Patches for 134.0.6998.178

.gitattributes

@@ -1,2 +1 @@
-*.zip binary
-*.pdf binary
+*.zip binary

.github/workflows/build_cromite.yaml

@@ -182,9 +182,9 @@ jobs:
         KYTHE_ROOT_DIRECTORY: /home/lg/working_dir/chromium/src
         KYTHE_OUTPUT_DIRECTORY: /home/lg/working_dir/chromium/src/out/arm64/kythe
         # cross build
-        DEPOT_TOOLS_WIN_TOOLCHAIN_BASE_URL: /win_sdk/sdks/Win11SDK_10.0.26100.0/
-        WINDOWSSDKDIR: "/win_sdk/sdks/Win11SDK_10.0.26100.0/Windows Kits/10/"
-        GYP_MSVS_OVERRIDE_PATH: /win_sdk/sdks/Win11SDK_10.0.26100.0/
+        DEPOT_TOOLS_WIN_TOOLCHAIN_BASE_URL: /win_sdk/sdks/Win11SDK_10.0.22621.2428/
+        WINDOWSSDKDIR: "/win_sdk/sdks/Win11SDK_10.0.22621.2428/Windows Kits/10/"
+        GYP_MSVS_OVERRIDE_PATH: /win_sdk/sdks/Win11SDK_10.0.22621.2428/
         # compile in debug mode
         TARGET_ISDEBUG: ${{ github.event.inputs.debug }}
         TARGET_OS: ${{ github.event.inputs.target_os }}
@@ -250,9 +250,6 @@ jobs:
           gpg --homedir ./ -d --passphrase "${{ secrets.KEYSTORE_PASSPHRASE }}" --batch cromite.keystore.asc > cromite.keystore
           echo "::endgroup::"
 
-          # bootstrap python3 for gn
-          echo ../../../../../usr/bin >$WORKSPACE/depot_tools/python3_bin_reldir.txt
-
       - name: Build Cromite Android x64
         if: ${{ (github.event.inputs.target_os == 'android' || github.event.inputs.target_os == 'all') && (github.event.inputs.build == 'x64' || github.event.inputs.build == 'all') }}
         shell: bash
@@ -434,5 +431,5 @@ jobs:
             gn gen --args="import(\"/home/lg/working_dir/cromite/build/cromite.gn_args\") $(cat ../../build_args.gni) skip_clangd_unsupported_options = true" out/clangd && \
             $WORKSPACE/ninja/ninja -C $WORKSPACE/chromium/src/out/clangd -a chrome_public_apk \
               -t compdb cc cxx objc objcxx >$WORKSPACE/chromium/src/out/clangd/compile_commands.json && \
-            /home/lg/working_dir/clangd_snapshot_20250518/bin/clangd-indexer --executor=all-TUs out/clangd/compile_commands.json >out/arm64/cromite.idx && \
+            /home/lg/working_dir/clangd_snapshot_20211205/bin/clangd-indexer --executor=all-TUs out/clangd/compile_commands.json >out/arm64/cromite.idx && \
             rm -rf out/clangd

.github/workflows/check_nist.yaml

@@ -1,6 +1,9 @@
 name: 'Check NIST database'
 
 on:
+  schedule:
+    - cron: '30 1 * * *'
+
   workflow_dispatch:
 
 permissions:

.github/workflows/update_fdroid_repo.yaml

@@ -2,11 +2,6 @@ name: Update fdroid repo
 
 on:
   workflow_dispatch:
-    inputs:
-      type:
-        description: 'runner? [dev/ci]'
-        required: true
-        default: 'ci'
 
 env:
   REMOVEDOCKERSUPPORT: true
@@ -15,7 +10,7 @@ env:
 
 jobs:
   update-fdroid:
-    runs-on: ${{ github.event.inputs.type }}
+    runs-on: ci2
 
     container:
       image: uazo/fdroidserver:latest

README.md

@@ -14,7 +14,7 @@
 
 Cromite is a [Chromium](https://www.chromium.org/Home) fork based on [Bromite](https://github.com/bromite/bromite) with built-in support for ad blocking and an eye for privacy.
 
-Cromite is available for Android arm64-v8a, arm32-v7a and x86_64, Android 10 and above, Windows and Linux 64bit.
+Cromite is available for Android arm64-v8a, arm32-v7a and x86_64, Oreo and above (Minimum v8.0, API level 26), Windows and Linux 64bit.
 
 # Goals
 
@@ -106,7 +106,7 @@ ChromiumUpdateUrl=https://github.com/uazo/cromite/releases/latest/download/updat
 # Command line for Chromium (string):
 # note --user-data-dir= works better if path is absolute
 # See here: http://peter.sh/experiments/chromium-command-line-switches/
-ChromiumCommandLine=--user-data-dir="%LOCALAPPDATA%\Cromite\User Data" --no-default-browser-check
+ChromiumCommandLine=--user-data-dir="C:\Users\<my user>\AppData\Local\Cromite\User Data" --no-default-browser-check
 
 # to enable full logging in c:\temp\log.txt (daily rotate, no automatic deletion)
 # ChromiumCommandLine=--enable-logging --v=0 --log-file=C:\temp\log.txt --user-data-dir=".\User Data" --no-default-browser-check
@@ -185,14 +185,7 @@ thanks to [austinhuang0131](https://github.com/austinhuang0131) for the svg icon
 
 # Donate
 
-If you want, you can donate to support cromite development through [paypal](https://www.paypal.com/pools/c/9e5lO2OIzb).
-
-Current link:
-- https://www.paypal.com/pools/c/9hEHZ6tElk
-
-Historical fundraisings links:
-- https://www.paypal.com/pools/c/9cwNgAQhRL
-- https://www.paypal.com/pools/c/9e5lO2OIzb
+If you want, you can donate to support cromite development through [paypal](https://www.paypal.com/pools/c/9cwNgAQhRL).
 
 # License
 

build/RELEASE

@@ -1 +1 @@
-140.0.7339.128
+134.0.6998.178

build/components/query4_0.json

@@ -1,32 +0,0 @@
-)]}' {
-	"response": {
-		"server": "prod",
-		"protocol": "4.0",
-		"apps": [
-			{
-				"appid": "gcmjkmgdlgnkkcocmoeiminaijmmjnii",
-				"status": "ok",
-				"updatecheck": {
-					"status": "ok",
-					"nextversion": "1.0.0",
-					"pipelines": [
-						{
-							"operations": [
-								{
-									"type": "download",
-									"urls": [ { "url": "https://www.cromite.org/components/fonts_component.zip" } ],
-									"out": { "sha256": "22639FA1B21D9D95E6343A6A58028B224903D23BA404537584A22236FCFC3482" },
-									"size": 60716451
-								},
-								{
-									"type": "crx3",
-									"in": { "sha256": "22639FA1B21D9D95E6343A6A58028B224903D23BA404537584A22236FCFC3482" }
-								}
-							]
-						}
-					]
-				}
-			}
-		]
-	}
-}

build/cromite.gn_args

@@ -4,7 +4,10 @@ build_contextual_search=false
 build_with_tflite_lib=false
 chrome_pgo_phase=0
 dcheck_always_on=false
+dfmify_dev_ui=false
+disable_android_lint=true
 disable_fieldtrial_testing_config=true
+enable_gvr_services=false
 enable_hangout_services_extension=false
 enable_iterator_debugging=false
 enable_mdns=false
@@ -67,10 +70,17 @@ if (target_os == "android" || target_os == "win") {
 enable_platform_dts_audio = false
 enable_passthrough_audio_codecs = false
 
+# Do not compile libmonochrome.so with RELR relocations
+# since supported only on API 28+
+use_relr_relocations=false
+
 # disabled the use of the context snapshot
 # see https://github.com/uazo/cromite/pull/317 for context
 use_v8_context_snapshot = false
 
+# enable libjxl support by default
+enable_jxl_decoder = false
+
 # disable minikin engine
 # see https://github.com/uazo/cromite/issues/697
 use_minikin_hyphenation = false
@@ -79,6 +89,9 @@ use_minikin_hyphenation = false
 # initial commit: https://source.chromium.org/chromium/chromium/src/+/fd9a841f7a63b9f5510f6b713d9c833d259c63ad
 enable_bound_session_credentials = false
 
+# Use LogErrorNotReached() for NOTREACHED_IN_MIGRATION() 
+enable_log_error_not_reached = true
+
 # Allows building without //third_party/unrar included, for license reasons
 safe_browsing_use_unrar = false
 
@@ -106,9 +119,6 @@ if (target_os == "android") {
 
   chrome_pgo_phase = 2 # enable pgo
 
-  # do not split Developer UI split into a separate Dynamic Feature Module
-  dfmify_dev_ui = false
-
   if (getenv("USE_KEYSTORE") != "") {
     android_keystore_path = "/home/lg/working_dir/cromite.keystore"
     android_keystore_name = "cromite"
@@ -116,8 +126,6 @@ if (target_os == "android") {
   }
 
   cromite_pref_hash_seed_bin = getenv("CROMITE_PREF_HASH_SEED_BIN")
-  
-  disable_android_lint = true
 
   _is_debug_build = getenv("TARGET_ISDEBUG")
   if (_is_debug_build == "true") {
@@ -128,17 +136,7 @@ if (target_os == "android") {
     symbol_level = 1
     strip_debug_info = false
     generate_linker_map = false
-
-    # Disable static analysis
-    android_static_analysis = "off"
-
-    # Turns off all V8 debug features. Disables running V8 in a pseudo debug mode
-    # bypass build error -5 in clang_x64/mksnapshot
-    v8_enable_debugging_features = false
-    v8_dcheck_always_on = false
   } else {
-    include_both_v8_snapshots = false
-    include_both_v8_snapshots_android_secondary_abi = false
     generate_linker_map = true
   }
 

build/cromite_patches_list.txt

@@ -2,11 +2,9 @@ Do-not-link-with-libatomic.patch
 Do-not-check-for-the-presence-of-use-remoteexec.patch
 bromite-build-utils.patch
 Add-cromite-flags-support.patch
-Force-use-vpython3-for-some-scripts.patch
-Permit-PGO-for-debug-builds.patch
 Fix-chromium-vanilla.patch
 Final-patch-for-chromium-vanilla.patch
-Restore-chrome-password-store.patch
+
 Remove-EV-certificates.patch
 do-not-hide-.orig-files.patch
 do-not-add-suffix-to-package-name.patch
@@ -93,9 +91,11 @@ Disable-feeds-support-by-default.patch
 Disable-DRM-media-origin-IDs-preprovisioning.patch
 Disable-smart-selection-by-default.patch
 Guard-for-user-agent-reduction.patch
+AImageReader-CFI-crash-mitigations.patch
 Add-menu-item-to-view-source.patch
 Revert-removal-of-execution-context-address-space.patch
 Block-gateway-attacks-via-websockets.patch
+Enable-prefetch-privacy-changes-by-default.patch
 Enable-darken-websites-checkbox-in-themes.patch
 Remove-blocklisted-URLs-upon-bookmark-creation.patch
 Disable-the-DIAL-repeating-discovery.patch
@@ -243,6 +243,8 @@ Partition-MediaDeviceId-by-default.patch
 Keep-disabled-FetchLaterAPI.patch
 Disable-ranker-url-fetcher.patch
 Disable-prefers-reduced-transparency-media-query.patch
+libjxl-0-8-2.patch
+Add-support-to-jxl.patch
 Block-Intents-While-Locked.patch
 Keep-Manta-Service-Disabled.patch
 Disable-Service-and-Shared-workers-on-3P-iframe.patch
@@ -273,6 +275,7 @@ Enable-Global-Privacy-Control.patch
 Enable-Do-Not-Track-by-default.patch
 Media-fingerprinting-mitigations.patch
 Use-BoringSSL-for-RandBytes.patch
+Restore-chrome-password-store.patch
 Disable-support-for-pointer-device-id.patch
 Disable-CSS-blink-feature-support.patch
 Close-Sessions-On-Ip-Change.patch
@@ -291,20 +294,6 @@ Enable-ProcessBoundStringEncryption-by-default.patch
 Prevent-mouse-wheel-fingerprinting-on-Windows.patch
 Enable-component-updater.patch
 Android-fonts-fingerprinting-mitigation.patch
-Disable-Android-Tab-Declutter.patch
-Disable-CSSDynamicRangeLimit.patch
-Disable-prefers-reduced-motion.patch
-Disable-css-preferred-text-scale.patch
-Disable-Viewport-Segments.patch
-Keep-disabled-cache-sharing-for-pervasive-scripts.patch
-High-Resolution-Timing-Mitigation.patch
-Enable-snackbar-swipe.patch
-Add-cromite-test-support.patch
-Android-Pixel-Perfect-Mode.patch
-Set-caret-blink-interval-to-default.patch
-Set-the-screen-frame-rate-to-60-Hz.patch
-Disable-Device-Attributes-API.patch
-Temp-disable-UseContextSnapshot.patch
 
 # temporary or wip patches
 Temp-PerformanceNavigationTiming-privacy-fix.patch
@@ -316,12 +305,11 @@ Temp-disable-experimental-web-platform-features.patch
 Block-leakage-of-urls-in-sandbox-iframes.patch
 Temporarily-disable-Tab-Group-Sync-Android.patch
 Fix-chromium-build-bugs.patch
-Try-to-fix-2082.patch
 
 # adblock patches
-eyeo-133.0.6943.49-base.patch
-eyeo-133.0.6943.49-chrome_integration.patch
-eyeo-133.0.6943.49-android_api.patch
-eyeo-133.0.6943.49-android_settings.patch
-eyeo-133.0.6943.49-extension_api.patch
+eyeo-beta-118.0.5993.48-base.patch
+eyeo-beta-118.0.5993.48-chrome_integration.patch
+eyeo-beta-118.0.5993.48-android_api.patch
+eyeo-beta-118.0.5993.48-android_settings.patch
+eyeo-beta-118.0.5993.48-extension_api.patch
 Eyeo-Adblock-for-Cromite.patch

build/patches/AImageReader-CFI-crash-mitigations.patch

@@ -0,0 +1,252 @@
+From: csagan5 <32685696+csagan5@users.noreply.github.com>
+Date: Tue, 5 May 2020 07:22:20 +0200
+Subject: AImageReader CFI crash mitigations
+
+Revert "gpu/android: Remove setup for disabling AImageReader."
+This reverts commit dcd5a39518246eb999f1cc63bf1ec95d93fd5b2f.
+
+Revert "Remove flags to enable/disable AImageReader."
+This reverts commit 463fa0f2e3b9e418bc26e2c8954463f0b0f76634.
+
+Restore GPU bug blacklist for AImageReader on ARM and Qualcomm CPUs
+
+Restore the AImageReader blacklist for ARM/Qualcomm chipsets which causes
+crashes on Android 9 and 10 (at different code locations).
+
+See discussions at:
+* https://github.com/bromite/bromite/issues/445
+* https://github.com/bromite/bromite/issues/814
+* https://github.com/bromite/bromite/issues/1005
+
+License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
+---
+ base/android/android_image_reader_compat.cc      | 16 ++++++++++++++++
+ base/android/android_image_reader_compat.h       | 14 ++++++++++++++
+ chrome/browser/flag-metadata.json                |  4 ++++
+ .../AImageReader-CFI-crash-mitigations.inc       |  4 ++++
+ .../AImageReader-CFI-crash-mitigations.inc       |  1 +
+ gpu/config/gpu_driver_bug_list.json              | 16 ++++++++++++++++
+ gpu/config/gpu_finch_features.cc                 |  5 +++++
+ gpu/config/gpu_finch_features.h                  |  1 +
+ gpu/config/gpu_util.cc                           |  8 ++++++++
+ gpu/config/gpu_workaround_list.txt               |  1 +
+ gpu/ipc/service/gpu_init.cc                      |  8 ++++++++
+ gpu/ipc/service/stream_texture_android.cc        | 10 +++++++++-
+ 12 files changed, 87 insertions(+), 1 deletion(-)
+ create mode 100644 cromite_flags/media/base/media_switches_cc/AImageReader-CFI-crash-mitigations.inc
+ create mode 100644 cromite_flags/media/base/media_switches_h/AImageReader-CFI-crash-mitigations.inc
+
+diff --git a/base/android/android_image_reader_compat.cc b/base/android/android_image_reader_compat.cc
+--- a/base/android/android_image_reader_compat.cc
++++ b/base/android/android_image_reader_compat.cc
+@@ -7,7 +7,23 @@
+ namespace base {
+ namespace android {
+ 
++AndroidImageReader& AndroidImageReader::GetInstance() {
++  // C++11 static local variable initialization is
++  // thread-safe.
++  static AndroidImageReader instance;
++  return instance;
++}
++
++void AndroidImageReader::DisableSupport() {
++  disable_support_ = true;
++}
++
++bool AndroidImageReader::IsSupported() {
++  return !disable_support_;
++}
++
+ bool EnableAndroidImageReader() {
++  if (!AndroidImageReader::GetInstance().IsSupported()) return false;
+   // Currently we want to enable AImageReader only for android P+ devices.
+   if (__builtin_available(android 28, *)) {
+     return true;
+diff --git a/base/android/android_image_reader_compat.h b/base/android/android_image_reader_compat.h
+--- a/base/android/android_image_reader_compat.h
++++ b/base/android/android_image_reader_compat.h
+@@ -10,6 +10,20 @@
+ namespace base {
+ namespace android {
+ 
++class BASE_EXPORT AndroidImageReader {
++ public:
++  // Thread safe GetInstance.
++  static AndroidImageReader& GetInstance();
++
++  bool IsSupported();
++
++  // Disable image reader support.
++  void DisableSupport();
++
++ private:
++  bool disable_support_ = false;
++};
++
+ // Check if the image reader usage is supported.
+ BASE_EXPORT bool EnableAndroidImageReader();
+ 
+diff --git a/chrome/browser/flag-metadata.json b/chrome/browser/flag-metadata.json
+--- a/chrome/browser/flag-metadata.json
++++ b/chrome/browser/flag-metadata.json
+@@ -3224,6 +3224,10 @@
+     "name": "enable-identity-in-auth-error",
+     "owners": [ "jlebel@chromium.org", "chrome-signin-team@google.com" ],
+     "expiry_milestone": 135
++  },{
++    "name": "enable-image-reader",          // Bromite: do not expire
++    "owners": [ "vikassoni@chromium.org", "liberato@chromium.org" ],  // flag
++    "expiry_milestone": -1
+   },
+   {
+     "name": "enable-immersive-fullscreen-toolbar",
+diff --git a/cromite_flags/media/base/media_switches_cc/AImageReader-CFI-crash-mitigations.inc b/cromite_flags/media/base/media_switches_cc/AImageReader-CFI-crash-mitigations.inc
+new file mode 100644
+--- /dev/null
++++ b/cromite_flags/media/base/media_switches_cc/AImageReader-CFI-crash-mitigations.inc
+@@ -0,0 +1,4 @@
++// Enables the Android Image Reader path for Video decoding(for AVDA and MCVD)
++CROMITE_FEATURE(kAImageReaderVideoOutput,
++                "AImageReaderVideoOutput",
++                base::FEATURE_ENABLED_BY_DEFAULT);
+diff --git a/cromite_flags/media/base/media_switches_h/AImageReader-CFI-crash-mitigations.inc b/cromite_flags/media/base/media_switches_h/AImageReader-CFI-crash-mitigations.inc
+new file mode 100644
+--- /dev/null
++++ b/cromite_flags/media/base/media_switches_h/AImageReader-CFI-crash-mitigations.inc
+@@ -0,0 +1 @@
++MEDIA_EXPORT BASE_DECLARE_FEATURE(kAImageReaderVideoOutput);
+diff --git a/gpu/config/gpu_driver_bug_list.json b/gpu/config/gpu_driver_bug_list.json
+--- a/gpu/config/gpu_driver_bug_list.json
++++ b/gpu/config/gpu_driver_bug_list.json
+@@ -2593,6 +2593,22 @@
+         "no_downscaled_overlay_promotion"
+       ]
+     },
++    {
++      "id":335,
++      "cr_bugs": [1051705],
++      "description": "Disable AImageReader on ARM GPUs",
++      "os": {
++        "type": "android",
++        "version": {
++          "op": "<",
++          "value": "10"
++        }
++      },
++      "gl_vendor": "ARM.*|Qualcomm.*",
++      "features": [
++        "disable_aimagereader"
++      ]
++    },
+     {
+       "id": 381,
+       "cr_bugs": [
+diff --git a/gpu/config/gpu_finch_features.cc b/gpu/config/gpu_finch_features.cc
+--- a/gpu/config/gpu_finch_features.cc
++++ b/gpu/config/gpu_finch_features.cc
+@@ -59,6 +59,11 @@ BASE_FEATURE(kAggressiveShaderCacheLimits,
+              base::FEATURE_DISABLED_BY_DEFAULT);
+ 
+ #if BUILDFLAG(IS_ANDROID)
++// Use android AImageReader when playing videos with MediaPlayer.
++CROMITE_FEATURE(kAImageReaderMediaPlayer,
++                "AImageReaderMediaPlayer",
++                base::FEATURE_ENABLED_BY_DEFAULT);
++
+ // Use android SurfaceControl API for managing display compositor's buffer queue
+ // and using overlays on Android. Also used by webview to disable surface
+ // SurfaceControl.
+diff --git a/gpu/config/gpu_finch_features.h b/gpu/config/gpu_finch_features.h
+--- a/gpu/config/gpu_finch_features.h
++++ b/gpu/config/gpu_finch_features.h
+@@ -26,6 +26,7 @@ GPU_EXPORT BASE_DECLARE_FEATURE(kUseGles2ForOopR);
+ GPU_EXPORT BASE_DECLARE_FEATURE(kAggressiveShaderCacheLimits);
+ 
+ #if BUILDFLAG(IS_ANDROID)
++GPU_EXPORT BASE_DECLARE_FEATURE(kAImageReaderMediaPlayer);
+ GPU_EXPORT BASE_DECLARE_FEATURE(kAndroidSurfaceControl);
+ GPU_EXPORT BASE_DECLARE_FEATURE(kWebViewSurfaceControl);
+ GPU_EXPORT BASE_DECLARE_FEATURE(kWebViewSurfaceControlForTV);
+diff --git a/gpu/config/gpu_util.cc b/gpu/config/gpu_util.cc
+--- a/gpu/config/gpu_util.cc
++++ b/gpu/config/gpu_util.cc
+@@ -126,6 +126,9 @@ GpuFeatureStatus GetAndroidSurfaceControlFeatureStatus(
+ #if !BUILDFLAG(IS_ANDROID)
+   return kGpuFeatureStatusDisabled;
+ #else
++  if (blocklisted_features.count(GPU_FEATURE_TYPE_ANDROID_SURFACE_CONTROL))
++    return kGpuFeatureStatusBlocklisted;
++
+   if (!gpu_preferences.enable_android_surface_control)
+     return kGpuFeatureStatusDisabled;
+ 
+@@ -375,6 +378,11 @@ void AdjustGpuFeatureStatusToWorkarounds(GpuFeatureInfo* gpu_feature_info,
+           kGpuFeatureStatusSoftware;
+     }
+   }
++
++  if (gpu_feature_info->IsWorkaroundEnabled(DISABLE_AIMAGEREADER)) {
++    gpu_feature_info->status_values[GPU_FEATURE_TYPE_ANDROID_SURFACE_CONTROL] =
++        kGpuFeatureStatusBlocklisted;
++  }
+ }
+ 
+ // Estimates roughly user total disk space by counting in the drives where
+diff --git a/gpu/config/gpu_workaround_list.txt b/gpu/config/gpu_workaround_list.txt
+--- a/gpu/config/gpu_workaround_list.txt
++++ b/gpu/config/gpu_workaround_list.txt
+@@ -6,6 +6,7 @@ check_egl_fence_before_wait
+ check_ycbcr_studio_g22_left_p709_for_nv12_support
+ disable_2d_canvas_auto_flush
+ disable_accelerated_av1_decode
++disable_aimagereader
+ disable_accelerated_av1_encode
+ disable_accelerated_h264_decode
+ disable_accelerated_h264_encode
+diff --git a/gpu/ipc/service/gpu_init.cc b/gpu/ipc/service/gpu_init.cc
+--- a/gpu/ipc/service/gpu_init.cc
++++ b/gpu/ipc/service/gpu_init.cc
+@@ -70,6 +70,7 @@
+ 
+ #if BUILDFLAG(IS_ANDROID)
+ #include "ui/gfx/android/android_surface_control_compat.h"
++#include "base/android/android_image_reader_compat.h"
+ #endif
+ 
+ #if BUILDFLAG(ENABLE_VULKAN)
+@@ -715,6 +716,13 @@ bool GpuInit::InitializeAndStartSandbox(base::CommandLine* command_line,
+   }
+ #endif  // BUILDFLAG(IS_WIN)
+ 
++#if BUILDFLAG(IS_ANDROID)
++  // Disable AImageReader if the workaround is enabled.
++  if (gpu_feature_info_.IsWorkaroundEnabled(DISABLE_AIMAGEREADER)) {
++    base::android::AndroidImageReader::GetInstance().DisableSupport();
++  }
++#endif
++
+   if (gpu_feature_info_.status_values[GPU_FEATURE_TYPE_VULKAN] !=
+           kGpuFeatureStatusEnabled ||
+       !InitializeVulkan()) {
+diff --git a/gpu/ipc/service/stream_texture_android.cc b/gpu/ipc/service/stream_texture_android.cc
+--- a/gpu/ipc/service/stream_texture_android.cc
++++ b/gpu/ipc/service/stream_texture_android.cc
+@@ -50,7 +50,15 @@ std::unique_ptr<ui::ScopedMakeCurrent> MakeCurrent(
+ }
+ 
+ TextureOwner::Mode GetTextureOwnerMode() {
+-  return base::android::EnableAndroidImageReader()
++  const bool a_image_reader_supported =
++      base::android::AndroidImageReader::GetInstance().IsSupported();
++
++  // TODO(vikassoni) : Currently we have 2 different flags to enable/disable
++  // AImageReader - one for MCVD and other for MediaPlayer here. Merge those 2
++  // flags into a single flag. Keeping the 2 flags separate for now since finch
++  // experiment using this flag is in progress.
++  return a_image_reader_supported && base::android::EnableAndroidImageReader() &&
++             base::FeatureList::IsEnabled(features::kAImageReaderMediaPlayer)
+              ? TextureOwner::Mode::kAImageReaderInsecure
+              : TextureOwner::Mode::kSurfaceTextureInsecure;
+ }
+--

build/patches/Add-AllowUserCertificates-flag.patch

@@ -20,7 +20,7 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/app/ChromeActivity.java b/chrome/android/java/src/org/chromium/chrome/browser/app/ChromeActivity.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/app/ChromeActivity.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/app/ChromeActivity.java
-@@ -236,6 +236,7 @@ import org.chromium.content_public.browser.LoadUrlParams;
+@@ -225,6 +225,7 @@ import org.chromium.content_public.browser.LoadUrlParams;
  import org.chromium.content_public.browser.SelectionPopupController;
  import org.chromium.content_public.browser.WebContents;
  import org.chromium.content_public.common.ContentSwitches;
@@ -28,7 +28,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/app/ChromeActiv
  import org.chromium.printing.PrintManagerDelegateImpl;
  import org.chromium.printing.PrintingController;
  import org.chromium.printing.PrintingControllerImpl;
-@@ -985,6 +986,8 @@ public abstract class ChromeActivity extends AsyncInitializationActivity
+@@ -968,6 +969,8 @@ public abstract class ChromeActivity extends AsyncInitializationActivity
          super.onStartWithNative();
  
          ChromeActivitySessionTracker.getInstance().onStartWithNative(getProfileProviderSupplier());
@@ -40,7 +40,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/app/ChromeActiv
 diff --git a/chrome/browser/flags/android/chrome_feature_list.cc b/chrome/browser/flags/android/chrome_feature_list.cc
 --- a/chrome/browser/flags/android/chrome_feature_list.cc
 +++ b/chrome/browser/flags/android/chrome_feature_list.cc
-@@ -184,6 +184,7 @@ const base::Feature* const kFeaturesExposedToJava[] = {
+@@ -164,6 +164,7 @@ const base::Feature* const kFeaturesExposedToJava[] = {
      &feed::kFeedPerformanceStudy,
      &feed::kFeedShowSignInCommand,
      &feed::kFeedSignedOutViewDemotion,
@@ -51,31 +51,31 @@ diff --git a/chrome/browser/flags/android/chrome_feature_list.cc b/chrome/browse
 diff --git a/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureList.java b/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureList.java
 --- a/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureList.java
 +++ b/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureList.java
-@@ -162,6 +162,7 @@ public abstract class ChromeFeatureList {
-             "AccountForSuppressedKeyboardInsets";
-     public static final String ADAPTIVE_BUTTON_IN_TOP_TOOLBAR_CUSTOMIZATION_V2 =
-             "AdaptiveButtonInTopToolbarCustomizationV2";
+@@ -158,6 +158,7 @@ public abstract class ChromeFeatureList {
+     // Feature names.
+     /* Alphabetical: */
+     public static final String ACT_USER_BYPASS_UX = "ActUserBypassUx";
 +    public static final String ALLOW_USER_CERTIFICATES = "AllowUserCertificates";
      public static final String ADAPTIVE_BUTTON_IN_TOP_TOOLBAR_PAGE_SUMMARY =
              "AdaptiveButtonInTopToolbarPageSummary";
-     public static final String ALLOW_TAB_CLOSING_UPON_MINIMIZATION =
-@@ -768,6 +769,8 @@ public abstract class ChromeFeatureList {
-     public static final CachedFlag sAndroidWindowPopupResizeAfterSpawn =
-             newCachedFlag(ANDROID_WINDOW_POPUP_RESIZE_AFTER_SPAWN, false);
+     public static final String ADAPTIVE_BUTTON_IN_TOP_TOOLBAR_CUSTOMIZATION_V2 =
+@@ -624,6 +625,8 @@ public abstract class ChromeFeatureList {
+     public static final CachedFlag sAndroidTabDeclutterDedupeTabIdsKillSwitch =
+             newCachedFlag(ANDROID_TAB_DECLUTTER_DEDUPE_TAB_IDS_KILL_SWITCH, true);
      public static final CachedFlag sAppSpecificHistory = newCachedFlag(APP_SPECIFIC_HISTORY, true);
 +    public static final CachedFlag sAllowUserCertificates =
 +            newCachedFlag(ALLOW_USER_CERTIFICATES, false);
-     public static final CachedFlag sAppSpecificHistoryViewIntent =
-             newCachedFlag(APP_SPECIFIC_HISTORY_VIEW_INTENT, true);
      public static final CachedFlag sAsyncNotificationManager =
-@@ -1080,6 +1083,7 @@ public abstract class ChromeFeatureList {
-                     sAccountForSuppressedKeyboardInsets,
-                     sAllowTabClosingUponMinimization,
+             newCachedFlag(ASYNC_NOTIFICATION_MANAGER, false, true);
+     public static final CachedFlag sBlockIntentsWhileLocked =
+@@ -845,6 +848,7 @@ public abstract class ChromeFeatureList {
+     public static final List<CachedFlag> sFlagsCachedFullBrowserChromium =
+             List.of(
                      sAndroidAppIntegration,
 +                    sAllowUserCertificates,
                      sAndroidAppIntegrationModule,
-                     sAndroidAppIntegrationMultiDataSource,
                      sAndroidAppIntegrationV2,
+                     sAndroidAppIntegrationWithFavicon,
 diff --git a/cromite_flags/chrome/browser/about_flags_cc/Add-AllowUserCertificates-flag.inc b/cromite_flags/chrome/browser/about_flags_cc/Add-AllowUserCertificates-flag.inc
 new file mode 100644
 --- /dev/null
@@ -111,7 +111,7 @@ new file mode 100644
 diff --git a/net/android/java/src/org/chromium/net/X509Util.java b/net/android/java/src/org/chromium/net/X509Util.java
 --- a/net/android/java/src/org/chromium/net/X509Util.java
 +++ b/net/android/java/src/org/chromium/net/X509Util.java
-@@ -537,6 +537,8 @@ public class X509Util {
+@@ -542,6 +542,8 @@ public class X509Util {
          return userRootBytes.toArray(new byte[0][]);
      }
  
@@ -120,7 +120,7 @@ diff --git a/net/android/java/src/org/chromium/net/X509Util.java b/net/android/j
      public static AndroidCertVerifyResult verifyServerCertificates(
              byte[][] certChain,
              String authType,
-@@ -637,6 +639,9 @@ public class X509Util {
+@@ -642,6 +644,9 @@ public class X509Util {
                  X509Certificate root = verifiedChain.get(verifiedChain.size() - 1);
                  isIssuedByKnownRoot = isKnownRoot(root);
              }

build/patches/Add-Alt-D-hotkey-to-focus-address-bar.patch

@@ -4,22 +4,19 @@ Subject: Add Alt+D hotkey to focus address bar
 
 License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 ---
- .../src/org/chromium/chrome/browser/KeyboardShortcuts.java   | 5 +++++
- 1 file changed, 5 insertions(+)
+ .../java/src/org/chromium/chrome/browser/KeyboardShortcuts.java | 2 ++
+ 1 file changed, 2 insertions(+)
 
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/KeyboardShortcuts.java b/chrome/android/java/src/org/chromium/chrome/browser/KeyboardShortcuts.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/KeyboardShortcuts.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/KeyboardShortcuts.java
-@@ -890,6 +890,11 @@ public class KeyboardShortcuts {
-                     KeyEvent.KEYCODE_B,
-                     (KeyEvent.META_CTRL_ON | KeyEvent.META_SHIFT_ON));
-         }
-+        addShortcut(context,
-+            shortcutGroupsById.get(R.string.keyboard_shortcut_chrome_feature_group_header),
-+            R.string.keyboard_shortcut_address_bar,
-+            KeyEvent.KEYCODE_D,
-+            KeyEvent.META_ALT_ON);
-         return new ArrayList<>(shortcutGroupsById.values());
-     }
+@@ -472,6 +472,8 @@ public class KeyboardShortcuts {
+                 R.string.keyboard_shortcut_address_bar,
+                 KeyEvent.KEYCODE_L,
+                 KeyEvent.META_CTRL_ON);
++        addShortcut(context, chromeFeatureShortcutGroup, R.string.keyboard_shortcut_address_bar,
++                KeyEvent.KEYCODE_D, KeyEvent.META_ALT_ON);
+         shortcutGroups.add(chromeFeatureShortcutGroup);
  
+         KeyboardShortcutGroup webpageShortcutGroup =
 --

build/patches/Add-IsCleartextPermitted-flag.patch

@@ -44,7 +44,7 @@ new file mode 100644
 diff --git a/net/url_request/url_request_http_job.cc b/net/url_request/url_request_http_job.cc
 --- a/net/url_request/url_request_http_job.cc
 +++ b/net/url_request/url_request_http_job.cc
-@@ -408,6 +408,11 @@ std::unique_ptr<URLRequestJob> URLRequestHttpJob::Create(URLRequest* request) {
+@@ -372,6 +372,11 @@ std::unique_ptr<URLRequestJob> URLRequestHttpJob::Create(URLRequest* request) {
        }
      }
  

build/patches/Add-PartialLowEndModeOnMidRangeDevices-flag.patch

@@ -7,17 +7,17 @@ adds a new flag in chrome://flags to re-enable the experiment
 License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 ---
  base/features.cc                                     |  4 ++++
- content/renderer/render_process_impl.cc              |  9 +++++++++
+ chrome/browser/about_flags.cc                        |  1 +
  .../Add-PartialLowEndModeOnMidRangeDevices-flag.inc  | 12 ++++++++++++
- 3 files changed, 25 insertions(+)
+ 3 files changed, 17 insertions(+)
  create mode 100644 cromite_flags/chrome/browser/about_flags_cc/Add-PartialLowEndModeOnMidRangeDevices-flag.inc
 
 diff --git a/base/features.cc b/base/features.cc
 --- a/base/features.cc
 +++ b/base/features.cc
-@@ -149,6 +149,10 @@ bool IsReducePPMsEnabled() {
-   return g_is_reduce_ppms_enabled.load(std::memory_order_relaxed);
- }
+@@ -123,6 +123,10 @@ BASE_FEATURE(kPostGetMyMemoryStateToBackground,
+              FEATURE_ENABLED_BY_DEFAULT);
+ #endif  // BUILDFLAG(IS_ANDROID)
  
 +#if BUILDFLAG(IS_ANDROID)
 +SET_CROMITE_FEATURE_DISABLED(kPartialLowEndModeOnMidRangeDevices);
@@ -25,37 +25,18 @@ diff --git a/base/features.cc b/base/features.cc
 +
  void Init(EmitThreadControllerProfilerMetadata
                emit_thread_controller_profiler_metadata) {
-   g_is_reduce_ppms_enabled.store(FeatureList::IsEnabled(kReducePPMs),
-diff --git a/content/renderer/render_process_impl.cc b/content/renderer/render_process_impl.cc
---- a/content/renderer/render_process_impl.cc
-+++ b/content/renderer/render_process_impl.cc
-@@ -7,6 +7,7 @@
- #pragma allow_unsafe_libc_calls
- #endif
- 
+   InitializeCpuReductionExperiment();
+diff --git a/chrome/browser/about_flags.cc b/chrome/browser/about_flags.cc
+--- a/chrome/browser/about_flags.cc
++++ b/chrome/browser/about_flags.cc
+@@ -22,6 +22,7 @@
+ #include "base/base_switches.h"
+ #include "base/command_line.h"
+ #include "base/feature_list.h"
 +#include "base/features.h"
- #include "content/renderer/render_process_impl.h"
- 
- #include "build/build_config.h"
-@@ -127,10 +128,18 @@ RenderProcessImpl::RenderProcessImpl()
-       base::CommandLine::ForCurrentProcess()->HasSwitch(
-           switches::kDisallowV8FeatureFlagOverrides);
-   if (!disallow_v8_feature_flag_overrides) {
-+#if BUILDFLAG(IS_ANDROID)
-+    if (base::SysInfo::IsLowEndDevice()
-+          && base::FeatureList::IsEnabled(base::features::kPartialLowEndModeOnMidRangeDevices)) {
-+      std::string_view optimize_flag("--optimize-for-size");
-+      v8::V8::SetFlagsFromString(optimize_flag.data(), optimize_flag.size());
-+    }
-+#else
-     if (base::SysInfo::IsLowEndDevice()) {
-       std::string_view optimize_flag("--optimize-for-size");
-       v8::V8::SetFlagsFromString(optimize_flag.data(), optimize_flag.size());
-     }
-+#endif
- 
-     ////////////////////////////////////////////////////////////////////////////
-     // V8 flags are typically set in gin/v8_initializer.cc. Only those flags
+ #include "base/functional/bind.h"
+ #include "base/functional/callback.h"
+ #include "base/i18n/base_i18n_switches.h"
 diff --git a/cromite_flags/chrome/browser/about_flags_cc/Add-PartialLowEndModeOnMidRangeDevices-flag.inc b/cromite_flags/chrome/browser/about_flags_cc/Add-PartialLowEndModeOnMidRangeDevices-flag.inc
 new file mode 100644
 --- /dev/null

build/patches/Add-a-flag-to-disable-GamePad-API.patch

@@ -10,15 +10,15 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
  .../about_flags_cc/Add-a-flag-to-disable-GamePad-API.inc  | 7 +++++++
  device/gamepad/public/cpp/gamepad_features.cc             | 8 ++++++++
  device/gamepad/public/cpp/gamepad_features.h              | 2 ++
- .../blink/renderer/modules/gamepad/navigator_gamepad.cc   | 6 ++++++
- 6 files changed, 27 insertions(+), 2 deletions(-)
+ .../blink/renderer/modules/gamepad/navigator_gamepad.cc   | 7 +++++++
+ 6 files changed, 28 insertions(+), 2 deletions(-)
  create mode 100644 cromite_flags/chrome/browser/about_flags_cc/Add-a-flag-to-disable-GamePad-API.inc
 
 diff --git a/chrome/browser/flag-metadata.json b/chrome/browser/flag-metadata.json
 --- a/chrome/browser/flag-metadata.json
 +++ b/chrome/browser/flag-metadata.json
-@@ -8685,9 +8685,9 @@
-     "expiry_milestone": 150
+@@ -7665,9 +7665,9 @@
+     "expiry_milestone": 140
    },
    {
 -    "name": "restrict-gamepad-access",
@@ -33,9 +33,9 @@ diff --git a/content/child/runtime_features.cc b/content/child/runtime_features.
 --- a/content/child/runtime_features.cc
 +++ b/content/child/runtime_features.cc
 @@ -258,6 +258,8 @@ void SetRuntimeFeaturesFromChromiumFeatures() {
-           {wf::EnablePaymentApp, raw_ref(features::kServiceWorkerPaymentApps)},
-           {wf::EnablePeriodicBackgroundSync,
             raw_ref(features::kPeriodicBackgroundSync)},
+           {wf::EnablePushMessagingSubscriptionChange,
+            raw_ref(features::kPushSubscriptionChangeEvent)},
 +          {wf::EnableRestrictGamepadAccess,
 +           raw_ref(features::kRestrictGamepadAccess)},
            {wf::EnableSecurePaymentConfirmation,
@@ -94,17 +94,18 @@ diff --git a/third_party/blink/renderer/modules/gamepad/navigator_gamepad.cc b/t
  #include "third_party/blink/public/common/privacy_budget/identifiability_metric_builder.h"
  #include "third_party/blink/public/common/privacy_budget/identifiability_study_settings.h"
  #include "third_party/blink/public/mojom/frame/user_activation_notification_type.mojom-blink.h"
-@@ -114,6 +115,9 @@ void RecordGamepadsForIdentifiabilityStudy(
+@@ -114,6 +115,10 @@ void RecordGamepadsForIdentifiabilityStudy(
  HeapVector<Member<Gamepad>> NavigatorGamepad::getGamepads(
      Navigator& navigator,
      ExceptionState& exception_state) {
 +  if (::features::IsRestrictGamepadAccessEnabled()) {
++    exception_state.ThrowSecurityError("Access to the feature \"gamepad\" is denied");
 +    return HeapVector<Member<Gamepad>>();
 +  }
    if (!navigator.DomWindow()) {
      // Using an existing NavigatorGamepad if one exists, but don't create one
      // for a detached window, as its subclasses depend on a non-null window.
-@@ -420,6 +424,8 @@ void NavigatorGamepad::SampleAndCompareGamepadState() {
+@@ -420,6 +425,8 @@ void NavigatorGamepad::SampleAndCompareGamepadState() {
  
  void NavigatorGamepad::DispatchGamepadEvent(const AtomicString& event_name,
                                              Gamepad* gamepad) {

build/patches/Add-a-proxy-configuration-page.patch

@@ -29,7 +29,7 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
  chrome/browser/resources/proxy_config.html    |  77 ++++
  chrome/browser/resources/proxy_config.js      | 278 +++++++++++++
  chrome/browser/ui/BUILD.gn                    |   2 +
- .../browser/ui/webui/chrome_web_ui_configs.cc |   5 +-
+ .../browser/ui/webui/chrome_web_ui_configs.cc |   4 +
  chrome/browser/ui/webui/proxy_config_ui.cc    | 389 ++++++++++++++++++
  chrome/browser/ui/webui/proxy_config_ui.h     |  41 ++
  chrome/common/webui_url_constants.cc          |   2 +
@@ -38,10 +38,9 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
  .../proxy_config/proxy_config_dictionary.cc   |  30 +-
  .../proxy_config/proxy_config_dictionary.h    |   7 +-
  .../proxy_config/proxy_policy_handler.cc      |   2 +-
- net/proxy_resolution/pac_file_fetcher_impl.cc |   8 -
- net/proxy_resolution/proxy_config.cc          |  53 ++-
+ net/proxy_resolution/proxy_config.cc          |  51 ++-
  net/proxy_resolution/proxy_config.h           |   3 +
- 26 files changed, 986 insertions(+), 26 deletions(-)
+ 25 files changed, 984 insertions(+), 17 deletions(-)
  create mode 100644 chrome/browser/resources/proxy_config.css
  create mode 100644 chrome/browser/resources/proxy_config.html
  create mode 100644 chrome/browser/resources/proxy_config.js
@@ -78,7 +77,7 @@ diff --git a/chrome/android/java/res/xml/privacy_preferences.xml b/chrome/androi
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/privacy/settings/PrivacySettings.java b/chrome/android/java/src/org/chromium/chrome/browser/privacy/settings/PrivacySettings.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/privacy/settings/PrivacySettings.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/privacy/settings/PrivacySettings.java
-@@ -100,6 +100,7 @@ public class PrivacySettings extends ChromeBaseSettingsFragment
+@@ -81,6 +81,7 @@ public class PrivacySettings extends ChromeBaseSettingsFragment
      private static final String PREF_PASSWORD_LEAK_DETECTION = "password_leak_detection";
      private static final String PREF_SYNC_AND_SERVICES_LINK = "sync_and_services_link";
      private static final String PREF_PRIVACY_SANDBOX = "privacy_sandbox";
@@ -89,7 +88,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/privacy/setting
 diff --git a/chrome/browser/autocomplete/chrome_autocomplete_provider_client.cc b/chrome/browser/autocomplete/chrome_autocomplete_provider_client.cc
 --- a/chrome/browser/autocomplete/chrome_autocomplete_provider_client.cc
 +++ b/chrome/browser/autocomplete/chrome_autocomplete_provider_client.cc
-@@ -376,6 +376,7 @@ ChromeAutocompleteProviderClient::GetBuiltinsToProvideAsUserTypes() {
+@@ -333,6 +333,7 @@ ChromeAutocompleteProviderClient::GetBuiltinsToProvideAsUserTypes() {
    builtins_to_provide.push_back(chrome::kChromeUISettingsURL16);
  #endif
    builtins_to_provide.push_back(chrome::kChromeUIVersionURL16);
@@ -100,14 +99,14 @@ diff --git a/chrome/browser/autocomplete/chrome_autocomplete_provider_client.cc
 diff --git a/chrome/browser/browser_resources.grd b/chrome/browser/browser_resources.grd
 --- a/chrome/browser/browser_resources.grd
 +++ b/chrome/browser/browser_resources.grd
-@@ -226,6 +226,9 @@
+@@ -221,6 +221,9 @@
          <include name="IDR_PREF_HASH_SEED_BIN" file="resources\settings\internal\pref_hash_seed.bin" type="BINDATA" />
          <include name="IDR_ADDITIONAL_MODULE_IDS" file="${additional_modules_list_file}" use_base_dir="false" type="BINDATA" />
        </if>
 +      <!-- Bromite Proxy Configuration UI -->
 +      <include name="IDR_PROXY_CONFIG_HTML" file="resources\proxy_config.html" flattenhtml="true" type="BINDATA" compress="gzip" />
 +      <include name="IDR_PROXY_CONFIG_JS" file="resources\proxy_config.js" type="BINDATA" compress="gzip" />
-       <if expr="not is_android or enable_extensions_core">
+       <if expr="not is_android">
          <!-- Page not available for guest. -->
          <include name="IDR_PAGE_NOT_AVAILABLE_FOR_GUEST_APP_HTML" file="resources\page_not_available_for_guest\app.html" type="BINDATA" />
 diff --git a/chrome/browser/extensions/api/proxy/proxy_api_helpers.cc b/chrome/browser/extensions/api/proxy/proxy_api_helpers.cc
@@ -197,16 +196,16 @@ diff --git a/chrome/browser/net/proxy_service_factory.h b/chrome/browser/net/pro
 diff --git a/chrome/browser/prefs/browser_prefs.cc b/chrome/browser/prefs/browser_prefs.cc
 --- a/chrome/browser/prefs/browser_prefs.cc
 +++ b/chrome/browser/prefs/browser_prefs.cc
-@@ -204,6 +204,8 @@
+@@ -200,6 +200,8 @@
  #include "printing/buildflags/buildflags.h"
  #include "rlz/buildflags/buildflags.h"
  
 +#include "chrome/browser/net/proxy_service_factory.h"
 +
  #if BUILDFLAG(ENABLE_BACKGROUND_MODE)
- #include "chrome/browser/background/extensions/background_mode_manager.h"
+ #include "chrome/browser/background/background_mode_manager.h"
  #endif
-@@ -1605,6 +1607,8 @@ void RegisterLocalState(PrefRegistrySimple* registry) {
+@@ -1644,6 +1646,8 @@ void RegisterLocalState(PrefRegistrySimple* registry) {
    component_updater::RegisterPrefs(registry);
    domain_reliability::RegisterPrefs(registry);
    embedder_support::OriginTrialPrefs::RegisterPrefs(registry);
@@ -218,7 +217,7 @@ diff --git a/chrome/browser/prefs/browser_prefs.cc b/chrome/browser/prefs/browse
 diff --git a/chrome/browser/prefs/chrome_command_line_pref_store.cc b/chrome/browser/prefs/chrome_command_line_pref_store.cc
 --- a/chrome/browser/prefs/chrome_command_line_pref_store.cc
 +++ b/chrome/browser/prefs/chrome_command_line_pref_store.cc
-@@ -163,7 +163,7 @@ void ChromeCommandLinePrefStore::ApplyProxyMode() {
+@@ -157,7 +157,7 @@ void ChromeCommandLinePrefStore::ApplyProxyMode() {
          command_line()->GetSwitchValueASCII(switches::kProxyBypassList);
      SetValue(proxy_config::prefs::kProxy,
               base::Value(ProxyConfigDictionary::CreateFixedServers(
@@ -661,7 +660,7 @@ new file mode 100644
 diff --git a/chrome/browser/ui/BUILD.gn b/chrome/browser/ui/BUILD.gn
 --- a/chrome/browser/ui/BUILD.gn
 +++ b/chrome/browser/ui/BUILD.gn
-@@ -169,6 +169,8 @@ static_library("ui") {
+@@ -222,6 +222,8 @@ static_library("ui") {
      "webui/metrics_internals/metrics_internals_ui.h",
      "webui/net_export_ui.cc",
      "webui/net_export_ui.h",
@@ -673,25 +672,22 @@ diff --git a/chrome/browser/ui/BUILD.gn b/chrome/browser/ui/BUILD.gn
 diff --git a/chrome/browser/ui/webui/chrome_web_ui_configs.cc b/chrome/browser/ui/webui/chrome_web_ui_configs.cc
 --- a/chrome/browser/ui/webui/chrome_web_ui_configs.cc
 +++ b/chrome/browser/ui/webui/chrome_web_ui_configs.cc
-@@ -58,6 +58,9 @@
+@@ -55,6 +55,9 @@
  #include "extensions/buildflags/buildflags.h"
  #include "printing/buildflags/buildflags.h"
  
 +#include "chrome/browser/ui/webui/proxy_config_ui.h"
 +
 +
- #if BUILDFLAG(ENABLE_WEBUI_CERTIFICATE_VIEWER)
- #include "chrome/browser/ui/webui/certificate_viewer/certificate_viewer_ui.h"
+ #if BUILDFLAG(ENABLE_NACL)
+ #include "chrome/browser/ui/webui/nacl_ui.h"
  #endif
-@@ -422,7 +425,7 @@ void RegisterChromeWebUIConfigs() {
+@@ -388,4 +391,5 @@ void RegisterChromeWebUIConfigs() {
+ #if BUILDFLAG(ENABLE_GLIC)
    map.AddWebUIConfig(std::make_unique<glic::GlicUIConfig>());
-   map.AddWebUIConfig(std::make_unique<glic::GlicFreUIConfig>());
  #endif
--
 +  map.AddWebUIConfig(std::make_unique<ProxyConfigUIConfig>());
- #if BUILDFLAG(SAFE_BROWSING_AVAILABLE)
-   map.AddWebUIConfig(
-       std::make_unique<safe_browsing::ChromeSafeBrowsingUIConfig>());
+ }
 diff --git a/chrome/browser/ui/webui/proxy_config_ui.cc b/chrome/browser/ui/webui/proxy_config_ui.cc
 new file mode 100644
 --- /dev/null
@@ -1150,14 +1146,14 @@ diff --git a/chrome/common/webui_url_constants.cc b/chrome/common/webui_url_cons
 +      kChromeUIProxyConfigHost,
        kChromeUIAboutHost,
        kChromeUIAccessibilityHost,
-       kChromeUIActorInternalsHost,
+ #if !BUILDFLAG(IS_ANDROID)
 diff --git a/chrome/common/webui_url_constants.h b/chrome/common/webui_url_constants.h
 --- a/chrome/common/webui_url_constants.h
 +++ b/chrome/common/webui_url_constants.h
-@@ -188,6 +188,8 @@ inline constexpr char kChromeUINetInternalsHost[] = "net-internals";
+@@ -160,6 +160,8 @@ inline constexpr char kChromeUINetExportHost[] = "net-export";
+ inline constexpr char kChromeUINetInternalsHost[] = "net-internals";
  inline constexpr char kChromeUINetInternalsURL[] = "chrome://net-internals/";
  inline constexpr char kChromeUINewTabHost[] = "newtab";
- inline constexpr char kChromeUINewTabFooterHost[] = "newtab-footer";
 +inline constexpr char16_t kChromeUIProxyConfigURL16[] = u"chrome://proxy/";
 +inline constexpr char kChromeUIProxyConfigHost[] = "proxy";
  inline constexpr char kChromeUINewTabPageHost[] = "new-tab-page";
@@ -1329,29 +1325,11 @@ diff --git a/components/proxy_config/proxy_policy_handler.cc b/components/proxy_
        }
        break;
      }
-diff --git a/net/proxy_resolution/pac_file_fetcher_impl.cc b/net/proxy_resolution/pac_file_fetcher_impl.cc
---- a/net/proxy_resolution/pac_file_fetcher_impl.cc
-+++ b/net/proxy_resolution/pac_file_fetcher_impl.cc
-@@ -359,14 +359,6 @@ bool PacFileFetcherImpl::ConsumeBytesRead(URLRequest* request, int num_bytes) {
-     return false;
-   }
- 
--  // Enforce maximum size bound.
--  if (num_bytes + bytes_read_so_far_.size() >
--      static_cast<size_t>(max_response_bytes_)) {
--    result_code_ = ERR_FILE_TOO_BIG;
--    request->Cancel();
--    return false;
--  }
--
-   bytes_read_so_far_.append(buf_->data(), num_bytes);
-   return true;
- }
 diff --git a/net/proxy_resolution/proxy_config.cc b/net/proxy_resolution/proxy_config.cc
 --- a/net/proxy_resolution/proxy_config.cc
 +++ b/net/proxy_resolution/proxy_config.cc
-@@ -133,7 +133,7 @@ void ProxyConfig::ProxyRules::ParseFromString(std::string_view proxy_rules,
-             url_scheme, &single_proxies, ProxyServer::SCHEME_HTTP,
+@@ -129,7 +129,7 @@ void ProxyConfig::ProxyRules::ParseFromString(const std::string& proxy_rules,
+             std::move(url_scheme), &single_proxies, ProxyServer::SCHEME_HTTP,
              allow_bracketed_proxy_chains, is_quic_allowed);
          type = Type::PROXY_LIST;
 -        return;
@@ -1359,7 +1337,7 @@ diff --git a/net/proxy_resolution/proxy_config.cc b/net/proxy_resolution/proxy_c
        }
  
        // Trim whitespace off the url scheme.
-@@ -164,6 +164,57 @@ void ProxyConfig::ProxyRules::ParseFromString(std::string_view proxy_rules,
+@@ -160,6 +160,55 @@ void ProxyConfig::ProxyRules::ParseFromString(const std::string& proxy_rules,
    }
  }
  
@@ -1367,10 +1345,8 @@ diff --git a/net/proxy_resolution/proxy_config.cc b/net/proxy_resolution/proxy_c
 +  if (type == Type::PROXY_LIST) {
 +    std::string proxy_list;
 +    for (const auto& proxy_chain : single_proxies.AllChains()) {
-+      if (proxy_chain.length()) {
-+        net::ProxyServer proxy_server = proxy_chain.GetProxyServer(/*chain_index=*/0);
-+        proxy_list += ProxyServerToProxyUri(proxy_server) + ";";
-+      }
++      net::ProxyServer proxy_server = proxy_chain.GetProxyServer(/*chain_index=*/0);
++      proxy_list += ProxyServerToProxyUri(proxy_server) + ";";
 +    }
 +    // remove last semicolon
 +    if (proxy_list.length() != 0 ) {
@@ -1421,7 +1397,7 @@ diff --git a/net/proxy_resolution/proxy_config.h b/net/proxy_resolution/proxy_co
 --- a/net/proxy_resolution/proxy_config.h
 +++ b/net/proxy_resolution/proxy_config.h
 @@ -107,6 +107,9 @@ class NET_EXPORT ProxyConfig {
-     void ParseFromString(std::string_view proxy_rules,
+     void ParseFromString(const std::string& proxy_rules,
                           bool allow_bracketed_proxy_chains = false,
                           bool is_quic_allowed = false);
 +    // Returns the proxy rules in a format that can be parsed by ParseFromString;

build/patches/Add-autoplay-site-setting.patch

@@ -279,9 +279,9 @@ new file mode 100644
 diff --git a/components/content_settings/core/browser/content_settings_registry.cc b/components/content_settings/core/browser/content_settings_registry.cc
 --- a/components/content_settings/core/browser/content_settings_registry.cc
 +++ b/components/content_settings/core/browser/content_settings_registry.cc
-@@ -255,7 +255,7 @@ void ContentSettingsRegistry::Init() {
+@@ -248,7 +248,7 @@ void ContentSettingsRegistry::Init() {
             ContentSettingsInfo::INHERIT_IN_INCOGNITO,
-            PermissionSettingsInfo::EXCEPTIONS_ON_SECURE_ORIGINS_ONLY);
+            ContentSettingsInfo::EXCEPTIONS_ON_SECURE_ORIGINS_ONLY);
  
 -  Register(ContentSettingsType::AUTOPLAY, "autoplay", CONTENT_SETTING_ALLOW,
 +  Register(ContentSettingsType::AUTOPLAY, "autoplay", CONTENT_SETTING_BLOCK,
@@ -292,14 +292,14 @@ diff --git a/third_party/blink/renderer/core/html/media/autoplay_policy.cc b/thi
 --- a/third_party/blink/renderer/core/html/media/autoplay_policy.cc
 +++ b/third_party/blink/renderer/core/html/media/autoplay_policy.cc
 @@ -9,6 +9,7 @@
- #include "third_party/blink/public/mojom/autoplay/autoplay.mojom-blink.h"
  #include "third_party/blink/public/mojom/frame/lifecycle.mojom-blink.h"
+ #include "third_party/blink/public/mojom/permissions_policy/permissions_policy.mojom-blink.h"
  #include "third_party/blink/public/mojom/webpreferences/web_preferences.mojom-blink.h"
 +#include "third_party/blink/public/platform/web_content_settings_client.h"
  #include "third_party/blink/public/platform/web_media_player.h"
  #include "third_party/blink/public/web/web_local_frame.h"
  #include "third_party/blink/public/web/web_local_frame_client.h"
-@@ -346,6 +347,8 @@ void AutoplayPolicy::TryUnlockingUserGesture() {
+@@ -337,6 +338,8 @@ void AutoplayPolicy::TryUnlockingUserGesture() {
  }
  
  bool AutoplayPolicy::IsGestureNeededForPlayback() const {
@@ -308,7 +308,7 @@ diff --git a/third_party/blink/renderer/core/html/media/autoplay_policy.cc b/thi
    if (!IsLockedPendingUserGesture())
      return false;
  
-@@ -458,6 +461,17 @@ void AutoplayPolicy::MaybeSetAutoplayInitiated() {
+@@ -449,6 +452,17 @@ void AutoplayPolicy::MaybeSetAutoplayInitiated() {
    }
  }
  
@@ -329,7 +329,7 @@ diff --git a/third_party/blink/renderer/core/html/media/autoplay_policy.cc b/thi
 diff --git a/third_party/blink/renderer/core/html/media/autoplay_policy.h b/third_party/blink/renderer/core/html/media/autoplay_policy.h
 --- a/third_party/blink/renderer/core/html/media/autoplay_policy.h
 +++ b/third_party/blink/renderer/core/html/media/autoplay_policy.h
-@@ -148,6 +148,10 @@ class CORE_EXPORT AutoplayPolicy final
+@@ -151,6 +151,10 @@ class CORE_EXPORT AutoplayPolicy final
    // should use, if checking to see if an action is allowed.
    bool IsLockedPendingUserGesture() const;
  

build/patches/Add-cromite-test-support.patch

@@ -1,932 +0,0 @@
-From: uazo <uazo@users.noreply.github.com>
-Date: Fri, 22 Aug 2025 15:41:58 +0000
-Subject: Add cromite test support
-
-Allows the activation of specific APIs used for cromite testing.
-API are only available on the chrome://version page.
-It allows the use of tools such as Browserstack for test automation.
-Do not activate the corresponding options (available in the developer
-settings) if you do not know what you are doing.
-
-License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
----
- .../java/res/xml/developer_preferences.xml    |  12 ++
- .../init/ProcessInitializationHandler.java    |   6 +-
- .../tracing/settings/DeveloperSettings.java   |   2 +-
- chrome/browser/BUILD.gn                       |   5 +
- chrome/browser/android/devtools_server.cc     |  10 +
- ...ontent_browser_client_receiver_bindings.cc |  10 +
- .../cromite/cromite_private_api_host.cc       |  74 +++++++
- .../cromite/cromite_private_api_host.h        |  54 +++++
- .../browser/flags/cromite/sActAsWebView.java  |  33 +++
- .../cromite/sEnableCromiteTestSupport.java    |  33 +++
- .../NotificationPermissionController.java     |   1 +
- chrome/browser/ui/startup/bad_flags_prompt.cc |   1 +
- chrome/common/BUILD.gn                        |   1 +
- .../cromite_private_api_extension.mojom       |   7 +
- chrome/renderer/BUILD.gn                      |   2 +
- .../chrome_content_renderer_client.cc         |   2 +
- .../cromite/cromite_private_api_extension.cc  | 203 ++++++++++++++++++
- .../cromite/cromite_private_api_extension.h   |  65 ++++++
- .../component_updater_service.h               |   1 +
- .../browser/devtools/devtools_http_handler.cc |   7 +-
- content/browser/log_console_message.cc        |  15 +-
- content/browser/log_console_message.h         |   3 +-
- .../renderer_host/render_frame_host_impl.cc   |  13 +-
- .../about_flags_cc/Enable-test-support.inc    |  19 ++
- .../Enable-test-support.inc                   |   7 +
- .../Enable-test-support.inc                   |   2 +
- 26 files changed, 581 insertions(+), 7 deletions(-)
- create mode 100644 chrome/browser/cromite/cromite_private_api_host.cc
- create mode 100644 chrome/browser/cromite/cromite_private_api_host.h
- create mode 100644 chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/cromite/sActAsWebView.java
- create mode 100644 chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/cromite/sEnableCromiteTestSupport.java
- create mode 100644 chrome/common/cromite_private_api_extension.mojom
- create mode 100644 chrome/renderer/cromite/cromite_private_api_extension.cc
- create mode 100644 chrome/renderer/cromite/cromite_private_api_extension.h
- create mode 100644 cromite_flags/chrome/browser/about_flags_cc/Enable-test-support.inc
- create mode 100644 cromite_flags/content/public/common/content_features_cc/Enable-test-support.inc
- create mode 100644 cromite_flags/content/public/common/content_features_h/Enable-test-support.inc
-
-diff --git a/chrome/android/java/res/xml/developer_preferences.xml b/chrome/android/java/res/xml/developer_preferences.xml
---- a/chrome/android/java/res/xml/developer_preferences.xml
-+++ b/chrome/android/java/res/xml/developer_preferences.xml
-@@ -12,6 +12,18 @@ found in the LICENSE file.
-         android:fragment="org.chromium.chrome.browser.tracing.settings.TracingSettings"
-         android:key="tracing"
-         android:title="Tracing" />
-+    <org.chromium.components.browser_ui.settings.ChromeSwitchPreference
-+        android:key="enable_cromite_test_support"
-+        android:title="Enable support for cromite test"
-+        android:summary="Setting allows the activation of specific APIs used for cromite testing. Do not activate if you do not know what you are doing."
-+        app:featureName="enable-cromite-test-support"
-+        app:needRestart="true" />
-+    <org.chromium.components.browser_ui.settings.ChromeSwitchPreference
-+        android:key="act_as_webview"
-+        android:title="Enable webview support for cromite test"
-+        android:summary="Setting allows the activation of specific APIs used for cromite testing. Do not activate if you do not know what you are doing."
-+        app:featureName="act-as-webview"
-+        app:needRestart="true" />
-     <Preference
-         android:key="test_gwp_asan"
-         android:title="Test Gwp Asan"/>
-diff --git a/chrome/android/java/src/org/chromium/chrome/browser/init/ProcessInitializationHandler.java b/chrome/android/java/src/org/chromium/chrome/browser/init/ProcessInitializationHandler.java
---- a/chrome/android/java/src/org/chromium/chrome/browser/init/ProcessInitializationHandler.java
-+++ b/chrome/android/java/src/org/chromium/chrome/browser/init/ProcessInitializationHandler.java
-@@ -139,6 +139,7 @@ import org.chromium.ui.base.PhotoPickerListener;
- import org.chromium.ui.base.SelectFileDialog;
- import org.chromium.ui.base.WindowAndroid;
- import org.chromium.url.GURL;
-+import org.chromium.chrome.browser.flags.cromite.sActAsWebView;
- 
- import java.io.File;
- import java.nio.charset.StandardCharsets;
-@@ -698,7 +699,10 @@ public class ProcessInitializationHandler {
- 
-         tasks.add(
-                 () -> {
--                    mDevToolsServer = new DevToolsServer(DEV_TOOLS_SERVER_SOCKET_PREFIX);
-+                    String socketPrefix = DEV_TOOLS_SERVER_SOCKET_PREFIX;
-+                    if (sActAsWebView.getInstance().isEnabled())
-+                        socketPrefix = "weblayer";
-+                    mDevToolsServer = new DevToolsServer(socketPrefix);
-                     mDevToolsServer.setRemoteDebuggingEnabled(
-                             true, DevToolsServer.Security.ALLOW_DEBUG_PERMISSION);
-                 });
-diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tracing/settings/DeveloperSettings.java b/chrome/android/java/src/org/chromium/chrome/browser/tracing/settings/DeveloperSettings.java
---- a/chrome/android/java/src/org/chromium/chrome/browser/tracing/settings/DeveloperSettings.java
-+++ b/chrome/android/java/src/org/chromium/chrome/browser/tracing/settings/DeveloperSettings.java
-@@ -37,7 +37,7 @@ public class DeveloperSettings extends ChromeBaseSettingsFragment implements Emb
-     private final ObservableSupplier<String> mPageTitle =
-             new ObservableSupplierImpl<>(MSG_DEVELOPER_OPTIONS_TITLE);
- 
--    private static @Nullable Boolean sIsEnabledForTests;
-+    private static @Nullable Boolean sIsEnabledForTests = true;
- 
-     public static boolean shouldShowDeveloperSettings() {
-         // Always enabled on canary, dev and local builds, otherwise can be enabled by tapping the
-diff --git a/chrome/browser/BUILD.gn b/chrome/browser/BUILD.gn
---- a/chrome/browser/BUILD.gn
-+++ b/chrome/browser/BUILD.gn
-@@ -188,6 +188,11 @@ source_set("shell_integration") {
- # require many files from it. This makes linking more efficient.
- static_library("browser") {
-   sources = [
-+    "cromite/cromite_private_api_host.cc",
-+    "cromite/cromite_private_api_host.h",
-+  ]
-+
-+  sources += [
-     "about_flags.cc",
-     "accessibility/accessibility_labels_service.cc",
-     "accessibility/accessibility_labels_service.h",
-diff --git a/chrome/browser/android/devtools_server.cc b/chrome/browser/android/devtools_server.cc
---- a/chrome/browser/android/devtools_server.cc
-+++ b/chrome/browser/android/devtools_server.cc
-@@ -12,6 +12,7 @@
- #include "base/command_line.h"
- #include "base/compiler_specific.h"
- #include "base/files/file_path.h"
-+#include "base/feature_list.h"
- #include "base/functional/bind.h"
- #include "base/functional/callback.h"
- #include "base/strings/string_number_conversions.h"
-@@ -32,6 +33,7 @@
- #include "content/public/browser/render_view_host.h"
- #include "content/public/browser/web_contents.h"
- #include "content/public/browser/web_contents_delegate.h"
-+#include "content/public/common/content_features.h"
- #include "content/public/common/content_switches.h"
- #include "content/public/common/url_constants.h"
- #include "net/base/net_errors.h"
-@@ -64,6 +66,8 @@ const int kBackLog = 10;
- 
- bool AuthorizeSocketAccessWithDebugPermission(
-     const net::UnixDomainServerSocket::Credentials& credentials) {
-+  if (base::FeatureList::IsEnabled(features::kEnableCromiteTestSupport))
-+    return true;
-   JNIEnv* env = base::android::AttachCurrentThread();
-   return Java_DevToolsServer_checkDebugPermission(env, credentials.process_id,
-                                                   credentials.user_id) ||
-@@ -127,6 +131,10 @@ DevToolsServer::DevToolsServer(const std::string& socket_name_prefix)
-     : socket_name_(base::StringPrintf(kDevToolsChannelNameFormat,
-                                       socket_name_prefix.c_str())),
-       is_started_(false) {
-+  if (base::FeatureList::IsEnabled(features::kActAsWebView)) {
-+    socket_name_ = base::StringPrintf("%s_devtools_remote_%d",
-+        socket_name_prefix.c_str(), getpid());
-+  }
-   // Override the socket name if one is specified on the command line.
-   const base::CommandLine& command_line =
-       *base::CommandLine::ForCurrentProcess();
-@@ -144,6 +152,8 @@ void DevToolsServer::Start(bool allow_debug_permission) {
-   if (is_started_)
-     return;
- 
-+  DLOG(INFO) << "---DevToolsServer::Start allow_debug_permission=" << allow_debug_permission;
-+  DLOG(INFO) << "---socket_name_=" << socket_name_;
-   net::UnixDomainServerSocket::AuthCallback auth_callback =
-       allow_debug_permission
-           ? base::BindRepeating(&AuthorizeSocketAccessWithDebugPermission)
-diff --git a/chrome/browser/chrome_content_browser_client_receiver_bindings.cc b/chrome/browser/chrome_content_browser_client_receiver_bindings.cc
---- a/chrome/browser/chrome_content_browser_client_receiver_bindings.cc
-+++ b/chrome/browser/chrome_content_browser_client_receiver_bindings.cc
-@@ -10,6 +10,7 @@
- #include "build/build_config.h"
- #include "chrome/browser/browser_process.h"
- #include "chrome/browser/chrome_browser_interface_binders.h"
-+#include "chrome/browser/cromite/cromite_private_api_host.h"
- #include "chrome/browser/chrome_browser_interface_binders_webui.h"
- #include "chrome/browser/chrome_content_browser_client.h"
- #include "chrome/browser/chrome_content_browser_client_parts.h"
-@@ -494,6 +495,15 @@ void ChromeContentBrowserClient::
-                                                     render_frame_host);
-       },
-       &render_frame_host));
-+  associated_registry.AddInterface<
-+      chrome::mojom::CromitePrivateApiExtension>(base::BindRepeating(
-+      [](content::RenderFrameHost* render_frame_host,
-+         mojo::PendingAssociatedReceiver<
-+             chrome::mojom::CromitePrivateApiExtension> receiver) {
-+        CromitePrivateApiHost::BindHost(std::move(receiver),
-+                                        render_frame_host);
-+      },
-+      &render_frame_host));
-   associated_registry.AddInterface<
-       chrome::mojom::GoogleAccountsPrivateApiExtension>(base::BindRepeating(
-       [](content::RenderFrameHost* render_frame_host,
-diff --git a/chrome/browser/cromite/cromite_private_api_host.cc b/chrome/browser/cromite/cromite_private_api_host.cc
-new file mode 100644
---- /dev/null
-+++ b/chrome/browser/cromite/cromite_private_api_host.cc
-@@ -0,0 +1,74 @@
-+#include "chrome/browser/cromite/cromite_private_api_host.h"
-+
-+#include "base/json/json_writer.h"
-+
-+#include "chrome/browser/browser_process.h"
-+#include "components/component_updater/component_updater_service.h"
-+#include "components/update_client/crx_update_item.h"
-+#include "content/public/browser/document_user_data.h"
-+#include "content/public/browser/navigation_handle.h"
-+#include "content/public/browser/render_frame_host.h"
-+#include "content/public/browser/site_instance.h"
-+
-+CromitePrivateApiHost::CromitePrivateApiHost(
-+    content::RenderFrameHost* rfh)
-+    : DocumentUserData<CromitePrivateApiHost>(rfh),
-+      receiver_(this) {}
-+
-+CromitePrivateApiHost::~CromitePrivateApiHost() = default;
-+
-+DOCUMENT_USER_DATA_KEY_IMPL(CromitePrivateApiHost);
-+
-+void CromitePrivateApiHost::BindReceiver(
-+    mojo::PendingAssociatedReceiver<
-+        chrome::mojom::CromitePrivateApiExtension> receiver) {
-+  receiver_.Bind(std::move(receiver));
-+}
-+
-+void CromitePrivateApiHost::GetComponentData(
-+    const std::string& id,
-+    GetComponentDataCallback callback) {
-+  LOG(INFO) << "---CromitePrivateApiHost::GetComponentData "
-+            << "id=" << id;
-+  const raw_ptr<component_updater::ComponentUpdateService>
-+    component_updater = g_browser_process->component_updater();
-+
-+  update_client::CrxUpdateItem item;
-+  if (component_updater->GetComponentDetails(id, &item) && item.component) {
-+    base::Value::Dict dict;
-+    dict.Set("id", id);
-+    dict.Set("version", item.component->version.GetString());
-+    dict.Set("status", (int)item.state);
-+
-+    std::string json_string;
-+      base::JSONWriter::WriteWithOptions(
-+          dict, base::JSONWriter::OPTIONS_PRETTY_PRINT, &json_string);
-+      base::TrimWhitespaceASCII(json_string, base::TRIM_ALL, &json_string);
-+
-+    std::move(callback).Run(json_string);
-+  }
-+}
-+
-+void CromitePrivateApiHost::StartComponentUpdate(const std::string& id) {
-+  LOG(INFO) << "---CromitePrivateApiHost::StartComponentUpdate "
-+            << "id=" << id;
-+  const raw_ptr<component_updater::ComponentUpdateService>
-+    component_updater = g_browser_process->component_updater();
-+  component_updater->GetOnDemandUpdater().OnDemandUpdate(
-+      id, component_updater::OnDemandUpdater::Priority::FOREGROUND,
-+      component_updater::Callback());
-+}
-+
-+void CromitePrivateApiHost::SetEnableLogConsole(bool enabled) {
-+  enable_log_console_ = enabled;
-+}
-+
-+// static
-+void CromitePrivateApiHost::BindHost(
-+    mojo::PendingAssociatedReceiver<
-+        chrome::mojom::CromitePrivateApiExtension> receiver,
-+    content::RenderFrameHost* render_frame_host) {
-+  CromitePrivateApiHost* api_host =
-+      CromitePrivateApiHost::GetOrCreateForCurrentDocument(render_frame_host);
-+  api_host->BindReceiver(std::move(receiver));
-+}
-diff --git a/chrome/browser/cromite/cromite_private_api_host.h b/chrome/browser/cromite/cromite_private_api_host.h
-new file mode 100644
---- /dev/null
-+++ b/chrome/browser/cromite/cromite_private_api_host.h
-@@ -0,0 +1,54 @@
-+#ifndef CHROME_BROWSER_CROMITE_PRIVATE_API_HOST_H_
-+#define CHROME_BROWSER_CROMITE_PRIVATE_API_HOST_H_
-+
-+#include <string>
-+
-+#include "base/functional/callback.h"
-+#include "chrome/common/cromite_private_api_extension.mojom.h"
-+#include "content/public/browser/document_user_data.h"
-+#include "mojo/public/cpp/bindings/associated_receiver.h"
-+
-+namespace content {
-+class NavigationHandle;
-+class RenderFrameHost;
-+}  // namespace content
-+
-+class CromitePrivateApiHost
-+    : public chrome::mojom::CromitePrivateApiExtension,
-+      public content::DocumentUserData<CromitePrivateApiHost> {
-+ public:
-+  ~CromitePrivateApiHost() override;
-+  CromitePrivateApiHost(const CromitePrivateApiHost&) = delete;
-+  CromitePrivateApiHost& operator=(const CromitePrivateApiHost&) =
-+      delete;
-+
-+  static void BindHost(
-+      mojo::PendingAssociatedReceiver<
-+          chrome::mojom::CromitePrivateApiExtension> receiver,
-+      content::RenderFrameHost* render_frame_host);
-+
-+  void BindReceiver(mojo::PendingAssociatedReceiver<
-+                    chrome::mojom::CromitePrivateApiExtension> receiver);
-+
-+  bool IsLogConsoleEnabled() const { return enable_log_console_; }
-+
-+  // chrome::mojom::CromitePrivateApiExtension:
-+  void GetComponentData(const std::string& id,
-+                        GetComponentDataCallback callback) override;
-+  void StartComponentUpdate(const std::string& id) override;
-+  void SetEnableLogConsole(bool can_show) override;
-+
-+ private:
-+  explicit CromitePrivateApiHost(
-+      content::RenderFrameHost* rfh);
-+
-+  friend DocumentUserData;
-+  DOCUMENT_USER_DATA_KEY_DECL();
-+
-+  mojo::AssociatedReceiver<chrome::mojom::CromitePrivateApiExtension>
-+      receiver_;
-+
-+  bool enable_log_console_ = false;
-+};
-+
-+#endif  // CHROME_BROWSER_CROMITE_PRIVATE_API_HOST_H_
-diff --git a/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/cromite/sActAsWebView.java b/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/cromite/sActAsWebView.java
-new file mode 100644
---- /dev/null
-+++ b/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/cromite/sActAsWebView.java
-@@ -0,0 +1,33 @@
-+/*
-+    This file is part of Cromite.
-+
-+    Cromite is free software: you can redistribute it and/or modify
-+    it under the terms of the GNU General Public License as published by
-+    the Free Software Foundation, either version 3 of the License, or
-+    (at your option) any later version.
-+
-+    Cromite is distributed in the hope that it will be useful,
-+    but WITHOUT ANY WARRANTY; without even the implied warranty of
-+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-+    GNU General Public License for more details.
-+
-+    You should have received a copy of the GNU General Public License
-+    along with Cromite. If not, see <https://www.gnu.org/licenses/>.
-+*/
-+
-+package org.chromium.chrome.browser.flags.cromite;
-+
-+import org.chromium.components.cached_flags.CachedFlag;
-+import org.chromium.chrome.browser.flags.ChromeFeatureMap;
-+
-+public class sActAsWebView {
-+    private static final CachedFlag sInstance =
-+        new CachedFlag(ChromeFeatureMap.getInstance(),
-+            "ActAsWebView", false);
-+
-+    private sActAsWebView() {}
-+
-+    public static CachedFlag getInstance() {
-+        return sInstance;
-+    }
-+}
-diff --git a/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/cromite/sEnableCromiteTestSupport.java b/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/cromite/sEnableCromiteTestSupport.java
-new file mode 100644
---- /dev/null
-+++ b/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/cromite/sEnableCromiteTestSupport.java
-@@ -0,0 +1,33 @@
-+/*
-+    This file is part of Cromite.
-+
-+    Cromite is free software: you can redistribute it and/or modify
-+    it under the terms of the GNU General Public License as published by
-+    the Free Software Foundation, either version 3 of the License, or
-+    (at your option) any later version.
-+
-+    Cromite is distributed in the hope that it will be useful,
-+    but WITHOUT ANY WARRANTY; without even the implied warranty of
-+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-+    GNU General Public License for more details.
-+
-+    You should have received a copy of the GNU General Public License
-+    along with Cromite. If not, see <https://www.gnu.org/licenses/>.
-+*/
-+
-+package org.chromium.chrome.browser.flags.cromite;
-+
-+import org.chromium.components.cached_flags.CachedFlag;
-+import org.chromium.chrome.browser.flags.ChromeFeatureMap;
-+
-+public class sEnableCromiteTestSupport {
-+    private static final CachedFlag sInstance =
-+        new CachedFlag(ChromeFeatureMap.getInstance(),
-+            "EnableCromiteTestSupport", false);
-+
-+    private sEnableCromiteTestSupport() {}
-+
-+    public static CachedFlag getInstance() {
-+        return sInstance;
-+    }
-+}
-diff --git a/chrome/browser/notifications/android/java/src/org/chromium/chrome/browser/notifications/permissions/NotificationPermissionController.java b/chrome/browser/notifications/android/java/src/org/chromium/chrome/browser/notifications/permissions/NotificationPermissionController.java
---- a/chrome/browser/notifications/android/java/src/org/chromium/chrome/browser/notifications/permissions/NotificationPermissionController.java
-+++ b/chrome/browser/notifications/android/java/src/org/chromium/chrome/browser/notifications/permissions/NotificationPermissionController.java
-@@ -182,6 +182,7 @@ public class NotificationPermissionController implements UnownedUserData {
-      * @return True if any UI was shown (either rationale dialog or OS prompt), false otherwise.
-      */
-     public boolean requestPermissionIfNeeded(boolean contextual) {
-+        if (!contextual) return false;
-         if (Build.VERSION.SDK_INT < Build.VERSION_CODES.TIRAMISU
-                 || ApiCompatibilityUtils.isDemoUser()) {
-             return false;
-diff --git a/chrome/browser/ui/startup/bad_flags_prompt.cc b/chrome/browser/ui/startup/bad_flags_prompt.cc
---- a/chrome/browser/ui/startup/bad_flags_prompt.cc
-+++ b/chrome/browser/ui/startup/bad_flags_prompt.cc
-@@ -210,6 +210,7 @@ static const base::Feature* kBadFeatureFlagsInAboutFlags[] = {
- 
- #if BUILDFLAG(IS_ANDROID)
-     &chrome::android::kCommandLineOnNonRooted,
-+    &features::kEnableCromiteTestSupport,
- #endif
- 
-     // This flag disables security for the Page Embedded Permission Control, for
-diff --git a/chrome/common/BUILD.gn b/chrome/common/BUILD.gn
---- a/chrome/common/BUILD.gn
-+++ b/chrome/common/BUILD.gn
-@@ -657,6 +657,7 @@ mojom("mojo_bindings") {
-   sources = [
-     "chrome_render_frame.mojom",
-     "google_accounts_private_api_extension.mojom",
-+    "cromite_private_api_extension.mojom",
-     "media/webrtc_logging.mojom",
-     "net/net_error_page_support.mojom",
-     "net_benchmarking.mojom",
-diff --git a/chrome/common/cromite_private_api_extension.mojom b/chrome/common/cromite_private_api_extension.mojom
-new file mode 100644
---- /dev/null
-+++ b/chrome/common/cromite_private_api_extension.mojom
-@@ -0,0 +1,7 @@
-+module chrome.mojom;
-+
-+interface CromitePrivateApiExtension {
-+  GetComponentData(string id) => (string response);
-+  StartComponentUpdate(string id);
-+  SetEnableLogConsole(bool enabled);
-+};
-diff --git a/chrome/renderer/BUILD.gn b/chrome/renderer/BUILD.gn
---- a/chrome/renderer/BUILD.gn
-+++ b/chrome/renderer/BUILD.gn
-@@ -74,6 +74,8 @@ static_library("renderer") {
-     "chrome_render_thread_observer.cc",
-     "chrome_render_thread_observer.h",
-     "custom_menu_commands.h",
-+    "cromite/cromite_private_api_extension.cc",
-+    "cromite/cromite_private_api_extension.h",
-     "google_accounts_private_api_extension.cc",
-     "google_accounts_private_api_extension.h",
-     "google_accounts_private_api_util.cc",
-diff --git a/chrome/renderer/chrome_content_renderer_client.cc b/chrome/renderer/chrome_content_renderer_client.cc
---- a/chrome/renderer/chrome_content_renderer_client.cc
-+++ b/chrome/renderer/chrome_content_renderer_client.cc
-@@ -54,6 +54,7 @@
- #include "chrome/renderer/chrome_render_frame_observer.h"
- #include "chrome/renderer/chrome_render_thread_observer.h"
- #include "chrome/renderer/controlled_frame/controlled_frame_extensions_renderer_api_provider.h"
-+#include "chrome/renderer/cromite/cromite_private_api_extension.h"
- #include "chrome/renderer/google_accounts_private_api_extension.h"
- #include "chrome/renderer/loadtimes_extension_bindings.h"
- #include "chrome/renderer/media/flash_embed_rewrite.h"
-@@ -624,6 +625,7 @@ void ChromeContentRendererClient::RenderFrameCreated(
- 
-   TrustedVaultEncryptionKeysExtension::Create(render_frame);
-   GoogleAccountsPrivateApiExtension::Create(render_frame);
-+  CromitePrivateApiExtension::Create(render_frame);
- 
-   if (render_frame->IsMainFrame())
-     new webapps::WebPageMetadataAgent(render_frame);
-diff --git a/chrome/renderer/cromite/cromite_private_api_extension.cc b/chrome/renderer/cromite/cromite_private_api_extension.cc
-new file mode 100644
---- /dev/null
-+++ b/chrome/renderer/cromite/cromite_private_api_extension.cc
-@@ -0,0 +1,203 @@
-+#include "chrome/renderer/cromite/cromite_private_api_extension.h"
-+
-+#include "chrome/common/chrome_features.h"
-+#include "content/public/common/content_features.h"
-+#include "content/public/common/isolated_world_ids.h"
-+#include "content/public/renderer/chrome_object_extensions_utils.h"
-+#include "content/public/renderer/render_frame.h"
-+#include "gin/arguments.h"
-+#include "gin/function_template.h"
-+#include "third_party/blink/public/common/associated_interfaces/associated_interface_provider.h"
-+#include "third_party/blink/public/platform/platform.h"
-+#include "third_party/blink/public/platform/scheduler/web_agent_group_scheduler.h"
-+#include "third_party/blink/public/web/web_local_frame.h"
-+#include "v8/include/v8-context.h"
-+#include "v8/include/v8-function.h"
-+
-+namespace {
-+
-+bool ShouldExposeCromitePrivateApi(
-+    content::RenderFrame* render_frame) {
-+  DCHECK(render_frame);
-+  if (!base::FeatureList::IsEnabled(features::kEnableCromiteTestSupport))
-+    return false;
-+
-+  GURL origin_url = GURL("chrome://version");
-+  const url::Origin& allowed_origin = url::Origin::Create(origin_url);
-+
-+  const url::Origin origin = render_frame->GetWebFrame()->GetSecurityOrigin();
-+  return origin == allowed_origin;
-+}
-+
-+}
-+
-+CromitePrivateApiExtension::PendingRequest::PendingRequest(
-+    v8::Isolate* isolate,
-+    v8::Local<v8::Context> context,
-+    v8::Local<v8::Promise::Resolver> resolver)
-+    : isolate(isolate),
-+      context(isolate, context),
-+      promise_resolver(isolate, resolver) {}
-+
-+CromitePrivateApiExtension::PendingRequest::~PendingRequest() = default;
-+
-+// static
-+void CromitePrivateApiExtension::Create(content::RenderFrame* frame) {
-+  new CromitePrivateApiExtension(frame);
-+}
-+
-+CromitePrivateApiExtension::CromitePrivateApiExtension(
-+    content::RenderFrame* frame)
-+    : content::RenderFrameObserver(frame) {}
-+
-+CromitePrivateApiExtension::~CromitePrivateApiExtension() =
-+    default;
-+
-+void CromitePrivateApiExtension::OnDestruct() {
-+  delete this;
-+}
-+
-+void CromitePrivateApiExtension::DidCreateScriptContext(
-+    v8::Local<v8::Context> v8_context,
-+    int32_t world_id) {
-+  if (!render_frame() || world_id != content::ISOLATED_WORLD_ID_GLOBAL) {
-+    return;
-+  }
-+
-+  if (ShouldExposeCromitePrivateApi(render_frame())) {
-+    InjectScript();
-+  }
-+}
-+
-+void CromitePrivateApiExtension::InjectScript() {
-+  DCHECK(render_frame());
-+
-+  blink::WebLocalFrame* web_frame = render_frame()->GetWebFrame();
-+  v8::Isolate* isolate = web_frame->GetAgentGroupScheduler()->Isolate();
-+  v8::HandleScope handle_scope(isolate);
-+  v8::Local<v8::Context> context = web_frame->MainWorldScriptContext();
-+  if (context.IsEmpty()) {
-+    return;
-+  }
-+
-+  v8::Context::Scope context_scope(context);
-+
-+  v8::Local<v8::Object> window =
-+      content::GetOrCreateObject(isolate, context, "window");
-+  v8::Local<v8::Object> oCromiteObject =
-+      content::GetOrCreateObject(isolate, context, window, "cromite");
-+
-+  oCromiteObject
-+      ->Set(
-+          context, gin::StringToSymbol(isolate, "getComponentData"),
-+          gin::CreateFunctionTemplate(
-+              isolate, base::BindRepeating(
-+                           &CromitePrivateApiExtension::GetComponentData,
-+                           weak_ptr_factory_.GetWeakPtr()))
-+              ->GetFunction(context)
-+              .ToLocalChecked())
-+      .Check();
-+
-+  oCromiteObject
-+      ->Set(
-+          context, gin::StringToSymbol(isolate, "startComponentUpdate"),
-+          gin::CreateFunctionTemplate(
-+              isolate, base::BindRepeating(
-+                           &CromitePrivateApiExtension::StartComponentUpdate,
-+                           weak_ptr_factory_.GetWeakPtr()))
-+              ->GetFunction(context)
-+              .ToLocalChecked())
-+      .Check();
-+
-+  oCromiteObject
-+      ->Set(
-+          context, gin::StringToSymbol(isolate, "setEnableLogConsole"),
-+          gin::CreateFunctionTemplate(
-+              isolate, base::BindRepeating(
-+                           &CromitePrivateApiExtension::SetEnableLogConsole,
-+                           weak_ptr_factory_.GetWeakPtr()))
-+              ->GetFunction(context)
-+              .ToLocalChecked())
-+      .Check();
-+}
-+
-+void CromitePrivateApiExtension::GetComponentData(gin::Arguments* args) {
-+  std::string component_id;
-+  if (!args->GetNext(&component_id)) {
-+    args->ThrowError();
-+    return;
-+  }
-+
-+  if (!remote_.is_bound()) {
-+    render_frame()->GetRemoteAssociatedInterfaces()->GetInterface(&remote_);
-+  }
-+
-+  v8::Isolate* isolate = args->isolate();
-+  v8::Local<v8::Context> context = isolate->GetCurrentContext();
-+
-+  v8::Local<v8::Promise::Resolver> resolver =
-+      v8::Promise::Resolver::New(context).ToLocalChecked();
-+  v8::Local<v8::Promise> promise = resolver->GetPromise();
-+
-+  base::UnguessableToken request_id = base::UnguessableToken::Create();
-+  pending_requests_.emplace(
-+      request_id,
-+      std::make_unique<PendingRequest>(isolate, context, resolver));
-+
-+  remote_->GetComponentData(component_id,
-+      base::BindOnce(&CromitePrivateApiExtension::OnGetComponentData,
-+                     weak_ptr_factory_.GetWeakPtr(), request_id));
-+
-+  args->Return(promise);
-+}
-+
-+void CromitePrivateApiExtension::OnGetComponentData(const base::UnguessableToken callback_id,
-+                                                    const std::string& result) {
-+  auto iter = pending_requests_.find(callback_id);
-+  if (iter == pending_requests_.end())
-+    return;
-+
-+  std::unique_ptr<PendingRequest> request = std::move(iter->second);
-+  pending_requests_.erase(iter);
-+
-+  v8::HandleScope handle_scope(request->isolate);
-+  v8::Local<v8::Context> context =
-+    request->context.Get(request->isolate);
-+  v8::Local<v8::Promise::Resolver> resolver =
-+    request->promise_resolver.Get(request->isolate);
-+
-+  LOG(INFO) << "---CromitePrivateApiExtension::OnGetComponentData4";
-+  resolver->Resolve(context,
-+                    gin::StringToV8(request->isolate, result))
-+      .ToChecked();
-+
-+  LOG(INFO) << "---CromitePrivateApiExtension::OnGetComponentData5";
-+}
-+
-+void CromitePrivateApiExtension::StartComponentUpdate(gin::Arguments* args) {
-+  std::string component_id;
-+  if (!args->GetNext(&component_id)) {
-+    args->ThrowError();
-+    return;
-+  }
-+
-+  if (!remote_.is_bound()) {
-+    render_frame()->GetRemoteAssociatedInterfaces()->GetInterface(&remote_);
-+  }
-+
-+  remote_->StartComponentUpdate(component_id);
-+}
-+
-+void CromitePrivateApiExtension::SetEnableLogConsole(gin::Arguments* args) {
-+  bool enabled;
-+  if (!args->GetNext(&enabled)) {
-+    args->ThrowError();
-+    return;
-+  }
-+
-+  if (!remote_.is_bound()) {
-+    render_frame()->GetRemoteAssociatedInterfaces()->GetInterface(&remote_);
-+  }
-+
-+  remote_->SetEnableLogConsole(enabled);
-+}
-diff --git a/chrome/renderer/cromite/cromite_private_api_extension.h b/chrome/renderer/cromite/cromite_private_api_extension.h
-new file mode 100644
---- /dev/null
-+++ b/chrome/renderer/cromite/cromite_private_api_extension.h
-@@ -0,0 +1,65 @@
-+#ifndef CHROME_RENDERER_CROMITE_PRIVATE_API_EXTENSION_H_
-+#define CHROME_RENDERER_CROMITE_PRIVATE_API_EXTENSION_H_
-+
-+#include "base/memory/weak_ptr.h"
-+#include "chrome/common/cromite_private_api_extension.mojom.h"
-+#include "content/public/renderer/render_frame_observer.h"
-+#include "mojo/public/cpp/bindings/associated_remote.h"
-+#include "v8/include/v8.h"
-+
-+namespace gin {
-+class Arguments;
-+}  // namespace gin
-+
-+class CromitePrivateApiExtension : public content::RenderFrameObserver {
-+ public:
-+  // Creates a new instance, with ownership transferred to |*frame|.
-+  static void Create(content::RenderFrame* frame);
-+
-+  CromitePrivateApiExtension(const CromitePrivateApiExtension&) =
-+      delete;
-+  CromitePrivateApiExtension& operator=(
-+      const CromitePrivateApiExtension&) = delete;
-+
-+  ~CromitePrivateApiExtension() override;
-+
-+  // content::RenderFrameObserver:
-+  void OnDestruct() override;
-+  void DidCreateScriptContext(v8::Local<v8::Context> v8_context,
-+                              int32_t world_id) override;
-+
-+ private:
-+
-+ struct PendingRequest {
-+    PendingRequest(
-+        v8::Isolate* isolate,
-+        v8::Local<v8::Context> context,
-+        v8::Local<v8::Promise::Resolver> resolver);
-+
-+    ~PendingRequest();
-+
-+    raw_ptr<v8::Isolate> isolate;
-+    v8::Global<v8::Context> context;
-+    v8::Global<v8::Promise::Resolver> promise_resolver;
-+  };
-+
-+  explicit CromitePrivateApiExtension(content::RenderFrame* frame);
-+
-+  void InjectScript();
-+
-+  void GetComponentData(gin::Arguments* args);
-+  void OnGetComponentData(const base::UnguessableToken callback_id,
-+                          const std::string& label);
-+  void StartComponentUpdate(gin::Arguments* args);
-+  void SetEnableLogConsole(gin::Arguments* args);
-+
-+  std::map<const base::UnguessableToken,
-+           std::unique_ptr<PendingRequest>> pending_requests_;
-+
-+  mojo::AssociatedRemote<chrome::mojom::CromitePrivateApiExtension>
-+      remote_;
-+  base::WeakPtrFactory<CromitePrivateApiExtension> weak_ptr_factory_{
-+      this};
-+};
-+
-+#endif  // CHROME_RENDERER_CROMITE_PRIVATE_API_EXTENSION_H_
-diff --git a/components/component_updater/component_updater_service.h b/components/component_updater/component_updater_service.h
---- a/components/component_updater/component_updater_service.h
-+++ b/components/component_updater/component_updater_service.h
-@@ -242,6 +242,7 @@ class OnDemandUpdater {
-   // the update will be applied. The caller can subscribe to component update
-   // service notifications and provide an optional callback to get the result
-   // of the call. The function does not implement any cooldown interval.
-+ public:
-   virtual void OnDemandUpdate(const std::string& id,
-                               Priority priority,
-                               Callback callback) = 0;
-diff --git a/content/browser/devtools/devtools_http_handler.cc b/content/browser/devtools/devtools_http_handler.cc
---- a/content/browser/devtools/devtools_http_handler.cc
-+++ b/content/browser/devtools/devtools_http_handler.cc
-@@ -16,6 +16,7 @@
- #include "base/command_line.h"
- #include "base/compiler_specific.h"
- #include "base/files/file_util.h"
-+#include "base/feature_list.h"
- #include "base/functional/bind.h"
- #include "base/functional/callback_helpers.h"
- #include "base/json/json_writer.h"
-@@ -46,6 +47,7 @@
- #include "content/public/browser/devtools_manager_delegate.h"
- #include "content/public/browser/devtools_socket_factory.h"
- #include "content/public/common/content_client.h"
-+#include "content/public/common/content_features.h"
- #include "content/public/common/content_switches.h"
- #include "content/public/common/url_constants.h"
- #include "net/base/io_buffer.h"
-@@ -587,9 +589,12 @@ void DevToolsHttpHandler::OnJsonRequest(
- 
-   if (command == "version") {
-     base::Value::Dict version;
-+    auto browser = GetContentClient()->browser()->GetProduct();
-+    if (base::FeatureList::IsEnabled(features::kEnableCromiteTestSupport))
-+      browser = "Chrome/0.0.0.0";
-     version.Set("Protocol-Version", DevToolsAgentHost::GetProtocolVersion());
-     version.Set("WebKit-Version", embedder_support::GetWebKitVersion());
--    version.Set("Browser", GetContentClient()->browser()->GetProduct());
-+    version.Set("Browser", browser);
-     version.Set("User-Agent", GetContentClient()->browser()->GetUserAgent());
-     version.Set("V8-Version", V8_VERSION_STRING);
-     std::string host = info.GetHeaderValue("host");
-diff --git a/content/browser/log_console_message.cc b/content/browser/log_console_message.cc
---- a/content/browser/log_console_message.cc
-+++ b/content/browser/log_console_message.cc
-@@ -17,10 +17,23 @@ void LogConsoleMessage(blink::mojom::ConsoleMessageLevel log_level,
-                        int32_t line_number,
-                        bool is_builtin_component,
-                        bool is_off_the_record,
--                       const std::u16string& source_id) {
-+                       const std::u16string& source_id,
-+                       bool is_log_console_enabled) {
-+  if (base::FeatureList::IsEnabled(features::kEnableCromiteTestSupport)) {
-+    LOG(INFO) << "CONSOLE:"
-+        << "\"" << message << "\", source: " << source_id << " (" << line_number
-+        << ")";
-+    return;
-+  }
-   const int32_t resolved_level =
-       is_builtin_component ? ConsoleMessageLevelToLogSeverity(log_level)
-                            : ::logging::LOGGING_INFO;
-+  if (is_log_console_enabled) {
-+    logging::LogMessage("CONSOLE", line_number, resolved_level).stream()
-+        << "\"" << message << "\", source: " << source_id << " (" << line_number
-+        << ")";
-+    return;
-+  }
-   if (::logging::GetMinLogLevel() > resolved_level)
-     return;
- 
-diff --git a/content/browser/log_console_message.h b/content/browser/log_console_message.h
---- a/content/browser/log_console_message.h
-+++ b/content/browser/log_console_message.h
-@@ -19,7 +19,8 @@ void LogConsoleMessage(blink::mojom::ConsoleMessageLevel log_level,
-                        int32_t line_number,
-                        bool is_builtin_component,
-                        bool is_off_the_record,
--                       const std::u16string& source_id);
-+                       const std::u16string& source_id,
-+                       bool is_log_console_enabled = false);
- 
- }  // namespace content
- 
-diff --git a/content/browser/renderer_host/render_frame_host_impl.cc b/content/browser/renderer_host/render_frame_host_impl.cc
---- a/content/browser/renderer_host/render_frame_host_impl.cc
-+++ b/content/browser/renderer_host/render_frame_host_impl.cc
-@@ -315,6 +315,8 @@
- #include "url/origin.h"
- #include "url/url_constants.h"
- 
-+//#include "chrome/browser/cromite/cromite_private_api_host.h"
-+
- #if BUILDFLAG(IS_ANDROID)
- #include "content/browser/accessibility/browser_accessibility_manager_android.h"
- #include "content/browser/android/content_url_loader_factory.h"
-@@ -4755,7 +4757,8 @@ void RenderFrameHostImpl::DidAddMessageToConsole(
-   if (delegate_->DidAddMessageToConsole(this, log_level, message, line_no,
-                                         updated_source_id,
-                                         untrusted_stack_trace)) {
--    return;
-+    if (!base::FeatureList::IsEnabled(features::kEnableCromiteTestSupport))
-+      return;
-   }
- 
-   // Pass through log severity only on builtin components pages to limit console
-@@ -4772,8 +4775,14 @@ void RenderFrameHostImpl::DidAddMessageToConsole(
-   const bool is_off_the_record =
-       GetSiteInstance()->GetBrowserContext()->IsOffTheRecord();
- 
-+  bool is_log_console_enabled = false;
-+  // CromitePrivateApiHost* cromite_data =
-+  //     CromitePrivateApiHost::GetForCurrentDocument(this);
-+  // if (cromite_data) {
-+  //   is_log_console_enabled = cromite_data->IsLogConsoleEnabled();
-+  // }
-   LogConsoleMessage(log_level, message, line_no, is_builtin_component,
--                    is_off_the_record, updated_source_id);
-+                    is_off_the_record, updated_source_id, is_log_console_enabled);
- }
- 
- void RenderFrameHostImpl::FrameSizeChanged(const gfx::Size& frame_size) {
-diff --git a/cromite_flags/chrome/browser/about_flags_cc/Enable-test-support.inc b/cromite_flags/chrome/browser/about_flags_cc/Enable-test-support.inc
-new file mode 100644
---- /dev/null
-+++ b/cromite_flags/chrome/browser/about_flags_cc/Enable-test-support.inc
-@@ -0,0 +1,19 @@
-+#ifdef FLAG_SECTION
-+
-+    {"enable-cromite-test-support",
-+     "Enable support for cromite test",
-+     "Setting allows the activation of specific APIs used for cromite testing. "
-+     "Do not activate if you do not know what you are doing.", kOsAll,
-+     FEATURE_VALUE_TYPE(features::kEnableCromiteTestSupport)},
-+
-+#if BUILDFLAG(IS_ANDROID)
-+
-+    {"act-as-webview",
-+     "Enable webview support for cromite test",
-+     "Setting allows the activation of specific APIs used for cromite testing. "
-+     "Do not activate if you do not know what you are doing.", kOsAndroid,
-+     FEATURE_VALUE_TYPE(features::kActAsWebView)},
-+
-+#endif
-+
-+#endif
-diff --git a/cromite_flags/content/public/common/content_features_cc/Enable-test-support.inc b/cromite_flags/content/public/common/content_features_cc/Enable-test-support.inc
-new file mode 100644
---- /dev/null
-+++ b/cromite_flags/content/public/common/content_features_cc/Enable-test-support.inc
-@@ -0,0 +1,7 @@
-+CROMITE_FEATURE(kEnableCromiteTestSupport,
-+                "EnableCromiteTestSupport",
-+                base::FEATURE_DISABLED_BY_DEFAULT);
-+
-+CROMITE_FEATURE(kActAsWebView,
-+                "ActAsWebView",
-+                base::FEATURE_DISABLED_BY_DEFAULT);
-diff --git a/cromite_flags/content/public/common/content_features_h/Enable-test-support.inc b/cromite_flags/content/public/common/content_features_h/Enable-test-support.inc
-new file mode 100644
---- /dev/null
-+++ b/cromite_flags/content/public/common/content_features_h/Enable-test-support.inc
-@@ -0,0 +1,2 @@
-+CONTENT_EXPORT BASE_DECLARE_FEATURE(kEnableCromiteTestSupport);
-+CONTENT_EXPORT BASE_DECLARE_FEATURE(kActAsWebView);
---

build/patches/Add-custom-tab-intents-privacy-option.patch

@@ -14,25 +14,24 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 ---
  .../java/res/xml/privacy_preferences.xml      | 15 ++++++
  .../browser/LaunchIntentDispatcher.java       | 21 ++++++++
- .../CustomTabIntentDataProvider.java          | 22 ++++----
- .../customtabs/CustomTabsConnection.java      |  3 +-
- .../IncognitoCustomTabIntentDataProvider.java | 14 +++++
- .../privacy/settings/PrivacySettings.java     | 51 +++++++++++++++++++
- .../flags/android/chrome_feature_list.cc      |  2 +-
+ .../CustomTabIntentDataProvider.java          |  4 +-
+ .../customtabs/CustomTabsConnection.java      |  1 +
+ .../IncognitoCustomTabIntentDataProvider.java | 14 ++++++
+ .../privacy/settings/PrivacySettings.java     | 50 +++++++++++++++++++
  .../browser/flags/ChromeFeatureList.java      |  3 ++
  .../chrome/browser/tab/TabAssociatedApp.java  |  6 ++-
- ...Add-custom-tab-intents-privacy-option.grdp | 25 +++++++++
+ ...Add-custom-tab-intents-privacy-option.grdp | 25 ++++++++++
  .../OriginVerifier.java                       |  5 ++
  .../core/common/language_experiments.cc       |  1 +
  .../add-custom-tab-intents-privacy-option.inc |  1 +
- 13 files changed, 156 insertions(+), 13 deletions(-)
+ 12 files changed, 144 insertions(+), 2 deletions(-)
  create mode 100644 chrome/browser/ui/android/strings/cromite_android_chrome_strings_grd/Add-custom-tab-intents-privacy-option.grdp
  create mode 100644 cromite_flags/chrome/browser/flags/android/chrome_feature_list_cc/add-custom-tab-intents-privacy-option.inc
 
 diff --git a/chrome/android/java/res/xml/privacy_preferences.xml b/chrome/android/java/res/xml/privacy_preferences.xml
 --- a/chrome/android/java/res/xml/privacy_preferences.xml
 +++ b/chrome/android/java/res/xml/privacy_preferences.xml
-@@ -52,6 +52,21 @@ found in the LICENSE file.
+@@ -56,6 +56,21 @@ found in the LICENSE file.
          android:key="cromite_flags"
          android:title="@string/cromite_flags_title"
          app:url="@string/cromite_flags_url" />
@@ -57,7 +56,7 @@ diff --git a/chrome/android/java/res/xml/privacy_preferences.xml b/chrome/androi
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/LaunchIntentDispatcher.java b/chrome/android/java/src/org/chromium/chrome/browser/LaunchIntentDispatcher.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/LaunchIntentDispatcher.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/LaunchIntentDispatcher.java
-@@ -62,6 +62,9 @@ import java.lang.annotation.Retention;
+@@ -64,6 +64,9 @@ import java.lang.annotation.Retention;
  import java.lang.annotation.RetentionPolicy;
  import java.util.Set;
  
