Rebase to 144.0.7559.97

[AUTO][FILECONTROL] - version 144.0.7559.97 (#2651 )
[AUTO][FILECONTROL] - version 144.0.7559.97
2026-01-25 10:24:53 +01:00 · 2026-01-24 17:34:54 +00:00 · 2026-01-24 17:34:15 +00:00 · 2026-01-24 18:33:12 +01:00 · 2026-01-24 17:32:39 +00:00 · 2026-01-24 18:31:38 +01:00
1313 changed files with 70350 additions and 216644 deletions
@@ -111,7 +111,6 @@ jobs:
        - /storage/images/${{ github.event.inputs.sha }}/android/${{ github.event.inputs.debug }}/chr_arm64:/home/lg/working_dir/chromium/src/out/chr_arm64
        - /storage/images/${{ github.event.inputs.sha }}/android/${{ github.event.inputs.debug }}/chr_x64:/home/lg/working_dir/chromium/src/out/chr_x64
        - /storage/images/${{ github.event.inputs.sha }}/android/${{ github.event.inputs.debug }}/x64_webview:/home/lg/working_dir/chromium/src/out/x64_webview
-        - /storage/images/${{ github.event.inputs.sha }}/android/${{ github.event.inputs.debug }}/arm64_webview:/home/lg/working_dir/chromium/src/out/arm64_webview
        - /tmp/proxy:/tmp/proxy
        - /win_sdk:/win_sdk

@@ -129,7 +128,7 @@ jobs:
          http_proxy=
          https_proxy=

-          # set out folder permissions
+          # setup folder permissions
          test -d chromium/src/out/chr_arm || sudo mkdir -p chromium/src/out/chr_arm && \
            sudo chown lg chromium/src/out &&
            sudo chown lg chromium/src/out/chr_arm
@@ -145,11 +144,11 @@ jobs:
          test -d chromium/src/out/x64_webview || sudo mkdir -p chromium/src/out/x64_webview && \
            sudo chown lg chromium/src/out &&
            sudo chown lg chromium/src/out/x64_webview
-
-          test -d chromium/src/out/arm64_webview || sudo mkdir -p chromium/src/out/arm64_webview && \
-            sudo chown lg chromium/src/out &&
-            sudo chown lg chromium/src/out/arm64_webview
            
+          sudo chown lg /home/lg/working_dir
+          test -d /github/home/.config/depot_tools || sudo mkdir -p /github/home/.config/depot_tools
+          sudo chown lg /github/home/.config/depot_tools
+
          sudo mkdir -p /run/user/1000/
          sudo chown lg /run/user/1000/
          sudo chmod g-rxw /run/user/1000/
@@ -177,27 +176,9 @@ jobs:
          gn args out/x64_webview/ --list >out/x64_webview/gn_list
          echo "::endgroup::"

-          ninja -C out/x64_webview system_webview_apk system_webview_shell
+          vpython3 /home/lg/working_dir/depot_tools/siso.py ninja -C out/x64_webview system_webview_apk system_webview_shell --offline
          cp ../../cromite/build/RELEASE out/x64_webview

-      - name: Build Cromite System WebView arm64
-        shell: bash
-        run: |
-          PATH=$WORKSPACE/chromium/src/third_party/llvm-build/Release+Asserts/bin:$WORKSPACE/depot_tools/:/usr/local/go/bin:$WORKSPACE/mtool/bin:$PATH
-          cd $WORKSPACE/chromium/src
-
-          echo "::group::-------- gn gen"
-          gn gen --args="target_os = \"android\" target_cpu = \"arm64\" $(cat /home/lg/working_dir/cromite/build/cromite.gn_args) system_webview_package_name=\"com.android.webview\" enable_trybot_verification=false " out/arm64_webview
-          echo "::endgroup::"
-
-          echo "::group::-------- gn args"
-          gn args out/arm64_webview/ --list --short
-          gn args out/arm64_webview/ --list >out/arm64_webview/gn_list
-          echo "::endgroup::"
-
-          ninja -C out/arm64_webview system_webview_apk system_webview_shell
-          cp ../../cromite/build/RELEASE out/arm64_webview
-
      - name: Prepare Build Container for vanilla chromium
        shell: bash
        run: |
@@ -224,7 +205,7 @@ jobs:
          gn args out/chr_x64/ --list >out/chr_x64/gn_list
          echo "::endgroup::"

-          ninja -C out/chr_x64 chrome_public_apk
+          vpython3 /home/lg/working_dir/depot_tools/siso.py ninja -C out/chr_x64 chrome_public_apk --offline

          cp ../../cromite/build/RELEASE out/chr_x64

@@ -243,7 +224,7 @@ jobs:
          gn args out/chr_arm64/ --list >out/chr_arm64/gn_list
          echo "::endgroup::"

-          ninja -C out/chr_arm64 chrome_public_apk
+          vpython3 /home/lg/working_dir/depot_tools/siso.py ninja -C out/chr_arm64 chrome_public_apk --offline

          cp ../../cromite/build/RELEASE out/chr_arm64

@@ -262,6 +243,6 @@ jobs:
          gn args out/chr_arm/ --list >out/chr_arm/gn_list
          echo "::endgroup::"

-          ninja -C out/chr_arm chrome_public_apk
+          vpython3 /home/lg/working_dir/depot_tools/siso.py ninja -C out/chr_arm chrome_public_apk --offline

          cp ../../cromite/build/RELEASE out/chr_arm
@@ -177,11 +177,12 @@ jobs:
        USELOCALIMAGE: true       # CUSTOM RUNNER: permit use of local images
        USEINTERNALNETWORK: true  # CUSTOM RUNNER: create the docker network as internal
        WORKSPACE: /home/lg/working_dir
+        HOME: /home/lg/working_dir
        # kythe
        KYTHE_CORPUS: chromium.googlesource.com/chromium/src
        KYTHE_ROOT_DIRECTORY: /home/lg/working_dir/chromium/src
        KYTHE_OUTPUT_DIRECTORY: /home/lg/working_dir/chromium/src/out/arm64/kythe
-        # cross build
+        # cross build (change also release.yaml)
        DEPOT_TOOLS_WIN_TOOLCHAIN_BASE_URL: /win_sdk/sdks/Win11SDK_10.0.26100.0/
        WINDOWSSDKDIR: "/win_sdk/sdks/Win11SDK_10.0.26100.0/Windows Kits/10/"
        GYP_MSVS_OVERRIDE_PATH: /win_sdk/sdks/Win11SDK_10.0.26100.0/
@@ -197,6 +198,7 @@ jobs:
        - /storage/images/${{ github.event.inputs.sha }}/android/${{ github.event.inputs.debug }}/x64:/home/lg/working_dir/chromium/src/out/x64
        - /storage/images/${{ github.event.inputs.sha }}/linux/${{ github.event.inputs.debug }}/lin64:/home/lg/working_dir/chromium/src/out/lin64
        - /storage/images/${{ github.event.inputs.sha }}/win/x64:/home/lg/working_dir/chromium/src/out/win64
+        - /storage/images/${{ github.event.inputs.sha }}/android/${{ github.event.inputs.debug }}/arm64_webview:/home/lg/working_dir/chromium/src/out/arm64_webview
        - /tmp/proxy:/tmp/proxy
        - /win_sdk:/win_sdk

@@ -214,7 +216,7 @@ jobs:
          http_proxy=
          https_proxy=

-          # set out folder permissions
+          # setup folder permissions
          test -d chromium/src/out/arm || sudo mkdir -p chromium/src/out/arm && \
            sudo chown lg chromium/src/out &&
            sudo chown lg chromium/src/out/arm
@@ -234,6 +236,14 @@ jobs:
          test -d chromium/src/out/lin64 || sudo mkdir -p chromium/src/out/lin64 && \
            sudo chown lg chromium/src/out &&
            sudo chown lg chromium/src/out/lin64
+
+          test -d chromium/src/out/arm64_webview || sudo mkdir -p chromium/src/out/arm64_webview && \
+            sudo chown lg chromium/src/out &&
+            sudo chown lg chromium/src/out/arm64_webview
+
+          sudo chown lg /home/lg/working_dir
+          test -d /github/home/.config/depot_tools || sudo mkdir -p /github/home/.config/depot_tools
+          sudo chown lg /github/home/.config/depot_tools
            
          # make kythe output directory
          test -d $KYTHE_OUTPUT_DIRECTORY || mkdir -p $KYTHE_OUTPUT_DIRECTORY
@@ -261,16 +271,16 @@ jobs:
          cd $WORKSPACE/chromium/src

          echo "::group::-------- gn gen"
-          gn gen --args="target_os = \"android\" $(cat /home/lg/working_dir/cromite/build/cromite.gn_args) target_cpu = \"x64\" " out/x64
+          gn gen --args="target_os = \"android\" $(cat /home/lg/working_dir/cromite/build/cromite.gn_args) target_cpu = \"x64\" " out/x64 || true
          echo "::endgroup::"

          echo "::group::-------- gn args"
-          gn args out/x64/ --list --short
-          gn args out/x64/ --list >out/x64/gn_list
+          gn args out/x64/ --list --short || true
+          gn args out/x64/ --list >out/x64/gn_list || true
          echo "::endgroup::"

-          ninja -C out/x64 chrome_public_bundle
-          ninja -C out/x64 chrome_public_apk
+          vpython3 /home/lg/working_dir/depot_tools/siso.py ninja -C out/x64 chrome_public_bundle --offline
+          vpython3 /home/lg/working_dir/depot_tools/siso.py ninja -C out/x64 chrome_public_apk --offline

          cp ../../cromite/build/RELEASE out/x64

@@ -290,15 +300,15 @@ jobs:
          cd $WORKSPACE/chromium/src

          echo "::group::-------- gn gen"
-          gn gen --args="target_os = \"win\" $(cat /home/lg/working_dir/cromite/build/cromite.gn_args) target_cpu = \"x64\" " out/win64
+          gn gen --args="target_os = \"win\" $(cat /home/lg/working_dir/cromite/build/cromite.gn_args) target_cpu = \"x64\" " out/win64 || true
          echo "::endgroup::"

          echo "::group::-------- gn args"
-          gn args out/win64/ --list --short
-          gn args out/win64/ --list >out/win64/gn_list
+          gn args out/win64/ --list --short || true
+          gn args out/win64/ --list >out/win64/gn_list || true
          echo "::endgroup::"

-          ninja -C out/win64 chrome
+          vpython3 /home/lg/working_dir/depot_tools/siso.py ninja -C out/win64 chrome --offline

          cp ../../cromite/build/RELEASE out/win64

@@ -318,16 +328,16 @@ jobs:
          cd $WORKSPACE/chromium/src

          echo "::group::-------- gn gen"
-          gn gen --args="target_os = \"android\" $(cat /home/lg/working_dir/cromite/build/cromite.gn_args) target_cpu = \"arm64\" " out/arm64
+          gn gen --args="target_os = \"android\" $(cat /home/lg/working_dir/cromite/build/cromite.gn_args) target_cpu = \"arm64\" " out/arm64 || true
          echo "::endgroup::"

          echo "::group::-------- gn args"
-          gn args out/arm64/ --list --short
-          gn args out/arm64/ --list >out/arm64/gn_list
+          gn args out/arm64/ --list --short || true
+          gn args out/arm64/ --list >out/arm64/gn_list || true
          echo "::endgroup::"

-          ninja -C out/arm64 chrome_public_bundle
-          ninja -C out/arm64 chrome_public_apk
+          vpython3 /home/lg/working_dir/depot_tools/siso.py ninja -C out/arm64 chrome_public_bundle --offline
+          vpython3 /home/lg/working_dir/depot_tools/siso.py ninja -C out/arm64 chrome_public_apk --offline

          cp ../../cromite/build/RELEASE out/arm64

@@ -347,7 +357,7 @@ jobs:
          cd $WORKSPACE/chromium/src

          echo "::group::-------- generating breakpad symbols"
-          ninja -C out/arm64 minidump_stackwalk dump_syms
+          vpython3 /home/lg/working_dir/depot_tools/siso.py ninja -C out/arm64 minidump_stackwalk dump_syms --offline
          components/crash/content/tools/generate_breakpad_symbols.py --build-dir=out/arm64 \
             --symbols-dir=out/arm64/symbols/ --binary=out/arm64/lib.unstripped/libchrome.so \
             --platform=android --clear --verbose
@@ -363,7 +373,7 @@ jobs:
          PATH=$WORKSPACE/chromium/src/third_party/llvm-build/Release+Asserts/bin:$WORKSPACE/depot_tools/:/usr/local/go/bin:$WORKSPACE/mtool/bin:$PATH
          cd $WORKSPACE/chromium/src

-          tools/binary_size/supersize archive out/arm64/chrome.size --apk-file out/arm64/apks/ChromePublic.apk -v
+          vpython3 tools/binary_size/libsupersize/main.py archive out/arm64/chrome.size --apk-file out/arm64/apks/ChromePublic.apk -v

      - name: Build Cromite Android arm
        if: ${{ (github.event.inputs.target_os == 'android' || github.event.inputs.target_os == 'all') && (github.event.inputs.build == 'arm' || github.event.inputs.build == 'all') }}
@@ -373,16 +383,16 @@ jobs:
          cd $WORKSPACE/chromium/src

          echo "::group::-------- gn gen"
-          gn gen --args="target_os = \"android\" $(cat /home/lg/working_dir/cromite/build/cromite.gn_args) target_cpu = \"arm\" " out/arm
+          gn gen --args="target_os = \"android\" $(cat /home/lg/working_dir/cromite/build/cromite.gn_args) target_cpu = \"arm\" " out/arm || true
          echo "::endgroup::"

          echo "::group::-------- gn args"
-          gn args out/arm/ --list --short
-          gn args out/arm/ --list >out/arm/gn_list
+          gn args out/arm/ --list --short || true
+          gn args out/arm/ --list >out/arm/gn_list || true
          echo "::endgroup::"

-          ninja -C out/arm chrome_public_bundle
-          ninja -C out/arm chrome_public_apk
+          vpython3 /home/lg/working_dir/depot_tools/siso.py ninja -C out/arm chrome_public_bundle --offline
+          vpython3 /home/lg/working_dir/depot_tools/siso.py ninja -C out/arm chrome_public_apk --offline

          cp ../../cromite/build/RELEASE out/arm

@@ -402,15 +412,15 @@ jobs:
          cd $WORKSPACE/chromium/src

          echo "::group::-------- gn gen"
-          gn gen --args="target_os = \"linux\" $(cat /home/lg/working_dir/cromite/build/cromite.gn_args) target_cpu = \"x64\" " out/lin64
+          gn gen --args="target_os = \"linux\" $(cat /home/lg/working_dir/cromite/build/cromite.gn_args) target_cpu = \"x64\" " out/lin64 || true
          echo "::endgroup::"

          echo "::group::-------- gn args"
-          gn args out/lin64/ --list --short
-          gn args out/lin64/ --list >out/lin64/gn_list
+          gn args out/lin64/ --list --short || true
+          gn args out/lin64/ --list >out/lin64/gn_list || true
          echo "::endgroup::"

-          ninja -C out/lin64 chrome chrome_sandbox
+          vpython3 /home/lg/working_dir/depot_tools/siso.py ninja -C out/lin64 chrome chrome_sandbox --offline

          cp ../../cromite/build/RELEASE out/lin64

@@ -422,6 +432,24 @@ jobs:
          $WORKSPACE/ninjatracing/ninjatracing -a $WORKSPACE/chromium/src/out/lin64/.ninja_log >$WORKSPACE/chromium/src/out/lin64/ninja_log_trace.json
          python3 $WORKSPACE/chromium/src/third_party/catapult/tracing/bin/trace2html $WORKSPACE/chromium/src/out/lin64/ninja_log_trace.json

+      - name: Build Cromite System WebView arm64
+        shell: bash
+        run: |
+          PATH=$WORKSPACE/chromium/src/third_party/llvm-build/Release+Asserts/bin:$WORKSPACE/depot_tools/:/usr/local/go/bin:$WORKSPACE/mtool/bin:$PATH
+          cd $WORKSPACE/chromium/src
+
+          echo "::group::-------- gn gen"
+          gn gen --args="target_os = \"android\" target_cpu = \"arm64\" $(cat /home/lg/working_dir/cromite/build/cromite.gn_args) system_webview_package_name=\"com.android.webview\" enable_trybot_verification=false " out/arm64_webview  || true
+          echo "::endgroup::"
+
+          echo "::group::-------- gn args"
+          gn args out/arm64_webview/ --list --short || true
+          gn args out/arm64_webview/ --list >out/arm64_webview/gn_list || true
+          echo "::endgroup::"
+
+          vpython3 /home/lg/working_dir/depot_tools/siso.py ninja -C out/arm64_webview system_webview_apk system_webview_shell --offline
+          cp ../../cromite/build/RELEASE out/arm64_webview
+
      - name: Generate clangd index for Android arm64
        if: ${{ github.event.inputs.clangd == 'true' }}
        shell: bash
@@ -1,9 +1,6 @@
 name: 'Check NIST database'

 on:
-  schedule:
-    - cron: '30 1 * * *'
-
  workflow_dispatch:

 permissions:
@@ -37,6 +37,7 @@ jobs:
      OUTPUTFILE_X64: /storage/images/${{ github.event.inputs.sha }}/android/false/x64/
      OUTPUTFILE_WIN: /storage/images/${{ github.event.inputs.sha }}/win/x64/
      OUTPUTFILE_LIN: /storage/images/${{ github.event.inputs.sha }}/linux/false/lin64/
+      OUTPUTFILE_WV_ARM64: /storage/images/${{ github.event.inputs.sha }}/android/false/arm64_webview/

    steps:
      - name: Login to Docker Hub
@@ -130,7 +131,7 @@ jobs:
          cp $OUTPUTFILE_WIN/chrome_proxy.exe chrome-win/
          cp $OUTPUTFILE_WIN/chrome_pwa_launcher.exe chrome-win/
          cp $OUTPUTFILE_WIN/chrome_wer.dll chrome-win/
-          cp "/win_sdk/10.0.22621.0/Windows Kits/10/Redist/D3D/x64/d3dcompiler_47.dll" chrome-win/
+          cp "/win_sdk/sdks/Win11SDK_10.0.26100.0/Windows Kits/10/Redist/D3D/x64/d3dcompiler_47.dll" chrome-win/
          cp $OUTPUTFILE_WIN/elevation_service.exe chrome-win/
          cp "$OUTPUTFILE_WIN/First Run" chrome-win/
          cp $OUTPUTFILE_WIN/headless_lib_data.pak chrome-win/
@@ -184,6 +185,7 @@ jobs:
          $GH release upload $VERSION-$CROMITE_SHA chrome-lin64.tar.gz
          echo "::endgroup::"

+          # android arm64 symbols
          echo "::group::-------- arm64 symbols"
          zip arm64_symbols.zip ${{ env.OUTPUTFILE_ARM64 }}/dump_syms \
                                ${{ env.OUTPUTFILE_ARM64 }}/minidump_stackwalk \
@@ -191,6 +193,19 @@ jobs:
          $GH release upload $VERSION-$CROMITE_SHA arm64_symbols.zip
          echo "::endgroup::"

+          # android arm64
+          echo "::group::-------- android systemwebview arm64"
+          sudo cp ${{ env.OUTPUTFILE_WV_ARM64 }}/apks/SystemWebView.apk arm64_SystemWebView.apk
+          sudo chown runner arm64_SystemWebView.apk
+
+          sudo cp ${{ env.OUTPUTFILE_WV_ARM64 }}/apks/SystemWebViewShell.apk arm64_SystemWebViewShell.apk
+          sudo chown runner arm64_SystemWebViewShell.apk
+
+          echo Uploading arm64_SystemWebView
+          $GH release upload $VERSION-$CROMITE_SHA arm64_SystemWebView.apk
+          $GH release upload $VERSION-$CROMITE_SHA arm64_SystemWebViewShell.apk
+          echo "::endgroup::"
+
          TIMESTAMP=$(date +%s -r chrome-win.zip)
          echo >updateurl.txt "browser=chromium;os=windows;architecture=64-bit;timestamp=$TIMESTAMP;editor=uazo;channel=stable;repository=https://github.com/uazo/cromite/releases;download=https://github.com/uazo/cromite/releases/latest/download/chrome-win.zip;version=$(cat $OUTPUTFILE_WIN/RELEASE);revision=1;commit=$CROMITE_SHA"
          $GH release upload $VERSION-$CROMITE_SHA updateurl.txt
@@ -201,7 +216,4 @@ jobs:
            $GH release edit $VERSION-$CROMITE_SHA --draft=false
          fi

-          VERSION=$(cat ${{ env.OUTPUTFILE_ARM64 }}/RELEASE)
-          docker push uazo/cromite:$VERSION-$CROMITE_SHA
-          docker push uazo/cromite-build:$VERSION-$CROMITE_SHA

@@ -24,7 +24,6 @@ jobs:
    runs-on: ${{ github.event.inputs.type }}
    env:
      IS_DRAFT: ${{ github.event.inputs.draft }}
-      OUTPUTFILE_ARM64: /storage/images/${{ github.event.inputs.sha }}/android/false/arm64_webview/
      OUTPUTFILE_X64: /storage/images/${{ github.event.inputs.sha }}/android/false/x64_webview/
      OUTPUTFILE_CHR_ARM64: /storage/images/${{ github.event.inputs.sha }}/android/false/chr_arm64/
      OUTPUTFILE_CHR_ARM: /storage/images/${{ github.event.inputs.sha }}/android/false/chr_arm/
@@ -48,7 +47,7 @@ jobs:
      - name: Create release
        shell: bash
        run: |          
-          VERSION=v$(cat ${{ env.OUTPUTFILE_ARM64 }}/RELEASE)
+          VERSION=v$(cat ${{ env.OUTPUTFILE_X64 }}/RELEASE)

          cd cromite/tools

@@ -58,19 +57,6 @@ jobs:

          echo ${{ secrets.GITHUB_TOKEN }} | $GH auth login --with-token

-          # android arm64
-          echo "::group::-------- android systemwebview arm64"
-          sudo cp ${{ env.OUTPUTFILE_ARM64 }}/apks/SystemWebView.apk arm64_SystemWebView.apk
-          sudo chown runner arm64_SystemWebView.apk
-
-          sudo cp ${{ env.OUTPUTFILE_ARM64 }}/apks/SystemWebViewShell.apk arm64_SystemWebViewShell.apk
-          sudo chown runner arm64_SystemWebViewShell.apk
-
-          echo Uploading arm64_SystemWebView
-          $GH release upload $VERSION-$CROMITE_SHA arm64_SystemWebView.apk
-          $GH release upload $VERSION-$CROMITE_SHA arm64_SystemWebViewShell.apk
-          echo "::endgroup::"
-
          # android x64
          echo "::group::-------- android systemwebview x64"
          sudo cp ${{ env.OUTPUTFILE_X64 }}/apks/SystemWebView.apk x64_SystemWebView.apk
@@ -37,9 +37,9 @@ jobs:
            apt update

            DEBIAN_FRONTEND=noninteractive apt update && apt install -y wget unzip
-            wget https://github.com/rclone/rclone/releases/download/v1.64.0/rclone-v1.64.0-linux-amd64.zip
-            unzip rclone-v1.64.0-linux-amd64.zip
-            export rclone=rclone-v1.64.0-linux-amd64/rclone
+            wget https://github.com/rclone/rclone/releases/download/v1.72.0/rclone-v1.72.0-linux-amd64.zip
+            unzip rclone-v1.72.0-linux-amd64.zip
+            export rclone=rclone-v1.72.0-linux-amd64/rclone

            mkdir -p  ~/.config/rclone
            echo "${{ secrets.RCLONE_CONF }}" > ~/.config/rclone/rclone.conf
@@ -14,7 +14,7 @@

 Cromite is a [Chromium](https://www.chromium.org/Home) fork based on [Bromite](https://github.com/bromite/bromite) with built-in support for ad blocking and an eye for privacy.

