomChin";
+    public static final String EDGE_TO_EDGE_DEBUGGING = "EdgeToEdgeDebugging";
+    public static final String EDGE_TO_EDGE_MONITOR_CONFIGURATIONS =
+            "EdgeToEdgeMonitorConfigurations";
     public static final String EDGE_TO_EDGE_EVERYWHERE = "EdgeToEdgeEverywhere";
     public static final String EDGE_TO_EDGE_SAFE_AREA_CONSTRAINT = "EdgeToEdgeSafeAreaConstraint";
+    public static final String EDGE_TO_EDGE_TABLET = "EdgeToEdgeTablet";
     public static final String EDGE_TO_EDGE_WEB_OPT_IN = "EdgeToEdgeWebOptIn";
     public static final String EDUCATIONAL_TIP_DEFAULT_BROWSER_PROMO_CARD =
             "EducationalTipDefaultBrowserPromoCard";
     public static final String EDUCATIONAL_TIP_MODULE = "EducationalTipModule";
     public static final String EMPTY_TAB_LIST_ANIMATION_KILL_SWITCH =
             "EmptyTabListAnimationKillSwitch";
-    public static final String ENABLE_BATCH_UPLOAD_FROM_SETTINGS = "EnableBatchUploadFromSettings";
     public static final String ENABLE_SAVE_PACKAGE_FOR_OFF_THE_RECORD =
             "EnableSavePackageForOffTheRecord";
     public static final String ENABLE_CLIPBOARD_DATA_CONTROLS_ANDROID =
@@ -373,8 +388,6 @@ public abstract class ChromeFeatureList {
     public static final String FLOATING_SNACKBAR = "FloatingSnackbar";
     public static final String FORCE_BROWSER_CONTROLS_UPON_EXITING_FULLSCREEN =
             "ForceBrowserControlsUponExitingFullscreen";
-    public static final String FORCE_DISABLE_EXTENDED_SYNC_PROMOS =
-            "ForceDisableExtendedSyncPromos";
     public static final String FORCE_LIST_TAB_SWITCHER = "ForceListTabSwitcher";
     public static final String FORCE_STARTUP_SIGNIN_PROMO = "ForceStartupSigninPromo";
     public static final String FORCE_TRANSLUCENT_NOTIFICATION_TRAMPOLINE =
@@ -395,10 +408,13 @@ public abstract class ChromeFeatureList {
             "HideTabletToolbarDownloadButton";
     public static final String HISTORY_JOURNEYS = "Journeys";
     public static final String HISTORY_PANE_ANDROID = "HistoryPaneAndroid";
+    public static final String HOMEPAGE_IS_NEW_TAB_PAGE_POLICY_ANDROID =
+            "HomepageIsNewTabPagePolicyAndroid";
     public static final String HTTPS_FIRST_BALANCED_MODE = "HttpsFirstBalancedMode";
     public static final String INCOGNITO_SCREENSHOT = "IncognitoScreenshot";
+    public static final String INSTANCE_SWITCHER_V2 = "InstanceSwitcherV2";
     public static final String IP_PROTECTION_UX = "IpProtectionUx";
-    public static final String KEYBOARD_ESC_BACK_NAVIGAION = "KeyboardEscBackNavigation";
+    public static final String KEYBOARD_ESC_BACK_NAVIGATION = "KeyboardEscBackNavigation";
     public static final String LEGACY_TAB_STATE_DEPRECATION = "LegacyTabStateDeprecation";
     public static final String LENS_ON_QUICK_ACTION_SEARCH_WIDGET = "LensOnQuickActionSearchWidget";
     public static final String LINKED_SERVICES_SETTING = "LinkedServicesSetting";
@@ -416,16 +432,17 @@ public abstract class ChromeFeatureList {
     public static final String MOST_VISITED_TILES_RESELECT = "MostVisitedTilesReselect";
     public static final String MULTI_INSTANCE_APPLICATION_STATUS_CLEANUP =
             "MultiInstanceApplicationStatusCleanup";
+    public static final String MVC_UPDATE_VIEW_WHEN_MODEL_CHANGED = "MvcUpdateViewWhenModelChanged";
     public static final String NATIVE_PAGE_TRANSITION_HARDWARE_CAPTURE =
             "NativePageTransitionHardwareCapture";
-    public static final String NAVIGATION_CAPTURE_REFACTOR = "NavigationCaptureRefactorAndroid";
     public static final String NAV_BAR_COLOR_ANIMATION = "NavBarColorAnimation";
     public static final String NAV_BAR_COLOR_MATCHES_TAB_BACKGROUND =
             "NavBarColorMatchesTabBackground";
     public static final String NEW_TAB_PAGE_ANDROID_TRIGGER_FOR_PRERENDER2 =
             "NewTabPageAndroidTriggerForPrerender2";
     public static final String NEW_TAB_PAGE_CUSTOMIZATION = "NewTabPageCustomization";
-    public static final String NEW_TAB_SEARCH_ENGINE_URL_ANDROID = "NewTabSearchEngineUrlAndroid";
+    public static final String NEW_TAB_PAGE_CUSTOMIZATION_TOOLBAR_BUTTON =
+            "NewTabPageCustomizationToolbarButton";
     public static final String NOTIFICATION_ONE_TAP_UNSUBSCRIBE = "NotificationOneTapUnsubscribe";
     public static final String NOTIFICATION_PERMISSION_BOTTOM_SHEET =
             "NotificationPermissionBottomSheet";
@@ -443,7 +460,6 @@ public abstract class ChromeFeatureList {
     public static final String PARTNER_CUSTOMIZATIONS_UMA = "PartnerCustomizationsUma";
     public static final String PASSWORD_FORM_GROUPED_AFFILIATIONS =
             "PasswordFormGroupedAffiliations";
-    public static final String PASSWORD_LEAK_TOGGLE_MOVE = "PasswordLeakToggleMove";
     public static final String PERMISSION_DEDICATED_CPSS_SETTING_ANDROID =
             "PermissionDedicatedCpssSettingAndroid";
     public static final String PERMISSION_SITE_SETTING_RADIO_BUTTON =
@@ -470,8 +486,6 @@ public abstract class ChromeFeatureList {
             "PrivacySandboxAdTopicsContentParity";
     public static final String PRIVACY_SANDBOX_CCT_ADS_NOTICE_SURVEY =
             "PrivacySandboxCctAdsNoticeSurvey";
-    public static final String PRIVACY_SANDBOX_NOTICE_ACTION_DEBOUNCING_ANDROID =
-            "PrivacySandboxNoticeActionDebouncingAndroid";
     public static final String PRIVACY_SANDBOX_RELATED_WEBSITE_SETS_UI =
             "PrivacySandboxRelatedWebsiteSetsUi";
     public static final String PRIVACY_SANDBOX_SENTIMENT_SURVEY = "PrivacySandboxSentimentSurvey";
@@ -486,6 +500,8 @@ public abstract class ChromeFeatureList {
     public static final String QUIET_NOTIFICATION_PROMPTS = "QuietNotificationPrompts";
     public static final String READALOUD = "ReadAloud";
     public static final String READALOUD_AUDIO_OVERVIEWS = "ReadAloudAudioOverviews";
+    public static final String READALOUD_AUDIO_OVERVIEWS_FEEDBACK =
+            "ReadAloudAudioOverviewsFeedback";
     public static final String READALOUD_BACKGROUND_PLAYBACK = "ReadAloudBackgroundPlayback";
     public static final String READALOUD_IN_MULTI_WINDOW = "ReadAloudInMultiWindow";
     public static final String READALOUD_IN_OVERFLOW_MENU_IN_CCT = "ReadAloudInOverflowMenuInCCT";
@@ -500,6 +516,8 @@ public abstract class ChromeFeatureList {
     public static final String REMOVE_TAB_FOCUS_ON_SHOWING_AND_SELECT =
             "RemoveTabFocusOnShowingAndSelect";
     public static final String RENAME_JOURNEYS = "RenameJourneys";
+    public static final String REPORT_NOTIFICATION_CONTENT_DETECTION_DATA =
+            "ReportNotificationContentDetectionData";
     public static final String RIGHT_EDGE_GOES_FORWARD_GESTURE_NAV =
             "RightEdgeGoesForwardGestureNav";
     public static final String SAFETY_HUB = "SafetyHub";
@@ -534,6 +552,7 @@ public abstract class ChromeFeatureList {
             "SensitiveContentWhileSwitchingTabs";
     public static final String SETTINGS_SINGLE_ACTIVITY = "SettingsSingleActivity";
     public static final String SHARE_CUSTOM_ACTIONS_IN_CCT = "ShareCustomActionsInCCT";
+    public static final String SHOW_HOME_BUTTON_POLICY_ANDROID = "ShowHomeButtonPolicyAndroid";
     public static final String SHOW_NEW_TAB_ANIMATIONS = "ShowNewTabAnimations";
     public static final String SHOW_WARNINGS_FOR_SUSPICIOUS_NOTIFICATIONS =
             "ShowWarningsForSuspiciousNotifications";
@@ -559,9 +578,11 @@ public abstract class ChromeFeatureList {
     public static final String TAB_GROUP_SYNC_ANDROID = "TabGroupSyncAndroid";
     public static final String TAB_GROUP_SYNC_AUTO_OPEN_KILL_SWITCH =
             "TabGroupSyncAutoOpenKillSwitch";
+    public static final String TABLET_TAB_STRIP_ANIMATION = "TabletTabStripAnimation";
     public static final String TAB_RESUMPTION_MODULE_ANDROID = "TabResumptionModuleAndroid";
     public static final String TAB_STATE_FLAT_BUFFER = "TabStateFlatBuffer";
     public static final String TAB_STRIP_CONTEXT_MENU = "TabStripContextMenuAndroid";
+    public static final String TAB_STRIP_DENSITY_CHANGE_ANDROID = "TabStripDensityChangeAndroid";
     public static final String TAB_STRIP_GROUP_DRAG_DROP_ANDROID = "TabStripGroupDragDropAndroid";
     public static final String TAB_STRIP_GROUP_REORDER = "TabStripGroupReorderAndroid";
     public static final String TAB_STRIP_INCOGNITO_MIGRATION = "TabStripIncognitoMigration";
@@ -579,24 +600,23 @@ public abstract class ChromeFeatureList {
     public static final String TILE_CONTEXT_MENU_REFACTOR = "TileContextMenuRefactor";
     public static final String TINKER_TANK_BOTTOM_SHEET = "TinkerTankBottomSheet";
     public static final String TOOLBAR_SCROLL_ABLATION = "AndroidToolbarScrollAblation";
+    public static final String TOP_CONTROLS_REFACTOR = "TopControlsRefactor";
     public static final String TRACE_BINDER_IPC = "TraceBinderIpc";
     public static final String TRACKING_PROTECTION_3PCD = "TrackingProtection3pcd";
-    public static final String TRACKING_PROTECTION_CONTENT_SETTING_UB_CONTROL =
-            "TrackingProtectionContentSettingUbControl";
     public static final String TRACKING_PROTECTION_USER_BYPASS_PWA =
             "TrackingProtectionUserBypassPwa";
     public static final String TRACKING_PROTECTION_USER_BYPASS_PWA_TRIGGER =
             "TrackingProtectionUserBypassPwaTrigger";
     public static final String TRANSLATE_MESSAGE_UI = "TranslateMessageUI";
     public static final String TRANSLATE_TFLITE = "TFLiteLanguageDetectionEnabled";
-    public static final String UNIFIED_PASSWORD_MANAGER_LOCAL_PWD_MIGRATION_WARNING =
-            "UnifiedPasswordManagerLocalPasswordsMigrationWarning";
     public static final String UNO_PHASE_2_FOLLOW_UP = "UnoPhase2FollowUp";
     public static final String UPDATE_COMPOSTIROR_FOR_SURFACE_CONTROL =
             "UpdateCompositorForSurfaceControl";
     public static final String USE_ALTERNATE_HISTORY_SYNC_ILLUSTRATION =
             "UseAlternateHistorySyncIllustration";
     public static final String USE_CHIME_ANDROID_SDK = "UseChimeAndroidSdk";
+    public static final String USE_ACTIVITY_MANAGER_FOR_TAB_ACTIVATION =
+            "UseActivityManagerForTabActivation";
     public static final String USE_LIBUNWINDSTACK_NATIVE_UNWINDER_ANDROID =
             "UseLibunwindstackNativeUnwinderAndroid";
     public static final String VISITED_URL_RANKING_SERVICE = "VisitedURLRankingService";
@@ -611,12 +631,16 @@ public abstract class ChromeFeatureList {
     public static final String XSURFACE_METRICS_REPORTING = "XsurfaceMetricsReporting";
 
     /* Alphabetical: */
+    public static final CachedFlag sAccountForSuppressedKeyboardInsets =
+            newCachedFlag(ACCOUNT_FOR_SUPPRESSED_KEYBOARD_INSETS, /* defaultValue= */ true);
+    public static final CachedFlag sAllowTabClosingUponMinimization =
+            newCachedFlag(ALLOW_TAB_CLOSING_UPON_MINIMIZATION, false);
     public static final CachedFlag sAndroidAppIntegration =
             newCachedFlag(ANDROID_APP_INTEGRATION, true);
     public static final CachedFlag sAndroidAppIntegrationModule =
             newCachedFlag(ANDROID_APP_INTEGRATION_MODULE, true);
     public static final CachedFlag sAndroidAppIntegrationMultiDataSource =
-            newCachedFlag(ANDROID_APP_INTEGRATION_MULTI_DATA_SOURCE, false);
+            newCachedFlag(ANDROID_APP_INTEGRATION_MULTI_DATA_SOURCE, false, true);
     public static final CachedFlag sAndroidAppIntegrationV2 =
             newCachedFlag(ANDROID_APP_INTEGRATION_V2, true);
     public static final CachedFlag sAndroidAppIntegrationWithFavicon =
@@ -626,16 +650,22 @@ public abstract class ChromeFeatureList {
     public static final CachedFlag sAndroidElegantTextHeight =
             newCachedFlag(ANDROID_ELEGANT_TEXT_HEIGHT, true);
     public static final CachedFlag sAndroidMinimalUiLargeScreen =
-            newCachedFlag(ANDROID_MINIMAL_UI_LARGE_SCREEN, false);
+            newCachedFlag(ANDROID_MINIMAL_UI_LARGE_SCREEN, false, true);
+    public static final CachedFlag sAndroidProgressBarVisualUpdate =
+            newCachedFlag(ANDROID_PROGRESS_BAR_VISUAL_UPDATE, false);
     public static final CachedFlag sAndroidSurfaceColorUpdate =
-            newCachedFlag(ANDROID_SURFACE_COLOR_UPDATE, /* defaultValue= */ false);
+            newCachedFlag(
+                    ANDROID_SURFACE_COLOR_UPDATE,
+                    /* defaultValue= */ false,
+                    /* defaultValueInTests= */ true);
     public static final CachedFlag sAndroidTabDeclutterDedupeTabIdsKillSwitch =
             newCachedFlag(ANDROID_TAB_DECLUTTER_DEDUPE_TAB_IDS_KILL_SWITCH, true);
     public static final CachedFlag sAndroidTabSkipSaveTabsKillswitch =
             newCachedFlag(ANDROID_TAB_SKIP_SAVE_TABS_TASK_KILLSWITCH, true, true);
-    public static final CachedFlag sAndroidThemeModule = newCachedFlag(ANDROID_THEME_MODULE, false);
+    public static final CachedFlag sAndroidThemeModule =
+            newCachedFlag(ANDROID_THEME_MODULE, false, /* defaultValueInTests= */ true);
     public static final CachedFlag sAndroidWebAppLaunchHandler =
-            newCachedFlag(ANDROID_WEB_APP_LAUNCH_HANDLER, false);
+            newCachedFlag(ANDROID_WEB_APP_LAUNCH_HANDLER, false, true);
     public static final CachedFlag sAndroidWindowPopupLargeScreen =
             newCachedFlag(ANDROID_WINDOW_POPUP_LARGE_SCREEN, false);
     public static final CachedFlag sAppSpecificHistory = newCachedFlag(APP_SPECIFIC_HISTORY, true);
@@ -643,15 +673,17 @@ public abstract class ChromeFeatureList {
             newCachedFlag(ASYNC_NOTIFICATION_MANAGER, false, true);
     public static final CachedFlag sAsyncNotificationManagerForDownload =
             newCachedFlag(ASYNC_NOTIFICATION_MANAGER_FOR_DOWNLOAD, false, true);
+    public static final CachedFlag sBatchTabRestore =
+            newCachedFlag(
+                    BATCH_TAB_RESTORE, /* defaultValue= */ false, /* defaultValueInTests= */ true);
     public static final CachedFlag sBlockIntentsWhileLocked =
             newCachedFlag(BLOCK_INTENTS_WHILE_LOCKED, false);
     public static final CachedFlag sBookmarkPaneAndroid =
             newCachedFlag(BOOKMARK_PANE_ANDROID, false);
+    public static final CachedFlag sBrowserControlsDebugging =
+            newCachedFlag(BROWSER_CONTROLS_DEBUGGING, false);
     public static final CachedFlag sCacheIsMultiInstanceApi31Enabled =
-            newCachedFlag(
-                    CACHE_IS_MULTI_INSTANCE_API_31_ENABLED,
-                    /* defaultValue= */ false,
-                    /* defaultValueInTests= */ true);
+            newCachedFlag(CACHE_IS_MULTI_INSTANCE_API_31_ENABLED, true);
     public static final CachedFlag sCctAdaptiveButton = newCachedFlag(CCT_ADAPTIVE_BUTTON, false);
     public static final CachedFlag sCctAuthTab = newCachedFlag(CCT_AUTH_TAB, true);
     public static final CachedFlag sCctAuthTabDisableAllExternalIntents =
@@ -688,7 +720,10 @@ public abstract class ChromeFeatureList {
     public static final CachedFlag sCctNestedSecurityIcon =
             newCachedFlag(CCT_NESTED_SECURITY_ICON, true);
     public static final CachedFlag sCctPredictiveBackGesture =
-            newCachedFlag(CCT_PREDICTIVE_BACK_GESTURE, false);
+            newCachedFlag(
+                    CCT_PREDICTIVE_BACK_GESTURE,
+                    /* defaultValue= */ false,
+                    /* defaultValueInTests= */ true);
     public static final CachedFlag sCctOpenInBrowserButtonIfAllowedByEmbedder =
             newCachedFlag(CCT_OPEN_IN_BROWSER_BUTTON_IF_ALLOWED_BY_EMBEDDER, false);
     public static final CachedFlag sCctOpenInBrowserButtonIfEnabledByEmbedder =
@@ -699,6 +734,8 @@ public abstract class ChromeFeatureList {
             newCachedFlag(CCT_REVAMPED_BRANDING, true);
     public static final CachedFlag sCctTabModalDialog = newCachedFlag(CCT_TAB_MODAL_DIALOG, true);
     public static final CachedFlag sCctToolbarRefactor = newCachedFlag(CCT_TOOLBAR_REFACTOR, false);
+    public static final CachedFlag sClampAutomotiveScaling =
+            newCachedFlag(CLAMP_AUTOMOTIVE_SCALING, true);
     public static final CachedFlag sClankStartupLatencyInjection =
             newCachedFlag(CLANK_STARTUP_LATENCY_INJECTION, false);
     public static final CachedFlag sCollectAndroidFrameTimelineMetrics =
@@ -708,6 +745,7 @@ public abstract class ChromeFeatureList {
                     /* defaultValueInTests= */ true);
     public static final CachedFlag sCommandLineOnNonRooted =
             newCachedFlag(COMMAND_LINE_ON_NON_ROOTED, false);
+    public static final CachedFlag sCpaSpecUpdate = newCachedFlag(CPA_SPEC_UPDATE, false);
     public static final CachedFlag sCrossDeviceTabPaneAndroid =
             newCachedFlag(CROSS_DEVICE_TAB_PANE_ANDROID, false);
     public static final CachedFlag sDisableInstanceLimit =
@@ -724,11 +762,19 @@ public abstract class ChromeFeatureList {
             newCachedFlag(DRAW_KEY_NATIVE_EDGE_TO_EDGE, true);
     public static final CachedFlag sEdgeToEdgeBottomChin =
             newCachedFlag(EDGE_TO_EDGE_BOTTOM_CHIN, /* defaultValue= */ true);
+    public static final CachedFlag sEdgeToEdgeDebugging =
+            newCachedFlag(
+                    EDGE_TO_EDGE_DEBUGGING,
+                    /* defaultValue= */ false,
+                    /* defaultValueInTests= */ true);
+    public static final CachedFlag sEdgeToEdgeMonitorConfigurations =
+            newCachedFlag(EDGE_TO_EDGE_MONITOR_CONFIGURATIONS, /* defaultValue= */ true);
     public static final CachedFlag sEdgeToEdgeEverywhere =
             newCachedFlag(
                     EDGE_TO_EDGE_EVERYWHERE,
                     /* defaultValue= */ false,
                     /* defaultValueInTests= */ true);
+    public static final CachedFlag sEdgeToEdgeTablet = newCachedFlag(EDGE_TO_EDGE_TABLET, false);
     public static final CachedFlag sEdgeToEdgeWebOptIn =
             newCachedFlag(EDGE_TO_EDGE_WEB_OPT_IN, true);
     public static final CachedFlag sEducationalTipDefaultBrowserPromoCard =
@@ -749,14 +795,19 @@ public abstract class ChromeFeatureList {
     public static final CachedFlag sFullscreenInsetsApiMigrationOnAutomotive =
             newCachedFlag(FULLSCREEN_INSETS_API_MIGRATION_ON_AUTOMOTIVE, true);
     public static final CachedFlag sGridTabSwitcherSurfaceColorUpdate =
-            newCachedFlag(GRID_TAB_SWITCHER_SURFACE_COLOR_UPDATE, /* defaultValue= */ false);
+            newCachedFlag(
+                    GRID_TAB_SWITCHER_SURFACE_COLOR_UPDATE,
+                    /* defaultValue= */ false,
+                    /* defaultValueInTests= */ true);
     public static final CachedFlag sGridTabSwitcherUpdate =
-            newCachedFlag(GRID_TAB_SWITCHER_UPDATE, false);
+            newCachedFlag(GRID_TAB_SWITCHER_UPDATE, false, /* defaultValueInTests= */ true);
     public static final CachedFlag sHideTabletToolbarDownloadButton =
             newCachedFlag(HIDE_TABLET_TOOLBAR_DOWNLOAD_BUTTON, true);
     public static final CachedFlag sHistoryPaneAndroid = newCachedFlag(HISTORY_PANE_ANDROID, false);
+    public static final CachedFlag sHomepageIsNewTabPagePolicyAndroid =
+            newCachedFlag(HOMEPAGE_IS_NEW_TAB_PAGE_POLICY_ANDROID, false);
     public static final CachedFlag sKeyboardEscBackNavigation =
-            newCachedFlag(KEYBOARD_ESC_BACK_NAVIGAION, false);
+            newCachedFlag(KEYBOARD_ESC_BACK_NAVIGATION, true);
     public static final CachedFlag sLegacyTabStateDeprecation =
             newCachedFlag(
                     LEGACY_TAB_STATE_DEPRECATION,
@@ -765,13 +816,18 @@ public abstract class ChromeFeatureList {
     public static final CachedFlag sLockBackPressHandlerAtStart =
             newCachedFlag(LOCK_BACK_PRESS_HANDLER_AT_START, true);
     public static final CachedFlag sMagicStackAndroid = newCachedFlag(MAGIC_STACK_ANDROID, true);
-    public static final CachedFlag sMiniOriginBar = newCachedFlag(MINI_ORIGIN_BAR, false);
+    public static final CachedFlag sMiniOriginBar = newCachedFlag(MINI_ORIGIN_BAR, false, true);
     public static final CachedFlag sMostVisitedTilesCustomization =
             newCachedFlag(MOST_VISITED_TILES_CUSTOMIZATION, false);
     public static final CachedFlag sMostVisitedTilesReselect =
             newCachedFlag(MOST_VISITED_TILES_RESELECT, false);
     public static final CachedFlag sMultiInstanceApplicationStatusCleanup =
             newCachedFlag(MULTI_INSTANCE_APPLICATION_STATUS_CLEANUP, false);
+    public static final CachedFlag sMvcUpdateViewWhenModelChanged =
+            newCachedFlag(
+                    MVC_UPDATE_VIEW_WHEN_MODEL_CHANGED,
+                    /* defaultValue= */ false,
+                    /* defaultValueInTests= */ true);
     public static final CachedFlag sNavBarColorAnimation =
             newCachedFlag(NAV_BAR_COLOR_ANIMATION, false);
     public static final CachedFlag sNavBarColorMatchesTabBackground =
@@ -779,7 +835,9 @@ public abstract class ChromeFeatureList {
     public static final CachedFlag sNewTabPageAndroidTriggerForPrerender2 =
             newCachedFlag(NEW_TAB_PAGE_ANDROID_TRIGGER_FOR_PRERENDER2, true);
     public static final CachedFlag sNewTabPageCustomization =
-            newCachedFlag(NEW_TAB_PAGE_CUSTOMIZATION, false);
+            newCachedFlag(NEW_TAB_PAGE_CUSTOMIZATION, false, true);
+    public static final CachedFlag sNewTabPageCustomizationToolbarButton =
+            newCachedFlag(NEW_TAB_PAGE_CUSTOMIZATION_TOOLBAR_BUTTON, false);
     public static final CachedFlag sNotificationTrampoline =
             newCachedFlag(NOTIFICATION_TRAMPOLINE, false);
     public static final CachedFlag sOptimizationGuidePushNotifications =
@@ -795,6 +853,11 @@ public abstract class ChromeFeatureList {
     public static final CachedFlag sPrefetchBrowserInitiatedTriggers =
             newCachedFlag(PREFETCH_BROWSER_INITIATED_TRIGGERS, true);
     public static final CachedFlag sPriceChangeModule = newCachedFlag(PRICE_CHANGE_MODULE, true);
+    public static final CachedFlag sReportNotificationContentDetectionData =
+            newCachedFlag(
+                    REPORT_NOTIFICATION_CONTENT_DETECTION_DATA,
+                    /* defaultValue= */ false,
+                    /* defaultValueInTests= */ true);
     public static final CachedFlag sRightEdgeGoesForwardGestureNav =
             newCachedFlag(RIGHT_EDGE_GOES_FORWARD_GESTURE_NAV, false);
     public static final CachedFlag sSafetyHubMagicStack =
@@ -808,6 +871,8 @@ public abstract class ChromeFeatureList {
             newCachedFlag(SEARCH_IN_CCT_ALTERNATE_TAP_HANDLING, false);
     public static final CachedFlag sSettingsSingleActivity =
             newCachedFlag(SETTINGS_SINGLE_ACTIVITY, false);
+    public static final CachedFlag sShowHomeButtonPolicyAndroid =
+            newCachedFlag(SHOW_HOME_BUTTON_POLICY_ANDROID, false);
     public static final CachedFlag sSkipIsolatedSplitPreload =
             newCachedFlag(
                     SKIP_ISOLATED_SPLIT_PRELOAD,
@@ -819,16 +884,20 @@ public abstract class ChromeFeatureList {
             newCachedFlag(START_SURFACE_RETURN_TIME, true);
     public static final CachedFlag sTabClosureMethodRefactor =
             newCachedFlag(TAB_CLOSURE_METHOD_REFACTOR, false);
+    public static final CachedFlag sTabletTabStripAnimation =
+            newCachedFlag(TABLET_TAB_STRIP_ANIMATION, false);
     public static final CachedFlag sTabStateFlatBuffer =
             newCachedFlag(
                     TAB_STATE_FLAT_BUFFER,
                     /* defaultValue= */ true,
                     /* defaultValueInTests= */ true);
+    public static final CachedFlag sTabStripDensityChangeAndroid =
+            newCachedFlag(TAB_STRIP_DENSITY_CHANGE_ANDROID, false);
     public static final CachedFlag sTabStripIncognitoMigration =
             newCachedFlag(
                     TAB_STRIP_INCOGNITO_MIGRATION,
                     /* defaultValue= */ false,
-                    /* defaultValueInTests= */ true);
+                    /* defaultValueInTests= */ false);
     public static final CachedFlag sTabStripLayoutOptimization =
             newCachedFlag(
                     TAB_STRIP_LAYOUT_OPTIMIZATION,
@@ -839,9 +908,16 @@ public abstract class ChromeFeatureList {
     public static final CachedFlag sTestDefaultDisabled =
             newCachedFlag(TEST_DEFAULT_DISABLED, false);
     public static final CachedFlag sTestDefaultEnabled = newCachedFlag(TEST_DEFAULT_ENABLED, true);
+    public static final CachedFlag sTopControlsRefactor =
+            newCachedFlag(
+                    TOP_CONTROLS_REFACTOR,
+                    /* defaultValue= */ false,
+                    /* defaultValueInTests= */ true);
     public static final CachedFlag sTraceBinderIpc = newCachedFlag(TRACE_BINDER_IPC, false);
     public static final CachedFlag sUseChimeAndroidSdk =
             newCachedFlag(USE_CHIME_ANDROID_SDK, false);
+    public static final CachedFlag sUseActivityManagerForTabActivation =
+            newCachedFlag(USE_ACTIVITY_MANAGER_FOR_TAB_ACTIVATION, true);
     public static final CachedFlag sUseLibunwindstackNativeUnwinderAndroid =
             newCachedFlag(USE_LIBUNWINDSTACK_NATIVE_UNWINDER_ANDROID, true);
     public static final CachedFlag sWebApkMinShellApkVersion =
@@ -849,6 +925,8 @@ public abstract class ChromeFeatureList {
 