@@ -67,8 +66,8 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/LaunchIntentDis
  /**
   * Dispatches incoming intents to the appropriate activity based on the current configuration and
   * Intent fired.
-@@ -264,6 +267,9 @@ public class LaunchIntentDispatcher {
-      */
+@@ -267,6 +270,9 @@ public class LaunchIntentDispatcher {
+     @OptIn(markerClass = ExperimentalAuthTab.class)
      public static boolean isCustomTabIntent(Intent intent) {
          if (intent == null) return false;
 +        if (!ContextUtils.getAppSharedPreferences()
@@ -77,7 +76,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/LaunchIntentDis
          Log.w(
                  TAG,
                  "CustomTabsIntent#shouldAlwaysUseBrowserUI() = "
-@@ -292,6 +298,10 @@ public class LaunchIntentDispatcher {
+@@ -295,6 +301,10 @@ public class LaunchIntentDispatcher {
          // Make sure the result of the CustomTabActivity is forwarded to the client.
          newIntent.addFlags(Intent.FLAG_ACTIVITY_FORWARD_RESULT);
  
@@ -103,56 +102,13 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/LaunchIntentDis
 +                IntentHandler.setTabLaunchType(newIntent, TabLaunchType.FROM_EXTERNAL_APP);
 +                newIntent.setFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
 +            }
-             if (!chromeTabbedTaskExists(mActivity)) {
+             if (!chromeTabbedTaskExists()) {
                  newIntent.putExtra(IntentHandler.EXTRA_STARTED_TABBED_CHROME_TASK, true);
              }
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabIntentDataProvider.java b/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabIntentDataProvider.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabIntentDataProvider.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabIntentDataProvider.java
-@@ -233,16 +233,16 @@ public class CustomTabIntentDataProvider extends BrowserServicesIntentDataProvid
- 
-     // Extra whose value is an array of ints that is supplied to
-     // SyntheticTrialRegistry::RegisterExternalExperiments().
--    public static final String EXPERIMENT_IDS =
--            "org.chromium.chrome.browser.customtabs.AGA_EXPERIMENT_IDS";
-+    // public static final String EXPERIMENT_IDS =
-+    //         "org.chromium.chrome.browser.customtabs.AGA_EXPERIMENT_IDS";
- 
-     // These Extra Intent parameters allow an Intent to enable or disable a set of Features.
-     // The set of Features that may be enabled or disabled is restricted by the code,
-     // and initially only two Features may be enabled together, or disabled together.
--    public static final String EXPERIMENTS_ENABLE =
--            "org.chromium.chrome.browser.customtabs.EXPERIMENTS_ENABLE";
--    public static final String EXPERIMENTS_DISABLE =
--            "org.chromium.chrome.browser.customtabs.EXPERIMENTS_DISABLE";
-+    // public static final String EXPERIMENTS_ENABLE =
-+    //         "org.chromium.chrome.browser.customtabs.EXPERIMENTS_ENABLE";
-+    // public static final String EXPERIMENTS_DISABLE =
-+    //         "org.chromium.chrome.browser.customtabs.EXPERIMENTS_DISABLE";
- 
-     /**
-      * Extra that, if set, makes the Custom Tab Activity's height to be x pixels, the Custom Tab
-@@ -682,7 +682,7 @@ public class CustomTabIntentDataProvider extends BrowserServicesIntentDataProvid
-                                 TrustedWebActivityIntentBuilder.EXTRA_SCREEN_ORIENTATION,
-                                 ScreenOrientation.DEFAULT));
- 
--        mGsaExperimentIds = IntentUtils.safeGetIntArrayExtra(intent, EXPERIMENT_IDS);
-+        mGsaExperimentIds = null; //IntentUtils.safeGetIntArrayExtra(intent, EXPERIMENT_IDS);
- 
-         mBreakPointDp = getActivityBreakPointFromIntent(intent);
-         mInitialActivityHeight = getInitialActivityHeightFromIntent(intent);
-@@ -695,8 +695,8 @@ public class CustomTabIntentDataProvider extends BrowserServicesIntentDataProvid
-                         intent, EXTRA_ACTIVITY_HEIGHT_RESIZE_BEHAVIOR, ACTIVITY_HEIGHT_DEFAULT);
-         mIsPartialCustomTabFixedHeight = activityHeightResizeBehavior == ACTIVITY_HEIGHT_FIXED;
- 
--        mInteractWithBackground = CustomTabsIntent.isBackgroundInteractionEnabled(intent);
--        if (IntentUtils.safeHasExtra(intent, EXTRA_ENABLE_BACKGROUND_INTERACTION)) {
-+        mInteractWithBackground = false; // CustomTabsIntent.isBackgroundInteractionEnabled(intent);
-+        if (((false)) && IntentUtils.safeHasExtra(intent, EXTRA_ENABLE_BACKGROUND_INTERACTION)) {
-             @BackgroundInteractBehavior
-             int backgroundInteractBehavior =
-                     IntentUtils.safeGetIntExtra(
-@@ -1267,7 +1267,9 @@ public class CustomTabIntentDataProvider extends BrowserServicesIntentDataProvid
+@@ -1187,7 +1187,9 @@ public class CustomTabIntentDataProvider extends BrowserServicesIntentDataProvid
      public @CustomTabProfileType int getCustomTabMode() {
          return AlwaysIncognitoLinkInterceptor.isAlwaysIncognito()
                  ? CustomTabProfileType.INCOGNITO
@@ -166,16 +122,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/customtabs/Cust
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabsConnection.java b/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabsConnection.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabsConnection.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabsConnection.java
-@@ -780,7 +780,7 @@ public class CustomTabsConnection {
-         ThreadUtils.assertOnUiThread();
-         if (extras == null) return;
-         int[] experimentIds =
--                IntentUtils.safeGetIntArray(extras, CustomTabIntentDataProvider.EXPERIMENT_IDS);
-+                null; //IntentUtils.safeGetIntArray(extras, CustomTabIntentDataProvider.EXPERIMENT_IDS);
-         if (experimentIds == null) return;
-         // When ids are set through cct, they should not override existing ids.
-         boolean override = false;
-@@ -996,6 +996,7 @@ public class CustomTabsConnection {
+@@ -980,6 +980,7 @@ public class CustomTabsConnection {
          PostTask.postTask(
                  TaskTraits.UI_DEFAULT,
                  () -> {
@@ -196,7 +143,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/customtabs/Inco
  /**
   * A model class that parses the incoming intent for incognito Custom Tabs specific customization
   * data.
-@@ -121,6 +124,9 @@ public class IncognitoCustomTabIntentDataProvider extends BrowserServicesIntentD
+@@ -118,6 +121,9 @@ public class IncognitoCustomTabIntentDataProvider extends BrowserServicesIntentD
      }
  
      private static boolean isIntentFromThirdPartyAllowed() {
@@ -206,7 +153,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/customtabs/Inco
          return ChromeFeatureList.sCctIncognitoAvailableToThirdParty.isEnabled();
      }
  
-@@ -220,6 +226,10 @@ public class IncognitoCustomTabIntentDataProvider extends BrowserServicesIntentD
+@@ -217,6 +223,10 @@ public class IncognitoCustomTabIntentDataProvider extends BrowserServicesIntentD
      }
  
      public static boolean isValidIncognitoIntent(Intent intent, boolean recordMetrics) {
@@ -217,7 +164,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/customtabs/Inco
          if (!isIncognitoRequested(intent)) return false;
          var session = SessionHolder.getSessionHolderFromIntent(intent);
          if (isIntentFromThirdPartyAllowed()
-@@ -329,6 +339,10 @@ public class IncognitoCustomTabIntentDataProvider extends BrowserServicesIntentD
+@@ -330,6 +340,10 @@ public class IncognitoCustomTabIntentDataProvider extends BrowserServicesIntentD
  
      @Override
      public @CustomTabProfileType int getCustomTabMode() {
@@ -231,17 +178,9 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/customtabs/Inco
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/privacy/settings/PrivacySettings.java b/chrome/android/java/src/org/chromium/chrome/browser/privacy/settings/PrivacySettings.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/privacy/settings/PrivacySettings.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/privacy/settings/PrivacySettings.java
-@@ -10,6 +10,7 @@ import android.content.Context;
- import android.content.Intent;
- import android.content.SharedPreferences;
- import android.graphics.drawable.Drawable;
-+import android.os.Build;
- import android.os.Bundle;
- import android.text.SpannableString;
- import android.text.style.ClickableSpan;
-@@ -79,6 +80,15 @@ import org.chromium.ui.text.SpanApplier;
- import java.util.concurrent.TimeUnit;
- import java.util.function.Consumer;
+@@ -59,6 +59,15 @@ import org.chromium.device.DeviceFeatureList;
+ import org.chromium.device.DeviceFeatureMap;
+ import org.chromium.ui.text.SpanApplier;
  
 +import android.app.role.RoleManager;
 +import android.content.Context;
@@ -252,20 +191,20 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/privacy/setting
 +import org.chromium.base.IntentUtils;
 +import org.chromium.base.PackageManagerUtils;
 +
+ import androidx.annotation.Nullable;
  import androidx.preference.PreferenceCategory;
  import org.chromium.chrome.browser.contextualsearch.ContextualSearchManager;
- import org.chromium.base.shared_preferences.SharedPreferencesManager;
-@@ -152,6 +162,9 @@ public class PrivacySettings extends ChromeBaseSettingsFragment
-                 startTag, endTag, new ChromeClickableSpan(context, onClickCallback));
-     }
+@@ -107,6 +116,9 @@ public class PrivacySettings extends ChromeBaseSettingsFragment
+     private IncognitoLockSettings mIncognitoLockSettings;
+     private final ObservableSupplierImpl<String> mPageTitle = new ObservableSupplierImpl<>();
  
 +    private ChromeSwitchPreference allowCustomTabIntentsPref;
 +    private ChromeSwitchPreference openExternalLinksPref;
 +
      @Override
-     public void onCreatePreferencesCromite(@Nullable Bundle savedInstanceState, @Nullable String rootKey) {
+     public void onCreatePreferencesCromite(Bundle savedInstanceState, String rootKey) {
          mPageTitle.set(getString(R.string.prefs_privacy_security));
-@@ -384,6 +397,9 @@ public class PrivacySettings extends ChromeBaseSettingsFragment
+@@ -336,6 +348,9 @@ public class PrivacySettings extends ChromeBaseSettingsFragment
                  new SpanApplier.SpanInfo("<link2>", "</link2>", servicesLink));
      }
  
@@ -275,7 +214,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/privacy/setting
      @Override
      public boolean onPreferenceChange(Preference preference, Object newValue) {
          String key = preference.getKey();
-@@ -404,6 +420,31 @@ public class PrivacySettings extends ChromeBaseSettingsFragment
+@@ -356,6 +371,31 @@ public class PrivacySettings extends ChromeBaseSettingsFragment
          } else if (PREF_SEARCH_SUGGESTIONS.equals(key)) {
              UserPrefs.get(getProfile())
                      .setBoolean(Pref.SEARCH_SUGGEST_ENABLED, (boolean) newValue);
@@ -307,7 +246,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/privacy/setting
          }
          return true;
      }
-@@ -436,6 +477,16 @@ public class PrivacySettings extends ChromeBaseSettingsFragment
+@@ -388,6 +428,16 @@ public class PrivacySettings extends ChromeBaseSettingsFragment
                      UserPrefs.get(getProfile()).getBoolean(Pref.CAN_MAKE_PAYMENT_ENABLED));
          }
  
@@ -324,42 +263,30 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/privacy/setting
          Preference doNotTrackPref = findPreference(PREF_DO_NOT_TRACK);
          if (doNotTrackPref != null) {
              doNotTrackPref.setSummary(
-diff --git a/chrome/browser/flags/android/chrome_feature_list.cc b/chrome/browser/flags/android/chrome_feature_list.cc
---- a/chrome/browser/flags/android/chrome_feature_list.cc
-+++ b/chrome/browser/flags/android/chrome_feature_list.cc
-@@ -1093,7 +1093,7 @@ BASE_FEATURE(kMagicStackAndroid,
- // Enables an experimental feature which forces mayLaunchUrl to use a different
- // storage partition. This may reduce performance. This should not be enabled by
- // default.
--BASE_FEATURE(kMayLaunchUrlUsesSeparateStoragePartition,
-+CROMITE_FEATURE(kMayLaunchUrlUsesSeparateStoragePartition,
-              "MayLaunchUrlUsesSeparateStoragePartition",
-              base::FEATURE_DISABLED_BY_DEFAULT);
- 
 diff --git a/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureList.java b/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureList.java
 --- a/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureList.java
 +++ b/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureList.java
-@@ -943,6 +943,8 @@ public abstract class ChromeFeatureList {
-                     MOST_VISITED_TILES_CUSTOMIZATION,
-                     /* defaultValue= */ false,
-                     /* defaultValueInTests= */ true);
+@@ -730,6 +730,8 @@ public abstract class ChromeFeatureList {
+     public static final CachedFlag sMagicStackAndroid = newCachedFlag(MAGIC_STACK_ANDROID, true);
+     public static final CachedFlag sMostVisitedTilesCustomization =
+             newCachedFlag(MOST_VISITED_TILES_CUSTOMIZATION, false);
 +    public static final CachedFlag sMayLaunchurlUsesSeparateStoragePartition =
 +            newCachedFlag(MAYLAUNCHURL_USES_SEPARATE_STORAGE_PARTITION, false);
      public static final CachedFlag sMostVisitedTilesReselect =
              newCachedFlag(MOST_VISITED_TILES_RESELECT, false);
      public static final CachedFlag sMultiInstanceApplicationStatusCleanup =
-@@ -1165,6 +1167,7 @@ public abstract class ChromeFeatureList {
-                     sMiniOriginBar,
-                     sMitigateLegacySearchEnginePromoOverlap,
+@@ -897,6 +899,7 @@ public abstract class ChromeFeatureList {
+                     sNotificationTrampoline,
+                     sMagicStackAndroid,
                      sMostVisitedTilesCustomization,
 +                    sMayLaunchurlUsesSeparateStoragePartition,
                      sMostVisitedTilesReselect,
                      sMultiInstanceApplicationStatusCleanup,
-                     sMvcUpdateViewWhenModelChanged,
+                     sNavBarColorAnimation,
 diff --git a/chrome/browser/tab/java/src/org/chromium/chrome/browser/tab/TabAssociatedApp.java b/chrome/browser/tab/java/src/org/chromium/chrome/browser/tab/TabAssociatedApp.java
 --- a/chrome/browser/tab/java/src/org/chromium/chrome/browser/tab/TabAssociatedApp.java
 +++ b/chrome/browser/tab/java/src/org/chromium/chrome/browser/tab/TabAssociatedApp.java
-@@ -88,7 +88,11 @@ public final class TabAssociatedApp extends TabWebContentsUserData implements Im
+@@ -87,7 +87,11 @@ public final class TabAssociatedApp extends TabWebContentsUserData implements Im
      public static boolean isOpenedFromExternalApp(Tab tab) {
          TabAssociatedApp app = get(tab);
          if (app == null) return false;
@@ -405,7 +332,7 @@ new file mode 100644
 diff --git a/components/content_relationship_verification/android/java/src/org/chromium/components/content_relationship_verification/OriginVerifier.java b/components/content_relationship_verification/android/java/src/org/chromium/components/content_relationship_verification/OriginVerifier.java
 --- a/components/content_relationship_verification/android/java/src/org/chromium/components/content_relationship_verification/OriginVerifier.java
 +++ b/components/content_relationship_verification/android/java/src/org/chromium/components/content_relationship_verification/OriginVerifier.java
-@@ -181,6 +181,11 @@ public abstract class OriginVerifier {
+@@ -180,6 +180,11 @@ public abstract class OriginVerifier {
          assert mNativeOriginVerifier != 0
                  : "Either provide a browserContextHandle to "
                          + "OriginVerifier#ctor or call initNativeOriginVerifier.";
@@ -420,9 +347,9 @@ diff --git a/components/content_relationship_verification/android/java/src/org/c
 diff --git a/components/language/core/common/language_experiments.cc b/components/language/core/common/language_experiments.cc
 --- a/components/language/core/common/language_experiments.cc
 +++ b/components/language/core/common/language_experiments.cc
-@@ -26,4 +26,5 @@ BASE_FEATURE(kDisableGeoLanguageModel,
-              "DisableGeoLanguageModel",
-              base::FEATURE_DISABLED_BY_DEFAULT);
+@@ -32,4 +32,5 @@ BASE_FEATURE(kDisableGeoLanguageModel,
+ // Params:
+ const char kContentLanguagesDisableObserversParam[] = "disable_observers";
  
 +SET_CROMITE_FEATURE_DISABLED(kCctAutoTranslate);
  }  // namespace language
@@ -431,5 +358,5 @@ new file mode 100644
 --- /dev/null
 +++ b/cromite_flags/chrome/browser/flags/android/chrome_feature_list_cc/add-custom-tab-intents-privacy-option.inc
 @@ -0,0 +1 @@
-+// explicitly empty
++SET_CROMITE_FEATURE_DISABLED(kCCTIntentFeatureOverrides);
 --

build/patches/Add-exit-menu-item.patch

@@ -6,58 +6,69 @@ Corrected Exit functionality
 
 License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 ---
- chrome/android/java/res/values/ids.xml                     | 1 +
- .../org/chromium/chrome/browser/ChromeTabbedActivity.java  | 4 ++++
- .../org/chromium/chrome/browser/app/ChromeActivity.java    | 6 ++++++
- .../chrome/browser/init/ChromeLifetimeController.java      | 2 ++
- .../tabbed_mode/TabbedAppMenuPropertiesDelegate.java       | 7 +++++++
- .../browser/ui/android/strings/android_chrome_strings.grd  | 3 +++
- 6 files changed, 23 insertions(+)
+ chrome/android/java/res/menu/main_menu.xml                  | 6 ++++++
+ .../org/chromium/chrome/browser/ChromeTabbedActivity.java   | 4 ++++
+ .../src/org/chromium/chrome/browser/app/ChromeActivity.java | 6 ++++++
+ .../chrome/browser/init/ChromeLifetimeController.java       | 2 ++
+ .../browser/ui/android/strings/android_chrome_strings.grd   | 3 +++
+ 5 files changed, 21 insertions(+)
 
-diff --git a/chrome/android/java/res/values/ids.xml b/chrome/android/java/res/values/ids.xml
---- a/chrome/android/java/res/values/ids.xml
-+++ b/chrome/android/java/res/values/ids.xml
-@@ -119,6 +119,7 @@ found in the LICENSE file.
-     <item type="id" name="ntp_feed_header_menu_item_toggle_switch" />
+diff --git a/chrome/android/java/res/menu/main_menu.xml b/chrome/android/java/res/menu/main_menu.xml
+--- a/chrome/android/java/res/menu/main_menu.xml
++++ b/chrome/android/java/res/menu/main_menu.xml
+@@ -166,6 +166,9 @@ found in the LICENSE file.
+         <item android:id="@+id/managed_by_menu_id"
+             android:title="@string/managed_browser"
+             android:icon="@drawable/ic_business" />
++        <item android:id="@+id/exit_id"
++            android:title="@string/menu_exit"
++            android:icon="@drawable/ic_exit_to_app_white_24dp" />
+     </group>
  
-     <!-- App Menu -->
-+    <item type="id" name="exit_id" />
-     <item type="id" name="icon_row_menu_id" />
-     <item type="id" name="forward_menu_id" />
-     <item type="id" name="bookmark_this_page_id" />
+     <!-- Items shown only in the tab switcher -->
+@@ -195,6 +198,9 @@ found in the LICENSE file.
+         <item android:id="@id/preferences_id"
+             android:title="@string/menu_settings"
+             android:icon="@drawable/settings_cog" />
++        <item android:id="@+id/exit_id"
++            android:title="@string/menu_exit"
++            android:icon="@drawable/ic_exit_to_app_white_24dp" />
+     </group>
+ 
+     <!-- Items shown only when the tablet has no visible tabs -->
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java b/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java
-@@ -345,6 +345,8 @@ import java.util.Map;
- import java.util.Set;
+@@ -293,6 +293,8 @@ import java.util.Set;
  import java.util.concurrent.atomic.AtomicBoolean;
+ import java.util.function.DoubleConsumer;
  
 +import org.chromium.chrome.browser.lifetime.ApplicationLifetime;
 +
  /**
   * This is the main activity for ChromeMobile when not running in document mode. All the tabs are
   * accessible via a chrome specific tab switching UI.
-@@ -3692,6 +3694,8 @@ public class ChromeTabbedActivity extends ChromeActivity {
+@@ -3021,6 +3023,8 @@ public class ChromeTabbedActivity extends ChromeActivity implements MismatchedIn
                      .closeTabs(
                              TabClosureParams.closeTab(currentTab).build(), /* allowDialog= */ true);
              RecordUserAction.record("MobileTabClosed");
 +        } else if (id == R.id.exit_id) {
 +            ApplicationLifetime.terminate(false);
          } else if (id == R.id.close_all_tabs_menu_id) {
-             boolean allowUndo = TabClosureParamsUtils.shouldAllowUndo(triggeringMotion);
- 
+             // Close both incognito and normal tabs.
+             Runnable closeAllTabsRunnable =
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/app/ChromeActivity.java b/chrome/android/java/src/org/chromium/chrome/browser/app/ChromeActivity.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/app/ChromeActivity.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/app/ChromeActivity.java
-@@ -59,6 +59,7 @@ import org.chromium.base.supplier.UnownedUserDataSupplier;
- import org.chromium.chrome.R;
+@@ -60,6 +60,7 @@ import org.chromium.chrome.R;
  import org.chromium.chrome.browser.ActivityTabProvider;
  import org.chromium.chrome.browser.ActivityUtils;
+ import org.chromium.chrome.browser.AppHooks;
 +import org.chromium.chrome.browser.lifetime.ApplicationLifetime;
  import org.chromium.chrome.browser.ChromeActivitySessionTracker;
  import org.chromium.chrome.browser.ChromeApplicationImpl;
  import org.chromium.chrome.browser.ChromeKeyboardVisibilityDelegate;
-@@ -2445,6 +2446,11 @@ public abstract class ChromeActivity extends AsyncInitializationActivity
+@@ -2374,6 +2375,11 @@ public abstract class ChromeActivity extends AsyncInitializationActivity
              return true;
          }
  
@@ -72,15 +83,15 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/app/ChromeActiv
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/init/ChromeLifetimeController.java b/chrome/android/java/src/org/chromium/chrome/browser/init/ChromeLifetimeController.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/init/ChromeLifetimeController.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/init/ChromeLifetimeController.java
-@@ -20,6 +20,7 @@ import org.chromium.build.annotations.MonotonicNonNull;
- import org.chromium.build.annotations.NullMarked;
+@@ -18,6 +18,7 @@ import org.chromium.base.ContextUtils;
+ import org.chromium.base.ThreadUtils;
  import org.chromium.chrome.browser.BrowserRestartActivity;
  import org.chromium.chrome.browser.lifetime.ApplicationLifetime;
 +import org.chromium.chrome.browser.incognito.IncognitoNotificationManager;
  
  /**
   * Answers requests to kill and (potentially) restart Chrome's main browser process.
-@@ -76,6 +77,7 @@ class ChromeLifetimeController
+@@ -73,6 +74,7 @@ class ChromeLifetimeController
  
      @Override
      public void onTerminate(boolean restart) {
@@ -88,27 +99,10 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/init/ChromeLife
          mRestartChromeOnDestroy = restart;
  
          // Tell all Chrome Activities to finish themselves.
-diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedAppMenuPropertiesDelegate.java b/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedAppMenuPropertiesDelegate.java
---- a/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedAppMenuPropertiesDelegate.java
-+++ b/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedAppMenuPropertiesDelegate.java
-@@ -384,6 +384,13 @@ public class TabbedAppMenuPropertiesDelegate extends AppMenuPropertiesDelegateIm
-             maybeAddDividerLine(modelList, R.id.menu_item_content_filter_divider_line_id);
-             modelList.add(buildContentFilterHelpCenterMenuItem(currentTab));
-         }
-+
-+        modelList.add(new MVCListAdapter.ListItem(
-+                AppMenuHandler.AppMenuItemType.STANDARD,
-+                buildModelForStandardMenuItem(
-+                        R.id.exit_id,
-+                        R.string.menu_exit,
-+                        shouldShowIconBeforeItem() ? R.drawable.ic_exit_to_app_white_24dp : 0)));
-     }
- 
-     private Runnable buildUpdateStateChangedObserver() {
 diff --git a/chrome/browser/ui/android/strings/android_chrome_strings.grd b/chrome/browser/ui/android/strings/android_chrome_strings.grd
 --- a/chrome/browser/ui/android/strings/android_chrome_strings.grd
 +++ b/chrome/browser/ui/android/strings/android_chrome_strings.grd
-@@ -4347,6 +4347,9 @@ To change this setting, <ph name="BEGIN_LINK">BEGIN_LINK</ph>delete the Chrome d
+@@ -4345,6 +4345,9 @@ To change this setting, <ph name="BEGIN_LINK">BEGIN_LINK</ph>delete the Chrome d
        <message name="IDS_MENU_AUTO_DARK_WEB_CONTENTS" desc="Menu item in Chrome's overflow/options menu. When Chrome's browser UI is set to dark theme and this option is checked, sites will have a dark theme automatically applied as well. [CHAR_LIMIT=24]">
          Dark theme
        </message>

build/patches/Add-flag-for-omnibox-autocomplete-filtering.patch

@@ -18,7 +18,7 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 diff --git a/components/omnibox/browser/autocomplete_controller.cc b/components/omnibox/browser/autocomplete_controller.cc
 --- a/components/omnibox/browser/autocomplete_controller.cc
 +++ b/components/omnibox/browser/autocomplete_controller.cc
-@@ -23,6 +23,7 @@
+@@ -22,6 +22,7 @@
  
  #include "base/check_op.h"
  #include "base/containers/contains.h"
@@ -26,7 +26,7 @@ diff --git a/components/omnibox/browser/autocomplete_controller.cc b/components/
  #include "base/feature_list.h"
  #include "base/format_macros.h"
  #include "base/functional/bind.h"
-@@ -569,6 +570,15 @@ AutocompleteController::AutocompleteController(
+@@ -540,6 +541,15 @@ AutocompleteController::AutocompleteController(
            provider_client_->GetOmniboxTriggeredFeatureService()),
        steady_state_omnibox_position_(
            metrics::OmniboxEventProto::UNKNOWN_POSITION) {
@@ -45,7 +45,7 @@ diff --git a/components/omnibox/browser/autocomplete_controller.cc b/components/
 diff --git a/components/omnibox/browser/history_url_provider.cc b/components/omnibox/browser/history_url_provider.cc
 --- a/components/omnibox/browser/history_url_provider.cc
 +++ b/components/omnibox/browser/history_url_provider.cc
-@@ -488,6 +488,9 @@ void HistoryURLProvider::Start(const AutocompleteInput& input,
+@@ -489,6 +489,9 @@ void HistoryURLProvider::Start(const AutocompleteInput& input,
    if (fixed_up_input.type() != metrics::OmniboxInputType::QUERY)
      matches_.push_back(what_you_typed_match);
  
@@ -58,7 +58,7 @@ diff --git a/components/omnibox/browser/history_url_provider.cc b/components/omn
 diff --git a/components/omnibox/browser/search_provider.cc b/components/omnibox/browser/search_provider.cc
 --- a/components/omnibox/browser/search_provider.cc
 +++ b/components/omnibox/browser/search_provider.cc
-@@ -17,6 +17,7 @@
+@@ -14,6 +14,7 @@
  #include "base/base64.h"
  #include "base/feature_list.h"
  #include "base/functional/bind.h"
@@ -66,7 +66,7 @@ diff --git a/components/omnibox/browser/search_provider.cc b/components/omnibox/
  #include "base/functional/callback.h"
  #include "base/i18n/break_iterator.h"
  #include "base/i18n/case_conversion.h"
-@@ -632,6 +633,9 @@ void SearchProvider::Run(bool query_is_private) {
+@@ -629,6 +630,9 @@ void SearchProvider::Run(bool query_is_private) {
  }
  
  void SearchProvider::DoHistoryQuery(bool minimal_changes) {
@@ -88,7 +88,7 @@ diff --git a/components/url_formatter/url_fixer.cc b/components/url_formatter/ur
  #include "base/files/file_path.h"
  #include "base/files/file_util.h"
  #include "base/i18n/char_iterator.h"
-@@ -648,6 +650,8 @@ GURL FixupURLInternal(const std::string& text,
+@@ -655,6 +657,8 @@ GURL FixupURLInternal(const std::string& text,
  
      FixupHost(trimmed, parts.host, parts.scheme.is_valid(), desired_tld, &url);
      if (chrome_url && !parts.host.is_valid()) {

build/patches/Add-flag-to-configure-maximum-connections-per-host.patch

@@ -103,7 +103,7 @@ diff --git a/net/socket/client_socket_pool_manager.cc b/net/socket/client_socket
  #include "net/ssl/ssl_config.h"
  #include "url/gurl.h"
  #include "url/scheme_host_port.h"
-@@ -186,6 +190,19 @@ void ClientSocketPoolManager::set_max_sockets_per_pool(
+@@ -161,6 +165,19 @@ void ClientSocketPoolManager::set_max_sockets_per_pool(
  int ClientSocketPoolManager::max_sockets_per_group(
      HttpNetworkSession::SocketPoolType pool_type) {
    DCHECK_LT(pool_type, HttpNetworkSession::NUM_SOCKET_POOL_TYPES);

build/patches/Add-flag-to-disable-IPv6-probes.patch

@@ -45,18 +45,18 @@ new file mode 100644
 diff --git a/net/BUILD.gn b/net/BUILD.gn
 --- a/net/BUILD.gn
 +++ b/net/BUILD.gn
-@@ -1157,6 +1157,7 @@ component("net") {
-     ":net_deps",
+@@ -1118,6 +1118,7 @@ component("net") {
+     "//build:chromeos_buildflags",
      "//components/miracle_parameter/common",
      "//components/network_time/time_tracker",
 +    "//components/network_session_configurator/common",
      "//net/http:transport_security_state_generated_files",
-     "//third_party/simdutf",
+     "//third_party/simdutf:simdutf",
    ]
 diff --git a/net/dns/host_resolver_manager.cc b/net/dns/host_resolver_manager.cc
 --- a/net/dns/host_resolver_manager.cc
 +++ b/net/dns/host_resolver_manager.cc
-@@ -115,6 +115,7 @@
+@@ -114,6 +114,7 @@
  #include "net/log/net_log_event_type.h"
  #include "net/log/net_log_source.h"
  #include "net/log/net_log_source_type.h"
@@ -64,7 +64,7 @@ diff --git a/net/dns/host_resolver_manager.cc b/net/dns/host_resolver_manager.cc
  #include "net/log/net_log_with_source.h"
  #include "net/socket/client_socket_factory.h"
  #include "net/url_request/url_request_context.h"
-@@ -1497,6 +1498,13 @@ int HostResolverManager::StartIPv6ReachabilityCheck(
+@@ -1425,6 +1426,13 @@ int HostResolverManager::StartIPv6ReachabilityCheck(
      return OK;
    }
  

build/patches/Add-flag-to-disable-external-intent-requests.patch

@@ -32,7 +32,7 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 diff --git a/chrome/android/java/res/xml/privacy_preferences.xml b/chrome/android/java/res/xml/privacy_preferences.xml
 --- a/chrome/android/java/res/xml/privacy_preferences.xml
 +++ b/chrome/android/java/res/xml/privacy_preferences.xml
-@@ -77,7 +77,12 @@ found in the LICENSE file.
+@@ -81,7 +81,12 @@ found in the LICENSE file.
          android:title="@string/settings_incognito_tab_lock_title"
          android:summary="@string/settings_incognito_tab_lock_summary_android_setting_off"
          android:persistent="false" />
@@ -45,7 +45,7 @@ diff --git a/chrome/android/java/res/xml/privacy_preferences.xml b/chrome/androi
 +        app:needRestart="false" />
      <PreferenceCategory
          android:key="security_section"
-       android:title="@string/security_section_title" />
+         android:title="@string/security_section_title" />
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabDelegateFactory.java b/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabDelegateFactory.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabDelegateFactory.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabDelegateFactory.java
@@ -57,7 +57,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/customtabs/Cust
  import org.chromium.chrome.browser.fullscreen.BrowserControlsManager;
  import org.chromium.chrome.browser.fullscreen.FullscreenManager;
  import org.chromium.chrome.browser.init.ChromeActivityNativeDelegate;
-@@ -128,6 +129,7 @@ public class CustomTabDelegateFactory implements TabDelegateFactory {
+@@ -133,6 +134,7 @@ public class CustomTabDelegateFactory implements TabDelegateFactory {
  
          @Override
          public boolean shouldDisableAllExternalIntents() {
@@ -68,15 +68,15 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/customtabs/Cust
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/externalnav/ExternalNavigationDelegateImpl.java b/chrome/android/java/src/org/chromium/chrome/browser/externalnav/ExternalNavigationDelegateImpl.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/externalnav/ExternalNavigationDelegateImpl.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/externalnav/ExternalNavigationDelegateImpl.java
-@@ -26,6 +26,7 @@ import org.chromium.base.supplier.Supplier;
- import org.chromium.build.annotations.NullMarked;
- import org.chromium.build.annotations.Nullable;
+@@ -20,6 +20,7 @@ import org.chromium.base.IntentUtils;
+ import org.chromium.base.PackageManagerUtils;
+ import org.chromium.base.supplier.Supplier;
  import org.chromium.chrome.browser.ChromeTabbedActivity2;
 +import org.chromium.chrome.browser.flags.cromite.sAllowExternalIntentRequests;
  import org.chromium.chrome.browser.IntentHandler;
- import org.chromium.chrome.browser.browserservices.intents.WebappConstants;
- import org.chromium.chrome.browser.document.ChromeLauncherActivity;
-@@ -117,7 +118,8 @@ public class ExternalNavigationDelegateImpl implements ExternalNavigationDelegat
+ import org.chromium.chrome.browser.password_manager.CctPasswordSavingMetricsRecorderBridge;
+ import org.chromium.chrome.browser.safe_browsing.SafeBrowsingBridge;
+@@ -107,7 +108,8 @@ public class ExternalNavigationDelegateImpl implements ExternalNavigationDelegat
  
      @Override
      public boolean shouldDisableExternalIntentRequestsForUrl(GURL url) {
@@ -141,17 +141,17 @@ new file mode 100644
 diff --git a/components/external_intents/android/external_intents_features.cc b/components/external_intents/android/external_intents_features.cc
 --- a/components/external_intents/android/external_intents_features.cc
 +++ b/components/external_intents/android/external_intents_features.cc
-@@ -29,7 +29,6 @@ const base::Feature* const kFeaturesExposedToJava[] = {
-     &kNavigationCaptureRefactorAndroid,  &kAuxiliaryNavigationStaysInBrowser,
-     &kReparentTopLevelNavigationFromPWA, &kReparentAuxiliaryNavigationFromPWA,
-     &kAuxiliaryNavigationStaysInPWA};
+@@ -27,7 +27,6 @@ namespace {
+ const base::Feature* const kFeaturesExposedToJava[] = {
+     &kExternalNavigationDebugLogs, &kBlockFrameRenavigations,
+     &kBlockIntentsToSelf, &kTrustedClientGestureBypass};
 -
  }  // namespace
  
  // Alphabetical:
-@@ -62,7 +61,13 @@ BASE_FEATURE(kAuxiliaryNavigationStaysInPWA,
-              "AuxiliaryNavigationStaysInPWA",
-              base::FEATURE_DISABLED_BY_DEFAULT);
+@@ -48,7 +47,13 @@ BASE_FEATURE(kTrustedClientGestureBypass,
+              "TrustedClientGestureBypass",
+              base::FEATURE_ENABLED_BY_DEFAULT);
  
 +CROMITE_FEATURE(kIntentBlockExternalFormRedirectsNoGesture,
 +                "IntentBlockExternalFormRedirectsNoGesture",
@@ -177,23 +177,23 @@ diff --git a/components/external_intents/android/external_intents_features.h b/c
 diff --git a/components/external_intents/android/java/src/org/chromium/components/external_intents/ExternalIntentsFeatures.java b/components/external_intents/android/java/src/org/chromium/components/external_intents/ExternalIntentsFeatures.java
 --- a/components/external_intents/android/java/src/org/chromium/components/external_intents/ExternalIntentsFeatures.java
 +++ b/components/external_intents/android/java/src/org/chromium/components/external_intents/ExternalIntentsFeatures.java
-@@ -19,6 +19,12 @@ import org.chromium.build.annotations.NullMarked;
+@@ -18,6 +18,12 @@ import org.chromium.base.Features;
+  */
  @JNINamespace("external_intents")
- @NullMarked
- public class ExternalIntentsFeatures {
+ public class ExternalIntentsFeatures extends Features {
 +    public static final String INTENT_BLOCK_EXTERNAL_FORM_REDIRECT_NO_GESTURE_NAME =
 +            "IntentBlockExternalFormRedirectsNoGesture";
 +
-+    public static final ExternalIntentsFeature INTENT_BLOCK_EXTERNAL_FORM_REDIRECT_NO_GESTURE =
-+            new ExternalIntentsFeature(-1, INTENT_BLOCK_EXTERNAL_FORM_REDIRECT_NO_GESTURE_NAME);
++    public static final ExternalIntentsFeatures INTENT_BLOCK_EXTERNAL_FORM_REDIRECT_NO_GESTURE =
++            new ExternalIntentsFeatures(-1, INTENT_BLOCK_EXTERNAL_FORM_REDIRECT_NO_GESTURE_NAME);
 +
      public static final String EXTERNAL_NAVIGATION_DEBUG_LOGS_NAME = "ExternalNavigationDebugLogs";
+     public static final String BLOCK_FRAME_RENAVIGATIONS_NAME = "BlockFrameRenavigations3";
      public static final String BLOCK_INTENTS_TO_SELF_NAME = "BlockIntentsToSelf";
-     public static final String NAVIGATION_CAPTURE_REFACTOR_ANDROID_NAME =
 diff --git a/components/external_intents/android/java/src/org/chromium/components/external_intents/ExternalNavigationHandler.java b/components/external_intents/android/java/src/org/chromium/components/external_intents/ExternalNavigationHandler.java
 --- a/components/external_intents/android/java/src/org/chromium/components/external_intents/ExternalNavigationHandler.java
 +++ b/components/external_intents/android/java/src/org/chromium/components/external_intents/ExternalNavigationHandler.java
-@@ -1558,6 +1558,12 @@ public class ExternalNavigationHandler {
+@@ -1529,6 +1529,12 @@ public class ExternalNavigationHandler {
                  || ignoreBackForwardNav(params);
      }
  
@@ -206,7 +206,7 @@ diff --git a/components/external_intents/android/java/src/org/chromium/component
      private OverrideUrlLoadingResult shouldOverrideUrlLoadingInternal(
              ExternalNavigationParams params,
              Intent targetIntent,
-@@ -1626,6 +1632,21 @@ public class ExternalNavigationHandler {
+@@ -1585,6 +1591,21 @@ public class ExternalNavigationHandler {
              return OverrideUrlLoadingResult.forNoOverride();
          }
  

build/patches/Add-flag-to-disable-vibration.patch

@@ -20,7 +20,7 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 diff --git a/content/child/runtime_features.cc b/content/child/runtime_features.cc
 --- a/content/child/runtime_features.cc
 +++ b/content/child/runtime_features.cc
-@@ -105,6 +105,7 @@ void SetRuntimeFeatureDefaultsForPlatform(
+@@ -104,6 +104,7 @@ void SetRuntimeFeatureDefaultsForPlatform(
    if (command_line.HasSwitch(switches::kDisableMediaSessionAPI)) {
      WebRuntimeFeatures::EnableMediaSession(false);
    }
@@ -59,14 +59,14 @@ new file mode 100644
 diff --git a/third_party/blink/public/platform/web_runtime_features.h b/third_party/blink/public/platform/web_runtime_features.h
 --- a/third_party/blink/public/platform/web_runtime_features.h
 +++ b/third_party/blink/public/platform/web_runtime_features.h
-@@ -70,6 +70,7 @@ class BLINK_PLATFORM_EXPORT WebRuntimeFeatures : public WebRuntimeFeaturesBase {
+@@ -71,6 +71,7 @@ class BLINK_PLATFORM_EXPORT WebRuntimeFeatures : public WebRuntimeFeaturesBase {
    static void EnableFingerprintingCanvasImageDataNoise(bool);
    static void EnableFluentScrollbars(bool);
    static void EnableFluentOverlayScrollbars(bool);
 +  static void EnableVibration(bool);
  
-   static void EnableLocalNetworkAccessWebRTC(bool);
- 
+   WebRuntimeFeatures() = delete;
+ };
 diff --git a/third_party/blink/renderer/modules/vibration/vibration_controller.cc b/third_party/blink/renderer/modules/vibration/vibration_controller.cc
 --- a/third_party/blink/renderer/modules/vibration/vibration_controller.cc
 +++ b/third_party/blink/renderer/modules/vibration/vibration_controller.cc
@@ -104,7 +104,7 @@ diff --git a/third_party/blink/renderer/platform/exported/web_runtime_features.c
 diff --git a/third_party/blink/renderer/platform/runtime_enabled_features.json5 b/third_party/blink/renderer/platform/runtime_enabled_features.json5
 --- a/third_party/blink/renderer/platform/runtime_enabled_features.json5
 +++ b/third_party/blink/renderer/platform/runtime_enabled_features.json5
-@@ -1011,6 +1011,10 @@
+@@ -858,6 +858,10 @@
      {
        name: "CompositingDecisionAtAnimationPhaseBoundaries"
      },

build/patches/Add-kill-switch-for-unsupported-clangd-flags.patch

@@ -7,61 +7,44 @@ Allows build with clangd by suppressing unsupported parameters
 Original License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 ---
- build/config/compiler/BUILD.gn | 14 +++++++++++---
+ build/config/compiler/BUILD.gn | 11 ++++++++++-
  build_overrides/build.gni      |  3 +++
- 2 files changed, 14 insertions(+), 3 deletions(-)
+ 2 files changed, 13 insertions(+), 1 deletion(-)
 
 diff --git a/build/config/compiler/BUILD.gn b/build/config/compiler/BUILD.gn
 --- a/build/config/compiler/BUILD.gn
 +++ b/build/config/compiler/BUILD.gn
-@@ -700,7 +700,7 @@ config("compiler") {
-     # TODO(crbug.com/376278218): This causes segfault on Linux ARM builds.
-     # It also causes segfault on Linux s390x:
-     # https://github.com/llvm/llvm-project/issues/149511
--    if (is_linux && use_lld && !llvm_android_mainline && current_cpu != "arm" &&
-+    if (is_linux && !skip_clangd_unsupported_options && use_lld && !llvm_android_mainline && current_cpu != "arm" &&
-         current_cpu != "s390x" &&
-         default_toolchain != "//build/toolchain/cros:target") {
-       cflags += [ "-Wa,--crel,--allow-experimental-crel" ]
-@@ -1813,7 +1813,7 @@ config("clang_revision") {
- # e.g. by setting in the the project's .gn file.
- config("clang_warning_suppression") {
-   # Some build configs use older versions of clang that don't support WSMs
--  if (use_clang_warning_suppression_file) {
-+  if (use_clang_warning_suppression_file && !skip_clangd_unsupported_options) {
-     from_build_root =
-         rebase_path(clang_warning_suppression_file, root_build_dir)
-     inputs = [ clang_warning_suppression_file ]
-@@ -2146,7 +2146,6 @@ config("default_warnings") {
-       # TODO(crbug.com/376641662): Fix and re-enable.
-       "-Wno-nontrivial-memcall",
-     ]
--
-     cflags_cc += [
-       # TODO(crbug.com/328490295): Fix and re-enable for C flags.
-       "-Wenum-compare-conditional",
-@@ -2211,6 +2210,15 @@ config("default_warnings") {
+@@ -1974,7 +1974,6 @@ config("default_warnings") {
+         # TODO(crbug.com/40284799): Fix and re-enable.
+         "-Wno-thread-safety-reference-return",
        ]
+-
+       cflags_cc += [
+         # TODO(crbug.com/328490295): Fix and re-enable for C flags.
+         "-Wenum-compare-conditional",
+@@ -1992,6 +1991,16 @@ config("default_warnings") {
+         # TODO(crbug.com/376641662): Fix and re-enable.
+         cflags += [ "-Wno-nontrivial-memcall" ]
+       }
++      if (skip_clangd_unsupported_options) {
++        cflags -= [
++          "-Wno-thread-safety-reference-return",
++          "-Wno-nontrivial-memcall",
++        ]
++        cflags_cc -= [
++          "-Wno-c++11-narrowing-const-reference",
++          "-Wno-missing-template-arg-list-after-template-kw",
++        ]
++      }
      }
  
-+    if (skip_clangd_unsupported_options) {
-+      cflags -= [
-+        "-Wno-thread-safety-reference-return",
-+        "-Wno-nontrivial-memcall",
-+      ]
-+      cflags_cc -= [
-+      ]
-+    }
-+
-     # Disable the GNU line marker warning when building a target with Icecc,
-     # ccache, or both. This warning appears frequently when compiling
-     # files that use GNU-style line markers with Clang and Icecc. It can
+     # Some builders, such as Cronet, use a different version of Clang than
 diff --git a/build_overrides/build.gni b/build_overrides/build.gni
 --- a/build_overrides/build.gni
 +++ b/build_overrides/build.gni
 @@ -54,6 +54,9 @@ declare_args() {
-   # Allows googletest to pretty-print various absl types.
-   gtest_enable_absl_printers = true
+   # to lack of toolchain support.
+   gtest_enable_absl_printers = !is_nacl
  
 +  # Allows clangd builds by suppressing unsupported parameters
 +  skip_clangd_unsupported_options = false

build/patches/Add-menu-item-to-bookmark-all-tabs.patch

@@ -4,49 +4,61 @@ Subject: Add menu item to bookmark all tabs
 
 License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 ---
- chrome/android/java/res/values/ids.xml        |  1 +
- .../chrome/browser/ChromeTabbedActivity.java  | 43 +++++++++++++++++++
- .../TabbedAppMenuPropertiesDelegate.java      | 15 +++++++
- .../bookmarks/android/bookmark_bridge.cc      | 42 ++++++++++++++++++
- .../bookmarks/android/bookmark_bridge.h       |  8 ++++
- .../browser/bookmarks/BookmarkBridge.java     | 41 ++++++++++++++++++
- .../browser/bookmarks/bookmark_html_writer.cc | 14 +++++-
- .../bookmarks/bookmark_parent_folder.cc       |  1 +
+ chrome/android/java/res/menu/main_menu.xml    |  7 ++
+ .../chrome/browser/ChromeTabbedActivity.java  | 24 +++++++
+ .../browser/bookmarks/BookmarkBridge.java     | 67 +++++++++++++++++++
+ .../bookmarks/android/bookmark_bridge.cc      | 42 ++++++++++++
+ .../bookmarks/android/bookmark_bridge.h       |  8 +++
+ .../browser/bookmarks/bookmark_html_writer.cc | 14 +++-
+ .../bookmark_merged_surface_service.cc        |  3 +
  .../permanent_folder_ordering_tracker.cc      |  2 +
  .../dialogs/DownloadLocationCustomView.java   |  4 +-
- .../strings/android_chrome_strings.grd        |  3 ++
+ .../strings/android_chrome_strings.grd        |  3 +
  .../bookmark_ui_operations_helper.cc          |  2 +
- components/bookmark_bar_strings.grdp          |  6 +++
- .../bookmarks/browser/bookmark_codec.cc       | 20 +++++++--
- components/bookmarks/browser/bookmark_codec.h |  7 ++-
- .../browser/bookmark_load_details.cc          | 15 +++++--
+ components/bookmark_bar_strings.grdp          |  6 ++
+ .../bookmarks/browser/bookmark_codec.cc       | 20 +++++-
+ components/bookmarks/browser/bookmark_codec.h |  7 +-
+ .../browser/bookmark_load_details.cc          | 14 +++-
  .../bookmarks/browser/bookmark_load_details.h |  2 +
  .../bookmarks/browser/bookmark_model.cc       |  3 +-
- components/bookmarks/browser/bookmark_model.h |  7 +++
- components/bookmarks/browser/bookmark_node.cc | 13 ++++++
- components/bookmarks/browser/bookmark_node.h  |  4 ++
+ components/bookmarks/browser/bookmark_model.h |  7 ++
+ components/bookmarks/browser/bookmark_node.cc | 11 +++
+ components/bookmarks/browser/bookmark_node.h  |  3 +
  .../bookmarks/browser/bookmark_storage.cc     |  2 +
- .../bookmarks/browser/bookmark_uuids.cc       |  3 ++
+ .../bookmarks/browser/bookmark_uuids.cc       |  3 +
  components/bookmarks/browser/bookmark_uuids.h |  1 +
- components/bookmarks/browser/model_loader.cc  |  9 +++-
+ components/bookmarks/browser/model_loader.cc  |  8 ++-
  .../bookmark_specifics_conversions.cc         |  1 +
- 26 files changed, 255 insertions(+), 14 deletions(-)
+ 25 files changed, 250 insertions(+), 14 deletions(-)
 
-diff --git a/chrome/android/java/res/values/ids.xml b/chrome/android/java/res/values/ids.xml
---- a/chrome/android/java/res/values/ids.xml
-+++ b/chrome/android/java/res/values/ids.xml
-@@ -180,6 +180,7 @@ found in the LICENSE file.
-     <item type="id" name="menu_select_tabs" />
-     <item type="id" name="menu_item_content_filter_divider_line_id" />
-     <item type="id" name="menu_item_content_filter_help_center_id" />
-+    <item type="id" name="bookmark_all_tabs_menu_id" />
- 
-     <!-- Custom Tabs -->
-     <item type="id" name="view_id_tag_key" />
+diff --git a/chrome/android/java/res/menu/main_menu.xml b/chrome/android/java/res/menu/main_menu.xml
+--- a/chrome/android/java/res/menu/main_menu.xml
++++ b/chrome/android/java/res/menu/main_menu.xml
+@@ -74,6 +74,10 @@ found in the LICENSE file.
+         <item android:id="@+id/all_bookmarks_menu_id"
+             android:title="@string/menu_bookmarks"
+             android:icon="@drawable/btn_star_filled" />
++        <item android:id="@+id/bookmark_all_tabs_menu_id"
++            android:title="@string/menu_bookmark_all_tabs"
++            android:titleCondensed="@string/menu_bookmark_all_tabs"
++            android:icon="@drawable/ic_folder_blue_24dp" />
+         <item android:id="@+id/recent_tabs_menu_id"
+             android:title="@string/menu_recent_tabs"
+             android:icon="@drawable/devices_black_24dp" />
+@@ -189,6 +193,9 @@ found in the LICENSE file.
+         <item android:id="@id/tinker_tank_menu_id"
+             android:title="@string/menu_tinker_tank"
+             android:icon="@drawable/ic_add_box_rounded_corner" />
++        <item android:id="@+id/bookmark_all_tabs_menu_id"
++            android:title="@string/menu_bookmark_all_tabs"
++            android:icon="@drawable/ic_folder_blue_24dp" />
+         <item android:id="@+id/menu_select_tabs"
+             android:title="@string/menu_select_tabs"
+             android:icon="@drawable/ic_select_check_box_24dp" />
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java b/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java
-@@ -103,6 +103,7 @@ import org.chromium.chrome.browser.bookmarks.BookmarkPane;
+@@ -97,6 +97,7 @@ import org.chromium.chrome.browser.bookmarks.BookmarkPane;
  import org.chromium.chrome.browser.bookmarks.BookmarkUtils;
  import org.chromium.chrome.browser.browserservices.intents.WebappConstants;
  import org.chromium.chrome.browser.compositor.CompositorViewHolder;
@@ -54,35 +66,16 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedAct
  import org.chromium.chrome.browser.compositor.layouts.Layout;
  import org.chromium.chrome.browser.compositor.layouts.LayoutManagerChrome;
  import org.chromium.chrome.browser.compositor.layouts.LayoutManagerChromePhone;
-@@ -287,6 +288,9 @@ import org.chromium.chrome.browser.ui.browser_window.ChromeAndroidTaskTrackerFac
- import org.chromium.chrome.browser.ui.desktop_windowing.AppHeaderUtils;
- import org.chromium.chrome.browser.ui.edge_to_edge.EdgeToEdgeUtils;
- import org.chromium.chrome.browser.ui.extensions.windowing.ExtensionWindowControllerBridgeFactory;
-+import org.chromium.chrome.browser.ui.messages.snackbar.Snackbar;
-+import org.chromium.chrome.browser.ui.messages.snackbar.SnackbarManager;
-+import org.chromium.chrome.browser.ui.messages.snackbar.SnackbarManager.SnackbarController;
- import org.chromium.chrome.browser.ui.searchactivityutils.SearchActivityClient;
- import org.chromium.chrome.browser.ui.searchactivityutils.SearchActivityExtras.IntentOrigin;
- import org.chromium.chrome.browser.ui.signin.BottomSheetSigninAndHistorySyncConfig;
-@@ -298,6 +302,8 @@ import org.chromium.chrome.browser.usage_stats.UsageStatsService;
- import org.chromium.chrome.browser.util.ChromeAccessibilityUtil;
- import org.chromium.chrome.browser.xr.scenecore.XrSceneCoreSessionInitializerImpl;
- import org.chromium.chrome.browser.xr.scenecore.XrSceneCoreSessionManagerImpl;
-+import org.chromium.components.bookmarks.BookmarkId;
-+import org.chromium.components.bookmarks.BookmarkItem;
- import org.chromium.components.browser_ui.bottomsheet.BottomSheetController;
- import org.chromium.components.browser_ui.edge_to_edge.SystemBarColorHelper;
- import org.chromium.components.browser_ui.edge_to_edge.TabbedSystemBarColorHelper;
-@@ -3724,6 +3730,8 @@ public class ChromeTabbedActivity extends ChromeActivity {
+@@ -3053,6 +3054,8 @@ public class ChromeTabbedActivity extends ChromeActivity implements MismatchedIn
                      getTabModelSelectorSupplier().get(),
                      closeAllTabsRunnable);
              RecordUserAction.record("MobileMenuCloseAllTabs");
 +        } else if (id == R.id.bookmark_all_tabs_menu_id) {
 +            bookmarkAllTabs();
          } else if (id == R.id.close_all_incognito_tabs_menu_id) {
-             boolean allowUndo = TabClosureParamsUtils.shouldAllowUndo(triggeringMotion);
- 
-@@ -3848,6 +3856,41 @@ public class ChromeTabbedActivity extends ChromeActivity {
+             // Close only incognito tabs
+             Runnable closeAllTabsRunnable =
+@@ -3138,6 +3141,27 @@ public class ChromeTabbedActivity extends ChromeActivity implements MismatchedIn
          getTabModalLifetimeHandler().onOmniboxFocusChanged(hasFocus);
      }
  
@@ -101,65 +94,138 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedAct
 +                if (tab.isNativePage()) {
 +                    continue;
 +                }
-+                bookmarkModel.addToTabsCollection(tab);
++                bookmarkModel.addToTabsCollection(this, tab);
 +            }
-+            BookmarkId parent = bookmarkModel.getTabsCollectionFolderId();
-+            BookmarkItem bookmarkItem = bookmarkModel.getBookmarkById(parent);
-+            String folderName = "";
-+            if (bookmarkItem != null) {
-+                folderName = bookmarkItem.getTitle();
-+            }
-+            SnackbarController snackbarController = new SnackbarController() {
-+                @Override
-+                public void onAction(Object actionData) {
-+                }
-+            };
-+            Snackbar snackbar = Snackbar.make(folderName, snackbarController, Snackbar.TYPE_ACTION,
-+                            Snackbar.UMA_BOOKMARK_ADDED)
-+                            .setTemplateText(getString(R.string.bookmark_page_saved_folder));
-+            getSnackbarManager().showSnackbar(snackbar);
++            bookmarkModel.finishedAddingToTabsCollection(this, getSnackbarManager());
 +        });
 +    }
 +
      private void recordLauncherShortcutAction(boolean isIncognito) {
          if (isIncognito) {
              RecordUserAction.record("Android.LauncherShortcut.NewIncognitoTab");
-diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedAppMenuPropertiesDelegate.java b/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedAppMenuPropertiesDelegate.java
---- a/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedAppMenuPropertiesDelegate.java
-+++ b/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedAppMenuPropertiesDelegate.java
-@@ -270,6 +270,14 @@ public class TabbedAppMenuPropertiesDelegate extends AppMenuPropertiesDelegateIm
-         // Bookmarks
-         modelList.add(buildBookmarksItem());
+diff --git a/chrome/android/java/src/org/chromium/chrome/browser/bookmarks/BookmarkBridge.java b/chrome/android/java/src/org/chromium/chrome/browser/bookmarks/BookmarkBridge.java
+--- a/chrome/android/java/src/org/chromium/chrome/browser/bookmarks/BookmarkBridge.java
++++ b/chrome/android/java/src/org/chromium/chrome/browser/bookmarks/BookmarkBridge.java
+@@ -17,6 +17,7 @@ import org.jni_zero.JniType;
+ import org.jni_zero.NativeMethods;
  
-+        // Add bookmark all item
-+        modelList.add(new MVCListAdapter.ListItem(
-+                AppMenuHandler.AppMenuItemType.STANDARD,
-+                buildModelForStandardMenuItem(
-+                        R.id.bookmark_all_tabs_menu_id,
-+                        R.string.menu_bookmark_all_tabs,
-+                        shouldShowIconBeforeItem() ? R.drawable.ic_folder_blue_24dp : 0)));
+ import org.chromium.base.ContextUtils;
++import org.chromium.base.Log;
+ import org.chromium.base.ObserverList;
+ import org.chromium.base.ThreadUtils;
+ import org.chromium.base.metrics.RecordUserAction;
+@@ -24,6 +25,11 @@ import org.chromium.base.supplier.Supplier;
+ import org.chromium.chrome.browser.partnerbookmarks.PartnerBookmark;
+ import org.chromium.chrome.browser.partnerbookmarks.PartnerBookmarksShim;
+ import org.chromium.chrome.browser.profiles.Profile;
++import org.chromium.chrome.browser.tab.Tab;
++import org.chromium.chrome.browser.ui.messages.snackbar.Snackbar;
++import org.chromium.chrome.browser.ui.messages.snackbar.SnackbarManager;
++import org.chromium.chrome.browser.ui.messages.snackbar.SnackbarManager.SnackbarController;
++import org.chromium.chrome.R;
+ import org.chromium.components.bookmarks.BookmarkId;
+ import org.chromium.components.bookmarks.BookmarkItem;
+ import org.chromium.components.bookmarks.BookmarkType;
+@@ -83,6 +89,8 @@ import org.chromium.ui.modaldialog.DialogDismissalCause;
+ class BookmarkBridge {
+     private final ObserverList<BookmarkModelObserver> mObservers = new ObserverList<>();
+ 
++    private static final String TAG = "BookmarkBridge";
 +
-         // Recent Tabs
-         if (shouldShowRecentTabsItem()) modelList.add(buildRecentTabsItem());
+     private long mNativeBookmarkBridge;
+     private Profile mProfile;
+     private boolean mIsDoingExtensiveChanges;
+@@ -411,6 +419,16 @@ class BookmarkBridge {
+         return mMobileFolderId;
+     }
  
-@@ -434,6 +442,13 @@ public class TabbedAppMenuPropertiesDelegate extends AppMenuPropertiesDelegateIm
-         }
-         modelList.add(buildCloseAllTabsItem());
-         if (shouldShowTinkerTank()) modelList.add(buildTinkerTankItem());
-+        // Add bookmark all item
-+        modelList.add(new MVCListAdapter.ListItem(
-+                AppMenuHandler.AppMenuItemType.STANDARD,
-+                buildModelForStandardMenuItem(
-+                        R.id.bookmark_all_tabs_menu_id,
-+                        R.string.menu_bookmark_all_tabs,
-+                        shouldShowIconBeforeItem() ? R.drawable.ic_folder_blue_24dp : 0)));
-         modelList.add(buildSelectTabsItem());
-         if (shouldShowQuickDeleteItem()) modelList.add(buildQuickDeleteItem());
-         modelList.add(buildSettingsItem());
++    /**
++     * @return The BookmarkId for the Tabs collecction folder node
++     */
++    public BookmarkId getTabsCollectionFolderId() {
++        ThreadUtils.assertOnUiThread();
++        assert mIsNativeBookmarkModelLoaded;
++        return BookmarkBridgeJni.get().getTabsCollectionFolderId(
++                mNativeBookmarkBridge, BookmarkBridge.this);
++    }
++
+     /** Returns Id representing the special "other" folder from bookmark model. */
+     public BookmarkId getOtherFolderId() {
+         ThreadUtils.assertOnUiThread();
+@@ -1132,6 +1150,50 @@ class BookmarkBridge {
+                 .addToReadingList(mNativeBookmarkBridge, parentId, title, url);
+     }
+ 
++    // Used to bookmark all tabs in a specific folder, created if not existing
++    public BookmarkId addToTabsCollection(Context context, Tab tab) {
++        BookmarkId parent = getTabsCollectionFolderId();
++        BookmarkId existingId = BookmarkBridgeJni.get().getBookmarkIdForTabsCollection(
++                mNativeBookmarkBridge, tab.getOriginalUrl());
++        if (existingId != null && existingId.getId() != BookmarkId.INVALID_ID) {
++            BookmarkId existingBookmarkId = new BookmarkId(existingId.getId(), BookmarkType.NORMAL);
++            BookmarkItem existingBookmark = getBookmarkById(existingBookmarkId);
++            if (parent.equals(existingBookmark.getParentId())) {
++                // bookmark already exists in the tabs collection folder
++                return existingBookmarkId;
++            }
++        }
++        BookmarkId bookmarkId =
++                addBookmark(parent, getChildCount(parent), tab.getTitle(), tab.getUrl());
++
++        if (bookmarkId == null) {
++            Log.e(TAG,
++                    "Failed to add bookmarks: parentTypeAndId %s", parent);
++        }
++        return bookmarkId;
++     }
++
++     public void finishedAddingToTabsCollection(Activity activity, SnackbarManager snackbarManager) {
++        BookmarkId parent = getTabsCollectionFolderId();
++
++        BookmarkItem bookmarkItem = getBookmarkById(parent);
++        String folderName;
++        if (bookmarkItem != null) {
++            folderName = bookmarkItem.getTitle();
++        } else {
++            folderName = "";
++        }
++        SnackbarController snackbarController = new SnackbarController() {
++            @Override
++            public void onAction(Object actionData) {
++            }
++        };
++        Snackbar snackbar = Snackbar.make(folderName, snackbarController, Snackbar.TYPE_ACTION,
++                        Snackbar.UMA_BOOKMARK_ADDED)
++                        .setTemplateText(activity.getString(R.string.bookmark_page_saved_folder));
++        snackbarManager.showSnackbar(snackbar);
++    }
++
+     /**
+      * Helper method to mark an item as read.
+      *
+@@ -1345,6 +1407,9 @@ class BookmarkBridge {
+         BookmarkId getMostRecentlyAddedUserBookmarkIdForUrl(
+                 long nativeBookmarkBridge, @JniType("GURL") GURL url);
+ 
++        BookmarkId getBookmarkIdForTabsCollection(
++                long nativeBookmarkBridge, GURL url);
++
+         BookmarkItem getBookmarkById(long nativeBookmarkBridge, long id, int type);
+ 
+         void getTopLevelFolderIds(
+@@ -1366,6 +1431,8 @@ class BookmarkBridge {
+ 
+         BookmarkId getRootFolderId(long nativeBookmarkBridge);
+ 
++        BookmarkId getTabsCollectionFolderId(long nativeBookmarkBridge, BookmarkBridge caller);
++
+         BookmarkId getMobileFolderId(long nativeBookmarkBridge);
+ 
+         BookmarkId getOtherFolderId(long nativeBookmarkBridge);
 diff --git a/chrome/browser/bookmarks/android/bookmark_bridge.cc b/chrome/browser/bookmarks/android/bookmark_bridge.cc
 --- a/chrome/browser/bookmarks/android/bookmark_bridge.cc
 +++ b/chrome/browser/bookmarks/android/bookmark_bridge.cc
-@@ -340,6 +340,33 @@ jboolean BookmarkBridge::AreAccountBookmarkFoldersActive(JNIEnv* env) {
+@@ -326,6 +326,33 @@ jboolean BookmarkBridge::AreAccountBookmarkFoldersActive(JNIEnv* env) {
    return bookmark_model_->account_mobile_node() != nullptr;
  }
  
@@ -193,7 +259,7 @@ diff --git a/chrome/browser/bookmarks/android/bookmark_bridge.cc b/chrome/browse
  base::android::ScopedJavaLocalRef<jobject>
  BookmarkBridge::GetMostRecentlyAddedUserBookmarkIdForUrl(JNIEnv* env,
                                                           const GURL& url) {
-@@ -452,6 +479,7 @@ void BookmarkBridge::GetAllFoldersWithDepths(
+@@ -438,6 +465,7 @@ void BookmarkBridge::GetAllFoldersWithDepths(
    // Vector to temporarily contain all child bookmarks at same level for sorting
    std::vector<const BookmarkNode*> bookmarks = {
        bookmark_model_->mobile_node(),
@@ -201,7 +267,7 @@ diff --git a/chrome/browser/bookmarks/android/bookmark_bridge.cc b/chrome/browse
        bookmark_model_->bookmark_bar_node(),
        bookmark_model_->other_node(),
    };
-@@ -560,6 +588,9 @@ std::vector<const BookmarkNode*> BookmarkBridge::GetTopLevelFolderIdsImpl(
+@@ -531,6 +559,9 @@ std::vector<const BookmarkNode*> BookmarkBridge::GetTopLevelFolderIdsImpl(
      top_level_folders.push_back(other_node);
    }
  
@@ -210,8 +276,8 @@ diff --git a/chrome/browser/bookmarks/android/bookmark_bridge.cc b/chrome/browse
 +
    const BookmarkNode* reading_list_node =
        local_or_syncable_reading_list_manager_->GetRoot();
-   if (IsPermanentFolderVisible(
-@@ -1237,6 +1268,17 @@ void BookmarkBridge::GetBookmarksOfType(
+   if (IsPermanentFolderVisible(ignore_visibility, reading_list_node)) {
+@@ -1256,6 +1287,17 @@ void BookmarkBridge::GetBookmarksOfType(
    AddBookmarkNodesToBookmarkIdList(env, j_list, results);
  }
  
@@ -232,7 +298,7 @@ diff --git a/chrome/browser/bookmarks/android/bookmark_bridge.cc b/chrome/browse
 diff --git a/chrome/browser/bookmarks/android/bookmark_bridge.h b/chrome/browser/bookmarks/android/bookmark_bridge.h
 --- a/chrome/browser/bookmarks/android/bookmark_bridge.h
 +++ b/chrome/browser/bookmarks/android/bookmark_bridge.h
-@@ -106,6 +106,10 @@ class BookmarkBridge : public ProfileObserver,
+@@ -79,6 +79,10 @@ class BookmarkBridge : public ProfileObserver,
  
    jboolean AreAccountBookmarkFoldersActive(JNIEnv* env);
  
@@ -243,7 +309,7 @@ diff --git a/chrome/browser/bookmarks/android/bookmark_bridge.h b/chrome/browser
    base::android::ScopedJavaLocalRef<jobject>
    GetMostRecentlyAddedUserBookmarkIdForUrl(JNIEnv* env, const GURL& url);
    const bookmarks::BookmarkNode* GetMostRecentlyAddedUserBookmarkIdForUrlImpl(
-@@ -245,6 +249,10 @@ class BookmarkBridge : public ProfileObserver,
+@@ -223,6 +227,10 @@ class BookmarkBridge : public ProfileObserver,
                            const base::android::JavaParamRef<jobject>& j_list,
                            jint type);
  
@@ -254,103 +320,10 @@ diff --git a/chrome/browser/bookmarks/android/bookmark_bridge.h b/chrome/browser
    base::android::ScopedJavaLocalRef<jobject> AddFolder(
        JNIEnv* env,
        const base::android::JavaParamRef<jobject>& j_parent_id_obj,
-diff --git a/chrome/browser/bookmarks/android/java/src/org/chromium/chrome/browser/bookmarks/BookmarkBridge.java b/chrome/browser/bookmarks/android/java/src/org/chromium/chrome/browser/bookmarks/BookmarkBridge.java
---- a/chrome/browser/bookmarks/android/java/src/org/chromium/chrome/browser/bookmarks/BookmarkBridge.java
-+++ b/chrome/browser/bookmarks/android/java/src/org/chromium/chrome/browser/bookmarks/BookmarkBridge.java
-@@ -16,6 +16,7 @@ import org.jni_zero.JniType;
- import org.jni_zero.NativeMethods;
- 
- import org.chromium.base.ContextUtils;
-+import org.chromium.base.Log;
- import org.chromium.base.ObserverList;
- import org.chromium.base.ThreadUtils;
- import org.chromium.base.metrics.RecordUserAction;
-@@ -26,6 +27,7 @@ import org.chromium.chrome.browser.partnerbookmarks.PartnerBookmarksShim;
- import org.chromium.chrome.browser.preferences.ChromePreferenceKeys;
- import org.chromium.chrome.browser.preferences.ChromeSharedPreferences;
- import org.chromium.chrome.browser.profiles.Profile;
-+import org.chromium.chrome.browser.tab.Tab;
- import org.chromium.components.bookmarks.BookmarkId;
- import org.chromium.components.bookmarks.BookmarkItem;
- import org.chromium.components.bookmarks.BookmarkType;
-@@ -47,6 +49,7 @@ import java.util.function.BiConsumer;
- class BookmarkBridge {
-     private static final OneshotSupplierImpl<BookmarkModel.PartnerBookmarkIteratorProvider>
-             sPartnerBookmarkIteratorSupplier = new OneshotSupplierImpl<>();
-+    private static final String TAG = "BookmarkBridge";
- 
-     private final ObserverList<BookmarkModelObserver> mObservers = new ObserverList<>();
-     private final Profile mProfile;
-@@ -385,6 +388,16 @@ class BookmarkBridge {
-         return mMobileFolderId;
-     }
- 
-+    /**
-+     * @return The BookmarkId for the Tabs collecction folder node
-+     */
-+    public BookmarkId getTabsCollectionFolderId() {
-+        ThreadUtils.assertOnUiThread();
-+        assert mIsNativeBookmarkModelLoaded;
-+        return BookmarkBridgeJni.get().getTabsCollectionFolderId(
-+                mNativeBookmarkBridge, BookmarkBridge.this);
-+    }
-+
-     /** Returns Id representing the special "other" folder from bookmark model. */
-     public @Nullable BookmarkId getOtherFolderId() {
-         ThreadUtils.assertOnUiThread();
-@@ -882,6 +895,29 @@ class BookmarkBridge {
-                 .addToReadingList(mNativeBookmarkBridge, parentId, title, url);
-     }
- 
-+    // Used to bookmark all tabs in a specific folder, created if not existing
-+    public BookmarkId addToTabsCollection(Tab tab) {
-+        BookmarkId parent = getTabsCollectionFolderId();
-+        BookmarkId existingId = BookmarkBridgeJni.get().getBookmarkIdForTabsCollection(
-+                mNativeBookmarkBridge, tab.getOriginalUrl());
-+        if (existingId != null && existingId.getId() != BookmarkId.INVALID_ID) {
-+            BookmarkId existingBookmarkId = new BookmarkId(existingId.getId(), BookmarkType.NORMAL);
-+            BookmarkItem existingBookmark = getBookmarkById(existingBookmarkId);
-+            if (parent.equals(existingBookmark.getParentId())) {
-+                // bookmark already exists in the tabs collection folder
-+                return existingBookmarkId;
-+            }
-+        }
-+        BookmarkId bookmarkId =
-+                addBookmark(parent, getChildCount(parent), tab.getTitle(), tab.getUrl());
-+
-+        if (bookmarkId == null) {
-+            Log.e(TAG,
-+                    "Failed to add bookmarks: parentTypeAndId %s", parent);
-+        }
-+        return bookmarkId;
-+     }
-+
-     /**
-      * Helper method to mark an item as read.
-      *
-@@ -1099,6 +1135,9 @@ class BookmarkBridge {
-         BookmarkId getMostRecentlyAddedUserBookmarkIdForUrl(
-                 long nativeBookmarkBridge, @JniType("GURL") GURL url);
- 
-+        BookmarkId getBookmarkIdForTabsCollection(
-+                long nativeBookmarkBridge, GURL url);
-+
-         BookmarkItem getBookmarkById(long nativeBookmarkBridge, long id, int type);
- 
-         void getTopLevelFolderIds(
-@@ -1120,6 +1159,8 @@ class BookmarkBridge {
- 
-         BookmarkId getRootFolderId(long nativeBookmarkBridge);
- 
-+        BookmarkId getTabsCollectionFolderId(long nativeBookmarkBridge, BookmarkBridge caller);
-+
-         BookmarkId getMobileFolderId(long nativeBookmarkBridge);
- 
-         BookmarkId getOtherFolderId(long nativeBookmarkBridge);
 diff --git a/chrome/browser/bookmarks/bookmark_html_writer.cc b/chrome/browser/bookmarks/bookmark_html_writer.cc
 --- a/chrome/browser/bookmarks/bookmark_html_writer.cc
 +++ b/chrome/browser/bookmarks/bookmark_html_writer.cc
-@@ -169,14 +169,15 @@ class Writer : public base::RefCountedThreadSafe<Writer> {
+@@ -173,14 +173,15 @@ class Writer : public base::RefCountedThreadSafe<Writer> {
      BookmarkCodec codec;
      local_bookmarks_ =
          codec.Encode(model->bookmark_bar_node(), model->other_node(),
@@ -368,7 +341,7 @@ diff --git a/chrome/browser/bookmarks/bookmark_html_writer.cc b/chrome/browser/b
      } else {
        CHECK(!model->account_other_node());
        CHECK(!model->account_mobile_node());
-@@ -210,6 +211,9 @@ class Writer : public base::RefCountedThreadSafe<Writer> {
+@@ -214,6 +215,9 @@ class Writer : public base::RefCountedThreadSafe<Writer> {
      base::Value::Dict* mobile_folder_value = local_permanent_folders->FindDict(
          BookmarkCodec::kMobileBookmarkFolderNameKey);
      CHECK(mobile_folder_value);
@@ -378,7 +351,7 @@ diff --git a/chrome/browser/bookmarks/bookmark_html_writer.cc b/chrome/browser/b
  
      base::Value::Dict* account_permanent_folders =
          account_bookmarks_.FindDict(BookmarkCodec::kRootsKey);
-@@ -285,6 +289,10 @@ class Writer : public base::RefCountedThreadSafe<Writer> {
+@@ -289,6 +293,10 @@ class Writer : public base::RefCountedThreadSafe<Writer> {
        return bookmark_html_writer::Result::kCouldNotWriteNodes;
      }
  
@@ -389,7 +362,7 @@ diff --git a/chrome/browser/bookmarks/bookmark_html_writer.cc b/chrome/browser/b
      DecrementIndent();
  
      if (!Write(kFolderChildrenEnd) || !Write(kNewline)) {
-@@ -431,6 +439,7 @@ class Writer : public base::RefCountedThreadSafe<Writer> {
+@@ -435,6 +443,7 @@ class Writer : public base::RefCountedThreadSafe<Writer> {
        case BookmarkNode::URL:
        case BookmarkNode::OTHER_NODE:
        case BookmarkNode::MOBILE:
@@ -397,7 +370,7 @@ diff --git a/chrome/browser/bookmarks/bookmark_html_writer.cc b/chrome/browser/b
          NOTREACHED();
      }
  
-@@ -559,6 +568,7 @@ void BookmarkFaviconFetcher::ExportBookmarks() {
+@@ -563,6 +572,7 @@ void BookmarkFaviconFetcher::ExportBookmarks() {
    ExtractUrls(model->bookmark_bar_node());
    ExtractUrls(model->other_node());
    ExtractUrls(model->mobile_node());
@@ -405,21 +378,30 @@ diff --git a/chrome/browser/bookmarks/bookmark_html_writer.cc b/chrome/browser/b
  
    if (model->account_bookmark_bar_node()) {
      CHECK(model->account_other_node());
-diff --git a/chrome/browser/bookmarks/bookmark_parent_folder.cc b/chrome/browser/bookmarks/bookmark_parent_folder.cc
---- a/chrome/browser/bookmarks/bookmark_parent_folder.cc
-+++ b/chrome/browser/bookmarks/bookmark_parent_folder.cc
-@@ -18,6 +18,7 @@ BookmarkParentFolder GetBookmarkParentFolderFromPermanentNode(
-   CHECK(node->is_permanent_node());
-   switch (node->type()) {
+diff --git a/chrome/browser/bookmarks/bookmark_merged_surface_service.cc b/chrome/browser/bookmarks/bookmark_merged_surface_service.cc
+--- a/chrome/browser/bookmarks/bookmark_merged_surface_service.cc
++++ b/chrome/browser/bookmarks/bookmark_merged_surface_service.cc
+@@ -29,6 +29,7 @@ BookmarkParentFolder GetBookmarkParentFolderFromPermanentType(
+     BookmarkNode::Type type) {
+   switch (type) {
      case bookmarks::BookmarkNode::URL:
 +    case bookmarks::BookmarkNode::TABS_COLLECTION:
        NOTREACHED();
      case bookmarks::BookmarkNode::FOLDER:
        // TODO(crbug.com/381252292): Consider extending type with a value
+@@ -67,6 +68,8 @@ std::optional<PermanentFolderType> GetIfPermanentFolderType(
+ 
+     case BookmarkNode::Type::URL:
+       NOTREACHED();
++    case BookmarkNode::Type::TABS_COLLECTION:
++      NOTREACHED();
+   }
+   NOTREACHED();
+ }
 diff --git a/chrome/browser/bookmarks/permanent_folder_ordering_tracker.cc b/chrome/browser/bookmarks/permanent_folder_ordering_tracker.cc
 --- a/chrome/browser/bookmarks/permanent_folder_ordering_tracker.cc
 +++ b/chrome/browser/bookmarks/permanent_folder_ordering_tracker.cc
-@@ -26,6 +26,7 @@ bool IsValidTrackedType(BookmarkNode::Type type) {
+@@ -23,6 +23,7 @@ bool IsValidTrackedType(BookmarkNode::Type type) {
    switch (type) {
      case bookmarks::BookmarkNode::URL:
      case bookmarks::BookmarkNode::FOLDER:
@@ -427,7 +409,7 @@ diff --git a/chrome/browser/bookmarks/permanent_folder_ordering_tracker.cc b/chr
        NOTREACHED();
  
      case bookmarks::BookmarkNode::BOOKMARK_BAR:
-@@ -303,6 +304,7 @@ void PermanentFolderOrderingTracker::SetTrackedPermanentNodes() {
+@@ -226,6 +227,7 @@ void PermanentFolderOrderingTracker::SetTrackedPermanentNodes() {
    switch (tracked_type_) {
      case bookmarks::BookmarkNode::URL:
      case bookmarks::BookmarkNode::FOLDER:
@@ -438,7 +420,7 @@ diff --git a/chrome/browser/bookmarks/permanent_folder_ordering_tracker.cc b/chr
 diff --git a/chrome/browser/download/android/java/src/org/chromium/chrome/browser/download/dialogs/DownloadLocationCustomView.java b/chrome/browser/download/android/java/src/org/chromium/chrome/browser/download/dialogs/DownloadLocationCustomView.java
 --- a/chrome/browser/download/android/java/src/org/chromium/chrome/browser/download/dialogs/DownloadLocationCustomView.java
 +++ b/chrome/browser/download/android/java/src/org/chromium/chrome/browser/download/dialogs/DownloadLocationCustomView.java
-@@ -88,7 +88,7 @@ public class DownloadLocationCustomView extends ScrollView
+@@ -85,7 +85,7 @@ public class DownloadLocationCustomView extends ScrollView
          mDirectoryAdapter.update();
      }
  
@@ -447,7 +429,7 @@ diff --git a/chrome/browser/download/android/java/src/org/chromium/chrome/browse
          mTitle.setText(title);
      }
  
-@@ -96,7 +96,7 @@ public class DownloadLocationCustomView extends ScrollView
+@@ -93,7 +93,7 @@ public class DownloadLocationCustomView extends ScrollView
          mSubtitleView.setText(subtitle);
      }
  
@@ -459,7 +441,7 @@ diff --git a/chrome/browser/download/android/java/src/org/chromium/chrome/browse
 diff --git a/chrome/browser/ui/android/strings/android_chrome_strings.grd b/chrome/browser/ui/android/strings/android_chrome_strings.grd
 --- a/chrome/browser/ui/android/strings/android_chrome_strings.grd
 +++ b/chrome/browser/ui/android/strings/android_chrome_strings.grd
-@@ -4482,6 +4482,9 @@ To change this setting, <ph name="BEGIN_LINK">BEGIN_LINK</ph>delete the Chrome d
+@@ -4447,6 +4447,9 @@ To change this setting, <ph name="BEGIN_LINK">BEGIN_LINK</ph>delete the Chrome d
        <message name="IDS_MENU_SELECT_TABS" desc="Menu item for bulk editing tabs. [CHAR_LIMIT=27]">
          Select tabs
        </message>
@@ -472,7 +454,7 @@ diff --git a/chrome/browser/ui/android/strings/android_chrome_strings.grd b/chro
 diff --git a/chrome/browser/ui/bookmarks/bookmark_ui_operations_helper.cc b/chrome/browser/ui/bookmarks/bookmark_ui_operations_helper.cc
 --- a/chrome/browser/ui/bookmarks/bookmark_ui_operations_helper.cc
 +++ b/chrome/browser/ui/bookmarks/bookmark_ui_operations_helper.cc
-@@ -105,6 +105,8 @@ ui::mojom::DragOperation BookmarkUIOperationsHelper::DropBookmarks(
+@@ -104,6 +104,8 @@ ui::mojom::DragOperation BookmarkUIOperationsHelper::DropBookmarks(
    if (is_reorder) {
      base::UmaHistogramEnumeration("Bookmarks.ReorderDropTarget", target);
      switch (target_parent()->GetType()) {
@@ -665,17 +647,16 @@ diff --git a/components/bookmarks/browser/bookmark_load_details.cc b/components/
  
  void UpdateUserFolderStatsRecursively(const BookmarkNode& node,
                                        bool top_level,
-@@ -63,6 +63,9 @@ BookmarkLoadDetails::BookmarkLoadDetails()
+@@ -60,6 +60,8 @@ BookmarkLoadDetails::BookmarkLoadDetails()
+       root_node_->Add(BookmarkPermanentNode::CreateOtherBookmarks(/*id=*/0)));
    mobile_folder_node_ = static_cast<BookmarkPermanentNode*>(
-       root_node_->Add(BookmarkPermanentNode::CreateMobileBookmarks(
-           /*id=*/0, /*is_account_node=*/false)));
+       root_node_->Add(BookmarkPermanentNode::CreateMobileBookmarks(/*id=*/0)));
 +  tabs_collection_folder_node_ = static_cast<BookmarkPermanentNode*>(
-+      root_node_->Add(BookmarkPermanentNode::CreateTabsCollectionBookmarks(
-+          /*id=*/0, /*is_account_node=*/false)));
++      root_node_->Add(BookmarkPermanentNode::CreateTabsCollectionBookmarks(/*id=*/0)));
  
-   // Set the nodes' `date_added` to the same time so that there is no inherent
-   // hierarchy in terms of their added time between them. This is relevant for
-@@ -119,6 +122,10 @@ void BookmarkLoadDetails::PopulateNodeIdsForLocalOrSyncablePermanentNodes() {
+   CHECK_EQ(kNumDefaultTopLevelPermanentFolders, root_node_->children().size());
+ }
+@@ -106,6 +108,10 @@ void BookmarkLoadDetails::PopulateNodeIdsForLocalOrSyncablePermanentNodes() {
    if (mobile_folder_node_->id() == 0) {
      mobile_folder_node_->set_id(max_id_++);
    }
@@ -686,7 +667,7 @@ diff --git a/components/bookmarks/browser/bookmark_load_details.cc b/components/
  }
  
  void BookmarkLoadDetails::AddManagedNode(
-@@ -131,6 +138,7 @@ void BookmarkLoadDetails::AddManagedNode(
+@@ -118,6 +124,7 @@ void BookmarkLoadDetails::AddManagedNode(
    CHECK_NE(bb_node_->id(), 0);
    CHECK_NE(other_folder_node_->id(), 0);
    CHECK_NE(mobile_folder_node_->id(), 0);
@@ -694,7 +675,7 @@ diff --git a/components/bookmarks/browser/bookmark_load_details.cc b/components/
  
    has_managed_node_ = true;
    root_node_->Add(std::move(managed_node));
-@@ -138,8 +146,8 @@ void BookmarkLoadDetails::AddManagedNode(
+@@ -125,8 +132,8 @@ void BookmarkLoadDetails::AddManagedNode(
  
  void BookmarkLoadDetails::CreateIndices() {
    local_or_syncable_uuid_index_.insert(root_node_.get());
@@ -705,7 +686,7 @@ diff --git a/components/bookmarks/browser/bookmark_load_details.cc b/components/
    for (const auto& child : root_node_->children()) {
      if (child.get() == account_bb_node_ ||
          child.get() == account_other_folder_node_ ||
-@@ -158,6 +166,7 @@ void BookmarkLoadDetails::ResetPermanentNodePointers() {
+@@ -145,6 +152,7 @@ void BookmarkLoadDetails::ResetPermanentNodePointers() {
    bb_node_ = nullptr;
    other_folder_node_ = nullptr;
    mobile_folder_node_ = nullptr;
@@ -735,16 +716,16 @@ diff --git a/components/bookmarks/browser/bookmark_load_details.h b/components/b
 diff --git a/components/bookmarks/browser/bookmark_model.cc b/components/bookmarks/browser/bookmark_model.cc
 --- a/components/bookmarks/browser/bookmark_model.cc
 +++ b/components/bookmarks/browser/bookmark_model.cc
-@@ -909,7 +909,7 @@ bool BookmarkModel::HasUserCreatedBookmarksOrFolders() const {
-          (account_bookmark_bar_node_ &&
-           !account_bookmark_bar_node_->children().empty()) ||
-          (account_other_node_ && !account_other_node_->children().empty()) ||
--         (account_mobile_node_ && !account_mobile_node_->children().empty());
-+         (account_mobile_node_ && !account_mobile_node_->children().empty() && tabs_collection_node_->children().empty());
+@@ -809,7 +809,7 @@ bool BookmarkModel::HasBookmarks() const {
+ bool BookmarkModel::HasNoUserCreatedBookmarksOrFolders() const {
+   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+   return bookmark_bar_node_->children().empty() &&
+-         other_node_->children().empty() && mobile_node_->children().empty();
++         other_node_->children().empty() && mobile_node_->children().empty() && tabs_collection_node_->children().empty();
  }
  
  bool BookmarkModel::IsBookmarked(const GURL& url) const {
-@@ -1241,6 +1241,7 @@ void BookmarkModel::DoneLoading(std::unique_ptr<BookmarkLoadDetails> details) {
+@@ -1141,6 +1141,7 @@ void BookmarkModel::DoneLoading(std::unique_ptr<BookmarkLoadDetails> details) {
    bookmark_bar_node_ = details->bb_node();
    other_node_ = details->other_folder_node();
    mobile_node_ = details->mobile_folder_node();
@@ -757,10 +738,10 @@ diff --git a/components/bookmarks/browser/bookmark_model.h b/components/bookmark
 +++ b/components/bookmarks/browser/bookmark_model.h
 @@ -150,6 +150,12 @@ class BookmarkModel : public BookmarkUndoProvider,
    // bookmarks in the account storage).
-   const BookmarkPermanentNode* account_mobile_node() const;
+   const BookmarkNode* account_mobile_node() const;
  
 +  // Returns the 'mobile' node. This is NULL until loaded.
-+  const BookmarkPermanentNode* tabs_collection_node() const {
++  const BookmarkNode* tabs_collection_node() const {
 +    DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
 +    return tabs_collection_node_;
 +  }
@@ -768,7 +749,7 @@ diff --git a/components/bookmarks/browser/bookmark_model.h b/components/bookmark
    bool is_root_node(const BookmarkNode* node) const {
      DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
      return node == root_;
-@@ -628,6 +634,7 @@ class BookmarkModel : public BookmarkUndoProvider,
+@@ -602,6 +608,7 @@ class BookmarkModel : public BookmarkUndoProvider,
    raw_ptr<BookmarkPermanentNode> account_bookmark_bar_node_ = nullptr;
    raw_ptr<BookmarkPermanentNode> account_other_node_ = nullptr;
    raw_ptr<BookmarkPermanentNode> account_mobile_node_ = nullptr;
@@ -788,19 +769,17 @@ diff --git a/components/bookmarks/browser/bookmark_node.cc b/components/bookmark
      case BookmarkNode::URL:
        NOTREACHED();
      case BookmarkNode::FOLDER:
-@@ -213,6 +215,17 @@ BookmarkPermanentNode::CreateMobileBookmarks(int64_t id,
-       is_account_node));
+@@ -211,6 +213,15 @@ BookmarkPermanentNode::CreateMobileBookmarks(int64_t id) {
+       l10n_util::GetStringUTF16(IDS_BOOKMARK_BAR_MOBILE_FOLDER_NAME)));
  }
  
 +// static
 +std::unique_ptr<BookmarkPermanentNode>
-+BookmarkPermanentNode::CreateTabsCollectionBookmarks(int64_t id,
-+                                                     bool is_account_node) {
++BookmarkPermanentNode::CreateTabsCollectionBookmarks(int64_t id) {
 +  // base::WrapUnique() used because the constructor is private.
 +  return base::WrapUnique(new BookmarkPermanentNode(
 +      id, TABS_COLLECTION, base::Uuid::ParseLowercase(kTabsCollectionBookmarksNodeUuid),
-+      l10n_util::GetStringUTF16(IDS_BOOKMARK_BAR_TABS_COLLECTION_FOLDER_NAME),
-+      is_account_node));
++      l10n_util::GetStringUTF16(IDS_BOOKMARK_BAR_TABS_COLLECTION_FOLDER_NAME)));
 +}
 +
  BookmarkPermanentNode::BookmarkPermanentNode(int64_t id,
@@ -817,13 +796,12 @@ diff --git a/components/bookmarks/browser/bookmark_node.h b/components/bookmarks
      MOBILE
    };
  
-@@ -249,6 +250,9 @@ class BookmarkPermanentNode : public BookmarkNode {
+@@ -241,6 +242,8 @@ class BookmarkPermanentNode : public BookmarkNode {
+       int64_t id);
    static std::unique_ptr<BookmarkPermanentNode> CreateMobileBookmarks(
-       int64_t id,
-       bool is_account_node);
+       int64_t id);
 +  static std::unique_ptr<BookmarkPermanentNode> CreateTabsCollectionBookmarks(
-+      int64_t id,
-+      bool is_account_node);
++      int64_t id);
  
    // Returns whether the permanent node of type `type` should be visible even
    // when it is empty (i.e. no children).
@@ -873,17 +851,16 @@ diff --git a/components/bookmarks/browser/bookmark_uuids.h b/components/bookmark
 diff --git a/components/bookmarks/browser/model_loader.cc b/components/bookmarks/browser/model_loader.cc
 --- a/components/bookmarks/browser/model_loader.cc
 +++ b/components/bookmarks/browser/model_loader.cc
-@@ -74,6 +74,9 @@ std::unique_ptr<BookmarkLoadDetails> LoadBookmarks(
+@@ -71,6 +71,8 @@ std::unique_ptr<BookmarkLoadDetails> LoadBookmarks(
+         BookmarkPermanentNode::CreateOtherBookmarks(0);
      std::unique_ptr<BookmarkPermanentNode> account_mobile_folder_node =
-         BookmarkPermanentNode::CreateMobileBookmarks(
-             0, /*is_account_node=*/true);
+         BookmarkPermanentNode::CreateMobileBookmarks(0);
 +    std::unique_ptr<BookmarkPermanentNode> tabs_collection_folder_node =
-+        BookmarkPermanentNode::CreateTabsCollectionBookmarks(
-+            0, /*is_account_node=*/true);
++        BookmarkPermanentNode::CreateTabsCollectionBookmarks(0);
  
      std::optional<base::Value::Dict> root_dict =
          LoadFileToDict(account_file_path);
-@@ -81,7 +84,8 @@ std::unique_ptr<BookmarkLoadDetails> LoadBookmarks(
+@@ -78,7 +80,8 @@ std::unique_ptr<BookmarkLoadDetails> LoadBookmarks(
      if (root_dict.has_value() &&
          codec.Decode(*root_dict, /*already_assigned_ids=*/{},
                       account_bb_node.get(), account_other_folder_node.get(),
@@ -893,7 +870,7 @@ diff --git a/components/bookmarks/browser/model_loader.cc b/components/bookmarks
                       &sync_metadata_str)) {
        ids_assigned_to_account_nodes = codec.release_assigned_ids();
  
-@@ -123,7 +127,8 @@ std::unique_ptr<BookmarkLoadDetails> LoadBookmarks(
+@@ -120,7 +123,8 @@ std::unique_ptr<BookmarkLoadDetails> LoadBookmarks(
      if (root_dict.has_value() &&
          codec.Decode(*root_dict, std::move(ids_assigned_to_account_nodes),
                       details->bb_node(), details->other_folder_node(),

build/patches/Add-menu-item-to-view-source.patch

@@ -4,30 +4,45 @@ Subject: Add menu item to view source
 
 License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 ---
- chrome/android/java/res/values/ids.xml        |  1 +
- .../chrome/browser/ChromeTabbedActivity.java  |  2 ++
- .../chrome/browser/app/ChromeActivity.java    |  5 ++++
- .../AppMenuPropertiesDelegateImpl.java        | 24 +++++++++++++++++++
- .../CustomTabAppMenuPropertiesDelegate.java   |  3 +++
- .../TabbedAppMenuPropertiesDelegate.java      |  3 +++
- .../strings/android_chrome_strings.grd        |  4 ++++
- 7 files changed, 42 insertions(+)
+ .../android/java/res/menu/custom_tabs_menu.xml |  3 +++
+ chrome/android/java/res/menu/main_menu.xml     |  3 +++
+ .../chrome/browser/ChromeTabbedActivity.java   |  2 ++
+ .../chrome/browser/app/ChromeActivity.java     |  5 +++++
+ .../appmenu/AppMenuPropertiesDelegateImpl.java | 18 ++++++++++++++++++
+ .../CustomTabAppMenuPropertiesDelegate.java    |  1 +
+ .../android/strings/android_chrome_strings.grd |  4 ++++
+ 7 files changed, 36 insertions(+)
 
-diff --git a/chrome/android/java/res/values/ids.xml b/chrome/android/java/res/values/ids.xml
---- a/chrome/android/java/res/values/ids.xml
-+++ b/chrome/android/java/res/values/ids.xml
-@@ -129,6 +129,7 @@ found in the LICENSE file.
-     <item type="id" name="update_menu_id" />
-     <item type="id" name="new_tab_menu_id" />
-     <item type="id" name="new_incognito_tab_menu_id" />
-+    <item type="id" name="view_source_id" />
-     <item type="id" name="add_to_group_menu_id" />
-     <item type="id" name="pin_tab_menu_id" />
-     <item type="id" name="unpin_tab_menu_id" />
+diff --git a/chrome/android/java/res/menu/custom_tabs_menu.xml b/chrome/android/java/res/menu/custom_tabs_menu.xml
+--- a/chrome/android/java/res/menu/custom_tabs_menu.xml
++++ b/chrome/android/java/res/menu/custom_tabs_menu.xml
+@@ -58,6 +58,9 @@ found in the LICENSE file.
+         <item android:id="@+id/universal_install"
+             android:title="@string/menu_add_to_homescreen"
+             android:orderInCategory="2" />
++        <item android:id="@+id/view_source_id"
++            android:title="@string/view_source"
++            android:orderInCategory="2" />
+         <item android:id="@+id/open_webapk_id"
+             android:title="@string/menu_open_webapk"
+             android:orderInCategory="2" />
+diff --git a/chrome/android/java/res/menu/main_menu.xml b/chrome/android/java/res/menu/main_menu.xml
+--- a/chrome/android/java/res/menu/main_menu.xml
++++ b/chrome/android/java/res/menu/main_menu.xml
+@@ -119,6 +119,9 @@ found in the LICENSE file.
+         <item android:id="@+id/universal_install"
+             android:title="@string/menu_add_to_homescreen"
+             android:icon="@drawable/ic_add_to_home_screen" />
++        <item android:id="@+id/view_source_id"
++            android:title="@string/view_source"
++            android:icon="@drawable/ic_drive_document_24dp" />
+         <item android:id="@+id/open_webapk_id"
+             android:title="@string/menu_open_webapk"
+             android:icon="@drawable/ic_open_webapk" />
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java b/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java
-@@ -3764,6 +3764,8 @@ public class ChromeTabbedActivity extends ChromeActivity {
+@@ -3086,6 +3086,8 @@ public class ChromeTabbedActivity extends ChromeActivity implements MismatchedIn
                  NewTabPageUma.recordAction(NewTabPageUma.ACTION_OPENED_DOWNLOADS_MANAGER);
              }
              RecordUserAction.record("MobileMenuDownloadManager");
@@ -39,7 +54,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedAct
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/app/ChromeActivity.java b/chrome/android/java/src/org/chromium/chrome/browser/app/ChromeActivity.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/app/ChromeActivity.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/app/ChromeActivity.java
-@@ -2602,6 +2602,11 @@ public abstract class ChromeActivity extends AsyncInitializationActivity
+@@ -2524,6 +2524,11 @@ public abstract class ChromeActivity extends AsyncInitializationActivity
              return doOpenWebApk(currentTab);
          }
  
@@ -54,8 +69,16 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/app/ChromeActiv
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/app/appmenu/AppMenuPropertiesDelegateImpl.java b/chrome/android/java/src/org/chromium/chrome/browser/app/appmenu/AppMenuPropertiesDelegateImpl.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/app/appmenu/AppMenuPropertiesDelegateImpl.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/app/appmenu/AppMenuPropertiesDelegateImpl.java
-@@ -957,6 +957,30 @@ public abstract class AppMenuPropertiesDelegateImpl implements AppMenuProperties
-         return false;
+@@ -580,6 +580,7 @@ public class AppMenuPropertiesDelegateImpl implements AppMenuPropertiesDelegate
+                         isNativePage, isFileScheme, isContentScheme, isIncognito, url));
+ 
+         updateRequestDesktopSiteMenuItem(menu, currentTab, true /* can show */, isNativePage);
++        updateViewSourceMenuItem(menu, currentTab);
+ 
+         updateAutoDarkMenuItem(menu, currentTab, isNativePage);
+ 
+@@ -1293,6 +1294,23 @@ public class AppMenuPropertiesDelegateImpl implements AppMenuPropertiesDelegate
+         findInPageMenuRow.setVisible(itemVisible);
      }
  
 +    /**
@@ -64,57 +87,35 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/app/appmenu/App
 +     * @param menu {@link Menu} for view source.
 +     * @param currentTab      Current tab being displayed.
 +     */
-+    protected void buildAddViewSourceItem(
-+            MVCListAdapter.ModelList modelList,
-+            @Nullable Tab currentTab) {
++    protected void updateViewSourceMenuItem(
++            Menu menu, Tab currentTab) {
++        MenuItem viewSourceMenuItem = menu.findItem(R.id.view_source_id);
 +        boolean visible = false;
 +        if (currentTab != null) {
-+            String url = currentTab.getUrl().getSpec();
-+            visible = !url.isEmpty() && !url.startsWith("view-source:");
-+        }
-+        if (visible) {
-+            modelList.add(new MVCListAdapter.ListItem(
-+                AppMenuHandler.AppMenuItemType.STANDARD,
-+                 buildModelForStandardMenuItem(
-+                    R.id.view_source_id,
-+                    R.string.view_source,
-+                    shouldShowIconBeforeItem() ? R.drawable.ic_drive_document_24dp : 0)));
++                String url = currentTab.getUrl().getSpec();
++                visible = !url.isEmpty() && !url.startsWith("view-source:");
 +        }
++        viewSourceMenuItem.setVisible(visible);
 +    }
 +
      /**
-      * Updates the bookmark item's visibility.
+      * Updates the request desktop site item's state.
       *
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabAppMenuPropertiesDelegate.java b/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabAppMenuPropertiesDelegate.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabAppMenuPropertiesDelegate.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabAppMenuPropertiesDelegate.java
-@@ -370,6 +370,9 @@ public class CustomTabAppMenuPropertiesDelegate extends AppMenuPropertiesDelegat
-             modelList.add(buildAddToHomescreenListItem(currentTab, false));
-         }
+@@ -303,6 +303,7 @@ public class CustomTabAppMenuPropertiesDelegate extends AppMenuPropertiesDelegat
  
-+        // Add view source item
-+        buildAddViewSourceItem(modelList, currentTab);
-+
-         // --- Request Desktop Site ---
-         if (requestDesktopSiteVisible) {
-             MVCListAdapter.ListItem rdsListItem =
-diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedAppMenuPropertiesDelegate.java b/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedAppMenuPropertiesDelegate.java
---- a/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedAppMenuPropertiesDelegate.java
-+++ b/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedAppMenuPropertiesDelegate.java
-@@ -334,6 +334,9 @@ public class TabbedAppMenuPropertiesDelegate extends AppMenuPropertiesDelegateIm
-             modelList.add(buildAddToHomescreenListItem(currentTab, shouldShowIconBeforeItem()));
+             updateRequestDesktopSiteMenuItem(
+                     menu, currentTab, requestDesktopSiteVisible, isNativePage);
++            updateViewSourceMenuItem(menu, currentTab);
+             prepareAddToHomescreenMenuItem(menu, currentTab, addToHomeScreenVisible);
          }
- 
-+        // Add view source item
-+        buildAddViewSourceItem(modelList, currentTab);
-+
-         // RDS
-         MVCListAdapter.ListItem rdsListItem =
-                 maybeBuildRequestDesktopSiteListItem(
+     }
 diff --git a/chrome/browser/ui/android/strings/android_chrome_strings.grd b/chrome/browser/ui/android/strings/android_chrome_strings.grd
 --- a/chrome/browser/ui/android/strings/android_chrome_strings.grd
 +++ b/chrome/browser/ui/android/strings/android_chrome_strings.grd
-@@ -321,6 +321,10 @@ CHAR_LIMIT guidelines:
+@@ -315,6 +315,10 @@ CHAR_LIMIT guidelines:
          Collaboration
        </message>
  

build/patches/Add-option-to-disable-snapshots.patch

@@ -15,12 +15,12 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 diff --git a/chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser/tasks/tab_management/TabGridViewBinder.java b/chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser/tasks/tab_management/TabGridViewBinder.java
 --- a/chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser/tasks/tab_management/TabGridViewBinder.java
 +++ b/chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser/tasks/tab_management/TabGridViewBinder.java
-@@ -480,7 +480,12 @@ class TabGridViewBinder {
+@@ -408,7 +408,12 @@ class TabGridViewBinder {
                      if (result != null) {
                          TabUtils.setDrawableAndUpdateImageMatrix(thumbnail, result, thumbnailSize);
                      } else {
 -                        thumbnail.setImageDrawable(null);
-+                        TabFavicon tabFavicon = model.get(TabProperties.FAVICON);
++                        TabListFaviconProvider.TabFavicon tabFavicon = model.get(TabProperties.FAVICON);
 +                        if (tabFavicon != null) {
 +                            thumbnail.setScaleType(ImageView.ScaleType.CENTER);
 +                            thumbnail.setImageDrawable(
@@ -29,10 +29,10 @@ diff --git a/chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser
                      }
                  };
          if (sThumbnailFetcherForTesting != null) {
-@@ -518,6 +523,7 @@ class TabGridViewBinder {
+@@ -449,6 +454,7 @@ class TabGridViewBinder {
       */
      private static void setFavicon(
-             ImageView faviconView, PropertyModel model, @Nullable TabFavicon favicon) {
+             ImageView faviconView, PropertyModel model, TabListFaviconProvider.TabFavicon favicon) {
 +        model.set(TabProperties.FAVICON, favicon);
          if (favicon == null) {
              faviconView.setImageDrawable(null);
@@ -40,7 +40,7 @@ diff --git a/chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser
 diff --git a/chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser/tasks/tab_management/TabProperties.java b/chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser/tasks/tab_management/TabProperties.java
 --- a/chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser/tasks/tab_management/TabProperties.java
 +++ b/chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser/tasks/tab_management/TabProperties.java
-@@ -127,6 +127,9 @@ public class TabProperties {
+@@ -72,6 +72,9 @@ public class TabProperties {
      public static final WritableBooleanPropertyKey FAVICON_FETCHED =
              new WritableBooleanPropertyKey();
  
