Do not clear the application bottom inset when the virtual keyboard uses
OVERLAYS_CONTENT.
The bottom-toolbar workaround is only required for keyboard modes that
resize Chromium content. Overlay mode owns its keyboard geometry and the
protected keyboard implementation needs the original inset to track the
IME transition consistently.
Keep the existing inset suppression for all non-overlay keyboard modes.
Test: Verified on Android with the bottom toolbar enabled across keyboard
open and close transitions.
Bucket the physical device pixel ratio to the nearest 0.5 while viewport
emulation is active and retain the selected value for the Page lifetime.
Expose the same protected DPR through window.devicePixelRatio and CSS
resolution media queries. This prevents the physical value from leaking
through either API and avoids inconsistencies between JavaScript and CSS.
Include the viewport-emulation scale when converting the virtual keyboard
overlay rectangle, keeping its geometry in the same emulated coordinate
space.
Test: Verified on Android that a physical DPR of 3.8 is exposed as 4
through window.devicePixelRatio and resolution media queries.
Normalize pointer type, hover capability, and maximum touch points to common
profiles instead of exposing the exact input hardware configuration.
This avoids exposing differences between devices with similar usage patterns,
such as desktop systems with optional touchscreen hardware.
Canvas readbacks smaller than 8x8 can still expose deterministic rendering
differences. Apply the canvas fingerprinting mitigation to those surfaces as
well, while bounding pixel selection to the SkPixmap dimensions to avoid
out-of-range coordinates.
Fixes a destructive conflict between the 60Hz anti-fingerprinting
snapping logic (kThrottleMainFrameTo60Hz) and the native
kOnBeginFrameThrottleVideo feature when hardware VSync is disabled.
The artificial timestamp snapping introduced by the anti-fingerprinting
patch tricks the viz video throttling heuristics into thinking the
playback is unstable, forcing the compositor to drop BeginFrame
intervals to 30Hz (33.3ms). This leads to false lost frames and severe
stuttering in the media pipeline. Disabling kOnBeginFrameThrottleVideo
restores the continuous 60Hz rhythm.
Fix a Null Pointer Dereference crash in `GetInsecureTopLevelSite()`
affecting sites with heavy Service Worker usage (e.g., Discord, Reddit).
This rewrite also hardens our custom `Partition-blobs-by-top-frame-URL`
logic against upstream cross-partition token leak vectors.
In `public_url_manager.cc`, the custom helper was passing the result of
`worker_global_scope->top_level_frame_security_origin()` straight into the
`BlinkSchemefulSite` constructor. However, this property is intentionally
null for Service Workers, causing a fatal null pointer dereference crash.
Additionally, since Cromite's partition checks execute downstream from
vanilla Chromium's native mitigations, the browser-side fallback using
`agent_cluster_id` inside `IsSamePartition()` was redundant dead code.
Changes:
1. Blink: Fully rewrote `GetInsecureTopLevelSite()` using safe `DynamicTo`
casts. For Service Workers, it now safely pulls the browser-validated
partition directly via `service_worker->storage_key().top_level_site()`,
eliminating the null pointer crash surface.
2. Blink / Hardening: Intentionally excluded Shared Workers from Blob URL
support (`IsSharedWorkerGlobalScope()`) by returning `std::nullopt` to prevent
unpartitioned fallback vectors in shared contexts.
3. Storage: Streamlined `IsSamePartition()` in `blob_url_store_impl.cc`
by removing the obsolete `agent_cluster_id` fallback, leaving a clean,
deterministic verification of the top-level site partition.
Carmelo Messina
uazoandGitHub