     public static final List<CachedFlag> sFlagsCachedFullBrowser =
             List.of(
+                    sAccountForSuppressedKeyboardInsets,
+                    sAllowTabClosingUponMinimization,
                     sAndroidAppIntegration,
                     sAndroidAppIntegrationModule,
                     sAndroidAppIntegrationMultiDataSource,
@@ -857,6 +935,7 @@ public abstract class ChromeFeatureList {
                     sAndroidBottomToolbar,
                     sAndroidElegantTextHeight,
                     sAndroidMinimalUiLargeScreen,
+                    sAndroidProgressBarVisualUpdate,
                     sAndroidSurfaceColorUpdate,
                     sAndroidTabDeclutterDedupeTabIdsKillSwitch,
                     sAndroidTabSkipSaveTabsKillswitch,
@@ -865,8 +944,10 @@ public abstract class ChromeFeatureList {
                     sAndroidWindowPopupLargeScreen,
                     sAppSpecificHistory,
                     sAsyncNotificationManager,
+                    sBatchTabRestore,
                     sBlockIntentsWhileLocked,
                     sBookmarkPaneAndroid,
+                    sBrowserControlsDebugging,
                     sCacheIsMultiInstanceApi31Enabled,
                     sCctAdaptiveButton,
                     sCctAuthTab,
@@ -891,15 +972,20 @@ public abstract class ChromeFeatureList {
                     sCctRevampedBranding,
                     sCctTabModalDialog,
                     sCctToolbarRefactor,
+                    sClampAutomotiveScaling,
                     sClankStartupLatencyInjection,
                     sCollectAndroidFrameTimelineMetrics,
                     sCommandLineOnNonRooted,
+                    sCpaSpecUpdate,
                     sCrossDeviceTabPaneAndroid,
                     sDisableInstanceLimit,
                     sDisableListTabSwitcher,
                     sDrawKeyNativeEdgeToEdge,
                     sEdgeToEdgeBottomChin,
+                    sEdgeToEdgeDebugging,
                     sEdgeToEdgeEverywhere,
+                    sEdgeToEdgeMonitorConfigurations,
+                    sEdgeToEdgeTablet,
                     sEdgeToEdgeWebOptIn,
                     sEducationalTipDefaultBrowserPromoCard,
                     sEducationalTipModule,
@@ -914,6 +1000,7 @@ public abstract class ChromeFeatureList {
                     sGridTabSwitcherUpdate,
                     sHideTabletToolbarDownloadButton,
                     sHistoryPaneAndroid,
+                    sHomepageIsNewTabPagePolicyAndroid,
                     sKeyboardEscBackNavigation,
                     sLegacyTabStateDeprecation,
                     sLockBackPressHandlerAtStart,
@@ -922,10 +1009,12 @@ public abstract class ChromeFeatureList {
                     sMostVisitedTilesCustomization,
                     sMostVisitedTilesReselect,
                     sMultiInstanceApplicationStatusCleanup,
+                    sMvcUpdateViewWhenModelChanged,
                     sNavBarColorAnimation,
                     sNavBarColorMatchesTabBackground,
                     sNewTabPageAndroidTriggerForPrerender2,
                     sNewTabPageCustomization,
+                    sNewTabPageCustomizationToolbarButton,
                     sNotificationTrampoline,
                     sOptimizationGuidePushNotifications,
                     sPaintPreviewDemo,
@@ -933,22 +1022,28 @@ public abstract class ChromeFeatureList {
                     sPowerSavingModeBroadcastReceiverInBackground,
                     sPrefetchBrowserInitiatedTriggers,
                     sPriceChangeModule,
+                    sReportNotificationContentDetectionData,
                     sRightEdgeGoesForwardGestureNav,
                     sSafetyHubMagicStack,
                     sSafetyHubWeakAndReusedPasswords,
                     sSearchInCCT,
                     sSearchInCCTAlternateTapHandling,
                     sSettingsSingleActivity,
+                    sShowHomeButtonPolicyAndroid,
                     sSkipIsolatedSplitPreload,
                     sSmallerTabStripTitleLimit,
                     sStartSurfaceReturnTime,
                     sTabClosureMethodRefactor,
+                    sTabletTabStripAnimation,
                     sTabStateFlatBuffer,
+                    sTabStripDensityChangeAndroid,
                     sTabStripIncognitoMigration,
                     sTabStripLayoutOptimization,
                     sTabWindowManagerReportIndicesMismatch,
+                    sTopControlsRefactor,
                     sTraceBinderIpc,
                     sUseChimeAndroidSdk,
+                    sUseActivityManagerForTabActivation,
                     sUseLibunwindstackNativeUnwinderAndroid,
                     sWebApkMinShellApkVersion);
 
@@ -975,18 +1070,22 @@ public abstract class ChromeFeatureList {
             newMutableFlagWithSafeDefault(ANDROID_DUMP_ON_SCROLL_WITHOUT_RESOURCE, false);
     public static final MutableFlagWithSafeDefault sAndroidNativePagesInNewTab =
             newMutableFlagWithSafeDefault(ANDROID_NATIVE_PAGES_IN_NEW_TAB, false);
-    public static final MutableFlagWithSafeDefault sAndroidTabDeclutter =
-            newMutableFlagWithSafeDefault(ANDROID_TAB_DECLUTTER, true);
     public static final MutableFlagWithSafeDefault sAndroidTabDeclutterArchiveAllButActiveTab =
             newMutableFlagWithSafeDefault(ANDROID_TAB_DECLUTTER_ARCHIVE_ALL_BUT_ACTIVE, false);
     public static final MutableFlagWithSafeDefault sAndroidTabDeclutterArchiveDuplicateTabs =
             newMutableFlagWithSafeDefault(ANDROID_TAB_DECLUTTER_ARCHIVE_DUPLICATE_TABS, true);
     public static final MutableFlagWithSafeDefault sAndroidTabDeclutterArchiveTabGroups =
             newMutableFlagWithSafeDefault(ANDROID_TAB_DECLUTTER_ARCHIVE_TAB_GROUPS, false);
+    public static final MutableFlagWithSafeDefault sAndroidTabDeclutterAutoDelete =
+            newMutableFlagWithSafeDefault(ANDROID_TAB_DECLUTTER_AUTO_DELETE, false);
+    public static final MutableFlagWithSafeDefault sAndroidTabDeclutterAutoDeleteKillSwitch =
+            newMutableFlagWithSafeDefault(ANDROID_TAB_DECLUTTER_AUTO_DELETE_KILL_SWITCH, true);
+    public static final MutableFlagWithSafeDefault sAndroidTabDeclutterPerformanceImprovements =
+            newMutableFlagWithSafeDefault(ANDROID_TAB_DECLUTTER_PERFORMANCE_IMPROVEMENTS, false);
     public static final MutableFlagWithSafeDefault sAndroidTabDeclutterRescueKillSwitch =
             newMutableFlagWithSafeDefault(ANDROID_TAB_DECLUTTER_RESCUE_KILLSWITCH, true);
     public static final MutableFlagWithSafeDefault sBcivBottomControls =
-            newMutableFlagWithSafeDefault(BCIV_BOTTOM_CONTROLS, false);
+            newMutableFlagWithSafeDefault(BCIV_BOTTOM_CONTROLS, true);
     public static final MutableFlagWithSafeDefault sBottomBrowserControlsRefactor =
             newMutableFlagWithSafeDefault(BOTTOM_BROWSER_CONTROLS_REFACTOR, true);
     public static final MutableFlagWithSafeDefault sBrowserControlsEarlyResize =
@@ -1090,10 +1189,12 @@ public abstract class ChromeFeatureList {
             newBooleanCachedFeatureParam(
                     ANDROID_APP_INTEGRATION_WITH_FAVICON, "skip_schema_check", false);
 
-    public static final BooleanCachedFeatureParam sAndroidAppIntegrationMultiDataSourceUseSchemaV1 =
-            newBooleanCachedFeatureParam(
-                    ANDROID_APP_INTEGRATION_MULTI_DATA_SOURCE, "use_schema_v1", false);
-
+    public static final BooleanCachedFeatureParam
+            sAndroidAppIntegrationMultiDataSourceSkipSchemaCheck =
+                    newBooleanCachedFeatureParam(
+                            ANDROID_APP_INTEGRATION_MULTI_DATA_SOURCE,
+                            "multi_data_source_skip_schema_check",
+                            false);
     public static final BooleanCachedFeatureParam
             sAndroidAppIntegrationMultiDataSourceSkipDeviceCheck =
                     newBooleanCachedFeatureParam(
@@ -1104,9 +1205,15 @@ public abstract class ChromeFeatureList {
     public static final BooleanCachedFeatureParam sAndroidBottomToolbarDefaultToTop =
             newBooleanCachedFeatureParam(ANDROID_BOTTOM_TOOLBAR, "default_to_top", true);
 
+    public static final IntCachedFeatureParam sBatchTabRestoreBatchSize =
+            newIntCachedFeatureParam(BATCH_TAB_RESTORE, "batch_tab_restore_batch_size", 5);
+
     public static final IntCachedFeatureParam sCctAuthTabEnableHttpsRedirectsVerificationTimeoutMs =
             newIntCachedFeatureParam(
                     CCT_AUTH_TAB_ENABLE_HTTPS_REDIRECTS, "verification_timeout_ms", 10_000);
+    public static final IntCachedFeatureParam sClampAutomotiveScalingMaxScalingPercentage =
+            newIntCachedFeatureParam(
+                    CLAMP_AUTOMOTIVE_SCALING, "max_automotive_scaling_percentage", 150);
 
     /**
      * Parameter that lists a pipe ("|") separated list of package names from which the {@link
@@ -1322,8 +1429,6 @@ public abstract class ChromeFeatureList {
             sNavBarColorMatchesTabBackgroundColorAnimationDisabled =
                     newBooleanCachedFeatureParam(
                             NAV_BAR_COLOR_MATCHES_TAB_BACKGROUND, "color_animation_disabled", true);
-    public static final BooleanCachedFeatureParam sNewTabSearchEngineUrlAndroidSwapOutNtp =
-            newBooleanCachedFeatureParam(NEW_TAB_SEARCH_ENGINE_URL_ANDROID, "swap_out_ntp", false);
     public static final IntCachedFeatureParam sNotificationTrampolineLongJobDurationMs =
             newIntCachedFeatureParam(NOTIFICATION_TRAMPOLINE, "long_job_duration_millis", 8 * 1000);
     public static final IntCachedFeatureParam sNotificationTrampolineNormalJobDurationMs =
@@ -1367,6 +1472,24 @@ public abstract class ChromeFeatureList {
                     14400); // 4 hours
     public static final BooleanCachedFeatureParam sTabStateFlatBufferMigrateStaleTabs =
             newBooleanCachedFeatureParam(TAB_STATE_FLAT_BUFFER, "migrate_stale_tabs", true);
+
+    public static final StringCachedFeatureParam sTabStripLayoutOptimizationOemAllowlist =
+            newStringCachedFeatureParam(
+                    TAB_STRIP_LAYOUT_OPTIMIZATION, "custom_headers_oem_allowlist", "");
+
+    public static final StringCachedFeatureParam sTabStripLayoutOptimizationOemDenylist =
+            newStringCachedFeatureParam(
+                    TAB_STRIP_LAYOUT_OPTIMIZATION, "custom_headers_oem_denylist", "");
+
+    public static final BooleanCachedFeatureParam sTabStripLayoutOptimizationOnExternalDisplay =
+            newBooleanCachedFeatureParam(
+                    TAB_STRIP_LAYOUT_OPTIMIZATION, "enable_on_external_display", true);
+
+    public static final StringCachedFeatureParam
+            sTabStripLayoutOptimizationOnExternalDisplayOemDenylist =
+                    newStringCachedFeatureParam(
+                            TAB_STRIP_LAYOUT_OPTIMIZATION, "external_display_oem_denylist", "");
+
     public static final IntCachedFeatureParam
             sTabWindowManagerReportIndicesMismatchTimeDiffThresholdMs =
                     newIntCachedFeatureParam(
@@ -1387,8 +1510,8 @@ public abstract class ChromeFeatureList {
                     sAndroidAppIntegrationModuleForceCardShow,
                     sAndroidAppIntegrationModuleShowThirdPartyCard,
                     sAndroidAppIntegrationMultiDataSourceHistoryContentTtlHours,
+                    sAndroidAppIntegrationMultiDataSourceSkipSchemaCheck,
                     sAndroidAppIntegrationMultiDataSourceSkipDeviceCheck,
-                    sAndroidAppIntegrationMultiDataSourceUseSchemaV1,
                     sAndroidAppIntegrationV2ContentTtlHours,
                     sAndroidAppIntegrationWithFaviconScheduleDelayTimeMs,
                     sAndroidAppIntegrationWithFaviconSkipDeviceCheck,
@@ -1397,9 +1520,11 @@ public abstract class ChromeFeatureList {
                     sAndroidAppIntegrationWithFaviconZeroStateFaviconNumber,
                     sAndroidBottomToolbarDefaultToTop,
                     sAndroidThemeModuleForceDependencies,
+                    sBatchTabRestoreBatchSize,
                     sCctAdaptiveButtonEnableOpenInBrowser,
                     sCctAdaptiveButtonEnableVoice,
                     sCctAuthTabEnableHttpsRedirectsVerificationTimeoutMs,
+                    sClampAutomotiveScalingMaxScalingPercentage,
                     sCctAutoTranslateAllowAllFirstParties,
                     sCctAutoTranslatePackageNamesAllowlist,
                     sCctGoogleBottomBarButtonList,
@@ -1435,7 +1560,6 @@ public abstract class ChromeFeatureList {
                     sNavBarColorAnimationDisableBottomChinColorAnimation,
                     sNavBarColorAnimationDisableEdgeToEdgeLayoutColorAnimation,
                     sNavBarColorMatchesTabBackgroundColorAnimationDisabled,
-                    sNewTabSearchEngineUrlAndroidSwapOutNtp,
                     sNotificationTrampolineImmediateJobDurationMs,
                     sNotificationTrampolineLongJobDurationMs,
                     sNotificationTrampolineNormalJobDurationMs,
@@ -1448,6 +1572,10 @@ public abstract class ChromeFeatureList {
                     sStartSurfaceReturnTimeTabletSecs,
                     sTabGroupListContainment,
                     sTabStateFlatBufferMigrateStaleTabs,
+                    sTabStripLayoutOptimizationOemAllowlist,
+                    sTabStripLayoutOptimizationOemDenylist,
+                    sTabStripLayoutOptimizationOnExternalDisplay,
+                    sTabStripLayoutOptimizationOnExternalDisplayOemDenylist,
                     sTabWindowManagerReportIndicesMismatchTimeDiffThresholdMs,
                     sUseChimeAndroidSdkAlwaysRegister,
                     sWebApkMinShellApkVersionValue);
@@ -1462,28 +1590,18 @@ public abstract class ChromeFeatureList {
             sAndroidNativePagesInNewTabDownloadsEnabled =
             sAndroidNativePagesInNewTab.newBooleanParam(
                     "android_native_pages_in_new_tab_downloads_enabled", true);
-    public static final MutableBooleanParamWithSafeDefault sAndroidTabDeclutterArchiveEnabled =
-            sAndroidTabDeclutter.newBooleanParam("android_tab_declutter_archive_enabled", true);
-    public static final MutableIntParamWithSafeDefault sAndroidTabDeclutterArchiveTimeDeltaHours =
-            sAndroidTabDeclutter.newIntParam(
-                    "android_tab_declutter_archive_time_delta_hours", 21 * 24);
-    public static final MutableBooleanParamWithSafeDefault sAndroidTabDeclutterAutoDeleteEnabled =
-            sAndroidTabDeclutter.newBooleanParam(
-                    "android_tab_declutter_auto_delete_enabled", false);
+    public static final MutableBooleanParamWithSafeDefault
+            sAndroidNativePagesInNewTabHistoryEnabled =
+            sAndroidNativePagesInNewTab.newBooleanParam(
+                    "android_native_pages_in_new_tab_history_enabled", true);
+    public static final MutableBooleanParamWithSafeDefault
+            sAndroidNativePagesInNewTabRecentTabsEnabled =
+                    sAndroidNativePagesInNewTab.newBooleanParam(
+                            "android_native_pages_in_new_tab_recent_tabs_enabled", true);
     public static final MutableIntParamWithSafeDefault
             sAndroidTabDeclutterAutoDeleteTimeDeltaHours =
-                    sAndroidTabDeclutter.newIntParam(
-                            "android_tab_declutter_auto_delete_time_delta_hours", 60 * 24);
-    public static final MutableIntParamWithSafeDefault sAndroidTabDeclutterIntervalTimeDeltaHours =
-            sAndroidTabDeclutter.newIntParam(
-                    "android_tab_declutter_interval_time_delta_hours", 7 * 24);
-    public static final MutableIntParamWithSafeDefault sAndroidTabDeclutterMaxSimultaneousArchives =
-            sAndroidTabDeclutter.newIntParam(
-                    "android_tab_declutter_max_simultaneous_archives", 100);
-    public static final MutableIntParamWithSafeDefault
-            sAndroidTabDeclutterIphMessageDismissThreshold =
-                    sAndroidTabDeclutter.newIntParam(
-                            "android_tab_declutter_iph_message_dismiss_threshold", 3);
+                    sAndroidTabDeclutterAutoDelete.newIntParam(
+                            "android_tab_declutter_auto_delete_time_delta_hours", 90 * 24);
     public static final MutableBooleanParamWithSafeDefault
             sDisableBottomControlsStackerYOffsetDispatching =
                     sBottomBrowserControlsRefactor.newBooleanParam(

tools/under-control/src/chrome/browser/prefs/browser_prefs.cc

@@ -42,6 +42,7 @@
 #include "chrome/browser/media/webrtc/permission_bubble_media_access_handler.h"
 #include "chrome/browser/memory/enterprise_memory_limit_pref_observer.h"
 #include "chrome/browser/metrics/chrome_metrics_service_client.h"
+#include "chrome/browser/metrics/tab_stats/tab_stats_tracker.h"
 #include "chrome/browser/net/net_error_tab_helper.h"
 #include "chrome/browser/net/profile_network_context_service.h"
 #include "chrome/browser/net/secure_dns_util.h"
@@ -71,6 +72,7 @@
 #include "chrome/browser/search/search.h"
 #include "chrome/browser/serial/serial_policy_allowed_ports.h"
 #include "chrome/browser/sharing_hub/sharing_hub_features.h"
+#include "chrome/browser/signin/chrome_signin_client.h"
 #include "chrome/browser/ssl/ssl_config_service_manager.h"
 #include "chrome/browser/tracing/chrome_tracing_delegate.h"
 #include "chrome/browser/ui/browser_ui_prefs.h"
@@ -207,6 +209,7 @@
 #endif
 
 #if BUILDFLAG(ENABLE_EXTENSIONS_CORE)
+#include "chrome/browser/extensions/activity_log/activity_log.h"
 #include "chrome/browser/extensions/commands/command_service.h"
 #include "chrome/browser/extensions/extension_util.h"
 #include "chrome/browser/extensions/extension_web_ui.h"
@@ -220,7 +223,6 @@
 #if BUILDFLAG(ENABLE_EXTENSIONS)
 #include "chrome/browser/accessibility/animation_policy_prefs.h"
 #include "chrome/browser/apps/platform_apps/shortcut_manager.h"
-#include "chrome/browser/extensions/activity_log/activity_log.h"
 #include "chrome/browser/extensions/api/tabs/tabs_api.h"
 #include "chrome/browser/extensions/preinstalled_apps.h"
 #include "chrome/browser/ui/extensions/settings_api_bubble_helpers.h"
@@ -279,7 +281,6 @@
 #include "chrome/browser/hid/hid_policy_allowed_devices.h"
 #include "chrome/browser/intranet_redirect_detector.h"
 #include "chrome/browser/media/unified_autoplay_config.h"
-#include "chrome/browser/metrics/tab_stats/tab_stats_tracker.h"
 #include "chrome/browser/nearby_sharing/common/nearby_share_prefs.h"
 #include "chrome/browser/new_tab_page/modules/file_suggestion/drive_service.h"
 #include "chrome/browser/new_tab_page/modules/file_suggestion/microsoft_files_page_handler.h"
@@ -410,7 +411,6 @@
 #include "chrome/browser/ash/printing/enterprise/enterprise_printers_provider.h"
 #include "chrome/browser/ash/release_notes/release_notes_storage.h"
 #include "chrome/browser/ash/scanning/chrome_scanning_app_delegate.h"
-#include "chrome/browser/ash/settings/device_settings_cache.h"
 #include "chrome/browser/ash/system/automatic_reboot_manager.h"
 #include "chrome/browser/ash/system/input_device_settings.h"
 #include "chrome/browser/ash/system_web_apps/apps/help_app/help_app_notification_controller.h"
@@ -429,7 +429,6 @@
 #include "chrome/browser/memory/oom_kills_monitor.h"
 #include "chrome/browser/metrics/chromeos_metrics_provider.h"
 #include "chrome/browser/policy/annotations/blocklist_handler.h"
-#include "chrome/browser/policy/system_features_disable_list_policy_handler.h"
 #include "chrome/browser/ui/ash/shelf/chrome_shelf_prefs.h"
 #include "chrome/browser/ui/webui/ash/login/enable_debugging_screen_handler.h"
 #include "chrome/browser/ui/webui/ash/settings/os_settings_ui.h"
@@ -448,9 +447,11 @@
 #include "chromeos/ash/components/network/network_metadata_store.h"
 #include "chromeos/ash/components/network/proxy/proxy_config_handler.h"
 #include "chromeos/ash/components/policy/restriction_schedule/device_restriction_schedule_controller.h"
+#include "chromeos/ash/components/policy/system_features_disable_list/system_features_disable_list_policy_utils.h"
 #include "chromeos/ash/components/quickoffice/quickoffice_prefs.h"
 #include "chromeos/ash/components/report/report_controller.h"
 #include "chromeos/ash/components/scheduler_config/scheduler_configuration_manager.h"
+#include "chromeos/ash/components/settings/device_settings_cache.h"
 #include "chromeos/ash/components/timezone/timezone_resolver.h"
 #include "chromeos/ash/experiences/arc/arc_prefs.h"
 #include "chromeos/ash/services/assistant/public/cpp/assistant_prefs.h"
@@ -557,12 +558,6 @@ constexpr char kOsCryptAppBoundFixedData3PrefName[] =
     "os_crypt.app_bound_fixed_data3";
 #endif  // BUILDFLAG(IS_WIN)
 
-#if BUILDFLAG(IS_CHROMEOS)
-// Deprecated 04/2024
-constexpr char kLastUploadedEuiccStatusPrefLegacy[] =
-    "esim.last_upload_euicc_status";
-#endif  // BUILDFLAG(IS_CHROMEOS)
-
 #if BUILDFLAG(IS_CHROMEOS)
 // Deprecated 05/2024.
 // A preference to keep track of the device registered time.
@@ -1096,8 +1091,30 @@ inline constexpr char kManagedAccessToGetAllScreensMediaAllowedForUrls[] =
 // Deprecated 04/2025.
 constexpr char kObsoleteUserAcknowledgedLocalPasswordsMigrationWarning[] =
     "user_acknowledged_local_passwords_migration_warning";
+
+// Deprecated 04/2025.
+constexpr char kObsoleteLocalPasswordMigrationWarningPrefsVersion[] =
+    "local_passwords_migration_warning_reset_count";
 #endif
 
+// Deprecated 04/2025.
+inline constexpr char kSuggestionGroupVisibility[] =
+    "omnibox.suggestionGroupVisibility";
+
+#if BUILDFLAG(IS_ANDROID)
+// Deprecated 05/2025.
+inline constexpr char kWipedWebAPkDataForMigration[] =
+    "sync.wiped_web_apk_data_for_migration";
+#endif  // BUILDFLAG(IS_ANDROID)
+
+// Deprecated 05/2025.
+inline constexpr char kSyncCacheGuid[] = "sync.cache_guid";
+inline constexpr char kSyncBirthday[] = "sync.birthday";
+inline constexpr char kSyncBagOfChips[] = "sync.bag_of_chips";
+inline constexpr char kSyncLastSyncedTime[] = "sync.last_synced_time";
+inline constexpr char kSyncLastPollTime[] = "sync.last_poll_time";
+inline constexpr char kSyncPollInterval[] = "sync.short_poll_interval";
+
 // Register local state used only for migration (clearing or moving to a new
 // key).
 void RegisterLocalStatePrefsForMigration(PrefRegistrySimple* registry) {
@@ -1111,9 +1128,6 @@ void RegisterLocalStatePrefsForMigration(PrefRegistrySimple* registry) {
   // Deprecated 05/2024.
   registry->RegisterTimePref(kDeviceRegisteredTime, base::Time());
   registry->RegisterDictionaryPref(kArcKioskDictionaryName);
-
-  // Deprecated 04/2024.
-  registry->RegisterDictionaryPref(kLastUploadedEuiccStatusPrefLegacy);
 #endif  // BUILDFLAG(IS_CHROMEOS)
 
 #if !BUILDFLAG(IS_ANDROID)
@@ -1541,7 +1555,27 @@ void RegisterProfilePrefsForMigration(
   // Deprecated 04/2025.
   registry->RegisterBooleanPref(
       kObsoleteUserAcknowledgedLocalPasswordsMigrationWarning, false);
+
+  // Deprecated 04/2025.
+  registry->RegisterIntegerPref(
+      kObsoleteLocalPasswordMigrationWarningPrefsVersion, 0);
 #endif
+
+  // Deprecated 04/2025.
+  registry->RegisterDictionaryPref(kSuggestionGroupVisibility);
+
+  // Deprecated 05/2025.
+#if BUILDFLAG(IS_ANDROID)
+  registry->RegisterBooleanPref(kWipedWebAPkDataForMigration, false);
+#endif  // BUILDFLAG(IS_ANDROID)
+
+  // Deprecated 05/2025.
+  registry->RegisterStringPref(kSyncCacheGuid, std::string());
+  registry->RegisterStringPref(kSyncBirthday, std::string());
+  registry->RegisterStringPref(kSyncBagOfChips, std::string());
+  registry->RegisterTimePref(kSyncLastSyncedTime, base::Time());
+  registry->RegisterTimePref(kSyncLastPollTime, base::Time());
+  registry->RegisterTimeDeltaPref(kSyncPollInterval, base::TimeDelta());
 }
 