@@ -50,15 +50,15 @@ diff --git a/chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser
      /** Property for lazily fetching favicons when required by an item in a UI. */
      public static final WritableObjectPropertyKey<TabListFaviconProvider.TabFaviconFetcher>
              FAVICON_FETCHER = new WritableObjectPropertyKey<>();
-@@ -220,6 +223,7 @@ public class TabProperties {
+@@ -155,6 +158,7 @@ public class TabProperties {
                  CARD_TYPE,
                  CONTENT_DESCRIPTION_TEXT_RESOLVER,
                  ACTION_BUTTON_DESCRIPTION_TEXT_RESOLVER,
 +                FAVICON,
+                 SHOPPING_PERSISTED_TAB_DATA_FETCHER,
+                 SHOULD_SHOW_PRICE_DROP_TOOLTIP,
                  QUICK_DELETE_ANIMATION_STATUS,
-                 TAB_GROUP_COLOR_VIEW_PROVIDER,
-                 TAB_GROUP_CARD_COLOR,
-@@ -259,6 +263,7 @@ public class TabProperties {
+@@ -173,6 +177,7 @@ public class TabProperties {
                  TAB_ACTION_BUTTON_DATA,
                  FAVICON_FETCHED,
                  FAVICON_FETCHER,
@@ -69,7 +69,7 @@ diff --git a/chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser
 diff --git a/chrome/android/java/res/xml/privacy_preferences.xml b/chrome/android/java/res/xml/privacy_preferences.xml
 --- a/chrome/android/java/res/xml/privacy_preferences.xml
 +++ b/chrome/android/java/res/xml/privacy_preferences.xml
-@@ -73,6 +73,11 @@ found in the LICENSE file.
+@@ -77,6 +77,11 @@ found in the LICENSE file.
          android:title="@string/open_external_links_incognito_title"
          android:summary="@string/open_external_links_incognito_summary"
          android:defaultValue="false" />
@@ -84,19 +84,19 @@ diff --git a/chrome/android/java/res/xml/privacy_preferences.xml b/chrome/androi
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/app/ChromeActivity.java b/chrome/android/java/src/org/chromium/chrome/browser/app/ChromeActivity.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/app/ChromeActivity.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/app/ChromeActivity.java
-@@ -147,6 +147,7 @@ import org.chromium.chrome.browser.preferences.ChromeSharedPreferences;
+@@ -139,6 +139,7 @@ import org.chromium.chrome.browser.preferences.ChromePreferenceKeys;
+ import org.chromium.chrome.browser.preferences.ChromeSharedPreferences;
  import org.chromium.chrome.browser.preferences.Pref;
- import org.chromium.chrome.browser.price_tracking.PriceDropNotificationManagerFactory;
  import org.chromium.chrome.browser.printing.TabPrinter;
 +import org.chromium.chrome.browser.privacy.settings.PrivacySettings;
  import org.chromium.chrome.browser.profiles.Profile;
  import org.chromium.chrome.browser.profiles.ProfileManager;
  import org.chromium.chrome.browser.profiles.ProfileProvider;
-@@ -641,7 +642,8 @@ public abstract class ChromeActivity extends AsyncInitializationActivity
+@@ -612,7 +613,8 @@ public abstract class ChromeActivity extends AsyncInitializationActivity
                      new TabContentManager(
                              this,
                              mBrowserControlsManagerSupplier.get(),
--                            /* snapshotsEnabled= */ true,
+-                            !TabUiFeatureUtilities.shouldUseListMode(),
 +                            !TabUiFeatureUtilities.shouldUseListMode()
 +                                && !ContextUtils.getAppSharedPreferences().getBoolean(PrivacySettings.PREF_TABGRID_USE_ICONS, false),
                              tabModelSelector != null ? tabModelSelector::getTabById : null,
@@ -105,15 +105,15 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/app/ChromeActiv
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/privacy/settings/PrivacySettings.java b/chrome/android/java/src/org/chromium/chrome/browser/privacy/settings/PrivacySettings.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/privacy/settings/PrivacySettings.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/privacy/settings/PrivacySettings.java
-@@ -28,6 +28,7 @@ import org.chromium.base.ContextUtils;
- import org.chromium.base.IntentUtils;
+@@ -21,6 +21,7 @@ import androidx.preference.Preference;
+ 
  import org.chromium.base.metrics.RecordHistogram;
  import org.chromium.base.metrics.RecordUserAction;
 +import org.chromium.base.supplier.Supplier;
  import org.chromium.base.supplier.ObservableSupplier;
  import org.chromium.base.supplier.ObservableSupplierImpl;
- import org.chromium.build.annotations.Nullable;
-@@ -98,12 +99,26 @@ import org.chromium.chrome.browser.preferences.ChromeSharedPreferences;
+ import org.chromium.base.ContextUtils;
+@@ -78,12 +79,26 @@ import org.chromium.chrome.browser.preferences.ChromeSharedPreferences;
  import org.chromium.components.browser_ui.settings.ChromeSwitchPreference;
  import org.chromium.components.browser_ui.settings.ManagedPreferenceDelegate;
  
@@ -141,7 +141,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/privacy/setting
      private static final String PREF_CAN_MAKE_PAYMENT = "can_make_payment";
      private static final String PREF_PRELOAD_PAGES = "preload_pages";
      private static final String PREF_HTTPS_FIRST_MODE = "https_first_mode";
-@@ -215,6 +230,21 @@ public class PrivacySettings extends ChromeBaseSettingsFragment
+@@ -170,6 +185,21 @@ public class PrivacySettings extends ChromeBaseSettingsFragment
              }
          }
  
@@ -163,7 +163,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/privacy/setting
          Preference privacyGuidePreference = findPreference(PREF_PRIVACY_GUIDE);
          // Record the launch of PG from the S&P link-row entry point
          privacyGuidePreference.setOnPreferenceClickListener(
-@@ -441,6 +471,7 @@ public class PrivacySettings extends ChromeBaseSettingsFragment
+@@ -392,6 +422,7 @@ public class PrivacySettings extends ChromeBaseSettingsFragment
  
      public static final String PREF_ALLOW_CUSTOM_TAB_INTENTS = "allow_custom_tab_intents";
      public static final String PREF_OPEN_EXTERNAL_LINKS_INCOGNITO = "open_external_links_incognito";
@@ -171,7 +171,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/privacy/setting
  
      @Override
      public boolean onPreferenceChange(Preference preference, Object newValue) {
-@@ -487,6 +518,13 @@ public class PrivacySettings extends ChromeBaseSettingsFragment
+@@ -438,6 +469,13 @@ public class PrivacySettings extends ChromeBaseSettingsFragment
              SharedPreferences.Editor sharedPreferencesEditor = ContextUtils.getAppSharedPreferences().edit();
              sharedPreferencesEditor.putBoolean(PREF_OPEN_EXTERNAL_LINKS_INCOGNITO, (boolean)newValue);
              sharedPreferencesEditor.apply();
@@ -185,7 +185,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/privacy/setting
          }
          return true;
      }
-@@ -537,6 +575,10 @@ public class PrivacySettings extends ChromeBaseSettingsFragment
+@@ -504,6 +542,10 @@ public class PrivacySettings extends ChromeBaseSettingsFragment
                              : R.string.text_off);
          }
  
@@ -199,7 +199,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/privacy/setting
 diff --git a/chrome/browser/ui/android/strings/android_chrome_strings.grd b/chrome/browser/ui/android/strings/android_chrome_strings.grd
 --- a/chrome/browser/ui/android/strings/android_chrome_strings.grd
 +++ b/chrome/browser/ui/android/strings/android_chrome_strings.grd
-@@ -6194,6 +6194,14 @@ To change this setting, <ph name="BEGIN_LINK">BEGIN_LINK</ph>delete the Chrome d
+@@ -5954,6 +5954,14 @@ To change this setting, <ph name="BEGIN_LINK">BEGIN_LINK</ph>delete the Chrome d
          Your <ph name="FQDN">%1$s<ex>www.amazon.com</ex></ph> timer ran out. It'll start again tomorrow.
        </message>
  

build/patches/Add-option-to-force-tablet-UI.patch

@@ -14,7 +14,6 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
  .../chrome/browser/app/ChromeActivity.java    |  4 +++-
  .../overlays/strip/StripLayoutHelper.java     | 10 ++++++++--
  .../strip/StripLayoutHelperManager.java       |  6 +++++-
- .../scene_layer/TabStripSceneLayer.java       |  8 ++++++++
  .../init/ChromeBrowserInitializer.java        |  2 ++
  .../tabbed_mode/TabbedRootUiCoordinator.java  |  4 +++-
  .../chrome/browser/ui/RootUiCoordinator.java  |  6 +++++-
@@ -38,12 +37,12 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
  .../accessibility/AccessibilitySettings.java  | 13 ++++++++++++
  .../AccessibilitySettingsDelegate.java        |  2 ++
  .../chromium/ui/base/DeviceFormFactor.java    | 14 +++++++++++++
- 34 files changed, 171 insertions(+), 26 deletions(-)
+ 33 files changed, 163 insertions(+), 26 deletions(-)
 
 diff --git a/chrome/android/java/res/layout/custom_tabs_control_container.xml b/chrome/android/java/res/layout/custom_tabs_control_container.xml
 --- a/chrome/android/java/res/layout/custom_tabs_control_container.xml
 +++ b/chrome/android/java/res/layout/custom_tabs_control_container.xml
-@@ -31,7 +31,7 @@ found in the LICENSE file.
+@@ -32,7 +32,7 @@ found in the LICENSE file.
              android:id="@+id/find_toolbar_stub"
              android:inflatedId="@+id/find_toolbar"
              android:visibility="gone"
@@ -81,7 +80,7 @@ diff --git a/chrome/android/java/res/values-sw600dp/dimens.xml b/chrome/android/
 diff --git a/chrome/android/java/res/values/dimens.xml b/chrome/android/java/res/values/dimens.xml
 --- a/chrome/android/java/res/values/dimens.xml
 +++ b/chrome/android/java/res/values/dimens.xml
-@@ -119,9 +119,13 @@ found in the LICENSE file.
+@@ -117,9 +117,13 @@ found in the LICENSE file.
      <dimen name="tab_modal_scrim_vertical_margin">16dp</dimen>
  
      <!-- Should match toolbar_height_no_shadow -->
@@ -99,15 +98,15 @@ diff --git a/chrome/android/java/res/values/dimens.xml b/chrome/android/java/res
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ChromeBaseAppCompatActivity.java b/chrome/android/java/src/org/chromium/chrome/browser/ChromeBaseAppCompatActivity.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/ChromeBaseAppCompatActivity.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/ChromeBaseAppCompatActivity.java
-@@ -63,6 +63,7 @@ import org.chromium.chrome.browser.ui.edge_to_edge.EdgeToEdgeController;
- import org.chromium.chrome.browser.ui.edge_to_edge.EdgeToEdgeControllerCreator;
- import org.chromium.chrome.browser.ui.edge_to_edge.EdgeToEdgeFieldTrialImpl;
- import org.chromium.chrome.browser.ui.edge_to_edge.EdgeToEdgeUtils;
+@@ -58,6 +58,7 @@ import org.chromium.chrome.browser.metrics.UmaSessionStats;
+ import org.chromium.chrome.browser.night_mode.GlobalNightModeStateProviderHolder;
+ import org.chromium.chrome.browser.night_mode.NightModeStateProvider;
+ import org.chromium.chrome.browser.night_mode.NightModeUtils;
 +import org.chromium.chrome.browser.preferences.ChromeSharedPreferences;
- import org.chromium.chrome.browser.ui.edge_to_edge.SimpleEdgeToEdgeController;
+ import org.chromium.chrome.browser.ui.edge_to_edge.EdgeToEdgeUtils;
  import org.chromium.components.browser_ui.edge_to_edge.EdgeToEdgeManager;
  import org.chromium.components.browser_ui.edge_to_edge.EdgeToEdgeStateProvider;
-@@ -145,6 +146,8 @@ public class ChromeBaseAppCompatActivity extends AppCompatActivity
+@@ -131,6 +132,8 @@ public class ChromeBaseAppCompatActivity extends AppCompatActivity
      protected void attachBaseContext(Context newBase) {
          super.attachBaseContext(newBase);
  
@@ -119,7 +118,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ChromeBaseAppCo
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/WarmupManager.java b/chrome/android/java/src/org/chromium/chrome/browser/WarmupManager.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/WarmupManager.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/WarmupManager.java
-@@ -69,6 +69,7 @@ import org.chromium.content_public.browser.WebContents;
+@@ -63,6 +63,7 @@ import org.chromium.content_public.browser.WebContents;
  import org.chromium.content_public.browser.WebContentsObserver;
  import org.chromium.net.NetId;
  import org.chromium.ui.LayoutInflaterUtils;
@@ -127,7 +126,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/WarmupManager.j
  import org.chromium.ui.base.WindowAndroid;
  import org.chromium.ui.display.DisplayUtil;
  import org.chromium.url.GURL;
-@@ -491,7 +492,9 @@ public class WarmupManager {
+@@ -476,7 +477,9 @@ public class WarmupManager {
              ControlContainer controlContainer = mainView.findViewById(R.id.control_container);
  
              if (toolbarId != ActivityUtils.NO_RESOURCE_ID && controlContainer != null) {
@@ -141,7 +140,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/WarmupManager.j
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/accessibility/settings/ChromeAccessibilitySettingsDelegate.java b/chrome/android/java/src/org/chromium/chrome/browser/accessibility/settings/ChromeAccessibilitySettingsDelegate.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/accessibility/settings/ChromeAccessibilitySettingsDelegate.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/accessibility/settings/ChromeAccessibilitySettingsDelegate.java
-@@ -65,6 +65,25 @@ public class ChromeAccessibilitySettingsDelegate implements AccessibilitySetting
+@@ -62,6 +62,25 @@ public class ChromeAccessibilitySettingsDelegate implements AccessibilitySetting
          }
      }
  
@@ -170,7 +169,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/accessibility/s
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/app/ChromeActivity.java b/chrome/android/java/src/org/chromium/chrome/browser/app/ChromeActivity.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/app/ChromeActivity.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/app/ChromeActivity.java
-@@ -791,7 +791,9 @@ public abstract class ChromeActivity extends AsyncInitializationActivity
+@@ -758,7 +758,9 @@ public abstract class ChromeActivity extends AsyncInitializationActivity
              // Inflate the correct toolbar layout for the device.
              int toolbarLayoutId = getToolbarLayoutId();
              if (toolbarLayoutId != ActivityUtils.NO_RESOURCE_ID && controlContainer != null) {
@@ -184,17 +183,17 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/app/ChromeActiv
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/compositor/overlays/strip/StripLayoutHelper.java b/chrome/android/java/src/org/chromium/chrome/browser/compositor/overlays/strip/StripLayoutHelper.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/compositor/overlays/strip/StripLayoutHelper.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/compositor/overlays/strip/StripLayoutHelper.java
-@@ -127,6 +127,7 @@ import org.chromium.components.tab_group_sync.TabGroupSyncService;
- import org.chromium.components.tab_group_sync.TriggerSource;
+@@ -114,6 +114,7 @@ import org.chromium.components.tab_group_sync.SavedTabGroup;
+ import org.chromium.components.tab_group_sync.TabGroupSyncService;
  import org.chromium.components.tab_groups.TabGroupColorId;
- import org.chromium.ui.accessibility.AccessibilityState;
+ import org.chromium.ui.MotionEventUtils;
 +import org.chromium.ui.base.DeviceFormFactor;
  import org.chromium.ui.base.LocalizationUtils;
  import org.chromium.ui.base.WindowAndroid;
- import org.chromium.ui.util.ColorUtils;
-@@ -4955,8 +4956,13 @@ public class StripLayoutHelper
-         mCloseButtonMenu.setAnchorView(tabView);
-         // 3. Set the vertical offset to align the close button menu with bottom of the tab strip
+ import org.chromium.ui.modaldialog.ModalDialogManager;
+@@ -4060,8 +4061,13 @@ public class StripLayoutHelper
+         mTabMenu.setAnchorView(tabView);
+         // 3. Set the vertical offset to align the tab menu with bottom of the tab strip
          int tabHeight = mManagerHost.getHeight();
 -        int verticalOffset =
 -                -(tabHeight - (int) mContext.getResources().getDimension(R.dimen.tab_strip_height));
@@ -205,13 +204,13 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/compositor/over
 +                (int) mContext.getResources().getDimension(R.dimen.tab_strip_height_tabletui);
 +        }
 +        int verticalOffset = -(tabHeight - tab_strip_height);
-         mCloseButtonMenu.setVerticalOffset(verticalOffset);
+         mTabMenu.setVerticalOffset(verticalOffset);
  
-         // 4. Set the horizontal offset to align the close button menu with the right side of the
+         // 4. Set the horizontal offset to align the tab menu with the right side of the tab
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/compositor/overlays/strip/StripLayoutHelperManager.java b/chrome/android/java/src/org/chromium/chrome/browser/compositor/overlays/strip/StripLayoutHelperManager.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/compositor/overlays/strip/StripLayoutHelperManager.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/compositor/overlays/strip/StripLayoutHelperManager.java
-@@ -105,6 +105,7 @@ import org.chromium.components.browser_ui.desktop_windowing.DesktopWindowStateMa
+@@ -94,6 +94,7 @@ import org.chromium.components.browser_ui.desktop_windowing.DesktopWindowStateMa
  import org.chromium.components.browser_ui.styles.SemanticColorUtils;
  import org.chromium.components.browser_ui.widget.scrim.ScrimProperties;
  import org.chromium.content_public.browser.LoadUrlParams;
@@ -219,10 +218,10 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/compositor/over
  import org.chromium.ui.base.LocalizationUtils;
  import org.chromium.ui.base.PageTransition;
  import org.chromium.ui.base.WindowAndroid;
-@@ -495,7 +496,10 @@ public class StripLayoutHelperManager
+@@ -453,7 +454,10 @@ public class StripLayoutHelperManager
+ 
          mIsLayoutOptimizationsEnabled =
-                 ToolbarFeatures.isTabStripWindowLayoutOptimizationEnabled(
-                         /* isTablet= */ true, DisplayUtil.isContextInDefaultDisplay(mContext));
+                 ToolbarFeatures.isTabStripWindowLayoutOptimizationEnabled(true);
 -        mScrollableStripHeight = res.getDimension(R.dimen.tab_strip_height) / mDensity;
 +        mScrollableStripHeight =
 +            (DeviceFormFactor.isForceTabletUI()
@@ -231,28 +230,10 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/compositor/over
          mHeight =
                  mIsLayoutOptimizationsEnabled
                          ? toolbarManager.getTabStripHeightSupplier().get() / mDensity
-diff --git a/chrome/android/java/src/org/chromium/chrome/browser/compositor/scene_layer/TabStripSceneLayer.java b/chrome/android/java/src/org/chromium/chrome/browser/compositor/scene_layer/TabStripSceneLayer.java
---- a/chrome/android/java/src/org/chromium/chrome/browser/compositor/scene_layer/TabStripSceneLayer.java
-+++ b/chrome/android/java/src/org/chromium/chrome/browser/compositor/scene_layer/TabStripSceneLayer.java
-@@ -111,6 +111,14 @@ public class TabStripSceneLayer extends SceneOverlayLayer {
-         if (mNativePtr == 0) return;
-         final boolean visible = yOffset > -layoutHelper.getHeight();
- 
-+        if (DeviceFormFactor.isNonMultiDisplayContextOnTablet(ContextUtils.getApplicationContext())) {
-+                TintedCompositorButton newTabButton = layoutHelper.getNewTabButton();
-+                if (newTabButton.isVisible()) {
-+                   rightPaddingDp += newTabButton.getWidth() + layoutHelper.getNewTabBtnVisualOffset()
-+                        + StripLayoutGroupTitle.REORDER_BACKGROUND_PADDING_END;
-+                }
-+        }
-+
-         // This will hide the tab strips if necessary.
-         TabStripSceneLayerJni.get()
-                 .beginBuildingFrame(mNativePtr, visible, resourceManager, layerTitleCache);
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/init/ChromeBrowserInitializer.java b/chrome/android/java/src/org/chromium/chrome/browser/init/ChromeBrowserInitializer.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/init/ChromeBrowserInitializer.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/init/ChromeBrowserInitializer.java
-@@ -16,6 +16,7 @@ import org.chromium.base.library_loader.LibraryProcessType;
+@@ -17,6 +17,7 @@ import org.chromium.base.library_loader.LibraryProcessType;
  import org.chromium.base.task.ChainedTasks;
  import org.chromium.base.task.TaskTraits;
  import org.chromium.chrome.browser.flags.ChromeSwitches;
@@ -260,7 +241,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/init/ChromeBrow
  import org.chromium.chrome.browser.profiles.ProfileManager;
  import org.chromium.chrome.browser.signin.SigninCheckerProvider;
  import org.chromium.components.background_task_scheduler.BackgroundTaskSchedulerFactory;
-@@ -106,6 +107,7 @@ public class ChromeBrowserInitializer {
+@@ -107,6 +108,7 @@ public class ChromeBrowserInitializer {
      public void handlePreNativeStartupAndLoadLibraries(final BrowserParts parts) {
          ThreadUtils.checkUiThread();
          if (parts.isActivityFinishingOrDestroyed()) return;
@@ -271,7 +252,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/init/ChromeBrow
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedRootUiCoordinator.java b/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedRootUiCoordinator.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedRootUiCoordinator.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedRootUiCoordinator.java
-@@ -747,7 +747,9 @@ public class TabbedRootUiCoordinator extends RootUiCoordinator {
+@@ -620,7 +620,9 @@ public class TabbedRootUiCoordinator extends RootUiCoordinator {
  
      @Override
      public int getControlContainerHeightResource() {
@@ -285,16 +266,16 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/Tab
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ui/RootUiCoordinator.java b/chrome/android/java/src/org/chromium/chrome/browser/ui/RootUiCoordinator.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/ui/RootUiCoordinator.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/ui/RootUiCoordinator.java
-@@ -108,6 +108,8 @@ import org.chromium.chrome.browser.paint_preview.DemoPaintPreview;
+@@ -109,6 +109,8 @@ import org.chromium.chrome.browser.paint_preview.DemoPaintPreview;
  import org.chromium.chrome.browser.password_manager.ManagePasswordsReferrer;
  import org.chromium.chrome.browser.password_manager.PasswordManagerLauncher;
  import org.chromium.chrome.browser.pdf.PdfPage;
 +import org.chromium.chrome.browser.preferences.ChromePreferenceKeys;
 +import org.chromium.chrome.browser.preferences.ChromeSharedPreferences;
- import org.chromium.chrome.browser.profiles.Profile;
- import org.chromium.chrome.browser.quick_delete.QuickDeleteController;
- import org.chromium.chrome.browser.quick_delete.QuickDeleteDelegateImpl;
-@@ -1715,7 +1717,9 @@ public class RootUiCoordinator
+ import org.chromium.chrome.browser.price_insights.PriceInsightsButtonController;
+ import org.chromium.chrome.browser.price_tracking.CurrentTabPriceTrackingStateSupplier;
+ import org.chromium.chrome.browser.price_tracking.PriceTrackingButtonController;
+@@ -1777,7 +1779,9 @@ public class RootUiCoordinator
          if (!mSupportsFindInPageSupplier.getAsBoolean()) return;
  
          int stubId = R.id.find_toolbar_stub;
@@ -319,7 +300,7 @@ diff --git a/chrome/browser/preferences/BUILD.gn b/chrome/browser/preferences/BU
 diff --git a/chrome/browser/preferences/android/java/src/org/chromium/chrome/browser/preferences/ChromePreferenceKeys.java b/chrome/browser/preferences/android/java/src/org/chromium/chrome/browser/preferences/ChromePreferenceKeys.java
 --- a/chrome/browser/preferences/android/java/src/org/chromium/chrome/browser/preferences/ChromePreferenceKeys.java
 +++ b/chrome/browser/preferences/android/java/src/org/chromium/chrome/browser/preferences/ChromePreferenceKeys.java
-@@ -317,6 +317,7 @@ public final class ChromePreferenceKeys {
+@@ -280,6 +280,7 @@ public final class ChromePreferenceKeys {
      /** Whether the app-specific history info text was already seen by users. */
      public static final String HISTORY_APP_SPECIFIC_INFO_SEEN =
              "Chrome.History.AppSpecificInfoSeen";
@@ -359,7 +340,7 @@ diff --git a/chrome/browser/preferences/android/java/src/org/chromium/chrome/bro
 diff --git a/chrome/browser/preferences/android/java/src/org/chromium/chrome/browser/preferences/LegacyChromePreferenceKeys.java b/chrome/browser/preferences/android/java/src/org/chromium/chrome/browser/preferences/LegacyChromePreferenceKeys.java
 --- a/chrome/browser/preferences/android/java/src/org/chromium/chrome/browser/preferences/LegacyChromePreferenceKeys.java
 +++ b/chrome/browser/preferences/android/java/src/org/chromium/chrome/browser/preferences/LegacyChromePreferenceKeys.java
-@@ -56,6 +56,7 @@ public class LegacyChromePreferenceKeys {
+@@ -57,6 +57,7 @@ public class LegacyChromePreferenceKeys {
                  ChromePreferenceKeys.FIRST_RUN_FLOW_COMPLETE,
                  ChromePreferenceKeys.FIRST_RUN_FLOW_SIGNIN_SETUP,
                  ChromePreferenceKeys.FIRST_RUN_LIGHTWEIGHT_FLOW_COMPLETE,
@@ -370,18 +351,18 @@ diff --git a/chrome/browser/preferences/android/java/src/org/chromium/chrome/bro
 diff --git a/chrome/browser/ui/android/desktop_windowing/java/src/org/chromium/chrome/browser/ui/desktop_windowing/AppHeaderCoordinator.java b/chrome/browser/ui/android/desktop_windowing/java/src/org/chromium/chrome/browser/ui/desktop_windowing/AppHeaderCoordinator.java
 --- a/chrome/browser/ui/android/desktop_windowing/java/src/org/chromium/chrome/browser/ui/desktop_windowing/AppHeaderCoordinator.java
 +++ b/chrome/browser/ui/android/desktop_windowing/java/src/org/chromium/chrome/browser/ui/desktop_windowing/AppHeaderCoordinator.java
-@@ -42,6 +42,7 @@ import org.chromium.components.browser_ui.desktop_windowing.DesktopWindowStateMa
+@@ -35,6 +35,7 @@ import org.chromium.chrome.browser.ui.desktop_windowing.AppHeaderUtils.Windowing
+ import org.chromium.components.browser_ui.desktop_windowing.AppHeaderState;
+ import org.chromium.components.browser_ui.desktop_windowing.DesktopWindowStateManager;
  import org.chromium.components.browser_ui.edge_to_edge.EdgeToEdgeStateProvider;
- import org.chromium.ui.display.DisplayUtil;
- import org.chromium.ui.insets.CaptionBarInsetsRectProvider;
 +import org.chromium.ui.base.DeviceFormFactor;
- import org.chromium.ui.insets.InsetObserver;
- import org.chromium.ui.insets.InsetObserver.WindowInsetsConsumer;
- import org.chromium.ui.insets.InsetsRectProvider;
-@@ -280,6 +281,7 @@ public class AppHeaderCoordinator
+ import org.chromium.ui.InsetObserver;
+ import org.chromium.ui.InsetObserver.WindowInsetsConsumer;
+ import org.chromium.ui.InsetsRectProvider;
+@@ -260,6 +261,7 @@ public class AppHeaderCoordinator
+     private static @DesktopWindowHeuristicResult int checkIsInDesktopWindow(
              InsetsRectProvider insetsRectProvider,
-             @DesktopWindowHeuristicResult int currentResult,
-             boolean isOnExternalDisplay) {
+             @DesktopWindowHeuristicResult int currentResult) {
 +        if (DeviceFormFactor.isForceTabletUI()) return DesktopWindowHeuristicResult.IN_DESKTOP_WINDOW;
          @DesktopWindowHeuristicResult int newResult;
  
@@ -389,7 +370,7 @@ diff --git a/chrome/browser/ui/android/desktop_windowing/java/src/org/chromium/c
 diff --git a/chrome/browser/ui/android/omnibox/java/src/org/chromium/chrome/browser/omnibox/LocationBarCoordinator.java b/chrome/browser/ui/android/omnibox/java/src/org/chromium/chrome/browser/omnibox/LocationBarCoordinator.java
 --- a/chrome/browser/ui/android/omnibox/java/src/org/chromium/chrome/browser/omnibox/LocationBarCoordinator.java
 +++ b/chrome/browser/ui/android/omnibox/java/src/org/chromium/chrome/browser/omnibox/LocationBarCoordinator.java
-@@ -833,7 +833,7 @@ public class LocationBarCoordinator
+@@ -799,7 +799,7 @@ public class LocationBarCoordinator
      }
  
      private boolean isTabletWindow() {
@@ -401,8 +382,8 @@ diff --git a/chrome/browser/ui/android/omnibox/java/src/org/chromium/chrome/brow
 diff --git a/chrome/browser/ui/android/strings/android_chrome_strings.grd b/chrome/browser/ui/android/strings/android_chrome_strings.grd
 --- a/chrome/browser/ui/android/strings/android_chrome_strings.grd
 +++ b/chrome/browser/ui/android/strings/android_chrome_strings.grd
-@@ -1531,6 +1531,13 @@ Your Google account may have other forms of browsing history like searches and a
-         Privacy guide explanation closed
+@@ -1657,6 +1657,13 @@ Your Google account may have other forms of browsing history like searches and a
+         Hide your IP address
        </message>
  
 +      <message name="IDS_FORCE_TABLET_UI_SUMMARY" desc="Summary of the preference that allows the user to force chromium to use tablet UI.">
@@ -427,7 +408,7 @@ diff --git a/chrome/browser/ui/android/toolbar/java/res/layout/control_container
  
      <view
          class="org.chromium.chrome.browser.toolbar.top.ToolbarControlContainer$ToolbarViewResourceFrameLayout"
-@@ -20,20 +20,20 @@ found in the LICENSE file.
+@@ -20,7 +20,7 @@ found in the LICENSE file.
          <ViewStub
              android:id="@+id/toolbar_stub"
              android:layout_width="match_parent"
@@ -435,14 +416,17 @@ diff --git a/chrome/browser/ui/android/toolbar/java/res/layout/control_container
 +            android:layout_marginTop="@dimen/tab_strip_height_cromite"
              android:layout_height="@dimen/toolbar_height_no_shadow" />
  
-         <org.chromium.chrome.browser.toolbar.ToolbarHairlineView
-             android:id="@+id/toolbar_hairline"
+         <ImageView
+@@ -28,7 +28,7 @@ found in the LICENSE file.
+             android:src="@drawable/toolbar_hairline"
              android:layout_width="match_parent"
              android:layout_height="wrap_content"
--            android:layout_marginTop="@dimen/control_container_height" />
-+            android:layout_marginTop="@dimen/control_container_height_cromite" />
+-            android:layout_marginTop="@dimen/control_container_height"
++            android:layout_marginTop="@dimen/control_container_height_cromite"
+             android:scaleType="fitXY"
+             android:importantForAccessibility="no" />
  
-         <ViewStub
+@@ -36,7 +36,7 @@ found in the LICENSE file.
              android:id="@+id/find_toolbar_stub"
              android:inflatedId="@+id/find_toolbar"
              android:visibility="gone"
@@ -480,7 +464,7 @@ diff --git a/chrome/browser/ui/android/toolbar/java/res/values/dimens.xml b/chro
 --- a/chrome/browser/ui/android/toolbar/java/res/values/dimens.xml
 +++ b/chrome/browser/ui/android/toolbar/java/res/values/dimens.xml
 @@ -10,8 +10,10 @@ found in the LICENSE file.
-     <dimen name="toolbar_tab_count_text_size_2_digit">9dp</dimen>
+     <dimen name="toolbar_tab_count_text_size_2_digit">10dp</dimen>
  
      <!-- Tab Strip Dimensions -->
 -    <dimen name="tab_strip_height">0dp</dimen>
@@ -495,8 +479,8 @@ diff --git a/chrome/browser/ui/android/toolbar/java/res/values/dimens.xml b/chro
 diff --git a/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/ControlContainer.java b/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/ControlContainer.java
 --- a/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/ControlContainer.java
 +++ b/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/ControlContainer.java
-@@ -27,7 +27,7 @@ public interface ControlContainer {
-      *
+@@ -23,7 +23,7 @@ public interface ControlContainer {
+      * Initialize the control container with the specified toolbar.
       * @param toolbarLayoutId The ID of the toolbar layout to use.
       */
 -    void initWithToolbar(int toolbarLayoutId);
@@ -507,18 +491,18 @@ diff --git a/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/brow
 diff --git a/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/top/ToolbarControlContainer.java b/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/top/ToolbarControlContainer.java
 --- a/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/top/ToolbarControlContainer.java
 +++ b/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/top/ToolbarControlContainer.java
-@@ -7,6 +7,7 @@ package org.chromium.chrome.browser.toolbar.top;
- import static org.chromium.build.NullUtil.assumeNonNull;
+@@ -5,6 +5,7 @@
+ package org.chromium.chrome.browser.toolbar.top;
  
  import android.content.Context;
 +import android.content.res.Resources;
  import android.graphics.Canvas;
- import android.graphics.Color;
  import android.graphics.PorterDuff;
-@@ -163,8 +164,25 @@ public class ToolbarControlContainer extends OptimizedFrameLayout
+ import android.graphics.Rect;
+@@ -143,8 +144,25 @@ public class ToolbarControlContainer extends OptimizedFrameLayout
+     }
  
      @Override
-     @Initializer
 -    public void initWithToolbar(int toolbarLayoutId) {
 +    public void initWithToolbar(int toolbarLayoutId, int controlContainerHeightOverrideId) {
          try (TraceEvent te = TraceEvent.scoped("ToolbarControlContainer.initWithToolbar")) {
@@ -539,21 +523,21 @@ diff --git a/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/brow
 +                if (view != null)
 +                    ((MarginLayoutParams)view.getLayoutParams()).topMargin = tab_strip_height;
 +            }
-             mToolbarContainer = findViewById(R.id.toolbar_container);
+             mToolbarContainer =
+                     (ToolbarViewResourceFrameLayout) findViewById(R.id.toolbar_container);
              ViewStub toolbarStub = findViewById(R.id.toolbar_stub);
-             toolbarStub.setLayoutResource(toolbarLayoutId);
 diff --git a/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/top/ToolbarLayout.java b/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/top/ToolbarLayout.java
 --- a/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/top/ToolbarLayout.java
 +++ b/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/top/ToolbarLayout.java
-@@ -66,6 +66,7 @@ import org.chromium.chrome.browser.util.BrowserUiUtils.ModuleTypeOnStartAndNtp;
+@@ -63,6 +63,7 @@ import org.chromium.chrome.browser.util.BrowserUiUtils;
+ import org.chromium.chrome.browser.util.BrowserUiUtils.ModuleTypeOnStartAndNtp;
  import org.chromium.components.feature_engagement.Tracker;
  import org.chromium.ui.base.ViewUtils;
- import org.chromium.ui.util.MotionEventUtils;
 +import org.chromium.ui.base.DeviceFormFactor;
  import org.chromium.ui.util.TokenHolder;
  import org.chromium.url.GURL;
  
-@@ -594,7 +595,9 @@ public abstract class ToolbarLayout extends FrameLayout
+@@ -590,7 +591,9 @@ public abstract class ToolbarLayout extends FrameLayout
       * not have a tab strip.
       */
      protected int getTabStripHeightFromResource() {
@@ -567,7 +551,7 @@ diff --git a/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/brow
 diff --git a/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/top/tab_strip/HeightTransitionHandler.java b/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/top/tab_strip/HeightTransitionHandler.java
 --- a/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/top/tab_strip/HeightTransitionHandler.java
 +++ b/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/top/tab_strip/HeightTransitionHandler.java
-@@ -30,6 +30,7 @@ import org.chromium.chrome.browser.toolbar.top.ToolbarLayout;
+@@ -28,6 +28,7 @@ import org.chromium.chrome.browser.toolbar.top.ToolbarLayout;
  import org.chromium.chrome.browser.toolbar.top.tab_strip.TabStripTransitionCoordinator.TabStripHeightObserver;
  import org.chromium.chrome.browser.toolbar.top.tab_strip.TabStripTransitionCoordinator.TabStripTransitionDelegate;
  import org.chromium.ui.base.ViewUtils;
@@ -575,7 +559,7 @@ diff --git a/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/brow
  import org.chromium.ui.resources.dynamics.DynamicResourceReadyOnceCallback;
  import org.chromium.ui.util.TokenHolder;
  
-@@ -562,6 +563,7 @@ class HeightTransitionHandler {
+@@ -559,6 +560,7 @@ class HeightTransitionHandler {
          if (TabStripTransitionCoordinator.sHeightTransitionThresholdForTesting != null) {
              return TabStripTransitionCoordinator.sHeightTransitionThresholdForTesting;
          }
@@ -593,7 +577,7 @@ diff --git a/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/brow
 +import org.chromium.ui.base.DeviceFormFactor;
  
  /** Class used to manage tab strip visibility and height updates. */
- @NullMarked
+ public class TabStripTransitionCoordinator implements ComponentCallbacks, AppHeaderObserver {
 @@ -153,7 +154,10 @@ public class TabStripTransitionCoordinator implements ComponentCallbacks, AppHea
          mTabStripReservedTopPadding =
                  controlContainerView()
@@ -624,15 +608,15 @@ diff --git a/components/browser_ui/accessibility/android/java/res/xml/accessibil
 diff --git a/components/browser_ui/accessibility/android/java/src/org/chromium/components/browser_ui/accessibility/AccessibilitySettings.java b/components/browser_ui/accessibility/android/java/src/org/chromium/components/browser_ui/accessibility/AccessibilitySettings.java
 --- a/components/browser_ui/accessibility/android/java/src/org/chromium/components/browser_ui/accessibility/AccessibilitySettings.java
 +++ b/components/browser_ui/accessibility/android/java/src/org/chromium/components/browser_ui/accessibility/AccessibilitySettings.java
-@@ -29,6 +29,7 @@ import org.chromium.content_public.browser.ContentFeatureList;
+@@ -25,6 +25,7 @@ import org.chromium.content_public.browser.ContentFeatureList;
  import org.chromium.content_public.browser.ContentFeatureMap;
  
  import org.chromium.chrome.browser.settings.ChromeBaseSettingsFragment;
 +import org.chromium.components.browser_ui.accessibility.AccessibilitySettingsDelegate.BooleanPreferenceDelegate;
  
  /** Fragment to keep track of all the accessibility related preferences. */
- @NullMarked
-@@ -44,6 +45,9 @@ public class AccessibilitySettings extends ChromeBaseSettingsFragment
+ public class AccessibilitySettings extends ChromeBaseSettingsFragment
+@@ -39,6 +40,9 @@ public class AccessibilitySettings extends ChromeBaseSettingsFragment
      public static final String PREF_ZOOM_INFO = "zoom_info";
      public static final String PREF_IMAGE_DESCRIPTIONS = "image_descriptions";
  
@@ -642,7 +626,7 @@ diff --git a/components/browser_ui/accessibility/android/java/src/org/chromium/c
      private PageZoomPreference mPageZoomDefaultZoomPref;
      private ChromeSwitchPreference mPageZoomIncludeOSAdjustment;
      private ChromeSwitchPreference mPageZoomAlwaysShowPref;
-@@ -108,6 +112,12 @@ public class AccessibilitySettings extends ChromeBaseSettingsFragment
+@@ -105,6 +109,12 @@ public class AccessibilitySettings extends ChromeBaseSettingsFragment
                  mDelegate.getReaderAccessibilityDelegate().getValue());
          readerForAccessibilityPref.setOnPreferenceChangeListener(this);
  
@@ -655,7 +639,7 @@ diff --git a/components/browser_ui/accessibility/android/java/src/org/chromium/c
          Preference captions = findPreference(PREF_CAPTIONS);
          captions.setOnPreferenceClickListener(
                  preference -> {
-@@ -167,6 +177,9 @@ public class AccessibilitySettings extends ChromeBaseSettingsFragment
+@@ -165,6 +175,9 @@ public class AccessibilitySettings extends ChromeBaseSettingsFragment
      public boolean onPreferenceChange(Preference preference, Object newValue) {
          if (PREF_FORCE_ENABLE_ZOOM.equals(preference.getKey())) {
              mDelegate.getForceEnableZoomAccessibilityDelegate().setValue((Boolean) newValue);
@@ -663,12 +647,12 @@ diff --git a/components/browser_ui/accessibility/android/java/src/org/chromium/c
 +            mForceTabletUIDelegate.setValue((Boolean) newValue);
 +            mDelegate.requestRestart(getActivity());
          } else if (PREF_READER_FOR_ACCESSIBILITY.equals(preference.getKey())) {
-             boolean readerModeEnabled = (Boolean) newValue;
-             mDelegate.getReaderAccessibilityDelegate().setValue(readerModeEnabled);
+             mDelegate.getReaderAccessibilityDelegate().setValue((Boolean) newValue);
+         } else if (PREF_PAGE_ZOOM_DEFAULT_ZOOM.equals(preference.getKey())) {
 diff --git a/components/browser_ui/accessibility/android/java/src/org/chromium/components/browser_ui/accessibility/AccessibilitySettingsDelegate.java b/components/browser_ui/accessibility/android/java/src/org/chromium/components/browser_ui/accessibility/AccessibilitySettingsDelegate.java
 --- a/components/browser_ui/accessibility/android/java/src/org/chromium/components/browser_ui/accessibility/AccessibilitySettingsDelegate.java
 +++ b/components/browser_ui/accessibility/android/java/src/org/chromium/components/browser_ui/accessibility/AccessibilitySettingsDelegate.java
-@@ -41,6 +41,8 @@ public interface AccessibilitySettingsDelegate {
+@@ -39,6 +39,8 @@ public interface AccessibilitySettingsDelegate {
       */
      BrowserContextHandle getBrowserContextHandle();
  
@@ -680,9 +664,9 @@ diff --git a/components/browser_ui/accessibility/android/java/src/org/chromium/c
 diff --git a/ui/android/java/src/org/chromium/ui/base/DeviceFormFactor.java b/ui/android/java/src/org/chromium/ui/base/DeviceFormFactor.java
 --- a/ui/android/java/src/org/chromium/ui/base/DeviceFormFactor.java
 +++ b/ui/android/java/src/org/chromium/ui/base/DeviceFormFactor.java
-@@ -70,6 +70,14 @@ public class DeviceFormFactor {
-     /** See {@link #setIsTabletForTesting(boolean)}. */
-     private static @Nullable Boolean sIsTabletForTesting;
+@@ -69,6 +69,14 @@ public class DeviceFormFactor {
+         return BuildConfig.IS_DESKTOP_ANDROID;
+     }
  
 +    private static boolean mForceTabletUI = false;
 +    public static void setForceTabletUI(boolean forceTabletUI) {
@@ -695,7 +679,7 @@ diff --git a/ui/android/java/src/org/chromium/ui/base/DeviceFormFactor.java b/ui
      /**
       * Each activity could be on a different display, and this will just tell you whether the
       * display associated with the application context is "tablet sized". Use {@link
-@@ -78,6 +86,7 @@ public class DeviceFormFactor {
+@@ -77,6 +85,7 @@ public class DeviceFormFactor {
      @CalledByNative
      @Deprecated
      public static boolean isTablet() {
@@ -703,7 +687,7 @@ diff --git a/ui/android/java/src/org/chromium/ui/base/DeviceFormFactor.java b/ui
          if (sIsTabletForTesting != null) {
              return sIsTabletForTesting;
          }
-@@ -108,6 +117,7 @@ public class DeviceFormFactor {
+@@ -107,6 +116,7 @@ public class DeviceFormFactor {
       *     E.g. http://developer.samsung.com/samsung-dex/testing
       */
      public static boolean isNonMultiDisplayContextOnTablet(Context context) {

build/patches/Add-option-to-not-persist-tabs-across-sessions.patch

@@ -13,7 +13,7 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 diff --git a/chrome/android/java/res/xml/privacy_preferences.xml b/chrome/android/java/res/xml/privacy_preferences.xml
 --- a/chrome/android/java/res/xml/privacy_preferences.xml
 +++ b/chrome/android/java/res/xml/privacy_preferences.xml
-@@ -95,6 +95,11 @@ found in the LICENSE file.
+@@ -96,6 +96,11 @@ found in the LICENSE file.
          android:title="@string/incognito_settings_title"
          android:summary="@string/incognito_settings_summary"
          android:fragment="org.chromium.chrome.browser.privacy.settings.IncognitoSettings"/>
@@ -28,7 +28,7 @@ diff --git a/chrome/android/java/res/xml/privacy_preferences.xml b/chrome/androi
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java b/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java
-@@ -46,6 +46,7 @@ import org.chromium.base.Callback;
+@@ -45,6 +45,7 @@ import org.chromium.base.Callback;
  import org.chromium.base.CallbackController;
  import org.chromium.base.CallbackUtils;
  import org.chromium.base.CommandLine;
@@ -36,7 +36,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedAct
  import org.chromium.base.IntentUtils;
  import org.chromium.base.Log;
  import org.chromium.base.MemoryPressureListener;
-@@ -2086,8 +2087,10 @@ public class ChromeTabbedActivity extends ChromeActivity {
+@@ -1666,8 +1667,10 @@ public class ChromeTabbedActivity extends ChromeActivity implements MismatchedIn
              boolean hadCipherData =
                      CipherLazyHolder.sCipherInstance.restoreFromBundle(getSavedInstanceState());
  
@@ -51,34 +51,33 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedAct
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/privacy/settings/PrivacySettings.java b/chrome/android/java/src/org/chromium/chrome/browser/privacy/settings/PrivacySettings.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/privacy/settings/PrivacySettings.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/privacy/settings/PrivacySettings.java
-@@ -8,6 +8,7 @@ import static org.chromium.components.content_settings.PrefNames.COOKIE_CONTROLS
+@@ -7,6 +7,7 @@ package org.chromium.chrome.browser.privacy.settings;
+ import static org.chromium.components.content_settings.PrefNames.COOKIE_CONTROLS_MODE;
  
- import android.content.Context;
- import android.content.Intent;
+ import android.os.Build;
 +import android.content.SharedPreferences;
- import android.graphics.drawable.Drawable;
  import android.os.Bundle;
  import android.text.SpannableString;
-@@ -20,7 +21,9 @@ import android.view.View;
- import androidx.annotation.VisibleForTesting;
- import androidx.preference.Preference;
- 
-+import org.chromium.base.BuildInfo;
- import org.chromium.base.Callback;
-+import org.chromium.base.ContextUtils;
- import org.chromium.base.IntentUtils;
- import org.chromium.base.metrics.RecordHistogram;
+ import android.text.style.ClickableSpan;
+@@ -22,6 +23,8 @@ import org.chromium.base.metrics.RecordHistogram;
  import org.chromium.base.metrics.RecordUserAction;
-@@ -112,6 +115,8 @@ public class PrivacySettings extends ChromeBaseSettingsFragment
+ import org.chromium.base.supplier.ObservableSupplier;
+ import org.chromium.base.supplier.ObservableSupplierImpl;
++import org.chromium.base.ContextUtils;
++import org.chromium.base.BuildInfo;
+ import org.chromium.chrome.R;
+ import org.chromium.chrome.browser.enterprise.util.ManagedBrowserUtils;
+ import org.chromium.chrome.browser.flags.ChromeFeatureList;
+@@ -92,6 +95,8 @@ public class PrivacySettings extends ChromeBaseSettingsFragment
      private final SharedPreferencesManager mSharedPreferencesManager =
              ChromeSharedPreferences.getInstance();
  
 +    private static final String PREF_CLOSE_TABS_ON_EXIT = "close_tabs_on_exit";
 +
      private ManagedPreferenceDelegate mManagedPreferenceDelegate;
-     @VisibleForTesting static final String PREF_THIRD_PARTY_COOKIES = "third_party_cookies";
-     @VisibleForTesting static final String PREF_TRACKING_PROTECTION = "tracking_protection";
-@@ -381,7 +386,11 @@ public class PrivacySettings extends ChromeBaseSettingsFragment
+     @VisibleForTesting static final String PREF_FP_PROTECTION = "fp_protection";
+     @VisibleForTesting static final String PREF_IP_PROTECTION = "ip_protection";
+@@ -333,7 +338,11 @@ public class PrivacySettings extends ChromeBaseSettingsFragment
      @Override
      public boolean onPreferenceChange(Preference preference, Object newValue) {
          String key = preference.getKey();
@@ -91,7 +90,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/privacy/setting
              UserPrefs.get(getProfile())
                      .setBoolean(Pref.CAN_MAKE_PAYMENT_ENABLED, (boolean) newValue);
          } else if (PREF_HTTPS_FIRST_MODE_LEGACY.equals(key)) {
-@@ -441,6 +450,11 @@ public class PrivacySettings extends ChromeBaseSettingsFragment
+@@ -409,6 +418,11 @@ public class PrivacySettings extends ChromeBaseSettingsFragment
                              getContext(), getProfile()));
          }
  
@@ -106,9 +105,9 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/privacy/setting
 diff --git a/chrome/browser/ui/android/strings/android_chrome_strings.grd b/chrome/browser/ui/android/strings/android_chrome_strings.grd
 --- a/chrome/browser/ui/android/strings/android_chrome_strings.grd
 +++ b/chrome/browser/ui/android/strings/android_chrome_strings.grd
-@@ -2901,6 +2901,12 @@ To change this setting, <ph name="BEGIN_LINK">BEGIN_LINK</ph>delete the Chrome d
-       <message name="IDS_ACCESSIBILITY_TAB_SWITCHER_TITLE" desc="Accessibility label of the current window when Grid Tab Switcher is shown.">
-         All tabs
+@@ -5479,6 +5479,12 @@ To change this setting, <ph name="BEGIN_LINK">BEGIN_LINK</ph>delete the Chrome d
+       <message name="IDS_CONTEXTMENU_IMAGE_TITLE" desc="The title of a context menu tab when the item pressed contains more than one type. This indicates that all the actions are related to the image.">
+         IMAGE
        </message>
 +      <message name="IDS_CLOSE_TABS_ON_EXIT_TITLE" desc="Text for 'Close tabs on exit' settings-privacy option.">
 +        Close all open tabs on exit
@@ -116,7 +115,7 @@ diff --git a/chrome/browser/ui/android/strings/android_chrome_strings.grd b/chro
 +      <message name="IDS_CLOSE_TABS_ON_EXIT_SUMMARY" desc="Summary text for 'Close tabs on exit' settings-privacy option.">
 +        Don't persist tabs between browsing sessions. Caution: parameters in urls allow linking between different sessions.
 +      </message>
-       <message name="IDS_TAB_LOADING_DEFAULT_TITLE" desc="The title of a tab when we are still waiting for either the URL or the real title. This generally shows when the page is first loading.">
-         Loading…
+       <message name="IDS_CONTEXTMENU_LINK_TITLE" desc="The title of a context menu tab when the item pressed contains more than one type. This indicates that all the actions are related to the link.">
+         LINK
        </message>
 --

build/patches/Add-option-to-use-home-page-as-NTP.patch

@@ -24,9 +24,9 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 diff --git a/chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser/tasks/tab_management/TabGridDialogMediator.java b/chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser/tasks/tab_management/TabGridDialogMediator.java
 --- a/chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser/tasks/tab_management/TabGridDialogMediator.java
 +++ b/chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser/tasks/tab_management/TabGridDialogMediator.java
-@@ -120,6 +120,9 @@ import java.util.Objects;
+@@ -99,6 +99,9 @@ import java.util.Map;
+ import java.util.Objects;
  import java.util.Optional;
- import java.util.Set;
  
 +import org.chromium.chrome.browser.homepage.HomepageManager;
 +import org.chromium.url.GURL;
@@ -34,7 +34,7 @@ diff --git a/chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser
  /**
   * A mediator for the TabGridDialog component, responsible for communicating with the components'
   * coordinator as well as managing the business logic for dialog show/hide.
-@@ -1035,9 +1038,15 @@ public class TabGridDialogMediator
+@@ -918,9 +921,15 @@ public class TabGridDialogMediator
                  return;
              }
  
@@ -45,7 +45,7 @@ diff --git a/chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser
 +                url = gurl != null ? gurl.getSpec() : url;
 +            }
              TabGroupUtils.openUrlInGroup(
-                     assumeNonNull(mCurrentTabGroupModelFilterSupplier.get()),
+                     mCurrentTabGroupModelFilterSupplier.get(),
 -                    UrlConstants.NTP_URL,
 +                    url,
                      currentTab.getId(),
@@ -54,15 +54,15 @@ diff --git a/chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser
 diff --git a/chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser/tasks/tab_management/TabGroupUiMediator.java b/chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser/tasks/tab_management/TabGroupUiMediator.java
 --- a/chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser/tasks/tab_management/TabGroupUiMediator.java
 +++ b/chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser/tasks/tab_management/TabGroupUiMediator.java
-@@ -36,6 +36,7 @@ import org.chromium.chrome.browser.data_sharing.DataSharingServiceFactory;
- import org.chromium.chrome.browser.data_sharing.ui.shared_image_tiles.SharedImageTilesConfig;
+@@ -25,6 +25,7 @@ import org.chromium.chrome.browser.collaboration.CollaborationServiceFactory;
+ import org.chromium.chrome.browser.data_sharing.DataSharingServiceFactory;
  import org.chromium.chrome.browser.data_sharing.ui.shared_image_tiles.SharedImageTilesCoordinator;
- import org.chromium.chrome.browser.layouts.LayoutStateProvider;
+ import org.chromium.chrome.browser.flags.ChromeFeatureList;
 +import org.chromium.chrome.browser.homepage.HomepageManager;
+ import org.chromium.chrome.browser.layouts.LayoutStateProvider;
  import org.chromium.chrome.browser.layouts.LayoutStateProvider.LayoutStateObserver;
  import org.chromium.chrome.browser.layouts.LayoutType;
- import org.chromium.chrome.browser.profiles.Profile;
-@@ -420,10 +421,15 @@ public class TabGroupUiMediator implements BackPressHandler {
+@@ -366,10 +367,15 @@ public class TabGroupUiMediator implements BackPressHandler, ThemeColorObserver,
                      assert relatedTabs.size() > 0;
  
                      Tab parentTabToAttach = relatedTabs.get(relatedTabs.size() - 1);
@@ -97,7 +97,7 @@ diff --git a/chrome/android/java/res/xml/homepage_preferences.xml b/chrome/andro
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/compositor/overlays/strip/TabGroupContextMenuCoordinator.java b/chrome/android/java/src/org/chromium/chrome/browser/compositor/overlays/strip/TabGroupContextMenuCoordinator.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/compositor/overlays/strip/TabGroupContextMenuCoordinator.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/compositor/overlays/strip/TabGroupContextMenuCoordinator.java
-@@ -75,6 +75,9 @@ import org.chromium.ui.text.EmptyTextWatcher;
+@@ -66,6 +66,9 @@ import org.chromium.ui.text.EmptyTextWatcher;
  import org.chromium.ui.widget.AnchoredPopupWindow.HorizontalOrientation;
  import org.chromium.ui.widget.RectProvider;
  
@@ -107,10 +107,10 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/compositor/over
  /**
   * A coordinator for the context menu on the tab strip by long-pressing on the group titles. It is
   * responsible for creating a list of menu items, setting up the menu and displaying the menu.
-@@ -215,9 +218,15 @@ public class TabGroupContextMenuCoordinator extends TabGroupOverflowMenuCoordina
+@@ -197,9 +200,15 @@ public class TabGroupContextMenuCoordinator extends TabGroupOverflowMenuCoordina
                          /* didCloseCallback= */ null);
-                 RecordUserAction.record("MobileToolbarTabGroupMenu.DeleteGroup");
-             } else if (menuId == R.id.open_new_tab_in_group) {
+                 recordUserAction("DeleteGroup");
+             } else if (menuId == org.chromium.chrome.R.id.open_new_tab_in_group) {
 +                String url = UrlConstants.NTP_URL;
 +                if (UrlConstants.NTP_URL.equals(url)
 +                        && HomepageManager.getInstance().getPrefNTPIsHomepageEnabled()) {
@@ -123,11 +123,11 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/compositor/over
 +                        url,
                          tabId,
                          TabLaunchType.FROM_TAB_GROUP_UI);
-                 RecordUserAction.record("MobileToolbarTabGroupMenu.NewTabInGroup");
+                 recordUserAction("NewTabInGroup");
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/homepage/HomepageManager.java b/chrome/android/java/src/org/chromium/chrome/browser/homepage/HomepageManager.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/homepage/HomepageManager.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/homepage/HomepageManager.java
-@@ -258,6 +258,22 @@ public class HomepageManager
+@@ -237,6 +237,22 @@ public class HomepageManager
          notifyHomepageUpdated();
      }
  
@@ -153,15 +153,15 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/homepage/Homepa
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/homepage/settings/HomepageSettings.java b/chrome/android/java/src/org/chromium/chrome/browser/homepage/settings/HomepageSettings.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/homepage/settings/HomepageSettings.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/homepage/settings/HomepageSettings.java
-@@ -26,6 +26,7 @@ import org.chromium.components.browser_ui.settings.SettingsUtils;
+@@ -24,6 +24,7 @@ import org.chromium.components.browser_ui.settings.SettingsUtils;
  import org.chromium.components.embedder_support.util.UrlUtilities;
  import org.chromium.components.url_formatter.UrlFormatter;
  import org.chromium.url.GURL;
 +import org.chromium.components.embedder_support.util.UrlConstants;
  
  /** Fragment that allows the user to configure homepage related preferences. */
- @NullMarked
-@@ -35,6 +36,8 @@ public class HomepageSettings extends ChromeBaseSettingsFragment {
+ public class HomepageSettings extends ChromeBaseSettingsFragment {
+@@ -32,6 +33,8 @@ public class HomepageSettings extends ChromeBaseSettingsFragment {
      @VisibleForTesting
      public static final String PREF_HOMEPAGE_RADIO_GROUP = "homepage_radio_group";
  
@@ -170,7 +170,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/homepage/settin
      private HomepageManager mHomepageManager;
      private RadioButtonGroupHomepagePreference mRadioButtons;
      private final ObservableSupplierImpl<String> mPageTitle = new ObservableSupplierImpl<>();
-@@ -78,6 +81,15 @@ public class HomepageSettings extends ChromeBaseSettingsFragment {
+@@ -67,6 +70,15 @@ public class HomepageSettings extends ChromeBaseSettingsFragment {
                  });
          mRadioButtons.setupPreferenceValues(createPreferenceValuesForRadioGroup());
  
@@ -189,7 +189,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/homepage/settin
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/metrics/LaunchMetrics.java b/chrome/android/java/src/org/chromium/chrome/browser/metrics/LaunchMetrics.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/metrics/LaunchMetrics.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/metrics/LaunchMetrics.java
-@@ -117,7 +117,6 @@ public class LaunchMetrics {
+@@ -113,7 +113,6 @@ public class LaunchMetrics {
      public static void recordHomePageLaunchMetrics(
              boolean showHomeButton, boolean homepageIsNtp, GURL homepageGurl) {
          if (homepageGurl.isEmpty()) {
@@ -200,18 +200,18 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/metrics/LaunchM
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/ChromeTabCreator.java b/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/ChromeTabCreator.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/ChromeTabCreator.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/ChromeTabCreator.java
-@@ -27,6 +27,7 @@ import org.chromium.chrome.browser.app.tab_activity_glue.ReparentingTask;
+@@ -24,6 +24,7 @@ import org.chromium.chrome.browser.app.tab_activity_glue.ReparentingTask;
  import org.chromium.chrome.browser.compositor.CompositorViewHolder;
  import org.chromium.chrome.browser.flags.ChromeFeatureList;
- import org.chromium.chrome.browser.multiwindow.MultiInstanceManager;
+ import org.chromium.chrome.browser.new_tab_url.DseNewTabUrlManager;
 +import org.chromium.chrome.browser.homepage.HomepageManager;
  import org.chromium.chrome.browser.prefetch.settings.PreloadPagesSettingsBridge;
  import org.chromium.chrome.browser.prefetch.settings.PreloadPagesState;
  import org.chromium.chrome.browser.profiles.Profile;
-@@ -565,6 +566,13 @@ public class ChromeTabCreator extends TabCreator
+@@ -485,6 +486,13 @@ public class ChromeTabCreator extends TabCreator {
+      * @return the created tab.
       */
-     public @Nullable Tab launchUrl(
-             String url, @TabLaunchType int type, @Nullable Intent intent, long intentTimestamp) {
+     public Tab launchUrl(String url, @TabLaunchType int type, Intent intent, long intentTimestamp) {
 +        if (!mIncognito && url.equals(UrlConstants.NTP_URL)) {
 +            if (HomepageManager.getInstance().getPrefNTPIsHomepageEnabled()) {
 +                GURL gurl = HomepageManager.getInstance().getHomepageGurl();
@@ -225,7 +225,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/Chrome
 diff --git a/chrome/browser/preferences/android/java/src/org/chromium/chrome/browser/preferences/ChromePreferenceKeys.java b/chrome/browser/preferences/android/java/src/org/chromium/chrome/browser/preferences/ChromePreferenceKeys.java
 --- a/chrome/browser/preferences/android/java/src/org/chromium/chrome/browser/preferences/ChromePreferenceKeys.java
 +++ b/chrome/browser/preferences/android/java/src/org/chromium/chrome/browser/preferences/ChromePreferenceKeys.java
-@@ -330,6 +330,7 @@ public final class ChromePreferenceKeys {
+@@ -293,6 +293,7 @@ public final class ChromePreferenceKeys {
      public static final String HOMEPAGE_USE_CHROME_NTP = "Chrome.Homepage.UseNTP";
      public static final String HOMEPAGE_USE_DEFAULT_URI = "homepage_partner_enabled";
  
@@ -236,7 +236,7 @@ diff --git a/chrome/browser/preferences/android/java/src/org/chromium/chrome/bro
 diff --git a/chrome/browser/preferences/android/java/src/org/chromium/chrome/browser/preferences/LegacyChromePreferenceKeys.java b/chrome/browser/preferences/android/java/src/org/chromium/chrome/browser/preferences/LegacyChromePreferenceKeys.java
 --- a/chrome/browser/preferences/android/java/src/org/chromium/chrome/browser/preferences/LegacyChromePreferenceKeys.java
 +++ b/chrome/browser/preferences/android/java/src/org/chromium/chrome/browser/preferences/LegacyChromePreferenceKeys.java
-@@ -60,6 +60,7 @@ public class LegacyChromePreferenceKeys {
+@@ -61,6 +61,7 @@ public class LegacyChromePreferenceKeys {
                  ChromePreferenceKeys.HISTORY_SHOW_HISTORY_INFO,
                  ChromePreferenceKeys.HOMEPAGE_ENABLED,
                  ChromePreferenceKeys.HOMEPAGE_USE_DEFAULT_URI,
@@ -247,7 +247,7 @@ diff --git a/chrome/browser/preferences/android/java/src/org/chromium/chrome/bro
 diff --git a/chrome/browser/ui/android/strings/android_chrome_strings.grd b/chrome/browser/ui/android/strings/android_chrome_strings.grd
 --- a/chrome/browser/ui/android/strings/android_chrome_strings.grd
 +++ b/chrome/browser/ui/android/strings/android_chrome_strings.grd
-@@ -1357,6 +1357,9 @@ Your Google account may have other forms of browsing history like searches and a
+@@ -1478,6 +1478,9 @@ Your Google account may have other forms of browsing history like searches and a
        <message name="IDS_CLEAR_BROWSING_DATA_TAB_PERIOD_HOUR" desc="The option to delete browsing data from the last hour.">
          Last hour
        </message>
@@ -260,10 +260,10 @@ diff --git a/chrome/browser/ui/android/strings/android_chrome_strings.grd b/chro
 diff --git a/chrome/browser/ui/browser_ui_prefs.cc b/chrome/browser/ui/browser_ui_prefs.cc
 --- a/chrome/browser/ui/browser_ui_prefs.cc
 +++ b/chrome/browser/ui/browser_ui_prefs.cc
-@@ -111,6 +111,8 @@ void RegisterBrowserUserPrefs(user_prefs::PrefRegistrySyncable* registry) {
- 
-   registry->RegisterBooleanPref(prefs::kPinSplitTabButton, false,
-                                 pref_registration_flags);
+@@ -90,6 +90,8 @@ void RegisterBrowserUserPrefs(user_prefs::PrefRegistrySyncable* registry) {
+   registry->RegisterBooleanPref(
+       prefs::kShowForwardButton, true,
+       GetHomeAndForwardButtonAndHomePageIsNewTabPageFlags());
 +  registry->RegisterBooleanPref(prefs::kNewTabPageIsHomePage, false,
 +                                PrefRegistry::NO_REGISTRATION_FLAGS);
  
@@ -272,9 +272,9 @@ diff --git a/chrome/browser/ui/browser_ui_prefs.cc b/chrome/browser/ui/browser_u
 diff --git a/chrome/common/pref_names.h b/chrome/common/pref_names.h
 --- a/chrome/common/pref_names.h
 +++ b/chrome/common/pref_names.h
-@@ -1327,6 +1327,10 @@ inline constexpr char kPinSplitTabButton[] = "browser.pin_split_tab_button";
- // by enterprise policy.
- inline constexpr char kGeminiSettings[] = "browser.gemini_settings";
+@@ -1326,6 +1326,10 @@ inline constexpr char kShowHomeButton[] = "browser.show_home_button";
+ // toolbar.
+ inline constexpr char kShowForwardButton[] = "browser.show_forward_button";
  
 +// A boolean specifying whether opening a new tab should open the Home page
 +// instead of the New Tab page.

build/patches/Add-search-engine.patch

@@ -9,18 +9,20 @@ Add DuckDuckGo Lite
 License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 ---
  .../search_engine_choice/default_favicon.png  | Bin 0 -> 903 bytes
+ ...search_engine_choice_scaled_resources.grdp |   1 +
  components/search_engines/BUILD.gn            |   3 ++
  components/search_engines/cromite/BUILD.gn    |  12 ++++++
  .../cromite/cromite_prepopulated_engines.json |  37 ++++++++++++++++++
  .../search_engine_choice_utils.cc             |   5 +--
+ .../search_engine_countries-inc.cc            |   2 +
  .../search_engines/search_engine_type.h       |   5 +++
- .../template_url_prepopulate_data.cc          |  21 +++++++++-
- .../template_url_prepopulate_data.h           |   9 -----
+ .../template_url_prepopulate_data.cc          |   3 +-
+ .../template_url_prepopulate_data.h           |   7 ----
  tools/json_to_struct/json_to_struct.gni       |   9 +++++
  tools/json_to_struct/json_to_struct.py        |  26 ++++++++----
  tools/json_to_struct/struct_generator.py      |  10 +++--
  tools/variations/fieldtrial_to_struct.py      |   4 +-
- 12 files changed, 113 insertions(+), 28 deletions(-)
+ 14 files changed, 99 insertions(+), 25 deletions(-)
  create mode 100644 components/resources/default_100_percent/search_engine_choice/default_favicon.png
  create mode 100644 components/search_engines/cromite/BUILD.gn
  create mode 100644 components/search_engines/cromite/cromite_prepopulated_engines.json
@@ -52,10 +54,21 @@ d#;<tA>kFnu^?NN9uE_uZ002ovPDHLkV1m60sc!%P
 literal 0
 HcmV?d00001
 
+diff --git a/components/resources/search_engine_choice_scaled_resources.grdp b/components/resources/search_engine_choice_scaled_resources.grdp
+--- a/components/resources/search_engine_choice_scaled_resources.grdp
++++ b/components/resources/search_engine_choice_scaled_resources.grdp
+@@ -5,6 +5,7 @@
+   <if expr="_google_chrome">
+     <structure type="chrome_scaled_image" name="IDR_GOOGLE_COM_PNG" file="google_chrome/google_search_logo.png" />
+   </if>
++  <structure type="chrome_scaled_image" name="IDR_GOOGLEEN_PNG" file="search_engine_choice/default_favicon.png" />
+   <structure type="chrome_scaled_image" name="IDR_AR_YAHOO_COM_PNG" file="search_engine_choice/yahoo_com.png" />
+   <structure type="chrome_scaled_image" name="IDR_AT_YAHOO_COM_PNG" file="search_engine_choice/yahoo_com.png" />
+   <structure type="chrome_scaled_image" name="IDR_AU_YAHOO_COM_PNG" file="search_engine_choice/yahoo_com.png" />
 diff --git a/components/search_engines/BUILD.gn b/components/search_engines/BUILD.gn
 --- a/components/search_engines/BUILD.gn
 +++ b/components/search_engines/BUILD.gn
-@@ -72,6 +72,7 @@ static_library("search_engines") {
+@@ -70,6 +70,7 @@ static_library("search_engines") {
      "//third_party/metrics_proto",
      "//third_party/omnibox_proto",
      "//third_party/search_engines_data:prepopulated_engines",
@@ -63,7 +76,7 @@ diff --git a/components/search_engines/BUILD.gn b/components/search_engines/BUIL
    ]
  
    deps = [
-@@ -162,6 +163,7 @@ source_set("search_engine_utils") {
+@@ -155,6 +156,7 @@ source_set("search_engine_utils") {
      ":search_engine_type",
      "//components/google/core/common",
      "//third_party/search_engines_data:prepopulated_engines",
@@ -71,7 +84,7 @@ diff --git a/components/search_engines/BUILD.gn b/components/search_engines/BUIL
    ]
  
    deps = [ "//url" ]
-@@ -252,6 +254,7 @@ source_set("unit_tests") {
+@@ -235,6 +237,7 @@ source_set("unit_tests") {
      "//testing/gmock",
      "//testing/gtest",
      "//third_party/search_engines_data:prepopulated_engines",
@@ -141,7 +154,7 @@ new file mode 100644
 diff --git a/components/search_engines/search_engine_choice/search_engine_choice_utils.cc b/components/search_engines/search_engine_choice/search_engine_choice_utils.cc
 --- a/components/search_engines/search_engine_choice/search_engine_choice_utils.cc
 +++ b/components/search_engines/search_engine_choice/search_engine_choice_utils.cc
-@@ -155,10 +155,7 @@ void RecordChoiceScreenDefaultSearchProviderType(
+@@ -182,10 +182,7 @@ void RecordChoiceScreenDefaultSearchProviderType(
  }
  
  void RecordChoiceScreenSelectedIndex(int selected_engine_index) {
@@ -153,19 +166,29 @@ diff --git a/components/search_engines/search_engine_choice/search_engine_choice
  }
  
  void RecordChoiceScreenPositionsCountryMismatch(bool has_mismatch) {
+diff --git a/components/search_engines/search_engine_countries-inc.cc b/components/search_engines/search_engine_countries-inc.cc
+--- a/components/search_engines/search_engine_countries-inc.cc
++++ b/components/search_engines/search_engine_countries-inc.cc
+@@ -1452,5 +1452,7 @@ const std::vector<EngineAndTier> GetPrepopulationSetFromCountryID(
+   for (size_t i = 0; i < num_engines; i++) {
+     t_url.push_back(engines[i]);
+   }
++  t_url.push_back({SearchEngineTier::kTopEngines, &googleen});
++  t_url.push_back({SearchEngineTier::kTopEngines, &duckduckgo_light});
+   return t_url;
+ }
 diff --git a/components/search_engines/search_engine_type.h b/components/search_engines/search_engine_type.h
 --- a/components/search_engines/search_engine_type.h
 +++ b/components/search_engines/search_engine_type.h
-@@ -98,11 +98,16 @@ enum SearchEngineType {
-   SEARCH_ENGINE_FREESPOKE = 78,
-   SEARCH_ENGINE_KAGI = 79,
-   SEARCH_ENGINE_STARTER_PACK_AI_MODE = 80,
-+  SEARCH_ENGINE_GOOGLE_EN = 81,
-+  SEARCH_ENGINE_DUCKDUCKGOLIGHT = 82,
+@@ -91,10 +91,15 @@ enum SearchEngineType {
+   SEARCH_ENGINE_YOU = 72,
+   SEARCH_ENGINE_STARTER_PACK_GEMINI = 73,
+   SEARCH_ENGINE_LILO = 74,
++  SEARCH_ENGINE_GOOGLE_EN = 75,
++  SEARCH_ENGINE_DUCKDUCKGOLIGHT = 76,
  
    SEARCH_ENGINE_MAX  // Bounding value needed for UMA histogram macro.
  };
- // LINT.ThenChange(//tools/metrics/histograms/enums.xml:OmniboxSearchEngineType)
  
 +static_assert(SEARCH_ENGINE_DUCKDUCKGOLIGHT == (SEARCH_ENGINE_MAX - 1),
 +              "Please check this patch");
@@ -176,8 +199,8 @@ diff --git a/components/search_engines/search_engine_type.h b/components/search_
 diff --git a/components/search_engines/template_url_prepopulate_data.cc b/components/search_engines/template_url_prepopulate_data.cc
 --- a/components/search_engines/template_url_prepopulate_data.cc
 +++ b/components/search_engines/template_url_prepopulate_data.cc
-@@ -28,6 +28,8 @@
- #include "components/search_engines/template_url_data_util.h"
+@@ -29,6 +29,8 @@
+ #include "components/version_info/version_info.h"
  #include "third_party/search_engines_data/resources/definitions/prepopulated_engines.h"
  
 +#include "components/search_engines/cromite/cromite_prepopulated_engines.h"
@@ -185,54 +208,18 @@ diff --git a/components/search_engines/template_url_prepopulate_data.cc b/compon
  namespace TemplateURLPrepopulateData {
  
  // Helpers --------------------------------------------------------------------
-@@ -122,7 +124,7 @@ int GetDataVersion(PrefService* prefs) {
-       kCurrentDataVersion;
+@@ -78,7 +80,6 @@ GetPrepopulatedEnginesForEeaRegionCountries(int country_id,
+   generator.seed(profile_seed);
+   std::shuffle(t_urls.begin(), t_urls.end(), generator);
+ 
+-  CHECK_LE(t_urls.size(), kMaxEeaPrepopulatedEngines);
+   return t_urls;
  }
  
--std::vector<std::unique_ptr<TemplateURLData>> GetPrepopulatedEngines(
-+std::vector<std::unique_ptr<TemplateURLData>> GetPrepopulatedEnginesChromium(
-     PrefService& prefs,
-     std::vector<const TemplateURLPrepopulateData::PrepopulatedEngine*>
-         regional_prepopulated_engines) {
-@@ -138,6 +140,17 @@ std::vector<std::unique_ptr<TemplateURLData>> GetPrepopulatedEngines(
-                         &PrepopulatedEngineToTemplateURLData);
- }
- 
-+std::vector<std::unique_ptr<TemplateURLData>> GetPrepopulatedEngines(
-+    PrefService& prefs,
-+    std::vector<const TemplateURLPrepopulateData::PrepopulatedEngine*>
-+        regional_prepopulated_engines) {
-+  std::vector<std::unique_ptr<TemplateURLData>> t_urls =
-+    GetPrepopulatedEnginesChromium(prefs, regional_prepopulated_engines);
-+  t_urls.push_back(TemplateURLDataFromPrepopulatedEngine(googleen));
-+  t_urls.push_back(TemplateURLDataFromPrepopulatedEngine(duckduckgo_light));
-+  return t_urls;
-+}
-+
- std::unique_ptr<TemplateURLData> GetPrepopulatedEngine(
-     PrefService& prefs,
-     std::vector<const TemplateURLPrepopulateData::PrepopulatedEngine*>
-@@ -159,11 +172,15 @@ std::vector<std::unique_ptr<TemplateURLData>> GetLocalPrepopulatedEngines(
-     return std::vector<std::unique_ptr<TemplateURLData>>();
-   }
- 
--  return base::ToVector(
-+  std::vector<std::unique_ptr<TemplateURLData>> t_urls =
-+    base::ToVector(
-       regional_capabilities::GetPrepopulatedEngines(
-           country_id, prefs,
-           regional_capabilities::SearchEngineListType::kTopFive),
-       &PrepopulatedEngineToTemplateURLData);
-+  t_urls.push_back(TemplateURLDataFromPrepopulatedEngine(googleen));
-+  t_urls.push_back(TemplateURLDataFromPrepopulatedEngine(duckduckgo_light));
-+  return t_urls;
- }
- 
- #endif
 diff --git a/components/search_engines/template_url_prepopulate_data.h b/components/search_engines/template_url_prepopulate_data.h
 --- a/components/search_engines/template_url_prepopulate_data.h
 +++ b/components/search_engines/template_url_prepopulate_data.h
-@@ -27,15 +27,6 @@ struct PrepopulatedEngine;
+@@ -32,13 +32,6 @@ struct PrepopulatedEngine;
  
  extern const int kMaxPrepopulatedEngineID;
  
@@ -241,17 +228,15 @@ diff --git a/components/search_engines/template_url_prepopulate_data.h b/compone
 -//
 -// Note: If this is increased, please also increase the declared variant count
 -// for the `Search.ChoiceScreenShowedEngineAt.Index{Index}` histogram.
--// TODO(crbug.com/408932087): Investigate moving it to the file that actually
--// populates these, `//c/regional_capabilities/r*c*_util.cc`.
 -inline constexpr size_t kMaxEeaPrepopulatedEngines = 8;
 -
  // The maximum number of prepopulated search engines that can be returned in
  // in the rest of the world by `GetPrepopulatedEngines()`.
- // TODO(crbug.com/408932087): Investigate deduping it with the constant
+ inline constexpr size_t kMaxRowPrepopulatedEngines = 5;
 diff --git a/tools/json_to_struct/json_to_struct.gni b/tools/json_to_struct/json_to_struct.gni
 --- a/tools/json_to_struct/json_to_struct.gni
 +++ b/tools/json_to_struct/json_to_struct.gni
-@@ -39,6 +39,11 @@ template("json_to_struct") {
+@@ -25,6 +25,11 @@ template("json_to_struct") {
    action_name = target_name + "_action"
    source_set_name = target_name
  
@@ -262,8 +247,8 @@ diff --git a/tools/json_to_struct/json_to_struct.gni b/tools/json_to_struct/json
 +
    action(action_name) {
      visibility = [ ":$source_set_name" ]
-     script = "//build/gn_run_binary.py"
-@@ -63,6 +68,10 @@ template("json_to_struct") {
+     script = "//tools/json_to_struct/json_to_struct.py"
+@@ -49,6 +54,10 @@ template("json_to_struct") {
        "--namespace=" + invoker.namespace,
        "--schema=" + rebase_path(invoker.schema_file, root_build_dir),
      ]
@@ -277,7 +262,7 @@ diff --git a/tools/json_to_struct/json_to_struct.gni b/tools/json_to_struct/json
 diff --git a/tools/json_to_struct/json_to_struct.py b/tools/json_to_struct/json_to_struct.py
 --- a/tools/json_to_struct/json_to_struct.py
 +++ b/tools/json_to_struct/json_to_struct.py
-@@ -103,7 +103,7 @@ def _GenerateHeaderGuard(h_filename):
+@@ -97,7 +97,7 @@ def _GenerateHeaderGuard(h_filename):
    return re.sub(u'^_*', '', result) + u'_'  # Remove leading underscores.
  
  
@@ -286,7 +271,7 @@ diff --git a/tools/json_to_struct/json_to_struct.py b/tools/json_to_struct/json_
    """Generates the .h file containing the definition of the structure specified
    by the schema.
  
-@@ -147,11 +147,15 @@ def _GenerateH(basepath, fileroot, head, namespace, schema, description):
+@@ -133,11 +133,15 @@ def _GenerateH(basepath, fileroot, head, namespace, schema, description):
        f.write(u'#include "%s"\n' % header)
      f.write(u'\n')
  
@@ -303,7 +288,7 @@ diff --git a/tools/json_to_struct/json_to_struct.py b/tools/json_to_struct/json_
        schema['type_name'], schema['schema']))
      f.write(u'\n')
  
-@@ -176,7 +180,7 @@ def _GenerateH(basepath, fileroot, head, namespace, schema, description):
+@@ -162,7 +166,7 @@ def _GenerateH(basepath, fileroot, head, namespace, schema, description):
      f.write(u'#endif  // %s\n' % header_guard)
  
  
@@ -312,16 +297,16 @@ diff --git a/tools/json_to_struct/json_to_struct.py b/tools/json_to_struct/json_
    """Generates the .cc file containing the static initializers for the
    of the elements specified in the description.
  
-@@ -211,7 +215,7 @@ def _GenerateCC(basepath, fileroot, head, namespace, schema, description):
+@@ -191,7 +195,7 @@ def _GenerateCC(basepath, fileroot, head, namespace, schema, description):
      f.write(element_generator.GenerateElements(schema['type_name'],
          schema['schema'], description))
  
--    if not aggregation.export_items:
-+    if excludetype == False and not aggregation.export_items:
-       f.write('\n}  // anonymous namespace \n\n')
- 
-     aggregated = GenerateCCAggregation(schema['type_name'], aggregation)
-@@ -298,7 +302,7 @@ def GenerateClass(basepath,
+-    if 'generate_array' in description:
++    if excludetype == False and 'generate_array' in description:
+       f.write(u'\n')
+       f.write(
+           u'const %s* const array_%s[] = {\n' %
+@@ -283,7 +287,7 @@ def GenerateClass(basepath,
  
  
  def GenerateStruct(basepath, output_root, namespace, schema, description,
@@ -330,7 +315,7 @@ diff --git a/tools/json_to_struct/json_to_struct.py b/tools/json_to_struct/json_
    """Generates a C++ struct from a JSON description.
  
    Args:
-@@ -317,8 +321,8 @@ def GenerateStruct(basepath, output_root, namespace, schema, description,
+@@ -302,8 +306,8 @@ def GenerateStruct(basepath, output_root, namespace, schema, description,
    """
    year = int(year) if year else datetime.now().year
    head = HEAD % (year, schema_filename, description_filename)
@@ -341,7 +326,7 @@ diff --git a/tools/json_to_struct/json_to_struct.py b/tools/json_to_struct/json_
  
  if __name__ == '__main__':
    parser = optparse.OptionParser(
-@@ -333,11 +337,17 @@ if __name__ == '__main__':
+@@ -318,11 +322,17 @@ if __name__ == '__main__':
    parser.add_option('-s', '--schema', help='path to the schema file, '
        'mandatory.')
    parser.add_option('-o', '--output', help='output filename, ')
@@ -359,7 +344,7 @@ diff --git a/tools/json_to_struct/json_to_struct.py b/tools/json_to_struct/json_
    description_filename = os.path.normpath(args[0])
    root, ext = os.path.splitext(description_filename)
    shortroot = opts.output if opts.output else os.path.split(root)[1]
-@@ -354,4 +364,4 @@ if __name__ == '__main__':
+@@ -339,4 +349,4 @@ if __name__ == '__main__':
    schema = _Load(opts.schema)
    description = _Load(description_filename)
    GenerateStruct(basepath, output_root, opts.namespace, schema, description,
@@ -399,7 +384,7 @@ diff --git a/tools/json_to_struct/struct_generator.py b/tools/json_to_struct/str
 diff --git a/tools/variations/fieldtrial_to_struct.py b/tools/variations/fieldtrial_to_struct.py
 --- a/tools/variations/fieldtrial_to_struct.py
 +++ b/tools/variations/fieldtrial_to_struct.py
-@@ -235,14 +235,14 @@ def main(arguments):
+@@ -232,14 +232,14 @@ def main(arguments):
    json_to_struct.GenerateStruct(
        basepath, output_root, opts.namespace, schema, description,
        os.path.split(description_filename)[1], os.path.split(opts.schema)[1],

build/patches/Add-setting-to-clear-data-on-exit.patch

@@ -11,7 +11,6 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
  .../ClearBrowsingDataFragment.java            | 31 ++++++--
  .../ClearBrowsingDataFragmentAtStart.java     | 79 +++++++++++++++++++
  chrome/app/settings_strings.grdp              | 10 +++
- chrome/browser/about_flags.cc                 |  1 +
  .../browsing_data/browsing_data_bridge.cc     | 17 +++-
  .../chrome_browsing_data_lifetime_manager.cc  | 22 +++++-
  .../chrome_browsing_data_remover_delegate.cc  | 15 ++++
@@ -33,22 +32,18 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
  .../core/clear_browsing_data_tab.h            |  3 +-
  components/browsing_data/core/pref_names.cc   | 17 ++++
  components/browsing_data/core/pref_names.h    | 10 +++
- components/favicon/core/favicon_database.cc   |  9 +++
- components/favicon/core/favicon_database.h    |  2 +
  .../search_engines/template_url_service.cc    |  1 +
- content/browser/btm/btm_service_impl.cc       |  2 +-
+ content/browser/dips/dips_service_impl.cc     |  2 +-
  content/browser/storage_partition_impl.cc     |  1 +
  .../public/browser/browsing_data_remover.h    |  7 +-
- .../Add-setting-to-clear-data-on-exit.inc     |  8 ++
- 36 files changed, 406 insertions(+), 33 deletions(-)
+ 32 files changed, 386 insertions(+), 33 deletions(-)
  create mode 100644 chrome/android/java/src/org/chromium/chrome/browser/browsing_data/ClearBrowsingDataFragmentAtStart.java
  create mode 100644 chrome/browser/ui/android/strings/cromite_android_chrome_strings_grd/Add-setting-to-clear-data-on-exit.grdp
- create mode 100644 cromite_flags/chrome/browser/about_flags_cc/Add-setting-to-clear-data-on-exit.inc
 
 diff --git a/chrome/android/chrome_java_sources.gni b/chrome/android/chrome_java_sources.gni
 --- a/chrome/android/chrome_java_sources.gni
 +++ b/chrome/android/chrome_java_sources.gni
-@@ -262,6 +262,7 @@ chrome_java_sources = [
+@@ -322,6 +322,7 @@ chrome_java_sources = [
    "java/src/org/chromium/chrome/browser/browsing_data/ClearBrowsingDataCheckBoxPreference.java",
    "java/src/org/chromium/chrome/browser/browsing_data/ClearBrowsingDataFetcher.java",
    "java/src/org/chromium/chrome/browser/browsing_data/ClearBrowsingDataFragment.java",
@@ -74,7 +69,7 @@ diff --git a/chrome/android/java/res/xml/privacy_preferences.xml b/chrome/androi
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java b/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java
-@@ -203,6 +203,7 @@ import org.chromium.chrome.browser.profiles.ProfileProvider;
+@@ -184,6 +184,7 @@ import org.chromium.chrome.browser.profiles.ProfileProvider;
  import org.chromium.chrome.browser.quick_delete.QuickDeleteController;
  import org.chromium.chrome.browser.quick_delete.QuickDeleteDelegateImpl;
  import org.chromium.chrome.browser.quick_delete.QuickDeleteMetricsDelegate;
@@ -82,7 +77,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedAct
  import org.chromium.chrome.browser.read_later.ReadingListBackPressHandler;
  import org.chromium.chrome.browser.recent_tabs.CrossDevicePaneFactory;
  import org.chromium.chrome.browser.reengagement.ReengagementNotificationController;
-@@ -2091,7 +2092,11 @@ public class ChromeTabbedActivity extends ChromeActivity {
+@@ -1666,7 +1667,11 @@ public class ChromeTabbedActivity extends ChromeActivity implements MismatchedIn
              Intent intent = getIntent();
  
              boolean hadCipherData =
@@ -98,7 +93,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedAct
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/browsing_data/BrowsingDataBridge.java b/chrome/android/java/src/org/chromium/chrome/browser/browsing_data/BrowsingDataBridge.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/browsing_data/BrowsingDataBridge.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/browsing_data/BrowsingDataBridge.java
-@@ -224,8 +224,8 @@ public final class BrowsingDataBridge implements Destroyable {
+@@ -218,8 +218,8 @@ public final class BrowsingDataBridge implements Destroyable {
       *     BrowsingDataType}).
       * @return The state of the corresponding deletion preference.
       */
@@ -109,7 +104,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/browsing_data/B
      }
  
      /**
-@@ -235,8 +235,8 @@ public final class BrowsingDataBridge implements Destroyable {
+@@ -229,8 +229,8 @@ public final class BrowsingDataBridge implements Destroyable {
       *     BrowsingDataType}).
       * @param value The state to be set.
       */
@@ -120,7 +115,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/browsing_data/B
      }
  
      /**
-@@ -340,10 +340,10 @@ public final class BrowsingDataBridge implements Destroyable {
+@@ -338,10 +338,10 @@ public final class BrowsingDataBridge implements Destroyable {
                  @JniType("Profile*") Profile profile, @JniType("std::string") String origin);
  
          boolean getBrowsingDataDeletionPreference(
@@ -136,10 +131,10 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/browsing_data/B
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/browsing_data/ClearBrowsingDataFragment.java b/chrome/android/java/src/org/chromium/chrome/browser/browsing_data/ClearBrowsingDataFragment.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/browsing_data/ClearBrowsingDataFragment.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/browsing_data/ClearBrowsingDataFragment.java
-@@ -160,6 +160,12 @@ public class ClearBrowsingDataFragment extends ChromeBaseSettingsFragment
-             assert mCheckbox == preference;
+@@ -163,6 +163,12 @@ public class ClearBrowsingDataFragment extends ChromeBaseSettingsFragment
  
              mParent.updateButtonState();
+             mShouldAnnounceCounterResult = true;
 +
 +            BrowsingDataBridge.getForProfile(mParent.getProfile())
 +                    .setBrowsingDataDeletionPreference(
@@ -149,7 +144,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/browsing_data/C
              return true;
          }
  
-@@ -241,7 +247,7 @@ public class ClearBrowsingDataFragment extends ChromeBaseSettingsFragment
+@@ -255,7 +261,7 @@ public class ClearBrowsingDataFragment extends ChromeBaseSettingsFragment
      private @TimePeriod int mLastSelectedTimePeriod;
      private boolean mShouldShowPostDeleteFeedback;
  
@@ -158,7 +153,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/browsing_data/C
  
      /**
       * @return All available {@link DialogOption} entries.
-@@ -347,7 +353,7 @@ public class ClearBrowsingDataFragment extends ChromeBaseSettingsFragment
+@@ -361,7 +367,7 @@ public class ClearBrowsingDataFragment extends ChromeBaseSettingsFragment
      }
  
      /** Called when browsing data is about to be cleared. */
@@ -167,7 +162,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/browsing_data/C
          RecordUserAction.record("ClearBrowsingData_AdvancedTab");
  
          if (ChromeFeatureList.sClearBrowsingDataAndroidSurvey.isEnabled()) {
-@@ -437,6 +443,7 @@ public class ClearBrowsingDataFragment extends ChromeBaseSettingsFragment
+@@ -451,6 +457,7 @@ public class ClearBrowsingDataFragment extends ChromeBaseSettingsFragment
              BrowsingDataBridge.getForProfile(getProfile())
                      .setBrowsingDataDeletionPreference(
                              ClearBrowsingDataFragment.getDataType(item.getOption()),
@@ -175,7 +170,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/browsing_data/C
                              item.isSelected());
          }
  
-@@ -444,8 +451,12 @@ public class ClearBrowsingDataFragment extends ChromeBaseSettingsFragment
+@@ -458,8 +465,12 @@ public class ClearBrowsingDataFragment extends ChromeBaseSettingsFragment
                  .setBrowsingDataDeletionTimePeriod(mLastSelectedTimePeriod);
      }
  
@@ -189,7 +184,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/browsing_data/C
          String referrer =
                  fragmentArgs.getString(
                          ClearBrowsingDataFragment.CLEAR_BROWSING_DATA_REFERRER, null);
-@@ -471,6 +482,10 @@ public class ClearBrowsingDataFragment extends ChromeBaseSettingsFragment
+@@ -485,6 +496,10 @@ public class ClearBrowsingDataFragment extends ChromeBaseSettingsFragment
                  DialogOption.CLEAR_SITE_SETTINGS);
      }
  
@@ -200,7 +195,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/browsing_data/C
      /**
       * Decides whether a given dialog option should be selected when the dialog is initialized.
       *
-@@ -479,7 +494,7 @@ public class ClearBrowsingDataFragment extends ChromeBaseSettingsFragment
+@@ -493,7 +508,7 @@ public class ClearBrowsingDataFragment extends ChromeBaseSettingsFragment
       */
      private boolean isOptionSelectedByDefault(@DialogOption int option) {
          return BrowsingDataBridge.getForProfile(getProfile())
@@ -209,7 +204,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/browsing_data/C
      }
  
      /**
-@@ -547,6 +562,7 @@ public class ClearBrowsingDataFragment extends ChromeBaseSettingsFragment
+@@ -561,6 +576,7 @@ public class ClearBrowsingDataFragment extends ChromeBaseSettingsFragment
       * options.
       */
      private void onClearButtonClicked() {
@@ -217,7 +212,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/browsing_data/C
          if (shouldShowImportantSitesDialog()) {
              showImportantDialogThenClear();
              return;
-@@ -576,6 +592,7 @@ public class ClearBrowsingDataFragment extends ChromeBaseSettingsFragment
+@@ -591,6 +607,7 @@ public class ClearBrowsingDataFragment extends ChromeBaseSettingsFragment
          Button clearButton = (Button) getView().findViewById(R.id.clear_button);
          boolean isEnabled = !getSelectedOptions().isEmpty();
          clearButton.setEnabled(isEnabled);
@@ -225,7 +220,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/browsing_data/C
      }
  
      private int getSpinnerIndex(
-@@ -651,7 +668,7 @@ public class ClearBrowsingDataFragment extends ChromeBaseSettingsFragment
+@@ -666,7 +683,7 @@ public class ClearBrowsingDataFragment extends ChromeBaseSettingsFragment
                              .getBoolean(Pref.ALLOW_DELETING_BROWSER_HISTORY)) {
                  enabled = false;
                  browsingDataBridge.setBrowsingDataDeletionPreference(
@@ -234,7 +229,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/browsing_data/C
              }
  
              // Disable tabs closure if the user is in multi-window mode.
-@@ -681,8 +698,12 @@ public class ClearBrowsingDataFragment extends ChromeBaseSettingsFragment
+@@ -696,8 +713,12 @@ public class ClearBrowsingDataFragment extends ChromeBaseSettingsFragment
          mSigninManager.addSignInStateObserver(this);
  
          setHasOptionsMenu(true);
@@ -334,7 +329,7 @@ new file mode 100644
 diff --git a/chrome/app/settings_strings.grdp b/chrome/app/settings_strings.grdp
 --- a/chrome/app/settings_strings.grdp
 +++ b/chrome/app/settings_strings.grdp
-@@ -2054,6 +2054,16 @@
+@@ -2203,6 +2203,16 @@
    <message name="IDS_SETTINGS_CLEAR_BROWSING_DATA" desc="Text for delete browsing data button in Privacy options">
      Delete browsing data
    </message>
@@ -351,17 +346,6 @@ diff --git a/chrome/app/settings_strings.grdp b/chrome/app/settings_strings.grdp
    <message name="IDS_SETTINGS_CLEAR_DATA_DESCRIPTION" desc="Description for delete browsing data button in Privacy options. 'History' refers to browsing history. 'Cookies' refers to the technical meaning of a cookie, i.e. data saved by a website on the user's computer, as in when a website saves your preferences.">
      Delete history, cookies, cache, and more
    </message>
-diff --git a/chrome/browser/about_flags.cc b/chrome/browser/about_flags.cc
---- a/chrome/browser/about_flags.cc
-+++ b/chrome/browser/about_flags.cc
-@@ -107,6 +107,7 @@
- #include "components/enterprise/data_controls/core/browser/features.h"
- #include "components/enterprise/obfuscation/core/utils.h"
- #include "components/error_page/common/error_page_switches.h"
-+#include "components/favicon/core/favicon_database.h"
- #include "components/feature_engagement/public/feature_constants.h"
- #include "components/feature_engagement/public/feature_list.h"
- #include "components/feed/feed_feature_list.h"
 diff --git a/chrome/browser/android/browsing_data/browsing_data_bridge.cc b/chrome/browser/android/browsing_data/browsing_data_bridge.cc
 --- a/chrome/browser/android/browsing_data/browsing_data_bridge.cc
 +++ b/chrome/browser/android/browsing_data/browsing_data_bridge.cc
@@ -420,7 +404,7 @@ diff --git a/chrome/browser/android/browsing_data/browsing_data_bridge.cc b/chro
 diff --git a/chrome/browser/browsing_data/chrome_browsing_data_lifetime_manager.cc b/chrome/browser/browsing_data/chrome_browsing_data_lifetime_manager.cc
 --- a/chrome/browser/browsing_data/chrome_browsing_data_lifetime_manager.cc
 +++ b/chrome/browser/browsing_data/chrome_browsing_data_lifetime_manager.cc
-@@ -324,8 +324,25 @@ void ChromeBrowsingDataLifetimeManager::Shutdown() {
+@@ -311,8 +311,25 @@ void ChromeBrowsingDataLifetimeManager::Shutdown() {
  
  void ChromeBrowsingDataLifetimeManager::ClearBrowsingDataForOnExitPolicy(
      bool keep_browser_alive) {
@@ -448,7 +432,7 @@ diff --git a/chrome/browser/browsing_data/chrome_browsing_data_lifetime_manager.
  
    if (!data_types.empty() &&
        IsConditionSatisfiedForBrowsingDataRemoval(GetSyncTypesForPolicyPref(
-@@ -434,6 +451,7 @@ void ChromeBrowsingDataLifetimeManager::StartScheduledBrowsingDataRemoval() {
+@@ -421,6 +438,7 @@ void ChromeBrowsingDataLifetimeManager::StartScheduledBrowsingDataRemoval() {
  bool ChromeBrowsingDataLifetimeManager::
      IsConditionSatisfiedForBrowsingDataRemoval(
          const syncer::UserSelectableTypeSet sync_types) {
@@ -459,7 +443,7 @@ diff --git a/chrome/browser/browsing_data/chrome_browsing_data_lifetime_manager.
 diff --git a/chrome/browser/browsing_data/chrome_browsing_data_remover_delegate.cc b/chrome/browser/browsing_data/chrome_browsing_data_remover_delegate.cc
 --- a/chrome/browser/browsing_data/chrome_browsing_data_remover_delegate.cc
 +++ b/chrome/browser/browsing_data/chrome_browsing_data_remover_delegate.cc
-@@ -350,6 +350,7 @@ void ChromeBrowsingDataRemoverDelegate::RemoveEmbedderData(
+@@ -360,6 +360,7 @@ void ChromeBrowsingDataRemoverDelegate::RemoveEmbedderData(
      uint64_t origin_type_mask,
      base::OnceCallback<void(uint64_t)> callback) {
    CHECK(((remove_mask &
@@ -467,7 +451,7 @@ diff --git a/chrome/browser/browsing_data/chrome_browsing_data_remover_delegate.
            ~content::BrowsingDataRemover::DATA_TYPE_AVOID_CLOSING_CONNECTIONS &
            ~constants::FILTERABLE_DATA_TYPES) == 0) ||
          filter_builder->MatchesAllOriginsAndDomains());
-@@ -457,6 +458,9 @@ void ChromeBrowsingDataRemoverDelegate::RemoveEmbedderData(
+@@ -467,6 +468,9 @@ void ChromeBrowsingDataRemoverDelegate::RemoveEmbedderData(
            CreateTaskCompletionClosure(TracingDataType::kHistory),
            &history_task_tracker_);
      }
@@ -477,7 +461,7 @@ diff --git a/chrome/browser/browsing_data/chrome_browsing_data_remover_delegate.
      if (ClipboardRecentContent::GetInstance())
        ClipboardRecentContent::GetInstance()->SuppressClipboardContent();
  
-@@ -565,6 +569,11 @@ void ChromeBrowsingDataRemoverDelegate::RemoveEmbedderData(
+@@ -575,6 +579,11 @@ void ChromeBrowsingDataRemoverDelegate::RemoveEmbedderData(
      // and SSL host state are scoped to hosts and represent them as std::string.
      // Rename the method to indicate its more general usage.
      if (profile_->GetSSLHostStateDelegate()) {
@@ -489,7 +473,7 @@ diff --git a/chrome/browser/browsing_data/chrome_browsing_data_remover_delegate.
        profile_->GetSSLHostStateDelegate()->Clear(
            filter_builder->MatchesAllOriginsAndDomains()
                ? base::RepeatingCallback<bool(const std::string&)>()
-@@ -593,9 +602,13 @@ void ChromeBrowsingDataRemoverDelegate::RemoveEmbedderData(
+@@ -603,9 +612,13 @@ void ChromeBrowsingDataRemoverDelegate::RemoveEmbedderData(
      }
  
      device_event_log::Clear(delete_begin_, delete_end_);
@@ -503,7 +487,7 @@ diff --git a/chrome/browser/browsing_data/chrome_browsing_data_remover_delegate.
      content::BackgroundTracingManager::GetInstance().DeleteTracesInDateRange(
          delete_begin_, delete_end_);
  
-@@ -1320,6 +1333,8 @@ void ChromeBrowsingDataRemoverDelegate::RemoveEmbedderData(
+@@ -1309,6 +1322,8 @@ void ChromeBrowsingDataRemoverDelegate::RemoveEmbedderData(
  
      if (should_clear_zero_suggest_and_session_token && template_url_service)
        template_url_service->ClearSessionToken();
@@ -515,7 +499,7 @@ diff --git a/chrome/browser/browsing_data/chrome_browsing_data_remover_delegate.
 diff --git a/chrome/browser/extensions/api/settings_private/prefs_util.cc b/chrome/browser/extensions/api/settings_private/prefs_util.cc
 --- a/chrome/browser/extensions/api/settings_private/prefs_util.cc
 +++ b/chrome/browser/extensions/api/settings_private/prefs_util.cc
-@@ -550,6 +550,23 @@ const PrefsUtil::TypedPrefMap& PrefsUtil::GetAllowlistedKeys() {
+@@ -535,6 +535,23 @@ const PrefsUtil::TypedPrefMap& PrefsUtil::GetAllowlistedKeys() {
    (*s_allowlist)[browsing_data::prefs::kLastClearBrowsingDataTab] =
        settings_api::PrefType::kNumber;
  
@@ -542,7 +526,7 @@ diff --git a/chrome/browser/extensions/api/settings_private/prefs_util.cc b/chro
 diff --git a/chrome/browser/profiles/android/java/src/org/chromium/chrome/browser/profiles/ProfileManagerUtils.java b/chrome/browser/profiles/android/java/src/org/chromium/chrome/browser/profiles/ProfileManagerUtils.java
 --- a/chrome/browser/profiles/android/java/src/org/chromium/chrome/browser/profiles/ProfileManagerUtils.java
 +++ b/chrome/browser/profiles/android/java/src/org/chromium/chrome/browser/profiles/ProfileManagerUtils.java
-@@ -56,11 +56,16 @@ public class ProfileManagerUtils {
+@@ -52,10 +52,15 @@ public class ProfileManagerUtils {
          }
      }
  
@@ -550,9 +534,8 @@ diff --git a/chrome/browser/profiles/android/java/src/org/chromium/chrome/browse
 +        ProfileManagerUtilsJni.get().removeBrowsingDataAtStart();
 +    }
 +
-     @VisibleForTesting(otherwise = VisibleForTesting.PACKAGE_PRIVATE)
      @NativeMethods
-     public interface Natives {
+     interface Natives {
          void flushPersistentDataForAllProfiles();
  
          void removeSessionCookiesForAllProfiles();
@@ -574,7 +557,7 @@ diff --git a/chrome/browser/profiles/android/profile_manager_utils.cc b/chrome/b
 diff --git a/chrome/browser/profiles/profile_manager.cc b/chrome/browser/profiles/profile_manager.cc
 --- a/chrome/browser/profiles/profile_manager.cc
 +++ b/chrome/browser/profiles/profile_manager.cc
-@@ -1441,6 +1441,19 @@ void ProfileManager::DoFinalInit(ProfileInfo* profile_info,
+@@ -1431,6 +1431,19 @@ void ProfileManager::DoFinalInit(ProfileInfo* profile_info,
    }
  }
  
@@ -594,7 +577,7 @@ diff --git a/chrome/browser/profiles/profile_manager.cc b/chrome/browser/profile
  void ProfileManager::DoFinalInitForServices(Profile* profile,
                                              bool go_off_the_record) {
    if (!do_final_services_init_ ||
-@@ -2102,7 +2115,7 @@ void ProfileManager::OnBrowserClosed(Browser* browser) {
+@@ -2117,7 +2130,7 @@ void ProfileManager::OnBrowserClosed(Browser* browser) {
    Profile* original_profile = profile->GetOriginalProfile();
    // Do nothing if the closed window is not the last window of the same profile.
    for (Browser* browser_iter : *BrowserList::GetInstance()) {
@@ -672,7 +655,7 @@ diff --git a/chrome/browser/resources/settings/clear_browsing_data_dialog/clear_
 diff --git a/chrome/browser/resources/settings/clear_browsing_data_dialog/clear_browsing_data_dialog.ts b/chrome/browser/resources/settings/clear_browsing_data_dialog/clear_browsing_data_dialog.ts
 --- a/chrome/browser/resources/settings/clear_browsing_data_dialog/clear_browsing_data_dialog.ts
 +++ b/chrome/browser/resources/settings/clear_browsing_data_dialog/clear_browsing_data_dialog.ts
-@@ -214,6 +214,7 @@ export class SettingsClearBrowsingDataDialogElement extends
+@@ -239,6 +239,7 @@ export class SettingsClearBrowsingDataDialogElement extends
          value: () =>
              [loadTimeData.getString('basicPageTitle'),
               loadTimeData.getString('advancedPageTitle'),
@@ -680,7 +663,7 @@ diff --git a/chrome/browser/resources/settings/clear_browsing_data_dialog/clear_
      ],
        },
  
-@@ -336,6 +337,7 @@ export class SettingsClearBrowsingDataDialogElement extends
+@@ -363,6 +364,7 @@ export class SettingsClearBrowsingDataDialogElement extends
      }
      this.clearButtonDisabled_ =
          this.getSelectedDataTypes_(page as HTMLElement).length === 0;
@@ -691,7 +674,7 @@ diff --git a/chrome/browser/resources/settings/clear_browsing_data_dialog/clear_
 diff --git a/chrome/browser/ui/android/strings/android_chrome_strings.grd b/chrome/browser/ui/android/strings/android_chrome_strings.grd
 --- a/chrome/browser/ui/android/strings/android_chrome_strings.grd
 +++ b/chrome/browser/ui/android/strings/android_chrome_strings.grd
-@@ -1452,6 +1452,9 @@ Your Google account may have other forms of browsing history like searches and a
+@@ -1570,6 +1570,9 @@ Your Google account may have other forms of browsing history like searches and a
        <message name="IDS_ANDROID_APP_HISTORY_OPEN_FULL_OTHER_FORMS" desc="The informational message at the top of the history page letting users know that app-specific history may be missing some entries, followed by the info on the other forms of browing history.">
          Some of your history might not show up here. To see all your Chrome history, open full Chrome history. Also, your Google Account may have other forms of browsing history at <ph name="BEGIN_LINK">&lt;link&gt;</ph>myactivity.google.com<ph name="END_LINK">&lt;/link&gt;</ph>.
        </message>
@@ -718,7 +701,7 @@ new file mode 100644
 diff --git a/chrome/browser/ui/webui/settings/settings_localized_strings_provider.cc b/chrome/browser/ui/webui/settings/settings_localized_strings_provider.cc
 --- a/chrome/browser/ui/webui/settings/settings_localized_strings_provider.cc
 +++ b/chrome/browser/ui/webui/settings/settings_localized_strings_provider.cc
-@@ -2021,6 +2021,7 @@ void AddPrivacyStrings(content::WebUIDataSource* html_source,
+@@ -1911,6 +1911,7 @@ void AddPrivacyStrings(content::WebUIDataSource* html_source,
        {"clearedData", IDS_SETTINGS_CLEARED_DATA},
        {"clearBrowsingData", IDS_SETTINGS_CLEAR_BROWSING_DATA},
        {"clearBrowsingDataDescription", IDS_SETTINGS_CLEAR_DATA_DESCRIPTION},
@@ -729,7 +712,7 @@ diff --git a/chrome/browser/ui/webui/settings/settings_localized_strings_provide
 diff --git a/components/browsing_data/content/browsing_data_helper.cc b/components/browsing_data/content/browsing_data_helper.cc
 --- a/components/browsing_data/content/browsing_data_helper.cc
 +++ b/components/browsing_data/content/browsing_data_helper.cc
-@@ -42,8 +42,13 @@ bool WebsiteSettingsFilterAdapter(
+@@ -39,8 +39,13 @@ bool WebsiteSettingsFilterAdapter(
    // this filter is used for is DURABLE_STORAGE, which also only uses
    // origin-scoped patterns. Such patterns can be directly translated to a GURL.
    GURL url(primary_pattern.ToString());
@@ -826,7 +809,7 @@ diff --git a/components/browsing_data/core/browsing_data_policies_utils.h b/comp
 diff --git a/components/browsing_data/core/browsing_data_utils.cc b/components/browsing_data/core/browsing_data_utils.cc
 --- a/components/browsing_data/core/browsing_data_utils.cc
 +++ b/components/browsing_data/core/browsing_data_utils.cc
-@@ -413,6 +413,37 @@ bool GetDeletionPreferenceFromDataType(
+@@ -346,6 +346,37 @@ bool GetDeletionPreferenceFromDataType(
      BrowsingDataType data_type,
      ClearBrowsingDataTab clear_browsing_data_tab,
      std::string* out_pref) {
@@ -924,48 +907,10 @@ diff --git a/components/browsing_data/core/pref_names.h b/components/browsing_da
  // Clear browsing data deletion time period.
  inline constexpr char kDeleteTimePeriod[] = "browser.clear_data.time_period";
  inline constexpr char kDeleteTimePeriodBasic[] =
-diff --git a/components/favicon/core/favicon_database.cc b/components/favicon/core/favicon_database.cc
---- a/components/favicon/core/favicon_database.cc
-+++ b/components/favicon/core/favicon_database.cc
-@@ -38,6 +38,10 @@
- 
- namespace favicon {
- 
-+CROMITE_FEATURE(kClearFaviconsData,
-+                "ClearFaviconsData",
-+                base::FEATURE_DISABLED_BY_DEFAULT);
-+
- // Description of database tables:
- //
- // icon_mapping
-@@ -507,6 +511,11 @@ bool FaviconDatabase::SetFaviconBitmapLastUpdateTime(FaviconBitmapID bitmap_id,
- 
- bool FaviconDatabase::SetFaviconsOutOfDateBetween(base::Time begin,
-                                                   base::Time end) {
-+  if (begin.is_null() && base::FeatureList::IsEnabled(kClearFaviconsData)) {
-+    std::ignore = db_.Execute("DELETE FROM favicon_bitmaps");
-+    std::ignore = db_.Execute("DELETE FROM favicons");
-+    std::ignore = db_.Execute("DELETE FROM icon_mapping");
-+  }
-   if (end.is_null())
-     end = base::Time::Max();
-   sql::Statement statement(
-diff --git a/components/favicon/core/favicon_database.h b/components/favicon/core/favicon_database.h
---- a/components/favicon/core/favicon_database.h
-+++ b/components/favicon/core/favicon_database.h
-@@ -33,6 +33,8 @@ namespace favicon {
- // All earlier updates are ignored.
- static const int kFaviconUpdateLastRequestedAfterDays = 10;
- 
-+BASE_DECLARE_FEATURE(kClearFaviconsData);
-+
- // This database interface is owned by the history backend and runs on the
- // history thread.
- class FaviconDatabase {
 diff --git a/components/search_engines/template_url_service.cc b/components/search_engines/template_url_service.cc
 --- a/components/search_engines/template_url_service.cc
 +++ b/components/search_engines/template_url_service.cc
-@@ -925,6 +925,7 @@ void TemplateURLService::RemoveAutoGeneratedForUrlsBetween(
+@@ -810,6 +810,7 @@ void TemplateURLService::RemoveAutoGeneratedForUrlsBetween(
      if (turl->date_created() >= created_after &&
          (created_before.is_null() || turl->date_created() < created_before) &&
          turl->safe_for_autoreplace() && turl->prepopulate_id() == 0 &&
@@ -973,10 +918,10 @@ diff --git a/components/search_engines/template_url_service.cc b/components/sear
          turl->starter_pack_id() == 0 && !MatchesDefaultSearchProvider(turl) &&
          (url_filter.is_null() ||
           url_filter.Run(turl->GenerateSearchURL(search_terms_data())))) {
-diff --git a/content/browser/btm/btm_service_impl.cc b/content/browser/btm/btm_service_impl.cc
---- a/content/browser/btm/btm_service_impl.cc
-+++ b/content/browser/btm/btm_service_impl.cc
-@@ -212,7 +212,7 @@ class StateClearer : public BrowsingDataRemover::Observer {
+diff --git a/content/browser/dips/dips_service_impl.cc b/content/browser/dips/dips_service_impl.cc
+--- a/content/browser/dips/dips_service_impl.cc
++++ b/content/browser/dips/dips_service_impl.cc
+@@ -221,7 +221,7 @@ class StateClearer : public BrowsingDataRemover::Observer {
      remove_mask &= ~BrowsingDataRemover::DATA_TYPE_PRIVACY_SANDBOX;
      remover->RemoveWithFilterAndReply(
          base::Time::Min(), base::Time::Max(),
@@ -988,7 +933,7 @@ diff --git a/content/browser/btm/btm_service_impl.cc b/content/browser/btm/btm_s
 diff --git a/content/browser/storage_partition_impl.cc b/content/browser/storage_partition_impl.cc
 --- a/content/browser/storage_partition_impl.cc
 +++ b/content/browser/storage_partition_impl.cc
-@@ -1529,6 +1529,7 @@ void StoragePartitionImpl::Initialize(
+@@ -1527,6 +1527,7 @@ void StoragePartitionImpl::Initialize(
                              .AppendASCII("Code Cache");
      }
      DCHECK_GE(settings.size_in_bytes(), 0);
@@ -999,35 +944,25 @@ diff --git a/content/browser/storage_partition_impl.cc b/content/browser/storage
 diff --git a/content/public/browser/browsing_data_remover.h b/content/public/browser/browsing_data_remover.h
 --- a/content/public/browser/browsing_data_remover.h
 +++ b/content/public/browser/browsing_data_remover.h
-@@ -157,11 +157,16 @@ class BrowsingDataRemover {
- 
-   // Clear-Site-Data Interaction with Prefetch and Prerender.
-   static constexpr DataType DATA_TYPE_PREFETCH_CACHE = 1 << 24;
--  static constexpr DataType DATA_TYPE_PRERENDER_CACHE = 1 << 25;
-+  static constexpr DataType DATA_TYPE_PRERENDER_CACHE = 1 << 26;
- 
-   // Embedders can add more datatypes beyond this point.
-   static constexpr DataType DATA_TYPE_CONTENT_END = DATA_TYPE_PRERENDER_CACHE;
+@@ -151,14 +151,19 @@ class BrowsingDataRemover {
+   static constexpr DataType DATA_TYPE_RELATED_WEBSITE_SETS_PERMISSIONS = 1
+                                                                          << 24;
  
 +  static constexpr DataType DATA_TYPE_SKIP_SSL_HOST_STATE = 1 << 25;
 +
-+  static_assert(DATA_TYPE_CONTENT_END == DATA_TYPE_PRERENDER_CACHE,
+   // Device bound sessions
+   // (https://github.com/WICG/dbsc/blob/main/README.md)
+-  static constexpr DataType DATA_TYPE_DEVICE_BOUND_SESSIONS = 1 << 25;
++  static constexpr DataType DATA_TYPE_DEVICE_BOUND_SESSIONS = 1 << 26;
+ 
+   // Embedders can add more datatypes beyond this point.
+   static constexpr DataType DATA_TYPE_CONTENT_END =
+       DATA_TYPE_DEVICE_BOUND_SESSIONS;
+ 
++  static_assert(DATA_TYPE_CONTENT_END == DATA_TYPE_DEVICE_BOUND_SESSIONS,
 +              "Please check.");
 +
    // All data stored by the Attribution Reporting API.
    static constexpr DataType DATA_TYPE_ATTRIBUTION_REPORTING =
        DATA_TYPE_ATTRIBUTION_REPORTING_SITE_CREATED |
-diff --git a/cromite_flags/chrome/browser/about_flags_cc/Add-setting-to-clear-data-on-exit.inc b/cromite_flags/chrome/browser/about_flags_cc/Add-setting-to-clear-data-on-exit.inc
-new file mode 100644
---- /dev/null
-+++ b/cromite_flags/chrome/browser/about_flags_cc/Add-setting-to-clear-data-on-exit.inc
-@@ -0,0 +1,8 @@
-+#ifdef FLAG_SECTION
-+
-+    {"clear-favicons-data",
-+     "Clear favicons data",
-+     "deletes all data from the favicons db when deleting at startup/close with cache selection.", kOsAll,
-+     FEATURE_VALUE_TYPE(favicon::kClearFaviconsData)},
-+
-+#endif
 --

build/patches/Add-setting-to-invert-tap-and-long-tap.patch

@@ -28,9 +28,9 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
  .../renderer/core/html/html_anchor_element.h  |  7 +++-
  .../renderer/core/html/html_image_element.cc  | 17 +++++++++
  .../renderer/core/html/html_image_element.h   |  2 ++
- .../core/page/context_menu_controller.cc      | 23 +++++++++---
+ .../core/page/context_menu_controller.cc      | 33 ++++++++++++-----
  .../core/page/context_menu_controller.h       |  5 +--
- 22 files changed, 164 insertions(+), 16 deletions(-)
+ 22 files changed, 170 insertions(+), 20 deletions(-)
  create mode 100644 cromite_flags/chrome/browser/about_flags_cc/Add-setting-to-invert-tap-and-long-tap.inc
  create mode 100644 cromite_flags/third_party/blink/common/features_cc/Add-setting-to-invert-tap-and-long-tap.inc
  create mode 100644 cromite_flags/third_party/blink/common/features_h/Add-setting-to-invert-tap-and-long-tap.inc
@@ -40,8 +40,8 @@ diff --git a/android_webview/java/src/org/chromium/android_webview/contextmenu/A
 +++ b/android_webview/java/src/org/chromium/android_webview/contextmenu/AwContextMenuItemDelegate.java
 @@ -11,6 +11,7 @@ import android.net.Uri;
  import org.chromium.base.IntentUtils;
- import org.chromium.build.annotations.NullMarked;
  import org.chromium.components.embedder_support.contextmenu.ContextMenuItemDelegate;
+ import org.chromium.components.embedder_support.contextmenu.ContextMenuParams;
 +import org.chromium.content_public.common.Referrer;
  import org.chromium.content_public.browser.WebContents;
  import org.chromium.ui.base.Clipboard;
@@ -59,7 +59,7 @@ diff --git a/android_webview/java/src/org/chromium/android_webview/contextmenu/A
 diff --git a/chrome/android/java/res/values/ids.xml b/chrome/android/java/res/values/ids.xml
 --- a/chrome/android/java/res/values/ids.xml
 +++ b/chrome/android/java/res/values/ids.xml
-@@ -105,6 +105,7 @@ found in the LICENSE file.
+@@ -88,6 +88,7 @@ found in the LICENSE file.
  