-Cromite is available for Android arm64-v8a, arm32-v7a and x86_64, Oreo and above (Minimum v8.0, API level 26), Windows and Linux 64bit.
+Cromite is available for Android arm64-v8a, arm32-v7a and x86_64, Android 10 and above, Windows and Linux 64bit.

 # Goals

@@ -106,7 +106,7 @@ ChromiumUpdateUrl=https://github.com/uazo/cromite/releases/latest/download/updat
 # Command line for Chromium (string):
 # note --user-data-dir= works better if path is absolute
 # See here: http://peter.sh/experiments/chromium-command-line-switches/
-ChromiumCommandLine=--user-data-dir="C:\Users\<my user>\AppData\Local\Cromite\User Data" --no-default-browser-check
+ChromiumCommandLine=--user-data-dir="%LOCALAPPDATA%\Cromite\User Data" --no-default-browser-check

 # to enable full logging in c:\temp\log.txt (daily rotate, no automatic deletion)
 # ChromiumCommandLine=--enable-logging --v=0 --log-file=C:\temp\log.txt --user-data-dir=".\User Data" --no-default-browser-check
@@ -133,6 +133,7 @@ you can activate (highly recommended) the 'RendererAppContainer' flag from the c
 ```
  --enable-features=RendererAppContainer
 ```
+In this case, it is also necessary to run icacls as indicated above.

 ### Auto-update setup for linux
 working in progress in https://github.com/uazo/cromite/issues/771
@@ -188,10 +189,11 @@ thanks to [austinhuang0131](https://github.com/austinhuang0131) for the svg icon
 If you want, you can donate to support cromite development through [paypal](https://www.paypal.com/pools/c/9e5lO2OIzb).

 Current link:
- https://www.paypal.com/pools/c/9e5lO2OIzb
+- https://www.paypal.com/pools/c/9hEHZ6tElk

 Historical fundraisings links:
 - https://www.paypal.com/pools/c/9cwNgAQhRL
+- https://www.paypal.com/pools/c/9e5lO2OIzb

 # License

@@ -1 +1 @@
-138.0.7204.184
+144.0.7559.97
@@ -4,12 +4,10 @@ build_contextual_search=false
 build_with_tflite_lib=false
 chrome_pgo_phase=0
 dcheck_always_on=false
-disable_android_lint=true
 disable_fieldtrial_testing_config=true
 enable_hangout_services_extension=false
 enable_iterator_debugging=false
 enable_mdns=false
-enable_nacl=false
 enable_remoting=false
 enable_reporting=false
 enable_vr=false
@@ -25,7 +23,6 @@ use_debug_fission=true
 use_errorprone_java_compiler=false
 use_official_google_api_keys=false
 use_rtti=false
-use_sysroot=false
 webview_includes_weblayer=false
 enable_arcore=false
 enable_openxr=false
@@ -66,30 +63,15 @@ if (target_os == "android" || target_os == "win") {

 # disable passthrough audio codecs
 enable_platform_dts_audio = false
-enable_passthrough_audio_codecs = false
-
-# Do not compile libmonochrome.so with RELR relocations
-# since supported only on API 28+
-use_relr_relocations=false

 # disabled the use of the context snapshot
 # see https://github.com/uazo/cromite/pull/317 for context
 use_v8_context_snapshot = false

-# enable libjxl support by default
-enable_jxl_decoder = false
-
-# disable minikin engine
-# see https://github.com/uazo/cromite/issues/697
-use_minikin_hyphenation = false
-
 # disable automatic update of sync-related cookies
 # initial commit: https://source.chromium.org/chromium/chromium/src/+/fd9a841f7a63b9f5510f6b713d9c833d259c63ad
 enable_bound_session_credentials = false

-# Use LogErrorNotReached() for NOTREACHED_IN_MIGRATION() 
-enable_log_error_not_reached = true
-
 # Allows building without //third_party/unrar included, for license reasons
 safe_browsing_use_unrar = false

@@ -100,6 +82,12 @@ enable_request_header_integrity = false
 # Disable precompiled headers because they are incompatible with the unsafe_buffers configuration
 enable_precompiled_headers = false

+# Disable integration with Gemini
+enable_glic = false
+
+# Disable TFLite with XNNPACK
+build_tflite_with_xnnpack = false
+
 declare_args() {
  _is_debug_build = ""
  build_webview = false
@@ -128,6 +116,8 @@ if (target_os == "android") {

  cromite_pref_hash_seed_bin = getenv("CROMITE_PREF_HASH_SEED_BIN")

+  disable_android_lint = true
+
  _is_debug_build = getenv("TARGET_ISDEBUG")
  if (_is_debug_build == "true") {
    # print("Debug build on")
@@ -144,7 +134,10 @@ if (target_os == "android") {
    # Turns off all V8 debug features. Disables running V8 in a pseudo debug mode
    # bypass build error -5 in clang_x64/mksnapshot
    v8_enable_debugging_features = false
+    v8_dcheck_always_on = false
  } else {
+    include_both_v8_snapshots = false
+    include_both_v8_snapshots_android_secondary_abi = false
    generate_linker_map = true
  }

@@ -163,7 +156,6 @@ if (target_os == "win") {
  enable_pdf = true
  pdf_is_complete_lib = true
  enable_plugins = true
-  enable_ppapi = false

  chrome_pgo_phase = 2 # enable pgo

@@ -179,7 +171,6 @@ if (target_os == "linux") {
  enable_pdf = true
  pdf_is_complete_lib = true
  enable_plugins = true
-  enable_ppapi = false

  use_sysroot = true
  chrome_pgo_phase = 2 # enable pgo
@@ -1,16 +1,14 @@
 Do-not-link-with-libatomic.patch
-Do-not-check-for-the-presence-of-use-remoteexec.patch
 bromite-build-utils.patch
 Add-cromite-flags-support.patch
 Force-use-vpython3-for-some-scripts.patch
 Permit-PGO-for-debug-builds.patch
 Fix-chromium-vanilla.patch
 Final-patch-for-chromium-vanilla.patch
-
+Restore-chrome-password-store.patch
 Remove-EV-certificates.patch
 do-not-hide-.orig-files.patch
 do-not-add-suffix-to-package-name.patch
-exit-on-failure-of-inclusion.patch
 Move-some-account-settings-back-to-privacy-settings.patch
 kill-Vision.patch
 kill-Location-fall-back-to-system.patch
@@ -93,15 +91,12 @@ Disable-feeds-support-by-default.patch
 Disable-DRM-media-origin-IDs-preprovisioning.patch
 Disable-smart-selection-by-default.patch
 Guard-for-user-agent-reduction.patch
-AImageReader-CFI-crash-mitigations.patch
 Add-menu-item-to-view-source.patch
 Revert-removal-of-execution-context-address-space.patch
 Block-gateway-attacks-via-websockets.patch
-Enable-prefetch-privacy-changes-by-default.patch
 Enable-darken-websites-checkbox-in-themes.patch
 Remove-blocklisted-URLs-upon-bookmark-creation.patch
 Disable-the-DIAL-repeating-discovery.patch
-Block-qjz9zk-or-trk-requests.patch
 Hardening-against-incognito-mode-detection.patch
 Restore-Simplified-NTP-launch.patch
 Add-option-to-use-home-page-as-NTP.patch
@@ -158,7 +153,6 @@ Enable-Certificate-Transparency.patch
 Invalidate-components-public-key.patch
 Improve-plain-text-rendering-on-mobile.patch
 Remove-segmentation-platform.patch
-Follow-only-system-dark-mode.patch
 Remove-window-name-on-cross-origin-navigation.patch
 Remove-preload-of-com.google.android.gms.fonts.patch
 Partition-Blink-memory-cache.patch
@@ -245,8 +239,6 @@ Partition-MediaDeviceId-by-default.patch
 Keep-disabled-FetchLaterAPI.patch
 Disable-ranker-url-fetcher.patch
 Disable-prefers-reduced-transparency-media-query.patch
-libjxl-0-8-2.patch
-Add-support-to-jxl.patch
 Block-Intents-While-Locked.patch
 Keep-Manta-Service-Disabled.patch
 Disable-Service-and-Shared-workers-on-3P-iframe.patch
@@ -277,7 +269,6 @@ Enable-Global-Privacy-Control.patch
 Enable-Do-Not-Track-by-default.patch
 Media-fingerprinting-mitigations.patch
 Use-BoringSSL-for-RandBytes.patch
-Restore-chrome-password-store.patch
 Disable-support-for-pointer-device-id.patch
 Disable-CSS-blink-feature-support.patch
 Close-Sessions-On-Ip-Change.patch
@@ -292,31 +283,43 @@ Disable-Posture-API.patch
 PublicKeyCredential-fingerprinting-mitigations.patch
 Disable-Web-Bluetooth-by-default-in-desktop-platforms.patch
 Enable-Cert-Management-UI.patch
-Enable-ProcessBoundStringEncryption-by-default.patch
 Prevent-mouse-wheel-fingerprinting-on-Windows.patch
 Enable-component-updater.patch
 Android-fonts-fingerprinting-mitigation.patch
 Disable-Android-Tab-Declutter.patch
 Disable-CSSDynamicRangeLimit.patch
-Android-Import-Passwords.patch
 Disable-prefers-reduced-motion.patch
 Disable-css-preferred-text-scale.patch
 Disable-Viewport-Segments.patch
 Keep-disabled-cache-sharing-for-pervasive-scripts.patch
 High-Resolution-Timing-Mitigation.patch
+Enable-snackbar-swipe.patch
+Add-cromite-test-support.patch
+Android-Pixel-Perfect-Mode.patch
+Set-caret-blink-interval-to-default.patch
+Set-the-screen-frame-rate-to-60-Hz.patch
+Disable-Device-Attributes-API.patch
+Add-setting-to-enable-Credman-for-passkeys.patch
 Temp-disable-UseContextSnapshot.patch
+Enable-ClientHello-Segmentation.patch
+Disable-Sticky-User-Activation-Across-Same-Origin-Navigation.patch
+Supporting-Dangling-Ptr-Detection-via-BackupRefPtr.patch
+Disable-device-bound-session.patch
+Keep-disabled-CpuPerformance.patch
+Immediately-destroy-shared-workers-when-closing-the-page.patch
+Disable-minikin-hyphenation.patch

 # temporary or wip patches
-Temp-PerformanceNavigationTiming-privacy-fix.patch
 Temp-disable-predictive-back-gesture.patch
 TEMP-Add-a-log-to-track-strange-behavior.patch
 Temp-guard-FileSystemAccessPersistentPermissions.patch
 Never-treat-Proguard-warnings-as-errors.patch
 Temp-disable-experimental-web-platform-features.patch
 Block-leakage-of-urls-in-sandbox-iframes.patch
-Temporarily-disable-Tab-Group-Sync-Android.patch
 Fix-chromium-build-bugs.patch
 Try-to-fix-2082.patch
+Temp-use-PREVIEW-for-IDCompositionDevice5.patch
+Temp-Backport-Fix-CtrlW-to-close-current-tab.patch

 # adblock patches
 eyeo-133.0.6943.49-base.patch
@@ -325,3 +328,7 @@ eyeo-133.0.6943.49-android_api.patch
 eyeo-133.0.6943.49-android_settings.patch
 eyeo-133.0.6943.49-extension_api.patch
 Eyeo-Adblock-for-Cromite.patch
+
+# extension patches
+Experimental-support-for-extensions-on-Android.patch
+Enable-extension-in-incognito.patch
@@ -1,249 +0,0 @@
-From: csagan5 <32685696+csagan5@users.noreply.github.com>
-Date: Tue, 5 May 2020 07:22:20 +0200
-Subject: AImageReader CFI crash mitigations
-
-Revert "gpu/android: Remove setup for disabling AImageReader."
-This reverts commit dcd5a39518246eb999f1cc63bf1ec95d93fd5b2f.
-
-Revert "Remove flags to enable/disable AImageReader."
-This reverts commit 463fa0f2e3b9e418bc26e2c8954463f0b0f76634.
-
-Restore GPU bug blacklist for AImageReader on ARM and Qualcomm CPUs
-
-Restore the AImageReader blacklist for ARM/Qualcomm chipsets which causes
-crashes on Android 9 and 10 (at different code locations).
-
-See discussions at:
-* https://github.com/bromite/bromite/issues/445
-* https://github.com/bromite/bromite/issues/814
-* https://github.com/bromite/bromite/issues/1005
-
-License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
---
- base/android/android_image_reader_compat.cc      | 16 ++++++++++++++++
- base/android/android_image_reader_compat.h       | 14 ++++++++++++++
- chrome/browser/flag-metadata.json                |  4 ++++
- .../AImageReader-CFI-crash-mitigations.inc       |  4 ++++
- .../AImageReader-CFI-crash-mitigations.inc       |  1 +
- gpu/config/gpu_driver_bug_list.json              | 16 ++++++++++++++++
- gpu/config/gpu_finch_features.cc                 |  5 +++++
- gpu/config/gpu_finch_features.h                  |  1 +
- gpu/config/gpu_util.cc                           |  8 ++++++++
- gpu/config/gpu_workaround_list.txt               |  1 +
- gpu/ipc/service/gpu_init.cc                      |  8 ++++++++
- media/gpu/android/video_frame_factory_impl.cc    |  4 +++-
- 12 files changed, 81 insertions(+), 1 deletion(-)
- create mode 100644 cromite_flags/media/base/media_switches_cc/AImageReader-CFI-crash-mitigations.inc
- create mode 100644 cromite_flags/media/base/media_switches_h/AImageReader-CFI-crash-mitigations.inc
-
-diff --git a/base/android/android_image_reader_compat.cc b/base/android/android_image_reader_compat.cc
--- a/base/android/android_image_reader_compat.cc
-+++ b/base/android/android_image_reader_compat.cc
-@@ -7,7 +7,23 @@
- namespace base {
- namespace android {
- 
-+AndroidImageReader& AndroidImageReader::GetInstance() {
-+  // C++11 static local variable initialization is
-+  // thread-safe.
-+  static AndroidImageReader instance;
-+  return instance;
-+}
-+
-+void AndroidImageReader::DisableSupport() {
-+  disable_support_ = true;
-+}
-+
-+bool AndroidImageReader::IsSupported() {
-+  return !disable_support_;
-+}
-+
- bool EnableAndroidImageReader() {
-+  if (!AndroidImageReader::GetInstance().IsSupported()) return false;
-   // Currently we want to enable AImageReader only for android P+ devices.
-   if (__builtin_available(android 28, *)) {
-     return true;
-diff --git a/base/android/android_image_reader_compat.h b/base/android/android_image_reader_compat.h
--- a/base/android/android_image_reader_compat.h
-+++ b/base/android/android_image_reader_compat.h
-@@ -10,6 +10,20 @@
- namespace base {
- namespace android {
- 
-+class BASE_EXPORT AndroidImageReader {
-+ public:
-+  // Thread safe GetInstance.
-+  static AndroidImageReader& GetInstance();
-+
-+  bool IsSupported();
-+
-+  // Disable image reader support.
-+  void DisableSupport();
-+
-+ private:
-+  bool disable_support_ = false;
-+};
-+
- // Check if the image reader usage is supported.
- BASE_EXPORT bool EnableAndroidImageReader();
- 
-diff --git a/chrome/browser/flag-metadata.json b/chrome/browser/flag-metadata.json
--- a/chrome/browser/flag-metadata.json
-+++ b/chrome/browser/flag-metadata.json
-@@ -3514,6 +3514,10 @@
-       "chrome-signin-team@google.com"
-     ],
-     "expiry_milestone": 138
-+  },{
-+    "name": "enable-image-reader",          // Bromite: do not expire
-+    "owners": [ "vikassoni@chromium.org", "liberato@chromium.org" ],  // flag
-+    "expiry_milestone": -1
-   },
-   {
-     "name": "enable-immersive-fullscreen-toolbar",
-diff --git a/cromite_flags/media/base/media_switches_cc/AImageReader-CFI-crash-mitigations.inc b/cromite_flags/media/base/media_switches_cc/AImageReader-CFI-crash-mitigations.inc
-new file mode 100644
--- /dev/null
-+++ b/cromite_flags/media/base/media_switches_cc/AImageReader-CFI-crash-mitigations.inc
-@@ -0,0 +1,4 @@
-+// Enables the Android Image Reader path for Video decoding(for AVDA and MCVD)
-+CROMITE_FEATURE(kAImageReaderVideoOutput,
-+                "AImageReaderVideoOutput",
-+                base::FEATURE_ENABLED_BY_DEFAULT);
-diff --git a/cromite_flags/media/base/media_switches_h/AImageReader-CFI-crash-mitigations.inc b/cromite_flags/media/base/media_switches_h/AImageReader-CFI-crash-mitigations.inc
-new file mode 100644
--- /dev/null
-+++ b/cromite_flags/media/base/media_switches_h/AImageReader-CFI-crash-mitigations.inc
-@@ -0,0 +1 @@
-+MEDIA_EXPORT BASE_DECLARE_FEATURE(kAImageReaderVideoOutput);
-diff --git a/gpu/config/gpu_driver_bug_list.json b/gpu/config/gpu_driver_bug_list.json
--- a/gpu/config/gpu_driver_bug_list.json
-+++ b/gpu/config/gpu_driver_bug_list.json
-@@ -2613,6 +2613,22 @@
-         "no_downscaled_overlay_promotion"
-       ]
-     },
-+    {
-+      "id":335,
-+      "cr_bugs": [1051705],
-+      "description": "Disable AImageReader on ARM GPUs",
-+      "os": {
-+        "type": "android",
-+        "version": {
-+          "op": "<",
-+          "value": "10"
-+        }
-+      },
-+      "gl_vendor": "ARM.*|Qualcomm.*",
-+      "features": [
-+        "disable_aimagereader"
-+      ]
-+    },
-     {
-       "id": 381,
-       "cr_bugs": [
-diff --git a/gpu/config/gpu_finch_features.cc b/gpu/config/gpu_finch_features.cc
--- a/gpu/config/gpu_finch_features.cc
-+++ b/gpu/config/gpu_finch_features.cc
-@@ -58,6 +58,11 @@ BASE_FEATURE(kAggressiveShaderCacheLimits,
-              base::FEATURE_DISABLED_BY_DEFAULT);
- 
- #if BUILDFLAG(IS_ANDROID)
-+// Use android AImageReader when playing videos with MediaPlayer.
-+CROMITE_FEATURE(kAImageReaderMediaPlayer,
-+                "AImageReaderMediaPlayer",
-+                base::FEATURE_ENABLED_BY_DEFAULT);
-+
- // Use android SurfaceControl API for managing display compositor's buffer queue
- // and using overlays on Android. Also used by webview to disable surface
- // SurfaceControl.
-diff --git a/gpu/config/gpu_finch_features.h b/gpu/config/gpu_finch_features.h
--- a/gpu/config/gpu_finch_features.h
-+++ b/gpu/config/gpu_finch_features.h
-@@ -26,6 +26,7 @@ GPU_EXPORT BASE_DECLARE_FEATURE(kUseGles2ForOopR);
- GPU_EXPORT BASE_DECLARE_FEATURE(kAggressiveShaderCacheLimits);
- 
- #if BUILDFLAG(IS_ANDROID)
-+GPU_EXPORT BASE_DECLARE_FEATURE(kAImageReaderMediaPlayer);
- GPU_EXPORT BASE_DECLARE_FEATURE(kAndroidSurfaceControl);
- GPU_EXPORT BASE_DECLARE_FEATURE(kWebViewSurfaceControl);
- GPU_EXPORT BASE_DECLARE_FEATURE(kWebViewSurfaceControlForTV);
-diff --git a/gpu/config/gpu_util.cc b/gpu/config/gpu_util.cc
--- a/gpu/config/gpu_util.cc
-+++ b/gpu/config/gpu_util.cc
-@@ -127,6 +127,9 @@ GpuFeatureStatus GetAndroidSurfaceControlFeatureStatus(
- #if !BUILDFLAG(IS_ANDROID)
-   return kGpuFeatureStatusDisabled;
- #else
-+  if (blocklisted_features.count(GPU_FEATURE_TYPE_ANDROID_SURFACE_CONTROL))
-+    return kGpuFeatureStatusBlocklisted;
-+
-   if (!gpu_preferences.enable_android_surface_control)
-     return kGpuFeatureStatusDisabled;
- 
-@@ -348,6 +351,11 @@ void AdjustGpuFeatureStatusToWorkarounds(GpuFeatureInfo* gpu_feature_info,
-           kGpuFeatureStatusSoftware;
-     }
-   }
-+
-+  if (gpu_feature_info->IsWorkaroundEnabled(DISABLE_AIMAGEREADER)) {
-+    gpu_feature_info->status_values[GPU_FEATURE_TYPE_ANDROID_SURFACE_CONTROL] =
-+        kGpuFeatureStatusBlocklisted;
-+  }
- }
- 
- // Estimates roughly user total disk space by counting in the drives where
-diff --git a/gpu/config/gpu_workaround_list.txt b/gpu/config/gpu_workaround_list.txt
--- a/gpu/config/gpu_workaround_list.txt
-+++ b/gpu/config/gpu_workaround_list.txt
-@@ -6,6 +6,7 @@ check_egl_fence_before_wait
- check_ycbcr_studio_g22_left_p709_for_nv12_support
- disable_2d_canvas_auto_flush
- disable_accelerated_av1_decode
-+disable_aimagereader
- disable_accelerated_av1_encode
- disable_accelerated_h264_decode
- disable_accelerated_h264_encode
-diff --git a/gpu/ipc/service/gpu_init.cc b/gpu/ipc/service/gpu_init.cc
--- a/gpu/ipc/service/gpu_init.cc
-+++ b/gpu/ipc/service/gpu_init.cc
-@@ -70,6 +70,7 @@
- 
- #if BUILDFLAG(IS_ANDROID)
- #include "ui/gfx/android/android_surface_control_compat.h"
-+#include "base/android/android_image_reader_compat.h"
- #endif
- 
- #if BUILDFLAG(ENABLE_VULKAN)
-@@ -687,6 +688,13 @@ bool GpuInit::InitializeAndStartSandbox(base::CommandLine* command_line,
-   }
- #endif  // BUILDFLAG(IS_WIN)
- 
-+#if BUILDFLAG(IS_ANDROID)
-+  // Disable AImageReader if the workaround is enabled.
-+  if (gpu_feature_info_.IsWorkaroundEnabled(DISABLE_AIMAGEREADER)) {
-+    base::android::AndroidImageReader::GetInstance().DisableSupport();
-+  }
-+#endif
-+
-   if (gpu_feature_info_.status_values[GPU_FEATURE_TYPE_VULKAN] !=
-           kGpuFeatureStatusEnabled ||
-       !InitializeVulkan()) {
-diff --git a/media/gpu/android/video_frame_factory_impl.cc b/media/gpu/android/video_frame_factory_impl.cc
--- a/media/gpu/android/video_frame_factory_impl.cc
-+++ b/media/gpu/android/video_frame_factory_impl.cc
-@@ -35,10 +35,12 @@ namespace {
- 
- gpu::TextureOwner::Mode GetTextureOwnerMode(
-     VideoFrameFactory::OverlayMode overlay_mode) {
-+  const bool enabled = base::android::EnableAndroidImageReader() &&
-+             base::FeatureList::IsEnabled(features::kAImageReaderMediaPlayer);
-   switch (overlay_mode) {
-     case VideoFrameFactory::OverlayMode::kDontRequestPromotionHints:
-     case VideoFrameFactory::OverlayMode::kRequestPromotionHints:
-      return base::android::EnableAndroidImageReader()
-+      return enabled
-                  ? gpu::TextureOwner::Mode::kAImageReaderInsecure
-                  : gpu::TextureOwner::Mode::kSurfaceTextureInsecure;
-     case VideoFrameFactory::OverlayMode::kSurfaceControlSecure:
--
@@ -20,7 +20,7 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/app/ChromeActivity.java b/chrome/android/java/src/org/chromium/chrome/browser/app/ChromeActivity.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/app/ChromeActivity.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/app/ChromeActivity.java
-@@ -233,6 +233,7 @@ import org.chromium.content_public.browser.LoadUrlParams;
+@@ -255,6 +255,7 @@ import org.chromium.content_public.browser.LoadUrlParams;
 import org.chromium.content_public.browser.SelectionPopupController;
 import org.chromium.content_public.browser.WebContents;
 import org.chromium.content_public.common.ContentSwitches;
@@ -28,7 +28,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/app/ChromeActiv
 import org.chromium.printing.PrintManagerDelegateImpl;
 import org.chromium.printing.PrintingController;
 import org.chromium.printing.PrintingControllerImpl;
-@@ -981,6 +982,8 @@ public abstract class ChromeActivity extends AsyncInitializationActivity
+@@ -1096,6 +1097,8 @@ public abstract class ChromeActivity extends AsyncInitializationActivity
         super.onStartWithNative();
 