 }  // namespace
@@ -1572,6 +1606,7 @@ void RegisterLocalState(PrefRegistrySimple* registry) {
   chrome_labs_prefs::RegisterLocalStatePrefs(registry);
   chrome_urls::RegisterPrefs(registry);
   ChromeMetricsServiceClient::RegisterPrefs(registry);
+  ChromeSigninClient::RegisterLocalStatePrefs(registry);
   enterprise_connectors::RegisterLocalStatePrefs(registry);
   enterprise_util::RegisterLocalStatePrefs(registry);
   component_updater::RegisterPrefs(registry);
@@ -1589,6 +1624,7 @@ void RegisterLocalState(PrefRegistrySimple* registry) {
   language::UlpLanguageCodeLocator::RegisterLocalStatePrefs(registry);
   memory::EnterpriseMemoryLimitPrefObserver::RegisterPrefs(registry);
   metrics::RegisterDemographicsLocalStatePrefs(registry);
+  metrics::TabStatsTracker::RegisterPrefs(registry);
   network_time::NetworkTimeTracker::RegisterPrefs(registry);
   optimization_guide::prefs::RegisterLocalStatePrefs(registry);
   optimization_guide::model_execution::prefs::RegisterLocalStatePrefs(registry);
@@ -1664,7 +1700,6 @@ void RegisterLocalState(PrefRegistrySimple* registry) {
   headless::RegisterPrefs(registry);
   IntranetRedirectDetector::RegisterPrefs(registry);
   media_router::RegisterLocalStatePrefs(registry);
-  metrics::TabStatsTracker::RegisterPrefs(registry);
   performance_manager::user_tuning::prefs::RegisterLocalStatePrefs(registry);
   PerformanceInterventionMetricsReporter::RegisterLocalStatePrefs(registry);
   RegisterBrowserPrefs(registry);
@@ -1762,7 +1797,7 @@ void RegisterLocalState(PrefRegistrySimple* registry) {
   RegisterNearbySharingLocalPrefs(registry);
   chromeos::echo_offer::RegisterPrefs(registry);
   memory::OOMKillsMonitor::RegisterPrefs(registry);
-  policy::SystemFeaturesDisableListPolicyHandler::RegisterPrefs(registry);
+  policy::RegisterDisabledSystemFeaturesPrefs(registry);
   policy::DlpRulesManagerImpl::RegisterPrefs(registry);
 #endif  // BUILDFLAG(IS_CHROMEOS)
 
@@ -1981,6 +2016,7 @@ void RegisterProfilePrefs(user_prefs::PrefRegistrySyncable* registry,
 #endif
 
 #if BUILDFLAG(ENABLE_EXTENSIONS_CORE)
+  extensions::ActivityLog::RegisterProfilePrefs(registry);
   extensions::PermissionsManager::RegisterProfilePrefs(registry);
   extensions::ExtensionPrefs::RegisterProfilePrefs(registry);
   extensions::RuntimeAPI::RegisterPrefs(registry);
@@ -1993,7 +2029,6 @@ void RegisterProfilePrefs(user_prefs::PrefRegistrySyncable* registry,
 
 #if BUILDFLAG(ENABLE_EXTENSIONS)
   RegisterAnimationPolicyPrefs(registry);
-  extensions::ActivityLog::RegisterProfilePrefs(registry);
   extensions::AudioAPI::RegisterUserPrefs(registry);
   // TODO(devlin): This would be more inline with the other calls here if it
   // were nested in either a class or separate namespace with a simple
@@ -2085,7 +2120,7 @@ void RegisterProfilePrefs(user_prefs::PrefRegistrySyncable* registry,
   extensions::login_api::RegisterProfilePrefs(registry);
   extensions::platform_keys::EnterprisePlatformKeysRegisterProfilePrefs(
       registry);
-  certificate_manager::CertificatesHandler::RegisterProfilePrefs(registry);
+  certificate_manager::RegisterProfilePrefs(registry);
   chromeos::cloud_storage::RegisterProfilePrefs(registry);
   chromeos::cloud_upload::RegisterProfilePrefs(registry);
   policy::NetworkAnnotationBlocklistHandler::RegisterPrefs(registry);
@@ -2265,16 +2300,17 @@ void RegisterProfilePrefs(user_prefs::PrefRegistrySyncable* registry,
   registry->RegisterBooleanPref(
       prefs::kAccessibilityMainNodeAnnotationsEnabled, false,
       user_prefs::PrefRegistrySyncable::SYNCABLE_PREF);
-#endif
+
+  // TODO(crbug.com/400455013): Add LNA support on Android
+  registry->RegisterBooleanPref(
+      prefs::kManagedLocalNetworkAccessRestrictionsEnabled, false);
+#endif  // !BUILDFLAG(IS_ANDROID)
 
 #if BUILDFLAG(IS_ANDROID)
   registry->RegisterBooleanPref(prefs::kVirtualKeyboardResizesLayoutByDefault,
                                 false);
 #endif
 
-  registry->RegisterBooleanPref(
-      prefs::kManagedPrivateNetworkAccessRestrictionsEnabled, false);
-
 #if BUILDFLAG(ENTERPRISE_DATA_CONTROLS)
   data_controls::RegisterProfilePrefs(registry);
 #endif  // BUILDFLAG(ENTERPRISE_DATA_CONTROLS)
@@ -2295,6 +2331,8 @@ void RegisterProfilePrefs(user_prefs::PrefRegistrySyncable* registry,
   registry->RegisterIntegerPref(prefs::kLensOverlayStartCount, 0);
 
   registry->RegisterDictionaryPref(prefs::kReportingEndpoints);
+
+  registry->RegisterBooleanPref(prefs::kViewSourceLineWrappingEnabled, false);
 }
 
 void RegisterUserProfilePrefs(user_prefs::PrefRegistrySyncable* registry) {
@@ -2353,9 +2391,6 @@ void MigrateObsoleteLocalStatePrefs(PrefService* local_state) {
   // Added 05/2024.
   local_state->ClearPref(kDeviceRegisteredTime);
   local_state->ClearPref(kArcKioskDictionaryName);
-
-  // Added 04/2024.
-  local_state->ClearPref(kLastUploadedEuiccStatusPrefLegacy);
 #endif  // BUILDFLAG(IS_CHROMEOS)
 
 #if !BUILDFLAG(IS_ANDROID)
@@ -2831,8 +2866,27 @@ void MigrateObsoleteProfilePrefs(PrefService* profile_prefs,
   // Added 04/2025
   profile_prefs->ClearPref(
       kObsoleteUserAcknowledgedLocalPasswordsMigrationWarning);
+
+  // Added 04/2025.
+  profile_prefs->ClearPref(kObsoleteLocalPasswordMigrationWarningPrefsVersion);
 #endif
 
+  // Added 04/2025.
+  profile_prefs->ClearPref(kSuggestionGroupVisibility);
+
+#if BUILDFLAG(IS_ANDROID)
+  // Added 05/2025.
+  profile_prefs->ClearPref(kWipedWebAPkDataForMigration);
+#endif  // BUILDFLAG(IS_ANDROID)
+
+  // Added 05/2025.
+  profile_prefs->ClearPref(kSyncCacheGuid);
+  profile_prefs->ClearPref(kSyncBirthday);
+  profile_prefs->ClearPref(kSyncBagOfChips);
+  profile_prefs->ClearPref(kSyncLastSyncedTime);
+  profile_prefs->ClearPref(kSyncLastPollTime);
+  profile_prefs->ClearPref(kSyncPollInterval);
+
   // Please don't delete the following line. It is used by PRESUBMIT.py.
   // END_MIGRATE_OBSOLETE_PROFILE_PREFS
 

tools/under-control/src/chrome/browser/ui/tab_helpers.cc

@@ -86,8 +86,6 @@
 #include "chrome/browser/ui/find_bar/find_bar_state.h"
 #include "chrome/browser/ui/focus_tab_after_navigation_helper.h"
 #include "chrome/browser/ui/passwords/manage_passwords_ui_controller.h"
-#include "chrome/browser/ui/performance_controls/memory_saver_chip_tab_helper.h"
-#include "chrome/browser/ui/performance_controls/tab_resource_usage_tab_helper.h"
 #include "chrome/browser/ui/prefs/prefs_tab_helper.h"
 #include "chrome/browser/ui/privacy_sandbox/privacy_sandbox_prompt_helper.h"
 #include "chrome/browser/ui/recently_audible_helper.h"
@@ -96,7 +94,6 @@
 #include "chrome/browser/ui/search_engines/search_engine_tab_helper.h"
 #include "chrome/browser/ui/tab_contents/core_tab_helper.h"
 #include "chrome/browser/ui/tab_dialogs.h"
-#include "chrome/browser/ui/tab_ui_helper.h"
 #include "chrome/browser/ui/thumbnails/thumbnail_tab_helper.h"
 #include "chrome/browser/v8_compile_hints/v8_compile_hints_tab_helper.h"
 #include "chrome/browser/vr/vr_tab_helper.h"
@@ -131,6 +128,7 @@
 #include "components/metrics_services_manager/metrics_services_manager.h"
 #include "components/no_state_prefetch/browser/no_state_prefetch_manager.h"
 #include "components/offline_pages/buildflags/buildflags.h"
+#include "components/omnibox/common/omnibox_feature_configs.h"
 #include "components/optimization_guide/core/optimization_guide_features.h"
 #include "components/page_info/core/features.h"
 #include "components/password_manager/core/browser/password_manager.h"
@@ -238,8 +236,8 @@
 
 #if BUILDFLAG(ENABLE_EXTENSIONS)
 #include "chrome/browser/extensions/api/web_navigation/web_navigation_api.h"
+#include "chrome/browser/extensions/app_tab_helper.h"
 #include "chrome/browser/extensions/navigation_extension_enabler.h"
-#include "chrome/browser/extensions/tab_helper.h"
 #include "chrome/browser/ui/extensions/extension_side_panel_utils.h"
 #include "chrome/browser/web_applications/policy/pre_redirection_url_observer.h"
 #include "chrome/browser/web_applications/web_app_utils.h"
@@ -248,6 +246,10 @@
 #include "extensions/common/mojom/view_type.mojom.h"
 #endif
 
+#if BUILDFLAG(ENABLE_EXTENSIONS_CORE)
+#include "chrome/browser/extensions/tab_helper.h"
+#endif
+
 #if BUILDFLAG(ENABLE_OFFLINE_PAGES)
 #include "chrome/browser/offline_pages/android/auto_fetch_page_load_watcher.h"
 #include "chrome/browser/offline_pages/offline_page_tab_helper.h"
@@ -333,7 +335,7 @@ void TabHelpers::AttachTabHelpers(WebContents* web_contents) {
       Profile::FromBrowserContext(web_contents->GetBrowserContext());
 
   // --- Section 1: Common tab helpers ---
-  if (page_info::IsAboutThisSiteAsyncFetchingEnabled()) {
+  if (page_info::IsAboutThisSiteFeatureEnabled()) {
     if (auto* optimization_guide_decider =
             OptimizationGuideKeyedServiceFactory::GetForProfile(profile)) {
       AboutThisSiteTabHelper::CreateForWebContents(web_contents,
@@ -566,7 +568,6 @@ void TabHelpers::AttachTabHelpers(WebContents* web_contents) {
   }
 #endif
   HttpErrorTabHelper::CreateForWebContents(web_contents);
-  TabUIHelper::CreateForWebContents(web_contents);
   tasks::TaskTabHelper::CreateForWebContents(web_contents);
   tpcd::metadata::TpcdMetadataDevtoolsObserver::CreateForWebContents(
       web_contents);
@@ -666,15 +667,15 @@ void TabHelpers::AttachTabHelpers(WebContents* web_contents) {
   SadTabHelper::CreateForWebContents(web_contents);
   SearchTabHelper::CreateForWebContents(web_contents);
   TabDialogs::CreateForWebContents(web_contents);
-  MemorySaverChipTabHelper::CreateForWebContents(web_contents);
-  TabResourceUsageTabHelper::CreateForWebContents(web_contents);
   if (base::FeatureList::IsEnabled(features::kTabHoverCardImages) ||
       base::FeatureList::IsEnabled(features::kWebUITabStrip)) {
     ThumbnailTabHelper::CreateForWebContents(web_contents);
   }
   UMABrowsingActivityObserver::TabHelper::CreateForWebContents(web_contents);
   web_modal::WebContentsModalDialogManager::CreateForWebContents(web_contents);
-  if (OmniboxFieldTrial::IsZeroSuggestPrefetchingEnabled()) {
+  if (OmniboxFieldTrial::IsZeroSuggestPrefetchingEnabled() ||
+      omnibox_feature_configs::ContextualSearch::Get()
+          .IsEnabledWithPrefetch()) {
     ZeroSuggestPrefetchTabHelper::CreateForWebContents(web_contents);
   }
 #endif  // BUILDFLAG(IS_ANDROID)
@@ -750,13 +751,16 @@ void TabHelpers::AttachTabHelpers(WebContents* web_contents) {
     extensions::SetViewType(web_contents,
                             extensions::mojom::ViewType::kTabContents);
   }
-
-  extensions::TabHelper::CreateForWebContents(web_contents);
+  extensions::AppTabHelper::CreateForWebContents(web_contents);
   extensions::NavigationExtensionEnabler::CreateForWebContents(web_contents);
-
   extensions::WebNavigationTabObserver::CreateForWebContents(web_contents);
 #endif
 
+#if BUILDFLAG(ENABLE_EXTENSIONS_CORE)
+  // extensions::TabHelper is used on Win/Mac/Linux and desktop Android.
+  extensions::TabHelper::CreateForWebContents(web_contents);
+#endif
+
 #if BUILDFLAG(ENABLE_OFFLINE_PAGES)
   offline_pages::OfflinePageTabHelper::CreateForWebContents(web_contents);
   offline_pages::RecentTabHelper::CreateForWebContents(web_contents);

tools/under-control/src/chrome/common/extensions/api/autofill_private.idl

@@ -146,6 +146,7 @@ namespace autofillPrivate {
     DRIVERS_LICENSE_ISSUE_DATE,
     VEHICLE_YEAR,
     VEHICLE_PLATE_STATE,
+    EMAIL_OR_LOYALTY_MEMBERSHIP_ID,
     MAX_VALID_FIELD_TYPE
   };
 
@@ -156,7 +157,9 @@ namespace autofillPrivate {
     LOCAL_OR_SYNCABLE,
     // The address is stored in a third party service that is tied
     // to user's account.
-    ACCOUNT
+    ACCOUNT,
+    ACCOUNT_HOME,
+    ACCOUNT_WORK
   };
 
   // The type of data that can be stored for an attribute type.

tools/under-control/src/chrome/common/extensions/api/enterprise_reporting_private.idl

@@ -80,7 +80,6 @@ namespace enterprise.reportingPrivate {
     boolean builtInDnsClientEnabled;
     PasswordProtectionTrigger passwordProtectionWarningTrigger;
     boolean chromeRemoteDesktopAppBlocked;
-    boolean? thirdPartyBlockingEnabled;
     SettingValue osFirewall;
     DOMString[] systemDnsServers;
     DOMString? enterpriseProfileId;

tools/under-control/src/chrome/common/extensions/api/experimental_actor.idl

@@ -9,8 +9,10 @@ namespace experimentalActor {
   callback ClosureCallback = void();
 
   interface Functions {
-    // Creates and starts a new task.  By default, opens a new tab to
-    // about:blank that is ready for actions.
+    // Creates and starts a new task. By default, opens a new tab to
+    // about:blank that is ready for actions. The startTaskProto can
+    // optionally specify a tab_id to use an existing tab instead of creating
+    // a new one.
     // startTaskProto: encoded optimization_guide.proto.BrowserStartTask
     // startTaskcallback:
     //   encoded optimization_guide.proto.BrowserStartTaskResult

tools/under-control/src/chrome/renderer/chrome_content_renderer_client.cc

@@ -354,19 +354,6 @@ std::unique_ptr<base::Unwinder> CreateV8Unwinder(v8::Isolate* isolate) {
   return std::make_unique<V8Unwinder>(isolate);
 }
 
-// Web Share is conditionally enabled here in chrome/, to avoid it being
-// made available in other clients of content/ that do not have a Web Share
-// Mojo implementation (e.g. WebView).
-void MaybeEnableWebShare() {
-#if BUILDFLAG(IS_CHROMEOS) || BUILDFLAG(IS_WIN) || BUILDFLAG(IS_MAC)
-  if (base::FeatureList::IsEnabled(features::kWebShare))
-#endif
-#if BUILDFLAG(IS_CHROMEOS) || BUILDFLAG(IS_WIN) || BUILDFLAG(IS_MAC) || \
-    BUILDFLAG(IS_ANDROID)
-    blink::WebRuntimeFeatures::EnableWebShare(true);
-#endif
-}
-
 #if BUILDFLAG(ENABLE_NACL) && BUILDFLAG(ENABLE_EXTENSIONS) && \
     BUILDFLAG(IS_CHROMEOS)
 bool IsTerminalSystemWebAppNaClPage(GURL url) {
@@ -1701,7 +1688,12 @@ void ChromeContentRendererClient::
   // embedder only.
   blink::WebRuntimeFeatures::EnablePerformanceManagerInstrumentation(true);
 
-  MaybeEnableWebShare();
+// Web Share is conditionally enabled here in chrome/, to avoid it
+// being made available in WebView or Linux.
+#if BUILDFLAG(IS_ANDROID) || BUILDFLAG(IS_CHROMEOS) || BUILDFLAG(IS_WIN) || \
+    BUILDFLAG(IS_MAC)
+  blink::WebRuntimeFeatures::EnableWebShare(true);
+#endif
 
   if (base::FeatureList::IsEnabled(
           autofill::features::kAutofillSharedAutofill)) {
@@ -1712,11 +1704,17 @@ void ChromeContentRendererClient::
     blink::WebRuntimeFeatures::EnableAdTagging(true);
 
   if (IsStandaloneContentExtensionProcess()) {
-    // These Web APIs are only exposed to workers in extensions.
+    // These Web API features are exposed in extensions.
     blink::WebRuntimeFeatures::EnableWebUSBOnServiceWorkers(true);
 #if !BUILDFLAG(IS_ANDROID)
     blink::WebRuntimeFeatures::EnableWebHIDOnServiceWorkers(true);
 #endif  // !BUILDFLAG(IS_ANDROID)
+    if (blink::WebRuntimeFeatures::IsAIPromptAPIForExtensionEnabled() &&
+        base::FeatureList::IsEnabled(
+            blink::features::kAIPromptAPIForExtension)) {
+      blink::WebRuntimeFeatures::EnableAIPromptAPI(true);
+    }
+    blink::WebRuntimeFeatures::EnableAIPromptAPIForWorkers(true);
     blink::WebRuntimeFeatures::EnableAIRewriterAPIForWorkers(true);
     blink::WebRuntimeFeatures::EnableAISummarizationAPIForWorkers(true);
     blink::WebRuntimeFeatures::EnableAIWriterAPIForWorkers(true);

tools/under-control/src/components/policy/resources/templates/policies.yaml

@@ -1358,7 +1358,14 @@ policies:
   1357: BuiltInAIAPIsEnabled
   1358: TabGroupSharingSettings
   1359: NTPFooterManagementNoticeEnabled
-  1360: NTPFooterThemeAttributionEnabled
+  1360: NTPFooterExtensionAttributionEnabled
+  1361: ClearWindowNameForNewBrowsingContextGroup
+  1362: PasswordManagerBlocklist
+  1363: TLS13EarlyDataEnabled
+  1364: LocalNetworkAccessRestrictionsEnabled
+  1365: PrefetchWithServiceWorkerEnabled
+  1366: AIModeSearchSuggestSettings
+  1367: AIModeSettings
 
 atomic_groups:
   1: Homepage

tools/under-control/src/components/policy/resources/templates/policy_definitions/Arc/ArcEnabled.yaml

@@ -4,8 +4,6 @@ default_for_enterprise_users: false
 desc: Unless Ephemeral mode or multiple sign-in is on during the user's session, setting
   ArcEnabled to True turns ARC on for the user. Setting the policy to False or leaving
   it unset means enterprise users can't use ARC.
-
-  This policy only controls <ph name="ARC_VM">ArcVM</ph> on <ph name="PRODUCT_NAME">$2<ex>Google ChromeOS</ex></ph>. For <ph name="PRODUCT_OS_FLEX_NAME">Google ChromeOS Flex</ph>, please see the <ph name="DEVICE_FLEX_ARC_PRELOAD_ENABLED_POLICY_NAME">DeviceFlexArcPreloadEnabled</ph> policy for more details.
 example_value: false
 features:
   dynamic_refresh: true

tools/under-control/src/components/policy/resources/templates/policy_definitions/ContentSettings/ClearWindowNameForNewBrowsingContextGroup.yaml

@@ -0,0 +1,58 @@
+caption: Choose whether to allow clearing window.name for cross-site top-level
+  navigations resulting in a new browsing context group.
+
+default: true
+
+desc: |-
+  This policy controls whether window.name can be cleared for cross-site
+  top-level navigations which result in a new browsing context group being
+  created when the ClearCrossSiteCrossBrowsingContextGroupWindowName variation is
+  enabled.
+
+  The ClearCrossSiteCrossBrowsingContextGroupWindowName variation controls whether
+  window.name will be cleared for cross-site top-level navigations. Examples of
+  such navigations include a user navigating to a new site via the omnibox or
+  clicking on a link to a new site when the link uses "target='_blank'
+  rel='noopener'". Clearing window.name in these cases prevents information from
+  potentially leaking between sites via the window.name property, improving user
+  privacy. ClearWindowNameForNewBrowsingContextGroup policy is in place to
+  restore the previous behavior. When the
+  ClearCrossSiteCrossBrowsingContextGroupWindowName variation is enabled
+  window.name will be cleared for qualifying navigations if this policy is set
+  to Enabled or not set. If it is disabled, window.name will not be cleared.
+
+  If you must use the policy to disable window.name clearing on qualifying
+  navigations, please file a bug on
+  <ph name="BUG_URL">$1<ex>https://crbug.com/new?component=1456652&amp;template=1937639&amp;cc=ladan@chromium.org,miketaylr@chromium.org&amp;noWizard=true</ex></ph>
+  explaining your use case. The policy is scheduled to
+  be offered through <ph name="PRODUCT_NAME">$2<ex>Google Chrome</ex></ph>
+  version 142.
+
+example_value: false
+
+features:
+  dynamic_refresh: true
+  per_profile: true
+
+future_on:
+ - chrome.*
+ - chrome_os
+ - android
+
+items:
+- caption: Clear window.name when the navigation is top-level, cross-site and swaps BrowsingContextGroup.
+  value: true
+- caption: Do not clear window.name when the navigation is top-level, cross-site and swaps BrowsingContextGroup.
+  value: false
+
+owners:
+- ladan@chromium.org
+- potassium-katabolism@google.com
+
+schema:
+  type: boolean
+
+tags: []
+
+type: main
+

tools/under-control/src/components/policy/resources/templates/policy_definitions/ContentSettings/PartitionedBlobUrlUsage.yaml

@@ -12,15 +12,17 @@ desc: |-
   or <ph name="DEFAULT_THIRD_PARTY_STORAGE_PARTITIONING_SETTING_POLICY_NAME">DefaultThirdPartyStoragePartitioningSetting</ph>,
   then Blob URLs will also not be partitioned.
 
-  If you must use the policy, please file a bug on crbug.com explaining your
-  use case and CC {janiceliu, awillia}@chromium.org. The policy is scheduled to
-  be offered through <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph>
-  version 140, after which the old implementation will be removed.
+  If you must use the policy, please file a bug at
+  <ph name="BUG_URL">$1<ex>https://crbug.com/new?component=1779870&amp;cc=awillia@chromium.org&amp;priority=p1&amp;type=bug&amp;noWizard=true</ex></ph>
+  explaining your use case. The policy is scheduled to be offered through
+  <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> version 143, after which
+  the old implementation will be removed.
 
   NOTE: Only newly-started renderer processes will reflect changes to this
   policy while the browser is running.
 
-  For detailed information on third-party storage partitioning, please see https://developers.google.com/privacy-sandbox/cookies/storage-partitioning.
+  For detailed information on third-party storage partitioning, please see
+  https://developers.google.com/privacy-sandbox/cookies/storage-partitioning.
 
 example_value: false
 
@@ -36,7 +38,6 @@ items:
 
 owners:
 - awillia@chromium.org
-- janiceliu@chromium.org
 - potassium-katabolism@google.com
 
 schema:

tools/under-control/src/components/policy/resources/templates/policy_definitions/Crostini/CrostiniAnsiblePlaybook.yaml

@@ -28,7 +28,8 @@ schema:
       description: The URL from which the Ansible playbook can be downloaded.
       type: string
   type: object
+deprecated: true
 supported_on:
-- chrome_os:80-
+- chrome_os:80-122
 tags: []
 type: external

tools/under-control/src/components/policy/resources/templates/policy_definitions/Extensions/MandatoryExtensionsForIncognitoNavigation.yaml

@@ -13,6 +13,7 @@ features:
   dynamic_refresh: true
   per_profile: true
 future_on:
+- android
 - fuchsia
 - chrome.*
 supported_on:
@@ -25,4 +26,4 @@ schema:
     type: string
   type: array
 tags: []
-type: list
+type: list

tools/under-control/src/components/policy/resources/templates/policy_definitions/FloatingSso/FloatingSsoDomainBlocklist.yaml

@@ -12,8 +12,8 @@ example_value:
 features:
   dynamic_refresh: true
   per_profile: true
-future_on:
-- chrome_os
+supported_on:
+- chrome_os:138-
 owners:
 - andreydav@google.com
 - mpetrisor@chromium.org

tools/under-control/src/components/policy/resources/templates/policy_definitions/FloatingSso/FloatingSsoDomainBlocklistExceptions.yaml

@@ -11,8 +11,8 @@ example_value:
 features:
   dynamic_refresh: true
   per_profile: true
-future_on:
-- chrome_os
+supported_on:
+- chrome_os:138-
 owners:
 - andreydav@google.com
 - mpetrisor@chromium.org

tools/under-control/src/components/policy/resources/templates/policy_definitions/FloatingSso/FloatingSsoEnabled.yaml

@@ -12,8 +12,8 @@ example_value: true
 features:
   dynamic_refresh: true
   per_profile: true
-future_on:
-- chrome_os
+supported_on:
+- chrome_os:138-
 items:
 - caption: Enable Floating SSO and move the user's web service authentications to new device
   value: true

tools/under-control/src/components/policy/resources/templates/policy_definitions/GenerativeAI/AIModeSearchSuggestSettings.yaml

@@ -0,0 +1,40 @@
+caption: Settings for AI Mode Search recommendations in the address bar and new tab page search box
+
+desc: |-
+  This policy controls the AI Mode recommendations section in the address bar and the new tab page search box.
+
+  This feature is available to all users with Google as their default search engine, unless it is disabled by this policy.
+
+  If the policy is unset, its behavior is determined by the <ph name="GEN_AI_DEFAULT_SETTINGS_POLICY_NAME">GenAiDefaultSettings</ph> policy.
+
+  When policy is set to 0 - Enabled or not set, the feature will be available to users. When policy is set to 1 - Disabled, the feature will not be available.
+
+  0 = Allow the feature to be used
+  1 = Do not allow the feature.
+
+default: 0
+example_value: 1
+features:
+  dynamic_refresh: true
+  per_profile: true
+items:
+- caption: Allow AI Mode recommendations.
+  name: Allowed
+  value: 0
+- caption: Do not allow AI Mode recommendations.
+  name: Disabled
+  value: 1
+owners:
+- file://components/omnibox/OWNERS
+schema:
+  enum:
+  - 0
+  - 1
+  type: integer
+future_on:
+- android
+- ios
+- chrome.*
+- chrome_os
+tags: []
+type: int-enum

tools/under-control/src/components/policy/resources/templates/policy_definitions/GenerativeAI/AIModeSettings.yaml

@@ -0,0 +1,38 @@
+caption: Settings for Google's AI Mode integrations in the address bar and New Tab page search box.
+
+desc: |-
+  This policy controls Google's AI Mode integrations in the address bar and the New Tab page search box.
+
+  To access this feature, Google must be set as the user's default search engine.
+
+  0/unset = The feature will be available to users.
+
+  1 = The feature will not be available to users.
+
+  If the policy is unset, its behavior is determined by the <ph name="GEN_AI_DEFAULT_SETTINGS_POLICY_NAME">GenAiDefaultSettings</ph> policy.
+default: 0
+example_value: 1
+features:
+  dynamic_refresh: true
+  per_profile: true
+items:
+- caption: Allow AI Mode integrations.
+  name: Allowed
+  value: 0
+- caption: Do not allow AI Mode integrations.
+  name: Disabled
+  value: 1
+owners:
+- file://components/omnibox/OWNERS
+schema:
+  enum:
+  - 0
+  - 1
+  type: integer
+supported_on:
+- android:138-
+- ios:138-
+- chrome.*:138-
+- chrome_os:138-
+tags: []
+type: int-enum

tools/under-control/src/components/policy/resources/templates/policy_definitions/Kiosk/KioskChromeAppsForceAllowed.yaml

@@ -7,7 +7,7 @@ desc: |-
 
   Leaving this policy unset or setting this policy to False will use the default behavior defined on the device.
 