      <!-- Menu item IDs for FullscreenActivities -->
      <item type="id" name="contextmenu_open_in_chrome" />
@@ -70,7 +70,7 @@ diff --git a/chrome/android/java/res/values/ids.xml b/chrome/android/java/res/va
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/accessibility/settings/ChromeAccessibilitySettingsDelegate.java b/chrome/android/java/src/org/chromium/chrome/browser/accessibility/settings/ChromeAccessibilitySettingsDelegate.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/accessibility/settings/ChromeAccessibilitySettingsDelegate.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/accessibility/settings/ChromeAccessibilitySettingsDelegate.java
-@@ -165,6 +165,24 @@ public class ChromeAccessibilitySettingsDelegate implements AccessibilitySetting
+@@ -162,6 +162,24 @@ public class ChromeAccessibilitySettingsDelegate implements AccessibilitySetting
              mSnackbarManagerSupplier.get().showSnackbar(mSnackbar);
      }
  
@@ -98,38 +98,38 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/accessibility/s
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/contextmenu/ChromeContextMenuItem.java b/chrome/android/java/src/org/chromium/chrome/browser/contextmenu/ChromeContextMenuItem.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/contextmenu/ChromeContextMenuItem.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/contextmenu/ChromeContextMenuItem.java
-@@ -128,8 +128,9 @@ class ChromeContextMenuItem {
-         int PRINT_PAGE = 38;
-         // Developer Group
-         int INSPECT_ELEMENT = 39;
-+        int FOLLOW_LINK = 40;
+@@ -111,8 +111,9 @@ class ChromeContextMenuItem {
+         int SHARE_HIGHLIGHT = 32;
+         int REMOVE_HIGHLIGHT = 33;
+         int LEARN_MORE = 34;
++        int FOLLOW_LINK = 35;
          // ALWAYS UPDATE!
--        int NUM_ENTRIES = 40;
-+        int NUM_ENTRIES = 41;
+-        int NUM_ENTRIES = 35;
++        int NUM_ENTRIES = 36;
      }
  
      /** Mapping from {@link Item} to the ID found in the ids.xml. */
-@@ -174,6 +175,7 @@ class ChromeContextMenuItem {
-         R.id.contextmenu_share_page, // Item.SHARE_PAGE
-         R.id.contextmenu_print_page, // Item.PRINT_PAGE
-         R.id.contextmenu_inspect_element, // Item.INSPECT_ELEMENT
-+        R.id.contextmenu_open_in_tab, // Item.OPEN_IN_NEW_CHROME_TAB
+@@ -152,6 +153,7 @@ class ChromeContextMenuItem {
+         R.id.contextmenu_share_highlight, // Item.SHARE_HIGHLIGHT
+         R.id.contextmenu_remove_highlight, // Item.REMOVE_HIGHLIGHT
+         R.id.contextmenu_learn_more, // Item.LEARN_MORE
++            R.id.contextmenu_open_in_tab, // Item.OPEN_IN_NEW_CHROME_TAB
      };
  
      /** Mapping from {@link Item} to the ID of the string that describes the action of the item. */
-@@ -218,6 +220,7 @@ class ChromeContextMenuItem {
-         R.string.contextmenu_share_page, // Item.SHARE_PAGE
-         R.string.contextmenu_print_page, // Item.PRINT_PAGE
-         R.string.contextmenu_inspect_element, // Item.INSPECT_ELEMENT
-+        R.string.contextmenu_open_in_tab, // Item.OPEN_IN_NEW_CHROME_TAB
+@@ -191,6 +193,7 @@ class ChromeContextMenuItem {
+         R.string.contextmenu_share_highlight, // Item.SHARE_HIGHLIGHT
+         R.string.contextmenu_remove_highlight, // Item.REMOVE_HIGHLIGHT
+         R.string.contextmenu_learn_more, // Item.LEARN_MORE
++            R.string.contextmenu_open_in_tab, // Item.OPEN_IN_NEW_CHROME_TAB:
      };
  
      /**
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/contextmenu/ChromeContextMenuPopulator.java b/chrome/android/java/src/org/chromium/chrome/browser/contextmenu/ChromeContextMenuPopulator.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/contextmenu/ChromeContextMenuPopulator.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/contextmenu/ChromeContextMenuPopulator.java
-@@ -442,6 +442,9 @@ public class ChromeContextMenuPopulator implements ContextMenuPopulator {
-         }
+@@ -347,6 +347,9 @@ public class ChromeContextMenuPopulator implements ContextMenuPopulator {
+ 
          if (mParams.isAnchor()) {
              ModelList linkGroup = new ModelList();
 +            if (ChromeFeatureList.sShowAlwaysContextMenuOnLinks.isEnabled()) {
@@ -138,7 +138,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/contextmenu/Chr
              if (FirstRunStatus.getFirstRunFlowComplete()
                      && !isEmptyUrl(mParams.getUrl())
                      && UrlUtilities.isAcceptedScheme(mParams.getUrl())) {
-@@ -1026,6 +1029,8 @@ public class ChromeContextMenuPopulator implements ContextMenuPopulator {
+@@ -738,6 +741,8 @@ public class ChromeContextMenuPopulator implements ContextMenuPopulator {
                                  getProfile(),
                                  false);
                      });
@@ -150,7 +150,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/contextmenu/Chr
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tab/TabContextMenuItemDelegate.java b/chrome/android/java/src/org/chromium/chrome/browser/tab/TabContextMenuItemDelegate.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/tab/TabContextMenuItemDelegate.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/tab/TabContextMenuItemDelegate.java
-@@ -369,6 +369,14 @@ public class TabContextMenuItemDelegate implements ContextMenuItemDelegate {
+@@ -301,6 +301,14 @@ public class TabContextMenuItemDelegate implements ContextMenuItemDelegate {
          mTab.loadUrl(loadUrlParams);
      }
  
@@ -168,27 +168,27 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tab/TabContextM
 diff --git a/chrome/browser/flags/android/chrome_feature_list.cc b/chrome/browser/flags/android/chrome_feature_list.cc
 --- a/chrome/browser/flags/android/chrome_feature_list.cc
 +++ b/chrome/browser/flags/android/chrome_feature_list.cc
-@@ -419,6 +419,7 @@ const base::Feature* const kFeaturesExposedToJava[] = {
-     &kTabGroupParityBottomSheetAndroid,
-     &kTabModelInitFixes,
-     &kTabStorageSqlitePrototype,
+@@ -343,6 +343,7 @@ const base::Feature* const kFeaturesExposedToJava[] = {
+     &kTabDragDropAndroid,
+     &kToolbarPhoneCleanup,
+     &kTabGroupCreationDialogAndroid,
 +    &blink::features::kShowAlwaysContextMenuOnLinks,
-     &kTabStripAutoSelectOnCloseChange,
-     &kTabStripDensityChangeAndroid,
-     &kTabStripGroupDragDropAndroid,
+     &kTabResumptionModuleAndroid,
+     &kTabStateFlatBuffer,
+     &kTabStripGroupCollapseAndroid,
 diff --git a/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureList.java b/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureList.java
 --- a/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureList.java
 +++ b/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureList.java
-@@ -494,6 +494,8 @@ public abstract class ChromeFeatureList {
+@@ -410,6 +410,8 @@ public abstract class ChromeFeatureList {
              "DisableToolbarSwipeUp";
      public static final String MOVE_TOP_TOOLBAR_TO_BOTTOM =
              "MoveTopToolbarToBottom";
 +    public static final String SHOW_ALWAYS_CONTEXT_MENU_ON_LINKS =
 +            "ShowAlwaysContextMenuOnLinks";
-     public static final String NEW_TAB_PAGE_CUSTOMIZATION_TOOLBAR_BUTTON =
-             "NewTabPageCustomizationToolbarButton";
-     public static final String NEW_TAB_PAGE_CUSTOMIZATION_V2 = "NewTabPageCustomizationV2";
-@@ -988,6 +990,8 @@ public abstract class ChromeFeatureList {
+     public static final String NOTIFICATION_PERMISSION_VARIANT = "NotificationPermissionVariant";
+     public static final String NOTIFICATION_PERMISSION_BOTTOM_SHEET =
+             "NotificationPermissionBottomSheet";
+@@ -773,6 +775,8 @@ public abstract class ChromeFeatureList {
              newCachedFlag(DISABLE_TOOLBAR_SWIPE_UP, false);
      public static final CachedFlag sMoveTopToolbarToBottom =
              newCachedFlag(MOVE_TOP_TOOLBAR_TO_BOTTOM, false);
@@ -197,18 +197,18 @@ diff --git a/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/f
      public static final CachedFlag sPaintPreviewDemo = newCachedFlag(PAINT_PREVIEW_DEMO, false);
      public static final CachedFlag sPostGetMyMemoryStateToBackground =
              newCachedFlag(POST_GET_MEMORY_PRESSURE_TO_BACKGROUND, true);
-@@ -1228,6 +1232,7 @@ public abstract class ChromeFeatureList {
-                     sTopControlsRefactor,
-                     sTouchToSearchCallout,
+@@ -959,6 +963,7 @@ public abstract class ChromeFeatureList {
+                     sTabWindowManagerReportIndicesMismatch,
                      sTraceBinderIpc,
-+                    sShowAlwaysContextMenuOnLinks,
-                     sUseActivityManagerForTabActivation,
                      sUseChimeAndroidSdk,
-                     sUseInitialNetworkStateAtStartup,
++                    sShowAlwaysContextMenuOnLinks,
+                     sUseLibunwindstackNativeUnwinderAndroid,
+                     sWebApkMinShellApkVersion);
+ 
 diff --git a/chrome/browser/ui/android/strings/android_chrome_strings.grd b/chrome/browser/ui/android/strings/android_chrome_strings.grd
 --- a/chrome/browser/ui/android/strings/android_chrome_strings.grd
 +++ b/chrome/browser/ui/android/strings/android_chrome_strings.grd
-@@ -1596,6 +1596,12 @@ Your Google account may have other forms of browsing history like searches and a
+@@ -1722,6 +1722,12 @@ Your Google account may have other forms of browsing history like searches and a
        <message name="IDS_DISABLE_TOOLBAR_SWIPE_UP" desc="Summary of the preference that allows the user to disable toolbar swipeup.">
          Disable toolbar swipe up
        </message>
@@ -221,7 +221,7 @@ diff --git a/chrome/browser/ui/android/strings/android_chrome_strings.grd b/chro
  
        <!-- Safety check -->
        <message name="IDS_PREFS_SAFETY_CHECK" desc="Title of the Safety check element in settings, allowing the user to check multiple areas of browser safety. [CHAR_LIMIT=32]">
-@@ -3237,6 +3243,9 @@ To change this setting, <ph name="BEGIN_LINK">BEGIN_LINK</ph>delete the Chrome d
+@@ -3281,6 +3287,9 @@ To change this setting, <ph name="BEGIN_LINK">BEGIN_LINK</ph>delete the Chrome d
        <message name="IDS_CONTEXTMENU_OPEN_IN_NEW_CHROME_TAB" desc="Context sensitive menu item to open the selected link in a new Chrome tab from Chrome Custom Tab. [CHAR_LIMIT=30]">
          Open in new Chrome tab
        </message>
@@ -249,7 +249,7 @@ diff --git a/components/browser_ui/accessibility/android/java/res/xml/accessibil
 diff --git a/components/browser_ui/accessibility/android/java/src/org/chromium/components/browser_ui/accessibility/AccessibilitySettings.java b/components/browser_ui/accessibility/android/java/src/org/chromium/components/browser_ui/accessibility/AccessibilitySettings.java
 --- a/components/browser_ui/accessibility/android/java/src/org/chromium/components/browser_ui/accessibility/AccessibilitySettings.java
 +++ b/components/browser_ui/accessibility/android/java/src/org/chromium/components/browser_ui/accessibility/AccessibilitySettings.java
-@@ -53,6 +53,9 @@ public class AccessibilitySettings extends ChromeBaseSettingsFragment
+@@ -48,6 +48,9 @@ public class AccessibilitySettings extends ChromeBaseSettingsFragment
      private BooleanPreferenceDelegate mMoveTopToolbarToBottomDelegate;
      private BooleanPreferenceDelegate mDisableToolbarSwipeUpDelegate;
  
@@ -259,7 +259,7 @@ diff --git a/components/browser_ui/accessibility/android/java/src/org/chromium/c
      private PageZoomPreference mPageZoomDefaultZoomPref;
      private ChromeSwitchPreference mPageZoomIncludeOSAdjustment;
      private ChromeSwitchPreference mPageZoomAlwaysShowPref;
-@@ -139,6 +142,12 @@ public class AccessibilitySettings extends ChromeBaseSettingsFragment
+@@ -136,6 +139,12 @@ public class AccessibilitySettings extends ChromeBaseSettingsFragment
          mDisableToolbarSwipeUpPref.setChecked(mDisableToolbarSwipeUpDelegate.getValue());
          mDisableToolbarSwipeUpPref.setOnPreferenceChangeListener(this);
  
@@ -272,7 +272,7 @@ diff --git a/components/browser_ui/accessibility/android/java/src/org/chromium/c
          Preference captions = findPreference(PREF_CAPTIONS);
          captions.setOnPreferenceClickListener(
                  preference -> {
-@@ -220,6 +229,9 @@ public class AccessibilitySettings extends ChromeBaseSettingsFragment
+@@ -214,6 +223,9 @@ public class AccessibilitySettings extends ChromeBaseSettingsFragment
          } else if (PREF_DISABLE_TOOLBAR_SWIPE_UP.equals(preference.getKey())) {
              mDisableToolbarSwipeUpDelegate.setValue((Boolean) newValue);
              mDelegate.requestRestart(getActivity());
@@ -285,7 +285,7 @@ diff --git a/components/browser_ui/accessibility/android/java/src/org/chromium/c
 diff --git a/components/browser_ui/accessibility/android/java/src/org/chromium/components/browser_ui/accessibility/AccessibilitySettingsDelegate.java b/components/browser_ui/accessibility/android/java/src/org/chromium/components/browser_ui/accessibility/AccessibilitySettingsDelegate.java
 --- a/components/browser_ui/accessibility/android/java/src/org/chromium/components/browser_ui/accessibility/AccessibilitySettingsDelegate.java
 +++ b/components/browser_ui/accessibility/android/java/src/org/chromium/components/browser_ui/accessibility/AccessibilitySettingsDelegate.java
-@@ -45,6 +45,8 @@ public interface AccessibilitySettingsDelegate {
+@@ -42,6 +42,8 @@ public interface AccessibilitySettingsDelegate {
      BooleanPreferenceDelegate getMoveTopToolbarToBottomDelegate();
      BooleanPreferenceDelegate getDisableToolbarSwipeUpDelegate();
  
@@ -297,15 +297,15 @@ diff --git a/components/browser_ui/accessibility/android/java/src/org/chromium/c
 diff --git a/components/embedder_support/android/java/src/org/chromium/components/embedder_support/contextmenu/ContextMenuItemDelegate.java b/components/embedder_support/android/java/src/org/chromium/components/embedder_support/contextmenu/ContextMenuItemDelegate.java
 --- a/components/embedder_support/android/java/src/org/chromium/components/embedder_support/contextmenu/ContextMenuItemDelegate.java
 +++ b/components/embedder_support/android/java/src/org/chromium/components/embedder_support/contextmenu/ContextMenuItemDelegate.java
-@@ -10,6 +10,7 @@ import androidx.annotation.IntDef;
+@@ -9,6 +9,7 @@ import android.net.Uri;
+ import androidx.annotation.IntDef;
  
- import org.chromium.build.annotations.NullMarked;
  import org.chromium.content_public.browser.WebContents;
 +import org.chromium.content_public.common.Referrer;
  import org.chromium.url.GURL;
  
  import java.lang.annotation.Retention;
-@@ -150,6 +151,8 @@ public interface ContextMenuItemDelegate {
+@@ -148,6 +149,8 @@ public interface ContextMenuItemDelegate {
       */
      GURL getPageUrl();
  
@@ -344,15 +344,15 @@ new file mode 100644
 diff --git a/third_party/blink/renderer/core/html/html_anchor_element.cc b/third_party/blink/renderer/core/html/html_anchor_element.cc
 --- a/third_party/blink/renderer/core/html/html_anchor_element.cc
 +++ b/third_party/blink/renderer/core/html/html_anchor_element.cc
-@@ -66,6 +66,7 @@
+@@ -63,6 +63,7 @@
  #include "third_party/blink/renderer/core/loader/render_blocking_resource_manager.h"
  #include "third_party/blink/renderer/core/navigation_api/navigation_api.h"
  #include "third_party/blink/renderer/core/page/chrome_client.h"
 +#include "third_party/blink/renderer/core/page/context_menu_controller.h"
  #include "third_party/blink/renderer/core/page/page.h"
- #include "third_party/blink/renderer/core/scroll/scroll_into_view_util.h"
  #include "third_party/blink/renderer/core/speculation_rules/document_speculation_rules.h"
-@@ -501,6 +502,17 @@ void HTMLAnchorElementBase::NavigateToHyperlink(
+ #include "third_party/blink/renderer/platform/heap/garbage_collected.h"
+@@ -503,6 +504,17 @@ void HTMLAnchorElementBase::NavigateToHyperlink(
      bool is_trusted,
      base::TimeTicks platform_time_stamp,
      KURL completed_url) {
@@ -370,8 +370,8 @@ diff --git a/third_party/blink/renderer/core/html/html_anchor_element.cc b/third
    LocalDOMWindow* window = GetDocument().domWindow();
    if (!window) {
      return;
-@@ -591,6 +603,15 @@ void HTMLAnchorElementBase::NavigateToHyperlink(
-     frame_request.SetImpression(impression);
+@@ -585,6 +597,15 @@ void HTMLAnchorElementBase::NavigateToHyperlink(
+             request.GetReferrerPolicy()));
    }
  
 +  if (!do_not_show_context_menu &&
@@ -386,8 +386,8 @@ diff --git a/third_party/blink/renderer/core/html/html_anchor_element.cc b/third
    Frame* target_frame =
        frame->Tree().FindOrCreateFrameForNavigation(frame_request, target).frame;
  
-@@ -634,7 +655,7 @@ Element* HTMLAnchorElementBase::InterestForElement() const {
-       html_names::kInterestforAttr);
+@@ -627,7 +648,7 @@ Element* HTMLAnchorElementBase::interestTargetElement() {
+       html_names::kInteresttargetAttr);
  }
  
 -void HTMLAnchorElementBase::HandleClick(MouseEvent& event) {
@@ -395,7 +395,7 @@ diff --git a/third_party/blink/renderer/core/html/html_anchor_element.cc b/third
    event.SetDefaultHandled();
  
    LocalDOMWindow* window = GetDocument().domWindow();
-@@ -730,13 +751,12 @@ void HTMLAnchorElementBase::HandleClick(MouseEvent& event) {
+@@ -723,13 +744,12 @@ void HTMLAnchorElementBase::HandleClick(MouseEvent& event) {
      return;
    }
  
@@ -413,7 +413,7 @@ diff --git a/third_party/blink/renderer/core/html/html_anchor_element.cc b/third
      // We distinguish single/double click with some modifiers.
      // See the comment of `EventHandler.delayed_navigation_task_handle_`.
      auto task_handle = PostDelayedCancellableTask(
-@@ -746,7 +766,9 @@ void HTMLAnchorElementBase::HandleClick(MouseEvent& event) {
+@@ -739,7 +759,9 @@ void HTMLAnchorElementBase::HandleClick(MouseEvent& event) {
      frame->GetEventHandler().SetDelayedNavigationTaskHandle(
          std::move(task_handle));
    } else {
@@ -428,7 +428,7 @@ diff --git a/third_party/blink/renderer/core/html/html_anchor_element.h b/third_
 --- a/third_party/blink/renderer/core/html/html_anchor_element.h
 +++ b/third_party/blink/renderer/core/html/html_anchor_element.h
 @@ -112,6 +112,7 @@ class CORE_EXPORT HTMLAnchorElementBase : public HTMLElement,
-   Element* InterestForElement() const override;
+   Element* interestTargetElement() override;
  
    void Trace(Visitor*) const override;
 +  void HandleClick(MouseEvent&, bool do_not_show_context_menu = false);
@@ -451,7 +451,7 @@ diff --git a/third_party/blink/renderer/core/html/html_anchor_element.h b/third_
 diff --git a/third_party/blink/renderer/core/html/html_image_element.cc b/third_party/blink/renderer/core/html/html_image_element.cc
 --- a/third_party/blink/renderer/core/html/html_image_element.cc
 +++ b/third_party/blink/renderer/core/html/html_image_element.cc
-@@ -37,6 +37,7 @@
+@@ -36,6 +36,7 @@
  #include "third_party/blink/renderer/core/dom/events/event_dispatch_forbidden_scope.h"
  #include "third_party/blink/renderer/core/dom/node_traversal.h"
  #include "third_party/blink/renderer/core/dom/shadow_root.h"
@@ -459,7 +459,7 @@ diff --git a/third_party/blink/renderer/core/html/html_image_element.cc b/third_
  #include "third_party/blink/renderer/core/frame/attribution_src_loader.h"
  #include "third_party/blink/renderer/core/frame/deprecation/deprecation.h"
  #include "third_party/blink/renderer/core/frame/local_dom_window.h"
-@@ -64,6 +65,7 @@
+@@ -63,6 +64,7 @@
  #include "third_party/blink/renderer/core/media_type_names.h"
  #include "third_party/blink/renderer/core/page/chrome_client.h"
  #include "third_party/blink/renderer/core/page/page.h"
@@ -467,7 +467,7 @@ diff --git a/third_party/blink/renderer/core/html/html_image_element.cc b/third_
  #include "third_party/blink/renderer/core/paint/timing/paint_timing.h"
  #include "third_party/blink/renderer/core/probe/core_probes.h"
  #include "third_party/blink/renderer/core/resize_observer/resize_observer_entry.h"
-@@ -815,6 +817,21 @@ void HTMLImageElement::DidFinishLifecycleUpdate(
+@@ -797,6 +799,21 @@ void HTMLImageElement::DidFinishLifecycleUpdate(
    }
  }
  
@@ -492,7 +492,7 @@ diff --git a/third_party/blink/renderer/core/html/html_image_element.cc b/third_
 diff --git a/third_party/blink/renderer/core/html/html_image_element.h b/third_party/blink/renderer/core/html/html_image_element.h
 --- a/third_party/blink/renderer/core/html/html_image_element.h
 +++ b/third_party/blink/renderer/core/html/html_image_element.h
-@@ -215,6 +215,8 @@ class CORE_EXPORT HTMLImageElement
+@@ -218,6 +218,8 @@ class CORE_EXPORT HTMLImageElement
    void DidAddUserAgentShadowRoot(ShadowRoot&) override;
    void AdjustStyle(ComputedStyleBuilder&) override;
  
@@ -504,7 +504,7 @@ diff --git a/third_party/blink/renderer/core/html/html_image_element.h b/third_p
 diff --git a/third_party/blink/renderer/core/page/context_menu_controller.cc b/third_party/blink/renderer/core/page/context_menu_controller.cc
 --- a/third_party/blink/renderer/core/page/context_menu_controller.cc
 +++ b/third_party/blink/renderer/core/page/context_menu_controller.cc
-@@ -200,14 +200,16 @@ void ContextMenuController::DocumentDetached(Document* document) {
+@@ -197,14 +197,16 @@ void ContextMenuController::DocumentDetached(Document* document) {
    }
  }
  
@@ -524,7 +524,7 @@ diff --git a/third_party/blink/renderer/core/page/context_menu_controller.cc b/t
      mouse_event->SetDefaultHandled();
  }
  
-@@ -432,7 +434,8 @@ bool ContextMenuController::ShouldShowContextMenuFromTouch(
+@@ -428,7 +430,8 @@ bool ContextMenuController::ShouldShowContextMenuFromTouch(
  bool ContextMenuController::ShowContextMenu(LocalFrame* frame,
                                              const PhysicalOffset& point,
                                              WebMenuSourceType source_type,
@@ -534,7 +534,7 @@ diff --git a/third_party/blink/renderer/core/page/context_menu_controller.cc b/t
    // Displaying the context menu in this function is a big hack as we don't
    // have context, i.e. whether this is being invoked via a script or in
    // response to user input (Mouse event WM_RBUTTONDOWN,
-@@ -455,6 +458,16 @@ bool ContextMenuController::ShowContextMenu(LocalFrame* frame,
+@@ -451,6 +454,16 @@ bool ContextMenuController::ShowContextMenu(LocalFrame* frame,
    if (!result.InnerNodeOrImageMapImage())
      return false;
  
@@ -551,15 +551,25 @@ diff --git a/third_party/blink/renderer/core/page/context_menu_controller.cc b/t
    // Clear any previously set cached results if we are resetting the hit test
    // result.
    image_selection_cached_result_ = nullptr;
-@@ -825,7 +838,7 @@ bool ContextMenuController::ShowContextMenu(LocalFrame* frame,
+@@ -782,11 +795,13 @@ bool ContextMenuController::ShowContextMenu(LocalFrame* frame,
  
    SetAutofillData(result.InnerNode(), data);
  
+-  const bool from_touch = source_type == kMenuSourceTouch ||
+-                          source_type == kMenuSourceLongPress ||
+-                          source_type == kMenuSourceLongTap;
 -  if (from_touch && !ShouldShowContextMenuFromTouch(data))
-+  if (!base::FeatureList::IsEnabled(features::kShowAlwaysContextMenuOnLinks) && from_touch && !ShouldShowContextMenuFromTouch(data))
-     return false;
+-    return false;
++  if (!base::FeatureList::IsEnabled(features::kShowAlwaysContextMenuOnLinks)) {
++    const bool from_touch = source_type == kMenuSourceTouch ||
++                            source_type == kMenuSourceLongPress ||
++                            source_type == kMenuSourceLongTap;
++    if (from_touch && !ShouldShowContextMenuFromTouch(data))
++      return false;
++  }
  
    WebLocalFrameImpl* selected_web_frame =
+       WebLocalFrameImpl::FromFrame(selected_frame);
 diff --git a/third_party/blink/renderer/core/page/context_menu_controller.h b/third_party/blink/renderer/core/page/context_menu_controller.h
 --- a/third_party/blink/renderer/core/page/context_menu_controller.h
 +++ b/third_party/blink/renderer/core/page/context_menu_controller.h

build/patches/Add-site-engagement-flag.patch

@@ -24,7 +24,7 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 diff --git a/chrome/browser/about_flags.cc b/chrome/browser/about_flags.cc
 --- a/chrome/browser/about_flags.cc
 +++ b/chrome/browser/about_flags.cc
-@@ -165,6 +165,7 @@
+@@ -166,6 +166,7 @@
  #include "components/sensitive_content/features.h"
  #include "components/services/heap_profiling/public/cpp/switches.h"
  #include "components/services/storage/public/cpp/buckets/bucket_info.h"
@@ -35,7 +35,7 @@ diff --git a/chrome/browser/about_flags.cc b/chrome/browser/about_flags.cc
 diff --git a/chrome/browser/engagement/important_sites_util.cc b/chrome/browser/engagement/important_sites_util.cc
 --- a/chrome/browser/engagement/important_sites_util.cc
 +++ b/chrome/browser/engagement/important_sites_util.cc
-@@ -31,6 +31,7 @@
+@@ -32,6 +32,7 @@
  #include "components/prefs/scoped_user_pref_update.h"
  #include "components/site_engagement/content/site_engagement_score.h"
  #include "components/site_engagement/content/site_engagement_service.h"
@@ -43,7 +43,7 @@ diff --git a/chrome/browser/engagement/important_sites_util.cc b/chrome/browser/
  #include "components/site_engagement/core/mojom/site_engagement_details.mojom.h"
  #include "components/webapps/browser/banners/app_banner_settings_helper.h"
  #include "net/base/registry_controlled_domains/registry_controlled_domain.h"
-@@ -344,6 +345,10 @@ void ImportantSitesUtil::RegisterProfilePrefs(
+@@ -349,6 +350,10 @@ void ImportantSitesUtil::RegisterProfilePrefs(
  // static
  std::set<std::string> ImportantSitesUtil::GetInstalledRegisterableDomains(
      Profile* profile) {
@@ -54,7 +54,7 @@ diff --git a/chrome/browser/engagement/important_sites_util.cc b/chrome/browser/
    std::set<GURL> installed_origins = GetOriginsWithInstalledWebApps(profile);
    std::set<std::string> registerable_domains;
  
-@@ -358,6 +363,10 @@ std::vector<ImportantDomainInfo>
+@@ -363,6 +368,10 @@ std::vector<ImportantDomainInfo>
  ImportantSitesUtil::GetImportantRegisterableDomains(Profile* profile,
                                                      size_t max_results) {
    SCOPED_UMA_HISTOGRAM_TIMER("Storage.ImportantSites.GenerationTime");
@@ -76,15 +76,15 @@ diff --git a/components/feature_engagement/internal/tracker_impl.cc b/components
  #include "components/feature_engagement/internal/availability_model_impl.h"
  #include "components/feature_engagement/internal/blocked_iph_features.h"
  #include "components/feature_engagement/internal/chrome_variations_configuration.h"
-@@ -306,6 +307,8 @@ TrackerImpl::TrackerImpl(
+@@ -236,6 +237,8 @@ TrackerImpl::TrackerImpl(
  TrackerImpl::~TrackerImpl() = default;
  
  void TrackerImpl::NotifyEvent(const std::string& event) {
 +  if (!base::FeatureList::IsEnabled(site_engagement::features::kSiteEngagement))
 +    return;
-   GetEventModelWriter()->IncrementEvent(event, time_provider_->GetCurrentDay());
+   event_model_->IncrementEvent(event, time_provider_->GetCurrentDay());
    stats::RecordNotifyEvent(event, configuration_.get(),
-                            event_model_provider_->IsReady());
+                            event_model_->IsReady());
 diff --git a/components/feature_engagement/public/feature_configurations.cc b/components/feature_engagement/public/feature_configurations.cc
 --- a/components/feature_engagement/public/feature_configurations.cc
 +++ b/components/feature_engagement/public/feature_configurations.cc

build/patches/Add-support-for-ISupportHelpAndFeedback.patch

@@ -12,15 +12,15 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/settings/SettingsActivity.java b/chrome/android/java/src/org/chromium/chrome/browser/settings/SettingsActivity.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/settings/SettingsActivity.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/settings/SettingsActivity.java
-@@ -54,6 +54,7 @@ import org.chromium.chrome.browser.ui.messages.snackbar.Snackbar;
+@@ -55,6 +55,7 @@ import org.chromium.chrome.browser.ui.messages.snackbar.Snackbar;
  import org.chromium.components.browser_ui.bottomsheet.BottomSheetController;
  import org.chromium.components.browser_ui.bottomsheet.BottomSheetControllerFactory;
  import org.chromium.components.browser_ui.bottomsheet.ManagedBottomSheetController;
 +import org.chromium.components.browser_ui.settings.SettingsUtils;
  import org.chromium.components.browser_ui.modaldialog.AppModalPresenter;
  import org.chromium.components.browser_ui.settings.EmbeddableSettingsPage;
- import org.chromium.components.browser_ui.settings.SettingsFragment;
-@@ -469,8 +470,12 @@ public class SettingsActivity extends ChromeBaseAppCompatActivity
+ import org.chromium.components.browser_ui.util.TraceEventVectorDrawableCompat;
+@@ -442,8 +443,12 @@ public class SettingsActivity extends ChromeBaseAppCompatActivity
              finishCurrentSettings(mainFragment);
              return true;
          } else if (item.getItemId() == R.id.menu_id_general_help) {
@@ -38,15 +38,13 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/settings/Settin
 diff --git a/components/browser_ui/settings/android/java/src/org/chromium/components/browser_ui/settings/SettingsUtils.java b/components/browser_ui/settings/android/java/src/org/chromium/components/browser_ui/settings/SettingsUtils.java
 --- a/components/browser_ui/settings/android/java/src/org/chromium/components/browser_ui/settings/SettingsUtils.java
 +++ b/components/browser_ui/settings/android/java/src/org/chromium/components/browser_ui/settings/SettingsUtils.java
-@@ -28,6 +28,10 @@ import org.chromium.ui.drawable.StateListDrawableBuilder;
- /** A helper class for Settings. */
- @NullMarked
- public class SettingsUtils {
+@@ -93,4 +93,8 @@ public class SettingsUtils {
+         ToolbarUtils.setOverflowMenuVisibility(toolbar, visibility);
+         return true;
+     }
++
 +    public interface ISupportHelpAndFeedback {
 +        void onHelpAndFeebackPressed();
 +    }
-+
-     /**
-      * A helper that is used to load preferences from XML resources without causing a
-      * StrictModeViolation. See http://crbug.com/692125.
+ }
 --

build/patches/Add-support-for-writing-URIs.patch

@@ -9,13 +9,13 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 ---
  base/android/content_uri_utils.cc             | 10 ++++++
  base/android/content_uri_utils.h              |  4 +++
- .../org/chromium/base/ContentUriUtils.java    | 33 +++++++++++++++++++
- 3 files changed, 47 insertions(+)
+ .../org/chromium/base/ContentUriUtils.java    | 34 +++++++++++++++++++
+ 3 files changed, 48 insertions(+)
 
 diff --git a/base/android/content_uri_utils.cc b/base/android/content_uri_utils.cc
 --- a/base/android/content_uri_utils.cc
 +++ b/base/android/content_uri_utils.cc
-@@ -136,6 +136,16 @@ void JNI_ContentUriUtils_AddFileInfoToVector(JNIEnv* env,
+@@ -119,6 +119,16 @@ void JNI_ContentUriUtils_AddFileInfoToVector(JNIEnv* env,
                         Time::FromMillisecondsSinceUnixEpoch(last_modified));
  }
  
@@ -35,9 +35,9 @@ diff --git a/base/android/content_uri_utils.cc b/base/android/content_uri_utils.
 diff --git a/base/android/content_uri_utils.h b/base/android/content_uri_utils.h
 --- a/base/android/content_uri_utils.h
 +++ b/base/android/content_uri_utils.h
-@@ -46,6 +46,10 @@ int ContentUriGetFd(
- void ContentUriClose(
-     const base::android::JavaRef<jobject>& java_parcel_file_descriptor);
+@@ -33,6 +33,10 @@ BASE_EXPORT std::optional<std::string> TranslateOpenFlagsToJavaMode(
+ // Returns -1 if the URI is invalid.
+ int OpenContentUri(const FilePath& content_uri, uint32_t open_flags);
  
 +// Opens a content URI for write and returns the file descriptor to the caller.
 +// Returns -1 if the URI is invalid.
@@ -49,7 +49,15 @@ diff --git a/base/android/content_uri_utils.h b/base/android/content_uri_utils.h
 diff --git a/base/android/java/src/org/chromium/base/ContentUriUtils.java b/base/android/java/src/org/chromium/base/ContentUriUtils.java
 --- a/base/android/java/src/org/chromium/base/ContentUriUtils.java
 +++ b/base/android/java/src/org/chromium/base/ContentUriUtils.java
-@@ -31,6 +31,9 @@ import org.chromium.build.annotations.Nullable;
+@@ -12,6 +12,7 @@ import android.content.res.AssetFileDescriptor;
+ import android.database.Cursor;
+ import android.net.Uri;
+ import android.os.Build;
++import android.os.ParcelFileDescriptor;
+ import android.provider.DocumentsContract;
+ import android.provider.MediaStore;
+ import android.text.TextUtils;
+@@ -30,6 +31,9 @@ import org.chromium.build.annotations.Nullable;
  import java.io.IOException;
  import java.util.List;
  
@@ -59,8 +67,8 @@ diff --git a/base/android/java/src/org/chromium/base/ContentUriUtils.java b/base
  /** This class provides methods to access content URI schemes. */
  @JNINamespace("base")
  @NullMarked
-@@ -72,6 +75,36 @@ public abstract class ContentUriUtils {
-         StreamUtil.closeQuietly(parcelFileDescriptor);
+@@ -64,6 +68,36 @@ public abstract class ContentUriUtils {
+         return -1;
      }
  
 +    @CalledByNative

build/patches/Add-webGL-site-setting.patch

@@ -166,7 +166,7 @@ new file mode 100644
 +           WebsiteSettingsInfo::TOP_ORIGIN_ONLY_SCOPE,
 +           WebsiteSettingsRegistry::ALL_PLATFORMS,
 +           ContentSettingsInfo::INHERIT_IN_INCOGNITO,
-+           PermissionSettingsInfo::EXCEPTIONS_ON_SECURE_AND_INSECURE_ORIGINS);
++           ContentSettingsInfo::EXCEPTIONS_ON_SECURE_AND_INSECURE_ORIGINS);
 +
 +  content_settings::WebsiteSettingsRegistry::GetInstance()
 +    ->GetMutable(ContentSettingsType::WEBGL)
@@ -189,7 +189,7 @@ new file mode 100644
 diff --git a/third_party/blink/renderer/core/execution_context/execution_context.cc b/third_party/blink/renderer/core/execution_context/execution_context.cc
 --- a/third_party/blink/renderer/core/execution_context/execution_context.cc
 +++ b/third_party/blink/renderer/core/execution_context/execution_context.cc
-@@ -86,6 +86,13 @@ blink::WebContentSettingsClient* GetContentSettingsClientFor(
+@@ -85,6 +85,13 @@ blink::WebContentSettingsClient* GetContentSettingsClientFor(
    return settings;
  }
  
@@ -206,7 +206,7 @@ diff --git a/third_party/blink/renderer/core/execution_context/execution_context
 diff --git a/third_party/blink/renderer/core/execution_context/execution_context.h b/third_party/blink/renderer/core/execution_context/execution_context.h
 --- a/third_party/blink/renderer/core/execution_context/execution_context.h
 +++ b/third_party/blink/renderer/core/execution_context/execution_context.h
-@@ -114,6 +114,8 @@ enum ReasonForCallingCanExecuteScripts {
+@@ -116,6 +116,8 @@ enum ReasonForCallingCanExecuteScripts {
  
  enum ReferrerPolicySource { kPolicySourceHttpHeader, kPolicySourceMetaTag };
  
@@ -218,7 +218,7 @@ diff --git a/third_party/blink/renderer/core/execution_context/execution_context
 diff --git a/third_party/blink/renderer/modules/webgl/webgl_rendering_context_base.cc b/third_party/blink/renderer/modules/webgl/webgl_rendering_context_base.cc
 --- a/third_party/blink/renderer/modules/webgl/webgl_rendering_context_base.cc
 +++ b/third_party/blink/renderer/modules/webgl/webgl_rendering_context_base.cc
-@@ -345,6 +345,13 @@ void WebGLRenderingContextBase::InitializeWebGLContextLimits(
+@@ -297,6 +297,13 @@ void WebGLRenderingContextBase::InitializeWebGLContextLimits(
    }
  }
  
@@ -232,7 +232,7 @@ diff --git a/third_party/blink/renderer/modules/webgl/webgl_rendering_context_ba
  unsigned WebGLRenderingContextBase::CurrentMaxGLContexts() {
    base::AutoLock locker(WebGLContextLimitLock());
    DCHECK(webgl_context_limits_initialized_);
-@@ -615,25 +622,6 @@ static String ExtractWebGLContextCreationError(
+@@ -566,25 +573,6 @@ static String ExtractWebGLContextCreationError(
      const Platform::GraphicsInfo& info) {
    StringBuilder builder;
    builder.Append("Could not create a WebGL context");
@@ -258,7 +258,7 @@ diff --git a/third_party/blink/renderer/modules/webgl/webgl_rendering_context_ba
    FormatWebGLStatusString("ErrorMessage", info.error_message.Utf8().c_str(),
                            builder);
    builder.Append('.');
-@@ -693,6 +681,12 @@ WebGLRenderingContextBase::CreateWebGraphicsContext3DProvider(
+@@ -644,6 +632,12 @@ WebGLRenderingContextBase::CreateWebGraphicsContext3DProvider(
      const CanvasContextCreationAttributesCore& attributes,
      Platform::ContextType context_type,
      Platform::GraphicsInfo* graphics_info) {
@@ -274,7 +274,7 @@ diff --git a/third_party/blink/renderer/modules/webgl/webgl_rendering_context_ba
 diff --git a/third_party/blink/renderer/modules/webgl/webgl_rendering_context_base.h b/third_party/blink/renderer/modules/webgl/webgl_rendering_context_base.h
 --- a/third_party/blink/renderer/modules/webgl/webgl_rendering_context_base.h
 +++ b/third_party/blink/renderer/modules/webgl/webgl_rendering_context_base.h
-@@ -1951,6 +1951,8 @@ class MODULES_EXPORT WebGLRenderingContextBase
+@@ -1936,6 +1936,8 @@ class MODULES_EXPORT WebGLRenderingContextBase : public CanvasRenderingContext,
                          DOMArrayBufferView* pixels,
                          int64_t offset);
  

build/patches/Add-webRTC-site-settings.patch

@@ -12,9 +12,9 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
  .../bromite_content_settings/webrtc.inc       | 22 +++++
  .../bromite_content_settings/WEBRTC.inc       |  1 +
  .../peer_connection_dependency_factory.cc     |  6 ++
- .../peerconnection/rtc_rtp_receiver.cc        | 11 +++
- .../modules/peerconnection/rtc_rtp_sender.cc  | 11 +++
- 7 files changed, 172 insertions(+)
+ .../peerconnection/rtc_rtp_receiver.cc        | 10 ++
+ .../modules/peerconnection/rtc_rtp_sender.cc  | 10 ++
+ 7 files changed, 170 insertions(+)
  create mode 100644 components/browser_ui/site_settings/android/java/src/org/chromium/components/browser_ui/site_settings/impl/BromiteWebRTCContentSetting.java
  create mode 100644 components/browser_ui/strings/bromite_content_settings/webrtc.grdp
  create mode 100644 components/content_settings/core/browser/bromite_content_settings/webrtc.inc
@@ -164,7 +164,7 @@ new file mode 100644
 +           WebsiteSettingsInfo::TOP_ORIGIN_ONLY_SCOPE,
 +           WebsiteSettingsRegistry::ALL_PLATFORMS,
 +           ContentSettingsInfo::INHERIT_IN_INCOGNITO,
-+           PermissionSettingsInfo::EXCEPTIONS_ON_SECURE_AND_INSECURE_ORIGINS);
++           ContentSettingsInfo::EXCEPTIONS_ON_SECURE_AND_INSECURE_ORIGINS);
 +
 +  content_settings::WebsiteSettingsRegistry::GetInstance()
 +    ->GetMutable(ContentSettingsType::WEBRTC)
@@ -187,7 +187,7 @@ new file mode 100644
 diff --git a/third_party/blink/renderer/modules/peerconnection/peer_connection_dependency_factory.cc b/third_party/blink/renderer/modules/peerconnection/peer_connection_dependency_factory.cc
 --- a/third_party/blink/renderer/modules/peerconnection/peer_connection_dependency_factory.cc
 +++ b/third_party/blink/renderer/modules/peerconnection/peer_connection_dependency_factory.cc
-@@ -46,6 +46,7 @@
+@@ -41,6 +41,7 @@
  #include "third_party/blink/public/platform/modules/webrtc/webrtc_logging.h"
  #include "third_party/blink/public/platform/platform.h"
  #include "third_party/blink/public/platform/task_type.h"
@@ -195,7 +195,7 @@ diff --git a/third_party/blink/renderer/modules/peerconnection/peer_connection_d
  #include "third_party/blink/public/platform/web_url.h"
  #include "third_party/blink/public/web/modules/mediastream/media_stream_video_source.h"
  #include "third_party/blink/public/web/web_document.h"
-@@ -1062,6 +1063,11 @@ PeerConnectionDependencyFactory::CreatePortAllocator(
+@@ -936,6 +937,11 @@ PeerConnectionDependencyFactory::CreatePortAllocator(
        // |request_multiple_routes|. Whether local IP addresses could be
        // collected depends on if mic/camera permission is granted for this
        // origin.
@@ -210,17 +210,16 @@ diff --git a/third_party/blink/renderer/modules/peerconnection/peer_connection_d
 diff --git a/third_party/blink/renderer/modules/peerconnection/rtc_rtp_receiver.cc b/third_party/blink/renderer/modules/peerconnection/rtc_rtp_receiver.cc
 --- a/third_party/blink/renderer/modules/peerconnection/rtc_rtp_receiver.cc
 +++ b/third_party/blink/renderer/modules/peerconnection/rtc_rtp_receiver.cc
-@@ -16,6 +16,9 @@
+@@ -14,6 +14,8 @@
  #include "third_party/blink/public/common/privacy_budget/identifiable_surface.h"
  #include "third_party/blink/public/common/privacy_budget/identifiable_token_builder.h"
  #include "third_party/blink/public/platform/modules/webrtc/webrtc_logging.h"
 +#include "third_party/blink/public/platform/web_content_settings_client.h"
 +#include "third_party/blink/public/web/web_local_frame.h"
-+#include "third_party/blink/renderer/core/frame/local_dom_window.h"
  #include "third_party/blink/renderer/bindings/core/v8/script_promise_resolver.h"
  #include "third_party/blink/renderer/bindings/modules/v8/v8_rtc_insertable_streams.h"
  #include "third_party/blink/renderer/bindings/modules/v8/v8_rtc_rtcp_parameters.h"
-@@ -288,6 +291,14 @@ RTCRtpCapabilities* RTCRtpReceiver::getCapabilities(ScriptState* state,
+@@ -286,6 +288,14 @@ RTCRtpCapabilities* RTCRtpReceiver::getCapabilities(ScriptState* state,
    if (kind != "audio" && kind != "video")
      return nullptr;
  
@@ -238,17 +237,16 @@ diff --git a/third_party/blink/renderer/modules/peerconnection/rtc_rtp_receiver.
 diff --git a/third_party/blink/renderer/modules/peerconnection/rtc_rtp_sender.cc b/third_party/blink/renderer/modules/peerconnection/rtc_rtp_sender.cc
 --- a/third_party/blink/renderer/modules/peerconnection/rtc_rtp_sender.cc
 +++ b/third_party/blink/renderer/modules/peerconnection/rtc_rtp_sender.cc
-@@ -21,6 +21,9 @@
+@@ -19,6 +19,8 @@
  #include "third_party/blink/public/common/privacy_budget/identifiable_surface.h"
  #include "third_party/blink/public/common/privacy_budget/identifiable_token_builder.h"
  #include "third_party/blink/public/platform/modules/webrtc/webrtc_logging.h"
 +#include "third_party/blink/public/platform/web_content_settings_client.h"
 +#include "third_party/blink/public/web/web_local_frame.h"
-+#include "third_party/blink/renderer/core/frame/local_dom_window.h"
  #include "third_party/blink/renderer/bindings/core/v8/script_promise_resolver.h"
  #include "third_party/blink/renderer/bindings/modules/v8/v8_rtc_encoding_options.h"
  #include "third_party/blink/renderer/bindings/modules/v8/v8_rtc_insertable_streams.h"
-@@ -1035,6 +1038,14 @@ RTCRtpCapabilities* RTCRtpSender::getCapabilities(ScriptState* state,
+@@ -1033,6 +1035,14 @@ RTCRtpCapabilities* RTCRtpSender::getCapabilities(ScriptState* state,
    if (kind != "audio" && kind != "video")
      return nullptr;
  

build/patches/Allow-DocumentPiP-if-PopupsAndRedirects-are-active.patch

@@ -3,38 +3,24 @@ Date: Mon, 7 Aug 2023 11:02:18 +0000
 Subject: Allow DocumentPiP if PopupsAndRedirects are active
 
 Allow documentPiP api use only with content setting popup allowed
-and disables the possibility of verifying the activation of PIP
-in the device with document.pictureInPictureEnabled
 
 License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 ---
- .../chromium/chrome/browser/media/PictureInPicture.java    | 1 +
  .../picture_in_picture_controller_impl.cc                  | 7 +++++++
- 2 files changed, 8 insertions(+)
+ 1 file changed, 7 insertions(+)
 
-diff --git a/chrome/android/java/src/org/chromium/chrome/browser/media/PictureInPicture.java b/chrome/android/java/src/org/chromium/chrome/browser/media/PictureInPicture.java
---- a/chrome/android/java/src/org/chromium/chrome/browser/media/PictureInPicture.java
-+++ b/chrome/android/java/src/org/chromium/chrome/browser/media/PictureInPicture.java
-@@ -29,6 +29,7 @@ public abstract class PictureInPicture {
-      * @return boolean true if Picture-In-Picture is enabled, otherwise false.
-      */
-     public static boolean isEnabled(Context context) {
-+        if ((true)) return true;
-         // Some versions of Android crash when the activity enters Picture-in-Picture
-         // immediately after it exits Picture-in-Picture. See b/143784148
-         if (Build.VERSION.SDK_INT < Build.VERSION_CODES.R) {
 diff --git a/third_party/blink/renderer/modules/document_picture_in_picture/picture_in_picture_controller_impl.cc b/third_party/blink/renderer/modules/document_picture_in_picture/picture_in_picture_controller_impl.cc
 --- a/third_party/blink/renderer/modules/document_picture_in_picture/picture_in_picture_controller_impl.cc
 +++ b/third_party/blink/renderer/modules/document_picture_in_picture/picture_in_picture_controller_impl.cc
-@@ -31,6 +31,7 @@
+@@ -27,6 +27,7 @@
+ #include "third_party/blink/renderer/core/html/media/html_media_element.h"
+ #include "third_party/blink/renderer/core/html/media/html_video_element.h"
  #include "third_party/blink/renderer/core/layout/layout_video.h"
- #include "third_party/blink/renderer/modules/document_picture_in_picture/document_picture_in_picture.h"
- #include "third_party/blink/renderer/modules/document_picture_in_picture/document_picture_in_picture_event.h"
 +#include "third_party/blink/renderer/core/loader/document_loader.h"
  #include "third_party/blink/renderer/modules/picture_in_picture/picture_in_picture_event.h"
  #include "third_party/blink/renderer/platform/heap/garbage_collected.h"
  #include "third_party/blink/renderer/platform/runtime_enabled_features.h"
-@@ -386,6 +387,12 @@ void PictureInPictureControllerImpl::CreateDocumentPictureInPictureWindow(
+@@ -377,6 +378,12 @@ void PictureInPictureControllerImpl::CreateDocumentPictureInPictureWindow(
      return;
    }
  

build/patches/Allow-building-without-enable_reporting.patch

@@ -10,7 +10,7 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
  .../browser/network/reporting_service_proxy.cc   |  3 +++
  .../renderer_host/render_frame_host_impl.cc      |  6 ------
  .../coop/cross_origin_opener_policy_reporter.cc  | 16 +++++++---------
- .../dip/document_isolation_policy_reporter.cc    |  3 +++
+ .../dip/document_isolation_policy_reporter.cc    |  2 ++
  .../web_package/signed_exchange_reporter.cc      |  2 ++
  ...content_switch_dependent_feature_overrides.cc |  1 +
  .../Allow-building-without-enable_reporting.inc  |  2 ++
@@ -22,11 +22,11 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
  .../network/public/mojom/network_context.mojom   |  3 +++
  .../core/frame/csp/content_security_policy.cc    |  3 +++
  .../blink/renderer/core/frame/local_frame.cc     |  3 +++
- .../blink/renderer/core/frame/local_frame.h      |  3 +++
+ .../blink/renderer/core/frame/local_frame.h      |  4 +++-
  .../renderer/core/frame/reporting_context.cc     |  9 +++++++++
  .../renderer/core/frame/reporting_context.h      |  7 +++++--
  .../renderer/core/frame/reporting_observer.cc    |  3 +--
- 22 files changed, 64 insertions(+), 25 deletions(-)
+ 22 files changed, 63 insertions(+), 26 deletions(-)
  create mode 100644 cromite_flags/services/network/public/cpp/features_cc/Allow-building-without-enable_reporting.inc
 
 diff --git a/chrome/browser/net/chrome_report_sender.cc b/chrome/browser/net/chrome_report_sender.cc
@@ -43,7 +43,7 @@ diff --git a/chrome/browser/net/chrome_report_sender.cc b/chrome/browser/net/chr
 diff --git a/content/browser/devtools/protocol/network_handler.cc b/content/browser/devtools/protocol/network_handler.cc
 --- a/content/browser/devtools/protocol/network_handler.cc
 +++ b/content/browser/devtools/protocol/network_handler.cc
-@@ -1496,6 +1496,7 @@ String BuildReportStatus(const net::ReportingReport::Status status) {
+@@ -1473,6 +1473,7 @@ String BuildReportStatus(const net::ReportingReport::Status status) {
    }
  }
  
@@ -51,7 +51,7 @@ diff --git a/content/browser/devtools/protocol/network_handler.cc b/content/brow
  std::vector<GURL> ComputeReportingURLs(RenderFrameHostImpl* frame_host) {
    std::vector<GURL> urls;
    frame_host->ForEachRenderFrameHostImplWithAction(
-@@ -1509,6 +1510,7 @@ std::vector<GURL> ComputeReportingURLs(RenderFrameHostImpl* frame_host) {
+@@ -1486,6 +1487,7 @@ std::vector<GURL> ComputeReportingURLs(RenderFrameHostImpl* frame_host) {
        });
    return urls;
  }
@@ -108,7 +108,7 @@ diff --git a/content/browser/network/reporting_service_proxy.cc b/content/browse
  #include "content/browser/service_worker/service_worker_host.h"
  #include "content/browser/worker_host/dedicated_worker_host.h"
  #include "content/browser/worker_host/shared_worker_host.h"
-@@ -240,12 +241,14 @@ class ReportingServiceProxyImpl : public blink::mojom::ReportingServiceProxy {
+@@ -222,12 +223,14 @@ class ReportingServiceProxyImpl : public blink::mojom::ReportingServiceProxy {
                     const std::string& group,
                     const std::string& type,
                     base::Value::Dict body) {
@@ -126,19 +126,19 @@ diff --git a/content/browser/network/reporting_service_proxy.cc b/content/browse
 diff --git a/content/browser/renderer_host/render_frame_host_impl.cc b/content/browser/renderer_host/render_frame_host_impl.cc
 --- a/content/browser/renderer_host/render_frame_host_impl.cc
 +++ b/content/browser/renderer_host/render_frame_host_impl.cc
-@@ -16153,12 +16153,6 @@ void RenderFrameHostImpl::MaybeGenerateCrashReport(
+@@ -15703,12 +15703,6 @@ void RenderFrameHostImpl::MaybeGenerateCrashReport(
        }
      }
    }
 -
 -  // Send the crash report to the Reporting API.
 -  GetProcess()->GetStoragePartition()->GetNetworkContext()->QueueReport(
--      /*type=*/"crash", crash_reporting_group_, last_committed_url_,
+-      /*type=*/"crash", /*group=*/"default", last_committed_url_,
 -      GetReportingSource(), isolation_info_.network_anonymization_key(),
 -      std::move(body));
  }
  
- void RenderFrameHostImpl::UpdateOrDisableCompositorMetricRecorder() const {
+ void RenderFrameHostImpl::SendCommitNavigation(
 diff --git a/content/browser/security/coop/cross_origin_opener_policy_reporter.cc b/content/browser/security/coop/cross_origin_opener_policy_reporter.cc
 --- a/content/browser/security/coop/cross_origin_opener_policy_reporter.cc
 +++ b/content/browser/security/coop/cross_origin_opener_policy_reporter.cc
@@ -177,7 +177,7 @@ diff --git a/content/browser/security/coop/cross_origin_opener_policy_reporter.c
  std::string ToString(network::mojom::CrossOriginOpenerPolicyValue coop_value) {
    switch (coop_value) {
      case network::mojom::CrossOriginOpenerPolicyValue::kUnsafeNone:
-@@ -59,6 +52,7 @@ std::string ToString(network::mojom::CrossOriginOpenerPolicyValue coop_value) {
+@@ -64,6 +57,7 @@ std::string ToString(network::mojom::CrossOriginOpenerPolicyValue coop_value) {
        return "noopener-allow-popups";
    }
  }
@@ -185,7 +185,7 @@ diff --git a/content/browser/security/coop/cross_origin_opener_policy_reporter.c
  
  FrameTreeNode* TopLevelOpener(FrameTreeNode* frame) {
    FrameTreeNode* opener =
-@@ -230,6 +224,7 @@ void CrossOriginOpenerPolicyReporter::QueueAccessReport(
+@@ -235,6 +229,7 @@ void CrossOriginOpenerPolicyReporter::QueueAccessReport(
      network::mojom::SourceLocationPtr source_location,
      const std::string& reported_window_url,
      const std::string& initial_popup_url) const {
@@ -193,7 +193,7 @@ diff --git a/content/browser/security/coop/cross_origin_opener_policy_reporter.c
    // Cross-Origin-Opener-Policy-Report-Only is not required to provide
    // endpoints.
    if (!coop_.report_only_reporting_endpoint)
-@@ -277,12 +272,14 @@ void CrossOriginOpenerPolicyReporter::QueueAccessReport(
+@@ -282,12 +277,14 @@ void CrossOriginOpenerPolicyReporter::QueueAccessReport(
    storage_partition_->GetNetworkContext()->QueueReport(
        "coop", endpoint, context_url_, reporting_source_,
        network_anonymization_key_, std::move(body));
@@ -208,7 +208,7 @@ diff --git a/content/browser/security/coop/cross_origin_opener_policy_reporter.c
    body.Set(kDisposition,
             is_report_only ? kDispositionReporting : kDispositionEnforce);
    body.Set(kEffectivePolicy,
-@@ -290,6 +287,7 @@ void CrossOriginOpenerPolicyReporter::QueueNavigationReport(
+@@ -295,6 +292,7 @@ void CrossOriginOpenerPolicyReporter::QueueNavigationReport(
    storage_partition_->GetNetworkContext()->QueueReport(
        "coop", endpoint, context_url_, reporting_source_,
        network_anonymization_key_, std::move(body));
@@ -219,15 +219,7 @@ diff --git a/content/browser/security/coop/cross_origin_opener_policy_reporter.c
 diff --git a/content/browser/security/dip/document_isolation_policy_reporter.cc b/content/browser/security/dip/document_isolation_policy_reporter.cc
 --- a/content/browser/security/dip/document_isolation_policy_reporter.cc
 +++ b/content/browser/security/dip/document_isolation_policy_reporter.cc
-@@ -7,6 +7,7 @@
- #include <string_view>
- 
- #include "base/values.h"
-+#include "net/net_buildflags.h"
- #include "content/public/browser/storage_partition.h"
- #include "services/network/public/cpp/request_destination.h"
- #include "services/network/public/mojom/network_context.mojom.h"
-@@ -94,11 +95,13 @@ void DocumentIsolationPolicyReporter::QueueAndNotify(
+@@ -94,11 +94,13 @@ void DocumentIsolationPolicyReporter::QueueAndNotify(
      }
      body_to_pass.Set("disposition", disposition);
  
@@ -281,7 +273,7 @@ new file mode 100644
 diff --git a/net/reporting/reporting_header_parser.cc b/net/reporting/reporting_header_parser.cc
 --- a/net/reporting/reporting_header_parser.cc
 +++ b/net/reporting/reporting_header_parser.cc
-@@ -344,6 +344,7 @@ void ReportingHeaderParser::ProcessParsedReportingEndpointsHeader(
+@@ -337,6 +337,7 @@ void ReportingHeaderParser::ProcessParsedReportingEndpointsHeader(
      const NetworkAnonymizationKey& network_anonymization_key,
      const url::Origin& origin,
      base::flat_map<std::string, std::string> header) {
@@ -292,7 +284,7 @@ diff --git a/net/reporting/reporting_header_parser.cc b/net/reporting/reporting_
 diff --git a/net/reporting/reporting_service.cc b/net/reporting/reporting_service.cc
 --- a/net/reporting/reporting_service.cc
 +++ b/net/reporting/reporting_service.cc
-@@ -236,6 +236,12 @@ class ReportingServiceImpl : public ReportingService {
+@@ -225,6 +225,12 @@ class ReportingServiceImpl : public ReportingService {
        int depth,
        base::TimeTicks queued_ticks,
        ReportingTargetType target_type) {
@@ -303,12 +295,12 @@ diff --git a/net/reporting/reporting_service.cc b/net/reporting/reporting_servic
 +#error Attempting to build with enable_reporting
 +#endif
      DCHECK(initialized_);
-     context_->cache()->AddReport(
-         reporting_source, network_anonymization_key, sanitized_url, user_agent,
+     context_->cache()->AddReport(reporting_source, network_anonymization_key,
+                                  sanitized_url, user_agent, group, type,
 diff --git a/services/network/network_context.h b/services/network/network_context.h
 --- a/services/network/network_context.h
 +++ b/services/network/network_context.h
-@@ -494,14 +494,14 @@ class COMPONENT_EXPORT(NETWORK_SERVICE) NetworkContext
+@@ -470,14 +470,14 @@ class COMPONENT_EXPORT(NETWORK_SERVICE) NetworkContext
        const GURL& url,
        const std::optional<base::UnguessableToken>& reporting_source,
        const net::NetworkAnonymizationKey& network_anonymization_key,
@@ -329,7 +321,7 @@ diff --git a/services/network/network_context.h b/services/network/network_conte
 diff --git a/services/network/public/cpp/parsed_headers.cc b/services/network/public/cpp/parsed_headers.cc
 --- a/services/network/public/cpp/parsed_headers.cc
 +++ b/services/network/public/cpp/parsed_headers.cc
-@@ -125,6 +125,7 @@ mojom::ParsedHeadersPtr PopulateParsedHeaders(
+@@ -115,6 +115,7 @@ mojom::ParsedHeadersPtr PopulateParsedHeaders(
    }
  
  #if BUILDFLAG(ENABLE_REPORTING)
@@ -340,7 +332,7 @@ diff --git a/services/network/public/cpp/parsed_headers.cc b/services/network/pu
 diff --git a/services/network/public/mojom/BUILD.gn b/services/network/public/mojom/BUILD.gn
 --- a/services/network/public/mojom/BUILD.gn
 +++ b/services/network/public/mojom/BUILD.gn
-@@ -1793,7 +1793,6 @@ mojom("mojom") {
+@@ -1590,7 +1590,6 @@ mojom("mojom") {
      export_define_blink = "BLINK_PLATFORM_IMPLEMENTATION=1"
      export_header_blink = "third_party/blink/public/platform/web_common.h"
      if (enable_reporting) {
@@ -351,7 +343,7 @@ diff --git a/services/network/public/mojom/BUILD.gn b/services/network/public/mo
 diff --git a/services/network/public/mojom/network_context.mojom b/services/network/public/mojom/network_context.mojom
 --- a/services/network/public/mojom/network_context.mojom
 +++ b/services/network/public/mojom/network_context.mojom
-@@ -1240,6 +1240,7 @@ interface NetworkContext {
+@@ -1205,6 +1205,7 @@ interface NetworkContext {
    // provided `network_anonymization_key`.
    //
    // Spec: https://w3c.github.io/reporting/#concept-reports
@@ -359,7 +351,7 @@ diff --git a/services/network/public/mojom/network_context.mojom b/services/netw
    QueueReport(string type,
                string group,
                url.mojom.Url url,
-@@ -1247,6 +1248,7 @@ interface NetworkContext {
+@@ -1212,6 +1213,7 @@ interface NetworkContext {
                NetworkAnonymizationKey network_anonymization_key,
                mojo_base.mojom.DictionaryValue body);
  
@@ -367,7 +359,7 @@ diff --git a/services/network/public/mojom/network_context.mojom b/services/netw
    QueueEnterpriseReport(string type,
                          string group,
                          url.mojom.Url url,
-@@ -1257,6 +1259,7 @@ interface NetworkContext {
+@@ -1222,6 +1224,7 @@ interface NetworkContext {
    // Note that this queued report will never be delivered if no reporting
    // endpoint matching is registered for with the provided
    // `network_anonymization_key`.
@@ -385,16 +377,16 @@ diff --git a/third_party/blink/renderer/core/frame/csp/content_security_policy.c
 +#include "net/net_buildflags.h"
  #include "base/containers/contains.h"
  #include "base/debug/dump_without_crashing.h"
- #include "base/feature_list.h"
-@@ -1344,6 +1345,7 @@ void ContentSecurityPolicy::ReportViolation(
-       ShouldBypassContentSecurityPolicy(KURL(violation_data->sourceFile()))) {
+ #include "services/network/public/cpp/web_sandbox_flags.h"
+@@ -1295,6 +1296,7 @@ void ContentSecurityPolicy::ReportViolation(
      return;
    }
+ 
 +#if BUILDFLAG(ENABLE_REPORTING)
    PostViolationReport(violation_data, context_frame, report_endpoints,
                        use_reporting_api);
  
-@@ -1351,6 +1353,7 @@ void ContentSecurityPolicy::ReportViolation(
+@@ -1302,6 +1304,7 @@ void ContentSecurityPolicy::ReportViolation(
    // `context_frame` (i.e. we're not processing 'frame-ancestors').
    if (delegate_ && !context_frame)
      delegate_->DispatchViolationEvent(*violation_data, element);
@@ -405,7 +397,7 @@ diff --git a/third_party/blink/renderer/core/frame/csp/content_security_policy.c
 diff --git a/third_party/blink/renderer/core/frame/local_frame.cc b/third_party/blink/renderer/core/frame/local_frame.cc
 --- a/third_party/blink/renderer/core/frame/local_frame.cc
 +++ b/third_party/blink/renderer/core/frame/local_frame.cc
-@@ -48,6 +48,7 @@
+@@ -47,6 +47,7 @@
  #include "build/build_config.h"
  #include "mojo/public/cpp/bindings/self_owned_receiver.h"
  #include "mojo/public/cpp/system/message_pipe.h"
@@ -413,7 +405,7 @@ diff --git a/third_party/blink/renderer/core/frame/local_frame.cc b/third_party/
  #include "services/network/public/cpp/features.h"
  #include "services/network/public/mojom/content_security_policy.mojom-blink.h"
  #include "services/network/public/mojom/source_location.mojom-blink.h"
-@@ -2836,9 +2837,11 @@ DocumentResourceCoordinator* LocalFrame::GetDocumentResourceCoordinator() {
+@@ -2796,9 +2797,11 @@ DocumentResourceCoordinator* LocalFrame::GetDocumentResourceCoordinator() {
    return CHECK_DEREF(GetDocument()).GetResourceCoordinator();
  }
  
@@ -435,11 +427,12 @@ diff --git a/third_party/blink/renderer/core/frame/local_frame.h b/third_party/b
 +#include "net/net_buildflags.h"
  #include "mojo/public/cpp/bindings/pending_associated_receiver.h"
  #include "mojo/public/cpp/bindings/pending_receiver.h"
- #include "net/storage_access_api/status.h"
-@@ -671,7 +672,9 @@ class CORE_EXPORT LocalFrame final
-     return client_hints_preferences_;
-   }
+ #include "services/metrics/public/cpp/ukm_source_id.h"
+@@ -659,8 +660,9 @@ class CORE_EXPORT LocalFrame final
+   void FinishedScrollSequence();
  
+   SmoothScrollSequencer* GetSmoothScrollSequencer() const;
+-
 +#if BUILDFLAG(ENABLE_REPORTING)
    mojom::blink::ReportingServiceProxy* GetReportingService();
 +#endif
@@ -457,7 +450,7 @@ diff --git a/third_party/blink/renderer/core/frame/reporting_context.cc b/third_
  #include "third_party/blink/public/platform/browser_interface_broker_proxy.h"
  #include "third_party/blink/public/platform/platform.h"
  #include "third_party/blink/public/platform/task_type.h"
-@@ -59,7 +60,9 @@ const char ReportingContext::kSupplementName[] = "ReportingContext";
+@@ -58,7 +59,9 @@ const char ReportingContext::kSupplementName[] = "ReportingContext";
  ReportingContext::ReportingContext(ExecutionContext& context)
      : Supplement<ExecutionContext>(context),
        execution_context_(context),
@@ -467,7 +460,7 @@ diff --git a/third_party/blink/renderer/core/frame/reporting_context.cc b/third_
        receivers_(this, &context) {}
  
  // static
-@@ -126,7 +129,9 @@ void ReportingContext::Trace(Visitor* visitor) const {
+@@ -125,7 +128,9 @@ void ReportingContext::Trace(Visitor* visitor) const {
    visitor->Trace(observers_);
    visitor->Trace(report_buffer_);
    visitor->Trace(execution_context_);
@@ -477,7 +470,7 @@ diff --git a/third_party/blink/renderer/core/frame/reporting_context.cc b/third_
    visitor->Trace(receivers_);
    Supplement<ExecutionContext>::Trace(visitor);
  }
-@@ -149,6 +154,7 @@ void ReportingContext::CountReport(Report* report) {
+@@ -148,6 +153,7 @@ void ReportingContext::CountReport(Report* report) {
    UseCounter::Count(execution_context_, feature);
  }
  
@@ -485,7 +478,7 @@ diff --git a/third_party/blink/renderer/core/frame/reporting_context.cc b/third_
  const HeapMojoRemote<mojom::blink::ReportingServiceProxy>&
  ReportingContext::GetReportingService() const {
    if (!reporting_service_.is_bound()) {
-@@ -158,6 +164,7 @@ ReportingContext::GetReportingService() const {
+@@ -157,6 +163,7 @@ ReportingContext::GetReportingService() const {
    }
    return reporting_service_;
  }
@@ -493,7 +486,7 @@ diff --git a/third_party/blink/renderer/core/frame/reporting_context.cc b/third_
  
  void ReportingContext::NotifyInternal(Report* report) {
    if (!ShouldReportBeVisibleToObservers(report)) {
-@@ -184,6 +191,7 @@ void ReportingContext::NotifyInternal(Report* report) {
+@@ -183,6 +190,7 @@ void ReportingContext::NotifyInternal(Report* report) {
  
  void ReportingContext::SendToReportingAPI(Report* report,
                                            const String& endpoint) const {
@@ -501,7 +494,7 @@ diff --git a/third_party/blink/renderer/core/frame/reporting_context.cc b/third_
    const String& type = report->type();
    if (!(type == ReportType::kCSPViolation || type == ReportType::kCSPHash ||
          type == ReportType::kDeprecation ||
-@@ -263,6 +271,7 @@ void ReportingContext::SendToReportingAPI(Report* report,
+@@ -254,6 +262,7 @@ void ReportingContext::SendToReportingAPI(Report* report,
          url, endpoint, body->featureId(), body->disposition(), body->message(),
          body->sourceFile(), line_number, column_number);
    }
@@ -520,7 +513,7 @@ diff --git a/third_party/blink/renderer/core/frame/reporting_context.h b/third_p
  #include "third_party/blink/public/mojom/frame/reporting_observer.mojom-blink.h"
  #include "third_party/blink/public/mojom/reporting/reporting.mojom-blink.h"
  #include "third_party/blink/renderer/core/core_export.h"
-@@ -56,10 +57,10 @@ class CORE_EXPORT ReportingContext : public GarbageCollected<ReportingContext>,
+@@ -55,10 +56,10 @@ class CORE_EXPORT ReportingContext : public GarbageCollected<ReportingContext>,
   private:
    // Counts the use of a report type via UseCounter.
    void CountReport(Report*);
@@ -533,7 +526,7 @@ diff --git a/third_party/blink/renderer/core/frame/reporting_context.h b/third_p
    void NotifyInternal(Report* report);
    // Send |report| via the Reporting API to |endpoint|.
    void SendToReportingAPI(Report* report, const String& endpoint) const;
-@@ -71,8 +72,10 @@ class CORE_EXPORT ReportingContext : public GarbageCollected<ReportingContext>,
+@@ -69,8 +70,10 @@ class CORE_EXPORT ReportingContext : public GarbageCollected<ReportingContext>,
  
    // This is declared mutable so that the service endpoint can be cached by
    // const methods.

build/patches/Allow-building-without-supervised-users.patch

@@ -11,20 +11,19 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
  chrome/browser/profiles/profile_attributes_entry.cc        | 2 +-
  chrome/browser/profiles/profile_impl.cc                    | 5 +----
  chrome/browser/profiles/profile_manager.cc                 | 7 -------
- .../supervised_user/supervised_user_browser_utils.cc       | 1 +
  chrome/browser/ui/webui/managed_ui_handler.cc              | 4 ----
  .../browser/ui/webui/management/management_ui_handler.cc   | 4 ----
  .../core/browser/supervised_user_pref_store.cc             | 1 +
  .../core/browser/supervised_user_preferences.cc            | 6 +++++-
- .../core/browser/supervised_user_service.cc                | 1 +
- components/supervised_user/core/common/features.cc         | 2 +-
- extensions/browser/api/management/management_api.cc        | 1 +
- 15 files changed, 13 insertions(+), 27 deletions(-)
+ .../core/browser/supervised_user_service.cc                | 5 +----
+ .../supervised_user/core/browser/supervised_user_utils.cc  | 1 +
+ components/supervised_user/core/common/features.cc         | 6 ++++++
+ 14 files changed, 17 insertions(+), 30 deletions(-)
 
 diff --git a/chrome/android/BUILD.gn b/chrome/android/BUILD.gn
 --- a/chrome/android/BUILD.gn
 +++ b/chrome/android/BUILD.gn
-@@ -819,7 +819,6 @@ if (_is_default_toolchain) {
+@@ -784,7 +784,6 @@ if (current_toolchain == default_toolchain) {
        "//components/offline_pages/core:offline_page_model_enums_java",
        "//components/sharing_message:sharing_dialog_type_generated_enum",
        "//components/sharing_message:sharing_send_message_result_generated_enum",
@@ -35,7 +34,7 @@ diff --git a/chrome/android/BUILD.gn b/chrome/android/BUILD.gn
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/feedback/ChromeFeedbackCollector.java b/chrome/android/java/src/org/chromium/chrome/browser/feedback/ChromeFeedbackCollector.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/feedback/ChromeFeedbackCollector.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/feedback/ChromeFeedbackCollector.java
-@@ -95,7 +95,6 @@ public class ChromeFeedbackCollector extends FeedbackCollector<ChromeFeedbackCol
+@@ -92,7 +92,6 @@ public class ChromeFeedbackCollector extends FeedbackCollector<ChromeFeedbackCol
          // FamilyInfoFeedbackSource relies on IdentityManager which is not available for the
          // incognito profile.
          if (!initParams.profile.isOffTheRecord()) {
@@ -65,19 +64,19 @@ diff --git a/chrome/browser/feedback/android/BUILD.gn b/chrome/browser/feedback/
 diff --git a/chrome/browser/prefs/chrome_pref_service_factory.cc b/chrome/browser/prefs/chrome_pref_service_factory.cc
 --- a/chrome/browser/prefs/chrome_pref_service_factory.cc
 +++ b/chrome/browser/prefs/chrome_pref_service_factory.cc
-@@ -319,7 +319,7 @@ void PrepareFactory(
+@@ -328,7 +328,7 @@ void PrepareFactory(
      policy::BrowserPolicyConnector* policy_connector) {
    factory->SetManagedPolicies(policy_service, policy_connector);
    factory->SetRecommendedPolicies(policy_service, policy_connector);
 -  if (supervised_user_settings) {
 +  if (((false)) && supervised_user_settings) {
-     // supervised_user_prefs handles the case when content_filters_service is
-     // nullptr. It's simply not subscribing to empty service's notifications.
      scoped_refptr<PrefStore> supervised_user_prefs =
+         base::MakeRefCounted<SupervisedUserPrefStore>(supervised_user_settings);
+     DCHECK(async || supervised_user_prefs->IsInitializationComplete());
 diff --git a/chrome/browser/profiles/profile_attributes_entry.cc b/chrome/browser/profiles/profile_attributes_entry.cc
 --- a/chrome/browser/profiles/profile_attributes_entry.cc
 +++ b/chrome/browser/profiles/profile_attributes_entry.cc
-@@ -471,7 +471,7 @@ bool ProfileAttributesEntry::IsSigninRequired() const {
+@@ -469,7 +469,7 @@ bool ProfileAttributesEntry::IsSigninRequired() const {
  }
  
  std::string ProfileAttributesEntry::GetSupervisedUserId() const {
@@ -89,7 +88,7 @@ diff --git a/chrome/browser/profiles/profile_attributes_entry.cc b/chrome/browse
 diff --git a/chrome/browser/profiles/profile_impl.cc b/chrome/browser/profiles/profile_impl.cc
 --- a/chrome/browser/profiles/profile_impl.cc
 +++ b/chrome/browser/profiles/profile_impl.cc
-@@ -684,10 +684,6 @@ void ProfileImpl::DoFinalInit(CreateMode create_mode) {
+@@ -675,10 +675,6 @@ void ProfileImpl::DoFinalInit(CreateMode create_mode) {
      prefs->SetTime(prefs::kProfileCreationTime, path_creation_time_);
  
    pref_change_registrar_.Init(prefs);
@@ -100,7 +99,7 @@ diff --git a/chrome/browser/profiles/profile_impl.cc b/chrome/browser/profiles/p
  
    // Changes in the profile avatar.
    pref_change_registrar_.Add(
-@@ -1624,6 +1620,7 @@ GURL ProfileImpl::GetHomePage() {
+@@ -1623,6 +1619,7 @@ GURL ProfileImpl::GetHomePage() {
  }
  
  void ProfileImpl::UpdateSupervisedUserIdInStorage() {
@@ -111,7 +110,7 @@ diff --git a/chrome/browser/profiles/profile_impl.cc b/chrome/browser/profiles/p
 diff --git a/chrome/browser/profiles/profile_manager.cc b/chrome/browser/profiles/profile_manager.cc
 --- a/chrome/browser/profiles/profile_manager.cc
 +++ b/chrome/browser/profiles/profile_manager.cc
-@@ -1192,10 +1192,6 @@ void ProfileManager::InitProfileUserPrefs(Profile* profile) {
+@@ -1181,10 +1181,6 @@ void ProfileManager::InitProfileUserPrefs(Profile* profile) {
      profile->GetPrefs()->SetString(prefs::kProfileName, profile_name);
    }
  
@@ -119,10 +118,10 @@ diff --git a/chrome/browser/profiles/profile_manager.cc b/chrome/browser/profile
 -    profile->GetPrefs()->SetString(prefs::kSupervisedUserId,
 -                                   supervised_user_id);
 -  }
- }
- 
- void ProfileManager::RegisterTestingProfile(std::unique_ptr<Profile> profile,
-@@ -1962,9 +1958,6 @@ void ProfileManager::AddProfileToStorage(Profile* profile) {
+ #if !BUILDFLAG(IS_ANDROID)
+   if (profile->IsNewProfile()) {
+     profile->GetPrefs()->SetBoolean(prefs::kHasSeenWelcomePage, false);
+@@ -1970,9 +1966,6 @@ void ProfileManager::AddProfileToStorage(Profile* profile) {
    init_params.icon_index =
        profile->GetPrefs()->GetInteger(prefs::kProfileAvatarIndex);
  
@@ -132,17 +131,6 @@ diff --git a/chrome/browser/profiles/profile_manager.cc b/chrome/browser/profile
  #if BUILDFLAG(IS_CHROMEOS)
    user_manager::User* user =
        ash::ProfileHelper::Get()->GetUserByProfile(profile);
-diff --git a/chrome/browser/supervised_user/supervised_user_browser_utils.cc b/chrome/browser/supervised_user/supervised_user_browser_utils.cc
---- a/chrome/browser/supervised_user/supervised_user_browser_utils.cc
-+++ b/chrome/browser/supervised_user/supervised_user_browser_utils.cc
-@@ -99,6 +99,7 @@ bool SupervisedUserCanSkipExtensionParentApprovals(const Profile* profile) {
- }
- 
- bool AreExtensionsPermissionsEnabled(Profile* profile) {
-+  if ((true)) return false;
- #if BUILDFLAG(ENABLE_EXTENSIONS_CORE)
-   return profile->IsChild();
- #else
 diff --git a/chrome/browser/ui/webui/managed_ui_handler.cc b/chrome/browser/ui/webui/managed_ui_handler.cc
 --- a/chrome/browser/ui/webui/managed_ui_handler.cc
 +++ b/chrome/browser/ui/webui/managed_ui_handler.cc
@@ -160,7 +148,7 @@ diff --git a/chrome/browser/ui/webui/managed_ui_handler.cc b/chrome/browser/ui/w
 diff --git a/chrome/browser/ui/webui/management/management_ui_handler.cc b/chrome/browser/ui/webui/management/management_ui_handler.cc
 --- a/chrome/browser/ui/webui/management/management_ui_handler.cc
 +++ b/chrome/browser/ui/webui/management/management_ui_handler.cc
-@@ -617,10 +617,6 @@ bool ManagementUIHandler::managed() const {
+@@ -595,10 +595,6 @@ bool ManagementUIHandler::managed() const {
  
  void ManagementUIHandler::RegisterPrefChange(
      PrefChangeRegistrar& pref_registrar) {
@@ -174,7 +162,7 @@ diff --git a/chrome/browser/ui/webui/management/management_ui_handler.cc b/chrom
 diff --git a/components/supervised_user/core/browser/supervised_user_pref_store.cc b/components/supervised_user/core/browser/supervised_user_pref_store.cc
 --- a/components/supervised_user/core/browser/supervised_user_pref_store.cc
 +++ b/components/supervised_user/core/browser/supervised_user_pref_store.cc
-@@ -175,6 +175,7 @@ void SupervisedUserPrefStore::OnNewContentFiltersStateAvailable(
+@@ -126,6 +126,7 @@ SupervisedUserPrefStore::~SupervisedUserPrefStore() = default;
  
  void SupervisedUserPrefStore::OnNewSettingsAvailable(
      const base::Value::Dict& settings) {
@@ -185,7 +173,7 @@ diff --git a/components/supervised_user/core/browser/supervised_user_pref_store.
 diff --git a/components/supervised_user/core/browser/supervised_user_preferences.cc b/components/supervised_user/core/browser/supervised_user_preferences.cc
 --- a/components/supervised_user/core/browser/supervised_user_preferences.cc
 +++ b/components/supervised_user/core/browser/supervised_user_preferences.cc
-@@ -164,6 +164,10 @@ void RegisterProfilePrefs(PrefRegistrySimple* registry) {
+@@ -155,6 +155,10 @@ void RegisterProfilePrefs(PrefRegistrySimple* registry) {
  }
  
  void EnableParentalControls(PrefService& pref_service) {
@@ -195,8 +183,8 @@ diff --git a/components/supervised_user/core/browser/supervised_user_preferences
 +  }
    pref_service.SetString(prefs::kSupervisedUserId,
                           supervised_user::kChildAccountSUID);
- #if BUILDFLAG(IS_CHROMEOS)
-@@ -197,7 +201,7 @@ bool IsSafeSitesEnabled(const PrefService& pref_service) {
+   SetIsChildAccountStatusKnown(pref_service);
+@@ -177,7 +181,7 @@ bool IsSafeSitesEnabled(const PrefService& pref_service) {
  }
  
  bool IsSubjectToParentalControls(const PrefService& pref_service) {
@@ -204,44 +192,52 @@ diff --git a/components/supervised_user/core/browser/supervised_user_preferences
 +  return false;
  }
  
- bool IsGoogleSafeSearchEnforced(const PrefService& pref_service) {
+ }  // namespace supervised_user
 diff --git a/components/supervised_user/core/browser/supervised_user_service.cc b/components/supervised_user/core/browser/supervised_user_service.cc
 --- a/components/supervised_user/core/browser/supervised_user_service.cc
 +++ b/components/supervised_user/core/browser/supervised_user_service.cc
-@@ -249,6 +249,7 @@ SupervisedUserService::SupervisedUserService(
+@@ -50,10 +50,6 @@ void SupervisedUserService::Init() {
+   DCHECK(settings_service_->IsReady());
+ 
+   pref_change_registrar_.Init(&user_prefs_.get());
+-  pref_change_registrar_.Add(
+-      prefs::kSupervisedUserId,
+-      base::BindRepeating(&SupervisedUserService::OnSupervisedUserIdChanged,
+-                          base::Unretained(this)));
+   SetActive(supervised_user::IsSubjectToParentalControls(user_prefs_.get()));
  }
  
- void SupervisedUserService::SetSettingsServiceActive(bool active) {
-+  active = false;
-   settings_service_->SetActive(active);
+@@ -139,6 +135,7 @@ SupervisedUserService::SupervisedUserService(
+ }
  
-   // Trigger a sync reconfig to enable/disable the right SU data types.
+ void SupervisedUserService::SetActive(bool active) {
++  active = false;
+   if (active_ == active) {
+     return;
+   }
+diff --git a/components/supervised_user/core/browser/supervised_user_utils.cc b/components/supervised_user/core/browser/supervised_user_utils.cc
+--- a/components/supervised_user/core/browser/supervised_user_utils.cc
++++ b/components/supervised_user/core/browser/supervised_user_utils.cc
+@@ -300,6 +300,7 @@ GURL NormalizeUrl(const GURL& url) {
+ }
+ 
+ bool AreWebFilterPrefsDefault(const PrefService& pref_service) {
++  if ((true)) return true;
+   return pref_service
+              .FindPreference(prefs::kDefaultSupervisedUserFilteringBehavior)
+              ->IsDefaultValue() ||
 diff --git a/components/supervised_user/core/common/features.cc b/components/supervised_user/core/common/features.cc
 --- a/components/supervised_user/core/common/features.cc
 +++ b/components/supervised_user/core/common/features.cc
-@@ -33,7 +33,6 @@ BASE_FEATURE(kAllowSubframeLocalWebApprovals,
- #else
+@@ -171,4 +171,10 @@ BASE_FEATURE(kReplaceSupervisionSystemCapabilitiesWithAccountCapabilitiesOnIOS,
+              "ReplaceSupervisionSystemCapabilitiesWithAccountCapabilitiesOnIOS",
               base::FEATURE_DISABLED_BY_DEFAULT);
  #endif
--
- #if BUILDFLAG(IS_IOS) || BUILDFLAG(IS_MAC) || BUILDFLAG(IS_LINUX) || \
-     BUILDFLAG(IS_WIN)
- const int kLocalWebApprovalBottomSheetLoadTimeoutDefaultValueMs = 5000;
-@@ -170,4 +169,5 @@ bool ClassifyUrlWithoutCredentialsForLocalSupervision() {
- 
- #endif
- 
++
 +SET_CROMITE_FEATURE_DISABLED(kLocalWebApprovals);
++#if BUILDFLAG(IS_MAC) || BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_WIN)
++SET_CROMITE_FEATURE_DISABLED(kEnableExtensionsPermissionsForSupervisedUsersOnDesktop);
++#endif
++
  }  // namespace supervised_user
-diff --git a/extensions/browser/api/management/management_api.cc b/extensions/browser/api/management/management_api.cc
---- a/extensions/browser/api/management/management_api.cc
-+++ b/extensions/browser/api/management/management_api.cc
-@@ -312,6 +312,7 @@ void AddExtensionInfo(const Extension* source_extension,
- }
- 
- bool PlatformSupportsApprovalFlowForExtensions() {
-+  if ((true)) return false;
- #if BUILDFLAG(IS_CHROMEOS) || BUILDFLAG(IS_MAC) || BUILDFLAG(IS_LINUX) || \
-     BUILDFLAG(IS_WIN)
-   return true;
 --

build/patches/Allow-playing-audio-in-background.patch

@@ -11,8 +11,8 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 diff --git a/third_party/blink/renderer/platform/media/web_media_player_impl.cc b/third_party/blink/renderer/platform/media/web_media_player_impl.cc
 --- a/third_party/blink/renderer/platform/media/web_media_player_impl.cc
 +++ b/third_party/blink/renderer/platform/media/web_media_player_impl.cc
-@@ -1330,6 +1330,12 @@ bool WebMediaPlayerImpl::HasAudio() const {
-   return pipeline_metadata_.has_audio;
+@@ -1311,6 +1311,12 @@ void WebMediaPlayerImpl::OnSelectedVideoTrackChanged(
+   pipeline_controller_->OnSelectedVideoTrackChanged(selected);
  }
  
 +bool WebMediaPlayerImpl::HasVideoNonEmptySize() const {
@@ -22,9 +22,9 @@ diff --git a/third_party/blink/renderer/platform/media/web_media_player_impl.cc
 +}
 +
  void WebMediaPlayerImpl::EnabledAudioTracksChanged(
-     std::optional<WebMediaPlayer::TrackId> enabled_track_id) {
+     const std::vector<WebMediaPlayer::TrackId>& enabled_track_ids) {
    DCHECK(main_task_runner_->BelongsToCurrentThread());
-@@ -3683,7 +3689,10 @@ bool WebMediaPlayerImpl::ShouldPausePlaybackWhenHidden() const {
+@@ -3710,7 +3716,10 @@ bool WebMediaPlayerImpl::ShouldPausePlaybackWhenHidden() const {
            : HasAudio();
  
    // Audio only stream is allowed to play when in background.
@@ -35,7 +35,7 @@ diff --git a/third_party/blink/renderer/platform/media/web_media_player_impl.cc
 +  if (!HasVideoNonEmptySize() && preserve_audio)
      return false;
  
-   // Video PiP is the only exception when background video playback is disabled.
+   // MediaPlayer always signals audio and video, so use an empty natural size to
 diff --git a/third_party/blink/renderer/platform/media/web_media_player_impl.h b/third_party/blink/renderer/platform/media/web_media_player_impl.h
 --- a/third_party/blink/renderer/platform/media/web_media_player_impl.h
 +++ b/third_party/blink/renderer/platform/media/web_media_player_impl.h
@@ -47,6 +47,6 @@ diff --git a/third_party/blink/renderer/platform/media/web_media_player_impl.h b
 +  bool HasVideoNonEmptySize() const;
 +
    void EnabledAudioTracksChanged(
-       std::optional<WebMediaPlayer::TrackId> enabled_track_id) override;
+       const std::vector<WebMediaPlayer::TrackId>& enabled_track_ids) override;
    void SelectedVideoTrackChanged(
 --

build/patches/Always-allow-inspect-fallback.patch

@@ -20,7 +20,7 @@ diff --git a/chrome/browser/resources/inspect/inspect.js b/chrome/browser/resour
    if (!HOST_CHROME_VERSION) {
      return false;
    }
-@@ -590,7 +591,7 @@ function formatValue(data, property) {
+@@ -566,7 +567,7 @@ function formatValue(data, property) {
  function addFavicon(row, data) {
    const favicon = document.createElement('img');
    if (data['faviconUrl']) {

build/patches/Always-open-browser-controls-in-new-tab.patch

@@ -10,34 +10,34 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tab/TabContextMenuItemDelegate.java b/chrome/android/java/src/org/chromium/chrome/browser/tab/TabContextMenuItemDelegate.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/tab/TabContextMenuItemDelegate.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/tab/TabContextMenuItemDelegate.java
-@@ -24,6 +24,7 @@ import org.chromium.base.metrics.RecordUserAction;
+@@ -21,6 +21,7 @@ import org.chromium.base.IntentUtils;
+ import org.chromium.base.PackageManagerUtils;
+ import org.chromium.base.metrics.RecordUserAction;
  import org.chromium.base.supplier.Supplier;
- import org.chromium.build.annotations.NullMarked;
- import org.chromium.build.annotations.Nullable;
 +import org.chromium.cc.input.BrowserControlsState;
  import org.chromium.chrome.browser.DefaultBrowserInfo;
  import org.chromium.chrome.browser.IntentHandler;
- import org.chromium.chrome.browser.bookmarks.BookmarkManagerOpenerImpl;
-@@ -43,6 +44,7 @@ import org.chromium.chrome.browser.preferences.Pref;
- import org.chromium.chrome.browser.price_tracking.PriceDropNotificationManagerFactory;
- import org.chromium.chrome.browser.printing.TabPrinter;
+ import org.chromium.chrome.browser.bookmarks.BookmarkModel;
+@@ -34,6 +35,7 @@ import org.chromium.chrome.browser.multiwindow.MultiWindowUtils;
+ import org.chromium.chrome.browser.offlinepages.OfflinePageBridge;
+ import org.chromium.chrome.browser.offlinepages.RequestCoordinatorBridge;
  import org.chromium.chrome.browser.profiles.Profile;
 +import org.chromium.chrome.browser.tab.TabBrowserControlsConstraintsHelper;
  import org.chromium.chrome.browser.tabmodel.TabModelSelector;
  import org.chromium.chrome.browser.tabmodel.document.ChromeAsyncTabLauncher;
  import org.chromium.chrome.browser.ui.messages.snackbar.SnackbarManager;
-@@ -303,6 +305,7 @@ public class TabContextMenuItemDelegate implements ContextMenuItemDelegate {
-             @Nullable Referrer referrer,
+@@ -235,6 +237,7 @@ public class TabContextMenuItemDelegate implements ContextMenuItemDelegate {
+             Referrer referrer,
              boolean navigateToTab,
              @Nullable AdditionalNavigationParams additionalNavigationParams) {
 +        TabBrowserControlsConstraintsHelper.get(mTab).update(BrowserControlsState.SHOWN, true);
          RecordUserAction.record("MobileNewTabOpened");
          RecordUserAction.record("LinkOpenedInNewTab");
          LoadUrlParams loadUrlParams = new LoadUrlParams(url.getSpec());
-@@ -323,6 +326,7 @@ public class TabContextMenuItemDelegate implements ContextMenuItemDelegate {
+@@ -255,6 +258,7 @@ public class TabContextMenuItemDelegate implements ContextMenuItemDelegate {
       * @param url The URL to open.
       */
-     public void onOpenInNewTabInGroup(GURL url, @Nullable Referrer referrer) {
+     public void onOpenInNewTabInGroup(GURL url, Referrer referrer) {
 +        TabBrowserControlsConstraintsHelper.get(mTab).update(BrowserControlsState.SHOWN, true);
          RecordUserAction.record("MobileNewTabOpened");
          RecordUserAction.record("LinkOpenedInNewTab");

build/patches/Always-use-new-tab-page-for-default-home-page.patch

@@ -7,51 +7,39 @@ Ignore any partner-provided home page.
 License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 ---
  .../org/chromium/chrome/browser/homepage/HomepageManager.java | 4 ----
- .../chrome/browser/new_tab_url/DseNewTabUrlManager.java       | 1 +
  .../partnerbookmarks/PartnerBookmarksProviderIterator.java    | 1 +
  .../partnercustomizations/PartnerBrowserCustomizations.java   | 2 +-
  .../org/chromium/components/search_engines/TemplateUrl.java   | 1 +
  .../search_engines/android/template_url_service_android.cc    | 1 +
- .../always-use-new-tab-page-for-default-home-page.inc         | 1 +
- 7 files changed, 6 insertions(+), 5 deletions(-)
+ .../always-use-new-tab-page-for-default-home-page.inc         | 2 ++
+ 6 files changed, 6 insertions(+), 5 deletions(-)
  create mode 100755 cromite_flags/chrome/browser/flags/android/chrome_feature_list_cc/always-use-new-tab-page-for-default-home-page.inc
 