         ChromeActivitySessionTracker.getInstance().onStartWithNative(getProfileProviderSupplier());
@@ -40,42 +40,42 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/app/ChromeActiv
 diff --git a/chrome/browser/flags/android/chrome_feature_list.cc b/chrome/browser/flags/android/chrome_feature_list.cc
 --- a/chrome/browser/flags/android/chrome_feature_list.cc
 +++ b/chrome/browser/flags/android/chrome_feature_list.cc
-@@ -169,6 +169,7 @@ const base::Feature* const kFeaturesExposedToJava[] = {
+@@ -196,6 +196,7 @@ const base::Feature* const kFeaturesExposedToJava[] = {
     &feed::kFeedPerformanceStudy,
-     &feed::kFeedShowSignInCommand,
-     &feed::kFeedSignedOutViewDemotion,
-+    &kAllowUserCertificates,
     &feed::kFeedRecyclerBinderUnmountOnDetach,
+     &feed::kFeedShowSignInCommand,
+    &kAllowUserCertificates,
+     &feed::kFeedSignedOutViewDemotion,
     &feed::kInterestFeedV2,
     &feed::kWebFeedAwareness,
 diff --git a/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureList.java b/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureList.java
 --- a/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureList.java
 +++ b/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureList.java
-@@ -162,6 +162,7 @@ public abstract class ChromeFeatureList {
+@@ -166,6 +166,7 @@ public abstract class ChromeFeatureList {
             "AccountForSuppressedKeyboardInsets";
     public static final String ADAPTIVE_BUTTON_IN_TOP_TOOLBAR_CUSTOMIZATION_V2 =
             "AdaptiveButtonInTopToolbarCustomizationV2";
 +    public static final String ALLOW_USER_CERTIFICATES = "AllowUserCertificates";
     public static final String ADAPTIVE_BUTTON_IN_TOP_TOOLBAR_PAGE_SUMMARY =
             "AdaptiveButtonInTopToolbarPageSummary";
-     public static final String ALLOW_TAB_CLOSING_UPON_MINIMIZATION =
-@@ -680,6 +681,8 @@ public abstract class ChromeFeatureList {
-     public static final CachedFlag sAndroidWindowPopupLargeScreen =
-             newCachedFlag(ANDROID_WINDOW_POPUP_LARGE_SCREEN, false);
+     public static final String ANDROID_ANIMATED_PROGRESS_BAR_IN_BROWSER =
+@@ -820,6 +821,8 @@ public abstract class ChromeFeatureList {
+     public static final CachedFlag sAndroidWindowPopupResizeAfterSpawn =
+             newCachedFlag(ANDROID_WINDOW_POPUP_RESIZE_AFTER_SPAWN, false, true);
     public static final CachedFlag sAppSpecificHistory = newCachedFlag(APP_SPECIFIC_HISTORY, true);
 +    public static final CachedFlag sAllowUserCertificates =
 +            newCachedFlag(ALLOW_USER_CERTIFICATES, false);
+     public static final CachedFlag sAppSpecificHistoryViewIntent =
+             newCachedFlag(APP_SPECIFIC_HISTORY_VIEW_INTENT, true);
     public static final CachedFlag sAsyncNotificationManager =
-             newCachedFlag(ASYNC_NOTIFICATION_MANAGER, false, true);
-     public static final CachedFlag sAsyncNotificationManagerForDownload =
-@@ -941,6 +944,7 @@ public abstract class ChromeFeatureList {
+@@ -1136,6 +1139,7 @@ public abstract class ChromeFeatureList {
                     sAccountForSuppressedKeyboardInsets,
-                     sAllowTabClosingUponMinimization,
-                     sAndroidAppIntegration,
+                     sAndroidAnimatedProgressBarInBrowser,
+                     sAndroidAnimatedProgressBarInViz,
 +                    sAllowUserCertificates,
                     sAndroidAppIntegrationModule,
                     sAndroidAppIntegrationMultiDataSource,
-                     sAndroidAppIntegrationV2,
+                     sAndroidAutoMintedTwa,
 diff --git a/cromite_flags/chrome/browser/about_flags_cc/Add-AllowUserCertificates-flag.inc b/cromite_flags/chrome/browser/about_flags_cc/Add-AllowUserCertificates-flag.inc
 new file mode 100644
 --- /dev/null
@@ -120,7 +120,7 @@ diff --git a/net/android/java/src/org/chromium/net/X509Util.java b/net/android/j
     public static AndroidCertVerifyResult verifyServerCertificates(
             byte[][] certChain,
             String authType,
-@@ -637,6 +639,9 @@ public class X509Util {
+@@ -639,6 +641,9 @@ public class X509Util {
                 X509Certificate root = verifiedChain.get(verifiedChain.size() - 1);
                 isIssuedByKnownRoot = isKnownRoot(root);
             }
@@ -4,21 +4,22 @@ Subject: Add Alt+D hotkey to focus address bar

 License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 ---
- .../src/org/chromium/chrome/browser/KeyboardShortcuts.java   | 5 +++++
- 1 file changed, 5 insertions(+)
+ .../src/org/chromium/chrome/browser/KeyboardShortcuts.java  | 6 ++++++
+ 1 file changed, 6 insertions(+)

 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/KeyboardShortcuts.java b/chrome/android/java/src/org/chromium/chrome/browser/KeyboardShortcuts.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/KeyboardShortcuts.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/KeyboardShortcuts.java
-@@ -839,6 +839,11 @@ public class KeyboardShortcuts {
-                     KeyEvent.KEYCODE_B,
-                     (KeyEvent.META_CTRL_ON | KeyEvent.META_SHIFT_ON));
+@@ -904,6 +904,12 @@ public class KeyboardShortcuts {
+                     KeyEvent.KEYCODE_ESCAPE,
+                     KeyEvent.META_CTRL_ON);
         }
 +        addShortcut(context,
-+            shortcutGroupsById.get(R.string.keyboard_shortcut_chrome_feature_group_header),
-+            R.string.keyboard_shortcut_address_bar,
-+            KeyEvent.KEYCODE_D,
-+            KeyEvent.META_ALT_ON);
+                    shortcutGroupsById,
+                    R.string.keyboard_shortcut_chrome_feature_group_header,
+                    R.string.keyboard_shortcut_address_bar,
+                    KeyEvent.KEYCODE_D,
+                    KeyEvent.META_ALT_ON);
         return new ArrayList<>(shortcutGroupsById.values());
     }
 
@@ -44,7 +44,7 @@ new file mode 100644
 diff --git a/net/url_request/url_request_http_job.cc b/net/url_request/url_request_http_job.cc
 --- a/net/url_request/url_request_http_job.cc
 +++ b/net/url_request/url_request_http_job.cc
-@@ -387,6 +387,11 @@ std::unique_ptr<URLRequestJob> URLRequestHttpJob::Create(URLRequest* request) {
+@@ -400,6 +400,11 @@ std::unique_ptr<URLRequestJob> URLRequestHttpJob::Create(URLRequest* request) {
       }
     }
 
@@ -7,24 +7,55 @@ adds a new flag in chrome://flags to re-enable the experiment
 License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 ---
 base/features.cc                                     |  4 ++++
+ content/renderer/render_process_impl.cc              |  9 +++++++++
 .../Add-PartialLowEndModeOnMidRangeDevices-flag.inc  | 12 ++++++++++++
- 2 files changed, 16 insertions(+)
+ 3 files changed, 25 insertions(+)
 create mode 100644 cromite_flags/chrome/browser/about_flags_cc/Add-PartialLowEndModeOnMidRangeDevices-flag.inc

 diff --git a/base/features.cc b/base/features.cc
 --- a/base/features.cc
 +++ b/base/features.cc
-@@ -126,6 +126,10 @@ BASE_FEATURE(kUseSharedRebindServiceConnection,
-              FEATURE_DISABLED_BY_DEFAULT);
- #endif  // BUILDFLAG(IS_ANDROID)
+@@ -200,6 +200,10 @@ bool IsReducePPMsEnabled() {
+   return g_is_reduce_ppms_enabled.load(std::memory_order_relaxed);
+ }
 
 +#if BUILDFLAG(IS_ANDROID)
 +SET_CROMITE_FEATURE_DISABLED(kPartialLowEndModeOnMidRangeDevices);
 +#endif
 +
- void Init(EmitThreadControllerProfilerMetadata
-               emit_thread_controller_profiler_metadata) {
-   sequence_manager::internal::SequenceManagerImpl::InitializeFeatures();
+ void Init() {
+   g_is_reduce_ppms_enabled.store(FeatureList::IsEnabled(kReducePPMs),
+                                  std::memory_order_relaxed);
+diff --git a/content/renderer/render_process_impl.cc b/content/renderer/render_process_impl.cc
+--- a/content/renderer/render_process_impl.cc
+++ b/content/renderer/render_process_impl.cc
+@@ -2,6 +2,7 @@
+ // Use of this source code is governed by a BSD-style license that can be
+ // found in the LICENSE file.
+ 
+#include "base/features.h"
+ #include "content/renderer/render_process_impl.h"
+ 
+ #include "build/build_config.h"
+@@ -122,10 +123,18 @@ RenderProcessImpl::RenderProcessImpl()
+       base::CommandLine::ForCurrentProcess()->HasSwitch(
+           switches::kDisallowV8FeatureFlagOverrides);
+   if (!disallow_v8_feature_flag_overrides) {
+#if BUILDFLAG(IS_ANDROID)
+    if (base::SysInfo::IsLowEndDevice()
+          && base::FeatureList::IsEnabled(base::features::kPartialLowEndModeOnMidRangeDevices)) {
+      std::string_view optimize_flag("--optimize-for-size");
+      v8::V8::SetFlagsFromString(optimize_flag.data(), optimize_flag.size());
+    }
+#else
+     if (base::SysInfo::IsLowEndDevice()) {
+       std::string_view optimize_flag("--optimize-for-size");
+       v8::V8::SetFlagsFromString(optimize_flag.data(), optimize_flag.size());
+     }
+#endif
+ 
+     ////////////////////////////////////////////////////////////////////////////
+     // V8 flags are typically set in gin/v8_initializer.cc. Only those flags
 diff --git a/cromite_flags/chrome/browser/about_flags_cc/Add-PartialLowEndModeOnMidRangeDevices-flag.inc b/cromite_flags/chrome/browser/about_flags_cc/Add-PartialLowEndModeOnMidRangeDevices-flag.inc
 new file mode 100644
 --- /dev/null
@@ -27,13 +27,14 @@ diff --git a/chrome/android/expectations/expectations.gni b/chrome/android/expec
 +enable_libs_and_assets_verification = enable_trybot_verification &&
     !enable_chrome_android_internal && !is_component_build &&
     !use_jacoco_coverage && is_official_build &&
-     (target_cpu == "arm64" && android_channel == "stable")
-@@ -15,6 +19,6 @@ enable_libs_and_assets_verification =
+     ((target_cpu == "arm64" || target_cpu == "x64") &&
+@@ -16,7 +20,7 @@ enable_libs_and_assets_verification =
 # use_jacoco_coverage: Adds proguard flags.
 # android_channel: Manifest entries vary based on channel.
 # target_cpu: android:versionCode varies.
 -enable_manifest_verification =
 +enable_manifest_verification = enable_trybot_verification &&
     !is_java_debug && !enable_chrome_android_internal && !use_jacoco_coverage &&
-     (target_cpu == "arm64" && android_channel == "stable")
+     ((target_cpu == "arm64" || target_cpu == "x64") &&
+      android_channel == "stable")
 --
@@ -17,8 +17,8 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 diff --git a/chrome/browser/flag-metadata.json b/chrome/browser/flag-metadata.json
 --- a/chrome/browser/flag-metadata.json
 +++ b/chrome/browser/flag-metadata.json
-@@ -8364,9 +8364,9 @@
-     "expiry_milestone": 140
+@@ -9195,9 +9195,9 @@
+     "expiry_milestone": 150
   },
   {
 -    "name": "restrict-gamepad-access",
@@ -28,11 +28,11 @@ diff --git a/chrome/browser/flag-metadata.json b/chrome/browser/flag-metadata.js
 +    "expiry_milestone": -1
   },
   {
-     "name": "retain-omnibox-on-focus",
+     "name": "rewriter-api-for-gemini-nano",
 diff --git a/content/child/runtime_features.cc b/content/child/runtime_features.cc
 --- a/content/child/runtime_features.cc
 +++ b/content/child/runtime_features.cc
-@@ -253,6 +253,8 @@ void SetRuntimeFeaturesFromChromiumFeatures() {
+@@ -262,6 +262,8 @@ void SetRuntimeFeaturesFromChromiumFeatures() {
           {wf::EnablePaymentApp, raw_ref(features::kServiceWorkerPaymentApps)},
           {wf::EnablePeriodicBackgroundSync,
            raw_ref(features::kPeriodicBackgroundSync)},
@@ -56,7 +56,7 @@ new file mode 100644
 diff --git a/device/gamepad/public/cpp/gamepad_features.cc b/device/gamepad/public/cpp/gamepad_features.cc
 --- a/device/gamepad/public/cpp/gamepad_features.cc
 +++ b/device/gamepad/public/cpp/gamepad_features.cc
-@@ -36,4 +36,12 @@ bool IsGamepadMultitouchEnabled() {
+@@ -53,4 +53,12 @@ bool IsGamepadMultitouchEnabled() {
   return false;
 }
 
@@ -72,12 +72,17 @@ diff --git a/device/gamepad/public/cpp/gamepad_features.cc b/device/gamepad/publ
 diff --git a/device/gamepad/public/cpp/gamepad_features.h b/device/gamepad/public/cpp/gamepad_features.h
 --- a/device/gamepad/public/cpp/gamepad_features.h
 +++ b/device/gamepad/public/cpp/gamepad_features.h
-@@ -13,8 +13,10 @@ namespace features {
+@@ -17,6 +17,7 @@ GAMEPAD_FEATURES_EXPORT BASE_DECLARE_FEATURE(kEnableGamepadMultitouch);
 GAMEPAD_FEATURES_EXPORT BASE_DECLARE_FEATURE(
-     kEnableWindowsGamingInputDataFetcher);
- GAMEPAD_FEATURES_EXPORT BASE_DECLARE_FEATURE(kEnableGamepadMultitouch);
+     kEnableSimulatedGamepadDataFetcher);
+ GAMEPAD_FEATURES_EXPORT BASE_DECLARE_FEATURE(kGamepadRawInputChangeEvent);
 +GAMEPAD_FEATURES_EXPORT BASE_DECLARE_FEATURE(kRestrictGamepadAccess);
 
+ #if BUILDFLAG(IS_WIN)
+ GAMEPAD_FEATURES_EXPORT BASE_DECLARE_FEATURE(kIgnorePS5GamepadsInWgi);
+@@ -27,6 +28,7 @@ GAMEPAD_FEATURES_EXPORT BASE_DECLARE_FEATURE(kAllowlistHidrawGamepads);
+ #endif  // BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_CHROMEOS)
+ 
 GAMEPAD_FEATURES_EXPORT bool IsGamepadMultitouchEnabled();
 +GAMEPAD_FEATURES_EXPORT bool IsRestrictGamepadAccessEnabled();
 
@@ -91,10 +96,10 @@ diff --git a/third_party/blink/renderer/modules/gamepad/navigator_gamepad.cc b/t
 #include "base/auto_reset.h"
 #include "device/gamepad/public/cpp/gamepads.h"
 +#include "device/gamepad/public/cpp/gamepad_features.h"
- #include "third_party/blink/public/common/privacy_budget/identifiability_metric_builder.h"
- #include "third_party/blink/public/common/privacy_budget/identifiability_study_settings.h"
 #include "third_party/blink/public/mojom/frame/user_activation_notification_type.mojom-blink.h"
-@@ -114,6 +115,9 @@ void RecordGamepadsForIdentifiabilityStudy(
+ #include "third_party/blink/public/platform/task_type.h"
+ #include "third_party/blink/renderer/bindings/modules/v8/v8_gamepad_mapping_type.h"
+@@ -86,6 +87,9 @@ NavigatorGamepad& NavigatorGamepad::From(Navigator& navigator) {
 HeapVector<Member<Gamepad>> NavigatorGamepad::getGamepads(
     Navigator& navigator,
     ExceptionState& exception_state) {
@@ -104,10 +109,10 @@ diff --git a/third_party/blink/renderer/modules/gamepad/navigator_gamepad.cc b/t
   if (!navigator.DomWindow()) {
     // Using an existing NavigatorGamepad if one exists, but don't create one
     // for a detached window, as its subclasses depend on a non-null window.
-@@ -420,6 +424,8 @@ void NavigatorGamepad::SampleAndCompareGamepadState() {
- 
- void NavigatorGamepad::DispatchGamepadEvent(const AtomicString& event_name,
-                                             Gamepad* gamepad) {
+@@ -428,6 +432,8 @@ void NavigatorGamepad::MaybeDispatchGamepadEvents(
+ void NavigatorGamepad::DispatchGamepadConnectionChangedEvent(
+     const AtomicString& event_name,
+     Gamepad* gamepad) {
 +  if (::features::IsRestrictGamepadAccessEnabled())
 +    return;
   // Ensure that we're blocking re-entrancy.
@@ -10,6 +10,7 @@ this implementation is the same as the one in ChromeOS which gets proxy informat
 for the system network context; this is strictly not correct on Android because the network context is
 never connected to any user profile and only gets proxy information from the system.
 Existing settings on Profile are migrated to LocalState on startup.
+Enable the support for multiple proxy chain via the bracketed [] sintax

 Credits to @uazo for the LocalState integration.