-  Attempting to launch a disabled Chrome App will show the user a message explaining why the app was not lauched and suggesting to contact their IT department.
+  Attempting to launch a disabled Chrome App will show the user a message explaining why the app was not launched and suggesting to contact their IT department.
 features:
   dynamic_refresh: true
   per_profile: false
@@ -21,6 +21,6 @@ items:
   value: false
 default: false
 example_value: false
-future_on:
-- chrome_os
+supported_on:
+- chrome_os:138-
 tags: []

tools/under-control/src/components/policy/resources/templates/policy_definitions/Miscellaneous/AllowDeletingBrowserHistory.yaml

@@ -9,6 +9,7 @@ features:
   dynamic_refresh: true
   per_profile: true
 future_on:
+- android
 - fuchsia
 items:
 - caption: Enable deleting browser and download history

tools/under-control/src/components/policy/resources/templates/policy_definitions/Miscellaneous/ChromeDataRegionSetting.yaml

@@ -34,10 +34,10 @@ schema:
   - 0
   - 1
   - 2
-future_on:
-- chrome.*
-- chrome_os
-- ios
-- android
+supported_on:
+- chrome.*:138-
+- chrome_os:138-
+- ios:138-
+- android:138-
 tags: []
 type: int-enum

tools/under-control/src/components/policy/resources/templates/policy_definitions/Miscellaneous/EditBookmarksEnabled.yaml

@@ -1,8 +1,8 @@
 caption: Enable or disable bookmark editing
 desc: |-
-  Setting the policy to True or leaving it unset lets users add, remove, or modify bookmarks.
+  Setting the policy to True or leaving it unset lets users add, remove, modify, or upload bookmarks.
 
-        Setting the policy to False means users can't add, remove, or modify bookmarks. They can still use existing bookmarks.
+        Setting the policy to False means users can't add, remove, modify or upload bookmarks. They can still use existing bookmarks.
 example_value: false
 features:
   dynamic_refresh: true

tools/under-control/src/components/policy/resources/templates/policy_definitions/Miscellaneous/EnterpriseRealTimeUrlCheckMode.yaml

@@ -30,11 +30,10 @@ schema:
   - 0
   - 1
   type: integer
-future_on:
-- ios
 supported_on:
 - chrome.*:86-
 - chrome_os:86-
 - android:136-
+- ios:138-
 tags: []
 type: int-enum

tools/under-control/src/components/policy/resources/templates/policy_definitions/Miscellaneous/EnterpriseSearchAggregatorSettings.yaml

@@ -1,7 +1,5 @@
-caption: Enterprise search aggregator settings (Beta)
+caption: Enterprise search aggregator settings
 desc: |-
-  This is a beta feature. As this is a feature in development, available to our trusted testers, please be aware that it may undergo changes and updates.
-
   This policy allows administrators to set a designated enterprise search aggregator that will provide search recommendations and results within the address bar when triggered by a specific keyword. Users can initiate a search by typing the keyword specified in the <ph name="SHORTCUT_SEARCH_AGGREGATOR_SETTINGS_FIELD">shortcut</ph> field with or without the @ prefix (e.g. <ph name="SHORTCUT_EXAMPLE_SEARCH_AGGREGATOR_SETTINGS">@work</ph>), followed by Space or Tab, in the address bar.
 
   The following fields are required: <ph name="NAME_SEARCH_AGGREGATOR_SETTINGS_FIELD">name</ph>, <ph name="SHORTCUT_SEARCH_AGGREGATOR_SETTINGS_FIELD">shortcut</ph>, <ph name="SEARCH_URL_SEARCH_AGGREGATOR_SETTINGS_FIELD">search_url</ph>, <ph name="SUGGEST_URL_SEARCH_AGGREGATOR_SETTINGS_FIELD">suggest_url</ph>.

tools/under-control/src/components/policy/resources/templates/policy_definitions/Miscellaneous/FloatingWorkspaceV2Enabled.yaml

@@ -1,7 +1,7 @@
-caption: Enable <ph name="PRODUCT_NAME">$1<ex>Floating Workspace</ex></ph> V2 Service
+caption: Enable <ph name="PRODUCT_NAME">$1<ex>Floating Workspace</ex></ph> Service
 default: false
 desc: |-
-  When a user switches between <ph name="PRODUCT_OS_NAME">$2<ex>Google ChromeOS</ex></ph> devices, <ph name="PRODUCT_NAME">$1<ex>Floating Workspace</ex></ph> V2 Service V2 Service will launch browser and app windows from the previous device onto the new device.
+  When a user switches between <ph name="PRODUCT_OS_NAME">$2<ex>Google ChromeOS</ex></ph> devices, <ph name="PRODUCT_NAME">$1<ex>Floating Workspace</ex></ph> Service will launch browser and app windows from the previous device onto the new device.
   Setting the policy to Enabled will launch browser and app windows from current user's last used <ph name="PRODUCT_OS_NAME">$2<ex>Google ChromeOS</ex></ph> device automatically upon login.
   Setting the policy to Disabled or leaving it unset will let full restore settings determine what to be launched upon login.
 example_value: true
@@ -15,11 +15,11 @@ items:
     login
   value: false
 owners:
-- ligeng@chromium.org
-- yzd@chromium.org
+- andreydav@google.com
+- slutskii@google.com
 schema:
   type: boolean
-future_on:
-- chrome_os
+supported_on:
+- chrome_os:138-
 tags: []
 type: main

tools/under-control/src/components/policy/resources/templates/policy_definitions/Miscellaneous/NTPFooterExtensionAttributionEnabled.yaml

@@ -0,0 +1,29 @@
+caption:  Control the visibility of the extension attribution on the New Tab page
+default: true
+desc: |-
+  This policy determines whether an attribution to the extension modifying the New Tab Page (NTP) is displayed in the NTP's footer.
+
+  By default, if an extension has overridden the standard NTP, a message attributing this change to the specific extension will appear in the footer. This attribution typically includes a link to the relevant extension in the Chrome Web Store.
+
+  If this policy is left unset or set to true, the extension attribution will be visible on the NTP footer when an extension is controlling the NTP.
+
+  If this policy is set to false, the attribution to the extension in the NTP footer will be suppressed.
+example_value: true
+features:
+  dynamic_refresh: true
+  per_profile: true
+supported_on:
+- chrome.*:138-
+- chrome_os:138-
+items:
+- caption: Enable extension attribution on NTP Footer
+  value: true
+- caption: Disable extension attribution on NTP Footer
+  value: false
+owners:
+- file://components/policy/OWNERS
+- esalma@google.com
+schema:
+  type: boolean
+tags: []
+type: main

tools/under-control/src/components/policy/resources/templates/policy_definitions/Miscellaneous/NTPFooterThemeAttributionEnabled.yaml

@@ -1,26 +0,0 @@
-caption:  Control the visibility of the extension theme attribution on the New Tab Page for managed browsers
-default: true
-desc: |-
-  This policy controls the visibility of extension theme attribution within the footer of the New Tab Page (NTP) when the NTP is controlled by an extension. By default, the NTP footer displays information about the extension controlling the NTP.
-
-  If this policy is left unset or set to true, browsers with an extension controlled NTP will show the extension name and a link to it.
-
-  If this policy is set to false, the theme atribution will be hidden.
-example_value: true
-features:
-  dynamic_refresh: true
-  per_profile: true
-future_on:
-- chrome.*
-items:
-- caption: Enable extension theme attribution on NTP Footer
-  value: true
-- caption: Disable extension theme attribution on NTP Footer
-  value: false
-owners:
-- file://components/policy/OWNERS
-- esalma@google.com
-schema:
-  type: boolean
-tags: []
-type: main

tools/under-control/src/components/policy/resources/templates/policy_definitions/Miscellaneous/PdfAnnotationsEnabled.yaml

@@ -22,5 +22,6 @@ schema:
   type: boolean
 supported_on:
 - chrome_os:91-
+- chrome.*:138-
 tags: []
 type: main

tools/under-control/src/components/policy/resources/templates/policy_definitions/Miscellaneous/PrefetchWithServiceWorkerEnabled.yaml

@@ -0,0 +1,37 @@
+caption: Allow SpeculationRules prefetch to ServiceWorker-controlled URLs
+desc: |-
+  SpeculationRules prefetch can be issued to URLs that are controlled by
+  ServiceWorker. However, legacy code did not allow it and canceled the prefetch
+  requests. This policy enables to control the behavior.
+
+  Setting this policy to Enabled or not set allows SpeculationRules prefetch to
+  ServiceWorker-controlled URLs (if the PrefetchServiceWorker feature flag is
+  enabled). This is the current default behavior and is aligned with the
+  specifications.
+
+  Setting this policy to Disabled disallows SpeculationRules prefetch to
+  ServiceWorker-controlled URLs. This is the legacy behavior.
+
+  This policy is intended to be temporary and will be removed in the future.
+default: true
+example_value: true
+features:
+  dynamic_refresh: false
+  per_profile: true
+items:
+- caption: SpeculationRules prefetch can be sent to ServiceWorker-controlled URLs.
+  value: true
+- caption: SpeculationRules prefetch cannot be sent to ServiceWorker-controlled URLs (legacy behavior).
+  value: false
+owners:
+- nhiroki@chromium.org
+- file://content/browser/preloading/prefetch/OWNERS
+schema:
+  type: boolean
+supported_on:
+- android:138-
+- chrome.*:138-
+- chrome_os:138-
+- fuchsia:138-
+tags: []
+type: main

tools/under-control/src/components/policy/resources/templates/policy_definitions/Miscellaneous/SelectParserRelaxationEnabled.yaml

@@ -1,6 +1,6 @@
 caption: Controls whether the new HTML parser behavior for the <select> element is enabled
 desc: |2-
-  The HTML parser is being changed to allow additional HTML tags inside the <select> element. This policy allows the old HTML parser behavior to be used until M136.
+  The HTML parser is being changed to allow additional HTML tags inside the <select> element. This policy allows the old HTML parser behavior to be used until M138.
 
   If this policy is enabled or not set, then the HTML parser will allow additional tags inside the <select> element.
 
@@ -22,11 +22,11 @@ owners:
 schema:
   type: boolean
 supported_on:
-- chrome.*:131-
-- chrome_os:131-
-- android:131-
-- webview_android:131-
+- chrome.*:131-138
+- chrome_os:131-138
+- android:131-138
+- webview_android:131-138
 tags: []
 type: main
-deprecated: false
+deprecated: true
 device_only: false

tools/under-control/src/components/policy/resources/templates/policy_definitions/Miscellaneous/TLS13EarlyDataEnabled.yaml

@@ -0,0 +1,41 @@
+caption: Enable TLS 1.3 Early Data
+default: true
+desc: |-
+  TLS 1.3 Early Data is an extension to TLS 1.3 to send an HTTP request simultaneously with the TLS handshake.
+
+        If this policy is not configured, <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> will follow the default rollout process for TLS 1.3 Early Data.
+
+        If it is enabled, <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> will enable TLS 1.3 Early Data.
+
+        If it is disabled, <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> will not enable TLS 1.3 Early Data.
+
+        When the feature is enabled, <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> may or may not use TLS 1.3 Early Data depending on server support.
+
+        TLS 1.3 Early Data is an established protocol. Existing TLS servers, middleboxes, and security software are expected to either handle or reject TLS 1.3 Early Data without dropping the connection.
+
+        However, devices that do not correctly implement TLS may malfunction and disconnect when TLS 1.3 Early Data is in use. If this occurs, administrators should contact the vendor for a fix.
+
+        This policy is a temporary measure to control the feature and will be removed afterwards. The policy may be enabled to allow you to test for issues and disabled while issues are being resolved.
+example_value: true
+features:
+  dynamic_refresh: true
+  per_profile: false
+future_on:
+- fuchsia
+items:
+- caption: Enable the TLS 1.3 Early Data
+  value: true
+- caption: Disable the TLS 1.3 Early Data
+  value: false
+owners:
+- bashi@chromium.org
+- blink-network-stack@google.com
+schema:
+  type: boolean
+supported_on:
+- chrome.*:138-
+- chrome_os:138-
+- android:138-
+tags:
+- system-security
+type: main

tools/under-control/src/components/policy/resources/templates/policy_definitions/Miscellaneous/WebXRImmersiveArEnabled.yaml

@@ -21,7 +21,7 @@ items:
     sessions
   value: false
 owners:
-- bialpio@chromium.org
+- alcooper@chromium.org
 - xr-dev@chromium.org
 schema:
   type: boolean

tools/under-control/src/components/policy/resources/templates/policy_definitions/Network/LocalNetworkAccessRestrictionsEnabled.yaml

@@ -0,0 +1,46 @@
+owners:
+- hchao@chromium.org
+- cthomp@chromium.org
+- chrome-secure-web-and-net@chromium.org
+
+caption: Specifies whether to apply restrictions to requests to local
+  network endpoints
+
+deprecated: true
+
+desc: |-
+  When this policy is set to Enabled, any time when a warning is supposed to be
+  displayed in the <ph name="DEV_TOOLS_NAME">DevTools</ph> due to <ph
+  name="LOCAL_NETWORK_ACCCESS">Local Network Access</ph> checks failing, the
+  main request will be blocked instead.
+
+  When this policy is set to Disabled or unset, <ph
+  name="LOCAL_NETWORK_ACCESS">Local Network Access</ph> requests will use the
+  default handling of these requests.
+
+  See https://github.com/explainers-by-googlers/local-network-access for <ph
+  name="LOCAL_NETWORK_ACCESS">Local Network Access</ph> restrictions.
+
+supported_on:
+- chrome.*:138-
+- chrome_os:138-
+
+features:
+  dynamic_refresh: true
+  per_profile: true
+
+type: main
+
+schema:
+  type: boolean
+
+items:
+- caption: Apply restrictions to requests to local network endpoints
+  value: true
+- caption: Use default behavior when determining if websites can make requests
+    to local network endpoints
+  value: false
+
+example_value: true
+
+tags: []

tools/under-control/src/components/policy/resources/templates/policy_definitions/PasswordManager/PasswordManagerBlocklist.yaml

@@ -0,0 +1,28 @@
+caption: Configure the list of domains for which the <ph name="PASSWORD_MANAGER_NAME">Password Manager</ph> (Save and
+  Fill) will be disabled
+desc: |-
+  Configure the list of domains where <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> should disable the <ph name="PASSWORD_MANAGER_NAME">Password Manager</ph>. This means that Save and Fill workflows will be disabled, ensuring that passwords for those websites can't be saved or auto filled into web forms.
+
+  If a domain is present in the list, the <ph name="PASSWORD_MANAGER_NAME">Password Manager</ph> will be disabled for it.
+
+  If a domain is not present in the list, the <ph name="PASSWORD_MANAGER_NAME">Password Manager</ph> will be available for it.
+
+  If the policy is unset, the <ph name="PASSWORD_MANAGER_NAME">Password Manager</ph> will be available for all domains.
+example_value:
+- example.com
+- login.example.com
+features:
+  dynamic_refresh: true
+  per_profile: true
+owners:
+- file://components/password_manager/OWNERS
+- kazinova@google.com
+schema:
+  items:
+    type: string
+  type: array
+supported_on:
+- chrome.*:138-
+- chrome_os:138-
+tags: []
+type: list

tools/under-control/src/components/policy/resources/templates/policy_definitions/PasswordManager/policy_atomic_groups.yaml

@@ -7,3 +7,4 @@ PasswordManager:
   - PasswordSharingEnabled
   - ThirdPartyPasswordManagersAllowed
   - PasswordManagerPasskeysEnabled
+  - PasswordManagerBlocklist

tools/under-control/src/components/policy/resources/templates/policy_definitions/PrivacySandbox/PrivacySandboxIpProtectionEnabled.yaml

@@ -1,29 +1,38 @@
 caption: Choose whether the <ph name="PRIVACY_SANDBOX_NAME">Privacy Sandbox</ph> IP Protection feature should be enabled.
 default: null
-default_for_enterprise_users: false
-desc: |-
-  A policy to control whether the <ph name="PRIVACY_SANDBOX_NAME">Privacy Sandbox</ph> IP Protection feature should be enabled.
+desc: |- # TODO(b/416726104): Move the considerations and other details to a help center article.
+  A policy to control whether the <ph name="PRIVACY_SANDBOX_NAME">Privacy Sandbox</ph> <ph name="IP_PROTECTION_NAME">IP Protection</ph> feature should be enabled.
 
-  If the policy is set to Disabled, then the IP Protection feature will be disabled and users won't be able to enable the feature via UI settings.
-  If the policy is set to Enabled, then the IP Protection feature will be enabled and users won't be able to disable the feature via UI settings.
-  If the policy is not set, users whose browser or device is being managed will have the IP Protection feature disabled and will not be able to enable the feature via UI settings. Users on unmanaged browsers and devices will be able to turn on or turn off the IP Protection feature on their device via UI settings.
+  <ph name="IP_PROTECTION_NAME">IP Protection</ph> is a feature that limits availability of a user's original IP address for certain third-party network requests made while browsing in Incognito mode, enhancing protections against cross-site tracking during Incognito browsing sessions.
+
+  If the policy is set to Disabled, then <ph name="IP_PROTECTION_NAME">IP Protection</ph> will be disabled and users won't be able to enable the feature via UI settings.
+  If the policy is set to Enabled, then <ph name="IP_PROTECTION_NAME">IP Protection</ph> will be enabled and users won't be able to disable the feature via UI settings.
+  If the policy is not set, <ph name="IP_PROTECTION_NAME">IP Protection</ph> will be enabled by default and users will be able to control the feature on their device via UI settings.
+
+  Some considerations regarding whether enterprises should disable <ph name="IP_PROTECTION_NAME">IP Protection</ph> include:
+  - DNS lookups won't be performed for requests that are proxied, which may impact DNS-based monitoring or filtering.
+  - Enterprise applications may experience breakage when used in Incognito mode if they rely on requests to domains (or subdomains of those domains) on the Masked Domain List (<ph name="MASKED_DOMAIN_LIST_URL">$1<ex>https://github.com/GoogleChrome/ip-protection/blob/main/Masked-Domain-List.md</ex></ph>) and require those requests to come from specific IP address ranges.
+  - Traffic might not be proxied in Incognito mode under certain conditions, for example when users launch Incognito mode from a Chrome profile they aren't signed in to. In general the feature requires the user to have been signed in to Chrome with a personal Google account when launching Incognito mode.
+  - The list of domains on the Masked Domain List may change over time, with new versions being pushed to users automatically. For more information on the Masked Domain List, see: <ph name="MASKED_DOMAIN_LIST_CRITERIA_URL">$1<ex>https://github.com/GoogleChrome/ip-protection/blob/main/README.md#identifying-domains-and-the-masked-domain-list-mdl</ex></ph>.
+
+  For more information on <ph name="IP_PROTECTION_NAME">IP Protection</ph>, see: <ph name="IP_PROTECTION_README_URL">$1<ex>https://github.com/GoogleChrome/ip-protection/blob/main/README.md</ex></ph>.
+
+  <ph name="IP_PROTECTION_NAME">IP Protection</ph> will be launched no sooner than M139.
 
-  Note: The behavior of the IP Protection feature for enterprise users may vary over time when the policy is set to Enabled or when the policy is not set and the feature is enabled via UI settings.
 example_value: false
 features:
   dynamic_refresh: true
   per_profile: true
-future_on:
- - fuchsia
- - chrome.*
- - chrome_os
- - android
+supported_on:
+- android:138-
+- chrome.*:138-
+- chrome_os:138-
 items:
-- caption: Disable the <ph name="PRIVACY_SANDBOX_NAME">Privacy Sandbox</ph> IP Protection feature.
+- caption: Disable the <ph name="IP_PROTECTION_NAME">IP Protection</ph> feature.
   value: false
-- caption: Enable the <ph name="PRIVACY_SANDBOX_NAME">Privacy Sandbox</ph> IP Protection feature.
+- caption: Enable the <ph name="IP_PROTECTION_NAME">IP Protection</ph> feature.
   value: true
-- caption: Allow users to turn on or turn off the <ph name="PRIVACY_SANDBOX_NAME">Privacy Sandbox</ph> IP Protection setting on their device if their browser and device are not being managed.
+- caption: Allow users to turn on or turn off the <ph name="IP_PROTECTION_NAME">IP Protection</ph> setting on their device. The feature will be enabled by default.
   value: null
 owners:
 - awillia@chromium.org

tools/under-control/src/components/policy/resources/templates/policy_definitions/PrivateNetworkRequestSettings/InsecurePrivateNetworkRequestsAllowed.yaml

@@ -1,5 +1,6 @@
 caption: Specifies whether to allow websites to make requests to more-private network
   endpoints in an insecure manner
+deprecated: true
 desc: |-
   Controls whether websites are allowed to make requests to more-private network endpoints in an insecure manner.
 
@@ -35,10 +36,10 @@ owners:
 schema:
   type: boolean
 supported_on:
-- chrome.*:92-
-- chrome_os:92-
-- android:92-
-- webview_android:92-
+- chrome.*:92-137
+- chrome_os:92-137
+- android:92-137
+- webview_android:92-137
 tags:
 - system-security
 type: main

tools/under-control/src/components/policy/resources/templates/policy_definitions/PrivateNetworkRequestSettings/InsecurePrivateNetworkRequestsAllowedForUrls.yaml

@@ -1,5 +1,6 @@
 caption: Allow the listed sites to make requests to more-private network endpoints
   in an insecure manner.
+deprecated: true
 desc: |-
   List of URL patterns. Requests initiated from websites served by matching origins are not subject to <ph name="PRIVATE_NETWORK_ACCESS">Private Network Access</ph> checks.
 
@@ -26,10 +27,10 @@ schema:
     type: string
   type: array
 supported_on:
-- chrome.*:92-
-- chrome_os:92-
-- android:92-
-- webview_android:92-
+- chrome.*:92-137
+- chrome_os:92-137
+- android:92-137
+- webview_android:92-137
 tags:
 - system-security
 type: list

tools/under-control/src/components/policy/resources/templates/policy_definitions/PrivateNetworkRequestSettings/PrivateNetworkAccessRestrictionsEnabled.yaml

@@ -5,6 +5,8 @@ owners:
 caption: Specifies whether to apply restrictions to requests to more-private
   network endpoints
 
+deprecated: true
+
 desc: |-
   When this policy is set to Enabled, any time when a warning is supposed to be
   displayed in the <ph name="DEV_TOOLS_NAME">DevTools</ph> due to <ph
@@ -19,12 +21,9 @@ desc: |-
   name="PRIVATE_NETWORK_ACCESS">Private Network Access</ph> restrictions.
 
 supported_on:
-- chrome.*:120-
-- chrome_os:120-
-- android:120-
-
-future_on:
-- fuchsia
+- chrome.*:120-137
+- chrome_os:120-137
+- android:120-137
 
 features:
   dynamic_refresh: true

tools/under-control/src/components/policy/resources/templates/policy_definitions/Sharing/TabGroupSharingSettings.yaml

@@ -26,11 +26,11 @@ schema:
   - 1
   type: integer
 items:
-- caption: Use the Shared Tab Group feature.
-  name: UseSharedTabGroup
+- caption: Use the tab group sharing feature.
+  name: UseTabGroupSharing
   value: 0
-- caption: Do not use the Shared Tab Group feature.
-  name: DoNotUseSharedTabGroup
+- caption: Do not use the tab group sharing feature.
+  name: DoNotUseTabGroupSharing
   value: 1
 default: 0
 example_value: 0

tools/under-control/src/components/policy/resources/templates/policy_definitions/Startup/HomepageIsNewTabPage.yaml

@@ -14,6 +14,7 @@ features:
   dynamic_refresh: true
   per_profile: true
 future_on:
+- android
 - fuchsia
 items:
 - caption: Use New Tab Page as homepage

tools/under-control/src/components/policy/resources/templates/policy_definitions/Startup/ShowHomeButton.yaml

@@ -9,6 +9,7 @@ features:
   dynamic_refresh: true
   per_profile: true
 future_on:
+- android
 - fuchsia
 items:
 - caption: Show the Home button on the toolbar

tools/under-control/src/content/browser/web_contents/web_contents_impl.cc

@@ -127,7 +127,6 @@
 #include "content/browser/tpcd_heuristics/opener_heuristic_tab_helper.h"
 #include "content/browser/tpcd_heuristics/redirect_heuristic_tab_helper.h"
 #include "content/browser/wake_lock/wake_lock_context_host.h"
-#include "content/browser/web_contents/accessibility_mode_policy.h"
 #include "content/browser/web_contents/java_script_dialog_commit_deferring_condition.h"
 #include "content/browser/web_contents/partitioned_popins_controller.h"
 #include "content/browser/web_contents/slow_web_preference_cache.h"
@@ -155,6 +154,7 @@
 #include "content/public/browser/javascript_dialog_manager.h"
 #include "content/public/browser/keyboard_event_processing_result.h"
 #include "content/public/browser/navigation_details.h"
+#include "content/public/browser/navigation_throttle_registry.h"
 #include "content/public/browser/permission_descriptor_util.h"
 #include "content/public/browser/preload_pipeline_info.h"
 #include "content/public/browser/preview_cancel_reason.h"
@@ -947,6 +947,11 @@ GURL WebContentsImpl::GetPartitionedPopinEmbedderOriginImpl() const {
   return partitioned_popin_opener_properties_->top_frame_origin.GetURL();
 }
 
+WindowOpenDisposition WebContentsImpl::GetOriginalWindowOpenDisposition()
+    const {
+  return original_window_open_disposition_;
+}
+
 void WebContents::SetScreenOrientationDelegate(
     ScreenOrientationDelegate* delegate) {
   ScreenOrientationProvider::SetDelegate(delegate);
@@ -1068,48 +1073,104 @@ WebContentsImpl::WebContentsTreeNode::WebContentsTreeNode(
 WebContentsImpl::WebContentsTreeNode::~WebContentsTreeNode() = default;
 
 void WebContentsImpl::WebContentsTreeNode::AttachInnerWebContents(
-    std::unique_ptr<WebContents> inner_web_contents,
-    RenderFrameHostImpl* render_frame_host) {
+    WebContents* inner_web_contents,
+    RenderFrameHostImpl* render_frame_host,
+    bool should_take_ownership) {
   OPTIONAL_TRACE_EVENT0("content",
                         "WebContentsTreeNode::AttachInnerWebContents");
   WebContentsImpl* inner_web_contents_impl =
-      static_cast<WebContentsImpl*>(inner_web_contents.get());
+      static_cast<WebContentsImpl*>(inner_web_contents);
   WebContentsTreeNode& inner_web_contents_node = inner_web_contents_impl->node_;
 
   inner_web_contents_node.outer_web_contents_ = current_web_contents_;
   inner_web_contents_node.outer_contents_frame_tree_node_id_ =
       render_frame_host->frame_tree_node()->frame_tree_node_id();
 