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/homepage/HomepageManager.java b/chrome/android/java/src/org/chromium/chrome/browser/homepage/HomepageManager.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/homepage/HomepageManager.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/homepage/HomepageManager.java
-@@ -160,10 +160,6 @@ public class HomepageManager
+@@ -155,10 +155,6 @@ public class HomepageManager
       *     tab page if the homepage button is force enabled via flag.
       */
      public GURL getDefaultHomepageGurl() {
 -        if (PartnerBrowserCustomizations.getInstance().isHomepageProviderAvailableAndEnabled()) {
--            return assumeNonNull(PartnerBrowserCustomizations.getInstance().getHomePageUrl());
+-            return PartnerBrowserCustomizations.getInstance().getHomePageUrl();
 -        }
 -
          String homepagePartnerDefaultGurlSerialized =
                  ChromeSharedPreferences.getInstance()
                          .readString(
-diff --git a/chrome/android/java/src/org/chromium/chrome/browser/new_tab_url/DseNewTabUrlManager.java b/chrome/android/java/src/org/chromium/chrome/browser/new_tab_url/DseNewTabUrlManager.java
---- a/chrome/android/java/src/org/chromium/chrome/browser/new_tab_url/DseNewTabUrlManager.java
-+++ b/chrome/android/java/src/org/chromium/chrome/browser/new_tab_url/DseNewTabUrlManager.java
-@@ -60,6 +60,7 @@ public class DseNewTabUrlManager {
- 
-     /** Returns whether the feature NewTabSearchEngineUrlAndroid is enabled. */
-     public static boolean isNewTabSearchEngineUrlAndroidEnabled() {
-+        if ((true)) return false;
-         return ChromeSharedPreferences.getInstance()
-                         .readBoolean(ChromePreferenceKeys.IS_EEA_CHOICE_COUNTRY, false)
-                 || (OmniboxFeatures.sOmniboxMobileParityUpdate.isEnabled()
 diff --git a/chrome/browser/partnerbookmarks/android/java/src/org/chromium/chrome/browser/partnerbookmarks/PartnerBookmarksProviderIterator.java b/chrome/browser/partnerbookmarks/android/java/src/org/chromium/chrome/browser/partnerbookmarks/PartnerBookmarksProviderIterator.java
 --- a/chrome/browser/partnerbookmarks/android/java/src/org/chromium/chrome/browser/partnerbookmarks/PartnerBookmarksProviderIterator.java
 +++ b/chrome/browser/partnerbookmarks/android/java/src/org/chromium/chrome/browser/partnerbookmarks/PartnerBookmarksProviderIterator.java
-@@ -70,6 +70,7 @@ public class PartnerBookmarksProviderIterator implements PartnerBookmark.Bookmar
-         new AsyncTask<@Nullable Cursor>() {
-             @Override
-             protected @Nullable Cursor doInBackground() {
-+                if ((true)) return null;
-                 try {
-                     return ContextUtils.getApplicationContext()
-                             .getContentResolver()
+@@ -61,6 +61,7 @@ public class PartnerBookmarksProviderIterator implements PartnerBookmark.Bookmar
+      * @return Iterator over bookmarks or null.
+      */
+     public static PartnerBookmarksProviderIterator createIfAvailable() {
++        if ((true)) return null;
+         try {
+             Cursor cursor =
+                     ContextUtils.getApplicationContext()
 diff --git a/chrome/browser/partnercustomizations/java/src/org/chromium/chrome/browser/partnercustomizations/PartnerBrowserCustomizations.java b/chrome/browser/partnercustomizations/java/src/org/chromium/chrome/browser/partnercustomizations/PartnerBrowserCustomizations.java
 --- a/chrome/browser/partnercustomizations/java/src/org/chromium/chrome/browser/partnercustomizations/PartnerBrowserCustomizations.java
 +++ b/chrome/browser/partnercustomizations/java/src/org/chromium/chrome/browser/partnercustomizations/PartnerBrowserCustomizations.java
@@ -67,7 +55,7 @@ diff --git a/chrome/browser/partnercustomizations/java/src/org/chromium/chrome/b
 diff --git a/components/search_engines/android/java/src/org/chromium/components/search_engines/TemplateUrl.java b/components/search_engines/android/java/src/org/chromium/components/search_engines/TemplateUrl.java
 --- a/components/search_engines/android/java/src/org/chromium/components/search_engines/TemplateUrl.java
 +++ b/components/search_engines/android/java/src/org/chromium/components/search_engines/TemplateUrl.java
-@@ -88,6 +88,7 @@ public class TemplateUrl {
+@@ -74,6 +74,7 @@ public class TemplateUrl {
       *     prepopulated_engines.json.
       */
      public String getNewTabURL() {
@@ -78,18 +66,19 @@ diff --git a/components/search_engines/android/java/src/org/chromium/components/
 diff --git a/components/search_engines/android/template_url_service_android.cc b/components/search_engines/android/template_url_service_android.cc
 --- a/components/search_engines/android/template_url_service_android.cc
 +++ b/components/search_engines/android/template_url_service_android.cc
-@@ -400,6 +400,7 @@ jboolean TemplateUrlServiceAndroid::SetPlayAPISearchEngine(
+@@ -404,6 +404,7 @@ jboolean TemplateUrlServiceAndroid::SetPlayAPISearchEngine(
          jimage_translate_source_language_param_key,
      const base::android::JavaParamRef<jstring>&
          jimage_translate_target_language_param_key) {
 +  if ((true)) return false;
    // The function is scheduled to run only when the service is loaded, see
    // `TemplateUrlService#runWhenLoaded()`.
-   CHECK(template_url_service_->loaded());
+   CHECK(template_url_service_->loaded(), base::NotFatalUntil::M128);
 diff --git a/cromite_flags/chrome/browser/flags/android/chrome_feature_list_cc/always-use-new-tab-page-for-default-home-page.inc b/cromite_flags/chrome/browser/flags/android/chrome_feature_list_cc/always-use-new-tab-page-for-default-home-page.inc
 new file mode 100755
 --- /dev/null
 +++ b/cromite_flags/chrome/browser/flags/android/chrome_feature_list_cc/always-use-new-tab-page-for-default-home-page.inc
-@@ -0,0 +1 @@
+@@ -0,0 +1,2 @@
++SET_CROMITE_FEATURE_DISABLED(kNewTabSearchEngineUrlAndroid);
 +SET_CROMITE_FEATURE_DISABLED(kPartnerCustomizationsUma);
 --

build/patches/Android-Toolbar-Scroll-Ablation-setting.patch

@@ -7,35 +7,13 @@ Adds a setting for blocking the toolbar hiding
 need: Add-cromite-flags-support.patch
 License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 ---
- ...rowserStateBrowserControlsVisibilityDelegate.java |  4 +++-
  .../Toolbar-Scroll-Ablation-flag.grdp                |  9 +++++++++
  .../java/res/xml/accessibility_preferences.xml       |  6 ++++++
  .../about_flags_cc/Toolbar-Scroll-Ablation-flag.inc  | 12 ++++++++++++
- 4 files changed, 30 insertions(+), 1 deletion(-)
+ 3 files changed, 27 insertions(+)
  create mode 100644 chrome/browser/ui/android/strings/cromite_android_chrome_strings_grd/Toolbar-Scroll-Ablation-flag.grdp
  create mode 100644 cromite_flags/chrome/browser/about_flags_cc/Toolbar-Scroll-Ablation-flag.inc
 
-diff --git a/chrome/browser/browser_controls/android/java/src/org/chromium/chrome/browser/browser_controls/BrowserStateBrowserControlsVisibilityDelegate.java b/chrome/browser/browser_controls/android/java/src/org/chromium/chrome/browser/browser_controls/BrowserStateBrowserControlsVisibilityDelegate.java
---- a/chrome/browser/browser_controls/android/java/src/org/chromium/chrome/browser/browser_controls/BrowserStateBrowserControlsVisibilityDelegate.java
-+++ b/chrome/browser/browser_controls/android/java/src/org/chromium/chrome/browser/browser_controls/BrowserStateBrowserControlsVisibilityDelegate.java
-@@ -40,6 +40,7 @@ public class BrowserStateBrowserControlsVisibilityDelegate extends BrowserContro
-     private final Supplier<Boolean> mPersistentFullscreenMode;
- 
-     private long mCurrentShowingStartTime;
-+    private int temporaryToken;
- 
-     /**
-      * Constructs a BrowserControlsVisibilityDelegate designed to deal with overrides driven by
-@@ -65,7 +66,8 @@ public class BrowserStateBrowserControlsVisibilityDelegate extends BrowserContro
-         long currentShowingTime = SystemClock.uptimeMillis() - mCurrentShowingStartTime;
-         if (currentShowingTime >= MINIMUM_SHOW_DURATION_MS) return;
- 
--        final int temporaryToken = mTokenHolder.acquireToken();
-+        mTokenHolder.releaseToken(temporaryToken);
-+        temporaryToken = mTokenHolder.acquireToken();
-         mHandler.postDelayed(
-                 () -> mTokenHolder.releaseToken(temporaryToken),
-                 MINIMUM_SHOW_DURATION_MS - currentShowingTime);
 diff --git a/chrome/browser/ui/android/strings/cromite_android_chrome_strings_grd/Toolbar-Scroll-Ablation-flag.grdp b/chrome/browser/ui/android/strings/cromite_android_chrome_strings_grd/Toolbar-Scroll-Ablation-flag.grdp
 new file mode 100644
 --- /dev/null
@@ -53,7 +31,7 @@ new file mode 100644
 diff --git a/components/browser_ui/accessibility/android/java/res/xml/accessibility_preferences.xml b/components/browser_ui/accessibility/android/java/res/xml/accessibility_preferences.xml
 --- a/components/browser_ui/accessibility/android/java/res/xml/accessibility_preferences.xml
 +++ b/components/browser_ui/accessibility/android/java/res/xml/accessibility_preferences.xml
-@@ -79,6 +79,12 @@ found in the LICENSE file.
+@@ -73,6 +73,12 @@ found in the LICENSE file.
          android:key="disable_toolbar_swipeup"
          android:title="@string/disable_toolbar_swipe_up" />
  

build/patches/Android-fonts-fingerprinting-mitigation.patch

@@ -6,13 +6,12 @@ Replaces system fonts with a predefined set downloaded from www.cromite.org
 
 License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 ---
- .../common/ProductionSupportedFlagList.java   |    3 +
  .../component_updater/registration.cc         |    9 +
  .../java/res/xml/developer_preferences.xml    |    5 +
  chrome/browser/BUILD.gn                       |    7 +
  .../browser/component_updater/registration.cc |   10 +
  ...droid-fonts-fingerprinting-mitigation.grdp |    9 +
- chrome/renderer/BUILD.gn                      |    4 +
+ chrome/renderer/BUILD.gn                      |    3 +
  .../installer_policies/BUILD.gn               |    7 +
  .../fonts_pack_component_installer.cc         |   96 +
  .../fonts_pack_component_installer.h          |   60 +
@@ -38,11 +37,11 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
  .../skia/src/ports/SkFontConfigInterface.cpp  |    4 +
  .../ports/SkFontConfigInterface_direct.cpp    |    5 +
  .../src/ports/SkFontConfigInterface_direct.h  |    1 +
- .../skia/src/ports/SkFontMgr_android.cpp      |  279 ++-
+ .../skia/src/ports/SkFontMgr_android.cpp      |  263 ++-
  .../skia/src/ports/SkFontMgr_android_data.cpp | 1640 +++++++++++++++++
  .../src/ports/SkFontMgr_android_parser.cpp    |   49 +-
  .../skia/src/ports/SkFontMgr_android_parser.h |    5 +-
- 36 files changed, 2415 insertions(+), 76 deletions(-)
+ 35 files changed, 2399 insertions(+), 72 deletions(-)
  create mode 100644 chrome/browser/ui/android/strings/cromite_android_chrome_strings_grd/Android-fonts-fingerprinting-mitigation.grdp
  create mode 100644 components/component_updater/installer_policies/fonts_pack_component_installer.cc
  create mode 100644 components/component_updater/installer_policies/fonts_pack_component_installer.h
@@ -51,23 +50,10 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
  create mode 100644 cromite_flags/third_party/blink/common/features_h/Android-fonts-fingerprinting-mitigation.inc
  create mode 100644 third_party/skia/src/ports/SkFontMgr_android_data.cpp
 
-diff --git a/android_webview/java/src/org/chromium/android_webview/common/ProductionSupportedFlagList.java b/android_webview/java/src/org/chromium/android_webview/common/ProductionSupportedFlagList.java
---- a/android_webview/java/src/org/chromium/android_webview/common/ProductionSupportedFlagList.java
-+++ b/android_webview/java/src/org/chromium/android_webview/common/ProductionSupportedFlagList.java
-@@ -1007,6 +1007,9 @@ public final class ProductionSupportedFlagList {
-                 "Hides user preference on the system keyboard by setting the standard "
-                  + "eng layout and removing the layout information from the "
-                  + "javascript keyboard events."),
-+        Flag.baseFeature(
-+                "AndroidFontsFingerprintingMitigation",
-+                "Android fonts fingerprinting mitigation: replaces all system fonts with the same for all devices.."),
-         Flag.baseFeature(
-                 BlinkFeatures.ASYNC_SET_COOKIE,
-                 "When enabled, the communication between renderer and network service is "
 diff --git a/android_webview/nonembedded/component_updater/registration.cc b/android_webview/nonembedded/component_updater/registration.cc
 --- a/android_webview/nonembedded/component_updater/registration.cc
 +++ b/android_webview/nonembedded/component_updater/registration.cc
-@@ -26,6 +26,9 @@
+@@ -27,6 +27,9 @@
  #include "components/update_client/update_client.h"
  #include "mojo/public/cpp/base/proto_wrapper.h"
  
@@ -77,7 +63,7 @@ diff --git a/android_webview/nonembedded/component_updater/registration.cc b/and
  namespace android_webview {
  
  void RegisterComponentsForUpdate(
-@@ -42,6 +45,12 @@ void RegisterComponentsForUpdate(
+@@ -43,6 +46,12 @@ void RegisterComponentsForUpdate(
    std::vector<std::unique_ptr<component_updater::ComponentInstallerPolicy>>
        component_installer_list_cromite;
  
@@ -106,7 +92,7 @@ diff --git a/chrome/android/java/res/xml/developer_preferences.xml b/chrome/andr
 diff --git a/chrome/browser/BUILD.gn b/chrome/browser/BUILD.gn
 --- a/chrome/browser/BUILD.gn
 +++ b/chrome/browser/BUILD.gn
-@@ -7951,6 +7951,13 @@ static_library("browser") {
+@@ -7648,6 +7648,13 @@ static_library("browser") {
      }
    }
  
@@ -123,9 +109,9 @@ diff --git a/chrome/browser/BUILD.gn b/chrome/browser/BUILD.gn
 diff --git a/chrome/browser/component_updater/registration.cc b/chrome/browser/component_updater/registration.cc
 --- a/chrome/browser/component_updater/registration.cc
 +++ b/chrome/browser/component_updater/registration.cc
-@@ -115,10 +115,20 @@
- #include "chrome/browser/component_updater/file_type_policies_component_installer.h"
- #endif
+@@ -118,10 +118,20 @@
+ #include "chrome/browser/component_updater/wasm_tts_engine_component_installer.h"
+ #endif  // BUILDFLAG(IS_WIN) || BUILDFLAG(IS_MAC) || BUILDFLAG(IS_LINUX)
  
 +#if BUILDFLAG(IS_ANDROID)
 +#include "components/component_updater/installer_policies/fonts_pack_component_installer.h"
@@ -161,21 +147,20 @@ new file mode 100644
 diff --git a/chrome/renderer/BUILD.gn b/chrome/renderer/BUILD.gn
 --- a/chrome/renderer/BUILD.gn
 +++ b/chrome/renderer/BUILD.gn
-@@ -258,6 +258,10 @@ static_library("renderer") {
-     deps += [ "//components/strings" ]
-   }
+@@ -293,6 +293,9 @@ static_library("renderer") {
+       "//ppapi/shared_impl",
+     ]
  
-+  if (is_android) {
-+    deps += [ "//components/services/font/public/cpp" ]
-+  }
-+
-   if (enable_pdf) {
-     deps += [
-       "//components/pdf/renderer",
++    if (is_android) {
++      deps += [ "//components/services/font/public/cpp" ]
++    }
+     if (is_linux || is_chromeos) {
+       deps += [ "//components/services/font/public/cpp" ]
+     }
 diff --git a/components/component_updater/installer_policies/BUILD.gn b/components/component_updater/installer_policies/BUILD.gn
 --- a/components/component_updater/installer_policies/BUILD.gn
 +++ b/components/component_updater/installer_policies/BUILD.gn
-@@ -38,6 +38,13 @@ static_library("installer_policies_no_content_deps") {
+@@ -34,6 +34,13 @@ static_library("installer_policies_no_content_deps") {
      "trust_token_key_commitments_component_installer_policy.h",
    ]
  
@@ -512,14 +497,14 @@ diff --git a/components/services/font/public/cpp/font_loader.cc b/components/ser
 diff --git a/components/services/font/public/cpp/font_loader.h b/components/services/font/public/cpp/font_loader.h
 --- a/components/services/font/public/cpp/font_loader.h
 +++ b/components/services/font/public/cpp/font_loader.h
-@@ -54,6 +54,7 @@ class FontLoader : public SkFontConfigInterface,
+@@ -52,6 +52,7 @@ class FontLoader : public SkFontConfigInterface,
+                        SkString* out_family_name,
                         SkFontStyle* out_style) override;
-   SkStreamAsset* openStream(const FontIdentity& identity) override
-       LOCKS_EXCLUDED(mapped_font_files_lock_);
+   SkStreamAsset* openStream(const FontIdentity& identity) override;
 +  SkStreamAsset* openStreamFromName(const char* filename) override;
    sk_sp<SkTypeface> makeTypeface(const FontIdentity& identity,
-                                  sk_sp<SkFontMgr> mgr) override
-       LOCKS_EXCLUDED(typeface_cache_lock_);
+                                  sk_sp<SkFontMgr> mgr) override;
+ 
 diff --git a/components/services/font/public/cpp/font_service_thread.cc b/components/services/font/public/cpp/font_service_thread.cc
 --- a/components/services/font/public/cpp/font_service_thread.cc
 +++ b/components/services/font/public/cpp/font_service_thread.cc
@@ -615,7 +600,7 @@ diff --git a/components/services/font/public/mojom/font_service.mojom b/componen
 diff --git a/content/browser/BUILD.gn b/content/browser/BUILD.gn
 --- a/content/browser/BUILD.gn
 +++ b/content/browser/BUILD.gn
-@@ -2600,6 +2600,17 @@ source_set("browser") {
+@@ -2524,6 +2524,17 @@ source_set("browser") {
      ]
    }
  
@@ -633,7 +618,7 @@ diff --git a/content/browser/BUILD.gn b/content/browser/BUILD.gn
    if (is_linux || is_chromeos) {
      sources -=
          [ "file_system_access/file_path_watcher/file_path_watcher_stub.cc" ]
-@@ -2645,6 +2656,13 @@ source_set("browser") {
+@@ -2566,6 +2577,13 @@ source_set("browser") {
      ]
    }
  
@@ -645,13 +630,13 @@ diff --git a/content/browser/BUILD.gn b/content/browser/BUILD.gn
 +  }
 +
    if (allow_oop_video_decoder) {
-     sources += [ "media/oop_video_decoder_factory.cc" ]
-     deps += [ "//media/mojo/mojom" ]
+     sources += [ "media/stable_video_decoder_factory.cc" ]
+     deps += [ "//media/mojo/mojom/stable:stable_video_decoder" ]
 diff --git a/content/browser/renderer_host/render_process_host_impl_receiver_bindings.cc b/content/browser/renderer_host/render_process_host_impl_receiver_bindings.cc
 --- a/content/browser/renderer_host/render_process_host_impl_receiver_bindings.cc
 +++ b/content/browser/renderer_host/render_process_host_impl_receiver_bindings.cc
 @@ -52,6 +52,11 @@
- #include "third_party/blink/public/mojom/android_font_lookup/android_font_lookup.mojom.h"
+ #include "third_party/blink/public/mojom/webdatabase/web_database.mojom.h"
  #endif
  
 +#if BUILDFLAG(IS_ANDROID)
@@ -662,7 +647,7 @@ diff --git a/content/browser/renderer_host/render_process_host_impl_receiver_bin
  #if BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_CHROMEOS)
  #include "components/services/font/public/mojom/font_service.mojom.h"  // nogncheck
  #include "content/browser/font_service.h"  // nogncheck
-@@ -348,6 +353,13 @@ void RenderProcessHostImpl::IOThreadHostImpl::BindHostReceiver(
+@@ -343,6 +348,13 @@ void RenderProcessHostImpl::IOThreadHostImpl::BindHostReceiver(
    }
  #endif
  
@@ -679,7 +664,7 @@ diff --git a/content/browser/renderer_host/render_process_host_impl_receiver_bin
 diff --git a/content/child/BUILD.gn b/content/child/BUILD.gn
 --- a/content/child/BUILD.gn
 +++ b/content/child/BUILD.gn
-@@ -136,6 +136,13 @@ target(link_target_type, "child") {
+@@ -135,6 +135,13 @@ target(link_target_type, "child") {
      ]
    }
  
@@ -696,7 +681,7 @@ diff --git a/content/child/BUILD.gn b/content/child/BUILD.gn
 diff --git a/content/renderer/BUILD.gn b/content/renderer/BUILD.gn
 --- a/content/renderer/BUILD.gn
 +++ b/content/renderer/BUILD.gn
-@@ -346,6 +346,10 @@ target(link_target_type, "renderer") {
+@@ -355,6 +355,10 @@ target(link_target_type, "renderer") {
      deps += [ "//services/screen_ai/public/mojom" ]
    }
  
@@ -710,7 +695,7 @@ diff --git a/content/renderer/BUILD.gn b/content/renderer/BUILD.gn
 diff --git a/content/renderer/renderer_blink_platform_impl.cc b/content/renderer/renderer_blink_platform_impl.cc
 --- a/content/renderer/renderer_blink_platform_impl.cc
 +++ b/content/renderer/renderer_blink_platform_impl.cc
-@@ -137,6 +137,23 @@
+@@ -142,6 +142,23 @@
  #include "content/common/android/sync_compositor_statics.h"
  #endif
  
@@ -734,7 +719,7 @@ diff --git a/content/renderer/renderer_blink_platform_impl.cc b/content/renderer
  using blink::Platform;
  using blink::WebAudioDevice;
  using blink::WebAudioLatencyHint;
-@@ -180,6 +197,37 @@ gpu::ContextType ToGpuContextType(blink::Platform::ContextType type) {
+@@ -184,6 +201,37 @@ gpu::ContextType ToGpuContextType(blink::Platform::ContextType type) {
    NOTREACHED();
  }
  
@@ -772,7 +757,7 @@ diff --git a/content/renderer/renderer_blink_platform_impl.cc b/content/renderer
  }  // namespace
  
  //------------------------------------------------------------------------------
-@@ -193,18 +241,21 @@ RendererBlinkPlatformImpl::RendererBlinkPlatformImpl(
+@@ -197,18 +245,21 @@ RendererBlinkPlatformImpl::RendererBlinkPlatformImpl(
        is_locked_to_site_(false),
        main_thread_scheduler_(main_thread_scheduler),
        next_frame_sink_id_(uint32_t{std::numeric_limits<int32_t>::max()} + 1) {
@@ -838,7 +823,7 @@ new file mode 100644
 diff --git a/skia/BUILD.gn b/skia/BUILD.gn
 --- a/skia/BUILD.gn
 +++ b/skia/BUILD.gn
-@@ -463,6 +463,18 @@ component("skia") {
+@@ -446,6 +446,18 @@ component("skia") {
      sources += skia_ports_fci_sources
    }
  
@@ -884,7 +869,7 @@ diff --git a/third_party/skia/include/ports/SkFontMgr_android.h b/third_party/sk
  
  #include <memory>
  
-@@ -40,9 +45,44 @@ struct SkFontMgr_Android_CustomFonts {
+@@ -40,13 +45,46 @@ struct SkFontMgr_Android_CustomFonts {
       *  system IO resources on initialization.
       */
      bool fIsolated;
@@ -924,9 +909,12 @@ diff --git a/third_party/skia/include/ports/SkFontMgr_android.h b/third_party/sk
  };
  
  /** Create a font manager for Android. If 'custom' is NULL, use only system fonts. */
--SK_API sk_sp<SkFontMgr> SkFontMgr_New_Android(const SkFontMgr_Android_CustomFonts* custom,
+ 
+ // Deprecated
+-SK_API sk_sp<SkFontMgr> SkFontMgr_New_Android(const SkFontMgr_Android_CustomFonts* custom);
 +SK_API sk_sp<SkFontMgr> SkFontMgr_New_Android(std::unique_ptr<SkFontMgr_Android_CustomFonts> custom);
-+
+ 
+-SK_API sk_sp<SkFontMgr> SkFontMgr_New_Android(const SkFontMgr_Android_CustomFonts* custom,
 +SK_API sk_sp<SkFontMgr> SkFontMgr_New_Android(std::unique_ptr<SkFontMgr_Android_CustomFonts> custom,
                                                std::unique_ptr<SkFontScanner> scanner);
  #endif // SkFontMgr_android_DEFINED
@@ -948,7 +936,7 @@ diff --git a/third_party/skia/src/ports/SkFontConfigInterface.cpp b/third_party/
 diff --git a/third_party/skia/src/ports/SkFontConfigInterface_direct.cpp b/third_party/skia/src/ports/SkFontConfigInterface_direct.cpp
 --- a/third_party/skia/src/ports/SkFontConfigInterface_direct.cpp
 +++ b/third_party/skia/src/ports/SkFontConfigInterface_direct.cpp
-@@ -715,3 +715,8 @@ bool SkFontConfigInterfaceDirect::matchFamilyName(const char familyName[],
+@@ -707,3 +707,8 @@ bool SkFontConfigInterfaceDirect::matchFamilyName(const char familyName[],
  SkStreamAsset* SkFontConfigInterfaceDirect::openStream(const FontIdentity& identity) {
      return SkStream::MakeFromFile(identity.fString.c_str()).release();
  }
@@ -971,15 +959,7 @@ diff --git a/third_party/skia/src/ports/SkFontConfigInterface_direct.h b/third_p
 diff --git a/third_party/skia/src/ports/SkFontMgr_android.cpp b/third_party/skia/src/ports/SkFontMgr_android.cpp
 --- a/third_party/skia/src/ports/SkFontMgr_android.cpp
 +++ b/third_party/skia/src/ports/SkFontMgr_android.cpp
-@@ -16,6 +16,7 @@
- #include "include/core/SkStream.h"
- #include "include/core/SkString.h"
- #include "include/ports/SkFontMgr_android.h"
-+#include "include/ports/SkFontScanner_FreeType.h"
- #include "include/private/base/SkFixed.h"
- #include "include/private/base/SkTArray.h"
- #include "include/private/base/SkTDArray.h"
-@@ -27,6 +28,7 @@
+@@ -26,6 +26,7 @@
  #include "src/core/SkTypefaceCache.h"
  #include "src/ports/SkFontMgr_android_parser.h"
  #include "src/ports/SkTypeface_proxy.h"
@@ -987,7 +967,7 @@ diff --git a/third_party/skia/src/ports/SkFontMgr_android.cpp b/third_party/skia
  
  #include <algorithm>
  #include <limits>
-@@ -36,6 +38,91 @@ using namespace skia_private;
+@@ -35,6 +36,91 @@ using namespace skia_private;
  class SkData;
  
  namespace {
@@ -1078,18 +1058,17 @@ diff --git a/third_party/skia/src/ports/SkFontMgr_android.cpp b/third_party/skia
 +
  class SkTypeface_AndroidSystem : public SkTypeface_proxy {
  public:
-     static sk_sp<SkTypeface_AndroidSystem> Make(sk_sp<SkTypeface> realTypeface,
-@@ -109,7 +196,8 @@ using StreamForPathCache = skia_private::THashMap<SkString, std::unique_ptr<SkSt
+     SkTypeface_AndroidSystem(sk_sp<SkTypeface> proxy,
+@@ -144,7 +230,7 @@ template <typename D, typename S> sk_sp<D> sk_sp_static_cast(sk_sp<S>&& s) {
  class SkFontStyleSet_Android : public SkFontStyleSet {
  public:
      explicit SkFontStyleSet_Android(const FontFamily& family, const SkFontScanner* scanner,
--                                    const bool cacheFontFiles, StreamForPathCache& streamForPath) {
-+                                    const bool cacheFontFiles, StreamForPathCache& streamForPath,
-+                                    const SkFontMgr_Android_CustomFonts* custom) {
+-                                    const bool cacheFontFiles) {
++                                    const bool cacheFontFiles, const SkFontMgr_Android_CustomFonts* custom) {
          const SkString* cannonicalFamilyName = nullptr;
          if (!family.fNames.empty()) {
              cannonicalFamilyName = &family.fNames[0];
-@@ -118,38 +206,60 @@ public:
+@@ -153,30 +239,52 @@ public:
  
          // TODO? make this lazy
          for (int i = 0; i < family.fFonts.size(); ++i) {
@@ -1099,17 +1078,10 @@ diff --git a/third_party/skia/src/ports/SkFontMgr_android.cpp b/third_party/skia
              SkString pathName(family.fBasePath);
              pathName.append(fontFile.fFileName);
  
--            std::unique_ptr<SkStreamAsset>* streamPtr = streamForPath.find(pathName);
--            if (!streamPtr) {
--                streamPtr = streamForPath.set(pathName, SkStream::MakeFromFile(pathName.c_str()));
--            }
--            if (!*streamPtr) {
--                SkDEBUGF("Requested font file %s cannot be opened.\n", pathName.c_str());
--                continue;
--            }
--            std::unique_ptr<SkStreamAsset> stream = (*streamPtr)->duplicate();
+-            std::unique_ptr<SkStreamAsset> stream = SkStream::MakeFromFile(pathName.c_str());
 -            if (!stream) {
--                SkDEBUGF("Requested font file %s could not be duplicated.\n", pathName.c_str());
+-                SkDEBUGF("Requested font file %s does not exist or cannot be opened.\n",
+-                         pathName.c_str());
 -                continue;
 +            const int ttcIndex = fontFile.fIndex;
 +            SkString familyName;
@@ -1121,17 +1093,10 @@ diff --git a/third_party/skia/src/ports/SkFontMgr_android.cpp b/third_party/skia
 +
 +            std::unique_ptr<SkStreamAsset> stream;
 +            if (!custom && !fontFile.fFileName.startsWith('#')) {
-+                std::unique_ptr<SkStreamAsset>* streamPtr = streamForPath.find(pathName);
-+                if (!streamPtr) {
-+                    streamPtr = streamForPath.set(pathName, SkStream::MakeFromFile(pathName.c_str()));
-+                }
-+                if (!*streamPtr) {
-+                    SkDEBUGF("Requested font file %s cannot be opened.\n", pathName.c_str());
-+                    continue;
-+                }
-+                stream = (*streamPtr)->duplicate();
++                stream = SkStream::MakeFromFile(pathName.c_str());
 +                if (!stream) {
-+                    SkDEBUGF("Requested font file %s could not be duplicated.\n", pathName.c_str());
++                    SkDEBUGF("Requested font file %s does not exist or cannot be opened.\n",
++                            pathName.c_str());
 +                    continue;
 +                }
 +            } else if (custom) {
@@ -1151,7 +1116,6 @@ diff --git a/third_party/skia/src/ports/SkFontMgr_android.cpp b/third_party/skia
 +                fontFile.fVariationDesignPosition.begin(),
 +                fontFile.fVariationDesignPosition.size()
              };
-             // TODO: this creates the proxy with the given stream, so always cacheFontFiles.
 -            auto proxy = scanner->MakeFromStream(
 -                std::move(stream),
 -                SkFontArguments().setCollectionIndex(fontFile.fIndex)
@@ -1173,7 +1137,7 @@ diff --git a/third_party/skia/src/ports/SkFontMgr_android.cpp b/third_party/skia
              }
  
              uint32_t variant = family.fVariant;
-@@ -160,13 +270,25 @@ public:
+@@ -187,13 +295,25 @@ public:
              // The first specified family name overrides the family name found in the font.
              // TODO: SkTypeface_AndroidSystem::onCreateFamilyNameIterator should return
              // all of the specified family names in addition to the names found in the font.
@@ -1205,7 +1169,7 @@ diff --git a/third_party/skia/src/ports/SkFontMgr_android.cpp b/third_party/skia
              int weight = fontFile.fWeight != 0 ? fontFile.fWeight : fontStyle.weight();
              SkFontStyle::Slant slant = fontStyle.slant();
              switch (fontFile.fStyle) {
-@@ -177,6 +299,19 @@ public:
+@@ -204,6 +324,19 @@ public:
              }
              fontStyle = SkFontStyle(weight, fontStyle.width(), slant);
  
@@ -1222,10 +1186,10 @@ diff --git a/third_party/skia/src/ports/SkFontMgr_android.cpp b/third_party/skia
 +                                                       custom));
 +                continue;
 +            }
-             fStyles.push_back(
-                 SkTypeface_AndroidSystem::Make(proxy,
-                                                fontStyle, proxy->isFixedPitch(),
-@@ -205,15 +340,18 @@ public:
+             fStyles.push_back().reset(
+                 new SkTypeface_AndroidSystem(proxy,
+                                              pathName,
+@@ -238,15 +371,18 @@ public:
          return fStyles[index];
      }
  
@@ -1247,7 +1211,7 @@ diff --git a/third_party/skia/src/ports/SkFontMgr_android.cpp b/third_party/skia
      SkString fFallbackFor;
  
      friend struct NameToFamily;
-@@ -234,24 +372,26 @@ struct NameToFamily {
+@@ -267,24 +403,26 @@ struct NameToFamily {
  
  class SkFontMgr_Android : public SkFontMgr {
  public:
@@ -1278,7 +1242,7 @@ diff --git a/third_party/skia/src/ports/SkFontMgr_android.cpp b/third_party/skia
          }
          this->buildNameToFamilyMap(families, custom ? custom->fIsolated : false);
          this->findDefaultStyleSet();
-@@ -309,33 +449,53 @@ protected:
+@@ -342,33 +480,53 @@ protected:
          return sset->matchStyle(style);
      }
  
@@ -1347,7 +1311,7 @@ diff --git a/third_party/skia/src/ports/SkFontMgr_android.cpp b/third_party/skia
              }
          }
          return nullptr;
-@@ -358,7 +518,7 @@ protected:
+@@ -391,7 +549,7 @@ protected:
                  for (int bcp47Index = bcp47Count; bcp47Index --> 0;) {
                      SkLanguage lang(bcp47[bcp47Index]);
                      while (!lang.getTag().isEmpty()) {
@@ -1356,7 +1320,7 @@ diff --git a/third_party/skia/src/ports/SkFontMgr_android.cpp b/third_party/skia
                              find_family_style_character(currentFamilyName, fFallbackNameToFamilyMap,
                                                          style, SkToBool(elegant),
                                                          lang.getTag(), character);
-@@ -369,7 +529,7 @@ protected:
+@@ -402,7 +560,7 @@ protected:
                          lang = lang.getParent();
                      }
                  }
@@ -1365,7 +1329,7 @@ diff --git a/third_party/skia/src/ports/SkFontMgr_android.cpp b/third_party/skia
                      find_family_style_character(currentFamilyName, fFallbackNameToFamilyMap,
                                                  style, SkToBool(elegant),
                                                  SkString(), character);
-@@ -420,6 +580,7 @@ protected:
+@@ -453,6 +611,7 @@ protected:
  private:
  
      std::unique_ptr<SkFontScanner> fScanner;
@@ -1373,29 +1337,31 @@ diff --git a/third_party/skia/src/ports/SkFontMgr_android.cpp b/third_party/skia
  
      TArray<sk_sp<SkFontStyleSet_Android>> fStyleSets;
      sk_sp<SkFontStyleSet> fDefaultStyleSet;
-@@ -441,7 +602,7 @@ private:
+@@ -472,7 +631,7 @@ private:
          }
  
          sk_sp<SkFontStyleSet_Android> newSet =
--            sk_make_sp<SkFontStyleSet_Android>(family, fScanner.get(), isolated, streamForPath);
-+            sk_make_sp<SkFontStyleSet_Android>(family, fScanner.get(), isolated, streamForPath, custom_.get());
+-            sk_make_sp<SkFontStyleSet_Android>(family, fScanner.get(), isolated);
++            sk_make_sp<SkFontStyleSet_Android>(family, fScanner.get(), isolated, custom_.get());
          if (0 == newSet->count()) {
              return;
          }
-@@ -486,7 +647,11 @@ static char const * const gSystemFontUseStrings[] = {
+@@ -516,11 +675,11 @@ static char const * const gSystemFontUseStrings[] = {
  
  }  // namespace
  
--sk_sp<SkFontMgr> SkFontMgr_New_Android(const SkFontMgr_Android_CustomFonts* custom, std::unique_ptr<SkFontScanner> scanner) {
+-sk_sp<SkFontMgr> SkFontMgr_New_Android(const SkFontMgr_Android_CustomFonts* custom) {
+-    return SkFontMgr_New_Android(custom, SkFontScanner_Make_FreeType());
 +sk_sp<SkFontMgr> SkFontMgr_New_Android(std::unique_ptr<SkFontMgr_Android_CustomFonts> custom) {
 +    return SkFontMgr_New_Android(std::move(custom), SkFontScanner_Make_FreeType());
-+}
-+
+ }
+ 
+-sk_sp<SkFontMgr> SkFontMgr_New_Android(const SkFontMgr_Android_CustomFonts* custom, std::unique_ptr<SkFontScanner> scanner) {
 +sk_sp<SkFontMgr> SkFontMgr_New_Android(std::unique_ptr<SkFontMgr_Android_CustomFonts> custom, std::unique_ptr<SkFontScanner> scanner) {
      if (custom) {
          SkASSERT(0 <= custom->fSystemFontUse);
          SkASSERT(custom->fSystemFontUse < std::size(gSystemFontUseStrings));
-@@ -496,5 +661,5 @@ sk_sp<SkFontMgr> SkFontMgr_New_Android(const SkFontMgr_Android_CustomFonts* cust
+@@ -530,5 +689,5 @@ sk_sp<SkFontMgr> SkFontMgr_New_Android(const SkFontMgr_Android_CustomFonts* cust
                   custom->fFontsXml,
                   custom->fFallbackFontsXml);
      }

build/patches/Ask-for-restart-on-connection-change.patch

@@ -29,10 +29,9 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
  .../sAskForRestartOnConnectionChange.java     |  32 +++++
  .../browser/tabmodel/TabModelSelector.java    |   2 +
  .../browser/tabmodel/TabModelUtils.java       |  18 +++
- .../browser/tabwindow/TabWindowManager.java   |   2 +
- .../tabwindow/TabWindowManagerImpl.java       |  10 ++
+ .../browser/tabmodel/TabWindowManager.java    |   2 +
+ .../tabmodel/TabWindowManagerImpl.java        |  10 ++
  .../Ask-for-restart-on-connection-change.grdp |  15 +++
- .../java/res/layout/floating_snackbar.xml     |  10 ++
  .../android/java/res/layout/snackbar.xml      |  10 ++
  .../ui/messages/snackbar/Snackbar.java        |  16 +++
  .../ui/messages/snackbar/SnackbarManager.java |   6 +
@@ -50,7 +49,7 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
  .../blink/renderer/core/frame/local_frame.cc  |   2 +
  .../main_thread/frame_scheduler_impl.cc       |   2 +
  .../main_thread/page_scheduler_impl.cc        |   9 +-
- 30 files changed, 332 insertions(+), 10 deletions(-)
+ 29 files changed, 322 insertions(+), 10 deletions(-)
  create mode 100644 chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/cromite/sAskForRestartOnConnectionChange.java
  create mode 100644 chrome/browser/ui/android/strings/cromite_android_chrome_strings_grd/Ask-for-restart-on-connection-change.grdp
  create mode 100644 cromite_flags/chrome/browser/about_flags_cc/Ask-for-restart-on-connection-change.inc
@@ -76,7 +75,7 @@ diff --git a/chrome/android/java/res/xml/homepage_preferences.xml b/chrome/andro
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/net/connectivitydetector/ConnectivityDetector.java b/chrome/android/java/src/org/chromium/chrome/browser/net/connectivitydetector/ConnectivityDetector.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/net/connectivitydetector/ConnectivityDetector.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/net/connectivitydetector/ConnectivityDetector.java
-@@ -470,7 +470,6 @@ public class ConnectivityDetector implements NetworkChangeNotifier.ConnectionTyp
+@@ -468,7 +468,6 @@ public class ConnectivityDetector implements NetworkChangeNotifier.ConnectionTyp
      @VisibleForTesting(otherwise = VisibleForTesting.PACKAGE_PRIVATE)
      public void setConnectionState(@ConnectionState int connectionState) {
          Log.i(TAG, "setConnectionState connectionState=" + connectionState);
@@ -87,7 +86,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/net/connectivit
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/offlinepages/indicator/OfflineDetector.java b/chrome/android/java/src/org/chromium/chrome/browser/offlinepages/indicator/OfflineDetector.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/offlinepages/indicator/OfflineDetector.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/offlinepages/indicator/OfflineDetector.java
-@@ -23,17 +23,39 @@ import org.chromium.build.annotations.Nullable;
+@@ -21,16 +21,38 @@ import org.chromium.base.version_info.VersionInfo;
  import org.chromium.chrome.browser.flags.ChromeFeatureList;
  import org.chromium.chrome.browser.net.connectivitydetector.ConnectivityDetector;
  import org.chromium.chrome.browser.net.connectivitydetector.ConnectivityDetector.ConnectionState;
@@ -99,7 +98,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/offlinepages/in
 +import org.chromium.base.supplier.ObservableSupplier;
 +import org.chromium.url.GURL;
 +import org.chromium.chrome.R;
-+import org.chromium.chrome.browser.app.tabwindow.TabWindowManagerSingleton;
++import org.chromium.chrome.browser.app.tabmodel.TabWindowManagerSingleton;
 +import org.chromium.chrome.browser.layouts.LayoutManager;
 +import org.chromium.chrome.browser.compositor.layouts.Layout;
 +import org.chromium.chrome.browser.compositor.layouts.LayoutManagerImpl;
@@ -112,7 +111,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/offlinepages/in
 +import org.chromium.chrome.browser.tab.Tab;
 +import org.chromium.chrome.browser.tabmodel.TabModelUtils;
 +import org.chromium.chrome.browser.tabmodel.TabModelSelector;
-+import org.chromium.chrome.browser.tabwindow.TabWindowManager;
++import org.chromium.chrome.browser.tabmodel.TabWindowManager;
 +import org.chromium.chrome.browser.lifetime.ApplicationLifetime;
 +import org.chromium.content_public.browser.WebContentsObserver;
 +import org.chromium.content_public.browser.WebContents;
@@ -122,7 +121,6 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/offlinepages/in
   * Class that detects if the network is offline. Waits for the network to stablize before notifying
   * the observer.
   */
- @NullMarked
  class OfflineDetector
 -        implements ConnectivityDetector.Observer, ApplicationStatus.ApplicationStateListener {
 +        implements ConnectivityDetector.Observer, ApplicationStatus.ApplicationStateListener,
@@ -130,7 +128,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/offlinepages/in
      // If the connection is online, then we report that immediately via |mIsOfflineCallback|.
      // |STATUS_INDICATOR_WAIT_ON_OFFLINE_DURATION_MS| and
      // |mStatusIndicatorWaitOnSwitchOnlineToOfflineDurationMs| control the duration before
-@@ -119,6 +141,11 @@ class OfflineDetector
+@@ -116,6 +138,11 @@ class OfflineDetector
  
      private static final String TAG = "OfflineDetector";
  
@@ -142,7 +140,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/offlinepages/in
      /**
       * Constructs the offline indicator.
       * @param isOfflineCallback The {@link Callback} is invoked when the connectivity status is
-@@ -130,7 +157,13 @@ class OfflineDetector
+@@ -127,7 +154,13 @@ class OfflineDetector
      OfflineDetector(
              Callback<Boolean> isOfflineCallback,
              Callback<Boolean> isForegroundCallback,
@@ -157,7 +155,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/offlinepages/in
          mIsOfflineCallback = isOfflineCallback;
          mIsForegroundCallback = isForegroundCallback;
          mContext = context;
-@@ -234,6 +267,75 @@ class OfflineDetector
+@@ -231,6 +264,75 @@ class OfflineDetector
          updateState();
      }
  
@@ -233,7 +231,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/offlinepages/in
      private void logToAdbConsoleNow(String prefix) {
          Log.i(
                  TAG,
-@@ -320,6 +422,7 @@ class OfflineDetector
+@@ -316,6 +418,7 @@ class OfflineDetector
       ** Calls |mUpdateOfflineStatusIndicatorDelayedRunnable| to update the connection state.
       */
      private void updateState() {
@@ -244,7 +242,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/offlinepages/in
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/offlinepages/indicator/OfflineIndicatorControllerV2.java b/chrome/android/java/src/org/chromium/chrome/browser/offlinepages/indicator/OfflineIndicatorControllerV2.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/offlinepages/indicator/OfflineIndicatorControllerV2.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/offlinepages/indicator/OfflineIndicatorControllerV2.java
-@@ -31,6 +31,11 @@ import org.chromium.content_public.common.ContentSwitches;
+@@ -28,6 +28,11 @@ import org.chromium.content_public.common.ContentSwitches;
  import java.lang.annotation.Retention;
  import java.lang.annotation.RetentionPolicy;
  
@@ -256,7 +254,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/offlinepages/in
  /**
   * Class that controls visibility and content of {@link StatusIndicatorCoordinator} to relay
   * connectivity information.
-@@ -104,7 +109,10 @@ public class OfflineIndicatorControllerV2 {
+@@ -101,7 +106,10 @@ public class OfflineIndicatorControllerV2 {
              Context context,
              StatusIndicatorCoordinator statusIndicator,
              ObservableSupplier<Boolean> isUrlBarFocusedSupplier,
@@ -265,10 +263,10 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/offlinepages/in
 +            ObservableSupplier<TabModelSelector> tabModelSelectorSupplier,
 +            ObservableSupplierImpl<LayoutManager> layoutManager,
 +            Supplier<SnackbarManager> snackbarManagerSupplier) {
-         // If "force online connection state" switch is set, the offline indicator should never
-         // show.
-         assert !CommandLine.getInstance()
-@@ -130,7 +138,10 @@ public class OfflineIndicatorControllerV2 {
+         if (CommandLine.getInstance()
+                 .hasSwitch(ContentSwitches.FORCE_ONLINE_CONNECTION_STATE_FOR_INDICATOR)) {
+             // If "force online connection state" switch is set, the offline indicator should never
+@@ -129,7 +137,10 @@ public class OfflineIndicatorControllerV2 {
                      new OfflineDetector(
                              (Boolean offline) -> onConnectionStateChanged(offline),
                              (Boolean isForeground) -> onApplicationStateChanged(isForeground),
@@ -283,22 +281,22 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/offlinepages/in
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedRootUiCoordinator.java b/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedRootUiCoordinator.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedRootUiCoordinator.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedRootUiCoordinator.java
-@@ -1417,7 +1417,10 @@ public class TabbedRootUiCoordinator extends RootUiCoordinator {
-                             mActivity,
-                             mStatusIndicatorCoordinator,
-                             isUrlBarFocusedSupplier,
--                            mCanAnimateBrowserControls);
-+                            mCanAnimateBrowserControls,
-+                            mTabModelSelectorSupplier,
-+                            mLayoutManagerSupplier,
-+                            mSnackbarManagerSupplier);
-         }
- 
+@@ -1239,7 +1239,10 @@ public class TabbedRootUiCoordinator extends RootUiCoordinator {
+                         mActivity,
+                         mStatusIndicatorCoordinator,
+                         isUrlBarFocusedSupplier,
+-                        mCanAnimateBrowserControls);
++                        mCanAnimateBrowserControls,
++                        mTabModelSelectorSupplier,
++                        mLayoutManagerSupplier,
++                        mSnackbarManagerSupplier);
          if (mToolbarManager.getOmniboxStub() != null) {
+             mToolbarManager.getOmniboxStub().addUrlFocusChangeListener(mUrlFocusChangeListener);
+         }
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/TabModelSelectorBase.java b/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/TabModelSelectorBase.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/TabModelSelectorBase.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/TabModelSelectorBase.java
-@@ -198,6 +198,13 @@ public abstract class TabModelSelectorBase
+@@ -195,6 +195,13 @@ public abstract class TabModelSelectorBase
          return null;
      }
  
@@ -310,7 +308,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/TabMod
 +    }
 +
      @Override
-     public TabModel getCurrentModel() {
+     public @NonNull TabModel getCurrentModel() {
          if (mTabModelInternals.size() == 0) return EmptyTabModel.getInstance(false);
 diff --git a/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/cromite/sAskForRestartOnConnectionChange.java b/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/cromite/sAskForRestartOnConnectionChange.java
 new file mode 100644
@@ -352,7 +350,7 @@ new file mode 100644
 diff --git a/chrome/browser/tabmodel/android/java/src/org/chromium/chrome/browser/tabmodel/TabModelSelector.java b/chrome/browser/tabmodel/android/java/src/org/chromium/chrome/browser/tabmodel/TabModelSelector.java
 --- a/chrome/browser/tabmodel/android/java/src/org/chromium/chrome/browser/tabmodel/TabModelSelector.java
 +++ b/chrome/browser/tabmodel/android/java/src/org/chromium/chrome/browser/tabmodel/TabModelSelector.java
-@@ -146,6 +146,8 @@ public interface TabModelSelector {
+@@ -147,6 +147,8 @@ public interface TabModelSelector {
      /** Get total tab count across all tab models */
      int getTotalTabCount();
  
@@ -360,11 +358,11 @@ diff --git a/chrome/browser/tabmodel/android/java/src/org/chromium/chrome/browse
 +
      /**
       * Search all TabModels for a tab with the specified id.
-      *
+      * @return specified tab or null if tab is not found
 diff --git a/chrome/browser/tabmodel/android/java/src/org/chromium/chrome/browser/tabmodel/TabModelUtils.java b/chrome/browser/tabmodel/android/java/src/org/chromium/chrome/browser/tabmodel/TabModelUtils.java
 --- a/chrome/browser/tabmodel/android/java/src/org/chromium/chrome/browser/tabmodel/TabModelUtils.java
 +++ b/chrome/browser/tabmodel/android/java/src/org/chromium/chrome/browser/tabmodel/TabModelUtils.java
-@@ -16,12 +16,16 @@ import org.chromium.build.annotations.Nullable;
+@@ -17,12 +17,16 @@ import org.chromium.base.supplier.SupplierUtils;
  import org.chromium.chrome.browser.tab.Tab;
  import org.chromium.chrome.browser.tab.TabSelectionType;
  import org.chromium.content_public.browser.WebContents;
@@ -402,11 +400,11 @@ diff --git a/chrome/browser/tabmodel/android/java/src/org/chromium/chrome/browse
      /**
       * Find the {@link Tab} index whose URL matches the specified URL.
       *
-diff --git a/chrome/browser/tabwindow/android/java/src/org/chromium/chrome/browser/tabwindow/TabWindowManager.java b/chrome/browser/tabwindow/android/java/src/org/chromium/chrome/browser/tabwindow/TabWindowManager.java
---- a/chrome/browser/tabwindow/android/java/src/org/chromium/chrome/browser/tabwindow/TabWindowManager.java
-+++ b/chrome/browser/tabwindow/android/java/src/org/chromium/chrome/browser/tabwindow/TabWindowManager.java
-@@ -133,6 +133,8 @@ public interface TabWindowManager {
-     /** Returns the total number of incognito tabs across all tab model selectors. */
+diff --git a/chrome/browser/tabmodel/android/java/src/org/chromium/chrome/browser/tabmodel/TabWindowManager.java b/chrome/browser/tabmodel/android/java/src/org/chromium/chrome/browser/tabmodel/TabWindowManager.java
+--- a/chrome/browser/tabmodel/android/java/src/org/chromium/chrome/browser/tabmodel/TabWindowManager.java
++++ b/chrome/browser/tabmodel/android/java/src/org/chromium/chrome/browser/tabmodel/TabWindowManager.java
+@@ -109,6 +109,8 @@ public interface TabWindowManager {
+      */
      int getIncognitoTabCount();
  
 +    void setPagesFrozen(boolean frozen);
@@ -414,17 +412,17 @@ diff --git a/chrome/browser/tabwindow/android/java/src/org/chromium/chrome/brows
      /**
       * @param tab The tab to look for in each model.
       * @return The TabModel containing the given Tab or null if one doesn't exist.
-diff --git a/chrome/browser/tabwindow/internal/android/java/src/org/chromium/chrome/browser/tabwindow/TabWindowManagerImpl.java b/chrome/browser/tabwindow/internal/android/java/src/org/chromium/chrome/browser/tabwindow/TabWindowManagerImpl.java
---- a/chrome/browser/tabwindow/internal/android/java/src/org/chromium/chrome/browser/tabwindow/TabWindowManagerImpl.java
-+++ b/chrome/browser/tabwindow/internal/android/java/src/org/chromium/chrome/browser/tabwindow/TabWindowManagerImpl.java
-@@ -546,6 +546,16 @@ public class TabWindowManagerImpl implements TabWindowManager {
-         return tabGroupModelFilter.getTabsInGroup(tabGroupId);
+diff --git a/chrome/browser/tabmodel/internal/android/java/src/org/chromium/chrome/browser/tabmodel/TabWindowManagerImpl.java b/chrome/browser/tabmodel/internal/android/java/src/org/chromium/chrome/browser/tabmodel/TabWindowManagerImpl.java
+--- a/chrome/browser/tabmodel/internal/android/java/src/org/chromium/chrome/browser/tabmodel/TabWindowManagerImpl.java
++++ b/chrome/browser/tabmodel/internal/android/java/src/org/chromium/chrome/browser/tabmodel/TabWindowManagerImpl.java
+@@ -458,6 +458,16 @@ public class TabWindowManagerImpl implements ActivityStateListener, TabWindowMan
+         return null;
      }
  
 +    @Override
 +    public void setPagesFrozen(boolean frozen) {
-+        for (int i : mWindowIdToSelectors.keySet()) {
-+            TabModelSelector selector = mWindowIdToSelectors.get(i);
++        for (int i = 0; i < mSelectors.size(); i++) {
++            TabModelSelector selector = mSelectors.get(i);
 +            if (selector != null) {
 +                selector.setPagesFrozen(frozen);
 +            }
@@ -432,8 +430,8 @@ diff --git a/chrome/browser/tabwindow/internal/android/java/src/org/chromium/chr
 +    }
 +
      @Override
-     public @Nullable TabModelSelector getTabModelSelectorById(@WindowId int windowId) {
-         return mWindowIdToSelectors.get(windowId);
+     public TabModelSelector getTabModelSelectorById(int index) {
+         return mSelectors.get(index);
 diff --git a/chrome/browser/ui/android/strings/cromite_android_chrome_strings_grd/Ask-for-restart-on-connection-change.grdp b/chrome/browser/ui/android/strings/cromite_android_chrome_strings_grd/Ask-for-restart-on-connection-change.grdp
 new file mode 100644
 --- /dev/null
@@ -454,25 +452,6 @@ new file mode 100644
 +        Not now
 +    </message>
 +</grit-part>
-diff --git a/chrome/browser/ui/messages/android/java/res/layout/floating_snackbar.xml b/chrome/browser/ui/messages/android/java/res/layout/floating_snackbar.xml
---- a/chrome/browser/ui/messages/android/java/res/layout/floating_snackbar.xml
-+++ b/chrome/browser/ui/messages/android/java/res/layout/floating_snackbar.xml
-@@ -50,5 +50,15 @@ found in the LICENSE file.
-       android:paddingEnd="@dimen/snackbar_button_padding"
-       android:paddingStart="@dimen/snackbar_button_padding"
-       style="@style/TextButton" />
-+
-+  <org.chromium.ui.widget.ButtonCompat
-+      android:id="@+id/snackbar_dismiss"
-+      android:layout_width="wrap_content"
-+      android:layout_height="wrap_content"
-+      android:layout_gravity="center_vertical"
-+      android:paddingEnd="24dp"
-+      android:paddingStart="24dp"
-+      android:visibility="gone"
-+      style="@style/TextButton" />
- </LinearLayout>
- 
 diff --git a/chrome/browser/ui/messages/android/java/res/layout/snackbar.xml b/chrome/browser/ui/messages/android/java/res/layout/snackbar.xml
 --- a/chrome/browser/ui/messages/android/java/res/layout/snackbar.xml
 +++ b/chrome/browser/ui/messages/android/java/res/layout/snackbar.xml
@@ -495,16 +474,16 @@ diff --git a/chrome/browser/ui/messages/android/java/res/layout/snackbar.xml b/c
 diff --git a/chrome/browser/ui/messages/android/java/src/org/chromium/chrome/browser/ui/messages/snackbar/Snackbar.java b/chrome/browser/ui/messages/android/java/src/org/chromium/chrome/browser/ui/messages/snackbar/Snackbar.java
 --- a/chrome/browser/ui/messages/android/java/src/org/chromium/chrome/browser/ui/messages/snackbar/Snackbar.java
 +++ b/chrome/browser/ui/messages/android/java/src/org/chromium/chrome/browser/ui/messages/snackbar/Snackbar.java
-@@ -136,6 +136,8 @@ public class Snackbar {
-     private @Nullable String mTemplateText;
-     private @Nullable String mActionText;
-     private @Nullable Object mActionData;
+@@ -133,6 +133,8 @@ public class Snackbar {
+     private String mTemplateText;
+     private String mActionText;
+     private Object mActionData;
 +    private String mDismissActionText;
 +    private Object mDismissActionData;
      private int mBackgroundColor;
      private int mTextApperanceResId;
      private boolean mSingleLine = true;
-@@ -241,6 +243,20 @@ public class Snackbar {
+@@ -235,6 +237,20 @@ public class Snackbar {
          return this;
      }
  
@@ -528,7 +507,7 @@ diff --git a/chrome/browser/ui/messages/android/java/src/org/chromium/chrome/bro
 diff --git a/chrome/browser/ui/messages/android/java/src/org/chromium/chrome/browser/ui/messages/snackbar/SnackbarManager.java b/chrome/browser/ui/messages/android/java/src/org/chromium/chrome/browser/ui/messages/snackbar/SnackbarManager.java
 --- a/chrome/browser/ui/messages/android/java/src/org/chromium/chrome/browser/ui/messages/snackbar/SnackbarManager.java
 +++ b/chrome/browser/ui/messages/android/java/src/org/chromium/chrome/browser/ui/messages/snackbar/SnackbarManager.java
-@@ -326,6 +326,12 @@ public class SnackbarManager
+@@ -318,6 +318,12 @@ public class SnackbarManager
                          new SnackbarView(
                                  mActivity,
                                  this,
@@ -544,7 +523,7 @@ diff --git a/chrome/browser/ui/messages/android/java/src/org/chromium/chrome/bro
 diff --git a/chrome/browser/ui/messages/android/java/src/org/chromium/chrome/browser/ui/messages/snackbar/SnackbarView.java b/chrome/browser/ui/messages/android/java/src/org/chromium/chrome/browser/ui/messages/snackbar/SnackbarView.java
 --- a/chrome/browser/ui/messages/android/java/src/org/chromium/chrome/browser/ui/messages/snackbar/SnackbarView.java
 +++ b/chrome/browser/ui/messages/android/java/src/org/chromium/chrome/browser/ui/messages/snackbar/SnackbarView.java
-@@ -55,6 +55,7 @@ public class SnackbarView implements InsetObserver.WindowInsetObserver {
+@@ -51,6 +51,7 @@ public class SnackbarView implements InsetObserver.WindowInsetObserver {
      protected final ViewGroup mSnackbarView;
      protected final TemplatePreservingTextView mMessageView;
      private final TextView mActionButtonView;
@@ -552,7 +531,7 @@ diff --git a/chrome/browser/ui/messages/android/java/src/org/chromium/chrome/bro
      private final ImageView mProfileImageView;
      private final int mAnimationDuration;
      private final boolean mIsTablet;
-@@ -101,11 +102,12 @@ public class SnackbarView implements InsetObserver.WindowInsetObserver {
+@@ -97,11 +98,12 @@ public class SnackbarView implements InsetObserver.WindowInsetObserver {
      public SnackbarView(
              Activity activity,
              OnClickListener listener,
@@ -566,7 +545,7 @@ diff --git a/chrome/browser/ui/messages/android/java/src/org/chromium/chrome/bro
      }
  
      /**
-@@ -124,6 +126,7 @@ public class SnackbarView implements InsetObserver.WindowInsetObserver {
+@@ -120,6 +122,7 @@ public class SnackbarView implements InsetObserver.WindowInsetObserver {
      public SnackbarView(
              Activity activity,
              OnClickListener listener,
@@ -574,7 +553,7 @@ diff --git a/chrome/browser/ui/messages/android/java/src/org/chromium/chrome/bro
              Snackbar snackbar,
              ViewGroup parentView,
              @Nullable WindowAndroid windowAndroid,
-@@ -154,6 +157,8 @@ public class SnackbarView implements InsetObserver.WindowInsetObserver {
+@@ -147,6 +150,8 @@ public class SnackbarView implements InsetObserver.WindowInsetObserver {
                  (TemplatePreservingTextView) mContainerView.findViewById(R.id.snackbar_message);
          mActionButtonView = (TextView) mContainerView.findViewById(R.id.snackbar_button);
          mActionButtonView.setOnClickListener(listener);
@@ -583,7 +562,7 @@ diff --git a/chrome/browser/ui/messages/android/java/src/org/chromium/chrome/bro
          mProfileImageView = (ImageView) mContainerView.findViewById(R.id.snackbar_profile_image);
          mEdgeToEdgeSupplier = edgeToEdgeSupplier;
          if (SnackbarManager.isFloatingSnackbarEnabled()) {
-@@ -428,6 +433,12 @@ public class SnackbarView implements InsetObserver.WindowInsetObserver {
+@@ -394,6 +399,12 @@ public class SnackbarView implements InsetObserver.WindowInsetObserver {
              mActionButtonView.setVisibility(View.VISIBLE);
              mActionButtonView.setContentDescription(snackbar.getActionText());
              setViewText(mActionButtonView, snackbar.getActionText(), animate);
@@ -599,7 +578,7 @@ diff --git a/chrome/browser/ui/messages/android/java/src/org/chromium/chrome/bro
 diff --git a/content/browser/web_contents/web_contents_android.cc b/content/browser/web_contents/web_contents_android.cc
 --- a/content/browser/web_contents/web_contents_android.cc
 +++ b/content/browser/web_contents/web_contents_android.cc
-@@ -903,6 +903,22 @@ void WebContentsAndroid::SetFocus(JNIEnv* env, jboolean focused) {
+@@ -898,6 +898,22 @@ void WebContentsAndroid::SetFocus(JNIEnv* env, jboolean focused) {
    view->SetFocus(focused);
  }
  
@@ -625,7 +604,7 @@ diff --git a/content/browser/web_contents/web_contents_android.cc b/content/brow
 diff --git a/content/browser/web_contents/web_contents_android.h b/content/browser/web_contents/web_contents_android.h
 --- a/content/browser/web_contents/web_contents_android.h
 +++ b/content/browser/web_contents/web_contents_android.h
-@@ -196,6 +196,7 @@ class CONTENT_EXPORT WebContentsAndroid {
+@@ -194,6 +194,7 @@ class CONTENT_EXPORT WebContentsAndroid {
  
    void OnScaleFactorChanged(JNIEnv* env);
    void SetFocus(JNIEnv* env, jboolean focused);
@@ -636,7 +615,7 @@ diff --git a/content/browser/web_contents/web_contents_android.h b/content/brows
 diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
 --- a/content/browser/web_contents/web_contents_impl.cc
 +++ b/content/browser/web_contents/web_contents_impl.cc
-@@ -4080,8 +4080,10 @@ void WebContentsImpl::Stop() {
+@@ -3748,8 +3748,10 @@ void WebContentsImpl::Stop() {
  void WebContentsImpl::SetPageFrozen(bool frozen) {
    TRACE_EVENT1("content", "WebContentsImpl::SetPageFrozen", "frozen", frozen);
  
@@ -650,7 +629,7 @@ diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser
 diff --git a/content/public/android/java/src/org/chromium/content/browser/webcontents/WebContentsImpl.java b/content/public/android/java/src/org/chromium/content/browser/webcontents/WebContentsImpl.java
 --- a/content/public/android/java/src/org/chromium/content/browser/webcontents/WebContentsImpl.java
 +++ b/content/public/android/java/src/org/chromium/content/browser/webcontents/WebContentsImpl.java
-@@ -1138,6 +1138,12 @@ public class WebContentsImpl
+@@ -1161,6 +1161,12 @@ public class WebContentsImpl
          WebContentsImplJni.get().setFocus(mNativeWebContentsAndroid, hasFocus);
      }
  
@@ -663,7 +642,7 @@ diff --git a/content/public/android/java/src/org/chromium/content/browser/webcon
      @Override
      public void setDisplayCutoutSafeArea(Rect insets) {
          if (mNativeWebContentsAndroid == 0) return;
-@@ -1447,6 +1453,8 @@ public class WebContentsImpl
+@@ -1459,6 +1465,8 @@ public class WebContentsImpl
  
          void setFocus(long nativeWebContentsAndroid, boolean focused);
  
@@ -675,7 +654,7 @@ diff --git a/content/public/android/java/src/org/chromium/content/browser/webcon
 diff --git a/content/public/android/java/src/org/chromium/content_public/browser/WebContents.java b/content/public/android/java/src/org/chromium/content_public/browser/WebContents.java
 --- a/content/public/android/java/src/org/chromium/content_public/browser/WebContents.java
 +++ b/content/public/android/java/src/org/chromium/content_public/browser/WebContents.java
-@@ -288,6 +288,8 @@ public interface WebContents extends Parcelable {
+@@ -289,6 +289,8 @@ public interface WebContents extends Parcelable {
       */
      void setFocus(boolean hasFocus);
  
@@ -687,7 +666,7 @@ diff --git a/content/public/android/java/src/org/chromium/content_public/browser
 diff --git a/content/public/test/android/javatests/src/org/chromium/content_public/browser/test/mock/MockWebContents.java b/content/public/test/android/javatests/src/org/chromium/content_public/browser/test/mock/MockWebContents.java
 --- a/content/public/test/android/javatests/src/org/chromium/content_public/browser/test/mock/MockWebContents.java
 +++ b/content/public/test/android/javatests/src/org/chromium/content_public/browser/test/mock/MockWebContents.java
-@@ -188,6 +188,9 @@ public class MockWebContents implements WebContents, WebContentsObserver.Observa
+@@ -187,6 +187,9 @@ public class MockWebContents implements WebContents, WebContentsObserver.Observa
      @Override
      public void setFocus(boolean hasFocus) {}
  
@@ -732,7 +711,7 @@ new file mode 100644
 diff --git a/third_party/blink/renderer/core/dom/document.cc b/third_party/blink/renderer/core/dom/document.cc
 --- a/third_party/blink/renderer/core/dom/document.cc
 +++ b/third_party/blink/renderer/core/dom/document.cc
-@@ -4614,6 +4614,7 @@ void Document::DispatchUnloadEvents(UnloadEventTimingInfo* unload_timing_info) {
+@@ -4307,6 +4307,7 @@ void Document::DispatchUnloadEvents(UnloadEventTimingInfo* unload_timing_info) {
  }
  
  void Document::DispatchFreezeEvent() {
@@ -743,7 +722,7 @@ diff --git a/third_party/blink/renderer/core/dom/document.cc b/third_party/blink
 diff --git a/third_party/blink/renderer/core/frame/local_frame.cc b/third_party/blink/renderer/core/frame/local_frame.cc
 --- a/third_party/blink/renderer/core/frame/local_frame.cc
 +++ b/third_party/blink/renderer/core/frame/local_frame.cc
-@@ -3273,6 +3273,7 @@ void LocalFrame::DidFreeze() {
+@@ -3231,6 +3231,7 @@ void LocalFrame::DidFreeze() {
    LoaderFreezeMode freeze_mode = GetLoaderFreezeMode();
    GetDocument()->Fetcher()->SetDefersLoading(freeze_mode);
    Loader().SetDefersLoading(freeze_mode);
@@ -751,7 +730,7 @@ diff --git a/third_party/blink/renderer/core/frame/local_frame.cc b/third_party/
  }
  
  void LocalFrame::DidResume() {
-@@ -3287,6 +3288,7 @@ void LocalFrame::DidResume() {
+@@ -3245,6 +3246,7 @@ void LocalFrame::DidResume() {
    GetDocument()->Fetcher()->SetDefersLoading(LoaderFreezeMode::kNone);
    Loader().SetDefersLoading(LoaderFreezeMode::kNone);
  
@@ -762,7 +741,7 @@ diff --git a/third_party/blink/renderer/core/frame/local_frame.cc b/third_party/
 diff --git a/third_party/blink/renderer/platform/scheduler/main_thread/frame_scheduler_impl.cc b/third_party/blink/renderer/platform/scheduler/main_thread/frame_scheduler_impl.cc
 --- a/third_party/blink/renderer/platform/scheduler/main_thread/frame_scheduler_impl.cc
 +++ b/third_party/blink/renderer/platform/scheduler/main_thread/frame_scheduler_impl.cc
-@@ -989,7 +989,9 @@ SchedulingLifecycleState FrameSchedulerImpl::CalculateLifecycleState(
+@@ -986,7 +986,9 @@ SchedulingLifecycleState FrameSchedulerImpl::CalculateLifecycleState(
    if (!parent_page_scheduler_)
      return SchedulingLifecycleState::kNotThrottled;
    if (parent_page_scheduler_->IsFrozen()) {
@@ -775,7 +754,7 @@ diff --git a/third_party/blink/renderer/platform/scheduler/main_thread/frame_sch
 diff --git a/third_party/blink/renderer/platform/scheduler/main_thread/page_scheduler_impl.cc b/third_party/blink/renderer/platform/scheduler/main_thread/page_scheduler_impl.cc
 --- a/third_party/blink/renderer/platform/scheduler/main_thread/page_scheduler_impl.cc
 +++ b/third_party/blink/renderer/platform/scheduler/main_thread/page_scheduler_impl.cc
-@@ -237,10 +237,12 @@ void PageSchedulerImpl::SetPageFrozen(bool frozen) {
+@@ -238,10 +238,12 @@ void PageSchedulerImpl::SetPageFrozen(bool frozen) {
    // it is desirable to reject the page freeze to prevent the scheduler from
    // being put in a bad state. See https://crbug.com/873214 for context of how
    // this can happen on the browser side.
@@ -788,7 +767,7 @@ diff --git a/third_party/blink/renderer/platform/scheduler/main_thread/page_sche
    PolicyUpdater policy_updater;
    SetPageFrozenImpl(frozen, policy_updater);
  }
-@@ -815,7 +817,12 @@ bool PageSchedulerImpl::IsBackgrounded() const {
+@@ -799,7 +801,12 @@ bool PageSchedulerImpl::IsBackgrounded() const {
    // expire immediately when a page is backgrounded, which is undesirable in
    // headless mode. To prevent that, a page is never considerer backgrounded
    // when virtual time is enabled.

build/patches/AudioBuffer-AnalyserNode-fp-mitigations.patch

@@ -15,9 +15,9 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
  .../modules/webaudio/base_audio_context.cc         | 12 ++++++++++++
  .../renderer/modules/webaudio/base_audio_context.h |  2 ++
  .../modules/webaudio/offline_audio_context.cc      |  1 +
- .../renderer/modules/webaudio/realtime_analyser.cc |  9 ++++++++-
+ .../renderer/modules/webaudio/realtime_analyser.cc |  7 +++++++
  .../platform/runtime_enabled_features.json5        |  5 ++---
- 11 files changed, 57 insertions(+), 5 deletions(-)
+ 11 files changed, 56 insertions(+), 4 deletions(-)
  create mode 100644 cromite_flags/chrome/browser/about_flags_cc/AudioBuffer-AnalyserNode-fp-mitigations.inc
  create mode 100644 cromite_flags/third_party/blink/common/features_cc/AudioBuffer-AnalyserNode-fp-mitigations.inc
  create mode 100644 cromite_flags/third_party/blink/common/features_h/AudioBuffer-AnalyserNode-fp-mitigations.inc
@@ -52,7 +52,7 @@ new file mode 100644
 diff --git a/third_party/blink/renderer/modules/webaudio/audio_buffer.cc b/third_party/blink/renderer/modules/webaudio/audio_buffer.cc
 --- a/third_party/blink/renderer/modules/webaudio/audio_buffer.cc
 +++ b/third_party/blink/renderer/modules/webaudio/audio_buffer.cc
-@@ -200,6 +200,20 @@ AudioBuffer::AudioBuffer(AudioBus* bus)
+@@ -202,6 +202,20 @@ AudioBuffer::AudioBuffer(AudioBus* bus)
    }
  }
  
@@ -76,7 +76,7 @@ diff --git a/third_party/blink/renderer/modules/webaudio/audio_buffer.cc b/third
 diff --git a/third_party/blink/renderer/modules/webaudio/audio_buffer.h b/third_party/blink/renderer/modules/webaudio/audio_buffer.h
 --- a/third_party/blink/renderer/modules/webaudio/audio_buffer.h
 +++ b/third_party/blink/renderer/modules/webaudio/audio_buffer.h
-@@ -116,6 +116,8 @@ class MODULES_EXPORT AudioBuffer final : public ScriptWrappable {
+@@ -115,6 +115,8 @@ class MODULES_EXPORT AudioBuffer final : public ScriptWrappable {
  
    std::unique_ptr<SharedAudioBuffer> CreateSharedAudioBuffer();
  
@@ -88,7 +88,7 @@ diff --git a/third_party/blink/renderer/modules/webaudio/audio_buffer.h b/third_
 diff --git a/third_party/blink/renderer/modules/webaudio/audio_context.cc b/third_party/blink/renderer/modules/webaudio/audio_context.cc
 --- a/third_party/blink/renderer/modules/webaudio/audio_context.cc
 +++ b/third_party/blink/renderer/modules/webaudio/audio_context.cc
-@@ -16,6 +16,7 @@
+@@ -15,6 +15,7 @@
  #include "third_party/blink/public/common/features.h"
  #include "third_party/blink/public/common/mediastream/media_devices.h"
  #include "third_party/blink/public/platform/browser_interface_broker_proxy.h"
@@ -96,7 +96,7 @@ diff --git a/third_party/blink/renderer/modules/webaudio/audio_context.cc b/thir
  #include "third_party/blink/public/platform/modules/webrtc/webrtc_logging.h"
  #include "third_party/blink/public/platform/web_audio_latency_hint.h"
  #include "third_party/blink/renderer/bindings/core/v8/script_promise_resolver.h"
-@@ -678,7 +679,9 @@ double AudioContext::baseLatency() const {
+@@ -639,7 +640,9 @@ double AudioContext::baseLatency() const {
    DCHECK_CALLED_ON_VALID_SEQUENCE(main_thread_sequence_checker_);
    DCHECK(destination());
  
@@ -118,7 +118,7 @@ diff --git a/third_party/blink/renderer/modules/webaudio/base_audio_context.cc b
  #include "third_party/blink/public/mojom/devtools/console_message.mojom-blink.h"
  #include "third_party/blink/public/mojom/frame/lifecycle.mojom-shared.h"
  #include "third_party/blink/public/platform/platform.h"
-@@ -710,6 +711,17 @@ LocalDOMWindow* BaseAudioContext::GetWindow() const {
+@@ -709,6 +710,17 @@ LocalDOMWindow* BaseAudioContext::GetWindow() const {
    return To<LocalDOMWindow>(GetExecutionContext());
  }
  
@@ -146,12 +146,12 @@ diff --git a/third_party/blink/renderer/modules/webaudio/base_audio_context.h b/
 +  static float ShuffleAudioData(float data, unsigned index);
 +
   protected:
-   enum class ContextType { kRealtimeContext, kOfflineContext };
+   enum ContextType { kRealtimeContext, kOfflineContext };
  
 diff --git a/third_party/blink/renderer/modules/webaudio/offline_audio_context.cc b/third_party/blink/renderer/modules/webaudio/offline_audio_context.cc
 --- a/third_party/blink/renderer/modules/webaudio/offline_audio_context.cc
 +++ b/third_party/blink/renderer/modules/webaudio/offline_audio_context.cc
-@@ -374,6 +374,7 @@ void OfflineAudioContext::FireCompletionEvent() {
+@@ -372,6 +372,7 @@ void OfflineAudioContext::FireCompletionEvent() {
      if (!rendered_buffer) {
        return;
      }
@@ -162,25 +162,25 @@ diff --git a/third_party/blink/renderer/modules/webaudio/offline_audio_context.c
 diff --git a/third_party/blink/renderer/modules/webaudio/realtime_analyser.cc b/third_party/blink/renderer/modules/webaudio/realtime_analyser.cc
 --- a/third_party/blink/renderer/modules/webaudio/realtime_analyser.cc
 +++ b/third_party/blink/renderer/modules/webaudio/realtime_analyser.cc
-@@ -32,6 +32,7 @@
+@@ -36,6 +36,7 @@
+ #include <bit>
  #include <complex>
  
- #include "base/compiler_specific.h"
 +#include "third_party/blink/renderer/modules/webaudio/base_audio_context.h"
  #include "third_party/blink/renderer/platform/audio/audio_bus.h"
  #include "third_party/blink/renderer/platform/audio/audio_utilities.h"
  #include "third_party/blink/renderer/platform/audio/vector_math.h"
-@@ -156,6 +157,7 @@ void RealtimeAnalyser::GetFloatTimeDomainData(
+@@ -160,6 +161,7 @@ void RealtimeAnalyser::GetFloatTimeDomainData(
            input_buffer[(i + write_index - fft_size + kInputBufferSize) %
-                        kInputBufferSize]);
+                        kInputBufferSize];
  
 +      value = BaseAudioContext::ShuffleAudioData(value, i);
-       UNSAFE_TODO(destination[i]) = value;
+       destination[i] = value;
      }
    }
-@@ -183,6 +185,8 @@ void RealtimeAnalyser::GetByteTimeDomainData(DOMUint8Array* destination_array) {
+@@ -187,6 +189,8 @@ void RealtimeAnalyser::GetByteTimeDomainData(DOMUint8Array* destination_array) {
            input_buffer[(i + write_index - fft_size + kInputBufferSize) %
-                        kInputBufferSize]);
+                        kInputBufferSize];
  
 +      value = BaseAudioContext::ShuffleAudioData(value, i);
 +
@@ -194,22 +194,20 @@ diff --git a/third_party/blink/renderer/modules/webaudio/realtime_analyser.cc b/
 +      scaled_value = BaseAudioContext::ShuffleAudioData(scaled_value, i);
 +
        // Clip to valid range.
-       UNSAFE_TODO(destination[i]) =
+       destination[i] =
            static_cast<unsigned char>(ClampTo(scaled_value, 0, UCHAR_MAX));
-@@ -324,7 +330,8 @@ void RealtimeAnalyser::ConvertFloatToDb(DOMFloat32Array* destination_array) {
-     for (unsigned i = 0; i < len; ++i) {
-       float linear_value = UNSAFE_TODO(source[i]);
+@@ -325,6 +331,7 @@ void RealtimeAnalyser::ConvertFloatToDb(DOMFloat32Array* destination_array) {
+       float linear_value = source[i];
        double db_mag = audio_utilities::LinearToDecibels(linear_value);
--      UNSAFE_TODO(destination[i]) = static_cast<float>(db_mag);
-+      auto v = static_cast<float>(db_mag);
-+      UNSAFE_TODO(destination[i]) = BaseAudioContext::ShuffleAudioData(v, i);
+       destination[i] = static_cast<float>(db_mag);
++      destination[i] = BaseAudioContext::ShuffleAudioData(destination[i], i);
      }
    }
  }
 diff --git a/third_party/blink/renderer/platform/runtime_enabled_features.json5 b/third_party/blink/renderer/platform/runtime_enabled_features.json5
 --- a/third_party/blink/renderer/platform/runtime_enabled_features.json5
 +++ b/third_party/blink/renderer/platform/runtime_enabled_features.json5
-@@ -575,9 +575,8 @@
+@@ -485,9 +485,8 @@
      {
        // AudioContext.playoutStats interface.
        // https://chromestatus.com/feature/5172818344148992

build/patches/Block-gateway-attacks-via-websockets.patch

@@ -7,23 +7,49 @@ This approach is not comprehensive, see also:
 
 License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 ---
+ .../execution_context/execution_context.cc    | 15 +++++++++
  .../execution_context/execution_context.h     |  1 +
  .../renderer/core/loader/base_fetch_context.h |  1 +
  .../core/loader/frame_fetch_context.cc        | 20 ++++++++++++
  .../core/loader/frame_fetch_context.h         |  1 +
  .../core/loader/worker_fetch_context.cc       | 21 +++++++++++++
  .../core/loader/worker_fetch_context.h        |  1 +
- .../core/workers/installed_scripts_manager.cc |  2 +-
+ .../core/workers/installed_scripts_manager.cc |  4 +--
  .../background_fetch_manager.cc               | 31 +++++++++++++++++++
  .../websockets/websocket_channel_impl.cc      |  5 +++
  .../modules/websockets/websocket_common.cc    | 30 ++++++++++++++++++
  .../modules/websockets/websocket_common.h     |  4 +++
- 11 files changed, 116 insertions(+), 1 deletion(-)
+ 12 files changed, 132 insertions(+), 2 deletions(-)
 
+diff --git a/third_party/blink/renderer/core/execution_context/execution_context.cc b/third_party/blink/renderer/core/execution_context/execution_context.cc
+--- a/third_party/blink/renderer/core/execution_context/execution_context.cc
++++ b/third_party/blink/renderer/core/execution_context/execution_context.cc
+@@ -707,6 +707,21 @@ void ExecutionContext::WriteIntoTrace(
+   proto->set_world_type(GetWorldType(*this));
+ }
+ 
++String ExecutionContext::addressSpaceForBindings() const {
++  switch (AddressSpace()) {
++    case network::mojom::IPAddressSpace::kPublic:
++    case network::mojom::IPAddressSpace::kUnknown:
++      return "public";
++
++    case network::mojom::IPAddressSpace::kPrivate:
++      return "private";
++
++    case network::mojom::IPAddressSpace::kLocal:
++      return "local";
++  }
++  NOTREACHED();
++}
++
+ bool ExecutionContext::CrossOriginIsolatedCapabilityOrDisabledWebSecurity()
+     const {
+   return Agent::IsWebSecurityDisabled() || CrossOriginIsolatedCapability();
 diff --git a/third_party/blink/renderer/core/execution_context/execution_context.h b/third_party/blink/renderer/core/execution_context/execution_context.h
 --- a/third_party/blink/renderer/core/execution_context/execution_context.h
 +++ b/third_party/blink/renderer/core/execution_context/execution_context.h
-@@ -395,6 +395,7 @@ class CORE_EXPORT ExecutionContext : public Supplementable<ExecutionContext>,
+@@ -396,6 +396,7 @@ class CORE_EXPORT ExecutionContext : public Supplementable<ExecutionContext>,
    void SetAddressSpace(network::mojom::blink::IPAddressSpace ip_address_space);
  
    HeapObserverList<ContextLifecycleObserver>& ContextLifecycleObserverSet();
@@ -34,7 +60,7 @@ diff --git a/third_party/blink/renderer/core/execution_context/execution_context
 diff --git a/third_party/blink/renderer/core/loader/base_fetch_context.h b/third_party/blink/renderer/core/loader/base_fetch_context.h
 --- a/third_party/blink/renderer/core/loader/base_fetch_context.h
 +++ b/third_party/blink/renderer/core/loader/base_fetch_context.h
-@@ -86,6 +86,7 @@ class CORE_EXPORT BaseFetchContext : public FetchContext {
+@@ -84,6 +84,7 @@ class CORE_EXPORT BaseFetchContext : public FetchContext {
  
    virtual SubresourceFilter* GetSubresourceFilter() const = 0;
    virtual bool ShouldBlockWebSocketByMixedContentCheck(const KURL&) const = 0;
@@ -45,7 +71,7 @@ diff --git a/third_party/blink/renderer/core/loader/base_fetch_context.h b/third
 diff --git a/third_party/blink/renderer/core/loader/frame_fetch_context.cc b/third_party/blink/renderer/core/loader/frame_fetch_context.cc
 --- a/third_party/blink/renderer/core/loader/frame_fetch_context.cc
 +++ b/third_party/blink/renderer/core/loader/frame_fetch_context.cc
-@@ -1057,6 +1057,26 @@ bool FrameFetchContext::ShouldBlockRequestByInspector(const KURL& url) const {
+@@ -996,6 +996,26 @@ bool FrameFetchContext::ShouldBlockRequestByInspector(const KURL& url) const {
    return should_block_request;
  }
  
@@ -58,7 +84,7 @@ diff --git a/third_party/blink/renderer/core/loader/frame_fetch_context.cc b/thi
 +  network::mojom::IPAddressSpace target_space =
 +      network::mojom::IPAddressSpace::kPublic;
 +  if (network_utils::IsReservedIPAddress(request_url.Host()))
-+    target_space = network::mojom::IPAddressSpace::kLocal;
++    target_space = network::mojom::IPAddressSpace::kPrivate;
 +  if (SecurityOrigin::Create(request_url)->IsLocalhost())
 +    target_space = network::mojom::IPAddressSpace::kLocal;
 +
@@ -75,7 +101,7 @@ diff --git a/third_party/blink/renderer/core/loader/frame_fetch_context.cc b/thi
 diff --git a/third_party/blink/renderer/core/loader/frame_fetch_context.h b/third_party/blink/renderer/core/loader/frame_fetch_context.h
 --- a/third_party/blink/renderer/core/loader/frame_fetch_context.h
 +++ b/third_party/blink/renderer/core/loader/frame_fetch_context.h
-@@ -187,6 +187,7 @@ class CORE_EXPORT FrameFetchContext final : public BaseFetchContext,
+@@ -182,6 +182,7 @@ class CORE_EXPORT FrameFetchContext final : public BaseFetchContext,
    bool ShouldBlockWebSocketByMixedContentCheck(const KURL&) const override;
    std::unique_ptr<WebSocketHandshakeThrottle> CreateWebSocketHandshakeThrottle()
        override;
@@ -107,7 +133,7 @@ diff --git a/third_party/blink/renderer/core/loader/worker_fetch_context.cc b/th
 +  network::mojom::IPAddressSpace target_space =
 +      network::mojom::IPAddressSpace::kPublic;
 +  if (network_utils::IsReservedIPAddress(request_url.Host()))
-+    target_space = network::mojom::IPAddressSpace::kLocal;
++    target_space = network::mojom::IPAddressSpace::kPrivate;
 +  if (SecurityOrigin::Create(request_url)->IsLocalhost())
 +    target_space = network::mojom::IPAddressSpace::kLocal;
 +
@@ -135,9 +161,12 @@ diff --git a/third_party/blink/renderer/core/loader/worker_fetch_context.h b/thi
 diff --git a/third_party/blink/renderer/core/workers/installed_scripts_manager.cc b/third_party/blink/renderer/core/workers/installed_scripts_manager.cc
 --- a/third_party/blink/renderer/core/workers/installed_scripts_manager.cc
 +++ b/third_party/blink/renderer/core/workers/installed_scripts_manager.cc
-@@ -35,7 +35,7 @@ InstalledScriptsManager::ScriptData::ScriptData(
+@@ -33,9 +33,9 @@ InstalledScriptsManager::ScriptData::ScriptData(
+   // place so that this is shareable out of worker code.
+   response_address_space_ = network::mojom::IPAddressSpace::kPublic;
    if (network_utils::IsReservedIPAddress(script_url_.Host()))
-     response_address_space_ = network::mojom::IPAddressSpace::kLocal;
+-    response_address_space_ = network::mojom::IPAddressSpace::kLocal;
++    response_address_space_ = network::mojom::IPAddressSpace::kPrivate;
    if (SecurityOrigin::Create(script_url_)->IsLocalhost())
 -    response_address_space_ = network::mojom::IPAddressSpace::kLoopback;
 +    response_address_space_ = network::mojom::IPAddressSpace::kLocal;
@@ -147,7 +176,7 @@ diff --git a/third_party/blink/renderer/core/workers/installed_scripts_manager.c
 diff --git a/third_party/blink/renderer/modules/background_fetch/background_fetch_manager.cc b/third_party/blink/renderer/modules/background_fetch/background_fetch_manager.cc
 --- a/third_party/blink/renderer/modules/background_fetch/background_fetch_manager.cc
 +++ b/third_party/blink/renderer/modules/background_fetch/background_fetch_manager.cc
-@@ -104,6 +104,30 @@ bool ShouldBlockDanglingMarkup(const KURL& request_url) {
+@@ -102,6 +102,30 @@ bool ShouldBlockDanglingMarkup(const KURL& request_url) {
           request_url.ProtocolIsInHTTPFamily();
  }
  
@@ -164,7 +193,7 @@ diff --git a/third_party/blink/renderer/modules/background_fetch/background_fetc
 +    network::mojom::IPAddressSpace target_space =
 +        network::mojom::IPAddressSpace::kPublic;
 +    if (network_utils::IsReservedIPAddress(request_url.Host()))
-+      target_space = network::mojom::IPAddressSpace::kLocal;
++      target_space = network::mojom::IPAddressSpace::kPrivate;
 +    if (SecurityOrigin::Create(request_url)->IsLocalhost())
 +      target_space = network::mojom::IPAddressSpace::kLocal;
 +
@@ -178,7 +207,7 @@ diff --git a/third_party/blink/renderer/modules/background_fetch/background_fetc
  scoped_refptr<BlobDataHandle> ExtractBlobHandle(
      Request* request,
      ExceptionState& exception_state) {
-@@ -191,6 +215,13 @@ ScriptPromise<BackgroundFetchRegistration> BackgroundFetchManager::fetch(
+@@ -189,6 +213,13 @@ ScriptPromise<BackgroundFetchRegistration> BackgroundFetchManager::fetch(
                                   exception_state);
      }
  
@@ -195,7 +224,7 @@ diff --git a/third_party/blink/renderer/modules/background_fetch/background_fetc
 diff --git a/third_party/blink/renderer/modules/websockets/websocket_channel_impl.cc b/third_party/blink/renderer/modules/websockets/websocket_channel_impl.cc
 --- a/third_party/blink/renderer/modules/websockets/websocket_channel_impl.cc
 +++ b/third_party/blink/renderer/modules/websockets/websocket_channel_impl.cc
-@@ -285,6 +285,11 @@ bool WebSocketChannelImpl::Connect(const KURL& url, const String& protocol) {
+@@ -288,6 +288,11 @@ bool WebSocketChannelImpl::Connect(const KURL& url, const String& protocol) {
      return false;
    }
  
@@ -210,7 +239,7 @@ diff --git a/third_party/blink/renderer/modules/websockets/websocket_channel_imp
 diff --git a/third_party/blink/renderer/modules/websockets/websocket_common.cc b/third_party/blink/renderer/modules/websockets/websocket_common.cc
 --- a/third_party/blink/renderer/modules/websockets/websocket_common.cc
 +++ b/third_party/blink/renderer/modules/websockets/websocket_common.cc
-@@ -139,9 +139,39 @@ WebSocketCommon::ConnectResult WebSocketCommon::Connect(
+@@ -135,9 +135,39 @@ WebSocketCommon::ConnectResult WebSocketCommon::Connect(
      return ConnectResult::kException;
    }
  
@@ -236,7 +265,7 @@ diff --git a/third_party/blink/renderer/modules/websockets/websocket_common.cc b
 +  network::mojom::IPAddressSpace target_space =
 +      network::mojom::IPAddressSpace::kPublic;
 +  if (network_utils::IsReservedIPAddress(request_url.Host()))
-+    target_space = network::mojom::IPAddressSpace::kLocal;
++    target_space = network::mojom::IPAddressSpace::kPrivate;
 +  if (SecurityOrigin::Create(request_url)->IsLocalhost())
 +    target_space = network::mojom::IPAddressSpace::kLocal;
 +

build/patches/Block-leakage-of-urls-in-sandbox-iframes.patch

@@ -25,7 +25,7 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 diff --git a/content/browser/renderer_host/render_frame_host_impl.cc b/content/browser/renderer_host/render_frame_host_impl.cc
 --- a/content/browser/renderer_host/render_frame_host_impl.cc
 +++ b/content/browser/renderer_host/render_frame_host_impl.cc
-@@ -5133,7 +5133,17 @@ void RenderFrameHostImpl::SetLastCommittedOrigin(
+@@ -4967,7 +4967,17 @@ void RenderFrameHostImpl::SetLastCommittedOrigin(
  }
  
  void RenderFrameHostImpl::SetInheritedBaseUrl(const GURL& inherited_base_url) {
@@ -82,7 +82,7 @@ diff --git a/third_party/blink/renderer/core/frame/location.cc b/third_party/bli
  #include "third_party/blink/renderer/bindings/core/v8/binding_security.h"
  #include "third_party/blink/renderer/bindings/core/v8/v8_binding_for_core.h"
  #include "third_party/blink/renderer/core/dom/document.h"
-@@ -126,8 +127,20 @@ DOMStringList* Location::ancestorOrigins() const {
+@@ -125,8 +126,20 @@ DOMStringList* Location::ancestorOrigins() const {
    auto* origins = MakeGarbageCollected<DOMStringList>();
    if (!IsAttached())
      return origins;
@@ -106,7 +106,7 @@ diff --git a/third_party/blink/renderer/core/frame/location.cc b/third_party/bli
 diff --git a/third_party/blink/renderer/core/loader/document_loader.cc b/third_party/blink/renderer/core/loader/document_loader.cc
 --- a/third_party/blink/renderer/core/loader/document_loader.cc
 +++ b/third_party/blink/renderer/core/loader/document_loader.cc
-@@ -833,6 +833,11 @@ WebString DocumentLoader::HttpMethod() const {
+@@ -827,6 +827,11 @@ WebString DocumentLoader::HttpMethod() const {
  }
  
  const AtomicString& DocumentLoader::GetReferrer() const {
@@ -118,7 +118,7 @@ diff --git a/third_party/blink/renderer/core/loader/document_loader.cc b/third_p
    return referrer_;
  }
  
-@@ -2898,6 +2903,13 @@ void DocumentLoader::CommitNavigation() {
+@@ -2930,6 +2935,13 @@ void DocumentLoader::CommitNavigation() {
          response_.HttpHeaderField(http_names::kDocumentPolicyReportOnly));
    }
  
@@ -135,7 +135,7 @@ diff --git a/third_party/blink/renderer/core/loader/document_loader.cc b/third_p
 diff --git a/third_party/blink/renderer/core/loader/document_loader.h b/third_party/blink/renderer/core/loader/document_loader.h
 --- a/third_party/blink/renderer/core/loader/document_loader.h
 +++ b/third_party/blink/renderer/core/loader/document_loader.h
-@@ -771,7 +771,7 @@ class CORE_EXPORT DocumentLoader : public GarbageCollected<DocumentLoader>,
+@@ -780,7 +780,7 @@ class CORE_EXPORT DocumentLoader : public GarbageCollected<DocumentLoader>,
    // |archive_|, but won't have |loading_main_document_from_mhtml_archive_| set.
    bool loading_main_document_from_mhtml_archive_ = false;
    const bool loading_srcdoc_ = false;

build/patches/Block-qjz9zk-or-trk-requests.patch

@@ -27,7 +27,7 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 diff --git a/chrome/browser/autocomplete/chrome_autocomplete_scheme_classifier.cc b/chrome/browser/autocomplete/chrome_autocomplete_scheme_classifier.cc
 --- a/chrome/browser/autocomplete/chrome_autocomplete_scheme_classifier.cc
 +++ b/chrome/browser/autocomplete/chrome_autocomplete_scheme_classifier.cc
-@@ -72,6 +72,7 @@ ChromeAutocompleteSchemeClassifier::GetInputTypeForScheme(
+@@ -56,6 +56,7 @@ ChromeAutocompleteSchemeClassifier::GetInputTypeForScheme(
    if (base::IsStringASCII(scheme) &&
        (ProfileIOData::IsHandledProtocol(scheme) ||
         base::EqualsCaseInsensitiveASCII(scheme, content::kViewSourceScheme) ||
@@ -49,7 +49,7 @@ diff --git a/chrome/browser/history/history_utils.cc b/chrome/browser/history/hi
 diff --git a/chrome/browser/ui/singleton_tabs.cc b/chrome/browser/ui/singleton_tabs.cc
 --- a/chrome/browser/ui/singleton_tabs.cc
 +++ b/chrome/browser/ui/singleton_tabs.cc
-@@ -136,6 +136,11 @@ int GetIndexOfExistingTab(Browser* browser, const NavigateParams& params) {
+@@ -128,6 +128,11 @@ int GetIndexOfExistingTab(Browser* browser, const NavigateParams& params) {
        continue;
      }
  
@@ -64,7 +64,7 @@ diff --git a/chrome/browser/ui/singleton_tabs.cc b/chrome/browser/ui/singleton_t
 diff --git a/components/omnibox/browser/autocomplete_input.cc b/components/omnibox/browser/autocomplete_input.cc
 --- a/components/omnibox/browser/autocomplete_input.cc
 +++ b/components/omnibox/browser/autocomplete_input.cc
-@@ -92,10 +92,15 @@ void OffsetComponentsExcludingScheme(url::Parsed* parts, int offset) {
+@@ -96,10 +96,15 @@ void OffsetComponentsExcludingScheme(url::Parsed* parts, int offset) {
  bool HasScheme(const std::u16string& input, const char* scheme) {
    std::string utf8_input(base::UTF16ToUTF8(input));
    url::Component view_source_scheme;
@@ -80,7 +80,7 @@ diff --git a/components/omnibox/browser/autocomplete_input.cc b/components/omnib
    return url::FindAndCompareScheme(utf8_input, scheme, nullptr);
  }
  
-@@ -578,7 +583,8 @@ void AutocompleteInput::ParseForEmphasizeComponents(
+@@ -582,7 +587,8 @@ void AutocompleteInput::ParseForEmphasizeComponents(
    // For the view-source and blob schemes, we should emphasize the host of the
    // URL qualified by the view-source or blob prefix.
    if ((base::EqualsCaseInsensitiveASCII(scheme_str, kViewSourceScheme) ||
@@ -93,7 +93,7 @@ diff --git a/components/omnibox/browser/autocomplete_input.cc b/components/omnib
 diff --git a/components/url_formatter/url_fixer.cc b/components/url_formatter/url_fixer.cc
 --- a/components/url_formatter/url_fixer.cc
 +++ b/components/url_formatter/url_fixer.cc
-@@ -602,6 +602,10 @@ GURL FixupURLInternal(const std::string& text,
+@@ -607,6 +607,10 @@ GURL FixupURLInternal(const std::string& text,
      }
    }
  
@@ -107,18 +107,18 @@ diff --git a/components/url_formatter/url_fixer.cc b/components/url_formatter/ur
 diff --git a/content/browser/child_process_security_policy_impl.cc b/content/browser/child_process_security_policy_impl.cc
 --- a/content/browser/child_process_security_policy_impl.cc
 +++ b/content/browser/child_process_security_policy_impl.cc
-@@ -970,6 +970,7 @@ ChildProcessSecurityPolicyImpl::ChildProcessSecurityPolicyImpl()
+@@ -951,6 +951,7 @@ ChildProcessSecurityPolicyImpl::ChildProcessSecurityPolicyImpl()
    RegisterPseudoScheme(url::kJavaScriptScheme);
    RegisterPseudoScheme(kViewSourceScheme);
    RegisterPseudoScheme(kGoogleChromeScheme);
 +  RegisterWebSafeScheme(url::kTraceScheme);
  }
  
- ChildProcessSecurityPolicyImpl::~ChildProcessSecurityPolicyImpl() = default;
+ ChildProcessSecurityPolicyImpl::~ChildProcessSecurityPolicyImpl() {
 diff --git a/net/BUILD.gn b/net/BUILD.gn
 --- a/net/BUILD.gn
 +++ b/net/BUILD.gn
-@@ -1127,6 +1127,8 @@ component("net") {
+@@ -1085,6 +1085,8 @@ component("net") {
      "url_request/url_request_http_job.cc",
      "url_request/url_request_http_job.h",
      "url_request/url_request_interceptor.cc",
@@ -203,7 +203,7 @@ diff --git a/net/url_request/url_request.cc b/net/url_request/url_request.cc
  #include "base/synchronization/lock.h"
  #include "base/task/single_thread_task_runner.h"
  #include "base/types/optional_util.h"
-@@ -55,6 +56,7 @@
+@@ -53,6 +54,7 @@
  #include "net/url_request/url_request_redirect_job.h"
  #include "url/gurl.h"
  #include "url/origin.h"
@@ -211,7 +211,7 @@ diff --git a/net/url_request/url_request.cc b/net/url_request/url_request.cc
  
  namespace net {
  
-@@ -653,6 +655,12 @@ URLRequest::URLRequest(base::PassKey<URLRequestContext> pass_key,
+@@ -635,6 +637,12 @@ URLRequest::URLRequest(base::PassKey<URLRequestContext> pass_key,
    // Sanity check out environment.
    DCHECK(base::SingleThreadTaskRunner::HasCurrentDefault());
  
@@ -227,7 +227,7 @@ diff --git a/net/url_request/url_request.cc b/net/url_request/url_request.cc
 diff --git a/net/url_request/url_request_context_builder.cc b/net/url_request/url_request_context_builder.cc
 --- a/net/url_request/url_request_context_builder.cc
 +++ b/net/url_request/url_request_context_builder.cc
-@@ -55,6 +55,7 @@
+@@ -49,6 +49,7 @@
  #include "net/socket/network_binding_client_socket_factory.h"
  #include "net/ssl/ssl_config_service_defaults.h"
  #include "net/url_request/static_http_user_agent_settings.h"
@@ -235,7 +235,7 @@ diff --git a/net/url_request/url_request_context_builder.cc b/net/url_request/ur
  #include "net/url_request/url_request_context.h"
  #include "net/url_request/url_request_job_factory.h"
  #include "url/url_constants.h"
-@@ -619,6 +620,8 @@ std::unique_ptr<URLRequestContext> URLRequestContextBuilder::Build() {
+@@ -601,6 +602,8 @@ std::unique_ptr<URLRequestContext> URLRequestContextBuilder::Build() {
      job_factory->SetProtocolHandler(scheme_handler.first,
                                      std::move(scheme_handler.second));
    }
@@ -258,7 +258,7 @@ diff --git a/url/url_constants.h b/url/url_constants.h
 diff --git a/url/url_util.cc b/url/url_util.cc
 --- a/url/url_util.cc
 +++ b/url/url_util.cc
-@@ -54,6 +54,7 @@ struct SchemeRegistry {
+@@ -53,6 +53,7 @@ struct SchemeRegistry {
    std::vector<SchemeWithType> standard_schemes = {
        {kHttpsScheme, SCHEME_WITH_HOST_PORT_AND_USER_INFORMATION},
        {kHttpScheme, SCHEME_WITH_HOST_PORT_AND_USER_INFORMATION},
@@ -266,7 +266,7 @@ diff --git a/url/url_util.cc b/url/url_util.cc
        // Yes, file URLs can have a hostname, so file URLs should be handled as
        // "standard". File URLs never have a port as specified by the SchemeType
        // field.  Unlike other SCHEME_WITH_HOST schemes, the 'host' in a file
-@@ -99,6 +100,7 @@ struct SchemeRegistry {
+@@ -98,6 +99,7 @@ struct SchemeRegistry {
        kAboutScheme,
        kJavaScriptScheme,
        kDataScheme,

build/patches/Bookmarks-select-all-menu-entry.patch

@@ -28,48 +28,54 @@ diff --git a/chrome/android/java/res/menu/bookmark_toolbar_menu_improved.xml b/c
          <item
              android:id="@+id/import_menu_id"
              android:icon="@drawable/ic_folder_blue_24dp"
-diff --git a/chrome/browser/bookmarks/android/java/src/org/chromium/chrome/browser/bookmarks/BookmarkToolbar.java b/chrome/browser/bookmarks/android/java/src/org/chromium/chrome/browser/bookmarks/BookmarkToolbar.java
---- a/chrome/browser/bookmarks/android/java/src/org/chromium/chrome/browser/bookmarks/BookmarkToolbar.java
-+++ b/chrome/browser/bookmarks/android/java/src/org/chromium/chrome/browser/bookmarks/BookmarkToolbar.java
-@@ -28,6 +28,7 @@ import org.chromium.components.browser_ui.widget.selectable_list.SelectionDelega
- import java.util.ArrayList;
+diff --git a/chrome/android/java/src/org/chromium/chrome/browser/bookmarks/BookmarkToolbar.java b/chrome/android/java/src/org/chromium/chrome/browser/bookmarks/BookmarkToolbar.java
+--- a/chrome/android/java/src/org/chromium/chrome/browser/bookmarks/BookmarkToolbar.java
++++ b/chrome/android/java/src/org/chromium/chrome/browser/bookmarks/BookmarkToolbar.java
+@@ -26,6 +26,8 @@ import java.util.ArrayList;
  import java.util.List;
  import java.util.function.Function;
-+import java.util.HashSet;
  
++import java.util.HashSet;
++
  /**
   * Main toolbar of bookmark UI. It is responsible for displaying title and buttons associated with
-@@ -190,6 +191,11 @@ public class BookmarkToolbar extends SelectableListToolbar<BookmarkId>
+  * the current context.
+@@ -186,12 +188,16 @@ public class BookmarkToolbar extends SelectableListToolbar<BookmarkId>
      void setCurrentFolder(BookmarkId folder) {
          mCurrentFolder = mBookmarkModel.getBookmarkById(folder);
          enableImportExportMenu();
 +        enableSelectAllMenu();
-+    }
+     }
+ 
+     void enableImportExportMenu() {
+         getMenu().findItem(R.id.import_menu_id).setVisible(true);
+         getMenu().findItem(R.id.export_menu_id).setVisible(true);
+     }
 +
 +    void enableSelectAllMenu() {
 +        getMenu().findItem(R.id.select_all_menu_id).setVisible(true);
      }
  