@@ -38,10 +39,11 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 .../proxy_config/proxy_config_dictionary.cc   |  30 +-
 .../proxy_config/proxy_config_dictionary.h    |   7 +-
 .../proxy_config/proxy_policy_handler.cc      |   2 +-
+ net/features.gni                              |   2 +-
 net/proxy_resolution/pac_file_fetcher_impl.cc |   8 -
 net/proxy_resolution/proxy_config.cc          |  53 ++-
 net/proxy_resolution/proxy_config.h           |   3 +
- 26 files changed, 986 insertions(+), 26 deletions(-)
+ 27 files changed, 987 insertions(+), 27 deletions(-)
 create mode 100644 chrome/browser/resources/proxy_config.css
 create mode 100644 chrome/browser/resources/proxy_config.html
 create mode 100644 chrome/browser/resources/proxy_config.js
@@ -78,7 +80,7 @@ diff --git a/chrome/android/java/res/xml/privacy_preferences.xml b/chrome/androi
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/privacy/settings/PrivacySettings.java b/chrome/android/java/src/org/chromium/chrome/browser/privacy/settings/PrivacySettings.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/privacy/settings/PrivacySettings.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/privacy/settings/PrivacySettings.java
-@@ -101,6 +101,7 @@ public class PrivacySettings extends ChromeBaseSettingsFragment
+@@ -102,6 +102,7 @@ public class PrivacySettings extends ChromeBaseSettingsFragment
     private static final String PREF_PASSWORD_LEAK_DETECTION = "password_leak_detection";
     private static final String PREF_SYNC_AND_SERVICES_LINK = "sync_and_services_link";
     private static final String PREF_PRIVACY_SANDBOX = "privacy_sandbox";
@@ -89,7 +91,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/privacy/setting
 diff --git a/chrome/browser/autocomplete/chrome_autocomplete_provider_client.cc b/chrome/browser/autocomplete/chrome_autocomplete_provider_client.cc
 --- a/chrome/browser/autocomplete/chrome_autocomplete_provider_client.cc
 +++ b/chrome/browser/autocomplete/chrome_autocomplete_provider_client.cc
-@@ -372,6 +372,7 @@ ChromeAutocompleteProviderClient::GetBuiltinsToProvideAsUserTypes() {
+@@ -411,6 +411,7 @@ ChromeAutocompleteProviderClient::GetBuiltinsToProvideAsUserTypes() {
   builtins_to_provide.push_back(chrome::kChromeUISettingsURL16);
 #endif
   builtins_to_provide.push_back(chrome::kChromeUIVersionURL16);
@@ -100,9 +102,9 @@ diff --git a/chrome/browser/autocomplete/chrome_autocomplete_provider_client.cc
 diff --git a/chrome/browser/browser_resources.grd b/chrome/browser/browser_resources.grd
 --- a/chrome/browser/browser_resources.grd
 +++ b/chrome/browser/browser_resources.grd
-@@ -221,6 +221,9 @@
+@@ -239,6 +239,9 @@
+       <if expr="_google_chrome">
         <include name="IDR_PREF_HASH_SEED_BIN" file="resources\settings\internal\pref_hash_seed.bin" type="BINDATA" />
-         <include name="IDR_ADDITIONAL_MODULE_IDS" file="${additional_modules_list_file}" use_base_dir="false" type="BINDATA" />
       </if>
 +      <!-- Bromite Proxy Configuration UI -->
 +      <include name="IDR_PROXY_CONFIG_HTML" file="resources\proxy_config.html" flattenhtml="true" type="BINDATA" compress="gzip" />
@@ -113,7 +115,7 @@ diff --git a/chrome/browser/browser_resources.grd b/chrome/browser/browser_resou
 diff --git a/chrome/browser/extensions/api/proxy/proxy_api_helpers.cc b/chrome/browser/extensions/api/proxy/proxy_api_helpers.cc
 --- a/chrome/browser/extensions/api/proxy/proxy_api_helpers.cc
 +++ b/chrome/browser/extensions/api/proxy/proxy_api_helpers.cc
-@@ -372,7 +372,7 @@ std::optional<base::Value::Dict> CreateProxyConfigDict(
+@@ -375,7 +375,7 @@ std::optional<base::Value::Dict> CreateProxyConfigDict(
         return std::nullopt;
       }
       return ProxyConfigDictionary::CreateFixedServers(proxy_rules_string,
@@ -197,7 +199,7 @@ diff --git a/chrome/browser/net/proxy_service_factory.h b/chrome/browser/net/pro
 diff --git a/chrome/browser/prefs/browser_prefs.cc b/chrome/browser/prefs/browser_prefs.cc
 --- a/chrome/browser/prefs/browser_prefs.cc
 +++ b/chrome/browser/prefs/browser_prefs.cc
-@@ -204,6 +204,8 @@
+@@ -212,6 +212,8 @@
 #include "printing/buildflags/buildflags.h"
 #include "rlz/buildflags/buildflags.h"
 
@@ -206,7 +208,7 @@ diff --git a/chrome/browser/prefs/browser_prefs.cc b/chrome/browser/prefs/browse
 #if BUILDFLAG(ENABLE_BACKGROUND_MODE)
 #include "chrome/browser/background/extensions/background_mode_manager.h"
 #endif
-@@ -1613,6 +1615,8 @@ void RegisterLocalState(PrefRegistrySimple* registry) {
+@@ -1314,6 +1316,8 @@ void RegisterLocalState(PrefRegistrySimple* registry) {
   component_updater::RegisterPrefs(registry);
   domain_reliability::RegisterPrefs(registry);
   embedder_support::OriginTrialPrefs::RegisterPrefs(registry);
@@ -218,7 +220,7 @@ diff --git a/chrome/browser/prefs/browser_prefs.cc b/chrome/browser/prefs/browse
 diff --git a/chrome/browser/prefs/chrome_command_line_pref_store.cc b/chrome/browser/prefs/chrome_command_line_pref_store.cc
 --- a/chrome/browser/prefs/chrome_command_line_pref_store.cc
 +++ b/chrome/browser/prefs/chrome_command_line_pref_store.cc
-@@ -160,7 +160,7 @@ void ChromeCommandLinePrefStore::ApplyProxyMode() {
+@@ -163,7 +163,7 @@ void ChromeCommandLinePrefStore::ApplyProxyMode() {
         command_line()->GetSwitchValueASCII(switches::kProxyBypassList);
     SetValue(proxy_config::prefs::kProxy,
              base::Value(ProxyConfigDictionary::CreateFixedServers(
@@ -661,7 +663,7 @@ new file mode 100644
 diff --git a/chrome/browser/ui/BUILD.gn b/chrome/browser/ui/BUILD.gn
 --- a/chrome/browser/ui/BUILD.gn
 +++ b/chrome/browser/ui/BUILD.gn
-@@ -204,6 +204,8 @@ static_library("ui") {
+@@ -158,6 +158,8 @@ static_library("ui") {
     "webui/metrics_internals/metrics_internals_ui.h",
     "webui/net_export_ui.cc",
     "webui/net_export_ui.h",
@@ -673,17 +675,17 @@ diff --git a/chrome/browser/ui/BUILD.gn b/chrome/browser/ui/BUILD.gn
 diff --git a/chrome/browser/ui/webui/chrome_web_ui_configs.cc b/chrome/browser/ui/webui/chrome_web_ui_configs.cc
 --- a/chrome/browser/ui/webui/chrome_web_ui_configs.cc
 +++ b/chrome/browser/ui/webui/chrome_web_ui_configs.cc
-@@ -57,6 +57,9 @@
+@@ -59,6 +59,9 @@
 #include "extensions/buildflags/buildflags.h"
 #include "printing/buildflags/buildflags.h"
 
 +#include "chrome/browser/ui/webui/proxy_config_ui.h"
 +
 +
- #if BUILDFLAG(ENABLE_NACL)
- #include "chrome/browser/ui/webui/nacl_ui.h"
+ #if BUILDFLAG(ENABLE_WEBUI_CERTIFICATE_VIEWER)
+ #include "chrome/browser/ui/webui/certificate_viewer/certificate_viewer_ui.h"
 #endif
-@@ -422,7 +425,7 @@ void RegisterChromeWebUIConfigs() {
+@@ -438,7 +441,7 @@ void RegisterChromeWebUIConfigs() {
   map.AddWebUIConfig(std::make_unique<glic::GlicUIConfig>());
   map.AddWebUIConfig(std::make_unique<glic::GlicFreUIConfig>());
 #endif
@@ -1135,7 +1137,7 @@ new file mode 100644
 diff --git a/chrome/common/webui_url_constants.cc b/chrome/common/webui_url_constants.cc
 --- a/chrome/common/webui_url_constants.cc
 +++ b/chrome/common/webui_url_constants.cc
-@@ -51,6 +51,7 @@ bool IsSystemWebUIHost(std::string_view host) {
+@@ -53,6 +53,7 @@ bool IsSystemWebUIHost(std::string_view host) {
       kChromeUILockScreenNetworkHost,
       kChromeUILockScreenStartReauthHost,
       kChromeUIMobileSetupHost,
@@ -1143,18 +1145,18 @@ diff --git a/chrome/common/webui_url_constants.cc b/chrome/common/webui_url_cons
       kChromeUIMultiDeviceSetupHost,
       kChromeUINetworkHost,
       kChromeUINotificationTesterHost,
-@@ -72,6 +73,7 @@ bool IsSystemWebUIHost(std::string_view host) {
+@@ -74,6 +75,7 @@ bool IsSystemWebUIHost(std::string_view host) {
 // These hosts will also be suggested by BuiltinProvider.
 base::span<const base::cstring_view> ChromeURLHosts() {
   static constexpr auto kChromeURLHosts = std::to_array<base::cstring_view>({
 +      kChromeUIProxyConfigHost,
       kChromeUIAboutHost,
       kChromeUIAccessibilityHost,
- #if !BUILDFLAG(IS_ANDROID)
+       kChromeUIActorInternalsHost,
 diff --git a/chrome/common/webui_url_constants.h b/chrome/common/webui_url_constants.h
 --- a/chrome/common/webui_url_constants.h
 +++ b/chrome/common/webui_url_constants.h
-@@ -179,6 +179,8 @@ inline constexpr char kChromeUINetInternalsHost[] = "net-internals";
+@@ -197,6 +197,8 @@ inline constexpr char kChromeUINetInternalsHost[] = "net-internals";
 inline constexpr char kChromeUINetInternalsURL[] = "chrome://net-internals/";
 inline constexpr char kChromeUINewTabHost[] = "newtab";
 inline constexpr char kChromeUINewTabFooterHost[] = "newtab-footer";
@@ -1166,24 +1168,25 @@ diff --git a/chrome/common/webui_url_constants.h b/chrome/common/webui_url_const
 diff --git a/components/proxy_config/pref_proxy_config_tracker_impl.cc b/components/proxy_config/pref_proxy_config_tracker_impl.cc
 --- a/components/proxy_config/pref_proxy_config_tracker_impl.cc
 +++ b/components/proxy_config/pref_proxy_config_tracker_impl.cc
-@@ -253,14 +253,14 @@ PrefProxyConfigTrackerImpl::GetEffectiveProxyConfig(
+@@ -550,7 +550,7 @@ PrefProxyConfigTrackerImpl::GetEffectiveProxyConfig(
 // static
 void PrefProxyConfigTrackerImpl::RegisterPrefs(PrefRegistrySimple* registry) {
   registry->RegisterDictionaryPref(proxy_config::prefs::kProxy,
 -                                   ProxyConfigDictionary::CreateSystem());
 +                                   ProxyConfigDictionary::CreateDirect());
- }
- 
- // static
+   registry->RegisterListPref(proxy_config::prefs::kProxyOverrideRules);
+ #if BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_MAC) || BUILDFLAG(IS_WIN)
+   registry->RegisterIntegerPref(
+@@ -562,7 +562,7 @@ void PrefProxyConfigTrackerImpl::RegisterPrefs(PrefRegistrySimple* registry) {
 void PrefProxyConfigTrackerImpl::RegisterProfilePrefs(
     PrefRegistrySimple* registry) {
   registry->RegisterDictionaryPref(proxy_config::prefs::kProxy,
 -                                   ProxyConfigDictionary::CreateSystem());
 +                                   ProxyConfigDictionary::CreateDirect());
   registry->RegisterBooleanPref(proxy_config::prefs::kUseSharedProxies, false);
- }
- 
-@@ -405,6 +405,7 @@ bool PrefProxyConfigTrackerImpl::PrefConfigToNetConfig(
+   registry->RegisterListPref(proxy_config::prefs::kProxyOverrideRules);
+ #if !BUILDFLAG(IS_CHROMEOS)
+@@ -716,6 +716,7 @@ bool PrefProxyConfigTrackerImpl::PrefConfigToNetConfig(
       if (proxy_dict.GetBypassList(&proxy_bypass)) {
         proxy_config.proxy_rules().bypass_rules.ParseFromString(proxy_bypass);
       }
@@ -1196,7 +1199,7 @@ diff --git a/components/proxy_config/proxy_config_dictionary.cc b/components/pro
 +++ b/components/proxy_config/proxy_config_dictionary.cc
@@ -30,6 +30,8 @@ const char kProxyPacMandatory[] = "pac_mandatory";
 // String containing proxy bypass rules. For a specification of the
- // expected syntax see net::ProxyBypassRules::ParseFromString().
+ // expected syntax see net::ProxyHostMatchingRules::ParseFromString().
 const char kProxyBypassList[] = "bypass_list";
 +// Boolean telling whether to reverse the meaning of the bypass list.
 +const char kProxyReverseBypass[] = "reverse_bypass";
@@ -1329,6 +1332,18 @@ diff --git a/components/proxy_config/proxy_policy_handler.cc b/components/proxy_
       }
       break;
     }
+diff --git a/net/features.gni b/net/features.gni
+--- a/net/features.gni
+++ b/net/features.gni
+@@ -62,7 +62,7 @@ declare_args() {
+   # Bracketed URIs parsing is only available for debug builds.
+   # TODO(crbug.com/365771838): Ensure tests are updated if needed if this
+   # feature is changed at all.
+-  enable_bracketed_proxy_uris = is_debug
+  enable_bracketed_proxy_uris = true
+ 
+   # General QUIC proxy support is only available for debug builds.
+   # TODO(crbug.com/367400641): If flag is changed or removed, ensure all
 diff --git a/net/proxy_resolution/pac_file_fetcher_impl.cc b/net/proxy_resolution/pac_file_fetcher_impl.cc
 --- a/net/proxy_resolution/pac_file_fetcher_impl.cc
 +++ b/net/proxy_resolution/pac_file_fetcher_impl.cc
@@ -1420,7 +1435,7 @@ diff --git a/net/proxy_resolution/proxy_config.cc b/net/proxy_resolution/proxy_c
 diff --git a/net/proxy_resolution/proxy_config.h b/net/proxy_resolution/proxy_config.h
 --- a/net/proxy_resolution/proxy_config.h
 +++ b/net/proxy_resolution/proxy_config.h
-@@ -107,6 +107,9 @@ class NET_EXPORT ProxyConfig {
+@@ -106,6 +106,9 @@ class NET_EXPORT ProxyConfig {
     void ParseFromString(std::string_view proxy_rules,
                          bool allow_bracketed_proxy_chains = false,
                          bool is_quic_allowed = false);
@@ -164,7 +164,7 @@ new file mode 100644
 +import org.chromium.components.browser_ui.site_settings.BromiteCustomContentSetting;
 +import org.chromium.components.browser_ui.site_settings.ContentSettingsResources;
 +import org.chromium.components.browser_ui.site_settings.SiteSettingsCategory;
-+import org.chromium.components.content_settings.ContentSettingValues;
+import org.chromium.components.content_settings.ContentSetting;
 +import org.chromium.components.content_settings.ContentSettingsType;
 +import org.chromium.content_public.browser.BrowserContextHandle;
 +
@@ -177,8 +177,8 @@ new file mode 100644
 +public class BromiteAutoplayContentSetting extends BromiteCustomContentSetting {
 +    public BromiteAutoplayContentSetting() {
 +        super(/*contentSettingsType*/ ContentSettingsType.AUTOPLAY,
-+              /*defaultEnabledValue*/ ContentSettingValues.ALLOW,
-+              /*defaultDisabledValue*/ ContentSettingValues.BLOCK,
+              /*defaultEnabledValue*/ ContentSetting.ALLOW,
+              /*defaultDisabledValue*/ ContentSetting.BLOCK,
 +              /*allowException*/ true,
 +              /*preferenceKey*/ "autoplay",
 +              /*profilePrefKey*/ "autoplay");
@@ -197,11 +197,11 @@ new file mode 100644
 +    }
 +
 +    @Override
-+    public int getCategorySummary(@Nullable @ContentSettingValues int value) {
+    public int getCategorySummary(@Nullable @ContentSetting int value) {
 +        switch (value) {
-+            case ContentSettingValues.ALLOW:
+            case ContentSetting.ALLOW:
 +                return R.string.website_settings_category_autoplay_enabled;
-+            case ContentSettingValues.BLOCK:
+            case ContentSetting.BLOCK:
 +                return R.string.website_settings_category_autoplay_disabled;
 +            default:
 +                return 0;
@@ -229,8 +229,8 @@ new file mode 100644
 +    }
 +
 +    @Override
-+    public @Nullable Boolean considerException(SiteSettingsCategory category, @ContentSettingValues int value) {
-+        return value != ContentSettingValues.BLOCK;
+    public @Nullable Boolean considerException(SiteSettingsCategory category, @ContentSetting int value) {
+        return value != ContentSetting.BLOCK;
 +    }
 +}
 diff --git a/components/browser_ui/strings/bromite_content_settings/autoplay.grdp b/components/browser_ui/strings/bromite_content_settings/autoplay.grdp
@@ -279,9 +279,9 @@ new file mode 100644
 diff --git a/components/content_settings/core/browser/content_settings_registry.cc b/components/content_settings/core/browser/content_settings_registry.cc
 --- a/components/content_settings/core/browser/content_settings_registry.cc
 +++ b/components/content_settings/core/browser/content_settings_registry.cc
-@@ -249,7 +249,7 @@ void ContentSettingsRegistry::Init() {
+@@ -255,7 +255,7 @@ void ContentSettingsRegistry::Init() {
            ContentSettingsInfo::INHERIT_IN_INCOGNITO,
-            ContentSettingsInfo::EXCEPTIONS_ON_SECURE_ORIGINS_ONLY);
+            PermissionSettingsInfo::EXCEPTIONS_ON_SECURE_ORIGINS_ONLY);
 
 -  Register(ContentSettingsType::AUTOPLAY, "autoplay", CONTENT_SETTING_ALLOW,
 +  Register(ContentSettingsType::AUTOPLAY, "autoplay", CONTENT_SETTING_BLOCK,
@@ -308,7 +308,7 @@ diff --git a/third_party/blink/renderer/core/html/media/autoplay_policy.cc b/thi
   if (!IsLockedPendingUserGesture())
     return false;
 
-@@ -458,6 +461,17 @@ void AutoplayPolicy::MaybeSetAutoplayInitiated() {
+@@ -457,6 +460,17 @@ void AutoplayPolicy::MaybeSetAutoplayInitiated() {
   }
 }
 
@@ -329,7 +329,7 @@ diff --git a/third_party/blink/renderer/core/html/media/autoplay_policy.cc b/thi
 diff --git a/third_party/blink/renderer/core/html/media/autoplay_policy.h b/third_party/blink/renderer/core/html/media/autoplay_policy.h
 --- a/third_party/blink/renderer/core/html/media/autoplay_policy.h
 +++ b/third_party/blink/renderer/core/html/media/autoplay_policy.h
-@@ -151,6 +151,10 @@ class CORE_EXPORT AutoplayPolicy final
+@@ -148,6 +148,10 @@ class CORE_EXPORT AutoplayPolicy final
   // should use, if checking to see if an action is allowed.
   bool IsLockedPendingUserGesture() const;
 
@@ -14,10 +14,10 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 chrome/android/java/AndroidManifest.xml       |   1 -
 .../menu/bookmark_toolbar_menu_improved.xml   |  14 +
 .../browser/TabbedModeTabDelegateFactory.java |   5 +-
- .../app/bookmarks/BookmarkActivity.java       |  31 ++
+ .../app/bookmarks/BookmarkActivity.java       |  32 ++
 .../native_page/NativePageFactory.java        |   9 +-
 chrome/browser/BUILD.gn                       |  11 +-
- .../bookmarks/android/bookmark_bridge.cc      | 266 ++++++++++++++++
+ .../bookmarks/android/bookmark_bridge.cc      | 193 ++++++++++++
 .../bookmarks/android/bookmark_bridge.h       |  30 +-
 .../browser/bookmarks/BookmarkBridge.java     |  39 +++
 .../browser/bookmarks/BookmarkDelegate.java   |  10 +
@@ -36,11 +36,10 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 chrome/browser/importer/profile_writer.h      |   6 +
 .../preferences/ChromePreferenceKeys.java     |   3 +
 .../strings/android_chrome_strings.grd        |  18 ++
- chrome/common/BUILD.gn                        |   3 +
- chrome/utility/BUILD.gn                       |   7 +-
- .../utility/importer/bookmark_html_reader.cc  |  28 +-
- .../utility/importer/bookmark_html_reader.h   |   8 +
+ chrome/utility/BUILD.gn                       |   7 +
+ .../importer/bookmarks_file_importer.cc       |   4 +
 .../headless_select_file_dialog.cc            |   4 +
+ .../content/content_bookmark_parser_utils.cc  |   3 +
 .../add-bookmark-import-export-actions.inc    |  12 +
 .../add-bookmark-import-export-actions.inc    |   4 +
 .../add-bookmark-import-export-actions.inc    |   1 +
@@ -52,7 +51,7 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 ui/shell_dialogs/select_file_dialog_linux.cc  |   4 +
 ui/shell_dialogs/select_file_dialog_linux.h   |   2 +
 ui/shell_dialogs/select_file_dialog_win.cc    |   5 +
- 41 files changed, 905 insertions(+), 29 deletions(-)
+ 40 files changed, 806 insertions(+), 24 deletions(-)
 create mode 100644 cromite_flags/chrome/browser/about_flags_cc/add-bookmark-import-export-actions.inc
 create mode 100644 cromite_flags/chrome/browser/flags/android/chrome_feature_list_cc/add-bookmark-import-export-actions.inc
 create mode 100644 cromite_flags/chrome/browser/flags/android/chrome_feature_list_h/add-bookmark-import-export-actions.inc
@@ -66,8 +65,8 @@ diff --git a/chrome/android/java/AndroidManifest.xml b/chrome/android/java/Andro
 