-  if (inner_web_contents) {
+  if (should_take_ownership) {
     inner_web_contents->SetOwnerLocationForDebug(FROM_HERE);
+    owned_inner_web_contents_.push_back(base::WrapUnique(inner_web_contents));
+  } else {
+    unowned_inner_web_contents_.push_back(inner_web_contents);
   }
-  inner_web_contents_.push_back(std::move(inner_web_contents));
 
   render_frame_host->frame_tree_node()->AddObserver(&inner_web_contents_node);
   current_web_contents_->InnerWebContentsAttached(inner_web_contents_impl);
 }
 
-std::unique_ptr<WebContents>
-WebContentsImpl::WebContentsTreeNode::DetachInnerWebContents(
-    WebContentsImpl* inner_web_contents) {
+void WebContentsImpl::WebContentsTreeNode::DetachInnerWebContents(
+    WebContents* inner_web_contents) {
   OPTIONAL_TRACE_EVENT0(
       "content",
       "WebContentsImpl::WebContentsTreeNode::DetachInnerWebContents");
-  std::unique_ptr<WebContents> detached_contents;
-  for (std::unique_ptr<WebContents>& web_contents : inner_web_contents_) {
-    if (web_contents.get() == inner_web_contents) {
-      detached_contents = std::move(web_contents);
-      std::swap(web_contents, inner_web_contents_.back());
-      inner_web_contents_.pop_back();
-      current_web_contents_->InnerWebContentsDetached(inner_web_contents);
-      if (detached_contents) {
-        detached_contents->SetOwnerLocationForDebug(std::nullopt);
-      }
-      return detached_contents;
-    }
+  CHECK_EQ(inner_web_contents->GetOuterWebContents(), current_web_contents_);
+
+  auto* inner_web_contents_impl =
+      static_cast<WebContentsImpl*>(inner_web_contents);
+  if (IsUnownedInnerWebContents(inner_web_contents)) {
+    DetachUnownedInnerWebContents(inner_web_contents_impl);
+  } else {
+    DestroyOwnedInnerWebContents(inner_web_contents_impl);
+  }
+}
+
+bool WebContentsImpl::WebContentsTreeNode::IsUnownedInnerWebContents(
+    WebContents* inner_web_contents) const {
+  CHECK_EQ(inner_web_contents->GetOuterWebContents(), current_web_contents_);
+  return base::Contains(unowned_inner_web_contents_, inner_web_contents);
+}
+
+void WebContentsImpl::WebContentsTreeNode::DetachUnownedInnerWebContents(
+    WebContentsImpl* inner_web_contents) {
+  std::erase(unowned_inner_web_contents_, inner_web_contents);
+
+  // Detach WebContents tree node and frame tree node.
+  bool was_inner_web_contents_focused =
+      inner_web_contents->ContainsOrIsFocusedWebContents();
+  FrameTree* focused_frame_tree = inner_web_contents->GetFocusedFrameTree();
+  WebContentsTreeNode& inner_web_contents_node = inner_web_contents->node_;
+  inner_web_contents_node.outer_web_contents_ = nullptr;
+  FrameTreeNode* outer_contents_frame_tree_node =
+      inner_web_contents_node.OuterContentsFrameTreeNode();
+  outer_contents_frame_tree_node->RemoveObserver(&inner_web_contents_node);
+  outer_contents_frame_tree_node->current_frame_host()
+      ->set_inner_tree_main_frame_tree_node_id(FrameTreeNodeId());
+  outer_contents_frame_tree_node->render_manager()
+      ->set_detach_inner_delegate_complete();
+  inner_web_contents_node.outer_contents_frame_tree_node_id_ =
+      FrameTreeNodeId();
+
+  // Reset inner WebContents's focused frame tree.
+  // When attached, only the outermost WebContents retains a focused tree. After
+  // detaching, the inner WebContents becomes the outermost WebContents from its
+  // perspective, so its focused frame tree needs to be set.
+  inner_web_contents_node.SetFocusedFrameTree(
+    was_inner_web_contents_focused ?
+      focused_frame_tree : &inner_web_contents->GetPrimaryFrameTree());
+  // Reset the outermost WebContents's focused frame tree if the inner
+  // WebContents was focused before detaching.
+  if (was_inner_web_contents_focused) {
+    current_web_contents_->SetAsFocusedWebContentsIfNecessary();
   }
 
-  NOTREACHED();
+  current_web_contents_->InnerWebContentsDetached(inner_web_contents);
+}
+
+void WebContentsImpl::WebContentsTreeNode::DestroyOwnedInnerWebContents(
+    WebContentsImpl* inner_web_contents) {
+  std::unique_ptr<WebContents> inner_web_contents_to_delete;
+  for (std::unique_ptr<WebContents>& web_contents : owned_inner_web_contents_) {
+    if (web_contents.get() == inner_web_contents) {
+      // Remove the WebContents from the list of owned WebContents.
+      inner_web_contents_to_delete = std::move(web_contents);
+      std::swap(web_contents, owned_inner_web_contents_.back());
+      owned_inner_web_contents_.pop_back();
+      break;
+    }
+  }
+  CHECK(inner_web_contents_to_delete);
+  inner_web_contents->SetOwnerLocationForDebug(std::nullopt);
+  current_web_contents_->InnerWebContentsDetached(inner_web_contents);
+  inner_web_contents_to_delete.reset();
 }
 
 FrameTreeNode*
@@ -1147,21 +1208,30 @@ WebContentsImpl*
 WebContentsImpl::WebContentsTreeNode::GetInnerWebContentsInFrame(
     const FrameTreeNode* frame) {
   auto ftn_id = frame->frame_tree_node_id();
-  for (auto& contents : inner_web_contents_) {
+  for (auto& contents : owned_inner_web_contents_) {
     WebContentsImpl* impl = static_cast<WebContentsImpl*>(contents.get());
     if (impl->node_.outer_contents_frame_tree_node_id() == ftn_id) {
       return impl;
     }
   }
+  for (auto& contents : unowned_inner_web_contents_) {
+    WebContentsImpl* impl = static_cast<WebContentsImpl*>(contents);
+    if (impl->node_.outer_contents_frame_tree_node_id() == ftn_id) {
+      return impl;
+    }
+  }
   return nullptr;
 }
 
 std::vector<WebContentsImpl*>
 WebContentsImpl::WebContentsTreeNode::GetInnerWebContents() const {
   std::vector<WebContentsImpl*> inner_web_contents;
-  for (auto& contents : inner_web_contents_) {
+  for (auto& contents : owned_inner_web_contents_) {
     inner_web_contents.push_back(static_cast<WebContentsImpl*>(contents.get()));
   }
+  for (auto& contents : unowned_inner_web_contents_) {
+    inner_web_contents.push_back(static_cast<WebContentsImpl*>(contents));
+  }
 
   return inner_web_contents;
 }
@@ -1364,10 +1434,6 @@ WebContentsImpl::WebContentsImpl(BrowserContext* browser_context)
     SharedStorageBudgetCharger::CreateForWebContents(this);
   }
 
-  if (input::IsTransferInputToVizSupported()) {
-    SetupRenderInputRouterDelegateConnection();
-  }
-
   if (base::FeatureList::IsEnabled(
           fingerprinting_protection_interventions::features::kCanvasNoise)) {
     renderer_preferences_.canvas_noise_token =
@@ -1375,22 +1441,6 @@ WebContentsImpl::WebContentsImpl(BrowserContext* browser_context)
   }
 }
 
-void WebContentsImpl::SetupRenderInputRouterDelegateConnection() {
-  // Handles setting up GPU mojo endpoint connections. In general, the number of
-  // retries for setting up these mojo connections is capped by the maximum
-  // number of attempts to restart the GPU process, see
-  // GpuProcessHost::GetFallbackCrashLimit().
-  rir_delegate_client_receiver_.reset();
-  rir_delegate_remote_.reset();
-  GetHostFrameSinkManager()->SetupRenderInputRouterDelegateConnection(
-      compositor_frame_sink_grouping_id_,
-      rir_delegate_client_receiver_.BindNewPipeAndPassRemote(),
-      rir_delegate_remote_.BindNewPipeAndPassReceiver());
-  rir_delegate_client_receiver_.set_disconnect_handler(
-      base::BindOnce(&WebContentsImpl::SetupRenderInputRouterDelegateConnection,
-                     weak_factory_.GetWeakPtr()));
-}
-
 WebContentsImpl::~WebContentsImpl() {
   TRACE_EVENT0("content", "WebContentsImpl::~WebContentsImpl");
   WebContentsOfBrowserContext::Detach(*this);
@@ -1430,6 +1480,11 @@ WebContentsImpl::~WebContentsImpl() {
     outermost->SetAsFocusedWebContentsIfNecessary();
   }
 
+  if (GetOuterWebContents()
+      && GetOuterWebContents()->node_.IsUnownedInnerWebContents(this)) {
+    GetOuterWebContents()->DetachUnownedInnerWebContents(this);
+  }
+
   if (pointer_lock_widget_) {
     pointer_lock_widget_->RejectPointerLockOrUnlockIfNecessary(
         blink::mojom::PointerLockResult::kElementDestroyed);
@@ -2098,29 +2153,7 @@ ui::ColorProviderKey::ColorMode WebContentsImpl::GetColorMode() const {
   return source->GetColorMode();
 }
 
-void WebContentsImpl::SetAccessibilityMode(ui::AXMode new_ax_mode) {
-  // Create the policy lazily so that the client is only enrolled into an arm
-  // of a trial if accessibility is enabled.
-  if (!accessibility_mode_policy_) {
-    // Exit early if the first call is a no-op, since creating the policy in
-    // this case would skew analysis of any trials.
-    if (new_ax_mode.is_mode_off()) {
-      return;
-    }
-    accessibility_mode_policy_ = AccessibilityModePolicy::Create(*this);
-  }
-  // Unretained is safe here because this owns the policy.
-  accessibility_mode_policy_->SetAccessibilityMode(base::BindRepeating(
-      [](WebContentsImpl* web_contents, ui::AXMode ax_mode, bool apply) {
-        if (web_contents) {
-          web_contents->SetAccessibilityModeImpl(apply ? ax_mode
-                                                       : ui::AXMode{});
-        }
-      },
-      base::Unretained(this), new_ax_mode));
-}
-
-void WebContentsImpl::SetAccessibilityModeImpl(ui::AXMode mode) {
+void WebContentsImpl::SetAccessibilityMode(ui::AXMode mode) {
   OPTIONAL_TRACE_EVENT2("content", "WebContentsImpl::SetAccessibilityMode",
                         "mode", mode.ToString(), "previous_mode",
                         accessibility_mode_.ToString());
@@ -2136,9 +2169,7 @@ void WebContentsImpl::SetAccessibilityModeImpl(ui::AXMode mode) {
 
   // Don't allow accessibility to be enabled for WebContents that are never
   // user-visible, like background pages.
-  if (IsNeverComposited()) {
-    return;
-  }
+  CHECK(!is_never_composited_);
 
   accessibility_mode_ = mode;
 
@@ -2235,6 +2266,11 @@ void WebContentsImpl::RequestAXTreeSnapshot(AXTreeSnapshotCallback callback,
                                             AXTreeSnapshotPolicy policy) {
   OPTIONAL_TRACE_EVENT1("content", "WebContentsImpl::RequestAXTreeSnapshot",
                         "mode", ax_mode.ToString());
+
+  // Inline text boxes are not supported in snapshots, as they are extra noise
+  // and expensive. If they are needed in the future, remove this line.
+  ax_mode.set_mode(ui::AXMode::kInlineTextBoxes, false);
+
   // Send a request to each of the frames in parallel. Each one will return
   // an accessibility tree snapshot, and AXTreeSnapshotCombiner will combine
   // them into a single tree and call |callback| with that result, then
@@ -2495,7 +2531,7 @@ bool WebContentsImpl::IsWebContentsOnlyAccessibilityModeForTesting() {
 }
 
 bool WebContentsImpl::IsFullAccessibilityModeForTesting() {
-  return accessibility_mode_ == ui::kAXModeComplete;
+  return accessibility_mode_ == ui::kAXModeDefaultForTests;
 }
 
 #if BUILDFLAG(IS_ANDROID)
@@ -2514,6 +2550,13 @@ void WebContentsImpl::SetContextMenuInsets(gfx::Rect safe_area) {
   }
 }
 
+void WebContentsImpl::ShowInterestInElement(int nodeID) {
+  OPTIONAL_TRACE_EVENT0("content", "WebContentsImpl::ShowInterestInElement");
+  if (auto* rwhv = GetRenderWidgetHostView()) {
+    rwhv->ShowInterestInElement(nodeID);
+  }
+}
+
 #endif
 
 const std::u16string& WebContentsImpl::GetTitle() {
@@ -3160,15 +3203,34 @@ void WebContentsImpl::AttachInnerWebContents(
     std::unique_ptr<WebContents> inner_web_contents,
     RenderFrameHost* render_frame_host,
     bool is_full_page) {
-  // Not reachable with MPArch based guests.
+  // Not reachable with MPArch based guest view.
   CHECK(!base::FeatureList::IsEnabled(features::kGuestViewMPArch));
+  AttachInnerWebContentsImpl(inner_web_contents.release(), render_frame_host,
+                            is_full_page,
+                            /*should_take_ownership=*/true);
+}
 
-  OPTIONAL_TRACE_EVENT2("content", "WebContentsImpl::AttachInnerWebContents",
-                        "inner_web_contents",
-                        static_cast<void*>(inner_web_contents.get()),
-                        "is_full_page", is_full_page);
+void WebContentsImpl::AttachUnownedInnerWebContents(
+    base::PassKey<UnownedInnerWebContentsClient>,
+    WebContents* inner_web_contents,
+    RenderFrameHost* render_frame_host) {
+  AttachInnerWebContentsImpl(inner_web_contents, render_frame_host,
+                            /*is_full_page=*/false,
+                            /*should_take_ownership=*/false);
+}
+
+void WebContentsImpl::AttachInnerWebContentsImpl(
+    WebContents* inner_web_contents,
+    RenderFrameHost* render_frame_host,
+    bool is_full_page,
+    bool should_take_ownership) {
+  OPTIONAL_TRACE_EVENT("content", "WebContentsImpl::AttachInnerWebContents",
+                       "inner_web_contents",
+                       static_cast<void*>(inner_web_contents), "is_full_page",
+                       is_full_page, "should_take_ownership",
+                       should_take_ownership);
   WebContentsImpl* inner_web_contents_impl =
-      static_cast<WebContentsImpl*>(inner_web_contents.get());
+      static_cast<WebContentsImpl*>(inner_web_contents);
   DCHECK(!inner_web_contents_impl->node_.outer_web_contents());
   auto* render_frame_host_impl =
       static_cast<RenderFrameHostImpl*>(render_frame_host);
@@ -3219,7 +3281,7 @@ void WebContentsImpl::AttachInnerWebContents(
   // calls below will just early return.
   inner_render_manager->InitRenderView(
       inner_main_frame->GetSiteInstance()->group(), inner_render_view_host,
-      nullptr);
+      /*proxy=*/nullptr, /*navigation_metrics_token=*/std::nullopt);
   if (!inner_render_manager->GetRenderWidgetHostView()) {
     inner_web_contents_impl->CreateRenderWidgetHostViewForRenderManager(
         inner_render_view_host);
@@ -3228,8 +3290,8 @@ void WebContentsImpl::AttachInnerWebContents(
   inner_web_contents_impl->RecursivelyUnregisterRenderWidgetHostViews();
 
   // Create a link to our outer WebContents.
-  node_.AttachInnerWebContents(std::move(inner_web_contents),
-                               render_frame_host_impl);
+  node_.AttachInnerWebContents(inner_web_contents, render_frame_host_impl,
+                               should_take_ownership);
 
   // Create a proxy in top-level RenderFrameHostManager, pointing to the
   // SiteInstanceGroup of the outer WebContents. The proxy will be used to send
@@ -3258,7 +3320,7 @@ void WebContentsImpl::AttachInnerWebContents(
         inner_web_contents_impl->primary_frame_tree_.root(),
         render_frame_host_impl->GetSiteInstance()->group());
   }
-  outer_render_manager->set_attach_complete();
+  outer_render_manager->set_attach_inner_delegate_complete();
 
   // If the inner WebContents is full frame, give it focus.
   if (is_full_page) {
@@ -3276,6 +3338,74 @@ void WebContentsImpl::AttachInnerWebContents(
   inner_main_frame->PropagateEmbeddingTokenToParentFrame();
 }
 
+void WebContentsImpl::DetachUnownedInnerWebContents(
+    base::PassKey<UnownedInnerWebContentsClient>,
+    WebContents* inner_web_contents) {
+  DetachUnownedInnerWebContents(inner_web_contents);
+}
+
+void WebContentsImpl::DetachUnownedInnerWebContents(
+    WebContents* inner_web_contents) {
+  CHECK(base::FeatureList::IsEnabled(features::kAttachUnownedInnerWebContents));
+  CHECK(node_.IsUnownedInnerWebContents(inner_web_contents));
+
+  WebContentsImpl* inner_web_contents_impl =
+      static_cast<WebContentsImpl*>(inner_web_contents);
+  // Unregister and destroy RenderWidgetHostViewChildFrame.
+  inner_web_contents_impl->RecursivelyUnregisterRenderWidgetHostViews();
+
+  // RenderWidgetHostView are of type RenderWidgetHostViewChildFrame and they
+  // need to be re-created with appropriate platform views.
+  std::vector<RenderViewHostImpl*> list_of_rvh_with_rwhv;
+  inner_web_contents_impl->GetPrimaryFrameTree().ForEachRenderViewHost(
+      [&list_of_rvh_with_rwhv](RenderViewHostImpl* rvh) {
+        if (rvh->GetWidget() && rvh->GetWidget()->GetView()) {
+          CHECK(
+              rvh->GetWidget()->GetView()->IsRenderWidgetHostViewChildFrame());
+          rvh->GetWidget()->GetView()->Destroy();
+          list_of_rvh_with_rwhv.push_back(rvh);
+        }
+      });
+
+  // Destroy WebContentsViewChildFrame.
+  inner_web_contents_impl->render_view_host_delegate_view_ = nullptr;
+  inner_web_contents_impl->view_ = nullptr;
+
+  // Reset proxy.
+  RenderFrameHostManager* inner_render_manager =
+      inner_web_contents_impl->GetRenderManager();
+  RenderFrameHostImpl* inner_main_frame =
+      inner_render_manager->current_frame_host();
+  RenderFrameProxyHost* proxy = inner_render_manager->GetProxyToOuterDelegate();
+  if (proxy) {
+    inner_main_frame->browsing_context_state()->DeleteRenderFrameProxyHost(
+        proxy->site_instance_group(),
+        BrowsingContextState::ProxyAccessMode::kAllowOuterDelegate);
+  }
+
+  node_.DetachInnerWebContents(inner_web_contents_impl);
+
+  // Recreate WebContentsView.
+  inner_web_contents_impl->view_ = CreateWebContentsView(
+      inner_web_contents_impl,
+      GetContentClient()->browser()->GetWebContentsViewDelegate(
+          inner_web_contents_impl),
+      &inner_web_contents_impl->render_view_host_delegate_view_);
+  inner_web_contents_impl->view_->CreateView(gfx::NativeView());
+
+  // Recreate and register RenderWidgetHostView. Don't do this if the
+  // WebContents is being destroyed because it will cause a CHECK failure in
+  // SendScreenRects().
+  if (!inner_web_contents_impl->IsBeingDestroyed()) {
+    for (RenderViewHostImpl* rvh : list_of_rvh_with_rwhv) {
+      inner_web_contents_impl->CreateRenderWidgetHostViewForRenderManager(rvh);
+    }
+    inner_web_contents_impl->RecursivelyRegisterRenderWidgetHostViews();
+  }
+
+  inner_main_frame->UpdateAXTreeData();
+}
+
 void WebContentsImpl::AttachGuestPage(
     std::unique_ptr<GuestPageHolder> guest_page,
     RenderFrameHost* outer_render_frame_host) {
@@ -3333,7 +3463,7 @@ void WebContentsImpl::AttachGuestPage(
   // call below will just early return.
   inner_render_manager->InitRenderView(
       inner_main_frame->GetSiteInstance()->group(), inner_render_view_host,
-      /*proxy=*/nullptr);
+      /*proxy=*/nullptr, /*navigation_metrics_token=*/std::nullopt);
 
   // If we are reusing the RenderViewHost and it doesn't already have a
   // RenderWidgetHostView, we need to create one if this is the main frame.
@@ -3370,7 +3500,7 @@ void WebContentsImpl::AttachGuestPage(
   inner_render_manager->SetRWHViewForInnerFrameTree(child_rwhv);
   child_rwhv->RegisterFrameSinkId();
 
-  outer_render_manager->set_attach_complete();
+  outer_render_manager->set_attach_inner_delegate_complete();
   inner_main_frame->PropagateEmbeddingTokenToParentFrame();
   // TODO(crbug.com/40202416): Determine if anything else is needed here.
 }
@@ -3697,10 +3827,6 @@ void WebContentsImpl::OnWebPreferencesChanged() {
         }
       }
     }
-    // Notify VizCompositor thread of force_enable_zoom state changes.
-    if (auto* remote = GetRenderInputRouterDelegateRemote()) {
-      remote->ForceEnableZoomStateChanged(force_enable_zoom_, frame_sink_ids);
-    }
   }
 #endif
 
@@ -3899,6 +4025,7 @@ void WebContentsImpl::Init(const WebContents::CreateParams& params,
   renderer_preferences_.uses_platform_autofill =
       params.initially_use_platform_autofill;
 
+  is_never_composited_ = params.is_never_composited;
   is_in_preview_mode_ = params.preview_mode;
   creator_location_ = params.creator_location;
 #if BUILDFLAG(IS_ANDROID)
@@ -3966,9 +4093,10 @@ void WebContentsImpl::Init(const WebContents::CreateParams& params,
   CHECK(view_.get());
 
   // Set the accessibility mode after the view is created.
-  SetAccessibilityMode(
-      BrowserAccessibilityState::GetInstance()
-          ->GetAccessibilityModeForBrowserContext(GetBrowserContext()));
+  if (!is_never_composited_) {
+    BrowserAccessibilityStateImpl::GetInstance()->OnWebContentsInitialized(
+        this);
+  }
 
   view_->CreateView(params.context);
 
@@ -4004,8 +4132,9 @@ void WebContentsImpl::Init(const WebContents::CreateParams& params,
   if (params.desired_renderer_state ==
       CreateParams::kInitializeAndWarmupRendererProcess) {
     if (!GetRenderManager()->current_frame_host()->IsRenderFrameLive()) {
-      GetRenderManager()->InitRenderView(site_instance->group(),
-                                         GetRenderViewHost(), nullptr);
+      GetRenderManager()->InitRenderView(
+          site_instance->group(), GetRenderViewHost(), /*proxy=*/nullptr,
+          /*navigation_metrics_token=*/std::nullopt);
     }
   }
 
@@ -4215,6 +4344,19 @@ bool WebContentsImpl::PreHandleMouseEvent(const blink::WebMouseEvent& event) {
   return delegate_ ? delegate_->PreHandleMouseEvent(this, event) : false;
 }
 
+void WebContentsImpl::PreHandleDragUpdate(const DropData& drop_data,
+                                          const gfx::PointF& client_pt) {
+  if (delegate_) {
+    delegate_->PreHandleDragUpdate(drop_data, client_pt);
+  }
+}
+
+void WebContentsImpl::PreHandleDragExit() {
+  if (delegate_) {
+    delegate_->PreHandleDragExit();
+  }
+}
+
 KeyboardEventProcessingResult WebContentsImpl::PreHandleKeyboardEvent(
     const input::NativeWebKeyboardEvent& event) {
   OPTIONAL_TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("content.verbose"),
@@ -4641,6 +4783,17 @@ void WebContentsImpl::UpdateVisibilityAndNotifyPageAndView(
   bool view_is_visible =
       !IsCrashed() && page_visibility != PageVisibilityState::kHidden;
 
+  // True if the instance is being hidden or revealed.
+  const bool hide_or_reveal = (visibility_ == Visibility::HIDDEN) !=
+                              (new_visibility == Visibility::HIDDEN);
+
+  // Send ax modes to renderers before they start painting if they are being
+  // revealed.
+  if (!is_never_composited_ && hide_or_reveal &&
+      new_visibility != Visibility::HIDDEN) {
+    BrowserAccessibilityStateImpl::GetInstance()->OnWebContentsRevealed(this);
+  }
+
   // Prerendering relies on overriding FrameTree::Delegate::IsHidden,
   // while for other frame trees FrameTree::Delegate::IsHidden
   // resolves to WebContents' visibility, so we avoid Prerender RennderViewHosts
@@ -4731,6 +4884,11 @@ void WebContentsImpl::UpdateVisibilityAndNotifyPageAndView(
     }
   }
 
+  if (!is_never_composited_ && hide_or_reveal &&
+      new_visibility == Visibility::HIDDEN) {
+    BrowserAccessibilityStateImpl::GetInstance()->OnWebContentsHidden(this);
+  }
+
   // We cannot show a page or capture video unless there is a valid renderer
   // associated with this web contents. The navigation controller for this page
   // must be set to active (allowing navigation to complete, a renderer and its
@@ -5011,10 +5169,11 @@ FrameTree* WebContentsImpl::CreateNewWindow(
   }
 
   // TODO(crbug.com/40202416): Support a way for MPArch guests to support this.
-  if (delegate_ && delegate_->IsWebContentsCreationOverridden(
-                       source_site_instance, params.window_container_type,
-                       opener->GetLastCommittedURL(), params.frame_name,
-                       params.target_url)) {
+  if (delegate_ &&
+      delegate_->IsWebContentsCreationOverridden(
+          opener, source_site_instance, params.window_container_type,
+          opener->GetLastCommittedURL(), params.frame_name,
+          params.target_url)) {
     auto* web_contents_impl =
         static_cast<WebContentsImpl*>(delegate_->CreateCustomWebContents(
             opener, source_site_instance, is_new_browsing_instance,
@@ -5131,6 +5290,9 @@ FrameTree* WebContentsImpl::CreateNewWindow(
   SetPartitionedPopinOpenerOnNewWindowIfNeeded(new_contents_impl, params,
                                                opener);
 
+  // Sets the newly created WebContents WindowOpenDisposition.
+  new_contents_impl->original_window_open_disposition_ = params.disposition;
+
   // If the new frame has a name, make sure any SiteInstances that can find
   // this named frame have proxies for it.  Must be called after
   // SetSessionStorageNamespace, since this calls CreateRenderView, which uses
@@ -7351,62 +7513,6 @@ input::TouchEmulator* WebContentsImpl::GetTouchEmulator(
   return touch_emulator_.get();
 }
 