-     void enableImportExportMenu() {
-@@ -226,6 +232,17 @@ public class BookmarkToolbar extends SelectableListToolbar<BookmarkId>
+     void setNavigateBackRunnable(Runnable navigateBackRunnable) {
+@@ -218,6 +224,17 @@ public class BookmarkToolbar extends SelectableListToolbar<BookmarkId>
              mExportBookmarkRunnable.run();
              return true;
          }
 +        if (menuItem.getItemId() == R.id.select_all_menu_id) {
 +            if (mBookmarkModel.isBookmarkModelLoaded()) {
-+                List<BookmarkId> childs = mBookmarkModel.getChildIds(mCurrentFolder.getId());
-+                HashSet<BookmarkId> ids = new HashSet<>(childs.size());
-+                for (BookmarkId item : childs) {
-+                    ids.add(item);
++                List<BookmarkItem> items = mBookmarkModel.getBookmarksForFolder(mCurrentFolder.getId());
++                HashSet<BookmarkId> ids = new HashSet<>(items.size());
++                for (BookmarkItem item : items) {
++                    ids.add(item.getId());
 +                }
 +                mSelectionDelegate.setSelectedItems(ids);
 +            }
 +            return true;
 +        }
-         return assumeNonNull(mMenuIdClickedFunction).apply(menuItem.getItemId());
+         return mMenuIdClickedFunction.apply(menuItem.getItemId());
      }
  
-@@ -248,6 +265,7 @@ public class BookmarkToolbar extends SelectableListToolbar<BookmarkId>
+@@ -235,6 +252,7 @@ public class BookmarkToolbar extends SelectableListToolbar<BookmarkId>
  
          getMenu().findItem(R.id.import_menu_id).setVisible(mCurrentFolder != null);
          getMenu().findItem(R.id.export_menu_id).setVisible(mCurrentFolder != null);
@@ -80,7 +86,7 @@ diff --git a/chrome/browser/bookmarks/android/java/src/org/chromium/chrome/brows
 diff --git a/chrome/browser/ui/android/strings/android_chrome_strings.grd b/chrome/browser/ui/android/strings/android_chrome_strings.grd
 --- a/chrome/browser/ui/android/strings/android_chrome_strings.grd
 +++ b/chrome/browser/ui/android/strings/android_chrome_strings.grd
-@@ -249,6 +249,9 @@ CHAR_LIMIT guidelines:
+@@ -246,6 +246,9 @@ CHAR_LIMIT guidelines:
        <message name="IDS_NOTIFICATION_CATEGORY_SITES" desc="Label for notifications from websites, within a list of notification categories. [CHAR_LIMIT=32]">
          Sites
        </message>

build/patches/Bromite-auto-updater.patch

@@ -35,14 +35,11 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
  .../omaha/inline/InlineUpdateController.java  |  57 ++++
  .../safety_hub/SafetyHubFetchService.java     |   5 -
  .../strings/android_chrome_strings.grd        |  23 +-
- .../ui/lens/lens_overlay_query_controller.cc  |   1 +
- .../endpoint_fetcher/endpoint_fetcher.cc      | 123 ++++++--
- .../endpoint_fetcher/endpoint_fetcher.h       |  25 ++
- components/manta/base_provider.cc             |   1 +
- .../composebox/composebox_query_controller.cc |   2 +-
+ .../endpoint_fetcher/endpoint_fetcher.cc      | 125 ++++++--
+ .../endpoint_fetcher/endpoint_fetcher.h       |  23 +-
  .../Bromite-auto-updater.inc                  |   3 +
  .../Bromite-auto-updater.inc                  |   1 +
- 34 files changed, 1235 insertions(+), 93 deletions(-)
+ 31 files changed, 1226 insertions(+), 98 deletions(-)
  create mode 100644 chrome/android/java/src/org/chromium/chrome/browser/omaha/CromiteUpdateStatusProvider.java
  create mode 100644 chrome/android/java/src/org/chromium/chrome/browser/omaha/inline/BromiteInlineUpdateController.java
  create mode 100644 chrome/browser/endpoint_fetcher/BUILD.gn
@@ -59,8 +56,8 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 diff --git a/build/android/java/templates/BuildConfig.template b/build/android/java/templates/BuildConfig.template
 --- a/build/android/java/templates/BuildConfig.template
 +++ b/build/android/java/templates/BuildConfig.template
-@@ -83,6 +83,8 @@ public class BuildConfig {
-     public static boolean CRONET_FOR_AOSP_BUILD;
+@@ -77,6 +77,8 @@ public class BuildConfig {
+     public static boolean IS_CRONET_BUILD;
  #endif
  
 +    public static String BUILD_TARGET_CPU = QUOTE(_BUILD_TARGET_CPU);
@@ -71,7 +68,7 @@ diff --git a/build/android/java/templates/BuildConfig.template b/build/android/j
 diff --git a/build/config/android/rules.gni b/build/config/android/rules.gni
 --- a/build/config/android/rules.gni
 +++ b/build/config/android/rules.gni
-@@ -1945,6 +1945,9 @@ if (!is_robolectric && enable_java_templates) {
+@@ -1928,6 +1928,9 @@ if (!is_robolectric && enable_java_templates) {
        sources = [ "//build/android/java/templates/BuildConfig.template" ]
        defines = []
  
@@ -84,7 +81,7 @@ diff --git a/build/config/android/rules.gni b/build/config/android/rules.gni
 diff --git a/chrome/android/chrome_java_sources.gni b/chrome/android/chrome_java_sources.gni
 --- a/chrome/android/chrome_java_sources.gni
 +++ b/chrome/android/chrome_java_sources.gni
-@@ -833,6 +833,8 @@ chrome_java_sources = [
+@@ -870,6 +870,8 @@ chrome_java_sources = [
    "java/src/org/chromium/chrome/browser/omaha/OmahaBase.java",
    "java/src/org/chromium/chrome/browser/omaha/OmahaDelegate.java",
    "java/src/org/chromium/chrome/browser/omaha/OmahaDelegateBase.java",
@@ -111,7 +108,7 @@ diff --git a/chrome/android/java/res/xml/about_chrome_preferences.xml b/chrome/a
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/about_settings/AboutChromeSettings.java b/chrome/android/java/src/org/chromium/chrome/browser/about_settings/AboutChromeSettings.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/about_settings/AboutChromeSettings.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/about_settings/AboutChromeSettings.java
-@@ -29,13 +29,19 @@ import org.chromium.ui.widget.Toast;
+@@ -24,12 +24,18 @@ import org.chromium.ui.widget.Toast;
  
  import java.util.Calendar;
  
@@ -120,7 +117,6 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/about_settings/
 +import org.chromium.components.browser_ui.settings.ChromeSwitchPreference;
 +
  /** Settings fragment that displays information about Chrome. */
- @NullMarked
  public class AboutChromeSettings extends PreferenceFragmentCompat
 -        implements EmbeddableSettingsPage, Preference.OnPreferenceClickListener {
 +        implements EmbeddableSettingsPage, Preference.OnPreferenceClickListener,
@@ -132,8 +128,8 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/about_settings/
      private static final String PREF_OS_VERSION = "os_version";
      private static final String PREF_LEGAL_INFORMATION = "legal_information";
  
-@@ -72,6 +78,13 @@ public class AboutChromeSettings extends PreferenceFragmentCompat
-         assumeNonNull(p);
+@@ -63,6 +69,13 @@ public class AboutChromeSettings extends PreferenceFragmentCompat
+         p = findPreference(PREF_LEGAL_INFORMATION);
          int currentYear = Calendar.getInstance().get(Calendar.YEAR);
          p.setSummary(getString(R.string.legal_information_summary, currentYear));
 +
@@ -146,10 +142,11 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/about_settings/
      }
  
      @Override
-@@ -142,6 +155,19 @@ public class AboutChromeSettings extends PreferenceFragmentCompat
+@@ -132,4 +145,17 @@ public class AboutChromeSettings extends PreferenceFragmentCompat
+         }
          return true;
      }
- 
++
 +    @Override
 +    public boolean onPreferenceChange(Preference preference, Object newValue) {
 +        String key = preference.getKey();
@@ -162,10 +159,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/about_settings/
 +        }
 +        return true;
 +    }
-+
-     @Override
-     public @SettingsFragment.AnimationType int getAnimationType() {
-         return SettingsFragment.AnimationType.PROPERTY;
+ }
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/omaha/CromiteUpdateStatusProvider.java b/chrome/android/java/src/org/chromium/chrome/browser/omaha/CromiteUpdateStatusProvider.java
 new file mode 100644
 --- /dev/null
@@ -216,7 +210,7 @@ new file mode 100644
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/omaha/OmahaBase.java b/chrome/android/java/src/org/chromium/chrome/browser/omaha/OmahaBase.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/omaha/OmahaBase.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/omaha/OmahaBase.java
-@@ -149,7 +149,8 @@ public class OmahaBase {
+@@ -140,7 +140,8 @@ public class OmahaBase {
      }
  
      static boolean isDisabled() {
@@ -226,7 +220,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/omaha/OmahaBase
      }
  
      /**
-@@ -592,6 +593,10 @@ public class OmahaBase {
+@@ -580,6 +581,10 @@ public class OmahaBase {
      /** Sends the request to the server and returns the response. */
      static String sendRequestToServer(HttpURLConnection urlConnection, String request)
              throws RequestFailureException {
@@ -240,15 +234,15 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/omaha/OmahaBase
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/omaha/UpdateMenuItemHelper.java b/chrome/android/java/src/org/chromium/chrome/browser/omaha/UpdateMenuItemHelper.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/omaha/UpdateMenuItemHelper.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/omaha/UpdateMenuItemHelper.java
-@@ -9,6 +9,7 @@ import android.content.ActivityNotFoundException;
- import android.content.res.Resources;
- import android.text.TextUtils;
- import android.view.Choreographer;
+@@ -12,6 +12,7 @@ import android.view.Choreographer;
+ 
+ import androidx.annotation.NonNull;
+ import androidx.annotation.Nullable;
 +import androidx.annotation.StringRes;
  
  import org.chromium.base.BuildInfo;
  import org.chromium.base.Callback;
-@@ -23,6 +24,7 @@ import org.chromium.build.annotations.Nullable;
+@@ -24,6 +25,7 @@ import org.chromium.base.task.TaskTraits;
  import org.chromium.chrome.R;
  import org.chromium.chrome.browser.omaha.UpdateStatusProvider.UpdateState;
  import org.chromium.chrome.browser.omaha.UpdateStatusProvider.UpdateStatus;
@@ -678,7 +672,7 @@ new file mode 100644
 diff --git a/chrome/browser/BUILD.gn b/chrome/browser/BUILD.gn
 --- a/chrome/browser/BUILD.gn
 +++ b/chrome/browser/BUILD.gn
-@@ -2685,6 +2685,12 @@ static_library("browser") {
+@@ -2525,6 +2525,12 @@ static_library("browser") {
    }
  
    if (is_android) {
@@ -772,8 +766,8 @@ new file mode 100644
 +    // Passing the endpoint_fetcher ensures the endpoint_fetcher's
 +    // lifetime extends to the callback and is not destroyed
 +    // prematurely (which would result in cancellation of the request).
-+    std::unique_ptr<endpoint_fetcher::EndpointFetcher> endpoint_fetcher,
-+    std::unique_ptr<endpoint_fetcher::EndpointResponse> endpoint_response) {
++    std::unique_ptr<EndpointFetcher> endpoint_fetcher,
++    std::unique_ptr<EndpointResponse> endpoint_response) {
 +  base::android::RunObjectCallbackAndroid(
 +      jcaller, Java_EndpointResponse_createEndpointResponse(
 +                   base::android::AttachCurrentThread(),
@@ -787,8 +781,8 @@ new file mode 100644
 +    // Passing the endpoint_fetcher ensures the endpoint_fetcher's
 +    // lifetime extends to the callback and is not destroyed
 +    // prematurely (which would result in cancellation of the request).
-+    std::unique_ptr<endpoint_fetcher::EndpointFetcher> endpoint_fetcher,
-+    std::unique_ptr<endpoint_fetcher::EndpointResponse> endpoint_response) {
++    std::unique_ptr<EndpointFetcher> endpoint_fetcher,
++    std::unique_ptr<EndpointResponse> endpoint_response) {
 +  base::android::RunObjectCallbackAndroid(
 +      jcaller, Java_EndpointHeaderResponse_createEndpointResponse(
 +                   base::android::AttachCurrentThread(),
@@ -818,7 +812,7 @@ new file mode 100644
 +    const base::android::JavaParamRef<jobject>& jcallback) {
 +  std::vector<std::string> scopes;
 +  base::android::AppendJavaStringArrayToStringVector(env, jscopes, &scopes);
-+  auto endpoint_fetcher = std::make_unique<endpoint_fetcher::EndpointFetcher>(
++  auto endpoint_fetcher = std::make_unique<EndpointFetcher>(
 +      Profile::FromJavaObject(jprofile)
 +          ->GetDefaultStoragePartition()
 +          ->GetURLLoaderFactoryForBrowserProcess(),
@@ -850,7 +844,7 @@ new file mode 100644
 +    jlong jtimeout, jboolean intercept_redirect,
 +    jint jannotation_hash_code,
 +    const base::android::JavaParamRef<jobject>& jcallback) {
-+  auto endpoint_fetcher = std::make_unique<endpoint_fetcher::EndpointFetcher>(
++  auto endpoint_fetcher = std::make_unique<EndpointFetcher>(
 +      Profile::FromJavaObject(jprofile)
 +          ->GetDefaultStoragePartition()
 +          ->GetURLLoaderFactoryForBrowserProcess(),
@@ -877,7 +871,7 @@ new file mode 100644
 +    jlong jtimeout, jboolean intercept_redirect,
 +    jint jannotation_hash_code,
 +    const base::android::JavaParamRef<jobject>& jcallback) {
-+  auto endpoint_fetcher = std::make_unique<endpoint_fetcher::EndpointFetcher>(
++  auto endpoint_fetcher = std::make_unique<EndpointFetcher>(
 +      Profile::FromJavaObject(jprofile)
 +        ->GetDefaultStoragePartition()
 +        ->GetURLLoaderFactoryForBrowserProcess(),
@@ -1091,25 +1085,25 @@ new file mode 100644
 diff --git a/chrome/browser/flags/android/chrome_feature_list.cc b/chrome/browser/flags/android/chrome_feature_list.cc
 --- a/chrome/browser/flags/android/chrome_feature_list.cc
 +++ b/chrome/browser/flags/android/chrome_feature_list.cc
-@@ -363,6 +363,7 @@ const base::Feature* const kFeaturesExposedToJava[] = {
-     &kProtectedTabsAndroid,
+@@ -302,6 +302,7 @@ const base::Feature* const kFeaturesExposedToJava[] = {
+     &kPriceChangeModule,
      &kPwaRestoreUi,
      &kPwaRestoreUiAtStartup,
 +    &kInlineUpdateFlow,
      &kOmahaMinSdkVersionAndroid,
      &kShortCircuitUnfocusAnimation,
-     &kShowHomeButtonPolicyAndroid,
+     &kShowNewTabAnimations,
 diff --git a/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureList.java b/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureList.java
 --- a/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureList.java
 +++ b/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureList.java
-@@ -453,6 +453,7 @@ public abstract class ChromeFeatureList {
-     public static final String HUB_BACK_BUTTON = "HubBackButton";
-     public static final String HUB_SLIDE_ANIMATION = "HubSlideAnimation";
+@@ -373,6 +373,7 @@ public abstract class ChromeFeatureList {
+     public static final String HISTORY_PANE_ANDROID = "HistoryPaneAndroid";
+     public static final String HTTPS_FIRST_BALANCED_MODE = "HttpsFirstBalancedMode";
      public static final String INCOGNITO_SCREENSHOT = "IncognitoScreenshot";
 +    public static final String INLINE_UPDATE_FLOW = "InlineUpdateFlow";
-     public static final String INSTANCE_SWITCHER_V2 = "InstanceSwitcherV2";
+     public static final String INSTALL_MESSAGE_THROTTLE = "InstallMessageThrottle";
+     public static final String IP_PROTECTION_V1 = "IpProtectionV1";
      public static final String IP_PROTECTION_UX = "IpProtectionUx";
-     public static final String KEYBOARD_ESC_BACK_NAVIGATION = "KeyboardEscBackNavigation";
 diff --git a/chrome/browser/omaha/android/BUILD.gn b/chrome/browser/omaha/android/BUILD.gn
 --- a/chrome/browser/omaha/android/BUILD.gn
 +++ b/chrome/browser/omaha/android/BUILD.gn
@@ -1126,18 +1120,17 @@ diff --git a/chrome/browser/omaha/android/BUILD.gn b/chrome/browser/omaha/androi
 diff --git a/chrome/browser/omaha/android/java/src/org/chromium/chrome/browser/omaha/OmahaPrefUtils.java b/chrome/browser/omaha/android/java/src/org/chromium/chrome/browser/omaha/OmahaPrefUtils.java
 --- a/chrome/browser/omaha/android/java/src/org/chromium/chrome/browser/omaha/OmahaPrefUtils.java
 +++ b/chrome/browser/omaha/android/java/src/org/chromium/chrome/browser/omaha/OmahaPrefUtils.java
-@@ -7,8 +7,10 @@ package org.chromium.chrome.browser.omaha;
+@@ -7,7 +7,9 @@ package org.chromium.chrome.browser.omaha;
  import android.content.Context;
  import android.content.SharedPreferences;
  
 +import org.chromium.base.Log;
  import org.chromium.base.ContextUtils;
- import org.chromium.build.annotations.NullMarked;
 +import org.chromium.base.version_info.VersionInfo;
  
- @NullMarked
  public class OmahaPrefUtils {
-@@ -24,7 +26,55 @@ public class OmahaPrefUtils {
+     // Flags for retrieving the OmahaClient's state after it's written to disk.
+@@ -22,7 +24,55 @@ public class OmahaPrefUtils {
      static final String PREF_TIMESTAMP_FOR_NEW_REQUEST = "timestampForNewRequest";
      static final String PREF_TIMESTAMP_FOR_NEXT_POST_ATTEMPT = "timestampForNextPostAttempt";
      static final String PREF_TIMESTAMP_OF_INSTALL = "timestampOfInstall";
@@ -1197,15 +1190,15 @@ diff --git a/chrome/browser/omaha/android/java/src/org/chromium/chrome/browser/o
 diff --git a/chrome/browser/omaha/android/java/src/org/chromium/chrome/browser/omaha/UpdateConfigs.java b/chrome/browser/omaha/android/java/src/org/chromium/chrome/browser/omaha/UpdateConfigs.java
 --- a/chrome/browser/omaha/android/java/src/org/chromium/chrome/browser/omaha/UpdateConfigs.java
 +++ b/chrome/browser/omaha/android/java/src/org/chromium/chrome/browser/omaha/UpdateConfigs.java
-@@ -12,6 +12,7 @@ import androidx.annotation.IntDef;
+@@ -11,6 +11,7 @@ import androidx.annotation.IntDef;
+ import androidx.annotation.Nullable;
+ 
  import org.chromium.base.CommandLine;
- import org.chromium.build.annotations.NullMarked;
- import org.chromium.build.annotations.Nullable;
 +import org.chromium.chrome.browser.flags.ChromeFeatureList;
  import org.chromium.chrome.browser.flags.ChromeSwitches;
  import org.chromium.chrome.browser.omaha.UpdateStatusProvider.UpdateState;
  import org.chromium.components.variations.VariationsAssociatedData;
-@@ -38,10 +39,12 @@ public class UpdateConfigs {
+@@ -36,10 +37,12 @@ public class UpdateConfigs {
      private static final String UPDATE_AVAILABLE_SWITCH_VALUE = "update_available";
      private static final String UNSUPPORTED_OS_VERSION_SWITCH_VALUE = "unsupported_os_version";
  
@@ -1219,7 +1212,7 @@ diff --git a/chrome/browser/omaha/android/java/src/org/chromium/chrome/browser/o
      @Retention(RetentionPolicy.SOURCE)
      public @interface UpdateFlowConfiguration {
          /** Turns off all update indicators. */
-@@ -51,6 +54,12 @@ public class UpdateConfigs {
+@@ -49,6 +52,12 @@ public class UpdateConfigs {
           * Requires Omaha to say an update is available, and only ever Intents out to Play Store.
           */
          int INTENT_ONLY = 2;
@@ -1232,7 +1225,7 @@ diff --git a/chrome/browser/omaha/android/java/src/org/chromium/chrome/browser/o
      }
  
      /**
-@@ -126,6 +135,13 @@ public class UpdateConfigs {
+@@ -124,6 +133,13 @@ public class UpdateConfigs {
          return DEFAULT_UPDATE_ATTRIBUTION_WINDOW_MS;
      }
  
@@ -1246,7 +1239,7 @@ diff --git a/chrome/browser/omaha/android/java/src/org/chromium/chrome/browser/o
      /**
       * Gets a String VariationsAssociatedData parameter. Also checks for a command-line switch
       * with the same name, for easy local testing.
-@@ -139,4 +155,13 @@ public class UpdateConfigs {
+@@ -137,4 +153,13 @@ public class UpdateConfigs {
          }
          return value;
      }
@@ -1263,18 +1256,18 @@ diff --git a/chrome/browser/omaha/android/java/src/org/chromium/chrome/browser/o
 diff --git a/chrome/browser/omaha/android/java/src/org/chromium/chrome/browser/omaha/UpdateStatusProvider.java b/chrome/browser/omaha/android/java/src/org/chromium/chrome/browser/omaha/UpdateStatusProvider.java
 --- a/chrome/browser/omaha/android/java/src/org/chromium/chrome/browser/omaha/UpdateStatusProvider.java
 +++ b/chrome/browser/omaha/android/java/src/org/chromium/chrome/browser/omaha/UpdateStatusProvider.java
-@@ -6,6 +6,7 @@ package org.chromium.chrome.browser.omaha;
+@@ -4,6 +4,7 @@
  
- import static org.chromium.build.NullUtil.assumeNonNull;
+ package org.chromium.chrome.browser.omaha;
  
 +import android.app.Activity;
  import android.content.ActivityNotFoundException;
  import android.content.Context;
  import android.content.Intent;
-@@ -15,9 +16,11 @@ import android.os.StatFs;
- import android.text.TextUtils;
- 
+@@ -15,9 +16,11 @@ import android.text.TextUtils;
  import androidx.annotation.IntDef;
+ import androidx.annotation.NonNull;
+ import androidx.annotation.Nullable;
 +import androidx.annotation.VisibleForTesting;
  
 -import com.google.android.gms.common.GooglePlayServicesUtil;
@@ -1285,15 +1278,15 @@ diff --git a/chrome/browser/omaha/android/java/src/org/chromium/chrome/browser/o
  import org.chromium.base.BuildInfo;
  import org.chromium.base.Callback;
  import org.chromium.base.ObserverList;
-@@ -30,6 +33,7 @@ import org.chromium.base.task.TaskTraits;
- import org.chromium.build.annotations.NullMarked;
- import org.chromium.build.annotations.Nullable;
- import org.chromium.build.annotations.RequiresNonNull;
+@@ -27,6 +30,7 @@ import org.chromium.base.task.AsyncTask;
+ import org.chromium.base.task.AsyncTask.Status;
+ import org.chromium.base.task.PostTask;
+ import org.chromium.base.task.TaskTraits;
 +import org.chromium.chrome.browser.omaha.inline.InlineUpdateController;
  import org.chromium.chrome.browser.omaha.metrics.UpdateSuccessMetrics;
  import org.chromium.chrome.browser.preferences.ChromePreferenceKeys;
  import org.chromium.chrome.browser.preferences.ChromeSharedPreferences;
-@@ -39,6 +43,11 @@ import java.io.File;
+@@ -36,30 +40,37 @@ import java.io.File;
  import java.lang.annotation.Retention;
  import java.lang.annotation.RetentionPolicy;
  
@@ -1305,10 +1298,9 @@ diff --git a/chrome/browser/omaha/android/java/src/org/chromium/chrome/browser/o
  /**
   * Provides the current update state for Chrome.  This update state is asynchronously determined and
   * can change as Chrome runs.
-@@ -46,24 +55,26 @@ import java.lang.annotation.RetentionPolicy;
+  *
   * For manually testing this functionality, see {@link UpdateConfigs}.
   */
- @NullMarked
 -public class UpdateStatusProvider {
 +public abstract class UpdateStatusProvider implements ActivityStateListener {
      /**
@@ -1340,7 +1332,7 @@ diff --git a/chrome/browser/omaha/android/java/src/org/chromium/chrome/browser/o
      }
  
      /** A set of properties that represent the current update state for Chrome. */
-@@ -97,6 +108,12 @@ public class UpdateStatusProvider {
+@@ -93,6 +104,12 @@ public class UpdateStatusProvider {
           */
          private boolean mIsSimulated;
  
@@ -1353,7 +1345,7 @@ diff --git a/chrome/browser/omaha/android/java/src/org/chromium/chrome/browser/o
          public UpdateStatus() {}
  
          UpdateStatus(UpdateStatus other) {
-@@ -105,11 +122,13 @@ public class UpdateStatusProvider {
+@@ -101,11 +118,13 @@ public class UpdateStatusProvider {
              latestVersion = other.latestVersion;
              latestUnsupportedVersion = other.latestUnsupportedVersion;
              mIsSimulated = other.mIsSimulated;
@@ -1367,7 +1359,7 @@ diff --git a/chrome/browser/omaha/android/java/src/org/chromium/chrome/browser/o
      private final UpdateQuery mOmahaQuery;
      private final UpdateSuccessMetrics mMetrics;
      private @Nullable UpdateStatus mStatus;
-@@ -117,11 +136,6 @@ public class UpdateStatusProvider {
+@@ -113,11 +132,6 @@ public class UpdateStatusProvider {
      /** Whether or not we've recorded the initial update status yet. */
      private boolean mRecordedInitialStatus;
  
@@ -1379,7 +1371,7 @@ diff --git a/chrome/browser/omaha/android/java/src/org/chromium/chrome/browser/o
      /**
       * Adds {@code observer} to notify about update state changes.  It is safe to call this multiple
       * times with the same {@code observer}.  This method will always notify {@code observer} of the
-@@ -177,6 +191,30 @@ public class UpdateStatusProvider {
+@@ -173,6 +187,30 @@ public class UpdateStatusProvider {
          pingObservers();
      }
  
@@ -1410,7 +1402,7 @@ diff --git a/chrome/browser/omaha/android/java/src/org/chromium/chrome/browser/o
      /**
       * Starts the intent update process, if possible
       * @param context An {@link Context} that will be used to fire off the update intent.
-@@ -184,12 +222,11 @@ public class UpdateStatusProvider {
+@@ -180,12 +218,11 @@ public class UpdateStatusProvider {
       * @return        Whether or not the update intent was sent and had a valid handler.
       */
      public boolean startIntentUpdate(Context context, boolean newTask) {
@@ -1424,7 +1416,7 @@ diff --git a/chrome/browser/omaha/android/java/src/org/chromium/chrome/browser/o
              Intent intent = new Intent(Intent.ACTION_VIEW, Uri.parse(mStatus.updateUrl));
              if (newTask) intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
              context.startActivity(intent);
-@@ -200,9 +237,15 @@ public class UpdateStatusProvider {
+@@ -196,9 +233,15 @@ public class UpdateStatusProvider {
          return true;
      }
  
@@ -1441,8 +1433,8 @@ diff --git a/chrome/browser/omaha/android/java/src/org/chromium/chrome/browser/o
 +        ApplicationStatus.registerStateListenerForAllActivities(this);
      }
  
-     @RequiresNonNull("mStatus")
-@@ -211,35 +254,52 @@ public class UpdateStatusProvider {
+     private void pingObservers() {
+@@ -206,35 +249,52 @@ public class UpdateStatusProvider {
      }
  
      private void resolveStatus() {
@@ -1452,10 +1444,10 @@ diff --git a/chrome/browser/omaha/android/java/src/org/chromium/chrome/browser/o
          }
  
          // We pull the Omaha result once as it will never change.
-         if (mStatus == null) mStatus = new UpdateStatus(assumeNonNull(mOmahaQuery.getResult()));
+         if (mStatus == null) mStatus = new UpdateStatus(mOmahaQuery.getResult());
  
 -        if (!mStatus.mIsSimulated) {
--            mStatus.updateState = assumeNonNull(mOmahaQuery.getResult()).updateState;
+-            mStatus.updateState = mOmahaQuery.getResult().updateState;
 +        if (mStatus.mIsSimulated) { // used only during tests
 +            if (mStatus.mIsInlineSimulated) {
 +                @UpdateState
@@ -1463,7 +1455,7 @@ diff --git a/chrome/browser/omaha/android/java/src/org/chromium/chrome/browser/o
 +                String updateUrl = mInlineController.getUpdateUrl();
 +
 +                if (inlineState == UpdateState.NONE) {
-+                    mStatus.updateState = assumeNonNull(mOmahaQuery.getResult()).updateState;
++                    mStatus.updateState = mOmahaQuery.getResult().updateState;
 +                } else {
 +                    mStatus.updateState = inlineState;
 +                    mStatus.updateUrl = updateUrl;
@@ -1496,15 +1488,15 @@ diff --git a/chrome/browser/omaha/android/java/src/org/chromium/chrome/browser/o
  
          private @Nullable UpdateStatus mStatus;
  
--        public UpdateQuery(Runnable resultReceiver) {
+-        public UpdateQuery(@NonNull Runnable resultReceiver) {
 +        private InlineUpdateController mInlineController;
 +
-+        public UpdateQuery(InlineUpdateController inlineController, Runnable resultReceiver) {
++        public UpdateQuery(InlineUpdateController inlineController, @NonNull Runnable resultReceiver) {
 +            mInlineController = inlineController;
              mCallback = resultReceiver;
          }
  
-@@ -251,7 +311,7 @@ public class UpdateStatusProvider {
+@@ -246,7 +306,7 @@ public class UpdateStatusProvider {
          protected UpdateStatus doInBackground() {
              UpdateStatus testStatus = getTestStatus();
              if (testStatus != null) return testStatus;
@@ -1513,7 +1505,7 @@ diff --git a/chrome/browser/omaha/android/java/src/org/chromium/chrome/browser/o
          }
  
          @Override
-@@ -269,6 +329,8 @@ public class UpdateStatusProvider {
+@@ -264,6 +324,8 @@ public class UpdateStatusProvider {
              status.mIsSimulated = true;
              status.updateState = forcedUpdateState;
  
@@ -1522,7 +1514,7 @@ diff --git a/chrome/browser/omaha/android/java/src/org/chromium/chrome/browser/o
              // Push custom configurations for certain update states.
              switch (forcedUpdateState) {
                  case UpdateState.UPDATE_AVAILABLE:
-@@ -286,31 +348,33 @@ public class UpdateStatusProvider {
+@@ -281,31 +343,33 @@ public class UpdateStatusProvider {
              return status;
          }
  
@@ -1582,7 +1574,7 @@ diff --git a/chrome/browser/omaha/android/java/src/org/chromium/chrome/browser/o
 diff --git a/chrome/browser/omaha/android/java/src/org/chromium/chrome/browser/omaha/VersionNumberGetter.java b/chrome/browser/omaha/android/java/src/org/chromium/chrome/browser/omaha/VersionNumberGetter.java
 --- a/chrome/browser/omaha/android/java/src/org/chromium/chrome/browser/omaha/VersionNumberGetter.java
 +++ b/chrome/browser/omaha/android/java/src/org/chromium/chrome/browser/omaha/VersionNumberGetter.java
-@@ -24,8 +24,8 @@ import org.chromium.chrome.browser.flags.ChromeFeatureList;
+@@ -22,8 +22,8 @@ import org.chromium.chrome.browser.flags.ChromeFeatureList;
  public class VersionNumberGetter {
      private static VersionNumberGetter sInstance = new VersionNumberGetter();
  
@@ -1658,9 +1650,9 @@ new file mode 100644
 diff --git a/chrome/browser/safety_hub/android/java/src/org/chromium/chrome/browser/safety_hub/SafetyHubFetchService.java b/chrome/browser/safety_hub/android/java/src/org/chromium/chrome/browser/safety_hub/SafetyHubFetchService.java
 --- a/chrome/browser/safety_hub/android/java/src/org/chromium/chrome/browser/safety_hub/SafetyHubFetchService.java
 +++ b/chrome/browser/safety_hub/android/java/src/org/chromium/chrome/browser/safety_hub/SafetyHubFetchService.java
-@@ -85,9 +85,6 @@ public class SafetyHubFetchService implements SigninManager.SignInStateObserver,
-         mLocalPasswordsFetchService =
-                 new SafetyHubPasswordsFetchService(passwordManagerHelper, prefService, null);
+@@ -78,9 +78,6 @@ public class SafetyHubFetchService implements SigninManager.SignInStateObserver,
+             mSigninManager.addSignInStateObserver(this);
+         }
  
 -        // Fetch latest update status.
 -        UpdateStatusProvider.getInstance().addObserver(mUpdateCallback);
@@ -1668,7 +1660,7 @@ diff --git a/chrome/browser/safety_hub/android/java/src/org/chromium/chrome/brow
          recordMetricForUnusedSitePermissionsSettingState();
      }
  
-@@ -116,8 +113,6 @@ public class SafetyHubFetchService implements SigninManager.SignInStateObserver,
+@@ -109,8 +106,6 @@ public class SafetyHubFetchService implements SigninManager.SignInStateObserver,
          if (mSigninManager != null) {
              mSigninManager.removeSignInStateObserver(this);
          }
@@ -1680,7 +1672,7 @@ diff --git a/chrome/browser/safety_hub/android/java/src/org/chromium/chrome/brow
 diff --git a/chrome/browser/ui/android/strings/android_chrome_strings.grd b/chrome/browser/ui/android/strings/android_chrome_strings.grd
 --- a/chrome/browser/ui/android/strings/android_chrome_strings.grd
 +++ b/chrome/browser/ui/android/strings/android_chrome_strings.grd
-@@ -2324,6 +2324,12 @@ Your Google account may have other forms of browsing history like searches and a
+@@ -2360,6 +2360,12 @@ Your Google account may have other forms of browsing history like searches and a
        <message name="IDS_DEPRECATION_WARNING" desc="Warning about Chrome updates no longer being supported">
          Chrome updates are no longer supported for this version of Android
        </message>
@@ -1693,7 +1685,7 @@ diff --git a/chrome/browser/ui/android/strings/android_chrome_strings.grd b/chro
  
        <!-- Account management UI strings. -->
        <message name="IDS_ACCOUNT_MANAGEMENT_TITLE" desc="Header title for the account management screen. [CHAR_LIMIT=32]">
-@@ -4288,7 +4294,10 @@ To change this setting, <ph name="BEGIN_LINK">BEGIN_LINK</ph>delete the Chrome d
+@@ -4298,7 +4304,10 @@ To change this setting, <ph name="BEGIN_LINK">BEGIN_LINK</ph>delete the Chrome d
  
        <!-- Main menu items -->
        <message name="IDS_MENU_UPDATE" desc="Menu item for updating chrome. [CHAR_LIMIT=24]">
@@ -1705,7 +1697,7 @@ diff --git a/chrome/browser/ui/android/strings/android_chrome_strings.grd b/chro
        </message>
        <message name="IDS_MENU_UPDATE_SUMMARY_DEFAULT" desc="Summary string for update menu item explaining that a newer version of Chrome is available. [CHAR_LIMIT=30]">
          Newer version is available
-@@ -4299,6 +4308,18 @@ To change this setting, <ph name="BEGIN_LINK">BEGIN_LINK</ph>delete the Chrome d
+@@ -4309,6 +4318,18 @@ To change this setting, <ph name="BEGIN_LINK">BEGIN_LINK</ph>delete the Chrome d
        <message name="IDS_MENU_UPDATE_UNSUPPORTED_SUMMARY_DEFAULT" desc="Summary string for update menu item explaining that the Android version on the device is unsupported. [CHAR_LIMIT=30]">
          Android version is unsupported
        </message>
@@ -1724,22 +1716,11 @@ diff --git a/chrome/browser/ui/android/strings/android_chrome_strings.grd b/chro
        <message name="IDS_MENU_NEW_WINDOW" desc="Menu item for opening a new window. [CHAR_LIMIT=27]">
          New window
        </message>
-diff --git a/chrome/browser/ui/lens/lens_overlay_query_controller.cc b/chrome/browser/ui/lens/lens_overlay_query_controller.cc
---- a/chrome/browser/ui/lens/lens_overlay_query_controller.cc
-+++ b/chrome/browser/ui/lens/lens_overlay_query_controller.cc
-@@ -802,6 +802,7 @@ LensOverlayQueryController::CreateEndpointFetcher(
-       /*post_data=*/std::move(request_string),
-       /*headers=*/request_headers,
-       /*cors_exempt_headers=*/cors_exempt_headers, chrome::GetChannel(),
-+      kTrafficAnnotationTag,
-       /*request_params=*/
-       EndpointFetcher::RequestParams::Builder(http_method,
-                                               kTrafficAnnotationTag)
 diff --git a/components/endpoint_fetcher/endpoint_fetcher.cc b/components/endpoint_fetcher/endpoint_fetcher.cc
 --- a/components/endpoint_fetcher/endpoint_fetcher.cc
 +++ b/components/endpoint_fetcher/endpoint_fetcher.cc
-@@ -21,6 +21,11 @@
- #include "services/network/public/mojom/referrer_policy.mojom-shared.h"
+@@ -20,6 +20,11 @@
+ #include "services/network/public/cpp/simple_url_loader.h"
  #include "services/network/public/mojom/url_response_head.mojom.h"
  
 +// used for the Bromite customization
@@ -1747,74 +1728,50 @@ diff --git a/components/endpoint_fetcher/endpoint_fetcher.cc b/components/endpoi
 +#include "net/http/http_status_code.h"
 +#include "services/network/public/cpp/resource_request.h"
 +
- namespace endpoint_fetcher {
- 
  namespace {
-@@ -37,6 +42,8 @@ std::string GetHttpMethodString(const HttpMethod& http_method) {
-       return "POST";
-     case HttpMethod::kDelete:
-       return "DELETE";
-+    case HttpMethod::kHead:
-+      return "HEAD";
-     default:
-       DCHECK(0) << base::StringPrintf("Unknown HttpMethod %d\n",
-                                       static_cast<int>(http_method));
-@@ -51,6 +58,8 @@ HttpMethod GetHttpMethod(const std::string& http_method_string) {
-     return HttpMethod::kPost;
-   } else if (http_method_string == "DELETE") {
-     return HttpMethod::kDelete;
-+  } else if (http_method_string == "HEAD") {
-+    return HttpMethod::kHead;
-   }
-   return HttpMethod::kUndefined;
- }
-@@ -110,6 +119,7 @@ EndpointFetcher::EndpointFetcher(
-     RequestParams request_params)
-     : url_loader_factory_(url_loader_factory),
-       identity_manager_(identity_manager),
+ const char kContentTypeKey[] = "Content-Type";
+ const char kDeveloperKey[] = "X-Developer-Key";
+@@ -83,6 +88,7 @@ EndpointFetcher::EndpointFetcher(
+       http_method_(http_method),
+       content_type_(content_type),
+       timeout_(timeout),
 +      intercept_redirect_(false),
-       request_params_(std::move(request_params)) {
-   if (request_params_.auth_type() == OAUTH) {
-     DCHECK(identity_manager_)
-@@ -150,9 +160,11 @@ EndpointFetcher::EndpointFetcher(
-     const std::vector<std::string>& headers,
-     const std::vector<std::string>& cors_exempt_headers,
-     version_info::Channel channel,
-+    const net::NetworkTrafficAnnotationTag& annotation_tag,
-     const RequestParams request_params)
-     : url_loader_factory_(url_loader_factory),
-       identity_manager_(nullptr),
+       post_data_(post_data),
+       headers_(headers),
+       cors_exempt_headers_(cors_exempt_headers),
+@@ -103,6 +109,7 @@ EndpointFetcher::EndpointFetcher(
+       http_method_("GET"),
+       content_type_(std::string()),
+       timeout_(base::Milliseconds(0)),
 +      intercept_redirect_(false),
-       request_params_(EndpointFetcher::RequestParams::Builder(request_params)
-                           .SetAuthType(CHROME_API_KEY)
-                           .SetUrl(url)
-@@ -171,6 +183,7 @@ EndpointFetcher::EndpointFetcher(
-     const net::NetworkTrafficAnnotationTag& annotation_tag)
-     : url_loader_factory_(url_loader_factory),
-       identity_manager_(nullptr),
+       post_data_(std::string()),
+       annotation_tag_(annotation_tag),
+       url_loader_factory_(url_loader_factory),
+@@ -128,6 +135,7 @@ EndpointFetcher::EndpointFetcher(
+       http_method_(http_method),
+       content_type_(content_type),
+       timeout_(timeout),
 +      intercept_redirect_(false),
-       request_params_(EndpointFetcher::RequestParams::Builder(HttpMethod::kGet,
-                                                               annotation_tag)
-                           .SetAuthType(NO_AUTH)
-@@ -193,6 +206,7 @@ EndpointFetcher::EndpointFetcher(
-     signin::ConsentLevel consent_level)
-     : url_loader_factory_(url_loader_factory),
-       identity_manager_(identity_manager),
+       post_data_(post_data),
+       annotation_tag_(annotation_tag),
+       url_loader_factory_(url_loader_factory),
+@@ -155,6 +163,7 @@ EndpointFetcher::EndpointFetcher(
+       http_method_(http_method),
+       content_type_(content_type),
+       timeout_(timeout),
 +      intercept_redirect_(false),
-       request_params_(
-           EndpointFetcher::RequestParams::Builder(GetHttpMethod(http_method),
-                                                   annotation_tag)
-@@ -212,6 +226,7 @@ EndpointFetcher::EndpointFetcher(
+       post_data_(post_data),
+       headers_(headers),
+       cors_exempt_headers_(cors_exempt_headers),
+@@ -167,11 +176,29 @@ EndpointFetcher::EndpointFetcher(
  EndpointFetcher::EndpointFetcher(
      const net::NetworkTrafficAnnotationTag& annotation_tag)
-     : identity_manager_(nullptr),
+     : timeout_(kDefaultTimeOut),
 +      intercept_redirect_(false),
-       request_params_(
-           EndpointFetcher::RequestParams::Builder(HttpMethod::kUndefined,
-                                                   annotation_tag)
-@@ -219,6 +234,25 @@ EndpointFetcher::EndpointFetcher(
-               .SetSanitizeResponse(true)
-               .Build()) {}
+       annotation_tag_(annotation_tag),
+       identity_manager_(nullptr),
+       consent_level_(std::nullopt),
+       sanitize_response_(true) {}
  
 +// constructor used by Bromite
 +EndpointFetcher::EndpointFetcher(
@@ -1824,48 +1781,48 @@ diff --git a/components/endpoint_fetcher/endpoint_fetcher.cc b/components/endpoi
 +    int64_t timeout_ms,
 +    const bool intercept_redirect,
 +    const net::NetworkTrafficAnnotationTag& annotation_tag)
-+    : url_loader_factory_(url_loader_factory),
-+      identity_manager_(nullptr),
++    : url_(url),
++      http_method_(http_method),
++      timeout_(base::Milliseconds(timeout_ms)),
 +      intercept_redirect_(intercept_redirect),
-+      request_params_(
-+          EndpointFetcher::RequestParams::Builder(GetHttpMethod(http_method),
-+                                                  annotation_tag)
-+              .SetAuthType(NO_AUTH)
-+              .SetTimeout(base::Milliseconds(timeout_ms))
-+              .SetUrl(url)
-+              .Build()) {}
++      annotation_tag_(annotation_tag),
++      url_loader_factory_(url_loader_factory),
++      identity_manager_(nullptr),
++      sanitize_response_(false) {}
 +
  EndpointFetcher::~EndpointFetcher() = default;
  
  void EndpointFetcher::Fetch(EndpointFetcherCallback endpoint_fetcher_callback) {
-@@ -301,13 +335,10 @@ void EndpointFetcher::PerformHttpRequest(
+@@ -229,11 +256,9 @@ void EndpointFetcher::PerformRequest(
    auto resource_request = std::make_unique<network::ResourceRequest>();
-   resource_request->method = GetHttpMethodString(request_params_.http_method());
-   resource_request->url = request_params_.url();
+   resource_request->method = http_method_;
+   resource_request->url = url_;
 -  resource_request->credentials_mode = GetCredentialsMode();
--
 -  if (GetSetSiteForCookies()) {
--    resource_request->site_for_cookies =
--        net::SiteForCookies::FromUrl(request_params_.url());
+-    resource_request->site_for_cookies = net::SiteForCookies::FromUrl(url_);
 -  }
+-
 +  resource_request->credentials_mode = network::mojom::CredentialsMode::kOmit;
- 
 +  resource_request->load_flags = net::LOAD_BYPASS_CACHE | net::LOAD_DISABLE_CACHE
 +                                  | net::LOAD_DO_NOT_SAVE_COOKIES;
-   // Add Content-Type header if post data is present.
-   if (request_params_.http_method() == HttpMethod::kPost &&
-       request_params_.post_data()) {
-@@ -346,8 +377,23 @@ void EndpointFetcher::PerformHttpRequest(
+   if (base::EqualsCaseInsensitiveASCII(http_method_, "POST")) {
+     resource_request->headers.SetHeader(kContentTypeKey, content_type_);
+   }
+@@ -261,10 +286,27 @@ void EndpointFetcher::PerformRequest(
+     default:
        break;
    }
- 
++
 +  if (intercept_redirect_ == true) {
 +    // will need manual mode to capture the landing page URL
 +    resource_request->redirect_mode = network::mojom::RedirectMode::kManual; // default is kFollow
 +  }
 +
+   // TODO(crbug.com/40641804) Make simple_url_loader_ local variable passed to
+   // callback
    simple_url_loader_ = network::SimpleURLLoader::Create(
-       std::move(resource_request), request_params_.annotation_tag());
+       std::move(resource_request), annotation_tag_);
++  simple_url_loader_->SetTimeoutDuration(timeout_);
 +  simple_url_loader_->SetAllowHttpErrorResults(true);
 +
 +  if (!response_)
@@ -1877,39 +1834,50 @@ diff --git a/components/endpoint_fetcher/endpoint_fetcher.cc b/components/endpoi
 +      &EndpointFetcher::OnSimpleLoaderRedirect, base::Unretained(this)));
 +  }
  
-   if (request_params_.http_method() == HttpMethod::kPost &&
-       request_params_.post_data()) {
-@@ -361,9 +407,18 @@ void EndpointFetcher::PerformHttpRequest(
- 
+   if (base::EqualsCaseInsensitiveASCII(http_method_, "POST")) {
+     simple_url_loader_->AttachStringForUpload(post_data_, content_type_);
+@@ -275,15 +317,23 @@ void EndpointFetcher::PerformRequest(
+   }
    simple_url_loader_->SetRetryOptions(GetMaxRetries(),
                                        network::SimpleURLLoader::RETRY_ON_5XX);
--  simple_url_loader_->SetTimeoutDuration(request_params_.timeout());
+-  simple_url_loader_->SetTimeoutDuration(timeout_);
 -  simple_url_loader_->SetAllowHttpErrorResults(true);
--
-+  LOG(INFO) << "performing "
-+            << GetHttpMethodString(request_params_.http_method())
-+            << " request to " << url_;
-+  if (request_params_.http_method() == HttpMethod::kHead) {
+-  network::SimpleURLLoader::BodyAsStringCallbackDeprecated
++  LOG(INFO) << "performing " << http_method_ << " request to " << url_;
++  if (base::EqualsCaseInsensitiveASCII(http_method_, "HEAD")) {
 +    endpoint_fetcher_callback_ = std::move(endpoint_fetcher_callback);
 +
 +    simple_url_loader_->DownloadHeadersOnly(
 +        url_loader_factory_.get(),
 +        base::BindOnce(&EndpointFetcher::OnURLLoadComplete,
 +                     base::Unretained(this)));
-+    return;
-+  }
-   network::SimpleURLLoader::BodyAsStringCallbackDeprecated
++  } else {
++      network::SimpleURLLoader::BodyAsStringCallbackDeprecated
        body_as_string_callback = base::BindOnce(
            &EndpointFetcher::OnResponseFetched, weak_ptr_factory_.GetWeakPtr(),
-@@ -453,21 +508,6 @@ void EndpointFetcher::OnSanitizationResult(
+           std::move(endpoint_fetcher_callback));
+-  simple_url_loader_->DownloadToString(
+-      url_loader_factory_.get(), std::move(body_as_string_callback),
+-      network::SimpleURLLoader::kMaxBoundedStringDownloadSize);
++      simple_url_loader_->DownloadToString(
++         url_loader_factory_.get(), std::move(body_as_string_callback),
++         network::SimpleURLLoader::kMaxBoundedStringDownloadSize);
++  }
+ }
+ 
+ void EndpointFetcher::OnResponseFetched(
+@@ -361,24 +411,6 @@ void EndpointFetcher::OnSanitizationResult(
    std::move(endpoint_fetcher_callback).Run(std::move(response));
  }
  
--network::mojom::CredentialsMode EndpointFetcher::GetCredentialsMode() const {
--  if (!request_params_.credentials_mode.has_value()) {
+-network::mojom::CredentialsMode EndpointFetcher::GetCredentialsMode() {
+-  if (!request_params_.has_value()) {
 -    return network::mojom::CredentialsMode::kOmit;
 -  }
--  switch (request_params_.credentials_mode.value()) {
+-  if (!request_params_.value().credentials_mode.has_value()) {
+-    return network::mojom::CredentialsMode::kOmit;
+-  }
+-  switch (request_params_.value().credentials_mode.value()) {
 -    case CredentialsMode::kOmit:
 -      return network::mojom::CredentialsMode::kOmit;
 -    case CredentialsMode::kInclude:
@@ -1917,16 +1885,17 @@ diff --git a/components/endpoint_fetcher/endpoint_fetcher.cc b/components/endpoi
 -  }
 -  DCHECK(0) << base::StringPrintf(
 -      "Credentials mode %d not currently supported by EndpointFetcher\n",
--      static_cast<int>(request_params_.credentials_mode.value()));
+-      static_cast<int>(request_params_.value().credentials_mode.value()));
 -}
 -
- int EndpointFetcher::GetMaxRetries() const {
-   if (!request_params_.max_retries.has_value()) {
+ int EndpointFetcher::GetMaxRetries() {
+   if (!request_params_.has_value()) {
      return kNumRetries;
-@@ -493,4 +533,39 @@ std::string EndpointFetcher::GetUrlForTesting() {
-   return request_params_.url().spec();
+@@ -412,3 +444,38 @@ UploadProgressCallback EndpointFetcher::GetUploadProgressCallback() {
+ std::string EndpointFetcher::GetUrlForTesting() {
+   return url_.spec();
  }
- 
++
 +void EndpointFetcher::OnSimpleLoaderRedirect(
 +    const GURL& url_before_redirect,
 +    const net::RedirectInfo& redirect_info,
@@ -1961,12 +1930,10 @@ diff --git a/components/endpoint_fetcher/endpoint_fetcher.cc b/components/endpoi
 +  response_->response = net_error;
 +  std::move(endpoint_fetcher_callback_).Run(std::move(response_));
 +}
-+
- }  // namespace endpoint_fetcher
 diff --git a/components/endpoint_fetcher/endpoint_fetcher.h b/components/endpoint_fetcher/endpoint_fetcher.h
 --- a/components/endpoint_fetcher/endpoint_fetcher.h
 +++ b/components/endpoint_fetcher/endpoint_fetcher.h
-@@ -21,6 +21,8 @@
+@@ -32,6 +32,8 @@ class EndpointFetcherTest;
  namespace base {
  class TimeDelta;
  }  // namespace base
@@ -1974,16 +1941,8 @@ diff --git a/components/endpoint_fetcher/endpoint_fetcher.h b/components/endpoin
 +#include "services/network/public/mojom/url_response_head.mojom.h"
  
  namespace network {
- class SimpleURLLoader;
-@@ -59,6 +61,7 @@ enum class HttpMethod {
-   kGet = 0,
-   kPost = 1,
-   kDelete = 2,
-+  kHead = 3,
- };
- 
- enum AuthType {
-@@ -72,6 +75,8 @@ enum AuthType {
+ struct ResourceRequest;
+@@ -58,6 +60,8 @@ enum class FetchErrorType {
  
  struct EndpointResponse {
    std::string response;
@@ -1992,15 +1951,7 @@ diff --git a/components/endpoint_fetcher/endpoint_fetcher.h b/components/endpoin
    int http_status_code{-1};
    std::optional<FetchErrorType> error_type;
  };
-@@ -359,6 +364,7 @@ class EndpointFetcher {
-       const std::vector<std::string>& headers,
-       const std::vector<std::string>& cors_exempt_headers,
-       version_info::Channel channel,
-+      const net::NetworkTrafficAnnotationTag& annotation_tag,
-       const RequestParams request_params);
- 
-   // Less preferred convenience constructor for requests requiring no
-@@ -375,6 +381,14 @@ class EndpointFetcher {
+@@ -175,6 +179,14 @@ class EndpointFetcher {
        const GURL& url,
        const net::NetworkTrafficAnnotationTag& annotation_tag);
  
@@ -2012,10 +1963,10 @@ diff --git a/components/endpoint_fetcher/endpoint_fetcher.h b/components/endpoin
 +                  const bool intercept_redirect,
 +                  const net::NetworkTrafficAnnotationTag& annotation_tag);
 +
-   // Used internally. Can be used if caller constructs their own
+   // Used for tests. Can be used if caller constructs their own
    // url_loader_factory and identity_manager.
    EndpointFetcher(
-@@ -424,11 +438,17 @@ class EndpointFetcher {
+@@ -231,6 +243,11 @@ class EndpointFetcher {
    void OnSanitizationResult(std::unique_ptr<EndpointResponse> response,
                              EndpointFetcherCallback endpoint_fetcher_callback,
                              data_decoder::JsonSanitizer::Result result);
@@ -2025,24 +1976,22 @@ diff --git a/components/endpoint_fetcher/endpoint_fetcher.h b/components/endpoin
 +                              const network::mojom::URLResponseHead& response_head,
 +                              std::vector<std::string>* removed_headers);
  
-   network::mojom::CredentialsMode GetCredentialsMode() const;
-   int GetMaxRetries() const;
-   bool GetSetSiteForCookies() const;
-   UploadProgressCallback GetUploadProgressCallback() const;
+   network::mojom::CredentialsMode GetCredentialsMode();
+   int GetMaxRetries();
+@@ -243,10 +260,11 @@ class EndpointFetcher {
+   // Members set in constructor to be passed to network::ResourceRequest or
+   // network::SimpleURLLoader.
+   const std::string oauth_consumer_name_;
+-  const GURL url_;
 +  GURL url_;
- 
-   // Members set in constructor
-   const scoped_refptr<network::SharedURLLoaderFactory> url_loader_factory_;
-@@ -436,6 +456,8 @@ class EndpointFetcher {
-   // this case, callers should invoke `PerformRequest` directly).
-   const raw_ptr<signin::IdentityManager> identity_manager_;
- 
+   const std::string http_method_;
+   const std::string content_type_;
+   base::TimeDelta timeout_;
 +  const bool intercept_redirect_;
-+
-   // The complete definition of the specific network request to be performed.
-   // Contains authentication details and response handling preferences.
-   const RequestParams request_params_;
-@@ -445,6 +467,9 @@ class EndpointFetcher {
+   const std::string post_data_;
+   const std::vector<std::string> headers_;
+   const std::vector<std::string> cors_exempt_headers_;
+@@ -270,6 +288,9 @@ class EndpointFetcher {
        access_token_fetcher_;
    std::unique_ptr<network::SimpleURLLoader> simple_url_loader_;
  
@@ -2052,29 +2001,6 @@ diff --git a/components/endpoint_fetcher/endpoint_fetcher.h b/components/endpoin
    base::WeakPtrFactory<EndpointFetcher> weak_ptr_factory_{this};
  };
  
-diff --git a/components/manta/base_provider.cc b/components/manta/base_provider.cc
---- a/components/manta/base_provider.cc
-+++ b/components/manta/base_provider.cc
-@@ -163,6 +163,7 @@ std::unique_ptr<EndpointFetcher> BaseProvider::CreateEndpointFetcherForDemoMode(
-       /*cors_exempt_headers=*/std::vector<std::string>(),
-       // ChromeOS always uses the stable channel API key
-       version_info::Channel::STABLE,
-+      annotation_tag,
-       EndpointFetcher::RequestParams::Builder(kHttpMethod, annotation_tag)
-           .Build());
- }
-diff --git a/components/omnibox/composebox/composebox_query_controller.cc b/components/omnibox/composebox/composebox_query_controller.cc
---- a/components/omnibox/composebox/composebox_query_controller.cc
-+++ b/components/omnibox/composebox/composebox_query_controller.cc
-@@ -314,7 +314,7 @@ ComposeboxQueryController::CreateEndpointFetcher(
-       /*post_data=*/std::move(request_string),
-       /*headers=*/request_headers,
-       /*cors_exempt_headers=*/cors_exempt_headers,
--      /*channel=*/channel_,
-+      /*channel=*/channel_, kTrafficAnnotationTag,
-       /*request_params=*/
-       EndpointFetcher::RequestParams::Builder(http_method,
-                                               kTrafficAnnotationTag)
 diff --git a/cromite_flags/chrome/browser/flags/android/chrome_feature_list_cc/Bromite-auto-updater.inc b/cromite_flags/chrome/browser/flags/android/chrome_feature_list_cc/Bromite-auto-updater.inc
 new file mode 100644
 --- /dev/null

build/patches/Bromite-package-name.patch

@@ -10,7 +10,7 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 diff --git a/chrome/android/chrome_public_apk_tmpl.gni b/chrome/android/chrome_public_apk_tmpl.gni
 --- a/chrome/android/chrome_public_apk_tmpl.gni
 +++ b/chrome/android/chrome_public_apk_tmpl.gni
-@@ -27,7 +27,7 @@ declare_args() {
+@@ -26,7 +26,7 @@ declare_args() {
    # WebView providers which declare one of a handful of package names. See
    # https://chromium.googlesource.com/chromium/src/+/HEAD/android_webview/docs/build-instructions.md#Changing-package-name
    # for details.

build/patches/Bromite-subresource-adblocker.patch

@@ -21,8 +21,8 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
  .../java/res/xml/adblock_preferences.xml      |  25 ++
  .../android/java/res/xml/main_preferences.xml |   5 +
  .../browser/settings/AdBlockEditor.java       |  91 ++++++
- .../browser/settings/AdBlockPreferences.java  |  74 +++++
- .../browser/settings/SettingsActivity.java    |   3 +
+ .../browser/settings/AdBlockPreferences.java  |  58 ++++
+ .../chrome/browser/tabmodel/TabModelImpl.java |   4 +-
  chrome/app/generated_resources.grd            |  10 +
  chrome/browser/after_startup_task_utils.cc    |   4 +
  chrome/browser/browser_process.h              |   6 +
@@ -44,14 +44,14 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
  .../component_updater/download_filters_task.h | 129 ++++++++
  ...ent_subresource_filter_throttle_manager.cc |  15 +
  ...tent_subresource_filter_throttle_manager.h |   2 +
- .../content/shared/browser/ruleset_service.cc |  44 ++-
+ .../content/shared/browser/ruleset_service.cc |  47 ++-
  .../content/shared/browser/ruleset_service.h  |   8 +-
  .../unindexed_ruleset_stream_generator.cc     |   3 +
  .../core/browser/ruleset_version.h            |   4 +
- .../browser/subresource_filter_features.cc    | 118 +-------
+ .../browser/subresource_filter_features.cc    | 114 +------
  .../core/browser/verified_ruleset_dealer.cc   |   4 +
  .../core/common/indexed_ruleset.cc            |   5 +-
- 39 files changed, 1287 insertions(+), 129 deletions(-)
+ 39 files changed, 1271 insertions(+), 129 deletions(-)
  create mode 100644 chrome/android/java/res/layout/adblock_editor.xml
  create mode 100644 chrome/android/java/res/xml/adblock_preferences.xml
  create mode 100644 chrome/android/java/src/org/chromium/chrome/browser/settings/AdBlockEditor.java
@@ -66,7 +66,7 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 diff --git a/chrome/android/BUILD.gn b/chrome/android/BUILD.gn
 --- a/chrome/android/BUILD.gn
 +++ b/chrome/android/BUILD.gn
-@@ -325,6 +325,7 @@ if (_is_default_toolchain) {
+@@ -322,6 +322,7 @@ if (current_toolchain == default_toolchain) {
        "//chrome/android/features/tab_ui/public:ui_java_resources",
        "//chrome/android/modules/stack_unwinder/provider:java",
        "//chrome/android/webapk/libs/client:client_java",
@@ -77,7 +77,7 @@ diff --git a/chrome/android/BUILD.gn b/chrome/android/BUILD.gn
 diff --git a/chrome/android/chrome_java_resources.gni b/chrome/android/chrome_java_resources.gni
 --- a/chrome/android/chrome_java_resources.gni
 +++ b/chrome/android/chrome_java_resources.gni
-@@ -419,6 +419,7 @@ chrome_java_resources = [
+@@ -436,6 +436,7 @@ chrome_java_resources = [
    "java/res/layout/account_divider_preference.xml",
    "java/res/layout/account_management_account_row.xml",
    "java/res/layout/app_history_filter.xml",
@@ -85,10 +85,10 @@ diff --git a/chrome/android/chrome_java_resources.gni b/chrome/android/chrome_ja
    "java/res/layout/auto_sign_in_first_run_dialog.xml",
    "java/res/layout/autofill_billing_address_dropdown.xml",
    "java/res/layout/autofill_card_name_and_number.xml",
-@@ -608,6 +609,7 @@ chrome_java_resources = [
+@@ -624,6 +625,7 @@ chrome_java_resources = [
+   "java/res/xml/about_chrome_preferences.xml",
    "java/res/xml/account_management_preferences.xml",
    "java/res/xml/ad_services_config.xml",
-   "java/res/xml/appearance_preferences.xml",
 +  "java/res/xml/adblock_preferences.xml",
    "java/res/xml/bookmark_widget_info.xml",
    "java/res/xml/clear_browsing_data_preferences.xml",
@@ -96,7 +96,7 @@ diff --git a/chrome/android/chrome_java_resources.gni b/chrome/android/chrome_ja
 diff --git a/chrome/android/chrome_java_sources.gni b/chrome/android/chrome_java_sources.gni
 --- a/chrome/android/chrome_java_sources.gni
 +++ b/chrome/android/chrome_java_sources.gni
-@@ -903,6 +903,8 @@ chrome_java_sources = [
+@@ -941,6 +941,8 @@ chrome_java_sources = [
    "java/src/org/chromium/chrome/browser/permissions/PermissionBlockedDialog.java",
    "java/src/org/chromium/chrome/browser/permissions/PermissionUpdateRequester.java",
    "java/src/org/chromium/chrome/browser/photo_picker/DecoderServiceImpl.java",
@@ -180,8 +180,8 @@ new file mode 100644
 diff --git a/chrome/android/java/res/values/styles.xml b/chrome/android/java/res/values/styles.xml
 --- a/chrome/android/java/res/values/styles.xml
 +++ b/chrome/android/java/res/values/styles.xml
-@@ -273,6 +273,24 @@ found in the LICENSE file.
-         <item name="android:textSize">20sp</item>
+@@ -256,6 +256,24 @@ found in the LICENSE file.
+         </item>
      </style>
  
 +    <style name="ButtonBarTopSpacer" parent="ButtonBarTopSpacerLight">
@@ -364,7 +364,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/settings/AdBloc
 new file mode 100644
 --- /dev/null
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/settings/AdBlockPreferences.java
-@@ -0,0 +1,74 @@
+@@ -0,0 +1,58 @@
 +// Copyright 2015 The Chromium Authors. All rights reserved.
 +// Use of this source code is governed by a BSD-style license that can be
 +// found in the LICENSE file.
@@ -374,46 +374,30 @@ new file mode 100644
 +import android.os.Bundle;
 +import androidx.preference.Preference;
 +import androidx.preference.PreferenceFragmentCompat;
-+
-+import org.chromium.base.supplier.ObservableSupplier;
-+import org.chromium.base.supplier.ObservableSupplierImpl;
-+import org.chromium.base.supplier.Supplier;
++import org.chromium.components.browser_ui.settings.ChromeSwitchPreference;
 +
 +import org.chromium.content_public.browser.BrowserContextHandle;
-+import org.chromium.components.browser_ui.settings.ChromeSwitchPreference;
 +import org.chromium.components.browser_ui.site_settings.BaseSiteSettingsFragment;
 +import org.chromium.components.browser_ui.site_settings.WebsitePreferenceBridge;
 +import org.chromium.components.content_settings.ContentSettingsType;
 +import org.chromium.components.browser_ui.settings.SettingsUtils;
-+import org.chromium.components.browser_ui.settings.SettingsFragment;
-+
-+import org.chromium.chrome.R;
 +import org.chromium.chrome.browser.flags.AdBlockNativeGateway;
-+import org.chromium.chrome.browser.settings.ChromeBaseSettingsFragment;
++import androidx.annotation.VisibleForTesting;
++import org.chromium.chrome.R;
 +
 +/**
 + * Fragment that allows the user to configure AdBlock related preferences.
 + */
-+public class AdBlockPreferences extends ChromeBaseSettingsFragment {
++public class AdBlockPreferences extends BaseSiteSettingsFragment {
++    @VisibleForTesting
 +    public static final String PREF_ADBLOCK_SWITCH = "adblock_switch";
 +    private static final String PREF_ADBLOCK_EDIT = "adblock_edit";
 +
 +    private Preference mAdBlockEdit;
-+    private final ObservableSupplierImpl<String> mPageTitle = new ObservableSupplierImpl<>();
-+
-+    @Override
-+    public ObservableSupplier<String> getPageTitle() {
-+        return mPageTitle;
-+    }
-+
-+    @Override
-+    public @SettingsFragment.AnimationType int getAnimationType() {
-+        return SettingsFragment.AnimationType.PROPERTY;
-+    }
 +
 +    @Override
 +    public void onCreatePreferences(Bundle savedInstanceState, String rootKey) {
-+        mPageTitle.set(getString(R.string.options_adblock_title));
++        getActivity().setTitle(R.string.options_adblock_title);
 +        SettingsUtils.addPreferencesFromResource(this, R.xml.adblock_preferences);
 +
 +        ChromeSwitchPreference mAdBlockSwitch =
@@ -439,30 +423,24 @@ new file mode 100644
 +        updateCurrentAdBlockUrl();
 +    }
 +}
-diff --git a/chrome/android/java/src/org/chromium/chrome/browser/settings/SettingsActivity.java b/chrome/android/java/src/org/chromium/chrome/browser/settings/SettingsActivity.java
---- a/chrome/android/java/src/org/chromium/chrome/browser/settings/SettingsActivity.java
-+++ b/chrome/android/java/src/org/chromium/chrome/browser/settings/SettingsActivity.java
-@@ -72,6 +72,8 @@ import org.chromium.ui.modaldialog.ModalDialogManager.ModalDialogType;
- import java.lang.ref.WeakReference;
- import java.util.Locale;
+diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/TabModelImpl.java b/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/TabModelImpl.java
+--- a/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/TabModelImpl.java
++++ b/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/TabModelImpl.java
+@@ -923,9 +923,7 @@ public class TabModelImpl extends TabModelJniBridge {
+                 .createTabWithWebContents(
+                         parent,
+                         webContents,
+-                        select
+-                                ? TabLaunchType.FROM_RECENT_TABS_FOREGROUND
+-                                : TabLaunchType.FROM_RECENT_TABS);
++                        TabLaunchType.FROM_LINK);
+     }
  
-+import org.chromium.chrome.browser.settings.AdBlockEditor;
-+
- /**
-  * The Chrome settings activity.
-  *
-@@ -683,6 +685,7 @@ public class SettingsActivity extends ChromeBaseAppCompatActivity
-             if (!MAIN_FRAGMENT_TAG.equals(fragment.getTag())) {
-                 return;
-             }
-+            if (fragment instanceof AdBlockEditor) return;
- 
-             String className = fragment.getClass().getSimpleName();
-             RecordHistogram.recordSparseHistogram(
+     @Override
 diff --git a/chrome/app/generated_resources.grd b/chrome/app/generated_resources.grd
 --- a/chrome/app/generated_resources.grd
 +++ b/chrome/app/generated_resources.grd
-@@ -16888,6 +16888,16 @@ Please help our engineers fix this problem. Tell us what happened right before y
+@@ -16490,6 +16490,16 @@ Please help our engineers fix this problem. Tell us what happened right before y
        Never show this again.
      </message>
  
@@ -482,16 +460,16 @@ diff --git a/chrome/app/generated_resources.grd b/chrome/app/generated_resources
 diff --git a/chrome/browser/after_startup_task_utils.cc b/chrome/browser/after_startup_task_utils.cc
 --- a/chrome/browser/after_startup_task_utils.cc
 +++ b/chrome/browser/after_startup_task_utils.cc
-@@ -24,6 +24,8 @@
- #include "chrome/browser/ui/ash/login/login_display_host.h"
- #endif
+@@ -29,6 +29,8 @@
+ #include "chromeos/startup/browser_params_proxy.h"
+ #endif  // BUILDFLAG(IS_CHROMEOS_LACROS)
  
 +#include "chrome/browser/browser_process.h"
 +
  using content::BrowserThread;
  
  namespace {
-@@ -129,6 +131,8 @@ void SetBrowserStartupIsComplete() {
+@@ -134,6 +136,8 @@ void SetBrowserStartupIsComplete() {
    }
    GetAfterStartupTasks().clear();
    GetAfterStartupTasks().shrink_to_fit();
@@ -503,7 +481,7 @@ diff --git a/chrome/browser/after_startup_task_utils.cc b/chrome/browser/after_s
 diff --git a/chrome/browser/browser_process.h b/chrome/browser/browser_process.h
 --- a/chrome/browser/browser_process.h
 +++ b/chrome/browser/browser_process.h
-@@ -31,6 +31,7 @@
+@@ -32,6 +32,7 @@
  #include "chrome/common/buildflags.h"
  #include "components/safe_browsing/buildflags.h"
  #include "media/media_buildflags.h"
@@ -511,7 +489,7 @@ diff --git a/chrome/browser/browser_process.h b/chrome/browser/browser_process.h
  
  class BackgroundModeManager;
  class BrowserProcessPlatformPart;
-@@ -88,6 +89,10 @@ namespace component_updater {
+@@ -89,6 +90,10 @@ namespace component_updater {
  class ComponentUpdateService;
  }
  
@@ -522,7 +500,7 @@ diff --git a/chrome/browser/browser_process.h b/chrome/browser/browser_process.h
  namespace gcm {
  class GCMDriver;
  }
-@@ -271,6 +276,7 @@ class BrowserProcess {
+@@ -269,6 +274,7 @@ class BrowserProcess {
  #endif
  
    virtual component_updater::ComponentUpdateService* component_updater() = 0;
@@ -533,7 +511,7 @@ diff --git a/chrome/browser/browser_process.h b/chrome/browser/browser_process.h
 diff --git a/chrome/browser/browser_process_impl.cc b/chrome/browser/browser_process_impl.cc
 --- a/chrome/browser/browser_process_impl.cc
 +++ b/chrome/browser/browser_process_impl.cc
-@@ -1273,6 +1273,34 @@ BrowserProcessImpl::component_updater() {
+@@ -1240,6 +1240,34 @@ BrowserProcessImpl::component_updater() {
    return component_updater_.get();
  }
  
@@ -571,7 +549,7 @@ diff --git a/chrome/browser/browser_process_impl.cc b/chrome/browser/browser_pro
 diff --git a/chrome/browser/browser_process_impl.h b/chrome/browser/browser_process_impl.h
 --- a/chrome/browser/browser_process_impl.h
 +++ b/chrome/browser/browser_process_impl.h
-@@ -212,6 +212,7 @@ class BrowserProcessImpl : public BrowserProcess,
+@@ -217,6 +217,7 @@ class BrowserProcessImpl : public BrowserProcess,
  #endif
  
    component_updater::ComponentUpdateService* component_updater() override;
@@ -590,7 +568,7 @@ diff --git a/chrome/browser/browser_process_impl.h b/chrome/browser/browser_proc
 diff --git a/chrome/browser/chrome_browser_main.cc b/chrome/browser/chrome_browser_main.cc
 --- a/chrome/browser/chrome_browser_main.cc
 +++ b/chrome/browser/chrome_browser_main.cc
-@@ -384,6 +384,9 @@ StartupProfileInfo CreateInitialProfile(
+@@ -468,6 +468,9 @@ StartupProfileInfo CreateInitialProfile(
    // missing code in the above test.
    CHECK(profile_info.profile) << "Cannot get default profile.";
  
@@ -598,8 +576,8 @@ diff --git a/chrome/browser/chrome_browser_main.cc b/chrome/browser/chrome_brows
 +  g_browser_process->adblock_updater();
 +
  #else
-   profile_info =
-       GetStartupProfile(/*cur_dir=*/base::FilePath(), parsed_command_line);
+ #if BUILDFLAG(IS_CHROMEOS_LACROS)
+   // Lacros has a special "primary" profile that is tied to the active ChromeOS
 diff --git a/chrome/browser/flags/BUILD.gn b/chrome/browser/flags/BUILD.gn
 --- a/chrome/browser/flags/BUILD.gn
 +++ b/chrome/browser/flags/BUILD.gn
@@ -701,9 +679,9 @@ new file mode 100755
 diff --git a/chrome/browser/net/system_network_context_manager.cc b/chrome/browser/net/system_network_context_manager.cc
 --- a/chrome/browser/net/system_network_context_manager.cc
 +++ b/chrome/browser/net/system_network_context_manager.cc
-@@ -721,6 +721,10 @@ void SystemNetworkContextManager::RegisterPrefs(PrefRegistrySimple* registry) {
+@@ -640,6 +640,10 @@ void SystemNetworkContextManager::RegisterPrefs(PrefRegistrySimple* registry) {
+   StubResolverConfigReader::RegisterPrefs(registry);
    DefaultDnsOverHttpsConfigSource::RegisterPrefs(registry);
-   NetworkProcessLaunchWatcher::RegisterPrefs(registry);
  
 +  registry->RegisterBooleanPref(prefs::kAdBlockEnabled, false);
 +  registry->RegisterStringPref(prefs::kAdBlockFiltersURL,
@@ -732,8 +710,8 @@ diff --git a/chrome/browser/sessions/session_restore_android.cc b/chrome/browser
 diff --git a/chrome/browser/ui/android/strings/android_chrome_strings.grd b/chrome/browser/ui/android/strings/android_chrome_strings.grd
 --- a/chrome/browser/ui/android/strings/android_chrome_strings.grd
 +++ b/chrome/browser/ui/android/strings/android_chrome_strings.grd
-@@ -221,6 +221,20 @@ CHAR_LIMIT guidelines:
-         <ph name="PREF_TITLE">%1$s</ph>  <ph name="BEGIN_NEW">&lt;new&gt;</ph>New<ph name="END_NEW">&lt;/new&gt;</ph>
+@@ -218,6 +218,20 @@ CHAR_LIMIT guidelines:
+         Advanced
        </message>
  
 +      <!-- AdBlock settings -->
@@ -756,7 +734,7 @@ diff --git a/chrome/browser/ui/android/strings/android_chrome_strings.grd b/chro
 diff --git a/chrome/common/pref_names.h b/chrome/common/pref_names.h
 --- a/chrome/common/pref_names.h
 +++ b/chrome/common/pref_names.h
-@@ -2907,6 +2907,11 @@ inline constexpr char kAudioCaptureAllowed[] = "hardware.audio_capture_enabled";
+@@ -2868,6 +2868,11 @@ inline constexpr char kAudioCaptureAllowed[] = "hardware.audio_capture_enabled";
  inline constexpr char kAudioCaptureAllowedUrls[] =
      "hardware.audio_capture_allowed_urls";
  
@@ -771,7 +749,7 @@ diff --git a/chrome/common/pref_names.h b/chrome/common/pref_names.h
 diff --git a/components/browser_ui/strings/android/site_settings.grdp b/components/browser_ui/strings/android/site_settings.grdp
 --- a/components/browser_ui/strings/android/site_settings.grdp
 +++ b/components/browser_ui/strings/android/site_settings.grdp
-@@ -391,6 +391,9 @@
+@@ -373,6 +373,9 @@
    <message name="IDS_INTRUSIVE_ADS_INFORMATION" desc="The extra information at the top of the Site Details page when the site tends to show intrusive ads">
      This site shows intrusive or misleading ads
    </message>
@@ -1596,16 +1574,16 @@ diff --git a/components/subresource_filter/content/browser/content_subresource_f
 --- a/components/subresource_filter/content/browser/content_subresource_filter_throttle_manager.cc
 +++ b/components/subresource_filter/content/browser/content_subresource_filter_throttle_manager.cc
 @@ -18,6 +18,9 @@
+ #include "base/strings/stringprintf.h"
  #include "base/trace_event/trace_event.h"
  #include "base/trace_event/traced_value.h"
- #include "base/tracing/protos/chrome_track_event.pbzero.h"
 +#include "components/content_settings/core/common/content_settings_types.h"
 +#include "components/subresource_filter/content/browser/subresource_filter_content_settings_manager.h"
 +#include "components/subresource_filter/content/browser/subresource_filter_profile_context.h"
  #include "components/subresource_filter/content/browser/ad_tagging_utils.h"
  #include "components/subresource_filter/content/browser/content_subresource_filter_web_contents_helper.h"
  #include "components/subresource_filter/content/browser/profile_interaction_manager.h"
-@@ -114,6 +117,7 @@ ContentSubresourceFilterThrottleManager::
+@@ -112,6 +115,7 @@ ContentSubresourceFilterThrottleManager::
        profile_interaction_manager_(
            std::make_unique<subresource_filter::ProfileInteractionManager>(
                profile_context)),
@@ -1613,17 +1591,17 @@ diff --git a/components/subresource_filter/content/browser/content_subresource_f
        web_contents_helper_(web_contents_helper) {}
  
  ContentSubresourceFilterThrottleManager::
-@@ -628,6 +632,17 @@ ContentSubresourceFilterThrottleManager::
+@@ -679,6 +683,17 @@ ContentSubresourceFilterThrottleManager::
        throttle->NotifyPageActivationWithRuleset(EnsureRulesetHandle(),
                                                  ad_tagging_state);
      }
 +
-+    const GURL& url(navigation_handle.GetURL());
++    const GURL& url(navigation_handle->GetURL());
 +    if (profile_context_->settings_manager()->GetSitePermission(url) != CONTENT_SETTING_ALLOW) {
 +      subresource_filter::ActivationDecision ignored_decision;
 +      mojom::ActivationState ad_filtering_state;
 +      ad_filtering_state.activation_level = profile_interaction_manager_->OnPageActivationComputed(
-+	      &navigation_handle, mojom::ActivationLevel::kEnabled, &ignored_decision);
++	      navigation_handle, mojom::ActivationLevel::kEnabled, &ignored_decision);
 +      throttle->NotifyPageActivationWithRuleset(EnsureRulesetHandle(),
 +                                                ad_filtering_state);
 +    }
@@ -1634,7 +1612,7 @@ diff --git a/components/subresource_filter/content/browser/content_subresource_f
 diff --git a/components/subresource_filter/content/browser/content_subresource_filter_throttle_manager.h b/components/subresource_filter/content/browser/content_subresource_filter_throttle_manager.h
 --- a/components/subresource_filter/content/browser/content_subresource_filter_throttle_manager.h
 +++ b/components/subresource_filter/content/browser/content_subresource_filter_throttle_manager.h
-@@ -403,6 +403,8 @@ class ContentSubresourceFilterThrottleManager
+@@ -414,6 +414,8 @@ class ContentSubresourceFilterThrottleManager
  
    std::unique_ptr<ProfileInteractionManager> profile_interaction_manager_;
  
@@ -1646,7 +1624,7 @@ diff --git a/components/subresource_filter/content/browser/content_subresource_f
 diff --git a/components/subresource_filter/content/shared/browser/ruleset_service.cc b/components/subresource_filter/content/shared/browser/ruleset_service.cc
 --- a/components/subresource_filter/content/shared/browser/ruleset_service.cc
 +++ b/components/subresource_filter/content/shared/browser/ruleset_service.cc
-@@ -50,12 +50,7 @@ namespace {
+@@ -51,12 +51,7 @@ namespace {
  void RecordIndexAndWriteRulesetResult(
      std::string_view uma_tag,
      RulesetService::IndexAndWriteRulesetResult result) {
@@ -1660,22 +1638,23 @@ diff --git a/components/subresource_filter/content/shared/browser/ruleset_servic
  }
  
  // Implements operations on a `sentinel file`, which is used as a safeguard to
-@@ -237,11 +232,13 @@ RulesetService::RulesetService(
+@@ -237,10 +232,13 @@ RulesetService::RulesetService(
  RulesetService::~RulesetService() = default;
  
  void RulesetService::IndexAndStoreAndPublishRulesetIfNeeded(
 -    const UnindexedRulesetInfo& unindexed_ruleset_info) {
+-  if (unindexed_ruleset_info.content_version.empty())
 +    const UnindexedRulesetInfo& unindexed_ruleset_info, bool ignore_recent_version) {
-   if (unindexed_ruleset_info.content_version.empty()) {
++  if (unindexed_ruleset_info.content_version.empty()) {
 +    LOG(INFO) << "RulesetService: ignoring update with empty version.";
      return;
-   }
++  }
  
 +  if (!ignore_recent_version) {
    // Trying to store a ruleset with the same version for a second time would
    // not only be futile, but would fail on Windows due to "File System
    // Tunneling" as long as the previously stored copy of the rules is still
-@@ -251,13 +248,16 @@ void RulesetService::IndexAndStoreAndPublishRulesetIfNeeded(
+@@ -250,13 +248,16 @@ void RulesetService::IndexAndStoreAndPublishRulesetIfNeeded(
    if (most_recently_indexed_version.IsCurrentFormatVersion() &&
        most_recently_indexed_version.content_version ==
            unindexed_ruleset_info.content_version) {
@@ -1692,7 +1671,7 @@ diff --git a/components/subresource_filter/content/shared/browser/ruleset_servic
      return;
    }
  
-@@ -277,6 +277,23 @@ IndexedRulesetVersion RulesetService::IndexAndWriteRuleset(
+@@ -276,6 +277,23 @@ IndexedRulesetVersion RulesetService::IndexAndWriteRuleset(
      const RulesetConfig& config,
      const base::FilePath& indexed_ruleset_base_dir,
      const UnindexedRulesetInfo& unindexed_ruleset_info) {
@@ -1716,7 +1695,7 @@ diff --git a/components/subresource_filter/content/shared/browser/ruleset_servic
    base::ScopedBlockingCall scoped_blocking_call(FROM_HERE,
                                                  base::BlockingType::MAY_BLOCK);
  
-@@ -284,6 +301,7 @@ IndexedRulesetVersion RulesetService::IndexAndWriteRuleset(
+@@ -283,6 +301,7 @@ IndexedRulesetVersion RulesetService::IndexAndWriteRuleset(
        unindexed_ruleset_info);
  
    if (!unindexed_ruleset_stream_generator.ruleset_stream()) {
@@ -1724,7 +1703,7 @@ diff --git a/components/subresource_filter/content/shared/browser/ruleset_servic
      RecordIndexAndWriteRulesetResult(
          config.uma_tag,
          IndexAndWriteRulesetResult::kFailedOpeningUnindexedRuleset);
-@@ -298,6 +316,7 @@ IndexedRulesetVersion RulesetService::IndexAndWriteRuleset(
+@@ -297,6 +316,7 @@ IndexedRulesetVersion RulesetService::IndexAndWriteRuleset(
            indexed_ruleset_base_dir, indexed_version);
  
    if (!base::CreateDirectory(indexed_ruleset_version_dir)) {
@@ -1732,7 +1711,7 @@ diff --git a/components/subresource_filter/content/shared/browser/ruleset_servic
      RecordIndexAndWriteRulesetResult(
          config.uma_tag, IndexAndWriteRulesetResult::kFailedCreatingVersionDir);
      return IndexedRulesetVersion(config.filter_tag);
-@@ -305,13 +324,11 @@ IndexedRulesetVersion RulesetService::IndexAndWriteRuleset(
+@@ -304,13 +324,11 @@ IndexedRulesetVersion RulesetService::IndexAndWriteRuleset(
  
    SentinelFile sentinel_file(indexed_ruleset_version_dir);
    if (sentinel_file.IsPresent()) {
@@ -1748,7 +1727,7 @@ diff --git a/components/subresource_filter/content/shared/browser/ruleset_servic
      RecordIndexAndWriteRulesetResult(
          config.uma_tag,
          IndexAndWriteRulesetResult::kFailedCreatingSentinelFile);
-@@ -326,6 +343,7 @@ IndexedRulesetVersion RulesetService::IndexAndWriteRuleset(
+@@ -325,6 +343,7 @@ IndexedRulesetVersion RulesetService::IndexAndWriteRuleset(
    RulesetIndexer indexer;
    if (!(*g_index_ruleset_func)(config, &unindexed_ruleset_stream_generator,
                                 &indexer)) {
@@ -1756,7 +1735,7 @@ diff --git a/components/subresource_filter/content/shared/browser/ruleset_servic
      RecordIndexAndWriteRulesetResult(
          config.uma_tag,
          IndexAndWriteRulesetResult::kFailedParsingUnindexedRuleset);
-@@ -346,9 +364,12 @@ IndexedRulesetVersion RulesetService::IndexAndWriteRuleset(
+@@ -345,9 +364,12 @@ IndexedRulesetVersion RulesetService::IndexAndWriteRuleset(
                     unindexed_ruleset_info.license_path, indexer.data());
    RecordIndexAndWriteRulesetResult(config.uma_tag, result);
    if (result != IndexAndWriteRulesetResult::kSuccess) {
@@ -1766,17 +1745,17 @@ diff --git a/components/subresource_filter/content/shared/browser/ruleset_servic
  
 +  LOG(INFO) << "RulesetService: successful parsing.";
 +
-   CHECK(indexed_version.IsValid());
+   CHECK(indexed_version.IsValid(), base::NotFatalUntil::M129);
    return indexed_version;
  }
-@@ -472,6 +493,7 @@ void RulesetService::IndexAndStoreRuleset(
+@@ -470,6 +492,7 @@ void RulesetService::IndexAndStoreRuleset(
  void RulesetService::OnWrittenRuleset(WriteRulesetCallback result_callback,
                                        const IndexedRulesetVersion& version) {
-   CHECK(!result_callback.is_null());
+   CHECK(!result_callback.is_null(), base::NotFatalUntil::M129);
 +  LOG(INFO) << "RulesetService: valid version: " << version.IsValid();
-   if (!version.IsValid()) {
+   if (!version.IsValid())
      return;
-   }
+   version.SaveToPrefs(local_state_);
 diff --git a/components/subresource_filter/content/shared/browser/ruleset_service.h b/components/subresource_filter/content/shared/browser/ruleset_service.h
 --- a/components/subresource_filter/content/shared/browser/ruleset_service.h
 +++ b/components/subresource_filter/content/shared/browser/ruleset_service.h
@@ -1805,7 +1784,7 @@ diff --git a/components/subresource_filter/content/shared/browser/ruleset_servic
 diff --git a/components/subresource_filter/content/shared/browser/unindexed_ruleset_stream_generator.cc b/components/subresource_filter/content/shared/browser/unindexed_ruleset_stream_generator.cc
 --- a/components/subresource_filter/content/shared/browser/unindexed_ruleset_stream_generator.cc
 +++ b/components/subresource_filter/content/shared/browser/unindexed_ruleset_stream_generator.cc
-@@ -12,6 +12,7 @@
+@@ -13,6 +13,7 @@
  #include "third_party/protobuf/src/google/protobuf/io/zero_copy_stream_impl.h"
  #include "third_party/protobuf/src/google/protobuf/io/zero_copy_stream_impl_lite.h"
  #include "ui/base/resource/resource_bundle.h"
@@ -1813,7 +1792,7 @@ diff --git a/components/subresource_filter/content/shared/browser/unindexed_rule
  
  namespace subresource_filter {
  
-@@ -46,6 +47,8 @@ void UnindexedRulesetStreamGenerator::GenerateStreamFromFile(
+@@ -49,6 +50,8 @@ void UnindexedRulesetStreamGenerator::GenerateStreamFromFile(
  
    ruleset_size_ = unindexed_ruleset_file.GetLength();
  
@@ -1825,7 +1804,7 @@ diff --git a/components/subresource_filter/content/shared/browser/unindexed_rule
 diff --git a/components/subresource_filter/core/browser/ruleset_version.h b/components/subresource_filter/core/browser/ruleset_version.h
 --- a/components/subresource_filter/core/browser/ruleset_version.h
 +++ b/components/subresource_filter/core/browser/ruleset_version.h
-@@ -53,6 +53,10 @@ struct UnindexedRulesetInfo {
+@@ -54,6 +54,10 @@ struct UnindexedRulesetInfo {
    // can be indicated not only by setting |license_path| to empty, but also by
    // setting it to any non existent path.
    base::FilePath license_path;
@@ -1839,7 +1818,7 @@ diff --git a/components/subresource_filter/core/browser/ruleset_version.h b/comp
 diff --git a/components/subresource_filter/core/browser/subresource_filter_features.cc b/components/subresource_filter/core/browser/subresource_filter_features.cc
 --- a/components/subresource_filter/core/browser/subresource_filter_features.cc
 +++ b/components/subresource_filter/core/browser/subresource_filter_features.cc
-@@ -55,75 +55,8 @@ class CommaSeparatedStrings {
+@@ -55,71 +55,8 @@ class CommaSeparatedStrings {
    const std::vector<std::string_view> pieces_;
  };
  
@@ -1847,9 +1826,8 @@ diff --git a/components/subresource_filter/core/browser/subresource_filter_featu
 -    std::map<std::string, std::string>* params,
 -    const std::string& key) {
 -  auto it = params->find(key);
--  if (it == params->end()) {
+-  if (it == params->end())
 -    return std::string();
--  }
 -  std::string value = std::move(it->second);
 -  params->erase(it);
 -  return value;
@@ -1857,23 +1835,21 @@ diff --git a/components/subresource_filter/core/browser/subresource_filter_featu
 -
 -mojom::ActivationLevel ParseActivationLevel(std::string_view activation_level) {
 -  if (base::EqualsCaseInsensitiveASCII(activation_level,
--                                       kActivationLevelEnabled)) {
+-                                       kActivationLevelEnabled))
 -    return mojom::ActivationLevel::kEnabled;
--  } else if (base::EqualsCaseInsensitiveASCII(activation_level,
--                                              kActivationLevelDryRun)) {
+-  else if (base::EqualsCaseInsensitiveASCII(activation_level,
+-                                            kActivationLevelDryRun))
 -    return mojom::ActivationLevel::kDryRun;
--  }
 -  return mojom::ActivationLevel::kDisabled;
 -}
 -
 -ActivationScope ParseActivationScope(std::string_view activation_scope) {
 -  if (base::EqualsCaseInsensitiveASCII(activation_scope,
--                                       kActivationScopeAllSites)) {
+-                                       kActivationScopeAllSites))
 -    return ActivationScope::ALL_SITES;
--  } else if (base::EqualsCaseInsensitiveASCII(activation_scope,
--                                              kActivationScopeActivationList)) {
+-  else if (base::EqualsCaseInsensitiveASCII(activation_scope,
+-                                            kActivationScopeActivationList))
 -    return ActivationScope::ACTIVATION_LIST;
--  }
 -  return ActivationScope::NO_SITES;
 -}
 -
@@ -1898,9 +1874,8 @@ diff --git a/components/subresource_filter/core/browser/subresource_filter_featu
 -// Will return a value between 0 and 1 inclusive.
 -double ParsePerformanceMeasurementRate(const std::string& rate) {
 -  double value = 0.0;
--  if (!base::StringToDouble(rate, &value) || value < 0) {
+-  if (!base::StringToDouble(rate, &value) || value < 0)
 -    return 0.0;
--  }
 -  return value < 1 ? value : 1;
 -}
 -
@@ -1909,14 +1884,14 @@ diff --git a/components/subresource_filter/core/browser/subresource_filter_featu
 -  base::StringToInt(value, &result);
 -  return result;
 -}
--
- std::vector<Configuration> FillEnabledPresetConfigurations(
+ 
+-std::vector<Configuration> FillEnabledPresetConfigurations(
 -    std::map<std::string, std::string>* params) {
-+    /*std::map<std::string, std::string>* params*/) {
++std::vector<Configuration> FillEnabledPresetConfigurations() {
    // If ad tagging is enabled, turn on the dryrun automatically.
    bool ad_tagging_enabled = base::FeatureList::IsEnabled(kAdTagging);
    const struct {
-@@ -131,23 +64,16 @@ std::vector<Configuration> FillEnabledPresetConfigurations(
+@@ -127,23 +64,16 @@ std::vector<Configuration> FillEnabledPresetConfigurations(
      bool enabled_by_default;
      Configuration (*factory_method)();
    } kAvailablePresetConfigurations[] = {
@@ -1942,7 +1917,7 @@ diff --git a/components/subresource_filter/core/browser/subresource_filter_featu
        enabled_configurations.push_back(available_preset.factory_method());
      }
    }
-@@ -155,48 +81,12 @@ std::vector<Configuration> FillEnabledPresetConfigurations(
+@@ -151,46 +81,10 @@ std::vector<Configuration> FillEnabledPresetConfigurations(
    return enabled_configurations;
  }
  
@@ -1981,17 +1956,15 @@ diff --git a/components/subresource_filter/core/browser/subresource_filter_featu
 -  base::GetFieldTrialParamsByFeature(kSafeBrowsingSubresourceFilter, &params);
 -
    std::vector<Configuration> configs;
-   if (base::FeatureList::IsEnabled(kSafeBrowsingSubresourceFilter)) {
+   if (base::FeatureList::IsEnabled(kSafeBrowsingSubresourceFilter))
 -    configs = FillEnabledPresetConfigurations(&params);
-+    configs = FillEnabledPresetConfigurations();
-   }
- 
+-
 -  Configuration experimental_config = ParseExperimentalConfiguration(&params);
 -  configs.push_back(std::move(experimental_config));
--
++    configs = FillEnabledPresetConfigurations();
+ 
    return configs;
  }
- 
 diff --git a/components/subresource_filter/core/browser/verified_ruleset_dealer.cc b/components/subresource_filter/core/browser/verified_ruleset_dealer.cc
 --- a/components/subresource_filter/core/browser/verified_ruleset_dealer.cc
 +++ b/components/subresource_filter/core/browser/verified_ruleset_dealer.cc
@@ -2000,10 +1973,10 @@ diff --git a/components/subresource_filter/core/browser/verified_ruleset_dealer.
  #include "base/functional/callback_helpers.h"
  #include "base/location.h"
 +#include "base/logging.h"
+ #include "base/not_fatal_until.h"
  #include "base/notreached.h"
  #include "base/task/sequenced_task_runner.h"
- #include "base/trace_event/trace_event.h"
-@@ -39,6 +40,9 @@ RulesetFilePtr VerifiedRulesetDealer::OpenAndSetRulesetFile(
+@@ -40,6 +41,9 @@ RulesetFilePtr VerifiedRulesetDealer::OpenAndSetRulesetFile(
    TRACE_EVENT1(TRACE_DISABLED_BY_DEFAULT("loading"),
                 "VerifiedRulesetDealer::OpenAndSetRulesetFile", "file_valid",
                 file->IsValid());
@@ -2022,9 +1995,9 @@ diff --git a/components/subresource_filter/core/common/indexed_ruleset.cc b/comp
  #include "base/hash/hash.h"
 +#include "base/logging.h"
  #include "base/metrics/histogram_functions.h"
+ #include "base/not_fatal_until.h"
  #include "base/strings/strcat.h"
- #include "base/trace_event/trace_event.h"
-@@ -37,7 +38,9 @@ VerifyStatus GetVerifyStatus(base::span<const uint8_t> buffer,
+@@ -38,7 +39,9 @@ VerifyStatus GetVerifyStatus(base::span<const uint8_t> buffer,
    // least once.  The verifier detects a subset of the errors detected by the
    // checksum, and is unneeded once expected_checksum is consistently nonzero.
    flatbuffers::Verifier verifier(buffer.data(), buffer.size());

build/patches/Bubble-Locking-on-UI-DevTools.patch

@@ -15,7 +15,7 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 diff --git a/chrome/browser/ui/views/toolbar/reload_button.cc b/chrome/browser/ui/views/toolbar/reload_button.cc
 --- a/chrome/browser/ui/views/toolbar/reload_button.cc
 +++ b/chrome/browser/ui/views/toolbar/reload_button.cc
-@@ -225,6 +225,14 @@ void ReloadButton::ButtonPressed(const ui::Event& event) {
+@@ -226,6 +226,14 @@ void ReloadButton::ButtonPressed(const ui::Event& event) {
        command = IDC_RELOAD;
      }
  
@@ -33,9 +33,9 @@ diff --git a/chrome/browser/ui/views/toolbar/reload_button.cc b/chrome/browser/u
 diff --git a/ui/views/widget/widget.h b/ui/views/widget/widget.h
 --- a/ui/views/widget/widget.h
 +++ b/ui/views/widget/widget.h
-@@ -1456,6 +1456,19 @@ class VIEWS_EXPORT Widget : public internal::NativeWidgetDelegate,
- 
-   WidgetAXManager* ax_manager() { return ax_manager_.get(); }
+@@ -1362,6 +1362,19 @@ class VIEWS_EXPORT Widget : public internal::NativeWidgetDelegate,
+   void UpdateAccessibleNameForRootView();
+   void UpdateAccessibleURLForRootView(const GURL& url);
  
 +  // Type of ways to ignore activation changes.
 +  enum class DisableActivationChangeHandlingType {
@@ -53,7 +53,7 @@ diff --git a/ui/views/widget/widget.h b/ui/views/widget/widget.h
   protected:
    // Creates the RootView to be used within this Widget. Subclasses may override
    // to create custom RootViews that do specialized event processing.
-@@ -1494,13 +1507,6 @@ class VIEWS_EXPORT Widget : public internal::NativeWidgetDelegate,
+@@ -1400,13 +1413,6 @@ class VIEWS_EXPORT Widget : public internal::NativeWidgetDelegate,
    ui::ColorProviderKey GetColorProviderKey() const override;
  
   private:
@@ -67,7 +67,7 @@ diff --git a/ui/views/widget/widget.h b/ui/views/widget/widget.h
    class PaintAsActiveLockImpl;
  
    friend class ButtonTest;
-@@ -1511,11 +1517,6 @@ class VIEWS_EXPORT Widget : public internal::NativeWidgetDelegate,
+@@ -1417,11 +1423,6 @@ class VIEWS_EXPORT Widget : public internal::NativeWidgetDelegate,
    friend class ui_devtools::BubbleLocking;
    friend void DisableActivationChangeHandlingForTests();
  

build/patches/Change-popup-site-setting.patch

@@ -23,7 +23,7 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 diff --git a/chrome/browser/ui/blocked_content/tab_under_navigation_throttle.cc b/chrome/browser/ui/blocked_content/tab_under_navigation_throttle.cc
 --- a/chrome/browser/ui/blocked_content/tab_under_navigation_throttle.cc
 +++ b/chrome/browser/ui/blocked_content/tab_under_navigation_throttle.cc
-@@ -143,9 +143,14 @@ TabUnderNavigationThrottle::MaybeBlockNavigation() {
+@@ -142,9 +142,14 @@ TabUnderNavigationThrottle::MaybeBlockNavigation() {
  
    LogTabUnderAttempt(navigation_handle());
  
@@ -273,7 +273,7 @@ new file mode 100644
 diff --git a/components/content_settings/core/browser/content_settings_registry.cc b/components/content_settings/core/browser/content_settings_registry.cc
 --- a/components/content_settings/core/browser/content_settings_registry.cc
 +++ b/components/content_settings/core/browser/content_settings_registry.cc
-@@ -140,7 +140,7 @@ void ContentSettingsRegistry::Init() {
+@@ -134,7 +134,7 @@ void ContentSettingsRegistry::Init() {
             WebsiteSettingsInfo::SYNCABLE,
             /*allowlisted_primary_schemes=*/
             {kChromeUIScheme, kChromeDevToolsScheme, kExtensionScheme},

build/patches/Chrome-web-store-protection.patch

@@ -14,18 +14,16 @@ Auto-update is disabled by default: it is possible to activate it with chrome://
 License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 ---
  chrome/app/extensions_strings.grdp            |  6 ++
- .../developer_private_api.cc                  | 28 +++++++++
+ .../developer_private_api.cc                  | 38 +++++++++++-
  .../developer_private/developer_private_api.h |  3 +
- .../developer_private_functions_shared.cc     |  8 ++-
- .../profile_info_generator.cc                 |  3 +
  .../webstore_private/webstore_private_api.cc  | 15 ++++-
- .../extensions/chrome_extension_system.cc     |  1 +
  .../extensions/cws_info_service_factory.cc    |  3 +-
  .../extensions/extension_management.cc        |  1 +
  .../extension_safety_check_utils.cc           |  3 +-
  .../browser/extensions/extension_service.cc   |  4 +-
+ .../extensions/extension_system_impl.cc       |  2 +
  .../chrome_extension_downloader_factory.cc    |  1 -
- .../extensions/updater/extension_updater.cc   | 40 +++++++-----
+ .../extensions/updater/extension_updater.cc   | 40 ++++++++-----
  .../extensions/updater/extension_updater.h    |  4 ++
  .../extensions/webstore_install_helper.cc     |  2 +-
  .../browser/extensions/webstore_installer.cc  |  2 +-
@@ -34,22 +32,22 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
  .../browser/resources/extensions/service.ts   |  5 ++
  .../browser/resources/extensions/toolbar.css  |  5 ++
  .../resources/extensions/toolbar.html.ts      |  7 +++
- .../browser/resources/extensions/toolbar.ts   | 17 +++++
+ .../browser/resources/extensions/toolbar.ts   | 17 ++++++
  .../resources/webstore_app/manifest.json      |  7 +--
- .../ui/webui/extensions/extensions_ui.cc      |  7 +++
+ .../ui/webui/extensions/extensions_ui.cc      |  8 +++
  .../chrome_update_query_params_delegate.cc    | 13 ++--
  .../extensions/api/developer_private.idl      |  2 +
- .../update_client/update_query_params.cc      |  5 +-
+ .../update_client/update_query_params.cc      |  7 +--
  .../about_flags_cc/Webstore-protection.inc    | 19 ++++++
- .../browser/api/management/management_api.cc  | 62 +++++++++++++------
- .../browser/updater/extension_downloader.cc   | 53 ++++++----------
+ .../browser/api/management/management_api.cc  | 60 ++++++++++++-------
+ .../browser/updater/extension_downloader.cc   | 53 +++++++---------
  .../browser/updater/extension_downloader.h    |  1 -
  .../browser/updater/manifest_fetch_data.cc    |  8 +--
  .../browser/updater/safe_manifest_parser.cc   |  1 +
  extensions/common/extension_features.cc       | 14 +++++
- extensions/common/extension_features.h        |  2 +
+ extensions/common/extension_features.h        |  4 ++
  .../definitions/developer_private.d.ts        |  2 +
- 36 files changed, 253 insertions(+), 107 deletions(-)
+ 34 files changed, 254 insertions(+), 109 deletions(-)
  create mode 100644 cromite_flags/chrome/browser/about_flags_cc/Webstore-protection.inc
 
 diff --git a/chrome/app/extensions_strings.grdp b/chrome/app/extensions_strings.grdp
@@ -71,21 +69,26 @@ diff --git a/chrome/app/extensions_strings.grdp b/chrome/app/extensions_strings.
 diff --git a/chrome/browser/extensions/api/developer_private/developer_private_api.cc b/chrome/browser/extensions/api/developer_private/developer_private_api.cc
 --- a/chrome/browser/extensions/api/developer_private/developer_private_api.cc
 +++ b/chrome/browser/extensions/api/developer_private/developer_private_api.cc
-@@ -25,6 +25,12 @@
- #include "extensions/browser/app_window/app_window_registry.h"
- #endif  // BUILDFLAG(ENABLE_EXTENSIONS)
+@@ -138,6 +138,12 @@
+ #include "url/gurl.h"
+ #include "url/origin.h"
  
 +#include "chrome/browser/about_flags.h"
 +#include "chrome/browser/browser_process.h"
-+#include "components/webui/flags/pref_service_flags_storage.h"
-+#include "components/webui/flags/feature_entry.h"
-+#include "components/webui/flags/flags_storage.h"
++#include "components/flags_ui/pref_service_flags_storage.h"
++#include "components/flags_ui/feature_entry.h"
++#include "components/flags_ui/flags_storage.h"
 +
  namespace extensions {
  
  namespace developer = api::developer_private;
-@@ -66,6 +72,28 @@ DeveloperPrivateAPI::GetFactoryInstance() {
-   return g_developer_private_api_factory.Pointer();
+@@ -492,10 +498,32 @@ std::unique_ptr<developer::ProfileInfo> DeveloperPrivateAPI::CreateProfileInfo(
+   info->is_mv2_deprecation_notice_dismissed =
+       ManifestV2ExperimentManager::Get(profile)
+           ->DidUserAcknowledgeNoticeGlobally();
+-
++  info->is_extension_autoupdate_enabled = DeveloperPrivateAPI::IsExtensionAutoupdateEnabled();
+   return info;
  }
  