 -    <uses-permission-sdk-23 android:name="android.permission.READ_CONTACTS"/>
     <uses-permission-sdk-23 android:name="android.permission.REORDER_TASKS"/>
-     <uses-permission-sdk-23 android:name="android.permission.REQUEST_INSTALL_PACKAGES"/>
 
+     <!--  Needed for allowing downloaded APKs to be installed. -->
 diff --git a/chrome/android/java/res/menu/bookmark_toolbar_menu_improved.xml b/chrome/android/java/res/menu/bookmark_toolbar_menu_improved.xml
 --- a/chrome/android/java/res/menu/bookmark_toolbar_menu_improved.xml
 +++ b/chrome/android/java/res/menu/bookmark_toolbar_menu_improved.xml
@@ -95,25 +94,25 @@ diff --git a/chrome/android/java/res/menu/bookmark_toolbar_menu_improved.xml b/c
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/TabbedModeTabDelegateFactory.java b/chrome/android/java/src/org/chromium/chrome/browser/TabbedModeTabDelegateFactory.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/TabbedModeTabDelegateFactory.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/TabbedModeTabDelegateFactory.java
-@@ -13,6 +13,7 @@ import org.chromium.base.jank_tracker.JankTracker;
- import org.chromium.base.supplier.ObservableSupplier;
+@@ -10,6 +10,7 @@ import org.chromium.base.supplier.ObservableSupplier;
 import org.chromium.base.supplier.OneshotSupplier;
- import org.chromium.base.supplier.Supplier;
+ import org.chromium.build.annotations.NullMarked;
+ import org.chromium.build.annotations.Nullable;
 +import org.chromium.chrome.browser.app.ChromeActivity;
 import org.chromium.chrome.browser.app.tab_activity_glue.ActivityTabWebContentsDelegateAndroid;
+ import org.chromium.chrome.browser.back_press.BackPressManager;
 import org.chromium.chrome.browser.browser_controls.BrowserControlsStateProvider;
- import org.chromium.chrome.browser.compositor.CompositorViewHolder;
-@@ -55,7 +56,7 @@ import org.chromium.ui.modaldialog.ModalDialogManager;
-  * {@link ChromeTabbedActivity}.
+@@ -61,7 +62,7 @@ import java.util.function.Supplier;
  */
+ @NullMarked
 public class TabbedModeTabDelegateFactory implements TabDelegateFactory {
 -    private final Activity mActivity;
 +    private final ChromeActivity mActivity;
     private final BrowserControlsVisibilityDelegate mAppBrowserControlsVisibilityDelegate;
     private final Supplier<ShareDelegate> mShareDelegateSupplier;
     private final Supplier<EphemeralTabCoordinator> mEphemeralTabCoordinatorSupplier;
-@@ -85,7 +86,7 @@ public class TabbedModeTabDelegateFactory implements TabDelegateFactory {
-     private NativePageFactory mNativePageFactory;
+@@ -93,7 +94,7 @@ public class TabbedModeTabDelegateFactory implements TabDelegateFactory {
+     private final MultiInstanceManager mMultiInstanceManager;
 
     public TabbedModeTabDelegateFactory(
 -            Activity activity,
@@ -124,15 +123,16 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/TabbedModeTabDe
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/app/bookmarks/BookmarkActivity.java b/chrome/android/java/src/org/chromium/chrome/browser/app/bookmarks/BookmarkActivity.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/app/bookmarks/BookmarkActivity.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/app/bookmarks/BookmarkActivity.java
-@@ -7,6 +7,7 @@ package org.chromium.chrome.browser.app.bookmarks;
+@@ -6,6 +6,8 @@ package org.chromium.chrome.browser.app.bookmarks;
+ 
+ import static org.chromium.build.NullUtil.assumeNonNull;
+ 
+import android.os.Bundle;
+
 import android.content.ComponentName;
 import android.content.Intent;
 import android.text.TextUtils;
-+import android.os.Bundle;
- 
- import org.chromium.base.IntentUtils;
- import org.chromium.build.annotations.Nullable;
-@@ -29,6 +30,9 @@ import org.chromium.components.embedder_support.util.UrlConstants;
+@@ -35,6 +37,9 @@ import org.chromium.components.embedder_support.util.UrlConstants;
 import org.chromium.ui.modaldialog.ModalDialogManager;
 import org.chromium.ui.modaldialog.ModalDialogManager.ModalDialogType;
 
@@ -142,9 +142,9 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/app/bookmarks/B
 /**
  * The activity that displays the bookmark UI on the phone. It keeps a {@link
  * BookmarkManagerCoordinator} inside of it and creates a snackbar manager. This activity should
-@@ -42,6 +46,9 @@ public class BookmarkActivity extends SnackbarActivity {
-     private @Nullable BookmarkManagerCoordinator mBookmarkManagerCoordinator;
+@@ -50,6 +55,9 @@ public class BookmarkActivity extends SnackbarActivity {
     private @Nullable BookmarkOpener mBookmarkOpener;
+     private @Nullable OnKeyDownHandler mOnKeyDownHandler;
 
 +    private ActivityWindowAndroid mWindowAndroid;
 +    private IntentRequestTracker mIntentRequestTracker;
@@ -152,10 +152,10 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/app/bookmarks/B
     @Override
     protected void onProfileAvailable(Profile profile) {
         super.onProfileAvailable(profile);
-@@ -68,6 +75,14 @@ public class BookmarkActivity extends SnackbarActivity {
-         mBookmarkManagerCoordinator.updateForUrl(url);
-         setContentView(mBookmarkManagerCoordinator.getView());
-         BackPressHelper.create(this, getOnBackPressedDispatcher(), mBookmarkManagerCoordinator);
+@@ -82,6 +90,14 @@ public class BookmarkActivity extends SnackbarActivity {
+         mOnKeyDownHandler =
+                 BackPressHelper.create(
+                         this, getOnBackPressedDispatcher(), mBookmarkManagerCoordinator);
 +
 +        final boolean listenToActivityState = true;
 +        mIntentRequestTracker = IntentRequestTracker.createFromActivity(this);
@@ -167,15 +167,15 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/app/bookmarks/B
     }
 
     @Override
-@@ -87,6 +102,7 @@ public class BookmarkActivity extends SnackbarActivity {
+@@ -109,6 +125,7 @@ public class BookmarkActivity extends SnackbarActivity {
     @Override
-     protected void onActivityResult(int requestCode, int resultCode, Intent data) {
+     protected void onActivityResult(int requestCode, int resultCode, @Nullable Intent data) {
         super.onActivityResult(requestCode, resultCode, data);
 +        mWindowAndroid.getIntentRequestTracker().onActivityResult(requestCode, resultCode, data);
         if (requestCode == EDIT_BOOKMARK_REQUEST_CODE && resultCode == RESULT_OK) {
+             assumeNonNull(data);
             BookmarkId bookmarkId =
-                     BookmarkId.getBookmarkIdFromString(
-@@ -95,6 +111,21 @@ public class BookmarkActivity extends SnackbarActivity {
+@@ -118,6 +135,21 @@ public class BookmarkActivity extends SnackbarActivity {
         }
     }
 
@@ -200,33 +200,33 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/app/bookmarks/B
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/native_page/NativePageFactory.java b/chrome/android/java/src/org/chromium/chrome/browser/native_page/NativePageFactory.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/native_page/NativePageFactory.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/native_page/NativePageFactory.java
-@@ -18,6 +18,7 @@ import org.chromium.base.supplier.ObservableSupplier;
- import org.chromium.base.supplier.OneshotSupplier;
- import org.chromium.base.supplier.Supplier;
+@@ -26,6 +26,7 @@ import org.chromium.base.supplier.OneshotSupplier;
+ import org.chromium.build.annotations.NullMarked;
+ import org.chromium.build.annotations.Nullable;
 import org.chromium.chrome.R;
 +import org.chromium.chrome.browser.app.ChromeActivity;
 import org.chromium.chrome.browser.app.download.home.DownloadPage;
+ import org.chromium.chrome.browser.back_press.BackPressManager;
 import org.chromium.chrome.browser.bookmarks.BookmarkPage;
- import org.chromium.chrome.browser.browser_controls.BrowserControlsMarginSupplier;
-@@ -59,7 +60,7 @@ import org.chromium.ui.util.ColorUtils;
-  * Creates NativePage objects to show chrome-native:// URLs using the native Android view system.
+@@ -79,7 +80,7 @@ import java.util.function.Supplier;
  */
+ @NullMarked
 public class NativePageFactory {
 -    private final Activity mActivity;
 +    private final ChromeActivity mActivity;
     private final BottomSheetController mBottomSheetController;
     private final BrowserControlsManager mBrowserControlsManager;
-     private final Supplier<Tab> mCurrentTabSupplier;
-@@ -82,7 +83,7 @@ public class NativePageFactory {
-     private static NativePage sTestPage;
+     private final Supplier<@Nullable Tab> mCurrentTabSupplier;
+@@ -104,7 +105,7 @@ public class NativePageFactory {
+     private final MultiInstanceManager mMultiInstanceManager;
 
     public NativePageFactory(
-            @NonNull Activity activity,
-+            @NonNull ChromeActivity activity,
-             @NonNull BottomSheetController sheetController,
-             @NonNull BrowserControlsManager browserControlsManager,
-             @NonNull Supplier<Tab> currentTabSupplier,
-@@ -154,7 +155,7 @@ public class NativePageFactory {
+-            Activity activity,
+            ChromeActivity activity,
+             BottomSheetController sheetController,
+             BrowserControlsManager browserControlsManager,
+             Supplier<@Nullable Tab> currentTabSupplier,
+@@ -182,7 +183,7 @@ public class NativePageFactory {
 
     @VisibleForTesting
     static class NativePageBuilder {
@@ -235,20 +235,20 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/native_page/Nat
         private final BottomSheetController mBottomSheetController;
         private final Supplier<NewTabPageCreationTracker> mNewTabPageCreationTracker;
         private final BrowserControlsManager mBrowserControlsManager;
-@@ -251,7 +252,7 @@ public class NativePageFactory {
-                     mSnackbarManagerSupplier.get(),
-                     tab.getProfile(),
-                     new TabShim(tab, mBrowserControlsManager, mTabModelSelector),
-                    mActivity.getComponentName());
-+                    mActivity.getComponentName(), mActivity);
+@@ -299,7 +300,7 @@ public class NativePageFactory {
+                             mTabModelSelector,
+                             mEdgeToEdgeControllerSupplier),
+                     mActivity.getComponentName(),
+-                    mBackPressManager);
+                    mBackPressManager, mActivity);
         }
 
         protected NativePage buildDownloadsPage(Tab tab) {
 diff --git a/chrome/browser/BUILD.gn b/chrome/browser/BUILD.gn
 --- a/chrome/browser/BUILD.gn
 +++ b/chrome/browser/BUILD.gn
-@@ -222,6 +222,8 @@ static_library("browser") {
-     "bluetooth/chrome_bluetooth_delegate_impl_client.h",
+@@ -207,6 +207,8 @@ static_library("browser") {
+     "bad_message.h",
     "bookmarks/bookmark_model_factory.cc",
     "bookmarks/bookmark_model_factory.h",
 +    "bookmarks/bookmark_html_writer.cc",
@@ -256,9 +256,9 @@ diff --git a/chrome/browser/BUILD.gn b/chrome/browser/BUILD.gn
     "bookmarks/chrome_bookmark_client.cc",
     "bookmarks/chrome_bookmark_client.h",
     "bookmarks/managed_bookmark_service_factory.cc",
-@@ -1731,6 +1733,13 @@ static_library("browser") {
-     ]
-   }
+@@ -1573,6 +1575,13 @@ static_library("browser") {
+     "webdata_services/web_data_service_factory.cc",
+   ]
 
 +  if (is_android) {
 +    sources += [
@@ -270,7 +270,7 @@ diff --git a/chrome/browser/BUILD.gn b/chrome/browser/BUILD.gn
   configs += [
     "//build/config/compiler:wexit_time_destructors",
     "//build/config:precompiled_headers",
-@@ -3639,8 +3648,6 @@ static_library("browser") {
+@@ -3733,8 +3742,6 @@ static_library("browser") {
       "bookmarks/bookmark_expanded_state_tracker.h",
       "bookmarks/bookmark_expanded_state_tracker_factory.cc",
       "bookmarks/bookmark_expanded_state_tracker_factory.h",
@@ -282,19 +282,20 @@ diff --git a/chrome/browser/BUILD.gn b/chrome/browser/BUILD.gn
 diff --git a/chrome/browser/bookmarks/android/bookmark_bridge.cc b/chrome/browser/bookmarks/android/bookmark_bridge.cc
 --- a/chrome/browser/bookmarks/android/bookmark_bridge.cc
 +++ b/chrome/browser/bookmarks/android/bookmark_bridge.cc
-@@ -68,6 +68,27 @@
+@@ -64,6 +64,28 @@
 #include "content/public/browser/web_contents.h"
 #include "url/gurl.h"
 
 +#include "base/android/content_uri_utils.h"
 +#include "base/android/path_utils.h"
 +#include "base/strings/utf_string_conversions.h"
-+#include "chrome/utility/importer/bookmark_html_reader.h"
 +#include "chrome/browser/bookmarks/bookmark_html_writer.h"
 +#include "chrome/browser/importer/profile_writer.h"
 +#include "chrome/browser/platform_util.h"
 +#include "chrome/browser/ui/chrome_select_file_policy.h"
 +#include "components/user_data_importer/common/imported_bookmark_entry.h"
+#include "components/user_data_importer/content/content_bookmark_parser.h"
+#include "components/user_data_importer/content/content_bookmark_parser_utils.h"
 +#include "chrome/common/url_constants.h"
 +#include "components/favicon_base/favicon_usage_data.h"
 +#include "components/search_engines/template_url.h"
@@ -310,65 +311,7 @@ diff --git a/chrome/browser/bookmarks/android/bookmark_bridge.cc b/chrome/browse
 // Must come after all headers that specialize FromJniType() / ToJniType().
 #include "chrome/browser/bookmarks/android/jni_headers/BookmarkBridge_jni.h"
 
-@@ -86,6 +107,57 @@ using bookmarks::android::JavaBookmarkIdGetType;
- using content::BrowserThread;
- using power_bookmarks::PowerBookmarkMeta;
- 
-+namespace internal {
-+
-+// Returns true if |url| has a valid scheme that we allow to import. We
-+// filter out the URL with a unsupported scheme.
-+bool CanImportURL(const GURL& url) {
-+  // The URL is not valid.
-+  if (!url.is_valid())
-+    return false;
-+
-+  // Filter out the URLs with unsupported schemes.
-+  const char* const kInvalidSchemes[] = {"wyciwyg", "place"};
-+  for (size_t i = 0; i < std::size(kInvalidSchemes); ++i) {
-+    if (url.SchemeIs(kInvalidSchemes[i]))
-+      return false;
-+  }
-+
-+  // Check if |url| is about:blank.
-+  if (url == url::kAboutBlankURL)
-+    return true;
-+
-+  // If |url| starts with chrome:// or about:, check if it's one of the URLs
-+  // that we support.
-+  if (url.SchemeIs(content::kChromeUIScheme) ||
-+      url.SchemeIs(url::kAboutScheme)) {
-+    if (url.host_piece() == chrome::kChromeUIAboutHost)
-+      return true;
-+
-+    GURL fixed_url(url_formatter::FixupURL(url.spec(), std::string()));
-+    const base::span<const base::cstring_view> hosts = chrome::ChromeURLHosts();
-+    for (const base::cstring_view host : hosts) {
-+      if (fixed_url.DomainIs(host)) {
-+        return true;
-+      }
-+    }
-+
-+    if (base::Contains(chrome::ChromeDebugURLs(), fixed_url.spec())) {
-+      return true;
-+    }
-+
-+    // If url has either chrome:// or about: schemes but wasn't found in the
-+    // above lists, it means we don't support it, so we don't allow the user
-+    // to import it.
-+    return false;
-+  }
-+
-+  // Otherwise, we assume the url has a valid (importable) scheme.
-+  return true;
-+}
-+
-+} // internal
-+
- namespace {
- // The key used to connect the instance of the bookmark bridge to the bookmark
- // model.
-@@ -296,6 +368,10 @@ BookmarkBridge::~BookmarkBridge() {
+@@ -292,6 +314,10 @@ BookmarkBridge::~BookmarkBridge() {
   partner_bookmarks_shim_observation_.Reset();
   bookmark_model_observation_.Reset();
   profile_observation_.Reset();
@@ -379,7 +322,7 @@ diff --git a/chrome/browser/bookmarks/android/bookmark_bridge.cc b/chrome/browse
 }
 
 void BookmarkBridge::Destroy(JNIEnv* env) {
-@@ -847,6 +923,196 @@ jint BookmarkBridge::GetTotalBookmarkCount(
+@@ -843,6 +869,173 @@ jint BookmarkBridge::GetTotalBookmarkCount(
   return count;
 }
 
@@ -506,13 +449,9 @@ diff --git a/chrome/browser/bookmarks/android/bookmark_bridge.cc b/chrome/browse
 +    return "";
 +  }
 +
-+  if (fileLength > 10 * 1024 * 1024) {
-+    select_file_dialog_->ShowToast("Bookmark file is bigger than 10MB");
-+    return "";
-+  }
-+
 +  std::vector<char> buffer(fileLength);
-+  if (-1 == file.ReadAtCurrentPos(buffer.data(), fileLength)) {
+  base::span<uint8_t> buffer_span = base::as_writable_byte_span(buffer);
+  if (-1 == file.ReadAtCurrentPos(buffer_span)) {
 +    select_file_dialog_->ShowToast("Could not read bookmarks file");
 +    return "";
 +  }
@@ -527,43 +466,24 @@ diff --git a/chrome/browser/bookmarks/android/bookmark_bridge.cc b/chrome/browse
 +}
 +
 +void BookmarkBridge::FileSelectedImplOnUIThread(const base::FilePath& path,
-+                                        const std::string& contents) {
+                                                const std::string& contents) {
 +  if (contents.empty())
 +    return;
 +
 +  // the following import logic comes from BookmarksFileImporter class
-+  std::vector<user_data_importer::ImportedBookmarkEntry> bookmarks;
-+  std::vector<user_data_importer::SearchEngineInfo> search_engines;
-+  favicon_base::FaviconUsageDataList favicons;
-+
-+  bookmark_html_reader::ImportBookmarksFile(
-+      base::RepeatingCallback<bool(void)>(),
-+      base::BindRepeating(internal::CanImportURL),
-+      contents,
-+      &bookmarks,
-+      &search_engines,
-+      &favicons);
+  user_data_importer::BookmarkParser::ParsedBookmarks parsed_bookmarks =
+      user_data_importer::ParseBookmarksUnsafe(contents);
 +
 +  auto *writer = new ProfileWriter(profile_);
 +
-+  if (!bookmarks.empty()) {
+  if (!parsed_bookmarks.bookmarks.empty()) {
 +    // adding bookmarks will begin extensive changes to the model
-+    writer->AddBookmarksWithModel(bookmark_model_, bookmarks, u"Imported");
-+  }
-+  if (!search_engines.empty()) {
-+    TemplateURLService::OwnedTemplateURLVector owned_template_urls;
-+    for (const auto& search_engine : search_engines) {
-+      std::unique_ptr<TemplateURL> owned_template_url = CreateTemplateURL(
-+          search_engine.url, search_engine.keyword, search_engine.display_name);
-+      if (owned_template_url)
-+        owned_template_urls.push_back(std::move(owned_template_url));
-+    }
-+    writer->AddKeywords(std::move(owned_template_urls), false);
+    writer->AddBookmarksWithModel(bookmark_model_, parsed_bookmarks.bookmarks, u"Imported");
 +  }
 +
 +  std::stringstream message;
-+  message << "Imported " << bookmarks.size() << " bookmarks and " <<
-+		search_engines.size() << " search engines from " << path.MaybeAsASCII();
+  message << "Imported " << parsed_bookmarks.bookmarks.size() << " bookmarks " <<
+		" from " << path.MaybeAsASCII();
 +  auto result = message.str();
 +
 +  select_file_dialog_->ShowToast(result);
@@ -637,7 +557,7 @@ diff --git a/chrome/browser/bookmarks/android/bookmark_bridge.h b/chrome/browser
   void GetAllFoldersWithDepths(
       JNIEnv* env,
       const base::android::JavaParamRef<jobject>& j_folders_obj,
-@@ -390,6 +411,8 @@ class BookmarkBridge : public ProfileObserver,
+@@ -385,6 +406,8 @@ class BookmarkBridge : public ProfileObserver,
   void CreateOrDestroyAccountReadingListManagerIfNeeded();
 
   const raw_ptr<Profile> profile_;  // weak
@@ -646,7 +566,7 @@ diff --git a/chrome/browser/bookmarks/android/bookmark_bridge.h b/chrome/browser
   base::android::ScopedJavaGlobalRef<jobject> java_bookmark_model_;
   const raw_ptr<bookmarks::BookmarkModel> bookmark_model_;  // weak
   const raw_ptr<bookmarks::ManagedBookmarkService>
-@@ -404,6 +427,7 @@ class BookmarkBridge : public ProfileObserver,
+@@ -399,6 +422,7 @@ class BookmarkBridge : public ProfileObserver,
   std::unique_ptr<bookmarks::ScopedGroupBookmarkActions>
       grouped_bookmark_actions_;
   PrefChangeRegistrar pref_change_registrar_;
@@ -654,7 +574,7 @@ diff --git a/chrome/browser/bookmarks/android/bookmark_bridge.h b/chrome/browser
 
   // Information about the Partner bookmarks (must check for IsLoaded()).
   // This is owned by profile.
-@@ -437,6 +461,10 @@ class BookmarkBridge : public ProfileObserver,
+@@ -432,6 +456,10 @@ class BookmarkBridge : public ProfileObserver,
   base::TimeTicks load_start_time_;
   bool loading_notification_sent_ = false;
 
@@ -724,7 +644,7 @@ diff --git a/chrome/browser/bookmarks/android/java/src/org/chromium/chrome/brows
     /**
      * Synchronously gets a list of bookmarks that match the specified search query.
      *
-@@ -1124,6 +1159,10 @@ class BookmarkBridge {
+@@ -1108,6 +1143,10 @@ class BookmarkBridge {
         void getChildIds(
                 long nativeBookmarkBridge, long id, int type, List<BookmarkId> bookmarksList);
 
@@ -758,16 +678,16 @@ diff --git a/chrome/browser/bookmarks/android/java/src/org/chromium/chrome/brows
 diff --git a/chrome/browser/bookmarks/android/java/src/org/chromium/chrome/browser/bookmarks/BookmarkManagerCoordinator.java b/chrome/browser/bookmarks/android/java/src/org/chromium/chrome/browser/bookmarks/BookmarkManagerCoordinator.java
 --- a/chrome/browser/bookmarks/android/java/src/org/chromium/chrome/browser/bookmarks/BookmarkManagerCoordinator.java
 +++ b/chrome/browser/bookmarks/android/java/src/org/chromium/chrome/browser/bookmarks/BookmarkManagerCoordinator.java
-@@ -53,6 +53,8 @@ import org.chromium.components.image_fetcher.ImageFetcher;
- import org.chromium.components.image_fetcher.ImageFetcherConfig;
+@@ -57,6 +57,8 @@ import org.chromium.components.image_fetcher.ImageFetcherConfig;
 import org.chromium.components.image_fetcher.ImageFetcherFactory;
 import org.chromium.ui.KeyboardVisibilityDelegate;
+ import org.chromium.ui.edge_to_edge.EdgeToEdgePadAdjuster;
 +import org.chromium.ui.base.ActivityWindowAndroid;
 +import org.chromium.ui.modaldialog.ModalDialogManager;
 import org.chromium.ui.modaldialog.ModalDialogManager;
 import org.chromium.ui.modaldialog.ModalDialogManager.ModalDialogType;
 import org.chromium.ui.modelutil.MVCListAdapter.ListItem;
-@@ -322,6 +324,13 @@ public class BookmarkManagerCoordinator
+@@ -344,6 +346,13 @@ public class BookmarkManagerCoordinator
 
     // Public API implementation.
 