-void WebContentsImpl::NotifyObserversOfInputEvent(
-    const viz::FrameSinkId& frame_sink_id,
-    std::unique_ptr<blink::WebCoalescedInputEvent> event,
-    bool dispatched_to_renderer) {
-  auto iter = created_widgets_.find(frame_sink_id);
-  // This adds a safeguard against race condition where a RenderWidgetHostImpl
-  // is being destroyed & removed from |created_widgets_|, but Viz may still
-  // send a mojo call referencing it.
-  if (iter == created_widgets_.end()) {
-    return;
-  }
-  iter->second->NotifyObserversOfInputEvent(event->Event(),
-                                            dispatched_to_renderer);
-}
-
-void WebContentsImpl::NotifyObserversOfInputEventAcks(
-    const viz::FrameSinkId& frame_sink_id,
-    blink::mojom::InputEventResultSource ack_source,
-    blink::mojom::InputEventResultState ack_result,
-    std::unique_ptr<blink::WebCoalescedInputEvent> event) {
-  auto iter = created_widgets_.find(frame_sink_id);
-  // This adds a safeguard against race condition where a RenderWidgetHostImpl
-  // is being destroyed & removed from |created_widgets_|, but Viz may still
-  // send a mojo call referencing it.
-  if (iter == created_widgets_.end()) {
-    return;
-  }
-  iter->second->NotifyObserversOfInputEventAcks(ack_source, ack_result,
-                                                event->Event());
-}
-
-void WebContentsImpl::OnInvalidInputEventSource(
-    const viz::FrameSinkId& frame_sink_id) {
-  auto iter = created_widgets_.find(frame_sink_id);
-  // This adds a safeguard against race condition where a RenderWidgetHostImpl
-  // is being destroyed & removed from |created_widgets_|, but Viz may still
-  // send a mojo call referencing it.
-  if (iter == created_widgets_.end()) {
-    return;
-  }
-  iter->second->OnInvalidInputEventSource();
-}
-
-void WebContentsImpl::StateOnOverscrollTransfer(
-    const viz::FrameSinkId& frame_sink_id,
-    blink::mojom::DidOverscrollParamsPtr params) {
-  auto iter = created_widgets_.find(frame_sink_id);
-  // This adds a safeguard against race condition where a RenderWidgetHostImpl
-  // is being destroyed & removed from |created_widgets_|, but Viz may still
-  // send a mojo call referencing it.
-  if (iter == created_widgets_.end()) {
-    return;
-  }
-  iter->second->DidOverscroll(std::move(params));
-}
-
 void WebContentsImpl::DidNavigateMainFramePreCommit(
     NavigationHandle* navigation_handle,
     bool navigation_is_within_page) {
@@ -8935,10 +9041,7 @@ void WebContentsImpl::ClearFocusedElement() {
 }
 
 bool WebContentsImpl::IsNeverComposited() {
-  if (!delegate_) {
-    return false;
-  }
-  return delegate_->IsNeverComposited(this);
+  return is_never_composited_;
 }
 
 RenderViewHostDelegateView* WebContentsImpl::GetDelegateView() {
@@ -9248,9 +9351,8 @@ void WebContentsImpl::UpdateWindowPreferredSize(
 }
 
 std::vector<RenderFrameHostImpl*>
-WebContentsImpl::GetActiveTopLevelDocumentsInGroup(
-    RenderFrameHostImpl* render_frame_host,
-    GroupType group_type) {
+WebContentsImpl::GetActiveTopLevelDocumentsInBrowsingContextGroup(
+    RenderFrameHostImpl* render_frame_host) {
   std::vector<RenderFrameHostImpl*> out;
   for (WebContentsImpl* web_contents : GetAllWebContents()) {
     RenderFrameHostImpl* other_render_frame_host =
@@ -9262,18 +9364,8 @@ WebContentsImpl::GetActiveTopLevelDocumentsInGroup(
       continue;
     }
 
-    // If we're looking for frames in the same browsing context group, filter
-    // frames in different browsing context groups.
-    if (group_type == GroupType::kBrowsingContextGroup &&
-        !render_frame_host->GetSiteInstance()->IsRelatedSiteInstance(
-            other_render_frame_host->GetSiteInstance())) {
-      continue;
-    }
-
-    // If we're looking for frames in the same CoopRelatedGroup, filter frames
-    // in different CoopRelatedGroups.
-    if (group_type == GroupType::kCoopRelatedGroup &&
-        !render_frame_host->GetSiteInstance()->IsCoopRelatedSiteInstance(
+    // Filter frames in different browsing context groups.
+    if (!render_frame_host->GetSiteInstance()->IsRelatedSiteInstance(
             other_render_frame_host->GetSiteInstance())) {
       continue;
     }
@@ -9283,20 +9375,6 @@ WebContentsImpl::GetActiveTopLevelDocumentsInGroup(
   return out;
 }
 
-std::vector<RenderFrameHostImpl*>
-WebContentsImpl::GetActiveTopLevelDocumentsInBrowsingContextGroup(
-    RenderFrameHostImpl* render_frame_host) {
-  return GetActiveTopLevelDocumentsInGroup(render_frame_host,
-                                           GroupType::kBrowsingContextGroup);
-}
-
-std::vector<RenderFrameHostImpl*>
-WebContentsImpl::GetActiveTopLevelDocumentsInCoopRelatedGroup(
-    RenderFrameHostImpl* render_frame_host) {
-  return GetActiveTopLevelDocumentsInGroup(render_frame_host,
-                                           GroupType::kCoopRelatedGroup);
-}
-
 PrerenderHostRegistry* WebContentsImpl::GetPrerenderHostRegistry() {
   DCHECK(prerender_host_registry_);
   return prerender_host_registry_.get();
@@ -9522,16 +9600,12 @@ bool WebContentsImpl::IsHidden() {
   return GetPageVisibilityState() == PageVisibilityState::kHidden;
 }
 
-std::vector<std::unique_ptr<NavigationThrottle>>
-WebContentsImpl::CreateThrottlesForNavigation(
-    NavigationHandle* navigation_handle) {
+void WebContentsImpl::CreateThrottlesForNavigation(
+    NavigationThrottleRegistry& registry) {
   OPTIONAL_TRACE_EVENT1("content",
                         "WebContentsImpl::CreateThrottlesForNavigation",
-                        "navigation", navigation_handle);
-  auto throttles = GetContentClient()->browser()->CreateThrottlesForNavigation(
-      navigation_handle);
-
-  return throttles;
+                        "navigation", registry.GetNavigationHandle());
+  GetContentClient()->browser()->CreateThrottlesForNavigation(registry);
 }
 
 std::vector<std::unique_ptr<CommitDeferringCondition>>
@@ -10333,7 +10407,8 @@ void WebContentsImpl::ReattachOuterDelegateIfNeeded() {
 bool WebContentsImpl::CreateRenderViewForRenderManager(
     RenderViewHost* render_view_host,
     const std::optional<blink::FrameToken>& opener_frame_token,
-    RenderFrameProxyHost* proxy_host) {
+    RenderFrameProxyHost* proxy_host,
+    const std::optional<base::UnguessableToken>& navigation_metrics_token) {
   TRACE_EVENT1("browser,navigation",
                "WebContentsImpl::CreateRenderViewForRenderManager",
                "render_view_host", render_view_host);
@@ -10351,7 +10426,8 @@ bool WebContentsImpl::CreateRenderViewForRenderManager(
   // TODO(crbug.com/40166243): Given MPArch, should we pass
   // opened_by_another_window_ for non primary FrameTrees?
   if (!rvh_impl->CreateRenderView(opener_frame_token, proxy_routing_id,
-                                  opened_by_another_window_)) {
+                                  opened_by_another_window_,
+                                  navigation_metrics_token)) {
     return false;
   }
 
@@ -11141,10 +11217,6 @@ void WebContentsImpl::MediaStartedPlaying(
     const WebContentsObserver::MediaPlayerInfo& media_info,
     const MediaPlayerId& id) {
   OPTIONAL_TRACE_EVENT0("content", "WebContentsImpl::MediaStartedPlaying");
-  if (media_info.has_video) {
-    currently_playing_video_count_++;
-  }
-
   observers_.NotifyObservers(&WebContentsObserver::MediaStartedPlaying,
                              media_info, id);
 }
@@ -11154,14 +11226,17 @@ void WebContentsImpl::MediaStoppedPlaying(
     const MediaPlayerId& id,
     WebContentsObserver::MediaStoppedReason reason) {
   OPTIONAL_TRACE_EVENT0("content", "WebContentsImpl::MediaStoppedPlaying");
-  if (media_info.has_video) {
-    currently_playing_video_count_--;
-  }
-
   observers_.NotifyObservers(&WebContentsObserver::MediaStoppedPlaying,
                              media_info, id, reason);
 }
 
+void WebContentsImpl::MediaMetadataChanged(
+    const WebContentsObserver::MediaPlayerInfo& media_info,
+    const MediaPlayerId& id) {
+  observers_.NotifyObservers(&WebContentsObserver::MediaMetadataChanged,
+                             media_info, id);
+}
+
 void WebContentsImpl::MediaResized(const gfx::Size& size,
                                    const MediaPlayerId& id) {
   OPTIONAL_TRACE_EVENT0("content", "WebContentsImpl::MediaResized");
@@ -11188,8 +11263,8 @@ void WebContentsImpl::MediaSessionCreated(MediaSession* media_session) {
                              media_session);
 }
 
-int WebContentsImpl::GetCurrentlyPlayingVideoCount() {
-  return currently_playing_video_count_;
+int WebContentsImpl::GetCurrentlyPlayingVideoCount() const {
+  return media_web_contents_observer_->GetCurrentlyPlayingVideoCount();
 }
 
 std::optional<gfx::Size> WebContentsImpl::GetFullscreenVideoSize() {
@@ -11893,14 +11968,6 @@ void WebContentsImpl::OnInputIgnored(const blink::WebInputEvent& event) {
 #endif
 }
 
-input::mojom::RenderInputRouterDelegate*
-WebContentsImpl::GetRenderInputRouterDelegateRemote() {
-  if (!rir_delegate_remote_) {
-    return nullptr;
-  }
-  return rir_delegate_remote_.get();
-}
-
 #if BUILDFLAG(IS_ANDROID)
 float WebContentsImpl::GetCurrentTouchSequenceYOffset() {
   ui::ViewAndroid* view_android = GetNativeView();

tools/under-control/src/content/child/runtime_features.cc

@@ -203,10 +203,6 @@ void SetRuntimeFeaturesFromChromiumFeatures() {
           {wf::EnableEyeDropperAPI, raw_ref(features::kEyeDropper),
            kSetOnlyIfOverridden},
           {wf::EnableFedCm, raw_ref(features::kFedCm), kSetOnlyIfOverridden},
-          {wf::EnableFedCm, raw_ref(features::kFedCmButtonMode),
-           kSetOnlyIfOverridden},
-          {wf::EnableFedCm, raw_ref(features::kFedCmAuthz),
-           kSetOnlyIfOverridden},
           {wf::EnableFedCmAutofill, raw_ref(features::kFedCmAutofill),
            kDefault},
           {wf::EnableFedCmDelegation, raw_ref(features::kFedCmDelegation),
@@ -225,8 +221,6 @@ void SetRuntimeFeaturesFromChromiumFeatures() {
           {wf::EnableFedCmMultipleIdentityProviders,
            raw_ref(features::kFedCmMultipleIdentityProviders),
            kSetOnlyIfOverridden},
-          {wf::EnableFedCmSelectiveDisclosure,
-           raw_ref(features::kFedCmSelectiveDisclosure), kDefault},
           {wf::EnableFencedFrames,
            raw_ref(features::kPrivacySandboxAdsAPIsOverride),
            kSetOnlyIfOverridden},
@@ -242,6 +236,8 @@ void SetRuntimeFeaturesFromChromiumFeatures() {
            raw_ref(features::kUserMediaScreenCapturing)},
 #endif
           {wf::EnableInstalledApp, raw_ref(features::kInstalledApp)},
+          {wf::EnableIntegrityPolicyScript,
+           raw_ref(network::features::kIntegrityPolicyScript)},
           {wf::EnableLazyInitializeMediaControls,
            raw_ref(features::kLazyInitializeMediaControls)},
 #if BUILDFLAG(IS_CHROMEOS)
@@ -264,6 +260,7 @@ void SetRuntimeFeaturesFromChromiumFeatures() {
 #if BUILDFLAG(IS_ANDROID)
           {wf::EnableSmartZoom, raw_ref(features::kSmartZoom)},
 #endif
+          {wf::EnableTouchDragAndDrop, raw_ref(features::kTouchDragAndDrop)},
           {wf::EnableTouchDragAndContextMenu,
            raw_ref(features::kTouchDragAndContextMenu)},
           {wf::EnableWebAuthenticationAmbient,
@@ -369,8 +366,6 @@ void SetRuntimeFeaturesFromChromiumFeatures() {
            kSetOnlyIfOverridden},
           {"FledgeBiddingAndAuctionServerAPI",
            raw_ref(blink::features::kFledgeBiddingAndAuctionServer), kDefault},
-          {"FontationsFontBackend",
-           raw_ref(blink::features::kFontationsFontBackend)},
           {"FontSrcLocalMatching", raw_ref(features::kFontSrcLocalMatching)},
           {"MachineLearningNeuralNetwork",
            raw_ref(webnn::mojom::features::kWebMachineLearningNeuralNetwork),
@@ -414,7 +409,9 @@ void SetRuntimeFeaturesFromChromiumFeatures() {
           {"WebAppLaunchQueue", raw_ref(features::kAndroidWebAppLaunchHandler)},
 #endif
           {"WebAuthenticationNewBfCacheHandlingBlink",
-           raw_ref(device::kWebAuthnNewBfCacheHandling)}};
+           raw_ref(device::kWebAuthnNewBfCacheHandling)},
+          {"LocalNetworkAccessPermissionPolicy",
+           raw_ref(network::features::kLocalNetworkAccessChecks)}};
   for (const auto& mapping : runtimeFeatureNameToChromiumFeatureMapping) {
     SetRuntimeFeatureFromChromiumFeature(
         *mapping.chromium_feature, mapping.option, [&mapping](bool enabled) {

tools/under-control/src/content/public/browser/content_browser_client.cc

@@ -62,6 +62,7 @@
 #include "media/mojo/mojom/media_service.mojom.h"
 #include "mojo/public/cpp/bindings/message.h"
 #include "net/base/isolation_info.h"
+#include "net/cookies/cookie_setting_override.h"
 #include "net/cookies/site_for_cookies.h"
 #include "net/ssl/client_cert_identity.h"
 #include "net/ssl/client_cert_store.h"
@@ -178,16 +179,25 @@ bool ContentBrowserClient::ShouldUseProcessPerSite(
   return false;
 }
 
+bool ContentBrowserClient::
+    ShouldReuseExistingProcessForNewMainFrameSiteInstance(
+        BrowserContext* browser_context,
+        const GURL& site_instance_original_url) {
+  DCHECK(browser_context);
+  return true;
+}
+
 bool ContentBrowserClient::ShouldAllowProcessPerSiteForMultipleMainFrames(
     BrowserContext* context) {
   return true;
 }
 
-std::optional<ContentBrowserClient::SpareProcessRefusedByEmbedderReason>
-ContentBrowserClient::ShouldUseSpareRenderProcessHost(
+bool ContentBrowserClient::ShouldUseSpareRenderProcessHost(
     BrowserContext* browser_context,
-    const GURL& site_url) {
-  return std::nullopt;
+    const GURL& site_url,
+    std::optional<SpareProcessRefusedByEmbedderReason>& refused_reason) {
+  refused_reason = std::nullopt;
+  return true;
 }
 
 bool ContentBrowserClient::DoesSiteRequireDedicatedProcess(
@@ -451,6 +461,7 @@ AllowServiceWorkerResult ContentBrowserClient::AllowServiceWorker(
     const GURL& scope,
     const net::SiteForCookies& site_for_cookies,
     const std::optional<url::Origin>& top_frame_origin,
+    const blink::StorageKey& storage_key,
     const GURL& script_url,
     BrowserContext* context) {
   return AllowServiceWorkerResult::Yes();
@@ -542,6 +553,7 @@ void ContentBrowserClient::AllowWorkerFileSystem(
     const GURL& url,
     BrowserContext* browser_context,
     const std::vector<GlobalRenderFrameHostId>& render_frames,
+    const blink::StorageKey& storage_key,
     base::OnceCallback<void(bool)> callback) {
   std::move(callback).Run(true);
 }
@@ -549,21 +561,24 @@ void ContentBrowserClient::AllowWorkerFileSystem(
 bool ContentBrowserClient::AllowWorkerIndexedDB(
     const GURL& url,
     BrowserContext* browser_context,
-    const std::vector<GlobalRenderFrameHostId>& render_frames) {
+    const std::vector<GlobalRenderFrameHostId>& render_frames,
+    const blink::StorageKey& storage_key) {
   return true;
 }
 
 bool ContentBrowserClient::AllowWorkerCacheStorage(
     const GURL& url,
     BrowserContext* browser_context,
-    const std::vector<GlobalRenderFrameHostId>& render_frames) {
+    const std::vector<GlobalRenderFrameHostId>& render_frames,
+    const blink::StorageKey& storage_key) {
   return true;
 }
 
 bool ContentBrowserClient::AllowWorkerWebLocks(
     const GURL& url,
     BrowserContext* browser_context,
-    const std::vector<GlobalRenderFrameHostId>& render_frames) {
+    const std::vector<GlobalRenderFrameHostId>& render_frames,
+    const blink::StorageKey& storage_key) {
   return true;
 }
 
@@ -699,7 +714,13 @@ bool ContentBrowserClient::IsFullCookieAccessAllowed(
     content::BrowserContext* browser_context,
     content::WebContents* web_contents,
     const GURL& url,
-    const blink::StorageKey& storage_key) {
+    const blink::StorageKey& storage_key,
+    net::CookieSettingOverrides overrides) {
+  return true;
+}
+
+bool ContentBrowserClient::IsPrefetchWithServiceWorkerAllowed(
+    content::BrowserContext* browser_context) {
   return true;
 }
 
@@ -710,6 +731,12 @@ void ContentBrowserClient::GrantCookieAccessDueToHeuristic(
     base::TimeDelta ttl,
     bool ignore_schemes) {}
 
+bool ContentBrowserClient::AreThirdPartyCookiesGenerallyAllowed(
+    content::BrowserContext* browser_context,
+    content::WebContents* web_contents) {
+  return true;
+}
+
 bool ContentBrowserClient::CanSendSCTAuditingReport(
     BrowserContext* browser_context) {
   return false;
@@ -990,11 +1017,8 @@ void ContentBrowserClient::OpenURL(
   std::move(callback).Run(nullptr);
 }
 
-std::vector<std::unique_ptr<NavigationThrottle>>
-content::ContentBrowserClient::CreateThrottlesForNavigation(
-    NavigationHandle* navigation_handle) {
-  return std::vector<std::unique_ptr<NavigationThrottle>>();
-}
+void ContentBrowserClient::CreateThrottlesForNavigation(
+    NavigationThrottleRegistry& registry) {}
 
 std::vector<std::unique_ptr<CommitDeferringCondition>>
 ContentBrowserClient::CreateCommitDeferringConditionsForNavigation(
@@ -1758,8 +1782,9 @@ bool ContentBrowserClient::CanBackForwardCachedPageReceiveCookieChanges(
     content::BrowserContext& browser_context,
     const GURL& url,
     const net::SiteForCookies& site_for_cookies,
-    const std::optional<url::Origin>& top_frame_origin,
-    const net::CookieSettingOverrides overrides) {
+    const url::Origin& top_frame_origin,
+    const net::CookieSettingOverrides overrides,
+    base::optional_ref<const net::CookiePartitionKey> cookie_partition_key) {
   return true;
 }
 
@@ -1793,6 +1818,11 @@ bool ContentBrowserClient::ShouldReduceAcceptLanguage(
   return true;
 }
 
+bool ContentBrowserClient::IsClearWindowNameForNewBrowsingContextGroupAllowed(
+    content::BrowserContext* browser_context) {
+  return true;
+}
+
 bool ContentBrowserClient::UseOutermostMainFrameOrEmbedderForSubCaptureTargets()
     const {
   return false;
@@ -1943,12 +1973,6 @@ bool ContentBrowserClient::ShouldDispatchPagehideDuringCommit(
   return true;
 }
 
-std::unique_ptr<WebUIController> ContentBrowserClient::OverrideForInternalWebUI(
-    WebUI* web_ui,
-    const GURL& url) {
-  return nullptr;
-}
-
 std::optional<network::CrossOriginEmbedderPolicy>
 ContentBrowserClient::MaybeOverrideLocalURLCrossOriginEmbedderPolicy(
     content::NavigationHandle* navigation_handle) {
@@ -1965,6 +1989,10 @@ bool ContentBrowserClient::ShouldPrioritizeForBackForwardCache(
   return false;
 }
 
+bool ContentBrowserClient::IsRendererProcessPriorityEnabled() {
+  return true;
+}
+
 std::unique_ptr<KeepAliveRequestTracker>
 ContentBrowserClient::MaybeCreateKeepAliveRequestTracker(
     const network::ResourceRequest& request,

tools/under-control/src/gin/v8_initializer.cc

@@ -390,7 +390,7 @@ void SetFeatureFlags() {
                         features::kV8MemoryReducerGCCount.Get());
   }
   if (base::FeatureList::IsEnabled(features::kV8PreconfigureOldGen)) {
-    SetV8FlagsFormatted("--initial-old-space-size=%i",
+    SetV8FlagsFormatted("--preconfigured-old-space-size=%i",
                         features::kV8PreconfigureOldGenSize.Get());
   }
   SetV8FlagsIfOverridden(features::kV8IncrementalMarkingStartUserVisible,

tools/under-control/src/services/network/network_context.cc

@@ -29,7 +29,6 @@
 #include "base/memory/ref_counted.h"
 #include "base/memory/scoped_refptr.h"
 #include "base/metrics/histogram_functions.h"
-#include "base/not_fatal_until.h"
 #include "base/sequence_checker.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_util.h"
@@ -127,15 +126,14 @@
 #include "services/network/proxy_resolving_socket_factory_mojo.h"
 #include "services/network/public/cpp/cert_verifier/mojo_cert_verifier.h"
 #include "services/network/public/cpp/content_security_policy/content_security_policy.h"
-#include "services/network/public/cpp/features.h"
 #include "services/network/public/cpp/network_switches.h"
 #include "services/network/public/cpp/parsed_headers.h"
 #include "services/network/public/cpp/resource_request.h"
 #include "services/network/public/cpp/simple_host_resolver.h"
 #include "services/network/public/mojom/clear_data_filter.mojom.h"
+#include "services/network/public/mojom/connection_change_observer_client.mojom-forward.h"
 #include "services/network/public/mojom/cookie_encryption_provider.mojom.h"
 #include "services/network/public/mojom/network_context.mojom.h"
-#include "services/network/public/mojom/reconnect_event_observer.mojom-forward.h"
 #include "services/network/public/mojom/reporting_service.mojom.h"
 #include "services/network/public/mojom/trust_tokens.mojom-forward.h"
 #include "services/network/public/mojom/url_loader_factory.mojom.h"
@@ -147,6 +145,7 @@
 #include "services/network/shared_dictionary/shared_dictionary_constants.h"
 #include "services/network/shared_dictionary/shared_dictionary_manager.h"
 #include "services/network/shared_dictionary/shared_dictionary_storage.h"
+#include "services/network/shared_resource_checker.h"
 #include "services/network/ssl_config_service_mojo.h"
 #include "services/network/throttling/network_conditions.h"
 #include "services/network/throttling/throttling_controller.h"
@@ -746,6 +745,9 @@ NetworkContext::NetworkContext(
       base::BindRepeating(&NetworkContext::OnCookieManagerSettingsChanged,
                           weak_factory_.GetWeakPtr()));
 
+  shared_resource_checker_ = std::make_unique<SharedResourceChecker>(
+      cookie_manager_->cookie_settings());
+
   network_service_->RegisterNetworkContext(this);
 
   // Only register for destruction if |this| will be wholly lifetime-managed
@@ -849,6 +851,10 @@ NetworkContext::NetworkContext(
            net::handles::kInvalidNetworkHandle)),
       prefetch_cache_(prefetch_enabled_ ? std::make_unique<PrefetchCache>()
                                         : nullptr) {
+
+  shared_resource_checker_ = std::make_unique<SharedResourceChecker>(
+      cookie_manager_->cookie_settings());
+
   // May be nullptr in tests.
   if (network_service_) {
     network_service_->RegisterNetworkContext(this);
@@ -1059,7 +1065,7 @@ void NetworkContext::OnRCMDisconnect(
     const network::RestrictedCookieManager* rcm) {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   auto it = restricted_cookie_managers_.find(rcm);
-  CHECK(it != restricted_cookie_managers_.end(), base::NotFatalUntil::M130);
+  CHECK(it != restricted_cookie_managers_.end());
   restricted_cookie_managers_.erase(it);
 }
 
@@ -1208,10 +1214,16 @@ void NetworkContext::SetTrackingProtectionContentSetting(
 void NetworkContext::OnProxyLookupComplete(
     ProxyLookupRequest* proxy_lookup_request) {
   auto it = proxy_lookup_requests_.find(proxy_lookup_request);
-  CHECK(it != proxy_lookup_requests_.end(), base::NotFatalUntil::M130);
+  CHECK(it != proxy_lookup_requests_.end());
   proxy_lookup_requests_.erase(it);
 }
 
+void NetworkContext::SetTLS13EarlyDataEnabled(bool enabled) {
+  url_request_context_->http_transaction_factory()
+      ->GetSession()
+      ->SetTLS13EarlyDataEnabled(enabled);
+}
+
 void NetworkContext::DisableQuic() {
   url_request_context_->http_transaction_factory()->GetSession()->DisableQuic();
 }
@@ -1222,7 +1234,7 @@ void NetworkContext::DestroyURLLoaderFactory(
     return;
   }
   auto it = url_loader_factories_.find(url_loader_factory);
-  CHECK(it != url_loader_factories_.end(), base::NotFatalUntil::M130);
+  CHECK(it != url_loader_factories_.end());
   url_loader_factories_.erase(it);
 }
 
@@ -1239,7 +1251,7 @@ void NetworkContext::LoaderCreated(uint32_t process_id) {
 
 void NetworkContext::LoaderDestroyed(uint32_t process_id) {
   auto it = loader_count_per_process_.find(process_id);
-  CHECK(it != loader_count_per_process_.end(), base::NotFatalUntil::M130);
+  CHECK(it != loader_count_per_process_.end());
   it->second -= 1;
   if (it->second == 0) {
     loader_count_per_process_.erase(it);
@@ -2250,8 +2262,8 @@ void NetworkContext::PreconnectSockets(
     const net::NetworkAnonymizationKey& network_anonymization_key,
     const net::MutableNetworkTrafficAnnotationTag& traffic_annotation,
     const std::optional<net::ConnectionKeepAliveConfig>& keepalive_config,
-    mojo::PendingRemote<mojom::ReconnectEventObserver>
-        reconnect_event_observer) {
+    mojo::PendingRemote<mojom::ConnectionChangeObserverClient>
+        connection_change_observer_client) {
   DCHECK(!require_network_anonymization_key_ ||
          !network_anonymization_key.IsEmpty());
 
@@ -2282,14 +2294,15 @@ void NetworkContext::PreconnectSockets(
                                        user_agent);
   request_info.traffic_annotation = traffic_annotation;
 
-  if (keepalive_config.has_value() || reconnect_event_observer.is_valid()) {
+  if (keepalive_config.has_value() ||
+      connection_change_observer_client.is_valid()) {
     request_info.connection_management_config =
         net::ConnectionManagementConfig();
     request_info.connection_management_config->keep_alive_config =
         keepalive_config;
-    if (reconnect_event_observer.is_valid()) {
+    if (connection_change_observer_client.is_valid()) {
       auto change_observer = std::make_unique<ConnectionChangeObserver>(
-          std::move(reconnect_event_observer), this);
+          std::move(connection_change_observer_client), this);
 
       request_info.connection_management_config->connection_change_observer =
           change_observer.get();
@@ -2892,6 +2905,11 @@ URLRequestContextOwner NetworkContext::MakeURLRequestContext(
   }
 
   auto quic_context = std::make_unique<net::QuicContext>();
+  if (params_->quic_idle_connection_timeout_seconds &&
+      params_->quic_idle_connection_timeout_seconds.value() >= 0) {
+    quic_context->params()->idle_connection_timeout =
+        base::Seconds(params_->quic_idle_connection_timeout_seconds.value());
+  }
   network_session_configurator::ParseCommandLineAndFieldTrials(
       *base::CommandLine::ForCurrentProcess(), is_quic_force_disabled,
       &session_params, quic_context->params());
@@ -2913,8 +2931,7 @@ URLRequestContextOwner NetworkContext::MakeURLRequestContext(
 
   if (params_->shared_dictionary_enabled) {
     builder.set_enable_shared_dictionary(true);
-    builder.set_enable_shared_zstd(
-        base::FeatureList::IsEnabled(network::features::kSharedZstd));
+    builder.set_enable_shared_zstd(true);
   }
 
   builder.SetWrapHttpNetworkLayerCallback(
@@ -3089,7 +3106,7 @@ void NetworkContext::OnHttpCacheCleared(ClearHttpCacheCallback callback,
 
 void NetworkContext::OnHostResolverShutdown(HostResolver* resolver) {
   auto found_resolver = host_resolvers_.find(resolver);
-  CHECK(found_resolver != host_resolvers_.end(), base::NotFatalUntil::M130);
+  CHECK(found_resolver != host_resolvers_.end());
   host_resolvers_.erase(found_resolver);
 }
 