 +// static
@@ -113,23 +116,7 @@ diff --git a/chrome/browser/extensions/api/developer_private/developer_private_a
  template <>
  void BrowserContextKeyedAPIFactory<
      DeveloperPrivateAPI>::DeclareFactoryDependencies() {
-diff --git a/chrome/browser/extensions/api/developer_private/developer_private_api.h b/chrome/browser/extensions/api/developer_private/developer_private_api.h
---- a/chrome/browser/extensions/api/developer_private/developer_private_api.h
-+++ b/chrome/browser/extensions/api/developer_private/developer_private_api.h
-@@ -34,6 +34,9 @@ class DeveloperPrivateAPI : public BrowserContextKeyedAPI,
-   static BrowserContextKeyedAPIFactory<DeveloperPrivateAPI>*
-   GetFactoryInstance();
- 
-+  static bool IsExtensionAutoupdateEnabled();
-+  static void SetExtensionAutoupdateEnabled(bool enable);
-+
-   // Convenience method to get the DeveloperPrivateAPI for a profile.
-   static DeveloperPrivateAPI* Get(content::BrowserContext* context);
- 
-diff --git a/chrome/browser/extensions/api/developer_private/developer_private_functions_shared.cc b/chrome/browser/extensions/api/developer_private/developer_private_functions_shared.cc
---- a/chrome/browser/extensions/api/developer_private/developer_private_functions_shared.cc
-+++ b/chrome/browser/extensions/api/developer_private/developer_private_functions_shared.cc
-@@ -354,6 +354,7 @@ ExtensionFunction::ResponseAction DeveloperPrivateAutoUpdateFunction::Run() {
+@@ -959,6 +987,7 @@ ExtensionFunction::ResponseAction DeveloperPrivateAutoUpdateFunction::Run() {
      ExtensionUpdater::CheckParams params;
      params.fetch_priority = DownloadFetchPriority::kForeground;
      params.install_immediately = true;
@@ -137,7 +124,7 @@ diff --git a/chrome/browser/extensions/api/developer_private/developer_private_f
      params.callback =
          base::BindOnce(&DeveloperPrivateAutoUpdateFunction::OnComplete, this);
      updater->CheckNow(std::move(params));
-@@ -490,7 +491,7 @@ DeveloperPrivateUpdateProfileConfigurationFunction::Run() {
+@@ -1093,7 +1122,7 @@ DeveloperPrivateUpdateProfileConfigurationFunction::Run() {
  
    const developer::ProfileConfigurationUpdate& update = params->update;
  
@@ -146,7 +133,7 @@ diff --git a/chrome/browser/extensions/api/developer_private/developer_private_f
      Profile* profile = Profile::FromBrowserContext(browser_context());
      CHECK(profile);
      if (supervised_user::AreExtensionsPermissionsEnabled(profile)) {
-@@ -504,6 +505,11 @@ DeveloperPrivateUpdateProfileConfigurationFunction::Run() {
+@@ -1107,6 +1136,11 @@ DeveloperPrivateUpdateProfileConfigurationFunction::Run() {
          ->MarkNoticeAsAcknowledgedGlobally();
    }
  
@@ -158,30 +145,23 @@ diff --git a/chrome/browser/extensions/api/developer_private/developer_private_f
    return RespondNow(NoArguments());
  }
  
-diff --git a/chrome/browser/extensions/api/developer_private/profile_info_generator.cc b/chrome/browser/extensions/api/developer_private/profile_info_generator.cc
---- a/chrome/browser/extensions/api/developer_private/profile_info_generator.cc
-+++ b/chrome/browser/extensions/api/developer_private/profile_info_generator.cc
-@@ -10,6 +10,7 @@
- #include "chrome/browser/prefs/incognito_mode_prefs.h"
- #include "chrome/browser/profiles/profile.h"
- #include "chrome/browser/supervised_user/supervised_user_browser_utils.h"
-+#include "chrome/browser/extensions/api/developer_private/developer_private_api.h"
- #include "chrome/common/pref_names.h"
- #include "components/policy/core/common/policy_pref_names.h"
- #include "components/prefs/pref_service.h"
-@@ -39,6 +40,8 @@ developer::ProfileInfo CreateProfileInfo(Profile* profile) {
-       ManifestV2ExperimentManager::Get(profile)
-           ->DidUserAcknowledgeNoticeGlobally();
+diff --git a/chrome/browser/extensions/api/developer_private/developer_private_api.h b/chrome/browser/extensions/api/developer_private/developer_private_api.h
+--- a/chrome/browser/extensions/api/developer_private/developer_private_api.h
++++ b/chrome/browser/extensions/api/developer_private/developer_private_api.h
+@@ -244,6 +244,9 @@ class DeveloperPrivateAPI : public BrowserContextKeyedAPI,
+   static std::unique_ptr<api::developer_private::ProfileInfo> CreateProfileInfo(
+       Profile* profile);
  
-+  info.is_extension_autoupdate_enabled =
-+    DeveloperPrivateAPI::IsExtensionAutoupdateEnabled();
-   return info;
- }
++  static bool IsExtensionAutoupdateEnabled();
++  static void SetExtensionAutoupdateEnabled(bool enable);
++
+   // Convenience method to get the DeveloperPrivateAPI for a profile.
+   static DeveloperPrivateAPI* Get(content::BrowserContext* context);
  
 diff --git a/chrome/browser/extensions/api/webstore_private/webstore_private_api.cc b/chrome/browser/extensions/api/webstore_private/webstore_private_api.cc
 --- a/chrome/browser/extensions/api/webstore_private/webstore_private_api.cc
 +++ b/chrome/browser/extensions/api/webstore_private/webstore_private_api.cc
-@@ -63,6 +63,7 @@
+@@ -65,6 +65,7 @@
  #include "extensions/browser/extension_util.h"
  #include "extensions/browser/extensions_browser_client.h"
  #include "extensions/common/extension.h"
@@ -240,17 +220,6 @@ diff --git a/chrome/browser/extensions/api/webstore_private/webstore_private_api
  #else
    return RespondNow(ArgumentList(
        api::webstore_private::GetReferrerChain::Results::Create("")));
-diff --git a/chrome/browser/extensions/chrome_extension_system.cc b/chrome/browser/extensions/chrome_extension_system.cc
---- a/chrome/browser/extensions/chrome_extension_system.cc
-+++ b/chrome/browser/extensions/chrome_extension_system.cc
-@@ -92,6 +92,7 @@ UninstallPingSender::FilterResult ShouldSendUninstallPing(
-     Profile* profile,
-     const Extension* extension,
-     UninstallReason reason) {
-+  if ((true)) return UninstallPingSender::DO_NOT_SEND_PING;
-   ExtensionManagement* extension_management =
-       ExtensionManagementFactory::GetForBrowserContext(profile);
-   if (extension && (extension->from_webstore() ||
 diff --git a/chrome/browser/extensions/cws_info_service_factory.cc b/chrome/browser/extensions/cws_info_service_factory.cc
 --- a/chrome/browser/extensions/cws_info_service_factory.cc
 +++ b/chrome/browser/extensions/cws_info_service_factory.cc
@@ -267,7 +236,7 @@ diff --git a/chrome/browser/extensions/cws_info_service_factory.cc b/chrome/brow
 diff --git a/chrome/browser/extensions/extension_management.cc b/chrome/browser/extensions/extension_management.cc
 --- a/chrome/browser/extensions/extension_management.cc
 +++ b/chrome/browser/extensions/extension_management.cc
-@@ -424,6 +424,7 @@ bool ExtensionManagement::IsExemptFromMV2DeprecationByPolicy(
+@@ -387,6 +387,7 @@ bool ExtensionManagement::IsExemptFromMV2DeprecationByPolicy(
  
  bool ExtensionManagement::IsAllowedByUnpublishedAvailabilityPolicy(
      const Extension* extension) {
@@ -291,16 +260,16 @@ diff --git a/chrome/browser/extensions/extension_safety_check_utils.cc b/chrome/
 diff --git a/chrome/browser/extensions/extension_service.cc b/chrome/browser/extensions/extension_service.cc
 --- a/chrome/browser/extensions/extension_service.cc
 +++ b/chrome/browser/extensions/extension_service.cc
-@@ -241,8 +241,6 @@ ExtensionService::ExtensionService(
+@@ -446,8 +446,6 @@ ExtensionService::ExtensionService(
+ 
    UpgradeDetector::GetInstance()->AddObserver(this);
- #endif
  
 -  cws_info_service_observation_.Observe(CWSInfoService::Get(profile_));
 -
    ExtensionManagementFactory::GetForBrowserContext(profile_)->AddObserver(this);
  
-   if (autoupdate_enabled) {
-@@ -757,7 +755,7 @@ void ExtensionService::OnExtensionManagementSettingsChanged() {
+   // Set up the ExtensionUpdater.
+@@ -1762,7 +1760,7 @@ void ExtensionService::OnExtensionManagementSettingsChanged() {
    // unpublished extensions should not be enabled. This update allows
    // unpublished extensions to be disabled sooner rather than waiting till the
    // next regularly scheduled fetch.
@@ -309,6 +278,25 @@ diff --git a/chrome/browser/extensions/extension_service.cc b/chrome/browser/ext
            pref_names::kExtensionUnpublishedAvailability) !=
        kAllowUnpublishedExtensions) {
      CWSInfoService::Get(profile_)->CheckAndMaybeFetchInfo();
+diff --git a/chrome/browser/extensions/extension_system_impl.cc b/chrome/browser/extensions/extension_system_impl.cc
+--- a/chrome/browser/extensions/extension_system_impl.cc
++++ b/chrome/browser/extensions/extension_system_impl.cc
+@@ -56,6 +56,7 @@
+ #include "extensions/browser/updater/uninstall_ping_sender.h"
+ #include "extensions/browser/user_script_manager.h"
+ #include "extensions/common/constants.h"
++#include "extensions/common/extension_features.h"
+ #include "extensions/common/features/feature_channel.h"
+ #include "extensions/common/manifest_url_handlers.h"
+ #include "ui/message_center/public/cpp/notifier_id.h"
+@@ -83,6 +84,7 @@ UninstallPingSender::FilterResult ShouldSendUninstallPing(
+     Profile* profile,
+     const Extension* extension,
+     UninstallReason reason) {
++  if ((true)) return UninstallPingSender::DO_NOT_SEND_PING;
+   ExtensionManagement* extension_management =
+       ExtensionManagementFactory::GetForBrowserContext(profile);
+   if (extension && (extension->from_webstore() ||
 diff --git a/chrome/browser/extensions/updater/chrome_extension_downloader_factory.cc b/chrome/browser/extensions/updater/chrome_extension_downloader_factory.cc
 --- a/chrome/browser/extensions/updater/chrome_extension_downloader_factory.cc
 +++ b/chrome/browser/extensions/updater/chrome_extension_downloader_factory.cc
@@ -323,15 +311,15 @@ diff --git a/chrome/browser/extensions/updater/chrome_extension_downloader_facto
 diff --git a/chrome/browser/extensions/updater/extension_updater.cc b/chrome/browser/extensions/updater/extension_updater.cc
 --- a/chrome/browser/extensions/updater/extension_updater.cc
 +++ b/chrome/browser/extensions/updater/extension_updater.cc
-@@ -55,6 +55,7 @@
+@@ -49,6 +49,7 @@
+ #include "extensions/browser/updater/extension_update_data.h"
  #include "extensions/common/constants.h"
  #include "extensions/common/extension.h"
- #include "extensions/common/extension_id.h"
 +#include "extensions/common/extension_features.h"
  #include "extensions/common/extension_set.h"
  #include "extensions/common/extension_updater_uma.h"
  #include "extensions/common/extension_urls.h"
-@@ -228,6 +229,10 @@ void ExtensionUpdater::Start() {
+@@ -203,6 +204,10 @@ void ExtensionUpdater::Start() {
    DCHECK(!weak_ptr_factory_.HasWeakPtrs());
    DCHECK(registry_);
    alive_ = true;
@@ -342,7 +330,7 @@ diff --git a/chrome/browser/extensions/updater/extension_updater.cc b/chrome/bro
    // Check soon, and set up the first delayed check.
    if (!g_skip_scheduled_checks_for_tests) {
      if (g_should_immediately_update)
-@@ -385,7 +390,8 @@ void ExtensionUpdater::AddToDownloader(
+@@ -335,7 +340,8 @@ void ExtensionUpdater::AddToDownloader(
      const Extension& extension = **extension_iter;
      const ExtensionId& extension_id = extension.id();
      if (!Manifest::IsAutoUpdateableLocation(extension.location())) {
@@ -352,7 +340,7 @@ diff --git a/chrome/browser/extensions/updater/extension_updater.cc b/chrome/bro
        continue;
      }
      // An extension might be overwritten by policy, and have its update url
-@@ -399,7 +405,7 @@ void ExtensionUpdater::AddToDownloader(
+@@ -349,7 +355,7 @@ void ExtensionUpdater::AddToDownloader(
        continue;
      }
  
@@ -361,7 +349,7 @@ diff --git a/chrome/browser/extensions/updater/extension_updater.cc b/chrome/bro
        update_check_params->update_info[extension_id] =
            GetExtensionUpdateData(extension_id);
      } else if (AddExtensionToDownloader(extension, request_id,
-@@ -436,6 +442,12 @@ bool ExtensionUpdater::AddExtensionToDownloader(
+@@ -388,6 +394,12 @@ bool ExtensionUpdater::AddExtensionToDownloader(
  }
  
  void ExtensionUpdater::CheckNow(CheckParams params) {
@@ -371,10 +359,10 @@ diff --git a/chrome/browser/extensions/updater/extension_updater.cc b/chrome/bro
 +    LOG(INFO) << "Extensions autoupdate is disabled.";
 +    return;
 +  }
-   CHECK(enabled_);
    if (params.ids.empty()) {
      // Checking all extensions. Cancel pending DoCheckSoon() call if there's
-@@ -445,7 +457,7 @@ void ExtensionUpdater::CheckNow(CheckParams params) {
+     // one, as it would be redundant.
+@@ -396,7 +408,7 @@ void ExtensionUpdater::CheckNow(CheckParams params) {
  
    int request_id = next_request_id_++;
  
@@ -383,7 +371,7 @@ diff --git a/chrome/browser/extensions/updater/extension_updater.cc b/chrome/bro
    if (params.ids.empty())
      NotifyStarted();
  
-@@ -513,7 +525,7 @@ void ExtensionUpdater::CheckNow(CheckParams params) {
+@@ -469,7 +481,7 @@ void ExtensionUpdater::CheckNow(CheckParams params) {
          update_check_params.update_info[pending_id] =
              GetExtensionUpdateData(pending_id);
        } else if (!Manifest::IsAutoUpdateableLocation(info->install_source())) {
@@ -392,7 +380,7 @@ diff --git a/chrome/browser/extensions/updater/extension_updater.cc b/chrome/bro
          continue;
        }
        // We have to mark high-priority extensions (such as policy-forced
-@@ -523,7 +535,7 @@ void ExtensionUpdater::CheckNow(CheckParams params) {
+@@ -479,7 +491,7 @@ void ExtensionUpdater::CheckNow(CheckParams params) {
        // See https://crbug.com/904600 and https://crbug.com/965686.
        const bool is_high_priority_extension_pending =
            pending_extension_manager->HasHighPriorityPendingExtension();
@@ -401,7 +389,7 @@ diff --git a/chrome/browser/extensions/updater/extension_updater.cc b/chrome/bro
          update_check_params.update_info[pending_id] =
              GetExtensionUpdateData(pending_id);
          update_check_params.update_info[pending_id].is_corrupt_reinstall =
-@@ -546,6 +558,8 @@ void ExtensionUpdater::CheckNow(CheckParams params) {
+@@ -502,6 +514,8 @@ void ExtensionUpdater::CheckNow(CheckParams params) {
            LOG(WARNING) << "Corrupt extension with id " << pending_id
                         << " will be reinstalled with ExtensionDownloader.";
          }
@@ -410,7 +398,7 @@ diff --git a/chrome/browser/extensions/updater/extension_updater.cc b/chrome/bro
        } else {
          InstallStageTracker::Get(profile_)->ReportFailure(
              pending_id,
-@@ -558,13 +572,6 @@ void ExtensionUpdater::CheckNow(CheckParams params) {
+@@ -514,13 +528,6 @@ void ExtensionUpdater::CheckNow(CheckParams params) {
      AddToDownloader(&registry_->disabled_extensions(), pending_ids, request_id,
                      params.fetch_priority, &update_check_params);
      ExtensionSet remotely_disabled_extensions;
@@ -424,7 +412,7 @@ diff --git a/chrome/browser/extensions/updater/extension_updater.cc b/chrome/bro
      AddToDownloader(&remotely_disabled_extensions, pending_ids, request_id,
                      params.fetch_priority, &update_check_params);
    } else {
-@@ -572,7 +579,7 @@ void ExtensionUpdater::CheckNow(CheckParams params) {
+@@ -528,7 +535,7 @@ void ExtensionUpdater::CheckNow(CheckParams params) {
        const Extension* extension =
            registry_->GetExtensionById(id, ExtensionRegistry::EVERYTHING);
        if (extension) {
@@ -433,7 +421,7 @@ diff --git a/chrome/browser/extensions/updater/extension_updater.cc b/chrome/bro
            update_check_params.update_info[id] = GetExtensionUpdateData(id);
          } else if (AddExtensionToDownloader(*extension, request_id,
                                              params.fetch_priority)) {
-@@ -716,7 +723,7 @@ void ExtensionUpdater::OnExtensionDownloadFinished(
+@@ -669,7 +676,7 @@ void ExtensionUpdater::OnExtensionDownloadFinished(
        file.extension_id, InstallStageTracker::Stage::INSTALLING);
    UpdatePingData(file.extension_id, ping);
  
@@ -442,7 +430,7 @@ diff --git a/chrome/browser/extensions/updater/extension_updater.cc b/chrome/bro
  
    FetchedCRXFile fetched(file, file_ownership_passed, request_ids,
                           std::move(callback));
-@@ -727,6 +734,7 @@ void ExtensionUpdater::OnExtensionDownloadFinished(
+@@ -680,6 +687,7 @@ void ExtensionUpdater::OnExtensionDownloadFinished(
  
  bool ExtensionUpdater::GetPingDataForExtension(const ExtensionId& id,
                                                 DownloadPingData* ping_data) {
@@ -450,7 +438,7 @@ diff --git a/chrome/browser/extensions/updater/extension_updater.cc b/chrome/bro
    DCHECK(alive_);
    ping_data->rollcall_days =
        CalculatePingDaysForExtension(extension_prefs_->LastPingDay(id));
-@@ -839,7 +847,7 @@ bool ExtensionUpdater::CanUseUpdateService(
+@@ -796,7 +804,7 @@ bool ExtensionUpdater::CanUseUpdateService(
  void ExtensionUpdater::InstallCRXFile(FetchedCRXFile crx_file) {
    std::set<int> request_ids;
  
@@ -458,8 +446,8 @@ diff --git a/chrome/browser/extensions/updater/extension_updater.cc b/chrome/bro
 +  LOG(INFO) << "Updating " << crx_file.info.extension_id << " with "
            << crx_file.info.path.value();
  
-   // The delegate is now responsible for cleaning up the temp file at
-@@ -1046,7 +1054,7 @@ void ExtensionUpdater::NotifyIfFinished(int request_id) {
+   // The ExtensionService is now responsible for cleaning up the temp file
+@@ -905,7 +913,7 @@ void ExtensionUpdater::NotifyIfFinished(int request_id) {
    InProgressCheck& request = requests_in_progress_[request_id];
    if (!request.in_progress_ids.empty() || request.awaiting_update_service)
      return;  // This request is not done yet.
@@ -471,7 +459,7 @@ diff --git a/chrome/browser/extensions/updater/extension_updater.cc b/chrome/bro
 diff --git a/chrome/browser/extensions/updater/extension_updater.h b/chrome/browser/extensions/updater/extension_updater.h
 --- a/chrome/browser/extensions/updater/extension_updater.h
 +++ b/chrome/browser/extensions/updater/extension_updater.h
-@@ -92,6 +92,8 @@ class ExtensionUpdater : public KeyedService,
+@@ -82,6 +82,8 @@ class ExtensionUpdater : public ExtensionDownloaderDelegate {
      // right away.
      bool install_immediately = false;
  
@@ -480,15 +468,15 @@ diff --git a/chrome/browser/extensions/updater/extension_updater.h b/chrome/brow
      // An extension update check can be originated by a user or by a scheduled
      // task. When the value of |fetch_priority| is FOREGROUND, the update
      // request was initiated by a user.
-@@ -401,6 +403,8 @@ class ExtensionUpdater : public KeyedService,
+@@ -333,6 +335,8 @@ class ExtensionUpdater : public ExtensionDownloaderDelegate {
    base::TimeDelta frequency_;
    bool will_check_soon_ = false;
  
 +  bool first_start_ = true;
 +
-   raw_ptr<ExtensionPrefs> extension_prefs_ = nullptr;
-   raw_ptr<PrefService> prefs_ = nullptr;
-   raw_ptr<Profile> profile_ = nullptr;
+   raw_ptr<ExtensionPrefs, DanglingUntriaged> extension_prefs_ = nullptr;
+   raw_ptr<PrefService, DanglingUntriaged> prefs_ = nullptr;
+   raw_ptr<Profile, DanglingUntriaged> profile_ = nullptr;
 diff --git a/chrome/browser/extensions/webstore_install_helper.cc b/chrome/browser/extensions/webstore_install_helper.cc
 --- a/chrome/browser/extensions/webstore_install_helper.cc
 +++ b/chrome/browser/extensions/webstore_install_helper.cc
@@ -504,7 +492,7 @@ diff --git a/chrome/browser/extensions/webstore_install_helper.cc b/chrome/brows
 diff --git a/chrome/browser/extensions/webstore_installer.cc b/chrome/browser/extensions/webstore_installer.cc
 --- a/chrome/browser/extensions/webstore_installer.cc
 +++ b/chrome/browser/extensions/webstore_installer.cc
-@@ -591,7 +591,7 @@ void WebstoreInstaller::StartDownload(
+@@ -626,7 +626,7 @@ void WebstoreInstaller::StartDownload(
        traffic_annotation));
    params->set_file_path(file);
    params->set_initiator(render_frame_host->GetLastCommittedOrigin());
@@ -537,15 +525,15 @@ diff --git a/chrome/browser/resources/extensions/manager.ts b/chrome/browser/res
  
        showDrawer_: {type: Boolean},
 @@ -167,6 +169,8 @@ export class ExtensionsManagerElement extends ExtensionsManagerElementBase {
-   accessor inDevMode: boolean = loadTimeData.getBoolean('inDevMode');
-   accessor isMv2DeprecationNoticeDismissed: boolean =
+   inDevMode: boolean = loadTimeData.getBoolean('inDevMode');
+   isMv2DeprecationNoticeDismissed: boolean =
        loadTimeData.getBoolean('MV2DeprecationNoticeDismissed');
-+  accessor isExtUpdateEnabled: boolean =
++  isExtUpdateEnabled: boolean =
 +      loadTimeData.getBoolean('isExtUpdateEnabled');
-   accessor showActivityLog: boolean =
-       loadTimeData.getBoolean('showActivityLog');
-   accessor enableEnhancedSiteControls: boolean =
-@@ -231,6 +235,7 @@ export class ExtensionsManagerElement extends ExtensionsManagerElementBase {
+   showActivityLog: boolean = loadTimeData.getBoolean('showActivityLog');
+   enableEnhancedSiteControls: boolean =
+       loadTimeData.getBoolean('enableEnhancedSiteControls');
+@@ -228,6 +232,7 @@ export class ExtensionsManagerElement extends ExtensionsManagerElementBase {
            this.canLoadUnpacked = profileInfo.canLoadUnpacked;
            this.isMv2DeprecationNoticeDismissed =
                profileInfo.isMv2DeprecationNoticeDismissed;
@@ -556,7 +544,7 @@ diff --git a/chrome/browser/resources/extensions/manager.ts b/chrome/browser/res
 diff --git a/chrome/browser/resources/extensions/service.ts b/chrome/browser/resources/extensions/service.ts
 --- a/chrome/browser/resources/extensions/service.ts
 +++ b/chrome/browser/resources/extensions/service.ts
-@@ -320,6 +320,11 @@ export class Service implements ServiceInterface {
+@@ -299,6 +299,11 @@ export class Service implements ServiceInterface {
          {inDeveloperMode: inDevMode});
    }
  
@@ -586,10 +574,10 @@ diff --git a/chrome/browser/resources/extensions/toolbar.css b/chrome/browser/re
 diff --git a/chrome/browser/resources/extensions/toolbar.html.ts b/chrome/browser/resources/extensions/toolbar.html.ts
 --- a/chrome/browser/resources/extensions/toolbar.html.ts
 +++ b/chrome/browser/resources/extensions/toolbar.html.ts
-@@ -32,6 +32,13 @@ export function getHtml(this: ToolbarElement) {
-       <img srcset="images/product_logo.png" role="presentation">
-     </picture>
-   </if>
+@@ -25,6 +25,13 @@ export function getHtml(this: ToolbarElement) {
+         aria-labelledby="devModeLabel">
+     </cr-toggle>
+   </div>
 +  <div class="more-actions">
 +    <span>$i18n{toolbarExtensionUpdateEnabled}
 +      <span id="need-update" ?hidden="${!this.shouldShowRelaunchDialog}">$i18n{toolbarExtensionUpdateEnabledNeedRestart}</span>
@@ -641,13 +629,13 @@ diff --git a/chrome/browser/resources/extensions/toolbar.ts b/chrome/browser/res
        /**
         * Prevents initiating update while update is in progress.
 @@ -103,6 +112,8 @@ export class ExtensionsToolbarElement extends ExtensionsToolbarElementBase {
-   accessor extensions: chrome.developerPrivate.ExtensionInfo[] = [];
-   accessor delegate: ToolbarDelegate = new DummyToolbarDelegate();
-   accessor inDevMode: boolean = false;
-+  accessor isExtUpdateEnabled: boolean = false;
-+  accessor shouldShowRelaunchDialog: boolean = false;
-   accessor devModeControlledByPolicy: boolean = false;
-   accessor isChildAccount: boolean = false;
+   extensions: chrome.developerPrivate.ExtensionInfo[] = [];
+   delegate: ToolbarDelegate = new DummyToolbarDelegate();
+   inDevMode: boolean = false;
++  isExtUpdateEnabled: boolean = false;
++  shouldShowRelaunchDialog: boolean = false;
+   devModeControlledByPolicy: boolean = false;
+   isChildAccount: boolean = false;
  
 @@ -155,6 +166,12 @@ export class ExtensionsToolbarElement extends ExtensionsToolbarElementBase {
          'Options_ToggleDeveloperMode_' + (e.detail ? 'Enabled' : 'Disabled'));
@@ -681,15 +669,16 @@ diff --git a/chrome/browser/resources/webstore_app/manifest.json b/chrome/browse
 diff --git a/chrome/browser/ui/webui/extensions/extensions_ui.cc b/chrome/browser/ui/webui/extensions/extensions_ui.cc
 --- a/chrome/browser/ui/webui/extensions/extensions_ui.cc
 +++ b/chrome/browser/ui/webui/extensions/extensions_ui.cc
-@@ -17,6 +17,7 @@
- #include "base/values.h"
- #include "build/build_config.h"
- #include "chrome/browser/browser_process.h"
+@@ -53,6 +53,8 @@
+ #include "ui/base/webui/web_ui_util.h"
+ #include "ui/webui/webui_util.h"
+ 
 +#include "chrome/browser/extensions/api/developer_private/developer_private_api.h"
- #include "chrome/browser/extensions/manifest_v2_experiment_manager.h"
- #include "chrome/browser/extensions/mv2_experiment_stage.h"
- #include "chrome/browser/extensions/permissions_url_constants.h"
-@@ -380,6 +381,8 @@ content::WebUIDataSource* CreateAndAddExtensionsSource(Profile* profile,
++
+ namespace extensions {
+ 
+ namespace {
+@@ -374,6 +376,8 @@ content::WebUIDataSource* CreateAndAddExtensionsSource(Profile* profile,
        {"itemSuspiciousInstallLearnMore",
         IDS_EXTENSIONS_ADDED_WITHOUT_KNOWLEDGE_LEARN_MORE},
        {"toolbarDevMode", IDS_EXTENSIONS_DEVELOPER_MODE},
@@ -698,7 +687,7 @@ diff --git a/chrome/browser/ui/webui/extensions/extensions_ui.cc b/chrome/browse
        {"toolbarLoadUnpacked", IDS_EXTENSIONS_TOOLBAR_LOAD_UNPACKED},
        {"toolbarLoadUnpackedDone", IDS_EXTENSIONS_TOOLBAR_LOAD_UNPACKED_DONE},
        {"toolbarPack", IDS_EXTENSIONS_TOOLBAR_PACK},
-@@ -464,6 +467,10 @@ content::WebUIDataSource* CreateAndAddExtensionsSource(Profile* profile,
+@@ -449,6 +453,10 @@ content::WebUIDataSource* CreateAndAddExtensionsSource(Profile* profile,
        "hostPermissionsLearnMoreLink",
        extension_permissions_constants::kRuntimeHostPermissionsHelpURL);
    source->AddBoolean(kInDevModeKey, in_dev_mode);
@@ -735,15 +724,15 @@ diff --git a/chrome/browser/update_client/chrome_update_query_params_delegate.cc
 diff --git a/chrome/common/extensions/api/developer_private.idl b/chrome/common/extensions/api/developer_private.idl
 --- a/chrome/common/extensions/api/developer_private.idl
 +++ b/chrome/common/extensions/api/developer_private.idl
-@@ -272,6 +272,7 @@ namespace developerPrivate {
+@@ -296,6 +296,7 @@ namespace developerPrivate {
      boolean isIncognitoAvailable;
      boolean isChildAccount;
      boolean isMv2DeprecationNoticeDismissed;
 +    boolean isExtensionAutoupdateEnabled;
    };
  
-   dictionary GetExtensionsInfoOptions {
-@@ -295,6 +296,7 @@ namespace developerPrivate {
+   // DEPRECATED: Prefer ExtensionInfo.
+@@ -355,6 +356,7 @@ namespace developerPrivate {
    dictionary ProfileConfigurationUpdate {
      boolean? inDeveloperMode;
      boolean? isMv2DeprecationNoticeDismissed;
@@ -754,17 +743,19 @@ diff --git a/chrome/common/extensions/api/developer_private.idl b/chrome/common/
 diff --git a/components/update_client/update_query_params.cc b/components/update_client/update_query_params.cc
 --- a/components/update_client/update_query_params.cc
 +++ b/components/update_client/update_query_params.cc
-@@ -87,8 +87,7 @@ UpdateQueryParamsDelegate* g_delegate = nullptr;
+@@ -85,9 +85,8 @@ UpdateQueryParamsDelegate* g_delegate = nullptr;
  // static
  std::string UpdateQueryParams::Get(ProdId prod) {
    return base::StringPrintf(
--      "os=%s&arch=%s&os_arch=%s&prod=%s%s&acceptformat=crx3,puff", kOs, kArch,
--      base::SysInfo().OperatingSystemArchitecture().c_str(),
+-      "os=%s&arch=%s&os_arch=%s&nacl_arch=%s&prod=%s%s&acceptformat=crx3,puff",
+-      kOs, kArch, base::SysInfo().OperatingSystemArchitecture().c_str(),
+-      GetNaclArch(), GetProdIdString(prod),
 +      "prod=%s%s&acceptformat=crx3",
-       GetProdIdString(prod),
++      GetProdIdString(prod),
        g_delegate ? g_delegate->GetExtraParams().c_str() : "");
  }
-@@ -120,7 +119,7 @@ const char* UpdateQueryParams::GetArch() {
+ 
+@@ -148,7 +147,7 @@ const char* UpdateQueryParams::GetNaclArch() {
  
  // static
  std::string UpdateQueryParams::GetProdVersion() {
@@ -800,7 +791,7 @@ new file mode 100644
 diff --git a/extensions/browser/api/management/management_api.cc b/extensions/browser/api/management/management_api.cc
 --- a/extensions/browser/api/management/management_api.cc
 +++ b/extensions/browser/api/management/management_api.cc
-@@ -26,6 +26,9 @@
+@@ -25,6 +25,9 @@
  #include "components/supervised_user/core/common/buildflags.h"
  #include "components/supervised_user/core/common/features.h"
  #include "content/public/browser/browser_context.h"
@@ -810,7 +801,7 @@ diff --git a/extensions/browser/api/management/management_api.cc b/extensions/br
  #include "extensions/browser/api/extensions_api_client.h"
  #include "extensions/browser/api/management/management_api_constants.h"
  #include "extensions/browser/disable_reason.h"
-@@ -41,6 +44,7 @@
+@@ -40,6 +43,7 @@
  #include "extensions/common/api/management.h"
  #include "extensions/common/error_utils.h"
  #include "extensions/common/extension.h"
@@ -818,7 +809,7 @@ diff --git a/extensions/browser/api/management/management_api.cc b/extensions/br
  #include "extensions/common/extension_id.h"
  #include "extensions/common/extension_urls.h"
  #include "extensions/common/icons/extension_icon_set.h"
-@@ -92,6 +96,29 @@ std::vector<std::string> CreateWarningsList(const Extension* extension) {
+@@ -91,6 +95,27 @@ std::vector<std::string> CreateWarningsList(const Extension* extension) {
    return warnings_list;
  }
  
@@ -827,13 +818,11 @@ diff --git a/extensions/browser/api/management/management_api.cc b/extensions/br
 +                                  const std::string& id,
 +                                  int include_mask) {
 +  bool enabled = base::FeatureList::IsEnabled(extensions_features::kEnableExtensionManagementToChromeStore);
-+  if (web_contents) {
-+    if (content::RenderFrameHost* rfh = web_contents->GetPrimaryMainFrame()) {
-+      url::Origin top_frame_origin = rfh->GetMainFrame()->GetLastCommittedOrigin();
-+      std::string scheme = top_frame_origin.scheme();
-+      if (scheme == content::kChromeUIScheme) {
-+        enabled = true;
-+      }
++  if (content::RenderFrameHost* rfh = web_contents->GetPrimaryMainFrame()) {
++    url::Origin top_frame_origin = rfh->GetMainFrame()->GetLastCommittedOrigin();
++    std::string scheme = top_frame_origin.scheme();
++    if (scheme == content::kChromeUIScheme) {
++      enabled = true;
 +    }
 +  }
 +  if (!enabled)
@@ -846,9 +835,9 @@ diff --git a/extensions/browser/api/management/management_api.cc b/extensions/br
 +}
 +
  std::vector<management::LaunchType> GetAvailableLaunchTypes(
-     const Extension& extension) {
-   std::vector<management::LaunchType> launch_type_list;
-@@ -269,6 +296,8 @@ void AddExtensionInfo(const Extension* source_extension,
+     const Extension& extension,
+     const ManagementAPIDelegate* delegate) {
+@@ -268,6 +293,8 @@ void AddExtensionInfo(const Extension* source_extension,
                        const ExtensionSet& extensions,
                        ExtensionInfoList* extension_list,
                        content::BrowserContext* context) {
@@ -857,7 +846,7 @@ diff --git a/extensions/browser/api/management/management_api.cc b/extensions/br
    for (ExtensionSet::const_iterator iter = extensions.begin();
         iter != extensions.end(); ++iter) {
      const Extension& extension = **iter;
-@@ -311,10 +340,9 @@ ExtensionFunction::ResponseAction ManagementGetFunction::Run() {
+@@ -313,10 +340,9 @@ ExtensionFunction::ResponseAction ManagementGetFunction::Run() {
    std::optional<management::Get::Params> params =
        management::Get::Params::Create(args());
    EXTENSION_FUNCTION_VALIDATE(params);
@@ -869,7 +858,7 @@ diff --git a/extensions/browser/api/management/management_api.cc b/extensions/br
    if (!target_extension) {
      return RespondNow(Error(keys::kNoExtensionError, params->id));
    }
-@@ -335,8 +363,7 @@ ManagementGetPermissionWarningsByIdFunction::Run() {
+@@ -337,8 +363,7 @@ ManagementGetPermissionWarningsByIdFunction::Run() {
    EXTENSION_FUNCTION_VALIDATE(params);
  
    const Extension* extension =
@@ -879,7 +868,7 @@ diff --git a/extensions/browser/api/management/management_api.cc b/extensions/br
    if (!extension) {
      return RespondNow(Error(keys::kNoExtensionError, params->id));
    }
-@@ -404,8 +431,7 @@ ExtensionFunction::ResponseAction ManagementLaunchAppFunction::Run() {
+@@ -406,8 +431,7 @@ ExtensionFunction::ResponseAction ManagementLaunchAppFunction::Run() {
    }
  
    const Extension* extension =
@@ -889,7 +878,7 @@ diff --git a/extensions/browser/api/management/management_api.cc b/extensions/br
    if (!extension) {
      return RespondNow(Error(keys::kNoExtensionError, params->id));
    }
-@@ -547,8 +573,8 @@ void ManagementSetEnabledFunction::CheckPermissionsIncrease() {
+@@ -547,8 +571,8 @@ void ManagementSetEnabledFunction::CheckPermissionsIncrease() {
    // Extension could have been uninstalled externally while previous check was
    // happening.
    const Extension* extension =
@@ -900,7 +889,7 @@ diff --git a/extensions/browser/api/management/management_api.cc b/extensions/br
    if (!extension) {
      FinishEnable(Error(keys::kNoExtensionError));
      return;
-@@ -591,8 +617,8 @@ void ManagementSetEnabledFunction::CheckManifestV2Deprecation() {
+@@ -591,8 +615,8 @@ void ManagementSetEnabledFunction::CheckManifestV2Deprecation() {
    // Extension can be uninstalled externally while the previous check was
    // happening async.
    const Extension* extension =
@@ -911,7 +900,7 @@ diff --git a/extensions/browser/api/management/management_api.cc b/extensions/br
    if (!extension) {
      FinishEnable(Error(keys::kNoExtensionError));
      return;
-@@ -736,8 +762,8 @@ void ManagementSetEnabledFunction::OnSupervisedExtensionApprovalDone(
+@@ -736,8 +760,8 @@ void ManagementSetEnabledFunction::OnSupervisedExtensionApprovalDone(
  }
  
  const Extension* ManagementSetEnabledFunction::GetExtension() {
@@ -922,7 +911,7 @@ diff --git a/extensions/browser/api/management/management_api.cc b/extensions/br
  }
  
  ManagementUninstallFunctionBase::ManagementUninstallFunctionBase() = default;
-@@ -762,8 +788,7 @@ ExtensionFunction::ResponseAction ManagementUninstallFunctionBase::Uninstall(
+@@ -762,8 +786,7 @@ ExtensionFunction::ResponseAction ManagementUninstallFunctionBase::Uninstall(
                                                ->GetDelegate();
    target_extension_id_ = target_extension_id;
    const Extension* target_extension =
@@ -932,7 +921,7 @@ diff --git a/extensions/browser/api/management/management_api.cc b/extensions/br
                               ExtensionRegistry::EVERYTHING);
    if (!target_extension || !ShouldExposeViaManagementAPI(*target_extension)) {
      return RespondNow(Error(keys::kNoExtensionError, target_extension_id_));
-@@ -828,8 +853,7 @@ void ManagementUninstallFunctionBase::UninstallExtension() {
+@@ -828,8 +851,7 @@ void ManagementUninstallFunctionBase::UninstallExtension() {
    // The extension can be uninstalled in another window while the UI was
    // showing. Do nothing in that case.
    const Extension* target_extension =
@@ -942,7 +931,7 @@ diff --git a/extensions/browser/api/management/management_api.cc b/extensions/br
                               ExtensionRegistry::EVERYTHING);
    std::string error;
    bool success = false;
-@@ -909,8 +933,7 @@ ExtensionFunction::ResponseAction ManagementCreateAppShortcutFunction::Run() {
+@@ -906,8 +928,7 @@ ExtensionFunction::ResponseAction ManagementCreateAppShortcutFunction::Run() {
        management::CreateAppShortcut::Params::Create(args());
    EXTENSION_FUNCTION_VALIDATE(params);
    const Extension* extension =
@@ -952,7 +941,7 @@ diff --git a/extensions/browser/api/management/management_api.cc b/extensions/br
    if (!extension) {
      return RespondNow(Error(
          ErrorUtils::FormatErrorMessage(keys::kNoExtensionError, params->id)));
-@@ -964,8 +987,7 @@ ExtensionFunction::ResponseAction ManagementSetLaunchTypeFunction::Run() {
+@@ -960,8 +981,7 @@ ExtensionFunction::ResponseAction ManagementSetLaunchTypeFunction::Run() {
        management::SetLaunchType::Params::Create(args());
    EXTENSION_FUNCTION_VALIDATE(params);
    const Extension* extension =
@@ -1159,7 +1148,7 @@ diff --git a/extensions/browser/updater/extension_downloader.h b/extensions/brow
 diff --git a/extensions/browser/updater/manifest_fetch_data.cc b/extensions/browser/updater/manifest_fetch_data.cc
 --- a/extensions/browser/updater/manifest_fetch_data.cc
 +++ b/extensions/browser/updater/manifest_fetch_data.cc
-@@ -108,7 +108,7 @@ ManifestFetchData::ManifestFetchData(const GURL& update_url,
+@@ -105,7 +105,7 @@ ManifestFetchData::ManifestFetchData(const GURL& update_url,
      : base_url_(update_url),
        full_url_(update_url),
        brand_code_(brand_code),
@@ -1168,7 +1157,7 @@ diff --git a/extensions/browser/updater/manifest_fetch_data.cc b/extensions/brow
        fetch_priority_(fetch_priority) {
    UpdateFullUrl(base_query_params);
    request_ids_.insert(request_id);
-@@ -161,18 +161,12 @@ bool ManifestFetchData::AddExtension(const std::string& id,
+@@ -158,18 +158,12 @@ bool ManifestFetchData::AddExtension(const std::string& id,
    // Compute the string we'd append onto the full_url_, and see if it fits.
    std::vector<std::string> parts;
    parts.push_back("id=" + id);
@@ -1201,8 +1190,8 @@ diff --git a/extensions/browser/updater/safe_manifest_parser.cc b/extensions/bro
 diff --git a/extensions/common/extension_features.cc b/extensions/common/extension_features.cc
 --- a/extensions/common/extension_features.cc
 +++ b/extensions/common/extension_features.cc
-@@ -242,4 +242,18 @@ BASE_FEATURE(kAvoidCloneArgsOnExtensionFunctionDispatch,
-              "AvoidCloneArgsOnExtensionFunctionDispatch",
+@@ -200,4 +200,18 @@ BASE_FEATURE(kUserScriptUserExtensionToggle,
+              "UserScriptUserExtensionToggle",
               base::FEATURE_DISABLED_BY_DEFAULT);
  
 +// Activates the auto update of extensions.
@@ -1223,19 +1212,21 @@ diff --git a/extensions/common/extension_features.cc b/extensions/common/extensi
 diff --git a/extensions/common/extension_features.h b/extensions/common/extension_features.h
 --- a/extensions/common/extension_features.h
 +++ b/extensions/common/extension_features.h
-@@ -271,6 +271,8 @@ BASE_DECLARE_FEATURE(kOptimizeServiceWorkerStartRequests);
- // TODO(crbug.com/424432184): Clean up when experiment is complete.
- BASE_DECLARE_FEATURE(kAvoidCloneArgsOnExtensionFunctionDispatch);
+@@ -240,6 +240,10 @@ BASE_DECLARE_FEATURE(kRemoveCoreSiteInstance);
+ // rather than the developer mode toggle on chrome://extensions.
+ BASE_DECLARE_FEATURE(kUserScriptUserExtensionToggle);
  
 +BASE_DECLARE_FEATURE(kEnableExtensionAutoupdate);
++
 +BASE_DECLARE_FEATURE(kEnableExtensionManagementToChromeStore);
++
  }  // namespace extensions_features
  
  #endif  // EXTENSIONS_COMMON_EXTENSION_FEATURES_H_
 diff --git a/tools/typescript/definitions/developer_private.d.ts b/tools/typescript/definitions/developer_private.d.ts
 --- a/tools/typescript/definitions/developer_private.d.ts
 +++ b/tools/typescript/definitions/developer_private.d.ts
-@@ -264,6 +264,7 @@ declare global {
+@@ -281,6 +281,7 @@ declare global {
          isIncognitoAvailable: boolean;
          isChildAccount: boolean;
          isMv2DeprecationNoticeDismissed: boolean;
@@ -1243,7 +1234,7 @@ diff --git a/tools/typescript/definitions/developer_private.d.ts b/tools/typescr
        }
  
        export interface ExtensionConfigurationUpdate {
-@@ -281,6 +282,7 @@ declare global {
+@@ -297,6 +298,7 @@ declare global {
        export interface ProfileConfigurationUpdate {
          inDeveloperMode?: boolean;
          isMv2DeprecationNoticeDismissed?: boolean;

build/patches/Clear-CORS-Preflight-Cache-on-clearing-data.patch

@@ -15,7 +15,7 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 diff --git a/services/network/cors/preflight_cache.cc b/services/network/cors/preflight_cache.cc
 --- a/services/network/cors/preflight_cache.cc
 +++ b/services/network/cors/preflight_cache.cc
-@@ -204,6 +204,10 @@ void PreflightCache::MayPurgeForTesting(size_t max_entries, size_t purge_unit) {
+@@ -200,6 +200,10 @@ void PreflightCache::MayPurgeForTesting(size_t max_entries, size_t purge_unit) {
    MayPurge(max_entries, purge_unit);
  }
  
@@ -41,7 +41,7 @@ diff --git a/services/network/cors/preflight_cache.h b/services/network/cors/pre
 diff --git a/services/network/cors/preflight_controller.cc b/services/network/cors/preflight_controller.cc
 --- a/services/network/cors/preflight_controller.cc
 +++ b/services/network/cors/preflight_controller.cc
-@@ -762,6 +762,10 @@ void PreflightController::ClearCorsPreflightCache(
+@@ -835,6 +835,10 @@ void PreflightController::ClearCorsPreflightCache(
    cache_.ClearCache(std::move(url_filter));
  }
  
@@ -51,11 +51,11 @@ diff --git a/services/network/cors/preflight_controller.cc b/services/network/co
 +
  void PreflightController::RemoveLoader(PreflightLoader* loader) {
    auto it = loaders_.find(loader);
-   CHECK(it != loaders_.end());
+   CHECK(it != loaders_.end(), base::NotFatalUntil::M130);
 diff --git a/services/network/cors/preflight_controller.h b/services/network/cors/preflight_controller.h
 --- a/services/network/cors/preflight_controller.h
 +++ b/services/network/cors/preflight_controller.h
-@@ -151,6 +151,8 @@ class COMPONENT_EXPORT(NETWORK_SERVICE) PreflightController final {
+@@ -157,6 +157,8 @@ class COMPONENT_EXPORT(NETWORK_SERVICE) PreflightController final {
            url_loader_network_service_observer,
        const PreflightMode& preflight_mode);
  
@@ -79,7 +79,7 @@ diff --git a/services/network/cors/preflight_result.cc b/services/network/cors/p
 diff --git a/services/network/network_context.cc b/services/network/network_context.cc
 --- a/services/network/network_context.cc
 +++ b/services/network/network_context.cc
-@@ -1374,6 +1374,7 @@ void NetworkContext::ClearHttpCache(base::Time start_time,
+@@ -1320,6 +1320,7 @@ void NetworkContext::ClearHttpCache(base::Time start_time,
                                      base::Time end_time,
                                      mojom::ClearDataFilterPtr filter,
                                      ClearHttpCacheCallback callback) {

build/patches/Client-hints-overrides.patch

@@ -30,7 +30,7 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 diff --git a/components/embedder_support/user_agent_utils.cc b/components/embedder_support/user_agent_utils.cc
 --- a/components/embedder_support/user_agent_utils.cc
 +++ b/components/embedder_support/user_agent_utils.cc
-@@ -202,9 +202,7 @@ const blink::UserAgentBrandList GetUserAgentBrandList(
+@@ -188,9 +188,7 @@ const blink::UserAgentBrandList GetUserAgentBrandList(
    bool parse_result = base::StringToInt(major_version, &major_version_number);
    DCHECK(parse_result);
    std::optional<std::string> brand;
@@ -44,15 +44,15 @@ diff --git a/components/embedder_support/user_agent_utils.cc b/components/embedd
 diff --git a/content/browser/client_hints/client_hints.cc b/content/browser/client_hints/client_hints.cc
 --- a/content/browser/client_hints/client_hints.cc
 +++ b/content/browser/client_hints/client_hints.cc
-@@ -57,6 +57,7 @@
- #include "third_party/blink/public/common/features.h"
- #include "third_party/blink/public/common/page/page_zoom.h"
+@@ -60,6 +60,7 @@
+ #include "third_party/blink/public/common/permissions_policy/origin_with_possible_wildcards.h"
+ #include "third_party/blink/public/common/permissions_policy/permissions_policy.h"
  #include "third_party/blink/public/common/user_agent/user_agent_metadata.h"
 +#include "third_party/blink/renderer/platform/runtime_enabled_features.h"
  #include "ui/display/display.h"
  #include "ui/display/screen.h"
  #include "url/origin.h"
-@@ -703,7 +704,8 @@ void UpdateNavigationRequestClientUaHeadersImpl(
+@@ -704,7 +705,8 @@ void UpdateNavigationRequestClientUaHeadersImpl(
      // value, disable them. This overwrites previous decision from UI.
      disable_due_to_custom_ua = !ua_metadata.has_value();
    }
@@ -62,7 +62,7 @@ diff --git a/content/browser/client_hints/client_hints.cc b/content/browser/clie
    if (!disable_due_to_custom_ua) {
      if (!ua_metadata.has_value())
        ua_metadata = delegate->GetUserAgentMetadata();
-@@ -885,10 +887,12 @@ void AddRequestClientHintsHeaders(
+@@ -886,10 +888,12 @@ void AddRequestClientHintsHeaders(
      AddEctHeader(headers, network_quality_tracker, url);
    }
  
@@ -79,7 +79,7 @@ diff --git a/content/browser/client_hints/client_hints.cc b/content/browser/clie
  
    if (ShouldAddClientHint(data, WebClientHintsType::kPrefersColorScheme)) {
      AddPrefersColorSchemeHeader(headers, frame_tree_node);
-@@ -969,6 +973,7 @@ ParseAndPersistAcceptCHForNavigation(
+@@ -975,6 +979,7 @@ ParseAndPersistAcceptCHForNavigation(
      BrowserContext* context,
      ClientHintsControllerDelegate* delegate,
      FrameTreeNode* frame_tree_node) {
@@ -90,7 +90,7 @@ diff --git a/content/browser/client_hints/client_hints.cc b/content/browser/clie
 diff --git a/content/browser/loader/navigation_url_loader_impl.cc b/content/browser/loader/navigation_url_loader_impl.cc
 --- a/content/browser/loader/navigation_url_loader_impl.cc
 +++ b/content/browser/loader/navigation_url_loader_impl.cc
-@@ -1674,6 +1674,11 @@ void NavigationURLLoaderImpl::OnAcceptCHFrameReceived(
+@@ -1301,6 +1301,11 @@ void NavigationURLLoaderImpl::OnAcceptCHFrameReceived(
      return;
    }
  
@@ -131,7 +131,7 @@ new file mode 100644
 diff --git a/net/http/http_network_transaction.cc b/net/http/http_network_transaction.cc
 --- a/net/http/http_network_transaction.cc
 +++ b/net/http/http_network_transaction.cc
-@@ -111,6 +111,7 @@ const size_t kMaxRestarts = 32;
+@@ -109,6 +109,7 @@ const size_t kMaxRestarts = 32;
  
  // Returns true when Early Hints are allowed on the given protocol.
  bool EarlyHintsAreAllowedOn(HttpConnectionInfo connection_info) {
@@ -156,12 +156,12 @@ diff --git a/third_party/blink/common/client_hints/client_hints.cc b/third_party
 @@ -14,6 +14,7 @@
  #include "base/strings/string_util.h"
  #include "services/network/public/cpp/client_hints.h"
- #include "services/network/public/cpp/permissions_policy/client_hints_permissions_policy_mapping.h"
-+#include "third_party/blink/public/common/features_generated.h"
- #include "services/network/public/cpp/permissions_policy/permissions_policy.h"
  #include "third_party/blink/public/common/features.h"
++#include "third_party/blink/public/common/features_generated.h"
+ #include "third_party/blink/public/common/permissions_policy/permissions_policy.h"
  #include "url/origin.h"
-@@ -22,11 +23,12 @@ namespace blink {
+ 
+@@ -108,11 +109,12 @@ const PolicyFeatureToClientHintMap& GetPolicyFeatureToClientHintMap() {
  
  bool IsClientHintSentByDefault(network::mojom::WebClientHintsType type) {
    switch (type) {
@@ -234,7 +234,7 @@ diff --git a/third_party/blink/renderer/core/frame/navigator_ua_data.idl b/third
 diff --git a/third_party/blink/renderer/core/loader/frame_fetch_context.cc b/third_party/blink/renderer/core/loader/frame_fetch_context.cc
 --- a/third_party/blink/renderer/core/loader/frame_fetch_context.cc
 +++ b/third_party/blink/renderer/core/loader/frame_fetch_context.cc
-@@ -227,6 +227,8 @@ bool ShouldSendClientHint(const network::PermissionsPolicy& policy,
+@@ -217,6 +217,8 @@ bool ShouldSendClientHint(const PermissionsPolicy& policy,
                            bool is_1p_origin,
                            network::mojom::blink::WebClientHintsType type,
                            const ClientHintsPreferences& hints_preferences) {
@@ -243,7 +243,7 @@ diff --git a/third_party/blink/renderer/core/loader/frame_fetch_context.cc b/thi
    // For subresource requests, sending the hint in the fetch request based on
    // the permissions policy.
    if (!policy.IsFeatureEnabledForOrigin(
-@@ -630,7 +632,7 @@ void FrameFetchContext::AddClientHintsIfNecessary(
+@@ -610,7 +612,7 @@ void FrameFetchContext::AddClientHintsIfNecessary(
    }
  
    // Only send User Agent hints if the info is available
@@ -255,9 +255,9 @@ diff --git a/third_party/blink/renderer/core/loader/frame_fetch_context.cc b/thi
 diff --git a/third_party/blink/renderer/platform/runtime_enabled_features.json5 b/third_party/blink/renderer/platform/runtime_enabled_features.json5
 --- a/third_party/blink/renderer/platform/runtime_enabled_features.json5
 +++ b/third_party/blink/renderer/platform/runtime_enabled_features.json5
-@@ -532,6 +532,11 @@
-       name: "AriaNotifyV2",
-       status: {"Android": "test", "Win": "test", "Mac": "test", "Linux": "test"},
+@@ -438,6 +438,11 @@
+       name: "AriaNotify",
+       status: "test",
      },
 +    {
 +      name: "UserAgentClientHint",
@@ -267,7 +267,7 @@ diff --git a/third_party/blink/renderer/platform/runtime_enabled_features.json5
      {
        name: "AriaRowColIndexText",
        status: "stable",
-@@ -924,8 +929,7 @@
+@@ -804,8 +809,7 @@
        // Allows top-level sites to restrict collection of high-entropy UA client
        // hints (from 3Ps, or itself) via the getHighEntropyValues API.
        // crbug.com/385161047
@@ -275,6 +275,6 @@ diff --git a/third_party/blink/renderer/platform/runtime_enabled_features.json5
 -      status: "test",
 +      name: "ClientHintUAHighEntropyValuesPermissionPolicy",  // disabled by default
      },
-     {
-       // Enables clipboardchange event API for listening for changes to the
+     // This ensures that clipboard event fires on a target node which is
+     // focused in case no visible selection is present.
 --

build/patches/Close-Sessions-On-Ip-Change.patch

@@ -9,12 +9,12 @@ No change in doh connections.
 
 License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 ---
- .../browser/network_session_configurator.cc        | 12 ++++--------
+ .../browser/network_session_configurator.cc        | 11 ++++-------
  .../about_flags_cc/Close-Sessions-On-Ip-Change.inc | 14 ++++++++++++++
  .../features_cc/Close-Sessions-On-Ip-Change.inc    |  5 +++++
  .../features_h/Close-Sessions-On-Ip-Change.inc     |  3 +++
  net/base/features.cc                               |  2 +-
- 5 files changed, 27 insertions(+), 9 deletions(-)
+ 5 files changed, 27 insertions(+), 8 deletions(-)
  create mode 100644 cromite_flags/chrome/browser/about_flags_cc/Close-Sessions-On-Ip-Change.inc
  create mode 100644 cromite_flags/net/base/features_cc/Close-Sessions-On-Ip-Change.inc
  create mode 100644 cromite_flags/net/base/features_h/Close-Sessions-On-Ip-Change.inc
@@ -22,7 +22,7 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 diff --git a/components/network_session_configurator/browser/network_session_configurator.cc b/components/network_session_configurator/browser/network_session_configurator.cc
 --- a/components/network_session_configurator/browser/network_session_configurator.cc
 +++ b/components/network_session_configurator/browser/network_session_configurator.cc
-@@ -222,9 +222,8 @@ quic::QuicTagVector GetQuicClientConnectionOptions(
+@@ -220,9 +220,8 @@ quic::QuicTagVector GetQuicClientConnectionOptions(
  
  bool ShouldQuicCloseSessionsOnIpChange(
      const VariationParameters& quic_trial_params) {
@@ -34,15 +34,14 @@ diff --git a/components/network_session_configurator/browser/network_session_con
  }
  
  bool ShouldQuicGoAwaySessionsOnIpChange(
-@@ -305,11 +304,8 @@ bool ShouldQuicEstimateInitialRtt(
+@@ -303,10 +302,8 @@ bool ShouldQuicEstimateInitialRtt(
  
  bool ShouldQuicMigrateSessionsOnNetworkChangeV2(
      const VariationParameters& quic_trial_params) {
 -  return GetVariationBoolParamOrFeatureSetting(
 -      quic_trial_params, "migrate_sessions_on_network_change_v2",
 -      base::FeatureList::IsEnabled(
--          net::features::kMigrateSessionsOnNetworkChangeV2),
--      "true");
+-          net::features::kMigrateSessionsOnNetworkChangeV2));
 +  return base::FeatureList::IsEnabled(
 +          net::features::kMigrateSessionsOnNetworkChangeV2);
  }
@@ -88,7 +87,7 @@ new file mode 100644
 diff --git a/net/base/features.cc b/net/base/features.cc
 --- a/net/base/features.cc
 +++ b/net/base/features.cc
-@@ -581,7 +581,7 @@ BASE_FEATURE(kRelatedWebsitePartitionAPI,
+@@ -485,7 +485,7 @@ const base::FeatureParam<bool> kIpPrivacyOnlyInIncognito{
  // NetworkChangeNotifier::AreNetworkHandlesSupported).
  #if BUILDFLAG(IS_ANDROID)
  inline constexpr auto kMigrateSessionsOnNetworkChangeV2Default =

build/patches/Compress-libchrome-to-free-up-some-space.patch

@@ -13,7 +13,7 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 diff --git a/chrome/android/chrome_public_apk_tmpl.gni b/chrome/android/chrome_public_apk_tmpl.gni
 --- a/chrome/android/chrome_public_apk_tmpl.gni
 +++ b/chrome/android/chrome_public_apk_tmpl.gni
-@@ -677,6 +677,7 @@ template("chrome_common_apk_or_module_tmpl") {
+@@ -663,6 +663,7 @@ template("chrome_common_apk_or_module_tmpl") {
            [ "//components/crash/core/app:chrome_crashpad_handler_named_as_so" ]
        loadable_modules += [ "$root_out_dir/libchrome_crashpad_handler.so" ]
        library_always_compress += [ "libchrome_crashpad_handler.so" ]

build/patches/Cromite-Branding--improve-settings-ui.patch

@@ -8,17 +8,17 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 ---
  chrome/android/chrome_java_resources.gni      |   2 +-
  .../android/java/res/xml/main_preferences.xml |   4 +-
- .../res/xml/privacy_preferences_cromite.xml   | 191 ++++++++++++++++++
- .../privacy/settings/PrivacySettings.java     |   6 +-
+ .../res/xml/privacy_preferences_cromite.xml   | 197 ++++++++++++++++++
+ .../privacy/settings/PrivacySettings.java     |   4 +-
  .../Cromite-settings-ui.grdp                  |  15 ++
- 5 files changed, 213 insertions(+), 5 deletions(-)
+ 5 files changed, 217 insertions(+), 5 deletions(-)
  create mode 100644 chrome/android/java/res/xml/privacy_preferences_cromite.xml
  create mode 100644 chrome/browser/ui/android/strings/cromite_android_chrome_strings_grd/Cromite-settings-ui.grdp
 
 diff --git a/chrome/android/chrome_java_resources.gni b/chrome/android/chrome_java_resources.gni
 --- a/chrome/android/chrome_java_resources.gni
 +++ b/chrome/android/chrome_java_resources.gni
-@@ -634,7 +634,7 @@ chrome_java_resources = [
+@@ -643,7 +643,7 @@ chrome_java_resources = [
    "java/res/xml/manage_sync_preferences.xml",
    "java/res/xml/personalize_google_services_preferences.xml",
    "java/res/xml/incognito_preferences.xml",
@@ -52,7 +52,7 @@ diff --git a/chrome/android/java/res/xml/privacy_preferences_cromite.xml b/chrom
 new file mode 100644
 --- /dev/null
 +++ b/chrome/android/java/res/xml/privacy_preferences_cromite.xml
-@@ -0,0 +1,191 @@
+@@ -0,0 +1,197 @@
 +<?xml version="1.0" encoding="utf-8"?><!--
 +Copyright 2022 The Chromium Authors
 +Use of this source code is governed by a BSD-style license that can be
@@ -188,12 +188,13 @@ new file mode 100644
 +        android:title="@string/improve_search_suggestions_title"
 +        android:summary="@string/improve_search_suggestions_summary"
 +        android:persistent="false"/>
++    <Preference
++        android:key="phone_as_a_security_key"
++        android:title="@string/cablev2_paask_title"
++        android:summary="@string/cablev2_paask_body"
++        android:fragment="org.chromium.chrome.browser.webauthn.PrivacySettingsFragment" />
 +
 +    <!--Always hidden-->
-+    <org.chromium.chrome.browser.safety_hub.SafetyHubExpandablePreference
-+        android:key="advanced_protection_info"
-+        android:title="@string/settings_privacy_and_security_advanced_protection_section_title"
-+        app:isPreferenceVisible="false" />
 +    <Preference
 +        android:key="safe_browsing"
 +        android:title="@string/prefs_safe_browsing_title"
@@ -217,10 +218,14 @@ new file mode 100644
 +        android:fragment="org.chromium.components.privacy_sandbox.TrackingProtectionSettings"
 +        app:isPreferenceVisible="false" />
 +    <Preference
-+        android:key="incognito_tracking_protections"
-+        android:title="@string/incognito_tracking_protections_link_row_label"
-+        android:summary="@string/incognito_tracking_protections_link_row_sublabel"
-+        android:fragment="org.chromium.components.privacy_sandbox.IncognitoTrackingProtectionsFragment"
++        android:key="ip_protection"
++        android:title="@string/ip_protection_title"
++        android:fragment="org.chromium.components.privacy_sandbox.IpProtectionSettingsFragment"
++        app:isPreferenceVisible="false" />
++    <Preference
++        android:key="fp_protection"
++        android:title="@string/tracking_protection_fingerprinting_protection_title"
++        android:fragment="org.chromium.components.privacy_sandbox.FingerprintingProtectionSettingsFragment"
 +        app:isPreferenceVisible="false" />
 +    <Preference
 +        android:key="privacy_sandbox"
@@ -241,32 +246,31 @@ new file mode 100644
 +    <org.chromium.components.browser_ui.settings.ChromeBasePreference
 +        android:key="javascript_optimizer"
 +        android:title="@string/website_settings_privacy_and_security_javascript_optimizer_row_label"
++        android:summary="@string/website_settings_privacy_and_security_javascript_optimizer_summary"
 +        android:fragment="org.chromium.components.browser_ui.site_settings.SingleCategorySettings"
 +        app:isPreferenceVisible="false" />
 +</PreferenceScreen>
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/privacy/settings/PrivacySettings.java b/chrome/android/java/src/org/chromium/chrome/browser/privacy/settings/PrivacySettings.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/privacy/settings/PrivacySettings.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/privacy/settings/PrivacySettings.java
-@@ -193,7 +193,7 @@ public class PrivacySettings extends ChromeBaseSettingsFragment
-     public void onCreatePreferencesCromite(@Nullable Bundle savedInstanceState, @Nullable String rootKey) {
+@@ -147,7 +147,7 @@ public class PrivacySettings extends ChromeBaseSettingsFragment
+     public void onCreatePreferencesCromite(Bundle savedInstanceState, String rootKey) {
          mPageTitle.set(getString(R.string.prefs_privacy_security));
  
 -        SettingsUtils.addPreferencesFromResource(this, R.xml.privacy_preferences);
 +        SettingsUtils.addPreferencesFromResource(this, R.xml.privacy_preferences_cromite);
  
-         Preference incognitoTrackingProtectionsPreference =
-                 findPreference(PREF_INCOGNITO_TRACKING_PROTECTIONS);
-@@ -289,7 +289,9 @@ public class PrivacySettings extends ChromeBaseSettingsFragment
- 
-         ChromeSwitchPreference passwordLeakTogglePref =
+         Preference fpProtectionPreference = findPreference(PREF_FP_PROTECTION);
+         fpProtectionPreference.setVisible(shouldShowFpProtectionUi());
+@@ -244,7 +244,7 @@ public class PrivacySettings extends ChromeBaseSettingsFragment
                  (ChromeSwitchPreference) findPreference(PREF_PASSWORD_LEAK_DETECTION);
--        passwordLeakTogglePref.setOnPreferenceChangeListener(this);
-+        if (passwordLeakTogglePref != null) {
-+                passwordLeakTogglePref.setVisible(false);
-+        }
+         if (ChromeFeatureList.isEnabled(ChromeFeatureList.PASSWORD_LEAK_TOGGLE_MOVE)) {
+             passwordLeakTogglePref.setOnPreferenceChangeListener(this);
+-        } else {
++        } else if (passwordLeakTogglePref != null) {
+             passwordLeakTogglePref.setVisible(false);
+         }
  
-         mSearchSuggestions = (ChromeSwitchPreference) findPreference(PREF_SEARCH_SUGGESTIONS);
-         mSearchSuggestions.setOnPreferenceChangeListener(this);
 diff --git a/chrome/browser/ui/android/strings/cromite_android_chrome_strings_grd/Cromite-settings-ui.grdp b/chrome/browser/ui/android/strings/cromite_android_chrome_strings_grd/Cromite-settings-ui.grdp
 new file mode 100644
 --- /dev/null

build/patches/Cromite-Branding.patch

@@ -26,7 +26,6 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
  .../mipmap-xxxhdpi/layered_app_icon.png       | Bin 3652 -> 29220 bytes
  .../layered_app_icon_background.png           | Bin 3519 -> 142032 bytes
  .../values/channel_constants.xml              |   8 +-
- .../browser/fullscreen/FullscreenToast.java   |   2 +-
  .../inline/BromiteInlineUpdateController.java |  19 +++-
  chrome/app/extensions_strings.grdp            |   4 +-
  chrome/app/settings_strings.grdp              |   2 +-
@@ -36,7 +35,6 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
  .../theme/chromium/win/tiles/SmallLogo.png    | Bin 9784 -> 12363 bytes
  .../chromium/product_logo_32.png              | Bin 822 -> 2301 bytes
  chrome/browser/BUILD.gn                       |   1 +
- .../browser/flags/ChromeFeatureList.java      |   2 +-
  .../chrome/browser/omaha/UpdateConfigs.java   |   2 +-
  chrome/browser/prefs/BUILD.gn                 |   1 +
  .../prefs/chrome_pref_service_factory.cc      |   6 +-
@@ -60,16 +58,14 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
  .../webui/version/resources/about_version.ts  |   4 +-
  .../resources/about_version_mobile.css        |   9 ++
  content/child/runtime_features.cc             |  44 ++++-----
- .../Cromite-Branding.inc                      |   1 +
  tools/grit/grit/grd_reader.py                 |  35 +++++++
- 58 files changed, 204 insertions(+), 130 deletions(-)
- create mode 100644 cromite_flags/chrome/browser/flags/android/chrome_feature_list_cc/Cromite-Branding.inc
+ 55 files changed, 201 insertions(+), 128 deletions(-)
 
 diff --git a/build/BUILD.gn b/build/BUILD.gn
 --- a/build/BUILD.gn
 +++ b/build/BUILD.gn
-@@ -56,6 +56,14 @@ buildflag_header("branding_buildflags") {
-   flags += [ "ENABLE_BUILTIN_SEARCH_PROVIDER_ASSETS=$enable_builtin_search_provider_assets" ]
+@@ -55,6 +55,14 @@ buildflag_header("branding_buildflags") {
+   }
  }
  
 +buildflag_header("cromite_buildflags") {
@@ -86,8 +82,8 @@ diff --git a/build/BUILD.gn b/build/BUILD.gn
 diff --git a/build/config/BUILDCONFIG.gn b/build/config/BUILDCONFIG.gn
 --- a/build/config/BUILDCONFIG.gn
 +++ b/build/config/BUILDCONFIG.gn
-@@ -194,6 +194,10 @@ declare_args() {
-   clang_warning_suppression_file = ""
+@@ -186,6 +186,10 @@ declare_args() {
+   clang_unsafe_buffers_paths = ""
  }
  
 +declare_args() {
@@ -100,7 +96,7 @@ diff --git a/build/config/BUILDCONFIG.gn b/build/config/BUILDCONFIG.gn
 diff --git a/chrome/android/java/AndroidManifest.xml b/chrome/android/java/AndroidManifest.xml
 --- a/chrome/android/java/AndroidManifest.xml
 +++ b/chrome/android/java/AndroidManifest.xml
-@@ -189,7 +189,7 @@ by a child template that "extends" this file.
+@@ -178,7 +178,7 @@ by a child template that "extends" this file.
        <application android:name="{% block application_name %}org.chromium.chrome.browser.base.SplitChromeApplication{% endblock %}"
          android:icon="@drawable/ic_launcher"
          android:roundIcon="@drawable/ic_launcher_round"
@@ -9138,18 +9134,6 @@ diff --git a/chrome/android/java/res_chromium_base/values/channel_constants.xml
 +    <string name="search_widget_title" translatable="false">Cromite search</string>
 +    <string name="quick_action_search_widget_title" translatable="false">Cromite quick action search</string>
  </resources>
-diff --git a/chrome/android/java/src/org/chromium/chrome/browser/fullscreen/FullscreenToast.java b/chrome/android/java/src/org/chromium/chrome/browser/fullscreen/FullscreenToast.java
---- a/chrome/android/java/src/org/chromium/chrome/browser/fullscreen/FullscreenToast.java
-+++ b/chrome/android/java/src/org/chromium/chrome/browser/fullscreen/FullscreenToast.java
-@@ -108,7 +108,7 @@ interface FullscreenToast {
-             mNotificationToast =
-                     Toast.makeTextWithPriority(
-                             mActivity, toastTextId, Toast.LENGTH_LONG, ToastPriority.HIGH);
--            mNotificationToast.setGravity(Gravity.BOTTOM | Gravity.CENTER, 0, 0);
-+            mNotificationToast.setGravity(Gravity.TOP | Gravity.CENTER, 0, 0);
-             mNotificationToast.show();
-         }
- 
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/omaha/inline/BromiteInlineUpdateController.java b/chrome/android/java/src/org/chromium/chrome/browser/omaha/inline/BromiteInlineUpdateController.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/omaha/inline/BromiteInlineUpdateController.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/omaha/inline/BromiteInlineUpdateController.java
@@ -9196,7 +9180,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/omaha/inline/Br
 diff --git a/chrome/app/extensions_strings.grdp b/chrome/app/extensions_strings.grdp
 --- a/chrome/app/extensions_strings.grdp
 +++ b/chrome/app/extensions_strings.grdp
-@@ -398,7 +398,7 @@
+@@ -392,7 +392,7 @@
      No recent activities
    </message>
    <message name="IDS_EXTENSIONS_NO_INSTALLED_ITEMS" desc="The message shown to the user on the Extensions settings page when there are no extensions or apps installed.">
@@ -9205,27 +9189,27 @@ diff --git a/chrome/app/extensions_strings.grdp b/chrome/app/extensions_strings.
    </message>
    <message name="IDS_EXTENSIONS_NO_DESCRIPTION" desc="The message shown to the user when an extension does not have any description.">
      No description provided
-@@ -536,7 +536,7 @@
+@@ -530,7 +530,7 @@
      My extensions
    </message>
-   <message name="IDS_EXTENSIONS_SIDEBAR_DISCOVER_MORE" desc="The text displayed in the sidebar of the chrome://extensions page to open the Chrome Web Store to get more extensions.">
+   <message name="IDS_EXTENSIONS_SIDEBAR_DISCOVER_MORE" desc="The text displayed in the sidebar to open the Chrome Web Store to get more extensions.">
 -    Discover more extensions and themes on the <ph name="BEGIN_LINK">&lt;a target="_blank" href="$1"&gt;</ph>Chrome Web Store<ph name="END_LINK">&lt;/a&gt; <ex>&lt;/a&gt;</ex> </ph>
 +    Discover more extensions and themes on the <ph name="BEGIN_LINK">&lt;a target="_blank" href="$1"&gt;</ph>Chromedontreplace Web Store<ph name="END_LINK">&lt;/a&gt; <ex>&lt;/a&gt;</ex> </ph>
    </message>
-   <message name="IDS_EXTENSIONS_WHATS_NEW_SIDEBAR_PROMO" desc="The text displayed in the sidebar of the chrome://extensions page to promote the extension documenation, for when the user is in developer mode.">
-     Developing extensions? Stay up to date on <ph name="BEGIN_LINK">&lt;a target="_blank" href="$1"&gt;</ph>What's New<ph name="END_LINK">&lt;/a&gt;</ph> with Chrome Extension developer documentation.
+   <message name="IDS_EXTENSIONS_SIDEBAR_KEYBOARD_SHORTCUTS" desc="The text for the link to manage keyboard shortcuts for extensions.">
+     Keyboard shortcuts
 diff --git a/chrome/app/settings_strings.grdp b/chrome/app/settings_strings.grdp
 --- a/chrome/app/settings_strings.grdp
 +++ b/chrome/app/settings_strings.grdp
-@@ -84,7 +84,7 @@
-     Accessibility
+@@ -275,7 +275,7 @@
+     Change
    </message>
-   <message name="IDS_SETTINGS_ACCESSIBILITY_WEB_STORE" desc="Text for an external link explaining that additional accessibility features are found on the Chrome Web Store.">
+   <message name="IDS_SETTINGS_WEB_STORE" desc="Sub-label about choosing something from the Chrome Web Store.">
 -    Open Chrome Web Store
 +    Open Chromedontreplace Web Store
    </message>
-   <message name="IDS_SETTINGS_MORE_FEATURES_LINK" desc="Link which opens page where users can install extensions which provide additional accessibility features.">
-     Add accessibility features
+   <if expr="is_macosx">
+     <message name="IDS_SETTINGS_TABS_TO_LINKS_PREF" desc="The documentation string of the 'Tabs to Links' preference">
 diff --git a/chrome/app/theme/chromium/BRANDING b/chrome/app/theme/chromium/BRANDING
 --- a/chrome/app/theme/chromium/BRANDING
 +++ b/chrome/app/theme/chromium/BRANDING
@@ -13171,7 +13155,7 @@ e)fqMZZ`3a)Ds&5H<cfp<0000<MNUMnLSTYHt&Yn8
 diff --git a/chrome/browser/BUILD.gn b/chrome/browser/BUILD.gn
 --- a/chrome/browser/BUILD.gn
 +++ b/chrome/browser/BUILD.gn
-@@ -1914,6 +1914,7 @@ static_library("browser") {
+@@ -1844,6 +1844,7 @@ static_library("browser") {
      "//build/config/chromebox_for_meetings:buildflags",
      "//build/config/compiler:compiler_buildflags",
      "//build/config/linux/dbus:buildflags",
@@ -13179,22 +13163,10 @@ diff --git a/chrome/browser/BUILD.gn b/chrome/browser/BUILD.gn
      "//cc",
      "//chrome:extra_resources",
      "//chrome:resources",
-diff --git a/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureList.java b/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureList.java
---- a/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureList.java
-+++ b/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureList.java
-@@ -1340,7 +1340,7 @@ public abstract class ChromeFeatureList {
-     public static final MutableFlagWithSafeDefault sSuppressToolbarCapturesAtGestureEnd =
-             newMutableFlagWithSafeDefault(SUPPRESS_TOOLBAR_CAPTURES_AT_GESTURE_END, false);
-     public static final MutableFlagWithSafeDefault sSwapNewTabAndNewTabInGroupAndroid =
--            newMutableFlagWithSafeDefault(SWAP_NEW_TAB_AND_NEW_TAB_IN_GROUP_ANDROID, false);
-+            newMutableFlagWithSafeDefault(SWAP_NEW_TAB_AND_NEW_TAB_IN_GROUP_ANDROID, true);
-     public static final MutableFlagWithSafeDefault sTabArchivalDragDropAndroid =
-             newMutableFlagWithSafeDefault(TAB_ARCHIVAL_DRAG_DROP_ANDROID, true);
-     public static final MutableFlagWithSafeDefault sTabCollectionAndroid =
 diff --git a/chrome/browser/omaha/android/java/src/org/chromium/chrome/browser/omaha/UpdateConfigs.java b/chrome/browser/omaha/android/java/src/org/chromium/chrome/browser/omaha/UpdateConfigs.java
 --- a/chrome/browser/omaha/android/java/src/org/chromium/chrome/browser/omaha/UpdateConfigs.java
 +++ b/chrome/browser/omaha/android/java/src/org/chromium/chrome/browser/omaha/UpdateConfigs.java
-@@ -39,7 +39,7 @@ public class UpdateConfigs {
+@@ -37,7 +37,7 @@ public class UpdateConfigs {
      private static final String UPDATE_AVAILABLE_SWITCH_VALUE = "update_available";
      private static final String UNSUPPORTED_OS_VERSION_SWITCH_VALUE = "unsupported_os_version";
  
@@ -13206,27 +13178,27 @@ diff --git a/chrome/browser/omaha/android/java/src/org/chromium/chrome/browser/o
 diff --git a/chrome/browser/prefs/BUILD.gn b/chrome/browser/prefs/BUILD.gn
 --- a/chrome/browser/prefs/BUILD.gn
 +++ b/chrome/browser/prefs/BUILD.gn
-@@ -59,6 +59,7 @@ source_set("impl") {
+@@ -52,6 +52,7 @@ source_set("impl") {
    deps = [
      ":prefs",
      ":util",
 +    "//build:cromite_buildflags",
      "//chrome/browser:browser_process",
-     "//chrome/browser:flags",
-     "//chrome/browser/autocomplete:aim_eligibility_service",
+     "//chrome/browser/devtools",
+     "//chrome/browser/media/prefs",
 diff --git a/chrome/browser/prefs/chrome_pref_service_factory.cc b/chrome/browser/prefs/chrome_pref_service_factory.cc
 --- a/chrome/browser/prefs/chrome_pref_service_factory.cc
 +++ b/chrome/browser/prefs/chrome_pref_service_factory.cc
-@@ -26,6 +26,7 @@
- #include "base/trace_event/trace_event.h"
+@@ -27,6 +27,7 @@
  #include "build/branding_buildflags.h"
  #include "build/build_config.h"
+ #include "build/chromeos_buildflags.h"
 +#include "build/cromite_flags.h"
  #include "chrome/browser/browser_process.h"
  #include "chrome/browser/enterprise/signin/enterprise_signin_prefs.h"
  #include "chrome/browser/policy/chrome_browser_policy_connector.h"
-@@ -281,10 +282,7 @@ std::unique_ptr<ProfilePrefStoreManager> CreateProfilePrefStoreManager(
-     const base::FilePath& profile_path) {
+@@ -291,10 +292,7 @@ std::unique_ptr<ProfilePrefStoreManager> CreateProfilePrefStoreManager(
+ #endif
    std::string seed;
    CHECK(ui::ResourceBundle::HasSharedInstance());
 -#if BUILDFLAG(GOOGLE_CHROME_BRANDING)
@@ -13234,9 +13206,9 @@ diff --git a/chrome/browser/prefs/chrome_pref_service_factory.cc b/chrome/browse
 -      IDR_PREF_HASH_SEED_BIN));
 -#endif
 +  seed = BUILDFLAG_INTERNAL_CROMITE_PREF_HASH_SEED_BIN();
-   return std::make_unique<ProfilePrefStoreManager>(profile_path, seed);
+   return std::make_unique<ProfilePrefStoreManager>(profile_path, seed,
+                                                    legacy_device_id);
  }
- 
 diff --git a/chrome/browser/profiles/profile_shortcut_manager_win.cc b/chrome/browser/profiles/profile_shortcut_manager_win.cc
 --- a/chrome/browser/profiles/profile_shortcut_manager_win.cc
 +++ b/chrome/browser/profiles/profile_shortcut_manager_win.cc
@@ -13271,7 +13243,7 @@ diff --git a/chrome/browser/resources/settings/settings_menu/settings_menu.html
        #menu {
          color: var(--google-grey-700);
          display: flex;
-@@ -164,7 +176,7 @@
+@@ -173,7 +185,7 @@
          </a>
          <a role="menuitem" id="about-menu" href="/help"
              class="cr-nav-menu-item">
@@ -13283,7 +13255,7 @@ diff --git a/chrome/browser/resources/settings/settings_menu/settings_menu.html
 diff --git a/chrome/browser/ui/android/strings/android_chrome_strings.grd b/chrome/browser/ui/android/strings/android_chrome_strings.grd
 --- a/chrome/browser/ui/android/strings/android_chrome_strings.grd
 +++ b/chrome/browser/ui/android/strings/android_chrome_strings.grd
-@@ -2389,7 +2389,7 @@ Your Google account may have other forms of browsing history like searches and a
+@@ -2425,7 +2425,7 @@ Your Google account may have other forms of browsing history like searches and a
          About Chrome
        </message>
        <message name="IDS_LEGAL_INFORMATION_SUMMARY" desc="Summary for legal information" meaning="Android">
@@ -13295,7 +13267,7 @@ diff --git a/chrome/browser/ui/android/strings/android_chrome_strings.grd b/chro
 diff --git a/chrome/browser/ui/toolbar/chrome_labs/chrome_labs_utils.cc b/chrome/browser/ui/toolbar/chrome_labs/chrome_labs_utils.cc
 --- a/chrome/browser/ui/toolbar/chrome_labs/chrome_labs_utils.cc
 +++ b/chrome/browser/ui/toolbar/chrome_labs/chrome_labs_utils.cc
-@@ -140,6 +140,7 @@ bool AreNewChromeLabsExperimentsAvailable(Profile* profile) {
+@@ -144,6 +144,7 @@ bool AreNewChromeLabsExperimentsAvailable(const ChromeLabsModel* model,
  }
  
  bool IsChromeLabsEnabled() {
@@ -13306,16 +13278,16 @@ diff --git a/chrome/browser/ui/toolbar/chrome_labs/chrome_labs_utils.cc b/chrome
 diff --git a/chrome/common/url_constants.h b/chrome/common/url_constants.h
 --- a/chrome/common/url_constants.h
 +++ b/chrome/common/url_constants.h
-@@ -135,7 +135,7 @@ inline constexpr char kChromeHelpViaMenuURL[] =
- #endif  // BUILDFLAG(IS_CHROMEOS)
+@@ -136,7 +136,7 @@ inline constexpr char kChromeHelpViaMenuURL[] =
+ #endif  // BUILDFLAG(IS_CHROMEOS_ASH)
  
  inline constexpr char kChromeHelpViaWebUIURL[] =
 -    "https://support.google.com/chrome?p=help&ctx=settings";
 +    "https://github.com/uazo/cromite/issues";
- #if BUILDFLAG(IS_CHROMEOS)
+ #if BUILDFLAG(IS_CHROMEOS_ASH)
  inline constexpr char kChromeOsHelpViaWebUIURL[] =
  #if BUILDFLAG(GOOGLE_CHROME_BRANDING)
-@@ -198,7 +198,7 @@ inline constexpr char kChromeUIUntrustedNewTabPageUrl[] =
+@@ -199,7 +199,7 @@ inline constexpr char kChromeUIUntrustedNewTabPageUrl[] =
      "chrome-untrusted://new-tab-page/";
  
  // The URL for the Chromium project used in the About dialog.
@@ -13327,7 +13299,7 @@ diff --git a/chrome/common/url_constants.h b/chrome/common/url_constants.h
 diff --git a/chrome/install_static/chromium_install_modes.cc b/chrome/install_static/chromium_install_modes.cc
 --- a/chrome/install_static/chromium_install_modes.cc
 +++ b/chrome/install_static/chromium_install_modes.cc
-@@ -14,7 +14,7 @@ namespace install_static {
+@@ -16,7 +16,7 @@ namespace install_static {
  
  const wchar_t kCompanyPathName[] = L"";
  
@@ -13339,7 +13311,7 @@ diff --git a/chrome/install_static/chromium_install_modes.cc b/chrome/install_st
 diff --git a/components/browser_ui/strings/android/browser_ui_strings.grd b/components/browser_ui/strings/android/browser_ui_strings.grd
 --- a/components/browser_ui/strings/android/browser_ui_strings.grd
 +++ b/components/browser_ui/strings/android/browser_ui_strings.grd
-@@ -1005,7 +1005,7 @@
+@@ -975,7 +975,7 @@
  
        <!-- Accessibility preferences -->
        <message name="IDS_PREFS_ACCESSIBILITY" desc="Title of Accessibility settings, which allows the user to change webpage font sizes. [CHAR_LIMIT=32]">
@@ -18253,15 +18225,15 @@ diff --git a/components/omnibox/browser/vector_icons/product_chrome_refresh.icon
 -// found in the LICENSE file.
 -
 -CANVAS_DIMENSIONS, 15,
--MOVE_TO, 4.92, 7.5,
--R_CUBIC_TO, 0, 0.71, 0.25, 1.31, 0.76, 1.82,
--R_CUBIC_TO, 0.51, 0.51, 1.12, 0.76, 1.82, 0.76,
--R_CUBIC_TO, 0.7, 0, 1.31, -0.25, 1.82, -0.76,
--R_CUBIC_TO, 0.51, -0.51, 0.76, -1.12, 0.76, -1.82,
--R_CUBIC_TO, 0, -0.7, -0.25, -1.31, -0.76, -1.82,
--R_ARC_TO, 2.49, 2.49, 0, 0, 0, -1.82, -0.76,
--R_CUBIC_TO, -0.7, 0, -1.31, 0.25, -1.82, 0.76,
--R_ARC_TO, 2.49, 2.49, 0, 0, 0, -0.76, 1.82,
+-MOVE_TO, 4.92f, 7.5f,
+-R_CUBIC_TO, 0, 0.71f, 0.25f, 1.31f, 0.76f, 1.82f,
+-R_CUBIC_TO, 0.51f, 0.51f, 1.12f, 0.76f, 1.82f, 0.76f,
+-R_CUBIC_TO, 0.7f, 0, 1.31f, -0.25f, 1.82f, -0.76f,
+-R_CUBIC_TO, 0.51f, -0.51f, 0.76f, -1.12f, 0.76f, -1.82f,
+-R_CUBIC_TO, 0, -0.7f, -0.25f, -1.31f, -0.76f, -1.82f,
+-R_ARC_TO, 2.49f, 2.49f, 0, 0, 0, -1.82f, -0.76f,
+-R_CUBIC_TO, -0.7f, 0, -1.31f, 0.25f, -1.82f, 0.76f,
+-R_ARC_TO, 2.49f, 2.49f, 0, 0, 0, -0.76f, 1.82f,
 +CANVAS_DIMENSIONS, 16,
 +MOVE_TO, 15.99f, 8,
 +CUBIC_TO, 15.99f, 9.83f, 15.37f, 11.52f, 14.34f, 12.87f,
@@ -18273,47 +18245,47 @@ diff --git a/components/omnibox/browser/vector_icons/product_chrome_refresh.icon
 +CUBIC_TO, 14.47f, 3.29f, 14.38f, 3.18f, 14.29f, 3.07f,
 +CUBIC_TO, 15.36f, 4.43f, 15.99f, 6.14f, 15.99f, 8,
  CLOSE,
--MOVE_TO, 7.5, 11.48,
--R_CUBIC_TO, 0.14, 0, 0.28, 0, 0.41, -0.02,
--R_CUBIC_TO, 0.13, -0.01, 0.26, -0.04, 0.39, -0.07,
--LINE_TO, 6.77, 14.06,
--R_CUBIC_TO, -1.65, -0.19, -3.04, -0.89, -4.15, -2.12,
--CUBIC_TO, 1.5, 10.71, 0.94, 9.24, 0.94, 7.55,
--R_CUBIC_TO, 0, -0.46, 0.05, -0.9, 0.13, -1.33,
--R_CUBIC_TO, 0.08, -0.44, 0.22, -0.85, 0.39, -1.25,
--R_LINE_TO, 2.63, 4.55,
--R_CUBIC_TO, 0.34, 0.59, 0.81, 1.07, 1.41, 1.43,
--R_CUBIC_TO, 0.6, 0.36, 1.26, 0.54, 2.01, 0.54,
+-MOVE_TO, 7.5f, 11.48f,
+-R_CUBIC_TO, 0.14f, 0, 0.28f, 0, 0.41f, -0.02f,
+-R_CUBIC_TO, 0.13f, -0.01f, 0.26f, -0.04f, 0.39f, -0.07f,
+-LINE_TO, 6.77f, 14.06f,
+-R_CUBIC_TO, -1.65f, -0.19f, -3.04f, -0.89f, -4.15f, -2.12f,
+-CUBIC_TO, 1.5f, 10.71f, 0.94f, 9.24f, 0.94f, 7.55f,
+-R_CUBIC_TO, 0, -0.46f, 0.05f, -0.9f, 0.13f, -1.33f,
+-R_CUBIC_TO, 0.08f, -0.44f, 0.22f, -0.85f, 0.39f, -1.25f,
+-R_LINE_TO, 2.63f, 4.55f,
+-R_CUBIC_TO, 0.34f, 0.59f, 0.81f, 1.07f, 1.41f, 1.43f,
+-R_CUBIC_TO, 0.6f, 0.36f, 1.26f, 0.54f, 2.01f, 0.54f,
 +MOVE_TO, 14.29f, 3.07f,
 +CUBIC_TO, 14.29f, 3.06f, 14.28f, 3.05f, 14.27f, 3.04f,
 +CUBIC_TO, 14.28f, 3.05f, 14.29f, 3.06f, 14.29f, 3.07f,
  CLOSE,
--R_MOVE_TO, 0, -7.87,
--R_CUBIC_TO, -0.87, 0, -1.65, 0.25, -2.33, 0.77,
--R_ARC_TO, 3.95, 3.95, 0, 0, 0, -1.42, 1.94,
--LINE_TO, 2.21, 3.66,
--R_ARC_TO, 6.79, 6.79, 0, 0, 1, 2.27, -1.94,
--CUBIC_TO, 5.4, 1.22, 6.4, 0.98, 7.5, 0.98,
--R_CUBIC_TO, 1.1, 0, 2.08, 0.24, 2.99, 0.72,
--ARC_TO, 6.66, 6.66, 0, 0, 1, 12.76, 3.6,
--H_LINE_TO, 7.51,
--R_LINE_TO, -0.01, 0.01,
+-R_MOVE_TO, 0, -7.87f,
+-R_CUBIC_TO, -0.87f, 0, -1.65f, 0.25f, -2.33f, 0.77f,
+-R_ARC_TO, 3.95f, 3.95f, 0, 0, 0, -1.42f, 1.94f,
+-LINE_TO, 2.21f, 3.66f,
+-R_ARC_TO, 6.79f, 6.79f, 0, 0, 1, 2.27f, -1.94f,
+-CUBIC_TO, 5.4f, 1.22f, 6.4f, 0.98f, 7.5f, 0.98f,
+-R_CUBIC_TO, 1.1f, 0, 2.08f, 0.24f, 2.99f, 0.72f,
+-ARC_TO, 6.66f, 6.66f, 0, 0, 1, 12.76f, 3.6f,
+-H_LINE_TO, 7.51f,
+-R_LINE_TO, -0.01f, 0.01f,
 +MOVE_TO, 14.34f, 12.87f,
 +CUBIC_TO, 14.29f, 12.93f, 14.24f, 12.99f, 14.2f, 13.05f,
 +CUBIC_TO, 14.24f, 12.99f, 14.29f, 12.93f, 14.34f, 12.87f,
  CLOSE,
--R_MOVE_TO, 6.01, 1.31,
--R_CUBIC_TO, 0.19, 0.4, 0.32, 0.83, 0.41, 1.27,
--R_CUBIC_TO, 0.09, 0.44, 0.15, 0.89, 0.15, 1.36,
--R_CUBIC_TO, 0, 1.7, -0.55, 3.16, -1.68, 4.38,
--R_CUBIC_TO, -1.11, 1.23, -2.47, 1.93, -4.1, 2.13,
--R_LINE_TO, 2.63, -4.55,
--R_CUBIC_TO, 0.17, -0.28, 0.29, -0.59, 0.38, -0.92,
--R_CUBIC_TO, 0.09, -0.34, 0.15, -0.69, 0.15, -1.05,
--R_CUBIC_TO, 0, -0.52, -0.09, -0.99, -0.28, -1.42,
--R_ARC_TO, 3.96, 3.96, 0, 0, 0, -0.74, -1.2,
--R_H_LINE_TO, 3.08,
--R_V_LINE_TO, 0.01,
+-R_MOVE_TO, 6.01f, 1.31f,
+-R_CUBIC_TO, 0.19f, 0.4f, 0.32f, 0.83f, 0.41f, 1.27f,
+-R_CUBIC_TO, 0.09f, 0.44f, 0.15f, 0.89f, 0.15f, 1.36f,
+-R_CUBIC_TO, 0, 1.7f, -0.55f, 3.16f, -1.68f, 4.38f,
+-R_CUBIC_TO, -1.11f, 1.23f, -2.47f, 1.93f, -4.1f, 2.13f,
+-R_LINE_TO, 2.63f, -4.55f,
+-R_CUBIC_TO, 0.17f, -0.28f, 0.29f, -0.59f, 0.38f, -0.92f,
+-R_CUBIC_TO, 0.09f, -0.34f, 0.15f, -0.69f, 0.15f, -1.05f,
+-R_CUBIC_TO, 0, -0.52f, -0.09f, -0.99f, -0.28f, -1.42f,
+-R_ARC_TO, 3.96f, 3.96f, 0, 0, 0, -0.74f, -1.2f,
+-R_H_LINE_TO, 3.08f,
+-R_V_LINE_TO, 0.01f,
 +MOVE_TO, 14.27f, 3.04f,
 +CUBIC_TO, 14.19f, 2.94f, 14.11f, 2.84f, 14.02f, 2.74f,
 +CUBIC_TO, 14.11f, 2.84f, 14.19f, 2.94f, 14.27f, 3.04f,
@@ -18985,7 +18957,7 @@ diff --git a/components/webui/version/resources/about_version_mobile.css b/compo
 diff --git a/content/child/runtime_features.cc b/content/child/runtime_features.cc
 --- a/content/child/runtime_features.cc
 +++ b/content/child/runtime_features.cc
-@@ -568,19 +568,22 @@ void ResolveInvalidConfigurations() {
+@@ -564,19 +564,22 @@ void ResolveInvalidConfigurations() {
         base::FeatureList::IsEnabled(
             features::kPrivacySandboxAdsAPIsM1Override)) &&
        !base::FeatureList::IsEnabled(blink::features::kFencedFrames)) {
@@ -19012,7 +18984,7 @@ diff --git a/content/child/runtime_features.cc b/content/child/runtime_features.
          << "Fenced frames must be enabled in order to enable local "
             "unpartitioned "
          << "data access. Use --" << switches::kEnableFeatures << "="
-@@ -588,12 +591,14 @@ void ResolveInvalidConfigurations() {
+@@ -584,12 +587,14 @@ void ResolveInvalidConfigurations() {
      WebRuntimeFeatures::EnableFeatureFromString(
          "FencedFramesLocalUnpartitionedDataAccess", false);
    }
@@ -19022,13 +18994,13 @@ diff --git a/content/child/runtime_features.cc b/content/child/runtime_features.
    // Topics API cannot be enabled without the support of the browser process.
    // The Document API should be additionally gated by the
    // `kBrowsingTopicsDocumentAPI` feature.
-   if (!base::FeatureList::IsEnabled(network::features::kBrowsingTopics)) {
+   if (!base::FeatureList::IsEnabled(blink::features::kBrowsingTopics)) {
 -    LOG_IF(WARNING, WebRuntimeFeatures::IsTopicsAPIEnabled())
 +    CHECK(!WebRuntimeFeatures::IsTopicsAPIEnabled())
          << "Topics cannot be enabled in this configuration. Use --"
          << switches::kEnableFeatures << "="
-         << network::features::kBrowsingTopics.name << " in addition.";
-@@ -601,30 +606,23 @@ void ResolveInvalidConfigurations() {
+         << blink::features::kBrowsingTopics.name << " in addition.";
+@@ -597,30 +602,23 @@ void ResolveInvalidConfigurations() {
      WebRuntimeFeatures::EnableTopicsDocumentAPI(false);
      WebRuntimeFeatures::EnableTopicsImgAPI(false);
    } else {
@@ -19045,14 +19017,14 @@ diff --git a/content/child/runtime_features.cc b/content/child/runtime_features.
 +    CHECK(false) << "kBrowsingTopics is enabled!";
    }
  
-   if (!base::FeatureList::IsEnabled(network::features::kSharedStorageAPI)) {
+   if (!base::FeatureList::IsEnabled(blink::features::kSharedStorageAPI)) {
 -    LOG_IF(WARNING, WebRuntimeFeatures::IsSharedStorageAPIEnabled())
 -        << "SharedStorage cannot be enabled in this "
 +    CHECK(!WebRuntimeFeatures::IsSharedStorageAPIEnabled())
 +        << "SharedStorage for M118+ cannot be enabled in this "
             "configuration. Use --"
          << switches::kEnableFeatures << "="
-         << network::features::kSharedStorageAPI.name << " in addition.";
+         << blink::features::kSharedStorageAPI.name << " in addition.";
      WebRuntimeFeatures::EnableSharedStorageAPI(false);
 +  } else {
 +    CHECK(false) << "kSharedStorageAPI is enabled!";
@@ -19065,21 +19037,21 @@ diff --git a/content/child/runtime_features.cc b/content/child/runtime_features.
          << "AttributionReporting cannot be enabled in this "
             "configuration. Use --"
          << switches::kEnableFeatures << "="
-@@ -632,23 +630,25 @@ void ResolveInvalidConfigurations() {
+@@ -628,23 +626,25 @@ void ResolveInvalidConfigurations() {
          << " in addition.";
      WebRuntimeFeatures::EnableAttributionReporting(false);
    }
 +  CHECK(!base::FeatureList::IsEnabled(attribution_reporting::features::kConversionMeasurement))
 +    << "kConversionMeasurement is enabled!";
  
-   if (!base::FeatureList::IsEnabled(network::features::kInterestGroupStorage)) {
+   if (!base::FeatureList::IsEnabled(blink::features::kInterestGroupStorage)) {
 -    LOG_IF(WARNING,
 -           WebRuntimeFeatures::IsAdInterestGroupAPIEnabledByRuntimeFlag())
 +    CHECK(!WebRuntimeFeatures::IsAdInterestGroupAPIEnabledByRuntimeFlag())
          << "AdInterestGroupAPI cannot be enabled in this "
             "configuration. Use --"
          << switches::kEnableFeatures << "="
-         << network::features::kInterestGroupStorage.name << " in addition.";
+         << blink::features::kInterestGroupStorage.name << " in addition.";
      WebRuntimeFeatures::EnableAdInterestGroupAPI(false);
      WebRuntimeFeatures::EnableFledge(false);
 +  } else {
@@ -19095,16 +19067,10 @@ diff --git a/content/child/runtime_features.cc b/content/child/runtime_features.
          << "PermissionElement cannot be enabled in this configuration. Use --"
          << switches::kEnableFeatures << "="
          << blink::features::kPermissionElement.name << " instead.";
-diff --git a/cromite_flags/chrome/browser/flags/android/chrome_feature_list_cc/Cromite-Branding.inc b/cromite_flags/chrome/browser/flags/android/chrome_feature_list_cc/Cromite-Branding.inc
-new file mode 100644
---- /dev/null
-+++ b/cromite_flags/chrome/browser/flags/android/chrome_feature_list_cc/Cromite-Branding.inc
-@@ -0,0 +1 @@
-+SET_CROMITE_FEATURE_DISABLED(kSwapNewTabAndNewTabInGroupAndroid);
 diff --git a/tools/grit/grit/grd_reader.py b/tools/grit/grit/grd_reader.py
 --- a/tools/grit/grit/grd_reader.py
 +++ b/tools/grit/grit/grd_reader.py
-@@ -129,6 +129,7 @@ class GrdContentHandler(xml.sax.handler.ContentHandler):
+@@ -126,6 +126,7 @@ class GrdContentHandler(xml.sax.handler.ContentHandler):
    def characters(self, content):
      if self.ignore_depth == 0:
        if self.stack[-1]:
@@ -19112,7 +19078,7 @@ diff --git a/tools/grit/grit/grd_reader.py b/tools/grit/grit/grd_reader.py
          self.stack[-1].AppendContent(content)
  
    def ignorableWhitespace(self, whitespace):
-@@ -136,6 +137,40 @@ class GrdContentHandler(xml.sax.handler.ContentHandler):
+@@ -133,6 +134,40 @@ class GrdContentHandler(xml.sax.handler.ContentHandler):
      # parser?
      pass
  

build/patches/Customize-selection-popup.patch

@@ -23,7 +23,7 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ChromeActionModeHandler.java b/chrome/android/java/src/org/chromium/chrome/browser/ChromeActionModeHandler.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/ChromeActionModeHandler.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/ChromeActionModeHandler.java
-@@ -173,9 +173,7 @@ public class ChromeActionModeHandler {
+@@ -166,9 +166,7 @@ public class ChromeActionModeHandler {
                              | ActionModeCallbackHelper.MENU_ITEM_SHARE;
              // Disable options that expose additional Chrome functionality prior to the FRE being
              // completed (i.e. creation of a new tab).
@@ -37,7 +37,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ChromeActionMod
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java b/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java
-@@ -884,10 +884,17 @@ public class ChromeTabbedActivity extends ChromeActivity {
+@@ -781,10 +781,17 @@ public class ChromeTabbedActivity extends ChromeActivity implements MismatchedIn
                                  @TabLaunchType int type,
                                  @TabCreationState int creationState,
                                  boolean markedForSelection) {
@@ -62,7 +62,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedAct
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/app/tab_activity_glue/ActivityTabWebContentsDelegateAndroid.java b/chrome/android/java/src/org/chromium/chrome/browser/app/tab_activity_glue/ActivityTabWebContentsDelegateAndroid.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/app/tab_activity_glue/ActivityTabWebContentsDelegateAndroid.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/app/tab_activity_glue/ActivityTabWebContentsDelegateAndroid.java
-@@ -258,6 +258,14 @@ public class ActivityTabWebContentsDelegateAndroid extends TabWebContentsDelegat
+@@ -195,12 +195,20 @@ public class ActivityTabWebContentsDelegateAndroid extends TabWebContentsDelegat
          // Skip opening a new Tab if it doesn't make sense.
          if (mTab.isClosing()) return false;
  
@@ -74,22 +74,20 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/app/tab_activit
 +            tabLaunchType = TabLaunchType.FROM_LONGPRESS_BACKGROUND_IN_GROUP;
 +        }
 +
-         WindowAndroid window = mTab.getWindowAndroid();
-         boolean openingPopup =
-                 window != null
-@@ -288,7 +296,7 @@ public class ActivityTabWebContentsDelegateAndroid extends TabWebContentsDelegat
-                         mTab,
-                         /* shouldPin= */ false,
-                         webContents,
--                        TabLaunchType.FROM_LONGPRESS_FOREGROUND,
-+                        tabLaunchType,
-                         url,
-                         !openingPopup && !willReparentTab);
-         if (tab == null) return false;
+         // Creating new Tabs asynchronously requires starting a new Activity to create the Tab,
+         // so the Tab returned will always be null.  There's no way to know synchronously
+         // whether the Tab is created, so assume it's always successful.
+         boolean success =
+                 tabCreator.createTabWithWebContents(
+-                        mTab, webContents, TabLaunchType.FROM_LONGPRESS_FOREGROUND, url);
++                        mTab, webContents, tabLaunchType, url);
+ 
+         if (success) {
+             if (disposition == WindowOpenDisposition.NEW_FOREGROUND_TAB) {
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/compositor/layouts/LayoutManagerImpl.java b/chrome/android/java/src/org/chromium/chrome/browser/compositor/layouts/LayoutManagerImpl.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/compositor/layouts/LayoutManagerImpl.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/compositor/layouts/LayoutManagerImpl.java
-@@ -18,6 +18,7 @@ import android.view.ViewGroup;
+@@ -18,6 +18,7 @@ import androidx.annotation.Nullable;
  import androidx.annotation.VisibleForTesting;
  
  import org.chromium.base.Callback;
@@ -97,7 +95,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/compositor/layo
  import org.chromium.base.ObserverList;
  import org.chromium.base.TraceEvent;
  import org.chromium.base.supplier.ObservableSupplier;
-@@ -246,6 +247,13 @@ public class LayoutManagerImpl
+@@ -237,6 +238,13 @@ public class LayoutManagerImpl
                                                  != TabLaunchType
                                                          .FROM_COLLABORATION_BACKGROUND_IN_GROUP)
                                  || (!getTabModelSelector().isIncognitoSelected() && incognito);
@@ -114,8 +112,8 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/compositor/layo
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tab/TabContextMenuItemDelegate.java b/chrome/android/java/src/org/chromium/chrome/browser/tab/TabContextMenuItemDelegate.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/tab/TabContextMenuItemDelegate.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/tab/TabContextMenuItemDelegate.java
-@@ -385,8 +385,13 @@ public class TabContextMenuItemDelegate implements ContextMenuItemDelegate {
-     public void onOpenImageInNewTab(GURL url, @Nullable Referrer referrer) {
+@@ -317,8 +317,13 @@ public class TabContextMenuItemDelegate implements ContextMenuItemDelegate {
+     public void onOpenImageInNewTab(GURL url, Referrer referrer) {
          LoadUrlParams loadUrlParams = new LoadUrlParams(url.getSpec());
          loadUrlParams.setReferrer(referrer);
 +        @TabLaunchType int type = TabLaunchType.FROM_LONGPRESS_BACKGROUND;
@@ -132,7 +130,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tab/TabContextM
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ui/RootUiCoordinator.java b/chrome/android/java/src/org/chromium/chrome/browser/ui/RootUiCoordinator.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/ui/RootUiCoordinator.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/ui/RootUiCoordinator.java
-@@ -30,6 +30,7 @@ import androidx.core.view.WindowInsetsCompat;
+@@ -28,6 +28,7 @@ import androidx.appcompat.content.res.AppCompatResources;
  import org.chromium.base.BuildInfo;
  import org.chromium.base.Callback;
  import org.chromium.base.CallbackController;
@@ -140,7 +138,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ui/RootUiCoordi
  import org.chromium.base.TraceEvent;
  import org.chromium.base.lifetime.Destroyable;
  import org.chromium.base.metrics.RecordUserAction;
-@@ -842,11 +843,16 @@ public class RootUiCoordinator
+@@ -823,11 +824,16 @@ public class RootUiCoordinator
                      TrackerFactory.getTrackerForProfile(tab.getProfile())
                              .notifyEvent(EventConstants.WEB_SEARCH_PERFORMED);
  