@@ -784,16 +704,16 @@ diff --git a/chrome/browser/bookmarks/android/java/src/org/chromium/chrome/brows
 diff --git a/chrome/browser/bookmarks/android/java/src/org/chromium/chrome/browser/bookmarks/BookmarkManagerMediator.java b/chrome/browser/bookmarks/android/java/src/org/chromium/chrome/browser/bookmarks/BookmarkManagerMediator.java
 --- a/chrome/browser/bookmarks/android/java/src/org/chromium/chrome/browser/bookmarks/BookmarkManagerMediator.java
 +++ b/chrome/browser/bookmarks/android/java/src/org/chromium/chrome/browser/bookmarks/BookmarkManagerMediator.java
-@@ -59,6 +59,8 @@ import org.chromium.components.commerce.core.SubscriptionsObserver;
+@@ -63,6 +63,8 @@ import org.chromium.components.commerce.core.SubscriptionsObserver;
 import org.chromium.components.embedder_support.util.UrlConstants;
 import org.chromium.components.power_bookmarks.PowerBookmarkMeta;
 import org.chromium.components.power_bookmarks.PowerBookmarkType;
 +import org.chromium.ui.base.ActivityWindowAndroid;
 +import org.chromium.ui.modaldialog.ModalDialogManager;
 import org.chromium.ui.accessibility.AccessibilityState;
- import org.chromium.ui.listmenu.ListMenu;
- import org.chromium.ui.listmenu.ListMenuItemProperties;
-@@ -77,6 +79,47 @@ import java.util.function.BooleanSupplier;
+ import org.chromium.ui.base.DeviceFormFactor;
+ import org.chromium.ui.base.DeviceInput;
+@@ -84,6 +86,47 @@ import java.util.function.BooleanSupplier;
 import java.util.function.Consumer;
 import java.util.function.Predicate;
 
@@ -840,8 +760,8 @@ diff --git a/chrome/browser/bookmarks/android/java/src/org/chromium/chrome/brows
 +
 /** Responsible for BookmarkManager business logic. */
 // TODO(crbug.com/40256938): Remove BookmarkDelegate if possible.
- class BookmarkManagerMediator
-@@ -86,6 +129,9 @@ class BookmarkManagerMediator
+ @NullMarked
+@@ -94,6 +137,9 @@ class BookmarkManagerMediator
 
     private static boolean sPreventLoadingForTesting;
 
@@ -851,7 +771,7 @@ diff --git a/chrome/browser/bookmarks/android/java/src/org/chromium/chrome/brows
     /** Keeps track of whether drag is enabled / active for bookmark lists. */
     private class BookmarkDragStateDelegate implements DragStateDelegate {
         private BookmarkDelegate mBookmarkDelegate;
-@@ -583,6 +629,14 @@ class BookmarkManagerMediator
+@@ -646,6 +692,14 @@ class BookmarkManagerMediator
         mNativePage = nativePage;
     }
 
@@ -866,7 +786,7 @@ diff --git a/chrome/browser/bookmarks/android/java/src/org/chromium/chrome/brows
     /** See BookmarkManager(Coordinator)#updateForUrl */
     void updateForUrl(String url) {
         // Bookmark model is null if the manager has been destroyed.
-@@ -758,6 +812,235 @@ class BookmarkManagerMediator
+@@ -818,6 +872,235 @@ class BookmarkManagerMediator
         }
     }
 
@@ -989,7 +909,7 @@ diff --git a/chrome/browser/bookmarks/android/java/src/org/chromium/chrome/brows
 +        // use the download ui and standard file saving
 +        DownloadLocationDialogController controller = new DownloadLocationDialogController() {
 +            @Override
-+            public void onDownloadLocationDialogComplete(String returnedPath) {}
+            public void onDownloadLocationDialogComplete(String returnedPath, boolean didUserConfirm) {}
 +
 +            @Override
 +            public void onDownloadLocationDialogCanceled() {}
@@ -1114,27 +1034,27 @@ diff --git a/chrome/browser/bookmarks/android/java/src/org/chromium/chrome/brows
 +import org.chromium.components.browser_ui.modaldialog.AppModalPresenter;
 
 /** A native page holding a {@link BookmarkManagerCoordinator} on _tablet_. */
- public class BookmarkPage extends BasicNativePage {
-@@ -35,7 +38,8 @@ public class BookmarkPage extends BasicNativePage {
-             @NonNull SnackbarManager snackbarManager,
-             @NonNull Profile profile,
-             @NonNull NativePageHost host,
-            @Nullable ComponentName componentName) {
-+            @Nullable ComponentName componentName,
+ @NullMarked
+@@ -37,7 +40,8 @@ public class BookmarkPage extends BasicNativePage {
+             Profile profile,
+             NativePageHost host,
+             @Nullable ComponentName componentName,
+-            BackPressManager backPressManager) {
+            BackPressManager backPressManager,
 +            ChromeActivity activity) {
         super(host);
-         mTitle = host.getContext().getString(R.string.bookmarks);
 
-@@ -55,6 +59,9 @@ public class BookmarkPage extends BasicNativePage {
-                         new BookmarkManagerOpenerImpl(),
-                         PriceDropNotificationManagerFactory.create(profile));
+         mTitle = host.getContext().getString(R.string.bookmarks);
+@@ -65,6 +69,9 @@ public class BookmarkPage extends BasicNativePage {
+                         backPressManager);
+ 
         mBookmarkManagerCoordinator.setBasicNativePage(this);
 +        mBookmarkManagerCoordinator.setWindow(activity.getWindowAndroid(),
 +            new ModalDialogManager(
 +                new AppModalPresenter(activity), ModalDialogManager.ModalDialogType.APP));
         initWithView(mBookmarkManagerCoordinator.getView());
-     }
 
+         setBackPressHandler(mBookmarkManagerCoordinator, backPressManager);
 diff --git a/chrome/browser/bookmarks/android/java/src/org/chromium/chrome/browser/bookmarks/BookmarkToolbar.java b/chrome/browser/bookmarks/android/java/src/org/chromium/chrome/browser/bookmarks/BookmarkToolbar.java
 --- a/chrome/browser/bookmarks/android/java/src/org/chromium/chrome/browser/bookmarks/BookmarkToolbar.java
 +++ b/chrome/browser/bookmarks/android/java/src/org/chromium/chrome/browser/bookmarks/BookmarkToolbar.java
@@ -1196,7 +1116,7 @@ diff --git a/chrome/browser/bookmarks/android/java/src/org/chromium/chrome/brows
 diff --git a/chrome/browser/bookmarks/android/java/src/org/chromium/chrome/browser/bookmarks/BookmarkToolbarMediator.java b/chrome/browser/bookmarks/android/java/src/org/chromium/chrome/browser/bookmarks/BookmarkToolbarMediator.java
 --- a/chrome/browser/bookmarks/android/java/src/org/chromium/chrome/browser/bookmarks/BookmarkToolbarMediator.java
 +++ b/chrome/browser/bookmarks/android/java/src/org/chromium/chrome/browser/bookmarks/BookmarkToolbarMediator.java
-@@ -140,6 +140,10 @@ class BookmarkToolbarMediator
+@@ -139,6 +139,10 @@ class BookmarkToolbarMediator
                     mBookmarkDelegate = bookmarkDelegate;
                     mModel.set(
                             BookmarkToolbarProperties.NAVIGATE_BACK_RUNNABLE, this::onNavigateBack);
@@ -1315,7 +1235,7 @@ diff --git a/chrome/browser/download/android/java/src/org/chromium/chrome/browse
 
     private boolean mLocationDialogManaged;
 
-@@ -153,7 +153,7 @@ public class DownloadLocationDialogCoordinator implements ModalDialogProperties.
+@@ -154,7 +154,7 @@ public class DownloadLocationDialogCoordinator implements ModalDialogProperties.
      * Called after retrieved the download directory options.
      * @param dirs An list of available download directories.
      */
@@ -1327,20 +1247,20 @@ diff --git a/chrome/browser/download/android/java/src/org/chromium/chrome/browse
 diff --git a/chrome/browser/flags/android/chrome_feature_list.cc b/chrome/browser/flags/android/chrome_feature_list.cc
 --- a/chrome/browser/flags/android/chrome_feature_list.cc
 +++ b/chrome/browser/flags/android/chrome_feature_list.cc
-@@ -223,6 +223,7 @@ const base::Feature* const kFeaturesExposedToJava[] = {
-     &kBatchTabRestore,
+@@ -264,6 +264,7 @@ const base::Feature* const kFeaturesExposedToJava[] = {
+     &kAuxiliarySearchHistoryDonation,
     &kBlockIntentsWhileLocked,
     &kBookmarkPaneAndroid,
 +    &kBookmarksExportUseSaf,
-     &kBottomBrowserControlsRefactor,
-     &kTabClosureMethodRefactor,
     &kBrowserControlsDebugging,
+     &kBrowserControlsEarlyResize,
+     &kBrowserControlsRenderDrivenShowConstraint,
 diff --git a/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureList.java b/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureList.java
 --- a/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureList.java
 +++ b/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureList.java
-@@ -625,6 +625,7 @@ public abstract class ChromeFeatureList {
-     public static final String USE_LIBUNWINDSTACK_NATIVE_UNWINDER_ANDROID =
+@@ -713,6 +713,7 @@ public abstract class ChromeFeatureList {
             "UseLibunwindstackNativeUnwinderAndroid";
+     public static final String VERIFY_QWACS = "VerifyQWACs";
     public static final String VISITED_URL_RANKING_SERVICE = "VisitedURLRankingService";
 +    public static final String BOOKMARKS_EXPORT_USESAF = "BookmarksExportUseSaf";
     public static final String WEB_APK_BACKUP_AND_RESTORE_BACKEND = "WebApkBackupAndRestoreBackend";
@@ -1349,7 +1269,7 @@ diff --git a/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/f
 diff --git a/chrome/browser/importer/profile_writer.cc b/chrome/browser/importer/profile_writer.cc
 --- a/chrome/browser/importer/profile_writer.cc
 +++ b/chrome/browser/importer/profile_writer.cc
-@@ -125,6 +125,16 @@ void ProfileWriter::AddBookmarks(
+@@ -126,6 +126,16 @@ void ProfileWriter::AddBookmarks(
     return;
 
   BookmarkModel* model = BookmarkModelFactory::GetForBrowserContext(profile_);
@@ -1401,7 +1321,7 @@ diff --git a/chrome/browser/preferences/android/java/src/org/chromium/chrome/bro
 
     /** Whether Chrome is set as the default browser. Default value is false. */
     public static final String CHROME_DEFAULT_BROWSER = "applink.chrome_default_browser";
-@@ -999,6 +1001,7 @@ public final class ChromePreferenceKeys {
+@@ -1125,6 +1127,7 @@ public final class ChromePreferenceKeys {
                 AUXILIARY_SEARCH_SCHEMA_VERSION,
                 APP_LAUNCH_LAST_KNOWN_ACTIVE_TAB_STATE,
                 APP_LAUNCH_SEARCH_ENGINE_HAD_LOGO,
@@ -1412,7 +1332,7 @@ diff --git a/chrome/browser/preferences/android/java/src/org/chromium/chrome/bro
 diff --git a/chrome/browser/ui/android/strings/android_chrome_strings.grd b/chrome/browser/ui/android/strings/android_chrome_strings.grd
 --- a/chrome/browser/ui/android/strings/android_chrome_strings.grd
 +++ b/chrome/browser/ui/android/strings/android_chrome_strings.grd
-@@ -249,6 +249,24 @@ CHAR_LIMIT guidelines:
+@@ -264,6 +264,24 @@ CHAR_LIMIT guidelines:
       <message name="IDS_NOTIFICATION_CATEGORY_SITES" desc="Label for notifications from websites, within a list of notification categories. [CHAR_LIMIT=32]">
         Sites
       </message>
@@ -1437,144 +1357,39 @@ diff --git a/chrome/browser/ui/android/strings/android_chrome_strings.grd b/chro
       <message name="IDS_NOTIFICATION_CATEGORY_VR" desc="Label for notifications in VR, within a list of notification categories. [CHAR_LIMIT=32]">
         Virtual Reality
       </message>
-diff --git a/chrome/common/BUILD.gn b/chrome/common/BUILD.gn
--- a/chrome/common/BUILD.gn
-+++ b/chrome/common/BUILD.gn
-@@ -352,6 +352,9 @@ static_library("common_lib") {
-     sources += [
-       "media/chrome_media_drm_bridge_client.cc",
-       "media/chrome_media_drm_bridge_client.h",
-+      ## Bromite dependencies for bookmark import functionality
-+      "//components/user_data_importer/common/imported_bookmark_entry.cc",
-+      "//components/user_data_importer/common/imported_bookmark_entry.h",
-     ]
-   } else {
-     # Non-Android.
 diff --git a/chrome/utility/BUILD.gn b/chrome/utility/BUILD.gn
 --- a/chrome/utility/BUILD.gn
 +++ b/chrome/utility/BUILD.gn
-@@ -88,8 +88,6 @@ static_library("utility") {
- 
-   if (!is_android) {
-     sources += [
-      "importer/bookmark_html_reader.cc",
-      "importer/bookmark_html_reader.h",
-       "importer/bookmarks_file_importer.cc",
-       "importer/bookmarks_file_importer.h",
-       "importer/external_process_importer_bridge.cc",
-@@ -222,6 +220,11 @@ static_library("utility") {
+@@ -211,6 +211,13 @@ static_library("utility") {
     deps += [ "//chrome/services/pdf:lib" ]
   }
 
-+  sources += [
-+    "importer/bookmark_html_reader.cc",
-+    "importer/bookmark_html_reader.h",
-+  ]
+  if (is_android) {
+    sources += [
+      "importer/bookmarks_file_importer.cc",
+      "importer/bookmarks_file_importer.h",
+    ]
+  }
 +
   # NSS decryptor is not needed on ChromeOS.
   if (!is_chromeos && use_nss_certs) {
     sources += [
-diff --git a/chrome/utility/importer/bookmark_html_reader.cc b/chrome/utility/importer/bookmark_html_reader.cc
--- a/chrome/utility/importer/bookmark_html_reader.cc
-+++ b/chrome/utility/importer/bookmark_html_reader.cc
-@@ -16,7 +16,9 @@
- #include "base/strings/string_util.h"
- #include "base/strings/utf_string_conversions.h"
- #include "base/time/time.h"
-+#if !BUILDFLAG(IS_ANDROID)
- #include "chrome/utility/importer/favicon_reencode.h"
+diff --git a/chrome/utility/importer/bookmarks_file_importer.cc b/chrome/utility/importer/bookmarks_file_importer.cc
+--- a/chrome/utility/importer/bookmarks_file_importer.cc
+++ b/chrome/utility/importer/bookmarks_file_importer.cc
+@@ -103,8 +103,12 @@ void BookmarksFileImporter::StartImport(
+       user_data_importer::ParseBookmarksUnsafe(raw_html);
+ 
+   if (!parsed_bookmarks.bookmarks.empty()) {
+#if BUILDFLAG(IS_ANDROID)
+    std::u16string first_folder_name;
+#else
+     std::u16string first_folder_name =
+         bridge_->GetLocalizedString(IDS_BOOKMARK_GROUP);
 +#endif
- #include "components/search_engines/search_terms_data.h"
- #include "components/search_engines/template_url.h"
- #include "components/user_data_importer/common/imported_bookmark_entry.h"
-@@ -55,6 +57,7 @@ bool GetAttribute(const std::string& attribute_list,
-   return true;
- }
- 
-+#if !BUILDFLAG(IS_ANDROID)
- // Given the URL of a page and a favicon data URL, adds an appropriate record
- // to the given favicon usage vector.
- void DataURLToFaviconUsage(const GURL& link_url,
-@@ -88,6 +91,7 @@ void DataURLToFaviconUsage(const GURL& link_url,
- 
-   favicons->push_back(usage);
- }
-+#endif
- 
- }  // namespace
- 
-@@ -108,14 +112,29 @@ static std::string stripDt(const std::string& lineDt) {
- }
- 
- void ImportBookmarksFile(
-    base::RepeatingCallback<bool(void)> cancellation_callback,
-    base::RepeatingCallback<bool(const GURL&)> valid_url_callback,
-+    const base::RepeatingCallback<bool(void)> cancellation_callback,
-+    const base::RepeatingCallback<bool(const GURL&)> valid_url_callback,
-     const base::FilePath& file_path,
-     std::vector<user_data_importer::ImportedBookmarkEntry>* bookmarks,
-     std::vector<user_data_importer::SearchEngineInfo>* search_engines,
-     favicon_base::FaviconUsageDataList* favicons) {
-   std::string content;
-  base::ReadFileToString(file_path, &content);
-+  if (!base::ReadFileToString(file_path, &content)) {
-+     LOG(ERROR) << "Could not directly read bookmarks import file";
-+     return;
-+  }
-+
-+  ImportBookmarksFile(cancellation_callback, valid_url_callback,
-+    content, bookmarks, search_engines, favicons);
-+}
-+
-+void ImportBookmarksFile(
-+    base::RepeatingCallback<bool(void)> cancellation_callback,
-+    base::RepeatingCallback<bool(const GURL&)> valid_url_callback,
-+    const std::string& content,
-+    std::vector<user_data_importer::ImportedBookmarkEntry>* bookmarks,
-+    std::vector<user_data_importer::SearchEngineInfo>* search_engines,
-+    favicon_base::FaviconUsageDataList* favicons) {
-   std::vector<std::string> lines = base::SplitString(
-       content, "\n", base::TRIM_WHITESPACE, base::SPLIT_WANT_ALL);
- 
-@@ -128,6 +147,7 @@ void ImportBookmarksFile(
-   std::vector<std::u16string> path;
-   size_t toolbar_folder_index = 0;
-   std::string charset = "UTF-8";  // If no charset is specified, assume utf-8.
-+
-   for (size_t i = 0;
-        i < lines.size() &&
-            (cancellation_callback.is_null() || !cancellation_callback.Run());
-@@ -219,10 +239,12 @@ void ImportBookmarksFile(
-       }
-       bookmarks->push_back(entry);
- 
-+#if !BUILDFLAG(IS_ANDROID)
-       // Save the favicon. DataURLToFaviconUsage will handle the case where
-       // there is no favicon.
-       if (favicons)
-         DataURLToFaviconUsage(url, favicon, favicons);
-+#endif
- 
-       continue;
-     }
-diff --git a/chrome/utility/importer/bookmark_html_reader.h b/chrome/utility/importer/bookmark_html_reader.h
--- a/chrome/utility/importer/bookmark_html_reader.h
-+++ b/chrome/utility/importer/bookmark_html_reader.h
-@@ -53,6 +53,14 @@ void ImportBookmarksFile(
-     std::vector<user_data_importer::SearchEngineInfo>* search_engines,
-     favicon_base::FaviconUsageDataList* favicons);
- 
-+void ImportBookmarksFile(
-+    const base::RepeatingCallback<bool(void)> cancellation_callback,
-+    const base::RepeatingCallback<bool(const GURL&)> valid_url_callback,
-+    const std::string& content,
-+    std::vector<user_data_importer::ImportedBookmarkEntry>* bookmarks,
-+    std::vector<user_data_importer::SearchEngineInfo>* search_engines,
-+    favicon_base::FaviconUsageDataList* favicons);
-+
- // Returns true if |url| should be imported as a search engine, i.e. because it
- // has replacement terms. Chrome treats such bookmarks as search engines rather
- // than true bookmarks.
+     std::erase_if(parsed_bookmarks.bookmarks,
+                   [](user_data_importer::ImportedBookmarkEntry bookmark) {
+                     return !internal::CanImportURL(bookmark.url);
 diff --git a/components/headless/select_file_dialog/headless_select_file_dialog.cc b/components/headless/select_file_dialog/headless_select_file_dialog.cc
 --- a/components/headless/select_file_dialog/headless_select_file_dialog.cc
 +++ b/components/headless/select_file_dialog/headless_select_file_dialog.cc
@@ -1589,6 +1404,29 @@ diff --git a/components/headless/select_file_dialog/headless_select_file_dialog.
   SelectFileDialogCallback callback_;
 };
 