@@ -3151,7 +3168,7 @@ GURL NetworkContext::GetHSTSRedirectForPreconnect(const GURL& original_url) {
 #if BUILDFLAG(IS_P2P_ENABLED)
 void NetworkContext::DestroySocketManager(P2PSocketManager* socket_manager) {
   auto iter = socket_managers_.find(socket_manager);
-  CHECK(iter != socket_managers_.end(), base::NotFatalUntil::M130);
+  CHECK(iter != socket_managers_.end());
   socket_managers_.erase(iter);
 }
 #endif  // BUILDFLAG(IS_P2P_ENABLED)
@@ -3168,7 +3185,7 @@ void NetworkContext::CanUploadDomainReliability(
 
 void NetworkContext::OnVerifyCertComplete(uint64_t cert_verify_id, int result) {
   auto iter = cert_verifier_requests_.find(cert_verify_id);
-  CHECK(iter != cert_verifier_requests_.end(), base::NotFatalUntil::M130);
+  CHECK(iter != cert_verifier_requests_.end());
 
   auto pending_cert_verify = std::move(iter->second);
   cert_verifier_requests_.erase(iter);

tools/under-control/src/third_party/blink/public/mojom/use_counter/metrics/web_feature.mojom

@@ -3226,7 +3226,7 @@ enum WebFeature {
   kTapDelayEnabled = 3965,
   kV8URLPattern_CompareComponent_Method = 3966,
   kEarlyHintsPreload = 3967,
-  kClientHintsUAReduced = 3968,  //Removed in M116.
+  kOBSOLETE_ClientHintsUAReduced = 3968,  //Removed in M116.
   kSpeculationRulesPrerender = 3969,
   kOBSOLETE_ExecCommandWithTrustedTypes = 3970,
   kOBSOLETE_CSSSelectorPseudoHasInSnapshotProfile = 3971,
@@ -3410,7 +3410,7 @@ enum WebFeature {
   kFrameNameContainsBrace = 4146,
   kFrameNameContainsNewline = 4147,
   kAbortSignalThrowIfAborted = 4148,
-  kClientHintsUAFull = 4149,  // Removed in M116.
+  kOBSOLETE_ClientHintsUAFull = 4149,  // Removed in M116.
   kPrivateNetworkAccessWithinWorker = 4150,
   kClientHintsUAWoW64 = 4151,
   kFetchSetCookieInRequestGuardedHeaders = 4152,
@@ -4542,6 +4542,7 @@ enum WebFeature {
   kCanvasTextDirectionSet = 5238,
   kCanvasTextDirectionSetInherit = 5239,
   kTopicsAPIImg = 5240,
+  // The items above roughly this point are available in the M133 branch.
   kMediaSessionEnterPictureInPicture = 5241,
   kOBSOLETE_V8AILanguageDetector_Detect_Method = 5242,
   kCharsetAutoDetection = 5243,
@@ -4603,6 +4604,7 @@ enum WebFeature {
   kHTMLImageElementNaturalSizeDiffersForSvgImage = 5299,
   kWindowProxyIndexedGetter = 5300,
   kWindowProxyNamedGetter = 5301,
+  // The items above roughly this point are available in the M134 branch.
   kOBSOLETE_V8AILanguageModelFactory_Availability_Method = 5302,
   kOBSOLETE_V8AILanguageModelFactory_Params_Method = 5303,
   kOBSOLETE_V8AISummarizerFactory_Availability_Method = 5304,
@@ -4637,6 +4639,7 @@ enum WebFeature {
   kButtonTypeAttrInvalidWithCommandOrCommandfor = 5333,
   kCSSVarFallbackCycle = 5334,
   kCSSAttrFallbackCycle = 5335,
+  // The items above roughly this point are available in the M135 branch.
   kCSSRainbowGradientPattern = 5336,
   kWebAppManifestStartUrl = 5337,
   kWebAppManifestDisplay = 5338,
@@ -4765,6 +4768,7 @@ enum WebFeature {
   kLanguageDetector_ExpectedInputLanguages = 5461,
   kServiceWorkerPushEventListener = 5462,
   kServiceWorkerPushSubscriptionChangeEventListener = 5463,
+  // The items above roughly this point are available in the M136 branch.
   kMediaPlaybackWhileNotVisiblePermissionPolicy = 5464,
   kFirstLinePseudoElement = 5465,
   kFirstLetterPseudoElement = 5466,
@@ -4853,6 +4857,48 @@ enum WebFeature {
   kSelectMultipleShowPopup = 5549,
   kSharedWorkerExtendedLifetimeFeatureEnabled = 5550,
   kSharedWorkerExtendedLifetimeIsTrue = 5551,
+  // The items above roughly this point are available in the M137 branch.
+  kEditContextTextFormatUpdateAddListener = 5552,
+  kEditContextTextFormatUpdateFireEvent = 5553,
+  kEditContextTextFormatUpdateTextFormatThicknessOrStyleNotNone = 5554,
+  kC2PAManifest = 5555,
+  kLanguageModel_Append = 5556,
+  kIntegrityPolicyInServiceWorkerResponse = 5557,
+  kEditContextTextFormatUnderlineStyle = 5558,
+  kEditContextTextFormatUnderlineThickness = 5559,
+  kProofreader_IncludeCorrectionTypes = 5560,
+  kProofreader_IncludeCorrectionExplanations = 5561,
+  kProofreader_ExpectedInputLanguages = 5562,
+  kProofreader_CorrectionExplanationLanguage = 5563,
+  kProofreader_Destroy = 5564,
+  kProofreader_Proofread = 5565,
+  kProofreader_Availability = 5566,
+  kProofreader_Create = 5567,
+  kDataUrlDedicatedWorker = 5568,
+  kDataUrlSharedWorker = 5569,
+  kV8WebGLRenderingContextWebGPU_GetExtension_Method = 5570,
+  kV8WebGLRenderingContextWebGPU_GetSupportedExtensions_Method = 5571,
+  kV8WebGL2RenderingContextWebGPU_GetExtension_Method = 5572,
+  kV8WebGL2RenderingContextWebGPU_GetSupportedExtensions_Method = 5573,
+  kCredentialsGetImmediateMediationPasswordSuccess = 5574,
+  kCredentialsGetImmediateMediationPublicKeySuccess = 5575,
+  kCredentialsGetImmediateMediationFailure = 5576,
+  kClearSiteData = 5577,
+  kScrollIntoViewContainerNearest = 5578,
+  kPopoverShown = 5579,
+  kInputParsedParentOptionOrOptgroup = 5580,
+  kNavigatorUAData_toJSON = 5581,
+  kEditContextUpdateTextRangePrecedesOrOverlapsSelection = 5582,
+  kEditContextUpdateTextRangePrecedesCompositionRange = 5583,
+  kEditContextUpdateTextRangeOverlapsCompositionRange = 5584,
+  kEditContextUpdateSelectionDuringActiveComposition = 5585,
+  kClipboardChangeEventAddListener = 5586,
+  kClipboardChangeEventFired = 5587,
+  kClipboardChangeEventFiredAfterFocusGain = 5588,
+  kClipboardChangeEventTypesAttribute = 5589,
+  kSchedulerYieldNonTrivialInherit = 5590,
+  kSchedulerYieldNonTrivialInheritCrossFrameIgnored = 5591,
+  kLocalNetworkAccessPrivateAliasUse = 5592,
 
   // Add new features immediately above this line. Don't change assigned
   // numbers of any item, and don't reuse removed slots. Also don't add extra

tools/under-control/src/third_party/blink/public/mojom/webpreferences/web_preferences.mojom

@@ -141,7 +141,6 @@ struct WebPreferences {
   // 'Save-Data: on'.
   bool data_saver_enabled;
   bool local_storage_enabled;
-  bool databases_enabled;
   bool tabs_to_links;
   bool disable_ipc_flooding_protection;
   bool hyperlink_auditing_enabled;
@@ -195,6 +194,7 @@ struct WebPreferences {
   bool sync_xhr_in_documents_enabled;
   bool target_blank_implies_no_opener_enabled_will_be_removed;
   bool allow_non_empty_navigator_plugins;
+  bool ignore_permission_for_device_changed_event;
   int32 number_of_cpu_cores;
   EditingBehavior editing_behavior;
   bool supports_multiple_windows;
@@ -480,6 +480,11 @@ struct WebPreferences {
   // default value depends on the platform.
   bool touch_drag_drop_enabled;
 
+  // Whether the end of a drag fires a contextmenu event and possibly shows a
+  // context-menu (depends on how the event is handled). Follows
+  // `touch_drag_drop_enabled` in Windows.
+  bool touch_dragend_context_menu = false;
+
   // Controls whether WebXR's immersive-ar is allowed.
   bool webxr_immersive_ar_allowed;
 

tools/under-control/src/third_party/blink/renderer/core/css/css_view_transition_rule.idl

@@ -3,8 +3,7 @@
 // found in the LICENSE file.
 
 [
-  Exposed=Window,
-  RuntimeEnabled=ViewTransitionOnNavigation
+  Exposed=Window
 ] interface CSSViewTransitionRule : CSSRule {
   [SetterCallWith=ExecutionContext] readonly attribute CSSOMString navigation;
   [SameObject, SaveSameObject] readonly attribute FrozenArray<CSSOMString> types;

tools/under-control/src/third_party/blink/renderer/core/css/parser/media_query_parser.cc

@@ -4,6 +4,7 @@
 
 #include "third_party/blink/renderer/core/css/parser/media_query_parser.h"
 
+#include "third_party/blink/renderer/core/css/css_unparsed_declaration_value.h"
 #include "third_party/blink/renderer/core/css/media_feature_names.h"
 #include "third_party/blink/renderer/core/css/parser/css_parser_context.h"
 #include "third_party/blink/renderer/core/css/parser/css_tokenizer.h"
@@ -34,6 +35,8 @@ bool MediaQueryParser::MediaQueryFeatureSet::IsAllowed(
       feature == media_feature_names::kStuckMediaFeature ||
       feature == media_feature_names::kSnappedMediaFeature ||
       feature == media_feature_names::kScrollableMediaFeature ||
+      (feature == media_feature_names::kScrollDirectionMediaFeature &&
+       RuntimeEnabledFeatures::CSSScrollDirectionContainerQueriesEnabled()) ||
       CSSVariableParser::IsValidVariableName(feature)) {
     return false;
   }
@@ -203,6 +206,40 @@ bool IsGtGe(MediaQueryOperator op) {
   return op == MediaQueryOperator::kGt || op == MediaQueryOperator::kGe;
 }
 
+// Consume a MediaQueryExpValue without parsing against the feature grammar.
+// Only used for container style queries for range syntax.
+std::optional<MediaQueryExpValue> ConsumeUnparsed(
+    CSSParserTokenStream& stream,
+    const CSSParserContext& context) {
+  wtf_size_t start = stream.Offset();
+  // Skip until the first comparison delimiter.
+  while (!stream.AtEnd()) {
+    stream.SkipUntilPeekedTypeIs<kDelimiterToken>();
+    if (stream.AtEnd()) {
+      break;
+    }
+    if (IsComparisonDelimiter(stream.Peek().Delimiter())) {
+      break;
+    }
+    if (!stream.AtEnd()) {
+      stream.Consume();  // kDelimiterToken
+    }
+  }
+  wtf_size_t end = stream.Offset();
+  String value_string(stream.StringRangeAt(start, end - start).ToString());
+  if (value_string.empty()) {
+    return std::nullopt;
+  }
+
+  CSSVariableData* data =
+      CSSVariableData::Create(value_string, /* is_animation_tainted= */ false,
+                              /* is_attr_tainted= */ false,
+                              /*needs_variable_resolution=*/false);
+  const CSSValue* value =
+      MakeGarbageCollected<CSSUnparsedDeclarationValue>(data, &context);
+  return MediaQueryExpValue(*value);
+}
+
 }  // namespace
 
 MediaQuery::RestrictorType MediaQueryParser::ConsumeRestrictor(
@@ -286,6 +323,62 @@ AtomicString MediaQueryParser::ConsumeUnprefixedName(
   return name;
 }
 
+// <style-range> = <unparsed> <mf-comparison> <unparsed>
+//               | <unparsed> <mf-lt> <unparsed> <mf-lt> <unparsed>
+//               | <unparsed> <mf-gt> <unparsed> <mf-gt> <unparsed>
+//
+// Where <unparsed> is a <declaration-value> that does not allow
+// any of the delimiters accepted by <mf-lt> or <mf-gt>.
+const MediaQueryExpNode* MediaQueryParser::ConsumeStyleFeatureRange(
+    CSSParserTokenStream& stream) {
+  CSSParserTokenStream::State start = stream.Save();
+  std::optional<MediaQueryExpValue> value1 =
+      ConsumeUnparsed(stream, fake_context_);
+  if (!value1.has_value() || stream.AtEnd()) {
+    stream.Restore(start);
+    return nullptr;
+  }
+
+  MediaQueryOperator op1 = ConsumeComparison(stream);
+  if (op1 == MediaQueryOperator::kNone) {
+    stream.Restore(start);
+    return nullptr;
+  }
+
+  std::optional<MediaQueryExpValue> value2 =
+      ConsumeUnparsed(stream, fake_context_);
+  if (!value2.has_value()) {
+    stream.Restore(start);
+    return nullptr;
+  }
+
+  if (stream.AtEnd()) {
+    MediaQueryExpComparison left(*value1, op1);
+    MediaQueryExpComparison right;
+    return MakeGarbageCollected<MediaQueryFeatureExpNode>(MediaQueryExp::Create(
+        value2.value(), MediaQueryExpBounds(left, right)));
+  }
+
+  MediaQueryOperator op2 = ConsumeComparison(stream);
+  if (op2 == MediaQueryOperator::kNone ||
+      std::abs(static_cast<int>(op2) - static_cast<int>(op1)) > 1) {
+    stream.Restore(start);
+    return nullptr;
+  }
+
+  std::optional<MediaQueryExpValue> value3 =
+      ConsumeUnparsed(stream, fake_context_);
+  if (!value3.has_value() || !stream.AtEnd()) {
+    stream.Restore(start);
+    return nullptr;
+  }
+
+  MediaQueryExpComparison left(*value1, op1);
+  MediaQueryExpComparison right(*value3, op2);
+  return MakeGarbageCollected<MediaQueryFeatureExpNode>(
+      MediaQueryExp::Create(value2.value(), MediaQueryExpBounds(left, right)));
+}
+
 const MediaQueryExpNode* MediaQueryParser::ConsumeFeature(
     CSSParserTokenStream& stream,
     const FeatureSet& feature_set) {
@@ -322,6 +415,13 @@ const MediaQueryExpNode* MediaQueryParser::ConsumeFeature(
     stream.Restore(start);
   }
 
+  if (feature_set.SupportsStyleRange() &&
+      RuntimeEnabledFeatures::CSSContainerStyleQueriesRangeEnabled()) {
+    // A feature set must either support regular ranges *or* style ranges.
+    CHECK(!feature_set.SupportsRange());
+    return ConsumeStyleFeatureRange(stream);
+  }
+
   if (!feature_set.SupportsRange()) {
     return nullptr;
   }

tools/under-control/src/third_party/blink/renderer/core/dom/quota_exceeded_error.idl

@@ -0,0 +1,18 @@
+// Copyright 2025 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+dictionary QuotaExceededErrorOptions {
+    double quota;
+    double requested;
+};
+
+[
+    Exposed=*,
+    Serializable,
+    RuntimeEnabled=QuotaExceededErrorUpdate
+] interface QuotaExceededError : DOMException {
+    constructor(optional DOMString message = "", optional QuotaExceededErrorOptions options = {});
+    readonly attribute double? quota;
+    readonly attribute double? requested;
+};

tools/under-control/src/third_party/blink/renderer/core/editing/ime/text_format.idl

@@ -21,6 +21,6 @@ enum UnderlineThickness { "none", "thin", "thick" };
     // https://crbug.com/354497121 These should be UnderlineStyle and
     // UnderlineThickness enumerations but the values returned by the
     // implementation do not match what the IDL defines.
-    readonly attribute DOMString underlineStyle;
-    readonly attribute DOMString underlineThickness;
+    [MeasureAs=EditContextTextFormatUnderlineStyle] readonly attribute DOMString underlineStyle;
+    [MeasureAs=EditContextTextFormatUnderlineThickness] readonly attribute DOMString underlineThickness;
 };

tools/under-control/src/third_party/blink/renderer/core/events/event_type_names.json5

@@ -74,6 +74,7 @@
     "chargingtimechange",
     "checking",
     "click",
+    "clipboardchange",
     "close",
     "closing",
     "command",

tools/under-control/src/third_party/blink/renderer/core/events/promise_rejection_event.idl

@@ -8,6 +8,6 @@
     Exposed=(Window,Worker,ShadowRealm) // TODO(crbug.com/41480387): This should be Exposed=*
 ] interface PromiseRejectionEvent : Event {
     [CallWith=ScriptState] constructor(DOMString type, PromiseRejectionEventInit eventInitDict);
-    [CallWith=ScriptState] readonly attribute Promise<any> promise;
+    [CallWith=ScriptState] readonly attribute object promise;
     [CallWith=ScriptState] readonly attribute any reason;
 };

tools/under-control/src/third_party/blink/renderer/core/events/toggle_event.idl

@@ -8,4 +8,5 @@
     constructor(DOMString type, optional ToggleEventInit eventInitDict = {});
     readonly attribute DOMString oldState;
     readonly attribute DOMString newState;
+    [RuntimeEnabled=ToggleEventSource] readonly attribute Element source;
 };

tools/under-control/src/third_party/blink/renderer/core/exported/web_view_impl.cc

@@ -56,6 +56,7 @@
 #include "third_party/blink/public/common/page/page_zoom.h"
 #include "third_party/blink/public/common/renderer_preferences/renderer_preferences.h"
 #include "third_party/blink/public/common/switches.h"
+#include "third_party/blink/public/common/view_source/rendering_preferences.h"
 #include "third_party/blink/public/common/web_preferences/web_preferences.h"
 #include "third_party/blink/public/mojom/frame/frame_replication_state.mojom-blink.h"
 #include "third_party/blink/public/mojom/input/focus_type.mojom-blink.h"
@@ -506,7 +507,7 @@ WebView* WebView::Create(
     scheduler::WebAgentGroupScheduler& agent_group_scheduler,
     const SessionStorageNamespaceId& session_storage_namespace_id,
     std::optional<SkColor> page_base_background_color,
-    const BrowsingContextGroupInfo& browsing_context_group_info,
+    const base::UnguessableToken& browsing_context_group_token,
     const ColorProviderColorMaps* color_provider_colors,
     blink::mojom::PartitionedPopinParamsPtr partitioned_popin_params) {
   return WebViewImpl::Create(
@@ -516,7 +517,7 @@ WebView* WebView::Create(
       std::move(prerender_param), fenced_frame_mode, compositing_enabled,
       widgets_never_composited, To<WebViewImpl>(opener), std::move(page_handle),
       agent_group_scheduler, session_storage_namespace_id,
-      std::move(page_base_background_color), browsing_context_group_info,
+      std::move(page_base_background_color), browsing_context_group_token,
       color_provider_colors, std::move(partitioned_popin_params));
 }
 
@@ -533,7 +534,7 @@ WebViewImpl* WebViewImpl::Create(
     blink::scheduler::WebAgentGroupScheduler& agent_group_scheduler,
     const SessionStorageNamespaceId& session_storage_namespace_id,
     std::optional<SkColor> page_base_background_color,
-    const BrowsingContextGroupInfo& browsing_context_group_info,
+    const base::UnguessableToken& browsing_context_group_token,
     const ColorProviderColorMaps* color_provider_colors,
     blink::mojom::PartitionedPopinParamsPtr partitioned_popin_params) {
   return new WebViewImpl(
@@ -541,7 +542,7 @@ WebViewImpl* WebViewImpl::Create(
       compositing_enabled, widgets_never_composited, opener,
       std::move(page_handle), agent_group_scheduler,
       session_storage_namespace_id, std::move(page_base_background_color),
-      browsing_context_group_info, color_provider_colors,
+      browsing_context_group_token, color_provider_colors,
       std::move(partitioned_popin_params));
 }
 
@@ -605,7 +606,7 @@ WebViewImpl::WebViewImpl(
     blink::scheduler::WebAgentGroupScheduler& agent_group_scheduler,
     const SessionStorageNamespaceId& session_storage_namespace_id,
     std::optional<SkColor> page_base_background_color,
-    const BrowsingContextGroupInfo& browsing_context_group_info,
+    const base::UnguessableToken& browsing_context_group_token,
     const ColorProviderColorMaps* color_provider_colors,
     blink::mojom::PartitionedPopinParamsPtr partitioned_popin_params)
     : widgets_never_composited_(widgets_never_composited),
@@ -638,7 +639,7 @@ WebViewImpl::WebViewImpl(
   page_ = Page::CreateOrdinary(
       *chrome_client_, opener ? opener->GetPage() : nullptr,
       agent_group_scheduler.GetAgentGroupScheduler(),
-      browsing_context_group_info, color_provider_colors,
+      browsing_context_group_token, color_provider_colors,
       std::move(partitioned_popin_params));
   CoreInitializer::GetInstance().ProvideModulesToPage(
       *page_, session_storage_namespace_id_);
@@ -1591,6 +1592,8 @@ void WebView::ApplyWebPreferences(const web_pref::WebPreferences& prefs,
       prefs.target_blank_implies_no_opener_enabled_will_be_removed);
   settings->SetAllowNonEmptyNavigatorPlugins(
       prefs.allow_non_empty_navigator_plugins);
+  settings->SetIgnorePermissionForDeviceChangedEvent(
+      prefs.ignore_permission_for_device_changed_event);
   settings->SetShouldProtectAgainstIpcFlooding(
       !prefs.disable_ipc_flooding_protection);
   settings->SetHyperlinkAuditingEnabled(prefs.hyperlink_auditing_enabled);
@@ -2554,19 +2557,6 @@ void WebViewImpl::SetPageLifecycleStateInternal(
   if (restoring_from_bfcache) {
     DCHECK(dispatching_pageshow);
     DCHECK(page_restore_params);
-    // Increment the navigation counter on the main frame and all nested frames
-    // in its frame tree.
-    // Navigation Id increment should happen before a
-    // BackForwardCacheRestoration instance is created which happens inside the
-    // DispatchPageshow method.
-    for (Frame* frame = page->MainFrame(); frame;
-         frame = frame->Tree().TraverseNext()) {
-      auto* local_frame = DynamicTo<LocalFrame>(frame);
-      if (local_frame && local_frame->View()) {
-        DCHECK(local_frame->DomWindow());
-        local_frame->DomWindow()->GenerateNewNavigationId();
-      }
-    }
 
     DispatchPersistedPageshow(page_restore_params->navigation_start);
 
@@ -2718,7 +2708,7 @@ void WebViewImpl::DispatchPersistedPageshow(base::TimeTicks navigation_start) {
   for (Frame* frame = GetPage()->MainFrame(); frame;
        frame = frame->Tree().TraverseNext()) {
     auto* local_frame = DynamicTo<LocalFrame>(frame);
-    // Record the metics.
+    // Record the metrics.
     if (local_frame && local_frame->View()) {
       Document* document = local_frame->GetDocument();
       if (document) {
@@ -2735,9 +2725,20 @@ void WebViewImpl::DispatchPersistedPageshow(base::TimeTicks navigation_start) {
       auto pageshow_start_time = base::TimeTicks::Now();
       LocalDOMWindow* window = frame->DomWindow()->ToLocalDOMWindow();
 
+      // The new navigation ID must be generated before the
+      // back-forward-cache-restoration performance entry is added to the
+      // window's performance (see below), but also prior to dispatching the
+      // pageshow event, in case some of the event listeners want to use the
+      // new navigation ID to identify the navigation.
+      if (RuntimeEnabledFeatures::
+              BackForwardCacheRestorationPerformanceEntryEnabled(window)) {
+        window->GenerateNewNavigationId();
+      }
+
       window->DispatchPersistedPageshowEvent(navigation_start);
 
-      if (RuntimeEnabledFeatures::NavigationIdEnabled(window)) {
+      if (RuntimeEnabledFeatures::
+              BackForwardCacheRestorationPerformanceEntryEnabled(window)) {
         auto pageshow_end_time = base::TimeTicks::Now();
 
         WindowPerformance* performance =
@@ -3568,6 +3569,8 @@ void WebViewImpl::UpdateRendererPreferences(
 #endif
 
   CanvasNoiseToken::Set(renderer_preferences_.canvas_noise_token);
+  ViewSourceLineWrappingPreference::Set(
+      renderer_preferences_.view_source_line_wrap_enabled);
 
   MaybePreloadSystemFonts(GetPage());
 }
@@ -4143,6 +4146,7 @@ void WebViewImpl::CreateRemoteMainFrame(
     mojom::blink::FrameReplicationStatePtr replicated_state,
     bool is_loading,
     const base::UnguessableToken& devtools_frame_token,
+    const std::optional<base::UnguessableToken>& navigation_metrics_token,
     mojom::blink::RemoteFrameInterfacesFromBrowserPtr remote_frame_interfaces,
     mojom::blink::RemoteMainFrameInterfacesPtr remote_main_frame_interfaces) {
   blink::WebFrame* opener = nullptr;
@@ -4168,11 +4172,11 @@ scheduler::WebAgentGroupScheduler& WebViewImpl::GetWebAgentGroupScheduler() {
 }
 
 void WebViewImpl::UpdatePageBrowsingContextGroup(
-    const BrowsingContextGroupInfo& browsing_context_group_info) {
+    const base::UnguessableToken& browsing_context_group_token) {
   Page* page = GetPage();
   CHECK(page);
 
-  page->UpdateBrowsingContextGroup(browsing_context_group_info);
+  page->UpdateBrowsingContextGroup(browsing_context_group_token);
 }
 
 void WebViewImpl::SetPageAttributionSupport(

tools/under-control/src/third_party/blink/renderer/core/fetch/request.idl

@@ -36,7 +36,7 @@ enum RequestCache { "default", "no-store", "reload", "no-cache", "force-cache",
                     "only-if-cached" };
 enum FetchPriority {"low", "auto", "high"};
 enum RequestDuplex {"half"};
-enum IPAddressSpace {"local", "private", "public", "unknown"};
+enum IPAddressSpace {"loopback", "local", "private", "public", "unknown"};
 
 // https://w3c.github.io/webappsec-referrer-policy/#referrer-policies
 
@@ -70,7 +70,7 @@ enum ReferrerPolicy {
     readonly attribute boolean keepalive;
     readonly attribute AbortSignal signal;
     readonly attribute RequestDuplex duplex;
-    [RuntimeEnabled=PrivateNetworkAccessPermissionPrompt] readonly attribute IPAddressSpace targetAddressSpace;
+    [RuntimeEnabled=LocalNetworkAccessPermissionPolicy] readonly attribute IPAddressSpace targetAddressSpace;
 