@@ -200,7 +198,7 @@ new file mode 100644
 diff --git a/components/browser_ui/accessibility/android/java/res/xml/accessibility_preferences.xml b/components/browser_ui/accessibility/android/java/res/xml/accessibility_preferences.xml
 --- a/components/browser_ui/accessibility/android/java/res/xml/accessibility_preferences.xml
 +++ b/components/browser_ui/accessibility/android/java/res/xml/accessibility_preferences.xml
-@@ -79,4 +79,28 @@ found in the LICENSE file.
+@@ -73,4 +73,28 @@ found in the LICENSE file.
          android:key="disable_toolbar_swipeup"
          android:title="@string/disable_toolbar_swipe_up" />
  
@@ -465,7 +463,7 @@ diff --git a/content/public/android/java/src/org/chromium/content/browser/select
  import org.chromium.base.ObserverList;
  import org.chromium.base.UserData;
  import org.chromium.build.annotations.Initializer;
-@@ -84,6 +85,9 @@ public class SmartSelectionClient implements SelectionClient, UserData {
+@@ -85,6 +86,9 @@ public class SmartSelectionClient implements SelectionClient, UserData {
              return null;
          }
  
@@ -474,5 +472,5 @@ diff --git a/content/public/android/java/src/org/chromium/content/browser/select
 +
          SmartSelectionClient client =
                  assumeNonNull(
-                         webContents.getOrSetUserData(
+                         ((WebContentsImpl) webContents)
 --

build/patches/Dictionary-suggestions-for-the-Omnibox.patch

@@ -23,11 +23,11 @@ diff --git a/chrome/android/java/res/layout/url_bar.xml b/chrome/android/java/re
      android:textAppearance="@style/TextAppearance.SearchBoxText"
 +    android:inputType="textUri"
      android:hint="@string/omnibox_empty_hint"
-     android:importantForAutofill="no"/>
+     android:importantForAutofill="no" />
 diff --git a/chrome/browser/ui/android/omnibox/java/src/org/chromium/chrome/browser/omnibox/LocationBarMediator.java b/chrome/browser/ui/android/omnibox/java/src/org/chromium/chrome/browser/omnibox/LocationBarMediator.java
 --- a/chrome/browser/ui/android/omnibox/java/src/org/chromium/chrome/browser/omnibox/LocationBarMediator.java
 +++ b/chrome/browser/ui/android/omnibox/java/src/org/chromium/chrome/browser/omnibox/LocationBarMediator.java
-@@ -307,8 +307,17 @@ class LocationBarMediator
+@@ -297,8 +297,17 @@ class LocationBarMediator
              if (!mUrlFocusedWithPastedText
                      && !shouldRetainOmniboxOnFocus
                      && mLocationBarLayout.shouldClearTextOnFocus()) {
@@ -50,7 +50,7 @@ diff --git a/chrome/browser/ui/android/omnibox/java/src/org/chromium/chrome/brow
 diff --git a/chrome/browser/ui/android/omnibox/java/src/org/chromium/chrome/browser/omnibox/UrlBar.java b/chrome/browser/ui/android/omnibox/java/src/org/chromium/chrome/browser/omnibox/UrlBar.java
 --- a/chrome/browser/ui/android/omnibox/java/src/org/chromium/chrome/browser/omnibox/UrlBar.java
 +++ b/chrome/browser/ui/android/omnibox/java/src/org/chromium/chrome/browser/omnibox/UrlBar.java
-@@ -11,6 +11,7 @@ import android.graphics.Canvas;
+@@ -9,6 +9,7 @@ import android.graphics.Canvas;
  import android.graphics.Paint;
  import android.graphics.Rect;
  import android.os.Build;
@@ -58,7 +58,7 @@ diff --git a/chrome/browser/ui/android/omnibox/java/src/org/chromium/chrome/brow
  import android.os.SystemClock;
  import android.text.Editable;
  import android.text.InputType;
-@@ -115,6 +116,7 @@ public class UrlBar extends AutocompleteEditText {
+@@ -110,6 +111,7 @@ public class UrlBar extends AutocompleteEditText {
      private boolean mAllowFocus = true;
      private boolean mShouldSendTypingStartedEvent;
  
@@ -66,7 +66,7 @@ diff --git a/chrome/browser/ui/android/omnibox/java/src/org/chromium/chrome/brow
      private boolean mPendingScroll;
      private boolean mIsInCct;
  
-@@ -352,6 +354,28 @@ public class UrlBar extends AutocompleteEditText {
+@@ -336,6 +338,28 @@ public class UrlBar extends AutocompleteEditText {
          fixupTextDirection();
  
          mShouldSendTypingStartedEvent = focused;

build/patches/Disable-Accessibility-service-by-default.patch

@@ -42,7 +42,7 @@ diff --git a/components/browser_ui/accessibility/android/java/res/xml/accessibil
 diff --git a/content/public/android/java/src/org/chromium/content/browser/accessibility/WebContentsAccessibilityImpl.java b/content/public/android/java/src/org/chromium/content/browser/accessibility/WebContentsAccessibilityImpl.java
 --- a/content/public/android/java/src/org/chromium/content/browser/accessibility/WebContentsAccessibilityImpl.java
 +++ b/content/public/android/java/src/org/chromium/content/browser/accessibility/WebContentsAccessibilityImpl.java
-@@ -1125,6 +1125,11 @@ public class WebContentsAccessibilityImpl extends AccessibilityNodeProviderCompa
+@@ -1095,6 +1095,11 @@ public class WebContentsAccessibilityImpl extends AccessibilityNodeProviderCompa
              structure.setChildCount(0);
              return;
          }

build/patches/Disable-Android-AppRestrictions.patch

@@ -21,26 +21,26 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 diff --git a/chrome/browser/enterprise/util/BUILD.gn b/chrome/browser/enterprise/util/BUILD.gn
 --- a/chrome/browser/enterprise/util/BUILD.gn
 +++ b/chrome/browser/enterprise/util/BUILD.gn
-@@ -21,6 +21,7 @@ android_library("java") {
+@@ -20,6 +20,7 @@ android_library("java") {
      "//build/android:build_java",
      "//chrome/browser/flags:java",
      "//chrome/browser/profiles/android:java",
 +    "//components/policy/android:policy_java",
-     "//content/public/android:content_java",
      "//third_party/androidx:androidx_annotation_annotation_java",
      "//third_party/jni_zero:jni_zero_java",
+   ]
 diff --git a/chrome/browser/enterprise/util/android/java/src/org/chromium/chrome/browser/enterprise/util/EnterpriseInfoImpl.java b/chrome/browser/enterprise/util/android/java/src/org/chromium/chrome/browser/enterprise/util/EnterpriseInfoImpl.java
 --- a/chrome/browser/enterprise/util/android/java/src/org/chromium/chrome/browser/enterprise/util/EnterpriseInfoImpl.java
 +++ b/chrome/browser/enterprise/util/android/java/src/org/chromium/chrome/browser/enterprise/util/EnterpriseInfoImpl.java
-@@ -31,6 +31,7 @@ import org.chromium.build.annotations.NullMarked;
- import org.chromium.build.annotations.Nullable;
- import org.chromium.chrome.browser.flags.ChromeFeatureList;
+@@ -23,6 +23,7 @@ import org.chromium.base.metrics.RecordHistogram;
+ import org.chromium.base.task.AsyncTask;
+ import org.chromium.base.task.TaskTraits;
  import org.chromium.chrome.browser.flags.ChromeSwitches;
 +import org.chromium.components.policy.AppRestrictionsProvider;
  
  import java.util.LinkedList;
- import java.util.List;
-@@ -113,6 +114,10 @@ public class EnterpriseInfoImpl extends EnterpriseInfo {
+ import java.util.Queue;
+@@ -104,6 +105,10 @@ public class EnterpriseInfoImpl extends EnterpriseInfo {
              new AsyncTask<OwnedState>() {
                  // TODO: Unit test this function. https://crbug.com/1099262
                  private OwnedState calculateIsRunningOnManagedProfile(Context context) {
@@ -48,9 +48,9 @@ diff --git a/chrome/browser/enterprise/util/android/java/src/org/chromium/chrome
 +                        return new OwnedState(/*hasDeviceOwnerApp*/false,
 +                            /*hasProfileOwnerApp*/false);
 +                    }
-                     long startTime = SystemClock.elapsedRealtime();
                      boolean hasProfileOwnerApp = false;
                      boolean hasDeviceOwnerApp = false;
+                     PackageManager packageManager = context.getPackageManager();
 diff --git a/chrome/browser/flags/BUILD.gn b/chrome/browser/flags/BUILD.gn
 --- a/chrome/browser/flags/BUILD.gn
 +++ b/chrome/browser/flags/BUILD.gn

build/patches/Disable-Android-Tab-Declutter.patch

@@ -1,50 +0,0 @@
-From: uazo <uazo@users.noreply.github.com>
-Date: Tue, 1 Apr 2025 11:37:52 +0000
-Subject: Disable Android Tab Declutter
-
-Original License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
-License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
----
- chrome/android/java/res/xml/main_preferences.xml               | 3 ++-
- .../org/chromium/chrome/browser/tab/TabArchiveSettings.java    | 3 ++-
- .../chrome_feature_list_cc/Disable-Android-Tab-Declutter.inc   | 1 +
- 3 files changed, 5 insertions(+), 2 deletions(-)
- create mode 100644 cromite_flags/chrome/browser/flags/android/chrome_feature_list_cc/Disable-Android-Tab-Declutter.inc
-
-diff --git a/chrome/android/java/res/xml/main_preferences.xml b/chrome/android/java/res/xml/main_preferences.xml
---- a/chrome/android/java/res/xml/main_preferences.xml
-+++ b/chrome/android/java/res/xml/main_preferences.xml
-@@ -106,7 +106,8 @@ for the previous order (main_preferences_legacy). -->
-         android:fragment="org.chromium.chrome.browser.tasks.tab_management.TabsSettings"
-         android:key="tabs"
-         android:order="18"
--        android:title="@string/tabs_settings_title"/>
-+        android:title="@string/tabs_settings_title"
-+        app:isPreferenceVisible="false"/>
-     <Preference
-         android:fragment="org.chromium.chrome.browser.homepage.settings.HomepageSettings"
-         android:key="homepage"
-diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tab/TabArchiveSettings.java b/chrome/android/java/src/org/chromium/chrome/browser/tab/TabArchiveSettings.java
---- a/chrome/android/java/src/org/chromium/chrome/browser/tab/TabArchiveSettings.java
-+++ b/chrome/android/java/src/org/chromium/chrome/browser/tab/TabArchiveSettings.java
-@@ -104,11 +104,12 @@ public class TabArchiveSettings {
-         // are created, and tabs disappearing from tests is very unexpected. For archive tests,
-         // this will need to be turned on manually.
-         return mPrefsManager.readBoolean(
--                ChromePreferenceKeys.TAB_DECLUTTER_ARCHIVE_ENABLED, !BuildConfig.IS_FOR_TEST);
-+                ChromePreferenceKeys.TAB_DECLUTTER_ARCHIVE_ENABLED, false);
-     }
- 
-     /** Sets whether archive is enabled in settings. */
-     public void setArchiveEnabled(boolean enabled) {
-+        enabled = false;
-         mPrefsManager.writeBoolean(ChromePreferenceKeys.TAB_DECLUTTER_ARCHIVE_ENABLED, enabled);
-     }
- 
-diff --git a/cromite_flags/chrome/browser/flags/android/chrome_feature_list_cc/Disable-Android-Tab-Declutter.inc b/cromite_flags/chrome/browser/flags/android/chrome_feature_list_cc/Disable-Android-Tab-Declutter.inc
-new file mode 100644
---- /dev/null
-+++ b/cromite_flags/chrome/browser/flags/android/chrome_feature_list_cc/Disable-Android-Tab-Declutter.inc
-@@ -0,0 +1 @@
-+// empty
---

build/patches/Disable-CSS-blink-feature-support.patch

@@ -16,7 +16,7 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 diff --git a/third_party/blink/renderer/core/css/parser/css_supports_parser.cc b/third_party/blink/renderer/core/css/parser/css_supports_parser.cc
 --- a/third_party/blink/renderer/core/css/parser/css_supports_parser.cc
 +++ b/third_party/blink/renderer/core/css/parser/css_supports_parser.cc
-@@ -397,7 +397,7 @@ bool CSSSupportsParser::ConsumeBlinkFeatureFn(CSSParserTokenStream& stream) {
+@@ -393,7 +393,7 @@ bool CSSSupportsParser::ConsumeBlinkFeatureFn(CSSParserTokenStream& stream) {
              feature_name.Value().Utf8()) &&
          guard.Release()) {
        stream.ConsumeWhitespace();
@@ -28,7 +28,7 @@ diff --git a/third_party/blink/renderer/core/css/parser/css_supports_parser.cc b
 diff --git a/third_party/blink/renderer/core/speculation_rules/document_rule_predicate.cc b/third_party/blink/renderer/core/speculation_rules/document_rule_predicate.cc
 --- a/third_party/blink/renderer/core/speculation_rules/document_rule_predicate.cc
 +++ b/third_party/blink/renderer/core/speculation_rules/document_rule_predicate.cc
-@@ -578,7 +578,7 @@ DocumentRulePredicate* DocumentRulePredicate::Parse(
+@@ -585,7 +585,7 @@ DocumentRulePredicate* DocumentRulePredicate::Parse(
      HeapVector<CSSSelector> arena;
      CSSPropertyValueSet* empty_properties =
          ImmutableCSSPropertyValueSet::Create(base::span<CSSPropertyValue>(),

build/patches/Disable-CSSDynamicRangeLimit.patch

@@ -1,27 +0,0 @@
-From: uazo <uazo@users.noreply.github.com>
-Date: Fri, 2 May 2025 14:20:38 +0000
-Subject: Disable CSSDynamicRangeLimit
-
-Disables the ability for pages to limit the maximum brightness of HDR content
-since use as screen fingerprinting is possible.
-
-see https://www.github.com/w3ctag/design-reviews/issues/1027
-
-License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
----
- .../blink/renderer/platform/runtime_enabled_features.json5      | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/third_party/blink/renderer/platform/runtime_enabled_features.json5 b/third_party/blink/renderer/platform/runtime_enabled_features.json5
---- a/third_party/blink/renderer/platform/runtime_enabled_features.json5
-+++ b/third_party/blink/renderer/platform/runtime_enabled_features.json5
-@@ -1288,7 +1288,7 @@
-     },
-     {
-       name: "CSSDynamicRangeLimit",
--      status: "stable",
-+      status: "experimental",
-     },
-     {
-       // Include custom properties in CSSComputedStyleDeclaration::item/length.
---

build/patches/Disable-Compose-feature.patch

@@ -13,7 +13,7 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 diff --git a/chrome/browser/BUILD.gn b/chrome/browser/BUILD.gn
 --- a/chrome/browser/BUILD.gn
 +++ b/chrome/browser/BUILD.gn
-@@ -8414,6 +8414,12 @@ static_library("browser") {
+@@ -8151,6 +8151,12 @@ static_library("browser") {
      deps += [ "//components/segmentation_platform/internal:optimization_guide_segmentation_handler" ]
    }
  
@@ -26,15 +26,15 @@ diff --git a/chrome/browser/BUILD.gn b/chrome/browser/BUILD.gn
    if (enable_compose) {
      sources += [
        "compose/chrome_compose_client.cc",
-@@ -8429,7 +8435,6 @@ static_library("browser") {
+@@ -8166,7 +8172,6 @@ static_library("browser") {
      ]
  
      deps += [
 -      ":compose_optimization_guide_proto",
        "//chrome/common/compose",
        "//chrome/common/compose:mojo_bindings",
-       "//components/autofill/content/browser",
-@@ -8888,7 +8893,7 @@ source_set("font_pref") {
+       "//components/autofill/content/browser:browser",
+@@ -8609,7 +8614,7 @@ source_set("font_pref") {
    deps = [ "//chrome/common" ]
  }
  
@@ -46,7 +46,7 @@ diff --git a/chrome/browser/BUILD.gn b/chrome/browser/BUILD.gn
 diff --git a/chrome/browser/ui/webui/settings/settings_ui.cc b/chrome/browser/ui/webui/settings/settings_ui.cc
 --- a/chrome/browser/ui/webui/settings/settings_ui.cc
 +++ b/chrome/browser/ui/webui/settings/settings_ui.cc
-@@ -352,7 +352,7 @@ SettingsUI::SettingsUI(content::WebUI* web_ui)
+@@ -382,7 +382,7 @@ SettingsUI::SettingsUI(content::WebUI* web_ui)
        base::FeatureList::IsEnabled(features::kLinkedServicesSetting));
  
  #if BUILDFLAG(ENABLE_COMPOSE)

build/patches/Disable-Compression-Dictionary-Transport.patch

@@ -10,7 +10,7 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 diff --git a/third_party/blink/renderer/platform/runtime_enabled_features.json5 b/third_party/blink/renderer/platform/runtime_enabled_features.json5
 --- a/third_party/blink/renderer/platform/runtime_enabled_features.json5
 +++ b/third_party/blink/renderer/platform/runtime_enabled_features.json5
-@@ -1031,12 +1031,14 @@
+@@ -878,12 +878,14 @@
        }
      },
      {

build/patches/Disable-Device-Attributes-API.patch

@@ -1,32 +0,0 @@
-From: uazo <uazo@users.noreply.github.com>
-Date: Wed, 10 Sep 2025 07:46:17 +0000
-Subject: Disable Device Attributes API
-
-License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
----
- chrome/browser/device_api/device_service_impl.cc | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/chrome/browser/device_api/device_service_impl.cc b/chrome/browser/device_api/device_service_impl.cc
---- a/chrome/browser/device_api/device_service_impl.cc
-+++ b/chrome/browser/device_api/device_service_impl.cc
-@@ -166,6 +166,7 @@ bool IsPermissionsPolicyFeatureEnabled() {
- 
- bool IsTrustedContext(content::RenderFrameHost& host,
-                       const url::Origin& origin) {
-+  if ((true)) return false;
-   // Do not create the service for the incognito mode.
-   if (GetProfile(host)->IsIncognitoProfile()) {
-     return false;
-@@ -361,6 +362,10 @@ void DeviceServiceImpl::GetAnnotatedLocation(
- void DeviceServiceImpl::GetDeviceAttribute(
-     void (DeviceAttributeApi::*method)(DeviceAttributeCallback callback),
-     DeviceAttributeCallback callback) {
-+  if ((true)) {
-+    device_attribute_api_->ReportNotAllowedError(std::move(callback));
-+    return;
-+  }
-   if (!IsAffiliatedUser()) {
-     device_attribute_api_->ReportNotAffiliatedError(std::move(callback));
-     return;
---

build/patches/Disable-FedCm.patch

@@ -4,26 +4,13 @@ Subject: Disable FedCm
 
 License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 ---
- .../content_settings/core/browser/content_settings_registry.cc  | 2 +-
  .../content/public/common/content_features_cc/Disable-FedCm.inc | 1 +
  .../third_party/blink/common/features_cc/Disable-FedCm.inc      | 1 +
  .../blink/renderer/platform/runtime_enabled_features.json5      | 2 +-
- 4 files changed, 4 insertions(+), 2 deletions(-)
+ 3 files changed, 3 insertions(+), 1 deletion(-)
  create mode 100644 cromite_flags/content/public/common/content_features_cc/Disable-FedCm.inc
  create mode 100644 cromite_flags/third_party/blink/common/features_cc/Disable-FedCm.inc
 
-diff --git a/components/content_settings/core/browser/content_settings_registry.cc b/components/content_settings/core/browser/content_settings_registry.cc
---- a/components/content_settings/core/browser/content_settings_registry.cc
-+++ b/components/content_settings/core/browser/content_settings_registry.cc
-@@ -671,7 +671,7 @@ void ContentSettingsRegistry::Init() {
-            PermissionSettingsInfo::EXCEPTIONS_ON_SECURE_ORIGINS_ONLY);
- 
-   Register(ContentSettingsType::FEDERATED_IDENTITY_AUTO_REAUTHN_PERMISSION,
--           "webid-auto-reauthn", CONTENT_SETTING_ALLOW,
-+           "webid-auto-reauthn", CONTENT_SETTING_BLOCK, // requires user mediation
-            WebsiteSettingsInfo::UNSYNCABLE,
-            /*allowlisted_primary_schemes=*/{},
-            /*valid_settings=*/{CONTENT_SETTING_ALLOW, CONTENT_SETTING_BLOCK},
 diff --git a/cromite_flags/content/public/common/content_features_cc/Disable-FedCm.inc b/cromite_flags/content/public/common/content_features_cc/Disable-FedCm.inc
 new file mode 100644
 --- /dev/null
@@ -35,11 +22,11 @@ new file mode 100644
 --- /dev/null
 +++ b/cromite_flags/third_party/blink/common/features_cc/Disable-FedCm.inc
 @@ -0,0 +1 @@
-+// empty
++SET_CROMITE_FEATURE_DISABLED(kFedCmWithStorageAccessAPI);
 diff --git a/third_party/blink/renderer/platform/runtime_enabled_features.json5 b/third_party/blink/renderer/platform/runtime_enabled_features.json5
 --- a/third_party/blink/renderer/platform/runtime_enabled_features.json5
 +++ b/third_party/blink/renderer/platform/runtime_enabled_features.json5
-@@ -2093,7 +2093,7 @@
+@@ -1833,7 +1833,7 @@
      {
        name: "FedCm",
        public: true,

build/patches/Disable-Feeback-Collector.patch

@@ -29,7 +29,7 @@ diff --git a/chrome/browser/feedback/BUILD.gn b/chrome/browser/feedback/BUILD.gn
 diff --git a/chrome/browser/feedback/android/java/src/org/chromium/chrome/browser/feedback/FeedbackCollector.java b/chrome/browser/feedback/android/java/src/org/chromium/chrome/browser/feedback/FeedbackCollector.java
 --- a/chrome/browser/feedback/android/java/src/org/chromium/chrome/browser/feedback/FeedbackCollector.java
 +++ b/chrome/browser/feedback/android/java/src/org/chromium/chrome/browser/feedback/FeedbackCollector.java
-@@ -29,6 +29,7 @@ import org.chromium.components.signin.identitymanager.ConsentLevel;
+@@ -28,6 +28,7 @@ import org.chromium.components.signin.identitymanager.ConsentLevel;
  import org.chromium.components.signin.identitymanager.IdentityManager;
  
  import java.util.HashMap;
@@ -37,7 +37,7 @@ diff --git a/chrome/browser/feedback/android/java/src/org/chromium/chrome/browse
  import java.util.List;
  import java.util.Map;
  
-@@ -73,31 +74,8 @@ public abstract class FeedbackCollector<T> implements Runnable {
+@@ -69,31 +70,8 @@ public abstract class FeedbackCollector<T> implements Runnable {
              @Nullable ScreenshotSource screenshotTask,
              T initParams,
              Profile profile) {

build/patches/Disable-GSA-by-default.patch

@@ -4,41 +4,30 @@ Subject: Disable GSA by default
 
 License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 ---
- .../src/org/chromium/base/PackageUtils.java   |  1 +
- .../chrome/browser/IntentHandler.java         |  6 ----
- .../chrome/browser/share/LensUtils.java       | 14 ++------
- .../chromium/chrome/browser/gsa/GSAUtils.java | 34 +++----------------
- .../GoogleBottomBarActionsHandler.java        | 19 ++---------
- .../chrome/browser/pdf/PdfCoordinator.java    |  2 +-
+ .../chrome/browser/IntentHandler.java         |  6 ------
+ .../provider/PageContentProviderImpl.java     |  6 ------
+ .../chrome/browser/share/LensUtils.java       | 14 ++------------
+ .../chromium/chrome/browser/gsa/GSAUtils.java | 10 +++-------
+ .../GoogleBottomBarActionsHandler.java        | 19 ++-----------------
+ .../chrome/browser/pdf/PdfCoordinator.java    |  4 +---
  .../Disable-GSA-by-default.inc                |  1 +
- 7 files changed, 12 insertions(+), 65 deletions(-)
+ 7 files changed, 9 insertions(+), 51 deletions(-)
  create mode 100644 cromite_flags/chrome/browser/flags/android/chrome_feature_list_cc/Disable-GSA-by-default.inc
 
-diff --git a/base/android/java/src/org/chromium/base/PackageUtils.java b/base/android/java/src/org/chromium/base/PackageUtils.java
---- a/base/android/java/src/org/chromium/base/PackageUtils.java
-+++ b/base/android/java/src/org/chromium/base/PackageUtils.java
-@@ -165,6 +165,7 @@ public class PackageUtils {
-      * @return Package name of assistant app, or null if unable to get.
-      */
-     public static @Nullable String getDefaultAssistantPackageName(Context context) {
-+        if ((true)) return null;
-         @Nullable String defaultAssistantSetting =
-                 Settings.Secure.getString(context.getContentResolver(), DEFAULT_ASSISTANT_SETTING);
-         if (defaultAssistantSetting == null || defaultAssistantSetting.isBlank()) {
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/IntentHandler.java b/chrome/android/java/src/org/chromium/chrome/browser/IntentHandler.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/IntentHandler.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/IntentHandler.java
-@@ -47,7 +47,6 @@ import org.chromium.chrome.browser.document.ChromeLauncherActivity;
+@@ -45,7 +45,6 @@ import org.chromium.chrome.browser.document.ChromeLauncherActivity;
  import org.chromium.chrome.browser.externalnav.IntentWithRequestMetadataHandler;
  import org.chromium.chrome.browser.externalnav.IntentWithRequestMetadataHandler.RequestMetadata;
  import org.chromium.chrome.browser.flags.ChromeFeatureList;
 -import org.chromium.chrome.browser.gsa.GSAUtils;
  import org.chromium.chrome.browser.omnibox.suggestions.AutocompleteCoordinator;
- import org.chromium.chrome.browser.pdf.PdfUtils;
  import org.chromium.chrome.browser.profiles.Profile;
-@@ -293,9 +292,6 @@ public class IntentHandler {
- 
-     public static final String EXTRA_CCT_EARLY_NAV = "org.chromium.chrome.browser.cct_early_nav";
+ import org.chromium.chrome.browser.profiles.ProfileManager;
+@@ -263,9 +262,6 @@ public class IntentHandler {
+     public static final String EXTRA_SKIP_PRECONNECT =
+             "org.chromium.chrome.browser.skip_preconnect";
  
 -    /** The package name for the Google Search App. */
 -    public static final String PACKAGE_GSA = GSAUtils.GSA_PACKAGE_NAME;
@@ -46,7 +35,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/IntentHandler.j
      private static Pair<Integer, String> sPendingReferrer;
      private static int sReferrerId;
      private static String sPendingIncognitoUrl;
-@@ -588,8 +584,6 @@ public class IntentHandler {
+@@ -539,8 +535,6 @@ public class IntentHandler {
              return ExternalAppId.LINE;
          } else if (packageName.equals(PACKAGE_WHATSAPP)) {
              return ExternalAppId.WHATSAPP;
@@ -55,10 +44,33 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/IntentHandler.j
          } else if (packageName.equals(ContextUtils.getApplicationContext().getPackageName())) {
              return ExternalAppId.CHROME;
          } else if (packageName.startsWith(WEBAPK_PACKAGE_PREFIX)) {
+diff --git a/chrome/android/java/src/org/chromium/chrome/browser/provider/PageContentProviderImpl.java b/chrome/android/java/src/org/chromium/chrome/browser/provider/PageContentProviderImpl.java
+--- a/chrome/android/java/src/org/chromium/chrome/browser/provider/PageContentProviderImpl.java
++++ b/chrome/android/java/src/org/chromium/chrome/browser/provider/PageContentProviderImpl.java
+@@ -57,8 +57,6 @@ public class PageContentProviderImpl extends SplitCompatContentProvider.Impl {
+ 
+     private static final int INVALIDATE_URI_DELAY_MS = 60_000;
+     private static final int PAGE_EXTRACTION_TIMEOUT_MS = 30_000;
+-    private static final String[] AUTHORIZED_PACKAGE_NAMES =
+-            new String[] {GSAUtils.GSA_PACKAGE_NAME};
+ 
+     static final class PageContentInvocationState {
+ 
+@@ -354,10 +352,6 @@ public class PageContentProviderImpl extends SplitCompatContentProvider.Impl {
+     }
+ 
+     private static void grantAccessToUri(Uri uri) {
+-        for (String packageName : AUTHORIZED_PACKAGE_NAMES) {
+-            ContextUtils.getApplicationContext()
+-                    .grantUriPermission(packageName, uri, Intent.FLAG_GRANT_READ_URI_PERMISSION);
+-        }
+     }
+ 
+     @VisibleForTesting(otherwise = VisibleForTesting.PRIVATE)
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/share/LensUtils.java b/chrome/android/java/src/org/chromium/chrome/browser/share/LensUtils.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/share/LensUtils.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/share/LensUtils.java
-@@ -9,7 +9,6 @@ import android.content.Context;
+@@ -10,7 +10,6 @@ import android.os.Build;
  import org.chromium.base.ResettersForTesting;
  import org.chromium.chrome.browser.IntentHandler;
  import org.chromium.chrome.browser.flags.ChromeFeatureList;
@@ -66,7 +78,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/share/LensUtils
  import org.chromium.components.externalauth.ExternalAuthUtils;
  
  /** This class provides utilities for intenting into Google Lens. */
-@@ -48,12 +47,7 @@ public class LensUtils {
+@@ -49,12 +48,7 @@ public class LensUtils {
              if (context == null) {
                  return "";
              }
@@ -79,7 +91,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/share/LensUtils
          }
      }
  
-@@ -76,15 +70,11 @@ public class LensUtils {
+@@ -92,15 +86,11 @@ public class LensUtils {
       * @return Whether the package is valid.
       */
      public static boolean isValidAgsaPackage() {
@@ -100,18 +112,15 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/share/LensUtils
 diff --git a/chrome/browser/gsa/java/src/org/chromium/chrome/browser/gsa/GSAUtils.java b/chrome/browser/gsa/java/src/org/chromium/chrome/browser/gsa/GSAUtils.java
 --- a/chrome/browser/gsa/java/src/org/chromium/chrome/browser/gsa/GSAUtils.java
 +++ b/chrome/browser/gsa/java/src/org/chromium/chrome/browser/gsa/GSAUtils.java
-@@ -15,19 +15,12 @@ import org.chromium.build.annotations.Nullable;
+@@ -14,16 +14,11 @@ import org.chromium.build.annotations.Nullable;
  /** This class provides utilities for the state of Google Search App. */
  @NullMarked
  public class GSAUtils {
--    private static final Object sPackageInfoLock = new Object();
--    @Nullable private static volatile PackageInfo sPackageInfo;
--
 -    public static final String GSA_PACKAGE_NAME = "com.google.android.googlequicksearchbox";
 -    public static final String GSA_CLASS_NAME =
 -            "com.google.android.apps.search.googleapp.activity.GoogleAppActivity";
 -    public static final String VOICE_SEARCH_INTENT_ACTION = "android.intent.action.VOICE_ASSIST";
- 
+-
      /**
       * @return Whether the given package name is the package name for Google Search App.
       */
@@ -121,7 +130,7 @@ diff --git a/chrome/browser/gsa/java/src/org/chromium/chrome/browser/gsa/GSAUtil
      }
  
      /**
-@@ -39,6 +32,7 @@ public class GSAUtils {
+@@ -35,6 +30,7 @@ public class GSAUtils {
       */
      public static boolean isAgsaVersionBelowMinimum(
              @Nullable String installedVersionName, @Nullable String minimumVersionName) {
@@ -129,48 +138,13 @@ diff --git a/chrome/browser/gsa/java/src/org/chromium/chrome/browser/gsa/GSAUtil
          if (TextUtils.isEmpty(installedVersionName) || TextUtils.isEmpty(minimumVersionName)) {
              return true;
          }
-@@ -69,8 +63,8 @@ public class GSAUtils {
+@@ -65,7 +61,7 @@ public class GSAUtils {
       * @return The version name of the Agsa package or null if it can't be found.
       */
      public static @Nullable String getAgsaVersionName() {
--        PackageInfo info = getAgsaPackageInfo();
--        return info == null ? null : info.versionName;
+-        PackageInfo packageInfo = PackageUtils.getPackageInfo(GSA_PACKAGE_NAME, 0);
 +        PackageInfo packageInfo = null;
-+        return packageInfo == null ? null : packageInfo.versionName;
-     }
- 
-     /**
-@@ -79,20 +73,7 @@ public class GSAUtils {
-      * @return Whether the AGSA is enabled
-      */
-     public static boolean isAgsaEnabled() {
--        PackageInfo info = getAgsaPackageInfo();
--        return info != null && info.applicationInfo != null && info.applicationInfo.enabled;
--    }
--
--    @Nullable
--    private static PackageInfo getAgsaPackageInfo() {
--        if (sPackageInfo == null) {
--            synchronized (sPackageInfoLock) {
--                if (sPackageInfo == null) {
--                    sPackageInfo = PackageUtils.getPackageInfo(GSA_PACKAGE_NAME, 0);
--                }
--            }
--        }
--        return sPackageInfo;
-+        return false;
-     }
- 
-     /**
-@@ -101,10 +82,5 @@ public class GSAUtils {
-      * @param packageInfo The package info to set for AGSA.
-      */
-     public static void setAgsaPackageInfoForTesting(@Nullable PackageInfo packageInfo) {
--        sPackageInfo = packageInfo;
--        ResettersForTesting.register(
--                () -> {
--                    sPackageInfo = null;
--                });
+         return packageInfo == null ? null : packageInfo.versionName;
      }
  }
 diff --git a/chrome/browser/ui/android/google_bottom_bar/java/src/org/chromium/chrome/browser/ui/google_bottom_bar/GoogleBottomBarActionsHandler.java b/chrome/browser/ui/android/google_bottom_bar/java/src/org/chromium/chrome/browser/ui/google_bottom_bar/GoogleBottomBarActionsHandler.java
@@ -186,7 +160,7 @@ diff --git a/chrome/browser/ui/android/google_bottom_bar/java/src/org/chromium/c
  import static org.chromium.chrome.browser.ui.google_bottom_bar.GoogleBottomBarLogger.GoogleBottomBarButtonEvent.SEARCHBOX_HOME;
  import static org.chromium.chrome.browser.ui.google_bottom_bar.GoogleBottomBarLogger.GoogleBottomBarButtonEvent.SEARCHBOX_LENS;
  import static org.chromium.chrome.browser.ui.google_bottom_bar.GoogleBottomBarLogger.GoogleBottomBarButtonEvent.SEARCHBOX_SEARCH;
-@@ -105,11 +102,6 @@ class GoogleBottomBarActionsHandler {
+@@ -102,11 +99,6 @@ class GoogleBottomBarActionsHandler {
      }
  
      void onSearchboxMicTap() {
@@ -198,7 +172,7 @@ diff --git a/chrome/browser/ui/android/google_bottom_bar/java/src/org/chromium/c
      }
  
      void onSearchboxLensTap(View buttonView) {
-@@ -148,21 +140,13 @@ class GoogleBottomBarActionsHandler {
+@@ -145,21 +137,13 @@ class GoogleBottomBarActionsHandler {
      }
  
      private void openGoogleAppSearch() {
@@ -221,7 +195,7 @@ diff --git a/chrome/browser/ui/android/google_bottom_bar/java/src/org/chromium/c
          intent.putExtra(EXTRA_IS_LAUNCHED_FROM_CHROME_SEARCH_ENTRYPOINT, true);
  
          if (PackageManagerUtils.canResolveActivity(intent)) {
-@@ -274,6 +258,7 @@ class GoogleBottomBarActionsHandler {
+@@ -271,6 +255,7 @@ class GoogleBottomBarActionsHandler {
      }
  
      private void sendPendingIntentWithUrl(PendingIntent pendingIntent) {
@@ -232,15 +206,24 @@ diff --git a/chrome/browser/ui/android/google_bottom_bar/java/src/org/chromium/c
 diff --git a/chrome/browser/ui/android/pdf/java/src/org/chromium/chrome/browser/pdf/PdfCoordinator.java b/chrome/browser/ui/android/pdf/java/src/org/chromium/chrome/browser/pdf/PdfCoordinator.java
 --- a/chrome/browser/ui/android/pdf/java/src/org/chromium/chrome/browser/pdf/PdfCoordinator.java
 +++ b/chrome/browser/ui/android/pdf/java/src/org/chromium/chrome/browser/pdf/PdfCoordinator.java
-@@ -266,7 +266,7 @@ public class PdfCoordinator {
+@@ -246,7 +246,7 @@ public class PdfCoordinator {
      }
  
-     @Nullable String requestAssistContent(String filename, boolean isWorkProfile) {
+     String requestAssistContent(String filename, boolean isWorkProfile) {
 -        if (mUri == null) {
 +        if ((true)) {
              return null;
          }
          String structuredData;
+@@ -264,8 +264,6 @@ public class PdfCoordinator {
+         } catch (JSONException e) {
+             return null;
+         }
+-        mActivity.grantUriPermission(
+-                GSAUtils.GSA_PACKAGE_NAME, mUri, Intent.FLAG_GRANT_READ_URI_PERMISSION);
+         PdfUtils.recordIsWorkProfile(isWorkProfile);
+         return structuredData;
+     }
 diff --git a/cromite_flags/chrome/browser/flags/android/chrome_feature_list_cc/Disable-GSA-by-default.inc b/cromite_flags/chrome/browser/flags/android/chrome_feature_list_cc/Disable-GSA-by-default.inc
 new file mode 100644
 --- /dev/null

build/patches/Disable-GetInstalledRelatedApps-API.patch

@@ -16,9 +16,9 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 diff --git a/components/installedapp/android/java/src/org/chromium/components/installedapp/InstalledAppProviderImpl.java b/components/installedapp/android/java/src/org/chromium/components/installedapp/InstalledAppProviderImpl.java
 --- a/components/installedapp/android/java/src/org/chromium/components/installedapp/InstalledAppProviderImpl.java
 +++ b/components/installedapp/android/java/src/org/chromium/components/installedapp/InstalledAppProviderImpl.java
-@@ -162,6 +162,7 @@ public class InstalledAppProviderImpl implements InstalledAppProvider {
+@@ -153,6 +153,7 @@ public class InstalledAppProviderImpl implements InstalledAppProvider {
+             final RelatedApplication[] relatedApps,
              final Url manifestUrl,
-             final boolean addSavedRelatedApplications,
              final FilterInstalledApps_Response callback) {
 +        assert false;
          GURL url = mRenderFrameHost.getLastCommittedURL();
@@ -27,8 +27,8 @@ diff --git a/components/installedapp/android/java/src/org/chromium/components/in
 diff --git a/content/browser/installedapp/installed_app_provider_impl.cc b/content/browser/installedapp/installed_app_provider_impl.cc
 --- a/content/browser/installedapp/installed_app_provider_impl.cc
 +++ b/content/browser/installedapp/installed_app_provider_impl.cc
-@@ -62,7 +62,7 @@ void InstalledAppProviderImpl::FilterInstalledApps(
-     bool add_saved_related_applications,
+@@ -60,7 +60,7 @@ void InstalledAppProviderImpl::FilterInstalledApps(
+     const GURL& manifest_url,
      FilterInstalledAppsCallback callback) {
    DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
 -  if (!base::FeatureList::IsEnabled(features::kInstalledAppProvider)) {
@@ -58,8 +58,8 @@ new file mode 100644
 diff --git a/third_party/blink/renderer/platform/runtime_enabled_features.json5 b/third_party/blink/renderer/platform/runtime_enabled_features.json5
 --- a/third_party/blink/renderer/platform/runtime_enabled_features.json5
 +++ b/third_party/blink/renderer/platform/runtime_enabled_features.json5
-@@ -2795,9 +2795,8 @@
-       status: "stable",
+@@ -2514,9 +2514,8 @@
+       name: "InspectorGhostRules",
      },
      {
 -      name: "InstalledApp",

build/patches/Disable-Paint-Preview-by-default.patch

@@ -10,7 +10,7 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/paint_preview/StartupPaintPreviewHelper.java b/chrome/android/java/src/org/chromium/chrome/browser/paint_preview/StartupPaintPreviewHelper.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/paint_preview/StartupPaintPreviewHelper.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/paint_preview/StartupPaintPreviewHelper.java
-@@ -118,7 +118,7 @@ public class StartupPaintPreviewHelper implements Destroyable {
+@@ -107,7 +107,7 @@ public class StartupPaintPreviewHelper {
  
      /** Enables Paint Preview show attempt on restoration of a tab. */
      public static void enableShowOnRestore() {

build/patches/Disable-PrivacyGuide.patch

@@ -22,7 +22,7 @@ diff --git a/chrome/android/java/res/xml/privacy_preferences.xml b/chrome/androi
 diff --git a/chrome/browser/ui/webui/settings/settings_ui.cc b/chrome/browser/ui/webui/settings/settings_ui.cc
 --- a/chrome/browser/ui/webui/settings/settings_ui.cc
 +++ b/chrome/browser/ui/webui/settings/settings_ui.cc
-@@ -326,8 +326,7 @@ SettingsUI::SettingsUI(content::WebUI* web_ui)
+@@ -352,8 +352,7 @@ SettingsUI::SettingsUI(content::WebUI* web_ui)
  #endif  // BUILDFLAG(IS_CHROMEOS)
  
    bool show_privacy_guide =

build/patches/Disable-Real-Box.patch

@@ -4,16 +4,16 @@ Subject: Disable Real Box
 
 Real-box is search box in ntp
 ---
- chrome/browser/prefs/browser_prefs.cc                 |  2 +-
- chrome/browser/resources/new_tab_page/app.html        | 11 -----------
- .../browser/ui/webui/searchbox/searchbox_handler.cc   |  1 +
- components/search/ntp_features.cc                     |  6 +++---
- 4 files changed, 5 insertions(+), 15 deletions(-)
+ chrome/browser/prefs/browser_prefs.cc                  | 2 +-
+ chrome/browser/resources/new_tab_page/app.html         | 8 --------
+ chrome/browser/ui/webui/searchbox/searchbox_handler.cc | 1 +
+ components/search/ntp_features.cc                      | 6 +++---
+ 4 files changed, 5 insertions(+), 12 deletions(-)
 
 diff --git a/chrome/browser/prefs/browser_prefs.cc b/chrome/browser/prefs/browser_prefs.cc
 --- a/chrome/browser/prefs/browser_prefs.cc
 +++ b/chrome/browser/prefs/browser_prefs.cc
-@@ -2272,7 +2272,7 @@ void RegisterProfilePrefs(user_prefs::PrefRegistrySyncable* registry,
+@@ -2323,7 +2323,7 @@ void RegisterProfilePrefs(user_prefs::PrefRegistrySyncable* registry,
    registry->RegisterBooleanPref(
        prefs::kLensRegionSearchEnabled, true,
        user_prefs::PrefRegistrySyncable::SYNCABLE_PREF);
@@ -21,32 +21,29 @@ diff --git a/chrome/browser/prefs/browser_prefs.cc b/chrome/browser/prefs/browse
 +  registry->RegisterBooleanPref(prefs::kLensDesktopNTPSearchEnabled, false);
  #endif
  
-   registry->RegisterListPref(
+ #if !BUILDFLAG(IS_ANDROID)
 diff --git a/chrome/browser/resources/new_tab_page/app.html b/chrome/browser/resources/new_tab_page/app.html
 --- a/chrome/browser/resources/new_tab_page/app.html
 +++ b/chrome/browser/resources/new_tab_page/app.html
-@@ -21,17 +21,6 @@ import {nothing} from '//resources/lit/v3_0/lit.rollup.js';
-       .theme="${this.theme_}" ?hidden="${!this.logoEnabled_}">
+@@ -19,14 +19,6 @@
+       ?hidden="${!this.logoEnabled_}">
    </ntp-logo>
    <div id="searchboxContainer">
 -    <cr-searchbox id="searchbox" ?is-dark="${this.isThemeDark_()}"
 -        ?color-source-is-baseline="${this.colorSourceIsBaseline}"
--        @open-composebox="${this.toggleComposebox_}"
 -        @open-lens-search="${this.onOpenLensSearch_}"
 -        @open-voice-search="${this.onOpenVoiceSearch_}" ?shown="${this.realboxShown_}"
 -        ?had-secondary-side="${this.realboxHadSecondarySide}"
 -        @had-secondary-side-changed="${this.onRealboxHadSecondarySideChanged_}"
--        ?can-show-secondary-side="${this.realboxCanShowSecondarySide}"
--        ?compose-button-enabled="${this.composeButtonEnabled}"
--        ?composebox-enabled="${this.composeboxEnabled}">
+-        ?can-show-secondary-side="${this.realboxCanShowSecondarySide}">
 -    </cr-searchbox>
-     ${this.showComposebox_ ? html`
-       <ntp-composebox id="composebox" ?is_collapsible="false" @close-composebox="${this.closeComposebox_}">
-       </ntp-composebox>
+     ${this.showLensUploadDialog_ ? html`
+       <ntp-lens-upload-dialog id="lensUploadDialog"
+           @close-lens-search="${this.onCloseLensSearch_}">
 diff --git a/chrome/browser/ui/webui/searchbox/searchbox_handler.cc b/chrome/browser/ui/webui/searchbox/searchbox_handler.cc
 --- a/chrome/browser/ui/webui/searchbox/searchbox_handler.cc
 +++ b/chrome/browser/ui/webui/searchbox/searchbox_handler.cc
-@@ -452,6 +452,7 @@ void SearchboxHandler::SetupWebUIDataSource(content::WebUIDataSource* source,
+@@ -420,6 +420,7 @@ void SearchboxHandler::SetupWebUIDataSource(content::WebUIDataSource* source,
                                              Profile* profile,
                                              bool enable_voice_search,
                                              bool enable_lens_search) {
@@ -57,7 +54,7 @@ diff --git a/chrome/browser/ui/webui/searchbox/searchbox_handler.cc b/chrome/bro
 diff --git a/components/search/ntp_features.cc b/components/search/ntp_features.cc
 --- a/components/search/ntp_features.cc
 +++ b/components/search/ntp_features.cc
-@@ -127,7 +127,7 @@ BASE_FEATURE(kNtpDriveModuleShowSixFiles,
+@@ -121,7 +121,7 @@ BASE_FEATURE(kNtpDriveModuleShowSixFiles,
  
  // If enabled, logo will be shown.
  // This is a kill switch. Keep indefinitely.
@@ -66,7 +63,7 @@ diff --git a/components/search/ntp_features.cc b/components/search/ntp_features.
  
  // If enabled, middle slot promo will be shown.
  // This is a kill switch. Keep indefinitely.
-@@ -186,8 +186,8 @@ BASE_FEATURE(kNtpModuleSignInRequirement,
+@@ -174,8 +174,8 @@ BASE_FEATURE(kNtpModulesLoad,
  // If enabled, OneGoogleBar will be shown.
  // This is a kill switch. Keep indefinitely.
  BASE_FEATURE(kNtpOneGoogleBar,

build/patches/Disable-Service-and-Shared-workers-on-3P-iframe.patch

@@ -14,7 +14,7 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 diff --git a/components/embedder_support/content_settings_utils.cc b/components/embedder_support/content_settings_utils.cc
 --- a/components/embedder_support/content_settings_utils.cc
 +++ b/components/embedder_support/content_settings_utils.cc
-@@ -30,16 +30,7 @@ namespace {
+@@ -29,16 +29,7 @@ namespace {
  //  allowed by default, and access is only blocked due to general third-party
  //  cookie blocking (and not due to a user specified pattern) then storage
  //  access can be allowed.
@@ -32,9 +32,9 @@ diff --git a/components/embedder_support/content_settings_utils.cc b/components/
  bool AllowWorkerStorageAccess(
      StorageType storage_type,
      const GURL& url,
-@@ -56,17 +47,11 @@ bool AllowWorkerStorageAccess(
-       net::CookieSettingOverrides(), storage_key.ToCookiePartitionKey(),
-       &cookie_settings_metadata);
+@@ -53,17 +44,11 @@ bool AllowWorkerStorageAccess(
+       url, net::SiteForCookies::FromUrl(url), url::Origin::Create(url),
+       net::CookieSettingOverrides(), &cookie_settings_metadata);
  
 -  if (!allow && PartitionedStorageByDefaultAllowed(cookie_settings_metadata)) {
 -    allow = true;
@@ -51,9 +51,9 @@ diff --git a/components/embedder_support/content_settings_utils.cc b/components/
  
    for (const auto& it : render_frames) {
      auto* rfh = content::RenderFrameHost::FromID(it);
-@@ -126,19 +111,16 @@ content::AllowServiceWorkerResult AllowServiceWorker(
- 
-       &cookie_settings_metadata);
+@@ -108,19 +93,16 @@ content::AllowServiceWorkerResult AllowServiceWorker(
+       scope, site_for_cookies, top_frame_origin,
+       cookie_settings->SettingOverridesForStorage(), &cookie_settings_metadata);
  
 -  if (!allow_cookies &&
 -      PartitionedStorageByDefaultAllowed(cookie_settings_metadata)) {
@@ -75,9 +75,9 @@ diff --git a/components/embedder_support/content_settings_utils.cc b/components/
  
    return content::AllowServiceWorkerResult::FromPolicy(!allow_javascript,
                                                         !allow_cookies);
-@@ -174,17 +156,16 @@ bool AllowSharedWorker(
-       net::CookieSettingOverrides(), cookie_partition_key,
-       &cookie_settings_metadata);
+@@ -143,17 +125,16 @@ bool AllowSharedWorker(
+       worker_url, site_for_cookies, top_frame_origin,
+       cookie_settings->SettingOverridesForStorage(), &cookie_settings_metadata);
  
 -  if (!allow && PartitionedStorageByDefaultAllowed(cookie_settings_metadata)) {
 -    allow = true;

build/patches/Disable-TLS-resumption.patch

@@ -79,7 +79,7 @@ new file mode 100644
 diff --git a/net/http/http_network_session.cc b/net/http/http_network_session.cc
 --- a/net/http/http_network_session.cc
 +++ b/net/http/http_network_session.cc
-@@ -222,6 +222,7 @@ HttpNetworkSession::HttpNetworkSession(const HttpNetworkSessionParams& params,
+@@ -223,6 +223,7 @@ HttpNetworkSession::HttpNetworkSession(const HttpNetworkSessionParams& params,
  
    next_protos_.push_back(NextProto::kProtoHTTP11);
  
@@ -90,7 +90,7 @@ diff --git a/net/http/http_network_session.cc b/net/http/http_network_session.cc
 diff --git a/net/quic/quic_session_pool.cc b/net/quic/quic_session_pool.cc
 --- a/net/quic/quic_session_pool.cc
 +++ b/net/quic/quic_session_pool.cc
-@@ -86,6 +86,7 @@
+@@ -84,6 +84,7 @@
  #include "net/third_party/quiche/src/quiche/quic/platform/api/quic_flags.h"
  #include "net/traffic_annotation/network_traffic_annotation.h"
  #include "third_party/boringssl/src/include/openssl/aead.h"
@@ -98,7 +98,7 @@ diff --git a/net/quic/quic_session_pool.cc b/net/quic/quic_session_pool.cc
  #include "url/gurl.h"
  #include "url/scheme_host_port.h"
  #include "url/url_constants.h"
-@@ -372,6 +373,38 @@ void LogSessionKeyMismatch(QuicSessionKeyPartialMatchResult result,
+@@ -370,6 +371,38 @@ void LogSessionKeyMismatch(QuicSessionKeyPartialMatchResult result,
  
  }  // namespace
  
@@ -137,10 +137,10 @@ diff --git a/net/quic/quic_session_pool.cc b/net/quic/quic_session_pool.cc
  QuicSessionRequest::QuicSessionRequest(QuicSessionPool* pool) : pool_(pool) {}
  
  QuicSessionRequest::~QuicSessionRequest() {
-@@ -2373,7 +2406,7 @@ QuicSessionPool::CreateCryptoConfigHandle(QuicCryptoClientConfigKey key) {
+@@ -2267,7 +2300,7 @@ QuicSessionPool::CreateCryptoConfigHandle(
                cert_verifier_, transport_security_state_, sct_auditing_delegate_,
                HostsFromOrigins(params_.origins_to_force_quic_on),
-               key.network_anonymization_key),
+               actual_network_anonymization_key),
 -          std::make_unique<quic::QuicClientSessionCache>(), this);
 +          std::make_unique<BromiteSessionCache>(), this);
  
@@ -149,7 +149,7 @@ diff --git a/net/quic/quic_session_pool.cc b/net/quic/quic_session_pool.cc
 diff --git a/net/socket/ssl_client_socket_impl.cc b/net/socket/ssl_client_socket_impl.cc
 --- a/net/socket/ssl_client_socket_impl.cc
 +++ b/net/socket/ssl_client_socket_impl.cc
-@@ -292,7 +292,33 @@ SSLClientSocketImpl::SSLClientSocketImpl(
+@@ -284,7 +284,33 @@ SSLClientSocketImpl::SSLClientSocketImpl(
    CHECK(context_);
  }
  
@@ -183,7 +183,7 @@ diff --git a/net/socket/ssl_client_socket_impl.cc b/net/socket/ssl_client_socket
    Disconnect();
  }
  
-@@ -700,6 +726,8 @@ int SSLClientSocketImpl::Init() {
+@@ -671,6 +697,8 @@ int SSLClientSocketImpl::Init() {
      }
      if (session)
        SSL_set_session(ssl_.get(), session.get());
@@ -192,7 +192,7 @@ diff --git a/net/socket/ssl_client_socket_impl.cc b/net/socket/ssl_client_socket
    }
  
    transport_adapter_ = std::make_unique<SocketBIOAdapter>(
-@@ -985,6 +1013,35 @@ int SSLClientSocketImpl::DoHandshakeComplete(int result) {
+@@ -957,6 +985,35 @@ int SSLClientSocketImpl::DoHandshakeComplete(int result) {
                      : SSLHandshakeDetails::kTLS13Full;
      }
    }
@@ -228,7 +228,7 @@ diff --git a/net/socket/ssl_client_socket_impl.cc b/net/socket/ssl_client_socket
    UMA_HISTOGRAM_ENUMERATION("Net.SSLHandshakeDetails", details);
  
    // Measure TLS connections that implement the renegotiation_info and EMS
-@@ -1624,6 +1681,8 @@ bool SSLClientSocketImpl::IsRenegotiationAllowed() const {
+@@ -1588,6 +1645,8 @@ bool SSLClientSocketImpl::IsRenegotiationAllowed() const {
  }
  
  bool SSLClientSocketImpl::IsCachingEnabled() const {
@@ -240,9 +240,9 @@ diff --git a/net/socket/ssl_client_socket_impl.cc b/net/socket/ssl_client_socket
 diff --git a/net/socket/ssl_client_socket_impl.h b/net/socket/ssl_client_socket_impl.h
 --- a/net/socket/ssl_client_socket_impl.h
 +++ b/net/socket/ssl_client_socket_impl.h
-@@ -127,6 +127,8 @@ class NET_EXPORT_PRIVATE SSLClientSocketImpl
+@@ -123,6 +123,8 @@ class SSLClientSocketImpl : public SSLClientSocket,
+   friend class SSLClientSocket;
    friend class SSLContext;
-   FRIEND_TEST_ALL_PREFIXES(SSLClientSocketTest, ParseServerTrustAnchorIDs);
  
 +  void Log_ssl_session_data(const std::string& tag, SSL_SESSION* session);
 +

build/patches/Disable-UA-full-version.patch

@@ -7,23 +7,22 @@ getHighEntropyValues will return only the major version
 Original License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 ---
- .../renderer/core/frame/navigator_ua_data.cc    | 17 +++++++++++++++--
- 1 file changed, 15 insertions(+), 2 deletions(-)
+ .../renderer/core/frame/navigator_ua_data.cc     | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
 
 diff --git a/third_party/blink/renderer/core/frame/navigator_ua_data.cc b/third_party/blink/renderer/core/frame/navigator_ua_data.cc
 --- a/third_party/blink/renderer/core/frame/navigator_ua_data.cc
 +++ b/third_party/blink/renderer/core/frame/navigator_ua_data.cc
-@@ -7,6 +7,9 @@
+@@ -7,6 +7,8 @@
  #include "base/compiler_specific.h"
  #include "base/task/single_thread_task_runner.h"
  #include "third_party/blink/public/common/features.h"
 +#include "base/version.h"
 +#include "base/strings/strcat.h"
-+#include "base/strings/string_number_conversions.h"
  #include "third_party/blink/public/common/privacy_budget/identifiability_metric_builder.h"
  #include "third_party/blink/public/common/privacy_budget/identifiability_study_settings.h"
  #include "third_party/blink/public/common/privacy_budget/identifiable_surface.h"
-@@ -65,6 +68,16 @@ void MaybeRecordMetric(bool record_identifiability,
+@@ -65,6 +67,16 @@ void MaybeRecordMetric(bool record_identifiability,
                      execution_context);
  }
  
@@ -40,7 +39,7 @@ diff --git a/third_party/blink/renderer/core/frame/navigator_ua_data.cc b/third_
  }  // namespace
  
  NavigatorUAData::NavigatorUAData(ExecutionContext* context)
-@@ -103,7 +116,7 @@ void NavigatorUAData::SetFullVersionList(
+@@ -103,7 +115,7 @@ void NavigatorUAData::SetFullVersionList(
      const UserAgentBrandList& full_version_list) {
    for (const auto& brand_version : full_version_list) {
      AddBrandFullVersion(String::FromUTF8(brand_version.brand),
@@ -49,7 +48,7 @@ diff --git a/third_party/blink/renderer/core/frame/navigator_ua_data.cc b/third_
    }
  }
  
-@@ -125,7 +138,7 @@ void NavigatorUAData::SetModel(const String& model) {
+@@ -125,7 +137,7 @@ void NavigatorUAData::SetModel(const String& model) {
  }
  
  void NavigatorUAData::SetUAFullVersion(const String& ua_full_version) {

build/patches/Disable-Viewport-Segments.patch

@@ -1,34 +0,0 @@
-From: uazo <uazo@users.noreply.github.com>
-Date: Sat, 28 Jun 2025 08:17:07 +0000
-Subject: Disable Viewport Segments
-
-Disable Viewport Segments API, specifically for foldable devices,
-since it exposes the geometry of the fold.
-
-License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
----
- .../blink/common/features_cc/Disable-ViewportSegments.inc      | 1 +
- .../blink/renderer/platform/runtime_enabled_features.json5     | 3 +--
- 2 files changed, 2 insertions(+), 2 deletions(-)
- create mode 100644 cromite_flags/third_party/blink/common/features_cc/Disable-ViewportSegments.inc
-
-diff --git a/cromite_flags/third_party/blink/common/features_cc/Disable-ViewportSegments.inc b/cromite_flags/third_party/blink/common/features_cc/Disable-ViewportSegments.inc
-new file mode 100644
---- /dev/null
-+++ b/cromite_flags/third_party/blink/common/features_cc/Disable-ViewportSegments.inc
-@@ -0,0 +1 @@
-+SET_CROMITE_FEATURE_DISABLED(kViewportSegments);
-diff --git a/third_party/blink/renderer/platform/runtime_enabled_features.json5 b/third_party/blink/renderer/platform/runtime_enabled_features.json5
---- a/third_party/blink/renderer/platform/runtime_enabled_features.json5
-+++ b/third_party/blink/renderer/platform/runtime_enabled_features.json5
-@@ -5317,8 +5317,7 @@
-       status: "stable",
-     },
-     {
--      name: "ViewportSegments",
--      status: "stable",
-+      name: "ViewportSegments", status: "test", public: true
-     },
-     {
-       name: "ViewTransitionAnimationDelayInherit",
---

build/patches/Disable-Web-Bluetooth-by-default-in-desktop-platforms.patch

@@ -14,9 +14,9 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 diff --git a/components/content_settings/core/browser/content_settings_registry.cc b/components/content_settings/core/browser/content_settings_registry.cc
 --- a/components/content_settings/core/browser/content_settings_registry.cc
 +++ b/components/content_settings/core/browser/content_settings_registry.cc
-@@ -378,8 +378,13 @@ void ContentSettingsRegistry::Init() {
+@@ -371,8 +371,13 @@ void ContentSettingsRegistry::Init() {
             ContentSettingsInfo::INHERIT_IF_LESS_PERMISSIVE,
-            PermissionSettingsInfo::EXCEPTIONS_ON_SECURE_AND_INSECURE_ORIGINS);
+            ContentSettingsInfo::EXCEPTIONS_ON_SECURE_AND_INSECURE_ORIGINS);
  
 +#if BUILDFLAG(IS_ANDROID)
    Register(ContentSettingsType::BLUETOOTH_GUARD, "bluetooth-guard",

build/patches/Disable-WebGPU.patch

@@ -12,7 +12,7 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 diff --git a/content/child/runtime_features.cc b/content/child/runtime_features.cc
 --- a/content/child/runtime_features.cc
 +++ b/content/child/runtime_features.cc
-@@ -547,6 +547,8 @@ void SetCustomizedRuntimeFeaturesFromCombinedArgs(
+@@ -549,6 +549,8 @@ void SetCustomizedRuntimeFeaturesFromCombinedArgs(
  
    WebRuntimeFeatures::EnableRemotePlayback(false);
  
@@ -20,13 +20,13 @@ diff --git a/content/child/runtime_features.cc b/content/child/runtime_features.
 +
    WebRuntimeFeatures::EnableBackForwardCache(
        content::IsBackForwardCacheEnabled());
- 
+ }
 diff --git a/gpu/config/gpu_finch_features.cc b/gpu/config/gpu_finch_features.cc
 --- a/gpu/config/gpu_finch_features.cc
 +++ b/gpu/config/gpu_finch_features.cc
-@@ -235,7 +235,7 @@ BASE_FEATURE(kEnableDrDc,
+@@ -243,7 +243,7 @@ BASE_FEATURE(kEnableDrDc,
  // enabled by default on supported platforms.
- #if BUILDFLAG(IS_APPLE) || BUILDFLAG(IS_WIN) || BUILDFLAG(IS_CHROMEOS) || \
+ #if BUILDFLAG(IS_MAC) || BUILDFLAG(IS_WIN) || BUILDFLAG(IS_CHROMEOS) || \
      BUILDFLAG(IS_ANDROID)
 -#define WEBGPU_ENABLED base::FEATURE_ENABLED_BY_DEFAULT
 +#define WEBGPU_ENABLED base::FEATURE_DISABLED_BY_DEFAULT
@@ -45,7 +45,7 @@ diff --git a/third_party/blink/renderer/modules/webgpu/gpu.cc b/third_party/blin
    return wgsl_language_features_.Get();
  }
  
-@@ -436,6 +438,7 @@ ScriptPromise<IDLNullable<GPUAdapter>> GPU::requestAdapter(
+@@ -438,6 +440,7 @@ ScriptPromise<IDLNullable<GPUAdapter>> GPU::requestAdapter(
          "WebGPU is experimental on this platform. See "
          "https://github.com/gpuweb/gpuweb/wiki/"
          "Implementation-Status#implementation-status"));

build/patches/Disable-all-promo-dialogs.patch

@@ -9,16 +9,15 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
  .../views/profiles/profile_picker_feature_promo_controller.cc  | 1 +
  .../user_education/impl/browser_feature_promo_controller_20.cc | 1 +
  .../chrome/browser/user_education/UserEducationHelper.java     | 1 +
- .../browser/user_education/user_education_service_factory.cc   | 1 +
  .../common/feature_promo/feature_promo_registry.cc             | 2 ++
  .../common/feature_promo/impl/feature_promo_controller_20.cc   | 1 +
  .../common/feature_promo/impl/feature_promo_controller_25.cc   | 3 ++-
- 9 files changed, 11 insertions(+), 2 deletions(-)
+ 8 files changed, 10 insertions(+), 2 deletions(-)
 
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedRootUiCoordinator.java b/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedRootUiCoordinator.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedRootUiCoordinator.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedRootUiCoordinator.java
-@@ -1747,6 +1747,7 @@ public class TabbedRootUiCoordinator extends RootUiCoordinator {
+@@ -1511,6 +1511,7 @@ public class TabbedRootUiCoordinator extends RootUiCoordinator {
      }
  
      private boolean maybeShowPromo(Profile profile) {
@@ -29,7 +28,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/Tab
 diff --git a/chrome/browser/ui/browser_ui_prefs.cc b/chrome/browser/ui/browser_ui_prefs.cc
 --- a/chrome/browser/ui/browser_ui_prefs.cc
 +++ b/chrome/browser/ui/browser_ui_prefs.cc
-@@ -172,7 +172,7 @@ void RegisterBrowserUserPrefs(user_prefs::PrefRegistrySyncable* registry) {
+@@ -150,7 +150,7 @@ void RegisterBrowserUserPrefs(user_prefs::PrefRegistrySyncable* registry) {
  
    registry->RegisterBooleanPref(prefs::kEnterpriseHardwarePlatformAPIEnabled,
                                  false);
@@ -41,29 +40,29 @@ diff --git a/chrome/browser/ui/browser_ui_prefs.cc b/chrome/browser/ui/browser_u
 diff --git a/chrome/browser/ui/views/profiles/profile_picker_feature_promo_controller.cc b/chrome/browser/ui/views/profiles/profile_picker_feature_promo_controller.cc
 --- a/chrome/browser/ui/views/profiles/profile_picker_feature_promo_controller.cc
 +++ b/chrome/browser/ui/views/profiles/profile_picker_feature_promo_controller.cc
-@@ -36,6 +36,7 @@ user_education::FeaturePromoResult
- ProfilePickerFeaturePromoController::CanShowPromoForElement(
-     ui::TrackedElement* anchor_element,
-     const user_education::UserEducationContextPtr&) const {
-+  if ((true)) return user_education::FeaturePromoResult::kBlockedByUi;
-   return ProfilePicker::IsOpen()
-              ? user_education::FeaturePromoResult::Success()
-              : user_education::FeaturePromoResult::kBlockedByUi;
+@@ -38,6 +38,7 @@ ui::ElementContext ProfilePickerFeaturePromoController::GetAnchorContext()
+ 
+ bool ProfilePickerFeaturePromoController::CanShowPromoForElement(
+     ui::TrackedElement* anchor_element) const {
++  if ((true)) return false;
+   return ProfilePicker::IsOpen();
+ }
+ 
 diff --git a/chrome/browser/ui/views/user_education/impl/browser_feature_promo_controller_20.cc b/chrome/browser/ui/views/user_education/impl/browser_feature_promo_controller_20.cc
 --- a/chrome/browser/ui/views/user_education/impl/browser_feature_promo_controller_20.cc
 +++ b/chrome/browser/ui/views/user_education/impl/browser_feature_promo_controller_20.cc
-@@ -45,6 +45,7 @@ user_education::FeaturePromoResult
- BrowserFeaturePromoController20::CanShowPromoForElement(
-     ui::TrackedElement* anchor_element,
-     const user_education::UserEducationContextPtr& context) const {
-+  if ((true)) return user_education::FeaturePromoResult::kBlockedByUi;
-   auto* const browser_context = context->AsA<BrowserUserEducationContext>();
-   CHECK(browser_context && browser_context->IsValid());
-   auto* const browser_view = &browser_context->GetBrowserView();
+@@ -59,6 +59,7 @@ ui::ElementContext BrowserFeaturePromoController20::GetAnchorContext() const {
+ 
+ bool BrowserFeaturePromoController20::CanShowPromoForElement(
+     ui::TrackedElement* anchor_element) const {
++  if ((true)) return false;
+   // Trying to show an IPH while the browser is closing can cause problems;
+   // see crbug.com/346461762 for an example. This can also crash unit_tests that
+   // use a BrowserWindow but not a browser, so also check if the browser view's
 diff --git a/chrome/browser/user_education/java/src/org/chromium/chrome/browser/user_education/UserEducationHelper.java b/chrome/browser/user_education/java/src/org/chromium/chrome/browser/user_education/UserEducationHelper.java
 --- a/chrome/browser/user_education/java/src/org/chromium/chrome/browser/user_education/UserEducationHelper.java
 +++ b/chrome/browser/user_education/java/src/org/chromium/chrome/browser/user_education/UserEducationHelper.java
-@@ -120,6 +120,7 @@ public class UserEducationHelper {
+@@ -117,6 +117,7 @@ public class UserEducationHelper {
      }
  
      private void showIph(Tracker tracker, IphCommand iphCommand) {
@@ -71,17 +70,6 @@ diff --git a/chrome/browser/user_education/java/src/org/chromium/chrome/browser/
          // Activity was destroyed; don't show IPH.
          View anchorView = iphCommand.anchorView;
          if (mActivity == null
-diff --git a/chrome/browser/user_education/user_education_service_factory.cc b/chrome/browser/user_education/user_education_service_factory.cc
---- a/chrome/browser/user_education/user_education_service_factory.cc
-+++ b/chrome/browser/user_education/user_education_service_factory.cc
-@@ -112,6 +112,7 @@ UserEducationServiceFactory::BuildServiceInstanceForBrowserContextImpl(
- 
- // static
- bool UserEducationServiceFactory::ProfileAllowsUserEducation(Profile* profile) {
-+  if ((true)) return false;
- #if BUILDFLAG(CHROME_FOR_TESTING)
-   // IPH is always disabled in Chrome for Testing.
-   return false;
 diff --git a/components/user_education/common/feature_promo/feature_promo_registry.cc b/components/user_education/common/feature_promo/feature_promo_registry.cc
 --- a/components/user_education/common/feature_promo/feature_promo_registry.cc
 +++ b/components/user_education/common/feature_promo/feature_promo_registry.cc
@@ -104,8 +92,8 @@ diff --git a/components/user_education/common/feature_promo/feature_promo_regist
 diff --git a/components/user_education/common/feature_promo/impl/feature_promo_controller_20.cc b/components/user_education/common/feature_promo/impl/feature_promo_controller_20.cc
 --- a/components/user_education/common/feature_promo/impl/feature_promo_controller_20.cc
 +++ b/components/user_education/common/feature_promo/impl/feature_promo_controller_20.cc
-@@ -106,6 +106,7 @@ FeaturePromoResult FeaturePromoController20::CanShowPromoCommon(
-     const UserEducationContextPtr& context,
+@@ -99,6 +99,7 @@ FeaturePromoResult FeaturePromoController20::CanShowPromoCommon(
+     const FeaturePromoParams& params,
      ShowSource source,
      CanShowPromoOutputs* outputs) const {
 +  if ((true)) return FeaturePromoResult::kBlockedByContext;
@@ -116,16 +104,16 @@ diff --git a/components/user_education/common/feature_promo/impl/feature_promo_c
 --- a/components/user_education/common/feature_promo/impl/feature_promo_controller_25.cc
 +++ b/components/user_education/common/feature_promo/impl/feature_promo_controller_25.cc
 @@ -189,6 +189,7 @@ FeaturePromoController25::~FeaturePromoController25() {
+ 
  FeaturePromoResult FeaturePromoController25::CanShowPromo(
-     const FeaturePromoParams& params,
-     const UserEducationContextPtr& context) const {
+     const FeaturePromoParams& params) const {
 +  if ((true)) return FeaturePromoResult::kBlockedByContext;
    auto* const spec = registry()->GetParamsForFeature(*params.feature);
    if (!spec) {
      return FeaturePromoResult::kError;
-@@ -211,7 +212,7 @@ void FeaturePromoController25::MaybeShowStartupPromo(
- void FeaturePromoController25::MaybeShowPromo(FeaturePromoParams params,
-                                               UserEducationContextPtr context) {
+@@ -209,7 +210,7 @@ void FeaturePromoController25::MaybeShowStartupPromo(
+ 
+ void FeaturePromoController25::MaybeShowPromo(FeaturePromoParams params) {
    auto* const spec = registry()->GetParamsForFeature(*params.feature);
 -  if (!spec) {
 +  if (((true)) || !spec) {

build/patches/Disable-conversion-measurement-api.patch

@@ -12,6 +12,7 @@ Original License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.
 License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 ---
  .../browser/aw_content_browser_client.cc      |   3 +
+ ..._token_key_commitments_component_loader.cc |   1 +
  .../chromium/android_webview/AwSettings.java  |   4 +-
  chrome/android/java/AndroidManifest.xml       |   4 -
  .../ChromeSiteSettingsDelegate.java           |   2 +
@@ -37,23 +38,23 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
  .../browser/AttributionOsLevelManager.java    | 349 +-----------------
  .../public/browser/content_browser_client.cc  |   7 +-
  .../public/browser/navigation_controller.cc   |   1 -
- .../Disable-conversion-measurement-api.inc    |   2 +
- .../Disable-conversion-measurement-api.inc    |   8 +
+ .../Disable-conversion-measurement-api.inc    |   1 +
+ .../Disable-conversion-measurement-api.inc    |  10 +
  .../attribution/request_headers_internal.cc   |   1 +
- services/network/network_context.cc           |  24 +-
+ services/network/network_context.cc           |  20 -
  .../network/public/cpp/attribution_utils.cc   |   2 +
  .../core/frame/attribution_src_loader.cc      |   2 -
  third_party/blink/renderer/core/page/page.cc  |   2 +-
  .../platform/runtime_enabled_features.json5   |  20 +-
  ui/events/android/motion_event_android.cc     |   8 +-
- 35 files changed, 103 insertions(+), 430 deletions(-)
+ 36 files changed, 101 insertions(+), 430 deletions(-)
  create mode 100644 cromite_flags/services/network/public/cpp/features_cc/Disable-conversion-measurement-api.inc
  create mode 100644 cromite_flags/third_party/blink/common/features_cc/Disable-conversion-measurement-api.inc
 
 diff --git a/android_webview/browser/aw_content_browser_client.cc b/android_webview/browser/aw_content_browser_client.cc
 --- a/android_webview/browser/aw_content_browser_client.cc
 +++ b/android_webview/browser/aw_content_browser_client.cc
-@@ -1354,6 +1354,7 @@ network::mojom::AttributionSupport
+@@ -1302,6 +1302,7 @@ network::mojom::AttributionSupport
  AwContentBrowserClient::GetAttributionSupport(
      AttributionReportingOsApiState state,
      bool client_os_disabled) {
@@ -61,7 +62,7 @@ diff --git a/android_webview/browser/aw_content_browser_client.cc b/android_webv
    // WebView only supports OS-level attribution and not web-attribution.
    switch (state) {
      case AttributionReportingOsApiState::kDisabled:
-@@ -1372,6 +1373,8 @@ bool AwContentBrowserClient::IsAttributionReportingOperationAllowed(
+@@ -1320,6 +1321,8 @@ bool AwContentBrowserClient::IsAttributionReportingOperationAllowed(
      const url::Origin* destination_origin,
      const url::Origin* reporting_origin,
      bool* can_bypass) {
@@ -70,10 +71,21 @@ diff --git a/android_webview/browser/aw_content_browser_client.cc b/android_webv
    AwBrowserContext* aw_context =
        static_cast<AwBrowserContext*>(browser_context);
    // WebView only supports OS-level attribution and not web-attribution.
+diff --git a/android_webview/browser/component_updater/trust_token_key_commitments_component_loader.cc b/android_webview/browser/component_updater/trust_token_key_commitments_component_loader.cc
+--- a/android_webview/browser/component_updater/trust_token_key_commitments_component_loader.cc
++++ b/android_webview/browser/component_updater/trust_token_key_commitments_component_loader.cc
+@@ -20,6 +20,7 @@ namespace android_webview {
+ // Tokens is enabled.
+ void LoadTrustTokenKeyCommitmentsComponent(
+     ComponentLoaderPolicyVector& policies) {
++  if ((true)) return;
+   DVLOG(1)
+       << "Registering Trust Token Key Commitments component for loading in "
+          "embedded WebView.";
 diff --git a/android_webview/java/src/org/chromium/android_webview/AwSettings.java b/android_webview/java/src/org/chromium/android_webview/AwSettings.java
 --- a/android_webview/java/src/org/chromium/android_webview/AwSettings.java
 +++ b/android_webview/java/src/org/chromium/android_webview/AwSettings.java
-@@ -177,7 +177,7 @@ public class AwSettings {
+@@ -172,7 +172,7 @@ public class AwSettings {
      private boolean mSpatialNavigationEnabled; // Default depends on device features.
      private boolean mEnableSupportedHardwareAcceleratedFeatures;
      private int mMixedContentMode = WebSettings.MIXED_CONTENT_NEVER_ALLOW;
@@ -82,7 +94,7 @@ diff --git a/android_webview/java/src/org/chromium/android_webview/AwSettings.ja
  
      @SpeculativeLoadingAllowedFlags
      private int mSpeculativeLoadingAllowedFlags =
-@@ -1804,7 +1804,7 @@ public class AwSettings {
+@@ -1778,7 +1778,7 @@ public class AwSettings {
      public void setAttributionBehavior(@AttributionBehavior int behavior) {
          synchronized (mAwSettingsLock) {
              if (mAttributionBehavior != behavior) {
@@ -102,7 +114,7 @@ diff --git a/chrome/android/java/AndroidManifest.xml b/chrome/android/java/Andro
      <uses-permission-sdk-23 android:name="android.permission.BLUETOOTH_ADMIN" android:maxSdkVersion="30"/>
      <uses-permission-sdk-23 android:name="android.permission.BLUETOOTH_CONNECT"/>
      <!--
-@@ -1179,9 +1178,6 @@ by a child template that "extends" this file.
+@@ -1149,9 +1148,6 @@ by a child template that "extends" this file.
              android:configChanges="orientation|keyboardHidden|keyboard|screenSize|mcc|mnc|screenLayout|smallestScreenSize" >
          </activity>
  
@@ -115,7 +127,7 @@ diff --git a/chrome/android/java/AndroidManifest.xml b/chrome/android/java/Andro
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/site_settings/ChromeSiteSettingsDelegate.java b/chrome/android/java/src/org/chromium/chrome/browser/site_settings/ChromeSiteSettingsDelegate.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/site_settings/ChromeSiteSettingsDelegate.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/site_settings/ChromeSiteSettingsDelegate.java
-@@ -150,6 +150,8 @@ public class ChromeSiteSettingsDelegate implements SiteSettingsDelegate {
+@@ -151,6 +151,8 @@ public class ChromeSiteSettingsDelegate implements SiteSettingsDelegate {
                  // not great to dynamically remove the preference in this way.
              case SiteSettingsCategory.Type.ADS:
                  return SiteSettingsCategory.adsCategoryEnabled();
@@ -127,7 +139,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/site_settings/C
 diff --git a/chrome/browser/k_anonymity_service/k_anonymity_trust_token_getter.cc b/chrome/browser/k_anonymity_service/k_anonymity_trust_token_getter.cc
 --- a/chrome/browser/k_anonymity_service/k_anonymity_trust_token_getter.cc
 +++ b/chrome/browser/k_anonymity_service/k_anonymity_trust_token_getter.cc
-@@ -120,7 +120,7 @@ KAnonymityTrustTokenGetter::~KAnonymityTrustTokenGetter() = default;
+@@ -119,7 +119,7 @@ KAnonymityTrustTokenGetter::~KAnonymityTrustTokenGetter() = default;
  
  void KAnonymityTrustTokenGetter::TryGetTrustTokenAndKey(
      TryGetTrustTokenAndKeyCallback callback) {
@@ -139,7 +151,7 @@ diff --git a/chrome/browser/k_anonymity_service/k_anonymity_trust_token_getter.c
 diff --git a/chrome/browser/resources/settings/privacy_page/privacy_page.html b/chrome/browser/resources/settings/privacy_page/privacy_page.html
 --- a/chrome/browser/resources/settings/privacy_page/privacy_page.html
 +++ b/chrome/browser/resources/settings/privacy_page/privacy_page.html
-@@ -588,11 +588,6 @@
+@@ -635,11 +635,6 @@
            </category-setting-exceptions>
          </settings-subpage>
        </template>
@@ -154,15 +166,15 @@ diff --git a/chrome/browser/resources/settings/privacy_page/privacy_page.html b/
 diff --git a/chrome/browser/resources/settings/route.ts b/chrome/browser/resources/settings/route.ts
 --- a/chrome/browser/resources/settings/route.ts
 +++ b/chrome/browser/resources/settings/route.ts
-@@ -84,7 +84,7 @@ function addPrivacyChildRoutes(r: Partial<SettingsRoutes>) {
+@@ -94,7 +94,7 @@ function addPrivacyChildRoutes(r: Partial<SettingsRoutes>) {
          r.SITE_SETTINGS.createChild('smartCardReaders');
    }
    // </if>
 -  r.SITE_SETTINGS_AUTO_VERIFY = r.SITE_SETTINGS.createChild('autoVerify');
 +  // r.SITE_SETTINGS_AUTO_VERIFY = r.SITE_SETTINGS.createChild('autoVerify');
-   r.SITE_SETTINGS_BACKGROUND_SYNC =
-       r.SITE_SETTINGS.createChild('backgroundSync');
-   r.SITE_SETTINGS_CAMERA = r.SITE_SETTINGS.createChild('camera');
+   if (!loadTimeData.getBoolean('enableAiSettingsPageRefresh') &&
+       loadTimeData.getBoolean('enableComposeProactiveNudge')) {
+     r.OFFER_WRITING_HELP = r.SITE_SETTINGS.createChild('offerWritingHelp');
 diff --git a/chrome/browser/resources/settings/site_settings_page/site_settings_page.ts b/chrome/browser/resources/settings/site_settings_page/site_settings_page.ts
 --- a/chrome/browser/resources/settings/site_settings_page/site_settings_page.ts
 +++ b/chrome/browser/resources/settings/site_settings_page/site_settings_page.ts
@@ -198,9 +210,9 @@ diff --git a/components/attribution_reporting/features.cc b/components/attributi
 diff --git a/components/content_settings/core/browser/content_settings_registry.cc b/components/content_settings/core/browser/content_settings_registry.cc
 --- a/components/content_settings/core/browser/content_settings_registry.cc
 +++ b/components/content_settings/core/browser/content_settings_registry.cc
-@@ -680,7 +680,7 @@ void ContentSettingsRegistry::Init() {
+@@ -689,7 +689,7 @@ void ContentSettingsRegistry::Init() {
             ContentSettingsInfo::INHERIT_IN_INCOGNITO,
-            PermissionSettingsInfo::EXCEPTIONS_ON_SECURE_ORIGINS_ONLY);
+            ContentSettingsInfo::EXCEPTIONS_ON_SECURE_ORIGINS_ONLY);
  
 -  Register(ContentSettingsType::ANTI_ABUSE, "anti-abuse", CONTENT_SETTING_ALLOW,
 +  Register(ContentSettingsType::ANTI_ABUSE, "anti-abuse", CONTENT_SETTING_BLOCK,
@@ -219,7 +231,7 @@ diff --git a/components/embedder_support/origin_trials/features.cc b/components/
 diff --git a/components/renderer_context_menu/render_view_context_menu_base.cc b/components/renderer_context_menu/render_view_context_menu_base.cc
 --- a/components/renderer_context_menu/render_view_context_menu_base.cc
 +++ b/components/renderer_context_menu/render_view_context_menu_base.cc
-@@ -541,9 +541,6 @@ RenderViewContextMenuBase::GetOpenURLParamsWithExtraHeaders(
+@@ -525,9 +525,6 @@ RenderViewContextMenuBase::GetOpenURLParamsWithExtraHeaders(
  
    open_url_params.source_site_instance = site_instance_;
  
@@ -232,7 +244,7 @@ diff --git a/components/renderer_context_menu/render_view_context_menu_base.cc b
 diff --git a/content/browser/aggregation_service/aggregatable_report_sender.cc b/content/browser/aggregation_service/aggregatable_report_sender.cc
 --- a/content/browser/aggregation_service/aggregatable_report_sender.cc
 +++ b/content/browser/aggregation_service/aggregatable_report_sender.cc
-@@ -192,13 +192,8 @@ void AggregatableReportSender::SendReport(GURL url,
+@@ -179,20 +179,19 @@ void AggregatableReportSender::SendReport(const GURL& url,
    // Allow bodies of non-2xx responses to be returned.
    simple_url_loader_ptr->SetAllowHttpErrorResults(true);
  
@@ -242,16 +254,15 @@ diff --git a/content/browser/aggregation_service/aggregatable_report_sender.cc b
 -      url_loader_factory_.get(),
 -      base::BindOnce(&AggregatableReportSender::OnReportSent,
 -                     base::Unretained(this), std::move(it), std::move(callback),
--                     delay_type, std::move(serialized_url)));
+-                     delay_type));
 +  // this is never called on Bromite but nothing would be sent if it were
-+  OnReportSent(std::move(it), std::move(callback), delay_type, std::move(serialized_url), nullptr);
++  OnReportSent(std::move(it), std::move(callback), delay_type, nullptr);
  }
  
  void AggregatableReportSender::OnReportSent(
-@@ -206,7 +201,11 @@ void AggregatableReportSender::OnReportSent(
+     UrlLoaderList::iterator it,
      ReportSentCallback callback,
      std::optional<DelayType> delay_type,
-     std::string serialized_url,
 -    scoped_refptr<net::HttpResponseHeaders> headers) {
 +    scoped_refptr<net::HttpResponseHeaders> headers) { // disable in Bromite
 +  if ((true)) {
@@ -264,7 +275,7 @@ diff --git a/content/browser/aggregation_service/aggregatable_report_sender.cc b
 diff --git a/content/browser/attribution_reporting/attribution_data_host_manager_impl.cc b/content/browser/attribution_reporting/attribution_data_host_manager_impl.cc
 --- a/content/browser/attribution_reporting/attribution_data_host_manager_impl.cc
 +++ b/content/browser/attribution_reporting/attribution_data_host_manager_impl.cc
-@@ -821,11 +821,9 @@ class AttributionDataHostManagerImpl::PendingRegistrationData {
+@@ -758,11 +758,9 @@ class AttributionDataHostManagerImpl::PendingRegistrationData {
          headers->GetNormalizedHeader(
              attribution_reporting::kAttributionReportingRegisterTriggerHeader);
  
@@ -278,7 +289,7 @@ diff --git a/content/browser/attribution_reporting/attribution_data_host_manager
  
      const bool has_source =
          web_source_header.has_value() || os_source_header.has_value();
-@@ -1184,6 +1182,8 @@ void AttributionDataHostManagerImpl::ParseHeader(
+@@ -1121,6 +1119,8 @@ void AttributionDataHostManagerImpl::ParseHeader(
      Registrations& registrations,
      HeaderPendingDecode pending_decode,
      Registrar registrar) {
@@ -290,7 +301,7 @@ diff --git a/content/browser/attribution_reporting/attribution_data_host_manager
 diff --git a/content/browser/attribution_reporting/attribution_host.cc b/content/browser/attribution_reporting/attribution_host.cc
 --- a/content/browser/attribution_reporting/attribution_host.cc
 +++ b/content/browser/attribution_reporting/attribution_host.cc
-@@ -132,8 +132,6 @@ AttributionHost::AttributionHost(WebContents* web_contents)
+@@ -119,8 +119,6 @@ AttributionHost::AttributionHost(WebContents* web_contents)
        attribution_reporting::features::kConversionMeasurement));
  
  #if BUILDFLAG(IS_ANDROID)
@@ -299,18 +310,18 @@ diff --git a/content/browser/attribution_reporting/attribution_host.cc b/content
  #endif
  }
  
-@@ -348,6 +346,7 @@ void AttributionHost::NotifyNavigationRegistrationData(
+@@ -318,6 +316,7 @@ void AttributionHost::NotifyNavigationRegistrationData(
      return;
    }
  
 +  if ((true)) return;
    auto* attribution_manager =
        AttributionManager::FromWebContents(web_contents());
-   CHECK(attribution_manager);
+   DCHECK(attribution_manager);
 diff --git a/content/browser/attribution_reporting/attribution_manager_impl.cc b/content/browser/attribution_reporting/attribution_manager_impl.cc
 --- a/content/browser/attribution_reporting/attribution_manager_impl.cc
 +++ b/content/browser/attribution_reporting/attribution_manager_impl.cc
-@@ -612,11 +612,7 @@ bool IsOperationAllowed(
+@@ -573,11 +573,7 @@ bool IsOperationAllowed(
  }
  
  std::unique_ptr<AttributionOsLevelManager> CreateOsLevelManager() {
@@ -321,7 +332,7 @@ diff --git a/content/browser/attribution_reporting/attribution_manager_impl.cc b
 -#endif
  }
  
- base::Time GetReportExpiryTime(const AttributionReport& report) {
+ // Returns new report time if any.
 diff --git a/content/browser/attribution_reporting/attribution_os_level_manager.cc b/content/browser/attribution_reporting/attribution_os_level_manager.cc
 --- a/content/browser/attribution_reporting/attribution_os_level_manager.cc
 +++ b/content/browser/attribution_reporting/attribution_os_level_manager.cc
@@ -345,7 +356,7 @@ diff --git a/content/browser/attribution_reporting/attribution_os_level_manager.
 diff --git a/content/browser/attribution_reporting/attribution_report_network_sender.cc b/content/browser/attribution_reporting/attribution_report_network_sender.cc
 --- a/content/browser/attribution_reporting/attribution_report_network_sender.cc
 +++ b/content/browser/attribution_reporting/attribution_report_network_sender.cc
-@@ -159,6 +159,9 @@ void AttributionReportNetworkSender::SendReport(GURL url,
+@@ -173,6 +173,9 @@ void AttributionReportNetworkSender::SendReport(GURL url,
                                                  url::Origin origin,
                                                  std::string body,
                                                  UrlLoaderCallback callback) {
@@ -355,7 +366,7 @@ diff --git a/content/browser/attribution_reporting/attribution_report_network_se
    auto resource_request = std::make_unique<network::ResourceRequest>();
    resource_request->url = std::move(url);
    resource_request->method = net::HttpRequestHeaders::kPostMethod;
-@@ -234,6 +237,12 @@ void AttributionReportNetworkSender::OnReportSent(
+@@ -248,6 +251,12 @@ void AttributionReportNetworkSender::OnReportSent(
      ReportSentCallback sent_callback,
      UrlLoaderList::iterator it,
      scoped_refptr<net::HttpResponseHeaders> headers) {
@@ -367,11 +378,11 @@ diff --git a/content/browser/attribution_reporting/attribution_report_network_se
 +  }
    network::SimpleURLLoader* loader = it->get();
  
-   const int net_error = loader->NetError();
+   // Consider a non-200 HTTP code as a non-internal error.
 diff --git a/content/browser/attribution_reporting/attribution_storage_sql.cc b/content/browser/attribution_reporting/attribution_storage_sql.cc
 --- a/content/browser/attribution_reporting/attribution_storage_sql.cc
 +++ b/content/browser/attribution_reporting/attribution_storage_sql.cc
-@@ -541,6 +541,8 @@ void AssignSourceForDeactivationOrDeletion(
+@@ -532,6 +532,8 @@ void AssignSourceForDeactivationOrDeletion(
    }
  }
  
@@ -380,7 +391,7 @@ diff --git a/content/browser/attribution_reporting/attribution_storage_sql.cc b/
  }  // namespace
  
  // static
-@@ -563,9 +565,9 @@ bool AttributionStorageSql::Transaction::Commit() {
+@@ -554,9 +556,9 @@ bool AttributionStorageSql::Transaction::Commit() {
  AttributionStorageSql::AttributionStorageSql(
      const base::FilePath& user_data_directory,
      AttributionResolverDelegate* delegate)
@@ -390,13 +401,13 @@ diff --git a/content/browser/attribution_reporting/attribution_storage_sql.cc b/
 +    : path_to_database_(user_data_directory.empty() || g_run_in_memory
 +                             ? base::FilePath()
 +                             : DatabasePath(user_data_directory)),
-       db_(sql::DatabaseOptions().set_cache_size(32),
+       db_(sql::DatabaseOptions().set_page_size(4096).set_cache_size(32),
            /*tag=*/"Conversions"),
        delegate_(delegate),
 diff --git a/content/browser/renderer_host/render_frame_host_impl.cc b/content/browser/renderer_host/render_frame_host_impl.cc
 --- a/content/browser/renderer_host/render_frame_host_impl.cc
 +++ b/content/browser/renderer_host/render_frame_host_impl.cc
-@@ -10465,6 +10465,7 @@ bool RenderFrameHostImpl::IsFencedFrameReportingFromRendererAllowed(
+@@ -10242,6 +10242,7 @@ bool RenderFrameHostImpl::IsFencedFrameReportingFromRendererAllowed(
      return false;
    }
  
@@ -404,7 +415,7 @@ diff --git a/content/browser/renderer_host/render_frame_host_impl.cc b/content/b
    if (!IsActive()) {
      // reportEvent is not allowed when this RenderFrameHost or one of its
      // ancestors is not active.
-@@ -14415,6 +14416,16 @@ void RenderFrameHostImpl::BindTrustTokenQueryAnswerer(
+@@ -14046,6 +14047,16 @@ void RenderFrameHostImpl::BindTrustTokenQueryAnswerer(
      return;
    }
  
@@ -424,7 +435,7 @@ diff --git a/content/browser/renderer_host/render_frame_host_impl.cc b/content/b
 diff --git a/content/browser/storage_partition_impl.cc b/content/browser/storage_partition_impl.cc
 --- a/content/browser/storage_partition_impl.cc
 +++ b/content/browser/storage_partition_impl.cc
-@@ -1484,15 +1484,6 @@ void StoragePartitionImpl::Initialize(
+@@ -1482,15 +1482,6 @@ void StoragePartitionImpl::Initialize(
  
    bucket_manager_ = std::make_unique<BucketManager>(this);
  
@@ -437,10 +448,10 @@ diff --git a/content/browser/storage_partition_impl.cc b/content/browser/storage
 -        this, path, special_storage_policy_);
 -  }
 -
-   if (base::FeatureList::IsEnabled(network::features::kInterestGroupStorage)) {
+   if (base::FeatureList::IsEnabled(blink::features::kInterestGroupStorage)) {
      // Auction worklets on non-Android use dedicated processes; on Android due
      // to high cost of process launch they try to reuse renderers.
-@@ -1544,9 +1535,6 @@ void StoragePartitionImpl::Initialize(
+@@ -1542,9 +1533,6 @@ void StoragePartitionImpl::Initialize(
  
    font_access_manager_ = FontAccessManager::Create();
  
@@ -453,7 +464,7 @@ diff --git a/content/browser/storage_partition_impl.cc b/content/browser/storage
 diff --git a/content/public/android/BUILD.gn b/content/public/android/BUILD.gn
 --- a/content/public/android/BUILD.gn
 +++ b/content/public/android/BUILD.gn
-@@ -205,8 +205,6 @@ android_library("content_full_java") {
+@@ -203,8 +203,6 @@ android_library("content_full_java") {
      "//third_party/androidx:androidx_appcompat_appcompat_resources_java",
      "//third_party/androidx:androidx_collection_collection_java",
      "//third_party/androidx:androidx_core_core_java",
@@ -644,7 +655,7 @@ diff --git a/content/public/android/java/src/org/chromium/content/browser/Attrib
 -                        onRegistrationCompleted(requestId, type, convertToOperationResult(thrown));
 -                    }
 -                },
--                PostTask.getUiBestEffortExecutor());
+-                ContextUtils.getApplicationContext().getMainExecutor());
 -    }
 -
      @CalledByNative
@@ -857,7 +868,7 @@ diff --git a/content/public/android/java/src/org/chromium/content/browser/Attrib
 -                                    originUris));
 -
 -            Futures.addCallback(
--                    future, callback, PostTask.getUiUserVisibleExecutor());
+-                    future, callback, ContextUtils.getApplicationContext().getMainExecutor());
 -        }
 +        onDataDeletionCompleted(requestId);
      }
@@ -920,14 +931,14 @@ diff --git a/content/public/android/java/src/org/chromium/content/browser/Attrib
 -                                /* status= */ 0, convertToOperationResult(thrown));
 -                    }
 -                },
--                PostTask.getUiUserBlockingExecutor());
+-                ContextUtils.getApplicationContext().getMainExecutor());
      }
  
      @CalledByNative
 diff --git a/content/public/browser/content_browser_client.cc b/content/public/browser/content_browser_client.cc
 --- a/content/public/browser/content_browser_client.cc
 +++ b/content/public/browser/content_browser_client.cc
-@@ -631,6 +631,7 @@ void ContentBrowserClient::OnAuctionComplete(
+@@ -601,6 +601,7 @@ void ContentBrowserClient::OnAuctionComplete(
  network::mojom::AttributionSupport ContentBrowserClient::GetAttributionSupport(
      AttributionReportingOsApiState state,
      bool client_os_disabled) {
@@ -935,7 +946,7 @@ diff --git a/content/public/browser/content_browser_client.cc b/content/public/b
    switch (state) {
      case AttributionReportingOsApiState::kDisabled:
        return network::mojom::AttributionSupport::kWeb;
-@@ -648,13 +649,13 @@ bool ContentBrowserClient::IsAttributionReportingOperationAllowed(
+@@ -618,13 +619,13 @@ bool ContentBrowserClient::IsAttributionReportingOperationAllowed(
      const url::Origin* destination_origin,
      const url::Origin* reporting_origin,
      bool* can_bypass) {
@@ -951,7 +962,7 @@ diff --git a/content/public/browser/content_browser_client.cc b/content/public/b
  }
  
  bool ContentBrowserClient::IsAttributionReportingAllowedForContext(
-@@ -662,7 +663,7 @@ bool ContentBrowserClient::IsAttributionReportingAllowedForContext(
+@@ -632,7 +633,7 @@ bool ContentBrowserClient::IsAttributionReportingAllowedForContext(
      content::RenderFrameHost* rfh,
      const url::Origin& context_origin,
      const url::Origin& reporting_origin) {
@@ -975,22 +986,23 @@ diff --git a/cromite_flags/services/network/public/cpp/features_cc/Disable-conve
 new file mode 100644
 --- /dev/null
 +++ b/cromite_flags/services/network/public/cpp/features_cc/Disable-conversion-measurement-api.inc
-@@ -0,0 +1,2 @@
-+SET_CROMITE_FEATURE_DISABLED(kBrowsingTopics);
-+SET_CROMITE_FEATURE_DISABLED(kInterestGroupStorage);
+@@ -0,0 +1 @@
++// none
 diff --git a/cromite_flags/third_party/blink/common/features_cc/Disable-conversion-measurement-api.inc b/cromite_flags/third_party/blink/common/features_cc/Disable-conversion-measurement-api.inc
 new file mode 100644
 --- /dev/null
 +++ b/cromite_flags/third_party/blink/common/features_cc/Disable-conversion-measurement-api.inc
-@@ -0,0 +1,8 @@
+@@ -0,0 +1,10 @@
 +SET_CROMITE_FEATURE_DISABLED(kAdAuctionSignals);
++SET_CROMITE_FEATURE_DISABLED(kBrowsingTopics);
 +SET_CROMITE_FEATURE_DISABLED(kBrowsingTopicsDocumentAPI);
 +SET_CROMITE_FEATURE_DISABLED(kBrowsingTopicsParameters);
 +SET_CROMITE_FEATURE_DISABLED(kFledge);
 +SET_CROMITE_FEATURE_DISABLED(kFledgeBiddingAndAuctionServer);
++SET_CROMITE_FEATURE_DISABLED(kInterestGroupStorage);
 +SET_CROMITE_FEATURE_DISABLED(kPrivateAggregationApi);
++SET_CROMITE_FEATURE_DISABLED(kBiddingAndScoringDebugReportingAPI);
 +SET_CROMITE_FEATURE_DISABLED(kAllowURNsInIframes);
-+SET_CROMITE_FEATURE_DISABLED(kFledgeSampleDebugReports);
 diff --git a/services/network/attribution/request_headers_internal.cc b/services/network/attribution/request_headers_internal.cc
 --- a/services/network/attribution/request_headers_internal.cc
 +++ b/services/network/attribution/request_headers_internal.cc
@@ -1005,18 +1017,7 @@ diff --git a/services/network/attribution/request_headers_internal.cc b/services
 diff --git a/services/network/network_context.cc b/services/network/network_context.cc
 --- a/services/network/network_context.cc
 +++ b/services/network/network_context.cc
-@@ -1318,6 +1318,10 @@ void NetworkContext::ClearTrustTokenData(mojom::ClearDataFilterPtr filter,
- 
- void NetworkContext::ClearTrustTokenSessionOnlyData(
-     ClearTrustTokenSessionOnlyDataCallback callback) {
-+  if (!trust_token_store_) {
-+    std::move(callback).Run(false);
-+    return;
-+  }
-   // Only called when Private State Tokens is enabled, i.e.,
-   // `trust_token_store_` is non-null.
-   DCHECK(trust_token_store_);
-@@ -2731,26 +2735,6 @@ URLRequestContextOwner NetworkContext::MakeURLRequestContext(
+@@ -2637,26 +2637,6 @@ URLRequestContextOwner NetworkContext::MakeURLRequestContext(
      builder.set_network_quality_estimator(
          network_service_->network_quality_estimator());
    }
@@ -1046,7 +1047,7 @@ diff --git a/services/network/network_context.cc b/services/network/network_cont
 diff --git a/services/network/public/cpp/attribution_utils.cc b/services/network/public/cpp/attribution_utils.cc
 --- a/services/network/public/cpp/attribution_utils.cc
 +++ b/services/network/public/cpp/attribution_utils.cc
-@@ -9,6 +9,7 @@
+@@ -10,6 +10,7 @@
  namespace network {
  
  bool HasAttributionOsSupport(mojom::AttributionSupport attribution_support) {
@@ -1054,7 +1055,7 @@ diff --git a/services/network/public/cpp/attribution_utils.cc b/services/network
    switch (attribution_support) {
      case mojom::AttributionSupport::kOs:
      case mojom::AttributionSupport::kWebAndOs:
-@@ -21,6 +22,7 @@ bool HasAttributionOsSupport(mojom::AttributionSupport attribution_support) {
+@@ -23,6 +24,7 @@ bool HasAttributionOsSupport(mojom::AttributionSupport attribution_support) {
  }
  
  bool HasAttributionWebSupport(mojom::AttributionSupport attribution_support) {
@@ -1065,7 +1066,7 @@ diff --git a/services/network/public/cpp/attribution_utils.cc b/services/network
 diff --git a/third_party/blink/renderer/core/frame/attribution_src_loader.cc b/third_party/blink/renderer/core/frame/attribution_src_loader.cc
 --- a/third_party/blink/renderer/core/frame/attribution_src_loader.cc
 +++ b/third_party/blink/renderer/core/frame/attribution_src_loader.cc
-@@ -211,8 +211,6 @@ struct AttributionSrcLoader::AttributionHeaders {
+@@ -209,8 +209,6 @@ struct AttributionSrcLoader::AttributionHeaders {
                       uint64_t request_id)
        : web_source(map.Get(http_names::kAttributionReportingRegisterSource)),
          web_trigger(map.Get(http_names::kAttributionReportingRegisterTrigger)),
@@ -1077,7 +1078,7 @@ diff --git a/third_party/blink/renderer/core/frame/attribution_src_loader.cc b/t
 diff --git a/third_party/blink/renderer/core/page/page.cc b/third_party/blink/renderer/core/page/page.cc
 --- a/third_party/blink/renderer/core/page/page.cc
 +++ b/third_party/blink/renderer/core/page/page.cc
-@@ -1604,7 +1604,7 @@ void Page::UpdateBrowsingContextGroup(
+@@ -1575,7 +1575,7 @@ void Page::UpdateBrowsingContextGroup(
  
  void Page::SetAttributionSupport(
      network::mojom::AttributionSupport attribution_support) {
@@ -1089,7 +1090,7 @@ diff --git a/third_party/blink/renderer/core/page/page.cc b/third_party/blink/re
 diff --git a/third_party/blink/renderer/platform/runtime_enabled_features.json5 b/third_party/blink/renderer/platform/runtime_enabled_features.json5
 --- a/third_party/blink/renderer/platform/runtime_enabled_features.json5
 +++ b/third_party/blink/renderer/platform/runtime_enabled_features.json5
-@@ -285,8 +285,8 @@
+@@ -286,8 +286,8 @@
      },
      {
        // Interest Group JS API/runtimeflag.
@@ -1100,8 +1101,8 @@ diff --git a/third_party/blink/renderer/platform/runtime_enabled_features.json5
        origin_trial_feature_name: "AdInterestGroupAPI",
        implied_by: ["Fledge", "Parakeet"],
        public: true,
-@@ -558,8 +558,8 @@
-       status: "stable",
+@@ -464,8 +464,8 @@
+       name: "AtomicMoveRangePreservation",
      },
      {
 -      name: "AttributionReporting",
@@ -1111,7 +1112,7 @@ diff --git a/third_party/blink/renderer/platform/runtime_enabled_features.json5
        base_feature: "none",
        public: true,
      },
-@@ -3778,8 +3778,8 @@
+@@ -3448,8 +3448,8 @@
        base_feature: "none",
      },
      {
@@ -1122,8 +1123,8 @@ diff --git a/third_party/blink/renderer/platform/runtime_enabled_features.json5
        base_feature: "none",
        public: true,
      },
-@@ -4983,16 +4983,16 @@
-       status: "stable",
+@@ -4359,16 +4359,16 @@
+       status: "experimental",
      },
      {
 -      name: "TopicsAPI",
@@ -1146,10 +1147,10 @@ diff --git a/third_party/blink/renderer/platform/runtime_enabled_features.json5
 diff --git a/ui/events/android/motion_event_android.cc b/ui/events/android/motion_event_android.cc
 --- a/ui/events/android/motion_event_android.cc
 +++ b/ui/events/android/motion_event_android.cc
-@@ -30,8 +30,12 @@ namespace ui {
- namespace {
+@@ -394,8 +394,12 @@ MotionEventAndroid::ToolType MotionEventAndroid::FromAndroidToolType(
+ #undef TOOL_TYPE_CASE
  
- base::TimeTicks FromAndroidTime(base::TimeTicks time) {
+ base::TimeTicks MotionEventAndroid::FromAndroidTime(base::TimeTicks time) {
 -  ValidateEventTimeClock(&time);
 -  return time;
 +  base::TimeTicks timestamp;
@@ -1160,5 +1161,5 @@ diff --git a/ui/events/android/motion_event_android.cc b/ui/events/android/motio
 +  return timestamp;
  }
  
- float ToValidFloat(float x) {
+ float MotionEventAndroid::ToValidFloat(float x) {
 --