+diff --git a/components/user_data_importer/content/content_bookmark_parser_utils.cc b/components/user_data_importer/content/content_bookmark_parser_utils.cc
+--- a/components/user_data_importer/content/content_bookmark_parser_utils.cc
+++ b/components/user_data_importer/content/content_bookmark_parser_utils.cc
+@@ -138,6 +138,7 @@ std::optional<bool> GetBoolAttribute(std::string_view attribute_list,
+ 
+ // Given the URL of a page and a favicon data URL, adds an appropriate record
+ // to the given favicon usage vector.
+[[maybe_unused]]
+ void DataURLToFaviconUsage(const GURL& link_url,
+                            const GURL& favicon_data,
+                            favicon_base::FaviconUsageDataList* favicons) {
+@@ -495,9 +496,11 @@ BookmarkParser::ParsedBookmarks ParseBookmarksUnsafe(
+       }
+       parsing_result.bookmarks.push_back(std::move(entry));
+ 
+#if !BUILDFLAG(IS_ANDROID)
+       // Save the favicon. DataURLToFaviconUsage will handle the case where
+       // there is no favicon.
+       DataURLToFaviconUsage(url, favicon, &parsing_result.favicons);
+#endif
+ 
+       continue;
+     }
 diff --git a/cromite_flags/chrome/browser/about_flags_cc/add-bookmark-import-export-actions.inc b/cromite_flags/chrome/browser/about_flags_cc/add-bookmark-import-export-actions.inc
 new file mode 100644
 --- /dev/null
@@ -1693,7 +1531,7 @@ diff --git a/ui/android/java/src/org/chromium/ui/base/SelectFileDialog.java b/ui
         return mimeTypes;
     }
 
-@@ -1155,6 +1169,10 @@ public class SelectFileDialog implements WindowAndroid.IntentCallback, PhotoPick
+@@ -1168,6 +1182,10 @@ public class SelectFileDialog implements WindowAndroid.IntentCallback, PhotoPick
         return countAcceptTypesFor(superType) == mMimeTypes.size();
     }
 
@@ -1732,8 +1570,8 @@ diff --git a/ui/shell_dialogs/select_file_dialog.h b/ui/shell_dialogs/select_fil
 diff --git a/ui/shell_dialogs/select_file_dialog_android.cc b/ui/shell_dialogs/select_file_dialog_android.cc
 --- a/ui/shell_dialogs/select_file_dialog_android.cc
 +++ b/ui/shell_dialogs/select_file_dialog_android.cc
-@@ -175,6 +175,12 @@ void SelectFileDialogImpl::SelectFileImpl(
-       owning_window->GetJavaObject());
+@@ -196,6 +196,12 @@ void SelectFileDialogImpl::SelectFileImpl(Type type,
+       suggested_name.value(), owning_window->GetJavaObject());
 }
 
 +void SelectFileDialogImpl::ShowToast(const std::string& message) {
@@ -1748,7 +1586,7 @@ diff --git a/ui/shell_dialogs/select_file_dialog_android.cc b/ui/shell_dialogs/s
 diff --git a/ui/shell_dialogs/select_file_dialog_android.h b/ui/shell_dialogs/select_file_dialog_android.h
 --- a/ui/shell_dialogs/select_file_dialog_android.h
 +++ b/ui/shell_dialogs/select_file_dialog_android.h
-@@ -53,6 +53,8 @@ class SelectFileDialogImpl : public SelectFileDialog {
+@@ -49,6 +49,8 @@ class SelectFileDialogImpl : public SelectFileDialog {
                       gfx::NativeWindow owning_window,
                       const GURL* caller) override;
 
@@ -1786,7 +1624,7 @@ diff --git a/ui/shell_dialogs/select_file_dialog_linux.h b/ui/shell_dialogs/sele
 diff --git a/ui/shell_dialogs/select_file_dialog_win.cc b/ui/shell_dialogs/select_file_dialog_win.cc
 --- a/ui/shell_dialogs/select_file_dialog_win.cc
 +++ b/ui/shell_dialogs/select_file_dialog_win.cc
-@@ -193,6 +193,7 @@ class SelectFileDialogImpl : public ui::SelectFileDialog,
+@@ -192,6 +192,7 @@ class SelectFileDialogImpl : public ui::SelectFileDialog,
                             int index);
 
   bool HasMultipleFileTypeChoicesImpl() override;
@@ -1794,7 +1632,7 @@ diff --git a/ui/shell_dialogs/select_file_dialog_win.cc b/ui/shell_dialogs/selec
 
   // Returns the filter to be used while displaying the open/save file dialog.
   // This is computed from the extensions for the file types being opened.
-@@ -270,6 +271,10 @@ bool SelectFileDialogImpl::HasMultipleFileTypeChoicesImpl() {
+@@ -269,6 +270,10 @@ bool SelectFileDialogImpl::HasMultipleFileTypeChoicesImpl() {
   return has_multiple_file_type_choices_;
 }
 
@@ -17,14 +17,14 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 base/android/feature_map.cc                   |   5 +
 .../base/cached_flags/ValuesReturned.java     |   2 +-
 base/feature_list.cc                          |  76 ++++++++
- base/feature_list.h                           |  72 +++++++-
- build/android/gyp/java_cpp_features.py        |  17 ++
+ base/feature_list.h                           |  98 +++++++++-
+ build/android/gyp/java_cpp_features.py        |  15 ++
 chrome/android/java/res/values/values.xml     |   3 +
 .../java/res/xml/privacy_preferences.xml      |   4 +
 .../homepage/settings/HomepageSettings.java   |   2 +-
 .../privacy/settings/PrivacySettings.java     |   2 +-
 .../settings/FragmentDependencyProvider.java  |  10 +-
- .../browser/settings/SettingsActivity.java    |  42 ++++-
+ .../browser/settings/SettingsActivity.java    |  41 ++++-
 .../tracing/settings/DeveloperSettings.java   |   5 +-
 chrome/browser/about_flags.cc                 |  11 ++
 chrome/browser/browser_features.cc            |   1 +
@@ -35,14 +35,13 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 .../browser/flags/ChromeFeatureList.java      |  13 +-
 .../flags/cromite/include_all_directory.java  |   1 +
 .../java_template/CromiteCachedFlag.java.tmpl |  47 +++++
- chrome/browser/settings/BUILD.gn              |   1 +
 .../settings/ChromeBaseSettingsFragment.java  |  50 +++++
 .../strings/android_chrome_strings.grd        |   1 +
 .../Add-cromite-flags-support.grdp            |   9 +
 .../placeholder.txt                           |   1 +
 chrome/browser/ui/ui_features.cc              |   1 +
 chrome/browser/unexpire_flags.cc              |  15 +-
- chrome/common/chrome_features.cc              |   1 +
+ chrome/common/chrome_features.cc              |   2 +-
 .../browser_ui/accessibility/android/BUILD.gn |   1 +
 .../res/xml/accessibility_preferences.xml     |   3 +-
 .../accessibility/AccessibilitySettings.java  |   6 +-
@@ -55,7 +54,7 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 .../core/offline_page_feature.cc              |   1 +
 .../offline_pages/core/offline_page_feature.h |   1 +
 .../browser/features/password_features.cc     |   1 +
- components/permissions/features.cc            |   2 +
+ components/permissions/features.cc            |   1 +
 ...nthetic_trials_active_group_id_provider.cc |   4 +-
 ...ynthetic_trials_active_group_id_provider.h |   4 +-
 components/webui/flags/flags_state.cc         |  59 ++++++
@@ -107,7 +106,7 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 third_party/blink/public/common/features.h    |   1 +
 ui/base/ui_base_features.cc                   |   1 +
 ui/base/ui_base_features.h                    |   1 +
- 94 files changed, 826 insertions(+), 30 deletions(-)
+ 93 files changed, 846 insertions(+), 32 deletions(-)
 create mode 100644 chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/cromite/include_all_directory.java
 create mode 100644 chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/cromite/java_template/CromiteCachedFlag.java.tmpl
 create mode 100644 chrome/browser/ui/android/strings/cromite_android_chrome_strings_grd/Add-cromite-flags-support.grdp
@@ -144,7 +143,7 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 diff --git a/base/BUILD.gn b/base/BUILD.gn
 --- a/base/BUILD.gn
 +++ b/base/BUILD.gn
-@@ -178,6 +178,8 @@ use_epoll = is_linux || is_chromeos || is_android
+@@ -174,6 +174,8 @@ use_epoll = is_linux || is_chromeos || is_android
 # This does not include test code (test support and anything in the test
 # directory) which should use source_set as is recommended for GN targets).
 component("base") {
@@ -153,7 +152,7 @@ diff --git a/base/BUILD.gn b/base/BUILD.gn
   sources = [
     "allocator/allocator_check.cc",
     "allocator/allocator_check.h",
-@@ -1036,7 +1038,7 @@ component("base") {
+@@ -1061,7 +1063,7 @@ component("base") {
     "//build/config/compiler:wglobal_constructors",
   ]
 
@@ -180,7 +179,7 @@ diff --git a/base/android/feature_map.cc b/base/android/feature_map.cc
 diff --git a/base/android/java/src/org/chromium/base/cached_flags/ValuesReturned.java b/base/android/java/src/org/chromium/base/cached_flags/ValuesReturned.java
 --- a/base/android/java/src/org/chromium/base/cached_flags/ValuesReturned.java
 +++ b/base/android/java/src/org/chromium/base/cached_flags/ValuesReturned.java
-@@ -18,7 +18,7 @@ import java.util.Map;
+@@ -18,7 +18,7 @@ import java.util.function.Supplier;
 @NullMarked
 public abstract class ValuesReturned {
     @GuardedBy("sBoolValues")
@@ -192,7 +191,7 @@ diff --git a/base/android/java/src/org/chromium/base/cached_flags/ValuesReturned
 diff --git a/base/feature_list.cc b/base/feature_list.cc
 --- a/base/feature_list.cc
 +++ b/base/feature_list.cc
-@@ -41,6 +41,31 @@
+@@ -43,6 +43,31 @@
 
 namespace base {
 
@@ -271,7 +270,7 @@ diff --git a/base/feature_list.cc b/base/feature_list.cc
 // static
 bool FeatureList::IsValidFeatureOrFieldTrialName(std::string_view name) {
   return IsStringASCII(name) && name.find_first_of(",<*") == std::string::npos;
-@@ -742,6 +807,17 @@ void FeatureList::VisitFeaturesAndParams(FeatureVisitor& visitor,
+@@ -739,6 +804,17 @@ void FeatureList::VisitFeaturesAndParams(FeatureVisitor& visitor,
 
 void FeatureList::FinalizeInitialization() {
   DCHECK(!initialized_);
@@ -292,7 +291,7 @@ diff --git a/base/feature_list.cc b/base/feature_list.cc
 diff --git a/base/feature_list.h b/base/feature_list.h
 --- a/base/feature_list.h
 +++ b/base/feature_list.h
-@@ -174,8 +174,10 @@ enum class FeatureMacroHandshake { kSecret };
+@@ -233,8 +233,10 @@ StringStorage(const char (&feature)[N]) -> StringStorage<N - 1>;
 struct BASE_EXPORT LOGICALLY_CONST Feature {
   constexpr Feature(const char* name,
                     FeatureState default_state,
@@ -305,7 +304,7 @@ diff --git a/base/feature_list.h b/base/feature_list.h
 #if BUILDFLAG(ENABLE_BANNED_BASE_FEATURE_PREFIX)
     if (std::string_view(name).find(BUILDFLAG(BANNED_BASE_FEATURE_PREFIX)) ==
         0) {
-@@ -202,6 +204,9 @@ struct BASE_EXPORT LOGICALLY_CONST Feature {
+@@ -261,6 +263,9 @@ struct BASE_EXPORT LOGICALLY_CONST Feature {
   // command line switch.
   const FeatureState default_state;
 
@@ -315,7 +314,7 @@ diff --git a/base/feature_list.h b/base/feature_list.h
  private:
   friend class FeatureList;
 
-@@ -481,6 +486,11 @@ class BASE_EXPORT FeatureList {
+@@ -541,6 +546,11 @@ class BASE_EXPORT FeatureList {
   // instance, which is checked in builds with DCHECKs enabled.
   static bool IsEnabled(const Feature& feature);
 
@@ -327,7 +326,7 @@ diff --git a/base/feature_list.h b/base/feature_list.h
   // Some characters are not allowed to appear in feature names or the
   // associated field trial names, as they are used as special characters for
   // command-line serialization. This function checks that the strings are ASCII
-@@ -750,4 +760,62 @@ class BASE_EXPORT FeatureList {
+@@ -810,4 +820,88 @@ class BASE_EXPORT FeatureList {
 
 }  // namespace base
 
@@ -388,39 +387,66 @@ diff --git a/base/feature_list.h b/base/feature_list.h
 +      g_feature_default_state_overrider_ ##feature {namespace_value::feature, base::FEATURE_DISABLED_BY_DEFAULT}; \
 +  _Pragma("clang diagnostic pop")                               \
 +  static_assert(true, "") /* for a semicolon requirement */
+
+#define BASE_FEATURE_DISABLED_3_ARGS(feature, name, default_state) \
+  BASE_FEATURE(feature, name, default_state); \
+  static_assert(default_state == base::FEATURE_DISABLED_BY_DEFAULT, "Check default state")
+
+#define BASE_FEATURE_DISABLED_2_ARGS(name, default_state) \
+  BASE_FEATURE(name, default_state); \
+  static_assert(default_state == base::FEATURE_DISABLED_BY_DEFAULT, "Check default state")
+
+#define GET_BASE_FEATURE_DISABLED_MACRO(_1, _2, _3, NAME, ...) NAME
+#define BASE_FEATURE_DISABLED(...)                                            \
+  GET_BASE_FEATURE_DISABLED_MACRO(__VA_ARGS__, BASE_FEATURE_DISABLED_3_ARGS,  \
+                                 BASE_FEATURE_DISABLED_2_ARGS)(__VA_ARGS__)
+
+#define BASE_FEATURE_ENABLED_3_ARGS(feature, name, default_state) \
+  BASE_FEATURE(feature, name, default_state); \
+  static_assert(default_state == base::FEATURE_ENABLED_BY_DEFAULT, "Check default state")
+
+#define BASE_FEATURE_ENABLED_2_ARGS(name, default_state) \
+  BASE_FEATURE(name, default_state); \
+  static_assert(default_state == base::FEATURE_ENABLED_BY_DEFAULT, "Check default state")
+
+#define GET_BASE_FEATURE_ENABLED_MACRO(_1, _2, _3, NAME, ...) NAME
+#define BASE_FEATURE_ENABLED(...)                                            \
+  GET_BASE_FEATURE_ENABLED_MACRO(__VA_ARGS__, BASE_FEATURE_ENABLED_3_ARGS,  \
+                                 BASE_FEATURE_ENABLED_2_ARGS)(__VA_ARGS__)
 +
 #endif  // BASE_FEATURE_LIST_H_
 diff --git a/build/android/gyp/java_cpp_features.py b/build/android/gyp/java_cpp_features.py
 --- a/build/android/gyp/java_cpp_features.py
 +++ b/build/android/gyp/java_cpp_features.py
-@@ -22,10 +22,27 @@ class FeatureParserDelegate(java_cpp_utils.CppConstantParser.Delegate):
+@@ -22,6 +22,11 @@ class FeatureParserDelegate(java_cpp_utils.CppConstantParser.Delegate):
   #   ExtractConstantName() -> 'ConstantName'
-   #   ExtractValue() -> '"StringNameOfTheFeature"'
-   FEATURE_RE = re.compile(r'BASE_FEATURE\(k([^,]+),')
-+
-+  FEATURE_RE1 = re.compile(r'CROMITE_FEATURE\(k([^,]+),')
-+  FEATURE_RE2 = re.compile(r'CROMITE_FEATURE_KEEP_DISABLED\(k([^,]+),')
-+  FEATURE_RE3 = re.compile(r'CROMITE_FEATURE_DISABLED\(k([^,]+),')
-+  FEATURE_RE4 = re.compile(r'CROMITE_FEATURE_KEEP_ENABLED\(k([^,]+),')
-+  FEATURE_RE5 = re.compile(r'CROMITE_FEATURE_ENABLED\(k([^,]+),')
-+
-   VALUE_RE = re.compile(r'\s*("(?:\"|[^"])*")\s*,')
+   #   ExtractValue() -> '"StringNameOfTheFeature"' or '"ConstantName"'
+   _FEATURE_RE = re.compile(r'BASE_FEATURE\(\s*(k\w+),')
+  _FEATURE_RE1 = re.compile(r'CROMITE_FEATURE\(\s*(k\w+),')
+  _FEATURE_RE2 = re.compile(r'BASE_FEATURE_DISABLED\(\s*(k\w+),')
+  _FEATURE_RE3 = re.compile(r'CROMITE_FEATURE_DISABLED\(\s*(k\w+),')
+  _FEATURE_RE4 = re.compile(r'BASE_FEATURE_ENABLED\(\s*(k\w+),')
+  _FEATURE_RE5 = re.compile(r'CROMITE_FEATURE_ENABLED\(\s*(k\w+),')
+   _STRING_LITERAL_RE = re.compile(r'"(?:\\"|[^"])*"')
+   _constant_name = None  # The name of the current macro.
+   _comma_count = 0  # Number of commas seen in the current macro.
+@@ -34,6 +39,16 @@ class FeatureParserDelegate(java_cpp_utils.CppConstantParser.Delegate):
+     self._constant_name = None
 
-   def ExtractConstantName(self, line):
-     match = FeatureParserDelegate.FEATURE_RE.match(line)
+     match = self._FEATURE_RE.match(line)
 +    if match is None:
-+      match = FeatureParserDelegate.FEATURE_RE1.match(line)
+      match = self._FEATURE_RE1.match(line)
 +    if match is None:
-+      match = FeatureParserDelegate.FEATURE_RE2.match(line)
+      match = self._FEATURE_RE2.match(line)
 +    if match is None:
-+      match = FeatureParserDelegate.FEATURE_RE3.match(line)
+      match = self._FEATURE_RE3.match(line)
 +    if match is None:
-+      match = FeatureParserDelegate.FEATURE_RE4.match(line)
+      match = self._FEATURE_RE4.match(line)
 +    if match is None:
-+      match = FeatureParserDelegate.FEATURE_RE5.match(line)
-     return match.group(1) if match else None
- 
-   def ExtractValue(self, line):
+      match = self._FEATURE_RE5.match(line)
+     if match:
+       # The regex ensures that the feature name starts with 'k'.
+       feature_name = match.group(1)
 diff --git a/chrome/android/java/res/values/values.xml b/chrome/android/java/res/values/values.xml
 --- a/chrome/android/java/res/values/values.xml
 +++ b/chrome/android/java/res/values/values.xml
@@ -437,7 +463,7 @@ diff --git a/chrome/android/java/res/values/values.xml b/chrome/android/java/res
 diff --git a/chrome/android/java/res/xml/privacy_preferences.xml b/chrome/android/java/res/xml/privacy_preferences.xml
 --- a/chrome/android/java/res/xml/privacy_preferences.xml
 +++ b/chrome/android/java/res/xml/privacy_preferences.xml
-@@ -44,6 +44,10 @@ found in the LICENSE file.
+@@ -38,6 +38,10 @@ found in the LICENSE file.
         android:key="do_not_track"
         android:title="@string/do_not_track_title"
         android:fragment="org.chromium.chrome.browser.privacy.settings.DoNotTrackSettings" />
@@ -451,7 +477,7 @@ diff --git a/chrome/android/java/res/xml/privacy_preferences.xml b/chrome/androi
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/homepage/settings/HomepageSettings.java b/chrome/android/java/src/org/chromium/chrome/browser/homepage/settings/HomepageSettings.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/homepage/settings/HomepageSettings.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/homepage/settings/HomepageSettings.java
-@@ -38,7 +38,7 @@ public class HomepageSettings extends ChromeBaseSettingsFragment {
+@@ -41,7 +41,7 @@ public class HomepageSettings extends ChromeBaseSettingsFragment {
     private final ObservableSupplierImpl<String> mPageTitle = new ObservableSupplierImpl<>();
 
     @Override
@@ -475,18 +501,18 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/privacy/setting
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/settings/FragmentDependencyProvider.java b/chrome/android/java/src/org/chromium/chrome/browser/settings/FragmentDependencyProvider.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/settings/FragmentDependencyProvider.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/settings/FragmentDependencyProvider.java
-@@ -12,6 +12,7 @@ import androidx.fragment.app.Fragment;
+@@ -10,6 +10,7 @@ import android.os.Bundle;
+ import androidx.fragment.app.Fragment;
 import androidx.fragment.app.FragmentManager;
 
- import org.chromium.base.IntentUtils;
-+import org.chromium.base.supplier.Supplier;
+import java.util.function.Supplier;
 import org.chromium.base.supplier.ObservableSupplier;
 import org.chromium.base.supplier.OneshotSupplier;
- import org.chromium.chrome.browser.LaunchIntentDispatcher;
-@@ -76,18 +77,21 @@ public class FragmentDependencyProvider extends FragmentManager.FragmentLifecycl
+ import org.chromium.build.annotations.NullMarked;
+@@ -68,24 +69,31 @@ public class FragmentDependencyProvider extends FragmentManager.FragmentLifecycl
     private final OneshotSupplier<SnackbarManager> mSnackbarManagerSupplier;
     private final OneshotSupplier<BottomSheetController> mBottomSheetControllerSupplier;
-     private final ObservableSupplier<ModalDialogManager> mModalDialogManagerSupplier;
+     private final ObservableSupplier<@Nullable ModalDialogManager> mModalDialogManagerSupplier;
 +    private final Supplier<ChromeBaseSettingsFragment.RequireRestartDelegate> mRequireRestartDelegateSupplier;
 
     public FragmentDependencyProvider(
@@ -494,8 +520,8 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/settings/Fragme
             Profile profile,
             OneshotSupplier<SnackbarManager> snackbarManagerSupplier,
             OneshotSupplier<BottomSheetController> bottomSheetControllerSupplier,
-            ObservableSupplier<ModalDialogManager> modalDialogManagerSupplier) {
-+            ObservableSupplier<ModalDialogManager> modalDialogManagerSupplier,
+-            ObservableSupplier<@Nullable ModalDialogManager> modalDialogManagerSupplier) {
+            ObservableSupplier<@Nullable ModalDialogManager> modalDialogManagerSupplier,
 +            Supplier<ChromeBaseSettingsFragment.RequireRestartDelegate> requireRestartDelegateSupplier) {
         mContext = context;
         mProfile = profile;
@@ -506,9 +532,8 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/settings/Fragme
     }
 