     [MeasureAs=RequestIsHistoryNavigation] readonly attribute boolean isHistoryNavigation;
     [RaisesException, CallWith=ScriptState, NewObject] Request clone();

tools/under-control/src/third_party/blink/renderer/core/fetch/request_init.idl

@@ -27,12 +27,13 @@ dictionary RequestInit {
     [RuntimeEnabled=SharedStorageAPI, Exposed=Window] boolean sharedStorageWritable;
     AbortSignal? signal;
     [RuntimeEnabled=FetchUploadStreaming] RequestDuplex duplex;
-    [RuntimeEnabled=PrivateNetworkAccessPermissionPrompt] IPAddressSpace targetAddressSpace;
+    [RuntimeEnabled=LocalNetworkAccessPermissionPolicy] IPAddressSpace targetAddressSpace;
     // Even though Private Token and Attribution Reporting operations are only
     // available in secure contexts, this has to be enforced after the fact
     // because the SecureContext IDL attribute doesn't affect dictionary members.
     [RuntimeEnabled=PrivateStateTokens] PrivateToken privateToken;
     [RuntimeEnabled=AttributionReporting] AttributionReportingRequestOptions attributionReporting;
+    [RuntimeEnabled=FetchRetry] RetryOptions retryOptions;
     // TODO(domfarolino): add support for RequestInit window member.
     //any window; // can only be set to null
 };

tools/under-control/src/third_party/blink/renderer/core/fetch/retry_options.idl

@@ -0,0 +1,43 @@
+// Copyright 2025 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Explainer: https://github.com/explainers-by-googlers/fetch-retry.
+// Note: In the final form, we might remove some of these settings if e.g. we
+// ended up not having use cases for them / browser-controlled policies are
+// enough. We will re-evaluate them after origin trial.
+dictionary RetryOptions {
+  // Required: Maximum number of retry attempts after the initial one fails.
+  // A value of 0 means no retries beyond the initial attempt.
+  required unsigned long maxAttempts;
+
+  // Optional: Delay before the first retry attempt in milliseconds.
+  // Defaults to browser-configured value if not specified.
+  unsigned long? initialDelay;
+
+  // Optional: Multiplier for increasing delay between retries (e.g., 2.0 for exponential backoff).
+  // A factor of 1.0 means fixed delay. Defaults to browser-configured value if not specified.
+  double? backoffFactor;
+
+  // Optional: Maximum total time allowed for all retry attempts in milliseconds,
+  // measured from when the first attempt fails. If this duration is exceeded,
+  // no further retries will be made, even if maxAttempts has not been reached.
+  // Defaults to browser-configured value if not specified.
+  unsigned long? maxAge;
+
+  // Optional: Controls whether the browser should continue attempting retries
+  // even after the originating document has been unloaded.
+  // This requires `keepalive: true` to be set on the Request.
+  // Defaults to false.
+  boolean retryAfterUnload = false;
+
+  // Optional: Specifies whether to retry when the HTTP request method is
+  // non-idempotent (e.g. POST, PUT, DELETE). If this is not set while the HTTP
+  // request method of the fetch is non-idempotent, no retry will be attempted.
+  // Defaults to false.
+  boolean retryNonIdempotent = false;
+
+  // Optional: Specifies whether to retry when the network request is guaranteed
+  // to have not reach the server yet (e.g. a connection can't be established).
+  boolean retryOnlyIfServerUnreached = false;
+};

tools/under-control/src/third_party/blink/renderer/core/frame/integrity_violation_report_body.idl

@@ -0,0 +1,16 @@
+// Copyright 2025 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// https://www.w3.org/TR/CSP3/#cspviolationreportbody
+
+[
+    Exposed=Window,
+    RuntimeEnabled=IntegrityPolicyScript
+] interface IntegrityViolationReportBody : ReportBody {
+  readonly attribute USVString documentURL;
+  readonly attribute USVString? blockedURL;
+  readonly attribute USVString? destination;
+  readonly attribute boolean reportOnly;
+  [CallWith=ScriptState] object toJSON();
+};

tools/under-control/src/third_party/blink/renderer/core/frame/navigator_ua_data.idl

@@ -9,5 +9,5 @@
   [HighEntropy=Direct, MeasureAs=NavigatorUAData_Mobile]  readonly attribute boolean mobile;
   [HighEntropy=Direct, MeasureAs=NavigatorUAData_Platform] readonly attribute DOMString platform;
   [HighEntropy, CallWith=ScriptState, MeasureAs=NavigatorUAData_GetHighEntropyValues] Promise<UADataValues> getHighEntropyValues(sequence<DOMString> hints);
-  [HighEntropy, CallWith=ScriptState] object toJSON();
+  [HighEntropy, CallWith=ScriptState, MeasureAs=NavigatorUAData_toJSON] object toJSON();
 };

tools/under-control/src/third_party/blink/renderer/core/frame/scroll_into_view_options.idl

@@ -1,6 +1,8 @@
 enum ScrollLogicalPosition { "start", "center", "end", "nearest" };
+enum ScrollContainer { "all", "nearest" };
 
 dictionary ScrollIntoViewOptions : ScrollOptions {
     ScrollLogicalPosition block = "start";
     [ImplementedAs=inlinePosition] ScrollLogicalPosition inline = "nearest";
-};
+    [RuntimeEnabled=ScrollIntoViewNearest] ScrollContainer container = "all";
+};

tools/under-control/src/third_party/blink/renderer/core/frame/settings.json5

@@ -316,6 +316,10 @@
       name: "allowNonEmptyNavigatorPlugins",
       initial: false,
     },
+    {
+      name: "ignorePermissionForDeviceChangedEvent",
+      initial: false,
+    },
     {
       name: "cookieEnabled",
       initial: true,

tools/under-control/src/third_party/blink/renderer/core/html/canvas/high_dynamic_range_options.idl

@@ -23,6 +23,6 @@ dictionary CanvasSmpteSt2086Metadata {
 
 dictionary CanvasHighDynamicRangeOptions {
   CanvasHighDynamicRangeMode mode = "default";
-
+  DOMString? agtm;
   CanvasSmpteSt2086Metadata smpteSt2086Metadata;
 };

tools/under-control/src/third_party/blink/renderer/core/html/canvas/html_canvas_element.idl

@@ -36,6 +36,8 @@
     [RaisesException=Setter, CEReactions] attribute unsigned long width;
     [RaisesException=Setter, CEReactions] attribute unsigned long height;
 
+    [RuntimeEnabled=CanvasDrawElement] attribute boolean layoutSubtree;
+
     [HighEntropy, MeasureAs=CanvasToDataURL, RaisesException] DOMString toDataURL(optional DOMString type = "image/png", optional any quality);
 
     [HighEntropy, MeasureAs=CanvasToBlob, RaisesException] void toBlob(BlobCallback _callback, optional DOMString type = "image/png", optional any quality);

tools/under-control/src/third_party/blink/renderer/core/html/html_dialog_element.idl

@@ -34,5 +34,5 @@
     [CEReactions, Measure, RaisesException] void show();
     [CEReactions, Measure, RaisesException] void showModal();
     [CEReactions] void close(optional DOMString returnValue);
-    [CEReactions,RaisesException] void requestClose(optional DOMString returnValue);
+    [CEReactions,RaisesException,MeasureAs="WebDXFeature::kRequestclose"] void requestClose(optional DOMString returnValue);
 };

tools/under-control/src/third_party/blink/renderer/core/html/html_menu_bar_element.idl

@@ -0,0 +1,9 @@
+// Copyright 2025 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+[
+    Exposed=Window,
+    HTMLConstructor,
+    RuntimeEnabled=MenuElements
+] interface HTMLMenuBarElement : HTMLElement {};

tools/under-control/src/third_party/blink/renderer/core/html/html_menu_item_element.idl

@@ -0,0 +1,13 @@
+// Copyright 2025 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+[
+    Exposed=Window,
+    HTMLConstructor,
+    RuntimeEnabled=MenuElements
+] interface HTMLMenuItemElement : HTMLElement {
+    [CEReactions, Reflect] attribute boolean disabled;
+    [CEReactions, Reflect=checked] attribute boolean defaultChecked;
+    [ImplementedAs=Checked] attribute boolean checked;
+};

tools/under-control/src/third_party/blink/renderer/core/html/html_menu_list_element.idl

@@ -0,0 +1,9 @@
+// Copyright 2025 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+[
+    Exposed=Window,
+    HTMLConstructor,
+    RuntimeEnabled=MenuElements
+] interface HTMLMenuListElement : HTMLElement {};

tools/under-control/src/third_party/blink/renderer/core/origin_trials/origin_trial_context.cc

@@ -528,11 +528,6 @@ bool OriginTrialContext::CanEnableTrialFromName(const StringView& trial_name) {
         network::features::kInterestGroupStorage);
   }
 
-  if (trial_name == "SpeculationRulesPrefetchFuture") {
-    return base::FeatureList::IsEnabled(
-        features::kSpeculationRulesPrefetchFuture);
-  }
-
   if (trial_name == "BackForwardCacheSendNotRestoredReasons") {
     return base::FeatureList::IsEnabled(
         features::kBackForwardCacheSendNotRestoredReasons);
@@ -547,10 +542,6 @@ bool OriginTrialContext::CanEnableTrialFromName(const StringView& trial_name) {
     return base::FeatureList::IsEnabled(features::kSoftNavigationDetection);
   }
 
-  if (trial_name == "FoldableAPIs") {
-    return base::FeatureList::IsEnabled(features::kViewportSegments);
-  }
-
   if (trial_name == "PermissionElement") {
     return base::FeatureList::IsEnabled(blink::features::kPermissionElement);
   }
@@ -560,12 +551,16 @@ bool OriginTrialContext::CanEnableTrialFromName(const StringView& trial_name) {
     return base::FeatureList::IsEnabled(features::kAISummarizationAPI);
   }
 
-  if (trial_name == "LanguageDetectionAPI") {
-    return base::FeatureList::IsEnabled(features::kLanguageDetectionAPI);
+  if (trial_name == "AIRewriterAPI") {
+    return base::FeatureList::IsEnabled(features::kAIRewriterAPI);
   }
 
-  if (trial_name == "AIPromptAPIForExtension") {
-    return base::FeatureList::IsEnabled(features::kAIPromptAPIForExtension);
+  if (trial_name == "AIWriterAPI") {
+    return base::FeatureList::IsEnabled(features::kAIRewriterAPI);
+  }
+
+  if (trial_name == "LanguageDetectionAPI") {
+    return base::FeatureList::IsEnabled(features::kLanguageDetectionAPI);
   }
 
   if (trial_name == "SpeculationRulesTargetHint") {

tools/under-control/src/third_party/blink/renderer/core/scroll/snap_event.idl

@@ -6,6 +6,7 @@
     Exposed=Window,
     RuntimeEnabled=CSSScrollSnapEvents
 ] interface SnapEvent : Event {
+    [RuntimeEnabled=CSSScrollSnapEventConstructorExposed] constructor(DOMString type, optional SnapEventInit eventInitDict = {});
     readonly attribute Node snapTargetBlock;
     readonly attribute Node snapTargetInline;
 };

tools/under-control/src/third_party/blink/renderer/core/scroll/snap_event_init.idl

@@ -0,0 +1,10 @@
+// Copyright 2025 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// https://drafts.csswg.org/css-scroll-snap-2/#snapevent-interface
+
+dictionary SnapEventInit : EventInit {
+    Node? snapTargetBlock = null;
+    Node? snapTargetInline = null;
+};

tools/under-control/src/third_party/blink/renderer/core/timing/back_forward_cache_restoration.idl

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-[RuntimeEnabled=NavigationId,Exposed=Window]
+[RuntimeEnabled=BackForwardCacheRestorationPerformanceEntry,Exposed=Window]
 interface BackForwardCacheRestoration : PerformanceEntry {
     readonly attribute DOMHighResTimeStamp pageshowEventStart;
     readonly attribute DOMHighResTimeStamp pageshowEventEnd;

tools/under-control/src/third_party/blink/renderer/core/view_transition/page_reveal_event.idl

@@ -8,5 +8,5 @@
   RuntimeEnabled=PageRevealEvent
 ] interface PageRevealEvent : Event {
   constructor(DOMString type, optional PageRevealEventInit eventInitDict = {});
-  [RuntimeEnabled=ViewTransitionOnNavigation] readonly attribute ViewTransition? viewTransition;
+  readonly attribute ViewTransition? viewTransition;
 };

tools/under-control/src/third_party/blink/renderer/core/view_transition/page_swap_event.idl

@@ -8,6 +8,6 @@
   RuntimeEnabled=PageSwapEvent
 ] interface PageSwapEvent : Event {
   constructor(DOMString type, optional PageSwapEventInit eventInitDict = {});
-  [RuntimeEnabled=ViewTransitionOnNavigation] readonly attribute ViewTransition? viewTransition;
+  readonly attribute ViewTransition? viewTransition;
   readonly attribute NavigationActivation? activation;
 };

tools/under-control/src/third_party/blink/renderer/core/view_transition/view_transition.idl

@@ -33,4 +33,11 @@
   // for this transition. These types are selectable using the
   // :active-view-transition-type pseudo-class.
   readonly attribute ViewTransitionTypeSet types;
+
+  // This will return an Element that generated this transition.
+  // TODO(vmpstr): Note that for document transitions, this is the document
+  // element. We need to figure out if we need to distinguish between
+  // document.startViewTransition() and
+  // document.documentElement.startViewTransition().
+  [RuntimeEnabled=ScopedViewTransitions] readonly attribute Element transitionRoot;
 };

tools/under-control/src/third_party/blink/renderer/core/workers/worker_global_scope.idl

@@ -40,9 +40,7 @@
     // attribute EventHandler ononline;
 
     // https://html.spec.whatwg.org/C/#apis-available-to-workers
-    // Although RaisesException is not specified, importScripts() can actually
-    // throw exceptions directly to V8.
-    void importScripts(ScriptURLString... urls);
+    [RaisesException] void importScripts((USVString or TrustedScriptURL)... urls);
     readonly attribute WorkerNavigator navigator;
 
 

tools/under-control/src/third_party/blink/renderer/modules/ad_auction/auction_ad_config.idl

@@ -74,7 +74,7 @@ dictionary AuctionAdConfig {
   Promise<record<USVString, unsigned long long>?> perBuyerTimeouts;
   Promise<record<USVString, unsigned long long>?> perBuyerCumulativeTimeouts;
   [RuntimeEnabled=FledgeTrustedSignalsKVv2ContextualData]
-  record<USVString, any> perBuyerTKVSignals;
+  record<USVString, Promise<any>> perBuyerTKVSignals;
 
   unsigned long long reportingTimeout;
 
@@ -109,6 +109,8 @@ dictionary AuctionAdConfig {
   AuctionRealTimeReportingConfig sellerRealTimeReportingConfig;
   [RuntimeEnabled=FledgeRealTimeReporting]
   record<USVString, AuctionRealTimeReportingConfig> perBuyerRealTimeReportingConfig;
+  [RuntimeEnabled=FledgeSellerScriptExecutionMode]
+  DOMString executionMode;
 
   sequence<AuctionAdConfig> componentAuctions;
   AbortSignal? signal;

tools/under-control/src/third_party/blink/renderer/modules/ai/ai.idl

@@ -1,13 +0,0 @@
-// Copyright 2024 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// https://github.com/webmachinelearning/prompt-api
-
-// TODO(crbug.com/381969447): remove this and use AIInterfaceProxy
-// for LanguageModel instead.
-[
-  Exposed(Window AIPromptAPI, Worker AIPromptAPIForWorkers),
-  SecureContext
-]
-interface AI {};

tools/under-control/src/third_party/blink/renderer/modules/ai/language_model.idl

@@ -13,8 +13,13 @@ dictionary LanguageModelPromptOptions {
   AbortSignal signal;
 };
 
+dictionary LanguageModelAppendOptions {
+  AbortSignal signal;
+};
+
 [
   Exposed(Window AIPromptAPI, Worker AIPromptAPIForWorkers),
+  RuntimeEnabled=AIPromptAPI,
   SecureContext
 ]
 interface LanguageModel : EventTarget {
@@ -46,7 +51,7 @@ interface LanguageModel : EventTarget {
     RaisesException
   ]
   Promise<DOMString> prompt(
-    LanguageModelPromptInput input,
+    LanguageModelPrompt input,
     optional LanguageModelPromptOptions options = {}
   );
   [
@@ -55,9 +60,18 @@ interface LanguageModel : EventTarget {
     RaisesException
   ]
   ReadableStream promptStreaming(
-    LanguageModelPromptInput input,
+    LanguageModelPrompt input,
     optional LanguageModelPromptOptions options = {}
   );
+  [
+    MeasureAs=LanguageModel_Append,
+    CallWith=ScriptState,
+    RaisesException
+  ]
+  Promise<undefined> append(
+    LanguageModelPrompt input,
+    optional LanguageModelAppendOptions options = {}
+  );
 
   [
     MeasureAs=LanguageModel_MeasureInputUsage,
@@ -65,7 +79,7 @@ interface LanguageModel : EventTarget {
     RaisesException
   ]
   Promise<double> measureInputUsage(
-    LanguageModelPromptInput input,
+    LanguageModelPrompt input,
     optional LanguageModelPromptOptions options = {}
   );
 

tools/under-control/src/third_party/blink/renderer/modules/ai/language_model_create_options.idl

@@ -5,24 +5,27 @@
 // https://github.com/webmachinelearning/prompt-api
 
 // The argument to the prompt() method and others like it
-typedef (LanguageModelPrompt or sequence<LanguageModelPrompt>) LanguageModelPromptInput;
-
-// Prompt lines
 typedef (
-  DOMString                   // interpreted as { role: "user", type: "text", content: providedValue }
-  or LanguageModelPromptDict  // canonical form
+  sequence<LanguageModelMessage>
+  // Shorthand for `[{ role: "user", content: [{ type: "text", value: providedValue }] }]`
+  or DOMString
 ) LanguageModelPrompt;
 
-// Prompt content inside the lines
-dictionary LanguageModelPromptDict {
-  LanguageModelPromptRole role = "user";
-  LanguageModelPromptType type = "text";
-  required LanguageModelPromptContent content;
+dictionary LanguageModelMessage {
+  required LanguageModelMessageRole role;
+
+  // The DOMString branch is shorthand for `[{ type: "text", value: providedValue }]`
+  required (DOMString or sequence<LanguageModelMessageContent>) content;
 };
 
-enum LanguageModelPromptRole { "system", "user", "assistant" };
+dictionary LanguageModelMessageContent {
+  required LanguageModelMessageType type;
+  required LanguageModelMessageValue value;
+};
 
-enum LanguageModelPromptType { "text", "image", "audio" };
+enum LanguageModelMessageRole { "system", "user", "assistant" };
+
+enum LanguageModelMessageType { "text", "image", "audio" };
 
 typedef (
   ImageBitmapSource
@@ -30,7 +33,7 @@ typedef (
   or HTMLAudioElement
   or BufferSource
   or DOMString
-) LanguageModelPromptContent;
+) LanguageModelMessageValue;
 
 dictionary LanguageModelCreateCoreOptions {
   // Note: these two have custom out-of-range handling behavior, not in the IDL layer.
@@ -38,18 +41,23 @@ dictionary LanguageModelCreateCoreOptions {
   unrestricted double topK;
   unrestricted double temperature;
 
-  // The expected input types and languages for the session.
-  sequence<LanguageModelExpectedInput> expectedInputs;
+  // The expected types and languages for the session.
+  sequence<LanguageModelExpected> expectedInputs;
+  sequence<LanguageModelExpected> expectedOutputs;
 };
 
 dictionary LanguageModelCreateOptions : LanguageModelCreateCoreOptions {
   AbortSignal signal;
   CreateMonitorCallback monitor;
+
+  sequence<LanguageModelMessage> initialPrompts;
+
+  // DEPRECATED: Use `initialPrompts: [{role: 'system', content: ... }, ...]`.
+  // TODO(crbug.com/381974893): Remove this along with the console warning.
   DOMString systemPrompt;
-  sequence<LanguageModelPrompt> initialPrompts;
 };
 
-dictionary LanguageModelExpectedInput {
-  required LanguageModelPromptType type;
+dictionary LanguageModelExpected {
+  required LanguageModelMessageType type;
   sequence<DOMString> languages;
 };

tools/under-control/src/third_party/blink/renderer/modules/ai/language_model_factory.idl

@@ -1,37 +0,0 @@
-// Copyright 2025 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// https://github.com/webmachinelearning/prompt-api
-
-// The `LanguageModelFactory` is no longer needed from the web platform JS API,
-// but we need to keep this IDL for the extension API.
-
-[
-  Exposed(Window AIPromptAPI, Worker AIPromptAPIForWorkers),
-  SecureContext
-]
-interface LanguageModelFactory {
-  [
-    MeasureAs=LanguageModel_Create,
-    CallWith=ScriptState,
-    RaisesException
-  ]
-  Promise<LanguageModel> create(
-    optional LanguageModelCreateOptions options = {}
-  );
-  [
-    MeasureAs=LanguageModel_Availability,
-    CallWith=ScriptState,
-    RaisesException
-  ]
-  Promise<Availability> availability(
-    optional LanguageModelCreateCoreOptions options = {}
-  );
-  [
-    MeasureAs=LanguageModel_Params,
-    CallWith=ScriptState,
-    RaisesException
-  ]
-  Promise<LanguageModelParams?> params();
-};

tools/under-control/src/third_party/blink/renderer/modules/ai/language_model_params.idl

@@ -6,6 +6,7 @@
 
 [
   Exposed(Window AIPromptAPI, Worker AIPromptAPIForWorkers),
+  RuntimeEnabled=AIPromptAPI,
   SecureContext
 ]
 interface LanguageModelParams {

tools/under-control/src/third_party/blink/renderer/modules/ai/proofreader.idl

@@ -0,0 +1,91 @@
+// Copyright 2025 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// https://github.com/explainers-by-googlers/proofreader-api
+
+enum CorrectionType {
+  "spelling", // Misspelled words, i.e. typos.
+  "punctuation", // Incorrect or missing punctuation marks.
+  "capitalization", // Incorrect upper/lowercase letters.
+  "preposition", // Errors in the use of prepositions.
+  "missing-words", // One or more words are absent from a sentence,
+                   // making it grammatically incorrect or altering
+                   // its intended meaning.
+  "grammar" // Broad and catch-all category, if no more-specific category
+            // matches. Encompassing sentence errors in structure
+            // errors, word order, subject-verb agreement, etc.
+};
+
+dictionary ProofreaderCreateCoreOptions {
+  boolean includeCorrectionTypes = false;
+  boolean includeCorrectionExplanations = false;
+  sequence<DOMString> expectedInputLanguages;
+  DOMString correctionExplanationLanguage;
+};
+
+dictionary ProofreaderCreateOptions : ProofreaderCreateCoreOptions {
+  AbortSignal signal;
+  CreateMonitorCallback monitor;
+};
+
+dictionary ProofreadResult {
+  DOMString correctedInput;
+  sequence<ProofreadCorrection> corrections;
+};
+
+dictionary ProofreadCorrection {
+  unsigned long long startIndex;
+  unsigned long long endIndex;
+  DOMString correction;
+  CorrectionType type;
+  DOMString explanation;
+};
+
+[
+  Exposed=(Window,Worker),
+  RuntimeEnabled=AIProofreadingAPI,
+  SecureContext
+]
+interface Proofreader {
+  [
+    MeasureAs=Proofreader_Availability,
+    CallWith=ScriptState,
+    RaisesException
+  ]
+  static Promise<Availability> availability(
+    optional ProofreaderCreateCoreOptions options = {}
+  );
+
+  [
+    MeasureAs=Proofreader_Create,
+    CallWith=ScriptState,
+    RaisesException
+  ]
+  static Promise<Proofreader> create(optional ProofreaderCreateOptions options = {});
+
+  [
+    MeasureAs=Proofreader_Proofread,
+    CallWith=ScriptState,
+    RaisesException
+  ]
+  Promise<ProofreadResult> proofread(
+    DOMString input
+  );
+
+  [
+    MeasureAs=Proofreader_Destroy,
+    CallWith=ScriptState,
+    RaisesException
+  ]
+  void destroy();
+
+  [MeasureAs=Proofreader_IncludeCorrectionTypes]
+  readonly attribute boolean includeCorrectionTypes;
+  [MeasureAs=Proofreader_IncludeCorrectionExplanations]
+  readonly attribute boolean includeCorrectionExplanations;
+  [MeasureAs=Proofreader_ExpectedInputLanguages]
+  readonly attribute FrozenArray<DOMString>? expectedInputLanguages;
+  [MeasureAs=Proofreader_CorrectionExplanationLanguage]
+  readonly attribute DOMString? correctionExplanationLanguage;
+};

tools/under-control/src/third_party/blink/renderer/modules/ai/summarizer.idl

@@ -4,7 +4,7 @@
 
 // https://github.com/WICG/writing-assistance-apis
 
-enum SummarizerType { "tl;dr", "key-points", "teaser", "headline" };
+enum SummarizerType { "tldr", "key-points", "teaser", "headline" };
 enum SummarizerFormat { "plain-text", "markdown" };
 enum SummarizerLength { "short", "medium", "long" };
 

tools/under-control/src/third_party/blink/renderer/modules/ai/window_or_worker_global_scope_ai.idl

@@ -1,16 +0,0 @@
-// Copyright 2024 The Chromium Authors
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// https://github.com/webmachinelearning/prompt-api
-
-[
-    Exposed=(Window,Worker),
-    ImplementedAs=DOMAI,
-    RuntimeEnabled=BuiltInAIAPI
-] partial interface mixin WindowOrWorkerGlobalScope {
-    [
-      Replaceable, SecureContext
-    ]
-    readonly attribute AI ai;
-};

tools/under-control/src/third_party/blink/renderer/modules/canvas/canvas2d/canvas_rendering_context_2d.idl

@@ -54,9 +54,12 @@ interface CanvasRenderingContext2D {
     void drawFocusIfNeeded(Element element);
     void drawFocusIfNeeded(Path2D path, Element element);
 
-    // placeElement: https://github.com/Igalia/explainers/blob/main/canvas-formatted-text/html-in-canvas.md
-    [RuntimeEnabled=CanvasPlaceElement, RaisesException] void placeElement(Element element, unrestricted double x,
-                                        unrestricted double y);
+    [RuntimeEnabled=CanvasDrawElement, RaisesException]
+    void drawElement(Element element, unrestricted double x, unrestricted double y);
+
+    [RuntimeEnabled=CanvasDrawElement, RaisesException]
+    void drawElement(Element element, unrestricted double x, unrestricted double y,
+                     unrestricted double dwidth, unrestricted double dheight);
 
     [MeasureAs=GetCanvas2DContextAttributes] CanvasRenderingContext2DSettings getContextAttributes();
 };

tools/under-control/src/third_party/blink/renderer/modules/canvas/htmlcanvas/html_canvas_element_module.idl

@@ -7,6 +7,8 @@
 typedef (CanvasRenderingContext2D or
          WebGLRenderingContext or
          WebGL2RenderingContext or
+         WebGLRenderingContextWebGPU or
+         WebGL2RenderingContextWebGPU or
          ImageBitmapRenderingContext or
          GPUCanvasContext) RenderingContext;
 

tools/under-control/src/third_party/blink/renderer/modules/canvas/offscreencanvas/offscreen_canvas_module.idl

@@ -7,6 +7,8 @@
 typedef (OffscreenCanvasRenderingContext2D or
          WebGLRenderingContext or
          WebGL2RenderingContext or
+         WebGLRenderingContextWebGPU or
+         WebGL2RenderingContextWebGPU or
          ImageBitmapRenderingContext or
          GPUCanvasContext) OffscreenRenderingContext;
 enum OffscreenRenderingContextType { "2d", "webgl", "webgl2", "bitmaprenderer", "webgpu" };

tools/under-control/src/third_party/blink/renderer/modules/clipboard/clipboard.idl

@@ -37,4 +37,6 @@ dictionary ClipboardUnsanitizedFormats {
      CallWith=ScriptState,
      RaisesException
     ] Promise<undefined> writeText(DOMString data);
+
+    [RuntimeEnabled=ClipboardChangeEvent] attribute EventHandler onclipboardchange;
 };

tools/under-control/src/third_party/blink/renderer/modules/clipboard/clipboard_change_event.idl

@@ -0,0 +1,27 @@
+/*
+ * Copyright (C) 2025 Microsoft Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+[
+    Exposed=Window,
+    SecureContext,
+    RuntimeEnabled=ClipboardChangeEvent
+] interface ClipboardChangeEvent : Event {
+    constructor(optional ClipboardChangeEventInit eventInitDict = {});
+    [MeasureAs=ClipboardChangeEventTypesAttribute] readonly attribute FrozenArray<DOMString> types;
+};