     @Override
-@@ -96,6 +100,10 @@ public class FragmentDependencyProvider extends FragmentManager.FragmentLifecycl
-             @NonNull Fragment fragment,
-             @NonNull Context unusedContext) {
+     public void onFragmentAttached(
+             FragmentManager fragmentManager, Fragment fragment, Context unusedContext) {
         // Common dependencies attachments.
 +        if (fragment instanceof ChromeBaseSettingsFragment) {
 +            ((ChromeBaseSettingsFragment)fragment).setRequestRestartDelegateSupplier(
@@ -520,25 +545,23 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/settings/Fragme
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/settings/SettingsActivity.java b/chrome/android/java/src/org/chromium/chrome/browser/settings/SettingsActivity.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/settings/SettingsActivity.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/settings/SettingsActivity.java
-@@ -4,6 +4,7 @@
+@@ -6,6 +6,7 @@ package org.chromium.chrome.browser.settings;
 
- package org.chromium.chrome.browser.settings;
+ import static org.chromium.build.NullUtil.assumeNonNull;
 
 +import android.app.Activity;
 import android.annotation.SuppressLint;
+ import android.app.ActivityManager;
 import android.content.Context;
- import android.content.Intent;
-@@ -34,7 +35,9 @@ import org.chromium.base.Callback;
- import org.chromium.base.CallbackUtils;
- import org.chromium.base.Log;
+@@ -43,6 +44,7 @@ import org.chromium.base.Log;
 import org.chromium.base.metrics.RecordHistogram;
-+import org.chromium.base.supplier.Supplier;
+ import org.chromium.base.metrics.RecordUserAction;
 import org.chromium.base.supplier.ObservableSupplier;
 +import org.chromium.base.supplier.OneshotSupplier;
 import org.chromium.base.supplier.OneshotSupplierImpl;
- import org.chromium.chrome.R;
- import org.chromium.chrome.browser.ChromeBaseAppCompatActivity;
-@@ -42,12 +45,14 @@ import org.chromium.chrome.browser.back_press.BackPressHelper;
+ import org.chromium.build.annotations.NullMarked;
+ import org.chromium.build.annotations.Nullable;
+@@ -54,6 +56,7 @@ import org.chromium.chrome.browser.back_press.BackPressHelper.OnKeyDownHandler;
 import org.chromium.chrome.browser.feedback.HelpAndFeedbackLauncherImpl;
 import org.chromium.chrome.browser.flags.ChromeFeatureList;
 import org.chromium.chrome.browser.init.ChromeBrowserInitializer;
@@ -546,6 +569,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/settings/Settin
 import org.chromium.chrome.browser.profiles.Profile;
 import org.chromium.chrome.browser.profiles.ProfileManager;
 import org.chromium.chrome.browser.profiles.ProfileManagerUtils;
+@@ -61,6 +64,7 @@ import org.chromium.chrome.browser.settings.search.SettingsSearchCoordinator;
 import org.chromium.chrome.browser.ui.device_lock.MissingDeviceLockLauncher;
 import org.chromium.chrome.browser.ui.messages.snackbar.SnackbarManager;
 import org.chromium.chrome.browser.ui.messages.snackbar.SnackbarManager.SnackbarManageable;
@@ -553,8 +577,8 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/settings/Settin
 import org.chromium.components.browser_ui.bottomsheet.BottomSheetController;
 import org.chromium.components.browser_ui.bottomsheet.BottomSheetControllerFactory;
 import org.chromium.components.browser_ui.bottomsheet.ManagedBottomSheetController;
-@@ -89,6 +94,40 @@ public class SettingsActivity extends ChromeBaseAppCompatActivity
-         implements PreferenceFragmentCompat.OnPreferenceStartFragmentCallback, SnackbarManageable {
+@@ -115,6 +119,40 @@ public class SettingsActivity extends ChromeBaseAppCompatActivity
+                 PreferenceUpdateObserver {
     private static final String TAG = "SettingsActivity";
 
 +    private static class RequestRestartDelegate implements ChromeBaseSettingsFragment.RequireRestartDelegate {
@@ -581,7 +605,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/settings/Settin
 +                                    ApplicationLifetime.terminate(true);
 +                            }
 +                        }, Snackbar.TYPE_NOTIFICATION, Snackbar.UMA_UNKNOWN)
-+                        .setSingleLine(false)
+                        .setDefaultLines(false)
 +                        .setAction(mActivity.getString(R.string.relaunch),
 +                                /*actionData*/null)
 +                        .setDuration(/*durationMs*/70000);
@@ -594,46 +618,42 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/settings/Settin
     @VisibleForTesting(otherwise = VisibleForTesting.PACKAGE_PRIVATE)
     public static final String EXTRA_SHOW_FRAGMENT = "show_fragment";
 
-@@ -155,7 +194,8 @@ public class SettingsActivity extends ChromeBaseAppCompatActivity
+@@ -205,7 +243,8 @@ public class SettingsActivity extends ChromeBaseAppCompatActivity
                         mProfile,
                         mSnackbarManagerSupplier,
                         mBottomSheetControllerSupplier,
 -                        getModalDialogManagerSupplier()),
 +                        getModalDialogManagerSupplier(),
 +                        () -> new RequestRestartDelegate(mSnackbarManagerSupplier, this)),
-                 true /* recursive */);
+                 /* recursive= */ true);
         fragmentManager.registerFragmentLifecycleCallbacks(
-                 new WideDisplayPaddingApplier(), false /* recursive */);
+                 new WideDisplayPaddingApplier(), /* recursive= */ true);
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tracing/settings/DeveloperSettings.java b/chrome/android/java/src/org/chromium/chrome/browser/tracing/settings/DeveloperSettings.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/tracing/settings/DeveloperSettings.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/tracing/settings/DeveloperSettings.java
-@@ -17,11 +17,12 @@ import org.chromium.base.version_info.VersionInfo;
- import org.chromium.chrome.R;
- import org.chromium.chrome.browser.preferences.ChromePreferenceKeys;
- import org.chromium.chrome.browser.preferences.ChromeSharedPreferences;
-+import org.chromium.chrome.browser.settings.ChromeBaseSettingsFragment;
- import org.chromium.components.browser_ui.settings.EmbeddableSettingsPage;
- import org.chromium.components.browser_ui.settings.SettingsUtils;
+@@ -23,8 +23,7 @@ import org.chromium.components.browser_ui.settings.SettingsUtils;
 
 /** Settings fragment containing preferences aimed at Chrome and web developers. */
-public class DeveloperSettings extends PreferenceFragmentCompat implements EmbeddableSettingsPage {
+ @NullMarked
+-public class DeveloperSettings extends ChromeBaseSettingsFragment
+-        implements EmbeddableSettingsPage {
 +public class DeveloperSettings extends ChromeBaseSettingsFragment implements EmbeddableSettingsPage {
     private static final String UI_PREF_BETA_STABLE_HINT = "beta_stable_hint";
 
     // Non-translated strings:
-@@ -52,7 +53,7 @@ public class DeveloperSettings extends PreferenceFragmentCompat implements Embed
+@@ -55,7 +54,7 @@ public class DeveloperSettings extends ChromeBaseSettingsFragment
     }
 
     @Override
-    public void onCreatePreferences(Bundle savedInstanceState, String s) {
-+    public void onCreatePreferencesCromite(Bundle savedInstanceState, String s) {
+-    public void onCreatePreferences(@Nullable Bundle savedInstanceState, @Nullable String s) {
+    public void onCreatePreferencesCromite(@Nullable Bundle savedInstanceState, @Nullable String s) {
         SettingsUtils.addPreferencesFromResource(this, R.xml.developer_preferences);
 
         if (VersionInfo.isBetaBuild() || VersionInfo.isStableBuild()) {
 diff --git a/chrome/browser/about_flags.cc b/chrome/browser/about_flags.cc
 --- a/chrome/browser/about_flags.cc
 +++ b/chrome/browser/about_flags.cc
-@@ -406,6 +406,10 @@ using flags_ui::kOsLinux;
+@@ -389,6 +389,10 @@ using flags_ui::kOsLinux;
 using flags_ui::kOsMac;
 using flags_ui::kOsWin;
 
@@ -644,9 +664,9 @@ diff --git a/chrome/browser/about_flags.cc b/chrome/browser/about_flags.cc
 namespace about_flags {
 
 namespace {
-@@ -4705,6 +4709,10 @@ const FeatureEntry::FeatureVariation kHistorySyncOptinExpansionPillVariations[]
-      nullptr}};
- #endif  // BUILDFLAG(ENABLE_DICE_SUPPORT)
+@@ -5291,6 +5295,10 @@ const FeatureEntry::Choice kOmniboxAutofocusOnIncognitoNtpChoices[] = {
+ };
+ #endif  // !BUILDFLAG(IS_ANDROID)
 
 +#define FEATURE_PARAM_SECTION
 +#include "cromite_flags/chrome_browser_about_flags_cc.inc"
@@ -655,7 +675,7 @@ diff --git a/chrome/browser/about_flags.cc b/chrome/browser/about_flags.cc
 // RECORDING USER METRICS FOR FLAGS:
 // -----------------------------------------------------------------------------
 // The first line of the entry is the internal name.
-@@ -4731,6 +4739,9 @@ const FeatureEntry::FeatureVariation kHistorySyncOptinExpansionPillVariations[]
+@@ -5317,6 +5325,9 @@ const FeatureEntry::Choice kOmniboxAutofocusOnIncognitoNtpChoices[] = {
 const FeatureEntry kFeatureEntries[] = {
 // Include generated flags for flag unexpiry; see //docs/flag_expiry.md and
 // //tools/flags/generate_unexpire_flags.py.
@@ -668,16 +688,16 @@ diff --git a/chrome/browser/about_flags.cc b/chrome/browser/about_flags.cc
 diff --git a/chrome/browser/browser_features.cc b/chrome/browser/browser_features.cc
 --- a/chrome/browser/browser_features.cc
 +++ b/chrome/browser/browser_features.cc
-@@ -359,4 +359,5 @@ BASE_FEATURE(kRemovalOfIWAsFromTabCapture,
-              "RemovalOfIWAsFromTabCapture",
-              base::FEATURE_ENABLED_BY_DEFAULT);
+@@ -284,4 +284,5 @@ BASE_FEATURE(kReportPakFileIntegrity,
+ // show both in Chrome Tabs and Windows.
+ BASE_FEATURE(kRemovalOfIWAsFromTabCapture, base::FEATURE_ENABLED_BY_DEFAULT);
 
 +#include "cromite_flags/chrome_browser_browser_features_cc.inc"
 }  // namespace features
 diff --git a/chrome/browser/browser_features.h b/chrome/browser/browser_features.h
 --- a/chrome/browser/browser_features.h
 +++ b/chrome/browser/browser_features.h
-@@ -135,6 +135,7 @@ BASE_DECLARE_FEATURE(kRemovalOfIWAsFromTabCapture);
+@@ -118,6 +118,7 @@ BASE_DECLARE_FEATURE(kRemovalOfIWAsFromTabCapture);
 // module, e.g.
 // //chrome/browser/<foo_module>/features.h
 //
@@ -688,7 +708,7 @@ diff --git a/chrome/browser/browser_features.h b/chrome/browser/browser_features
 diff --git a/chrome/browser/flags/BUILD.gn b/chrome/browser/flags/BUILD.gn
 --- a/chrome/browser/flags/BUILD.gn
 +++ b/chrome/browser/flags/BUILD.gn
-@@ -12,9 +12,14 @@ android_library("java") {
+@@ -13,9 +13,14 @@ android_library("java") {
     "android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureMap.java",
     "android/java/src/org/chromium/chrome/browser/flags/ChromeSessionState.java",
   ]
@@ -703,7 +723,7 @@ diff --git a/chrome/browser/flags/BUILD.gn b/chrome/browser/flags/BUILD.gn
     "//base/version_info/android:version_constants_java",
     "//build:android_buildflags",
     "//build:chromeos_buildflags",
-@@ -25,12 +30,20 @@ android_library("java") {
+@@ -27,12 +32,20 @@ android_library("java") {
     "//third_party/jni_zero:jni_zero_java",
   ]
   srcjar_deps = [
@@ -727,28 +747,29 @@ diff --git a/chrome/browser/flags/BUILD.gn b/chrome/browser/flags/BUILD.gn
 diff --git a/chrome/browser/flags/android/chrome_feature_list.cc b/chrome/browser/flags/android/chrome_feature_list.cc
 --- a/chrome/browser/flags/android/chrome_feature_list.cc
 +++ b/chrome/browser/flags/android/chrome_feature_list.cc
-@@ -1348,5 +1348,6 @@ BASE_FEATURE(kWebOtpCrossDeviceSimpleString,
-              "WebOtpCrossDeviceSimpleString",
-              base::FEATURE_DISABLED_BY_DEFAULT);
+@@ -840,6 +840,7 @@ BASE_FEATURE(kXplatSyncedSetup, base::FEATURE_DISABLED_BY_DEFAULT);
+ 
+ // clang-format on
 
 +#include "cromite_flags/chrome_browser_flags_android_chrome_feature_list_cc.inc"
 }  // namespace android
 }  // namespace chrome
+ 
 diff --git a/chrome/browser/flags/android/chrome_feature_list.h b/chrome/browser/flags/android/chrome_feature_list.h
 --- a/chrome/browser/flags/android/chrome_feature_list.h
 +++ b/chrome/browser/flags/android/chrome_feature_list.h
-@@ -286,6 +286,7 @@ constexpr base::FeatureParam<std::string> kQuickDeleteAndroidSurveyTriggerId(
-     "trigger_id",
-     /*default_value=*/"");
+@@ -375,6 +375,7 @@ inline constexpr base::FeatureParam<bool>
+                                            "snippet_as_subtitle",
+                                            /*default_value=*/false);
 
 +#include "cromite_flags/chrome_browser_flags_android_chrome_feature_list_h.inc"
- }  // namespace android
- }  // namespace chrome
+ }  // namespace chrome::android
 
+ #endif  // CHROME_BROWSER_FLAGS_ANDROID_CHROME_FEATURE_LIST_H_
 diff --git a/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureList.java b/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureList.java
 --- a/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureList.java
 +++ b/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureList.java
-@@ -19,6 +19,10 @@ import org.chromium.components.cached_flags.DoubleCachedFeatureParam;
+@@ -20,6 +20,10 @@ import org.chromium.components.cached_flags.DoubleCachedFeatureParam;
 import org.chromium.components.cached_flags.IntCachedFeatureParam;
 import org.chromium.components.cached_flags.StringCachedFeatureParam;
 
@@ -759,18 +780,18 @@ diff --git a/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/f
 import java.util.List;
 import java.util.Map;
 
-@@ -924,7 +928,7 @@ public abstract class ChromeFeatureList {
-     public static final CachedFlag sWebApkMinShellApkVersion =
+@@ -1118,7 +1122,7 @@ public abstract class ChromeFeatureList {
             newCachedFlag(WEB_APK_MIN_SHELL_APK_VERSION, true);
+     // keep-sorted end
 
 -    public static final List<CachedFlag> sFlagsCachedFullBrowser =
 +    public static final List<CachedFlag> sFlagsCachedFullBrowserChromium =
             List.of(
+                     // keep-sorted start
                     sAccountForSuppressedKeyboardInsets,
-                     sAllowTabClosingUponMinimization,
-@@ -1048,6 +1052,13 @@ public abstract class ChromeFeatureList {
-                     sUseLibunwindstackNativeUnwinderAndroid,
-                     sWebApkMinShellApkVersion);
+@@ -1282,6 +1286,13 @@ public abstract class ChromeFeatureList {
+                     // keep-sorted end
+                     );
 
 +    private static <T> List<T> concatenateLists(List<T>... collections) {
 +        return Arrays.stream(collections).flatMap(x -> x.stream()).collect(Collectors.toList());
@@ -840,29 +861,19 @@ new file mode 100644
 +    }}
 +
 +}}
-diff --git a/chrome/browser/settings/BUILD.gn b/chrome/browser/settings/BUILD.gn
--- a/chrome/browser/settings/BUILD.gn
-+++ b/chrome/browser/settings/BUILD.gn
-@@ -35,6 +35,7 @@ android_library("java") {
-     "//base:base_java",
-     "//chrome/browser/feedback/android:factory_java",
-     "//chrome/browser/feedback/android:java",
-+    "//chrome/browser/flags:java",
-     "//chrome/browser/preferences:java",
-     "//chrome/browser/profiles/android:java",
-     "//chrome/browser/ui/android/favicon:java",
 diff --git a/chrome/browser/settings/android/java/src/org/chromium/chrome/browser/settings/ChromeBaseSettingsFragment.java b/chrome/browser/settings/android/java/src/org/chromium/chrome/browser/settings/ChromeBaseSettingsFragment.java
 --- a/chrome/browser/settings/android/java/src/org/chromium/chrome/browser/settings/ChromeBaseSettingsFragment.java
 +++ b/chrome/browser/settings/android/java/src/org/chromium/chrome/browser/settings/ChromeBaseSettingsFragment.java
-@@ -8,12 +8,19 @@ import androidx.preference.PreferenceFragmentCompat;
- 
+@@ -9,6 +9,7 @@ import androidx.preference.PreferenceFragmentCompat;
 import org.chromium.build.annotations.Initializer;
 import org.chromium.build.annotations.NullMarked;
-+import org.chromium.base.supplier.Supplier;
+ import org.chromium.build.annotations.Nullable;
+import java.util.function.Supplier;
 import org.chromium.chrome.browser.feedback.HelpAndFeedbackLauncher;
 import org.chromium.chrome.browser.feedback.HelpAndFeedbackLauncherFactory;
- import org.chromium.chrome.browser.profiles.Profile;
- import org.chromium.components.browser_ui.settings.EmbeddableSettingsPage;
+ import org.chromium.chrome.browser.flags.ChromeFeatureList;
+@@ -18,6 +19,12 @@ import org.chromium.components.browser_ui.settings.EmbeddableSettingsPage;
+ import org.chromium.components.browser_ui.settings.PreferenceUpdateObserver;
 import org.chromium.components.browser_ui.settings.SettingsCustomTabLauncher;
 
 +import android.os.Bundle;
@@ -874,9 +885,9 @@ diff --git a/chrome/browser/settings/android/java/src/org/chromium/chrome/browse
 /**
  * Base class for settings in Chrome.
  *
-@@ -28,6 +35,49 @@ public abstract class ChromeBaseSettingsFragment extends PreferenceFragmentCompa
-     private Profile mProfile;
+@@ -35,6 +42,49 @@ public abstract class ChromeBaseSettingsFragment extends PreferenceFragmentCompa
     private SettingsCustomTabLauncher mCustomTabLauncher;
+     private @Nullable PreferenceUpdateObserver mPreferenceUpdateObserver;
 
 +    private Supplier<ChromeBaseSettingsFragment.RequireRestartDelegate> mRequireRestartDelegateSupplier;
 +
@@ -958,18 +969,18 @@ new file mode 100644
 diff --git a/chrome/browser/ui/ui_features.cc b/chrome/browser/ui/ui_features.cc
 --- a/chrome/browser/ui/ui_features.cc
 +++ b/chrome/browser/ui/ui_features.cc
-@@ -500,4 +500,5 @@ bool HasTabSearchToolbarButton() {
-   return has_tab_search_toolbar_button;
- }
+@@ -788,4 +788,5 @@ BASE_FEATURE(kWhatsNewDesktopRefresh, base::FEATURE_DISABLED_BY_DEFAULT);
+ 
+ BASE_FEATURE(kTabGroupsFocusing, base::FEATURE_DISABLED_BY_DEFAULT);
 
 +#include "cromite_flags/chrome_browser_ui_ui_features_cc.inc"
 }  // namespace features
 diff --git a/chrome/browser/unexpire_flags.cc b/chrome/browser/unexpire_flags.cc
 --- a/chrome/browser/unexpire_flags.cc
 +++ b/chrome/browser/unexpire_flags.cc
-@@ -12,6 +12,7 @@
- #include "base/containers/contains.h"
+@@ -11,6 +11,7 @@
 #include "base/containers/flat_map.h"
+ #include "base/feature_list.h"
 #include "base/no_destructor.h"
 +#include "chrome/browser/about_flags.h"
 #include "chrome/browser/expired_flags_list.h"
@@ -999,23 +1010,24 @@ diff --git a/chrome/browser/unexpire_flags.cc b/chrome/browser/unexpire_flags.cc
 diff --git a/chrome/common/chrome_features.cc b/chrome/common/chrome_features.cc
 --- a/chrome/common/chrome_features.cc
 +++ b/chrome/common/chrome_features.cc
-@@ -1795,4 +1795,5 @@ BASE_FEATURE(kDisableShortcutsEnableDiy,
-              "DisableShortcutsEnableDiy",
-              base::FEATURE_ENABLED_BY_DEFAULT);
- 
+@@ -1906,5 +1906,5 @@ BASE_FEATURE(kDisableShortcutsEnableDiy, base::FEATURE_ENABLED_BY_DEFAULT);
+ // happen silently without prompting an updating dialog.
+ BASE_FEATURE(kSilentPolicyAndDefaultAppUpdating,
+              base::FEATURE_DISABLED_BY_DEFAULT);
+-
 +#include "cromite_flags/chrome_common_chrome_features_cc.inc"
 }  // namespace features
 diff --git a/components/browser_ui/accessibility/android/BUILD.gn b/components/browser_ui/accessibility/android/BUILD.gn
 --- a/components/browser_ui/accessibility/android/BUILD.gn
 +++ b/components/browser_ui/accessibility/android/BUILD.gn
-@@ -55,6 +55,7 @@ android_library("lib_java") {
+@@ -73,6 +73,7 @@ android_library("lib_java") {
     ":page_zoom_utils_java",
     "//base:base_java",
     "//build/android:build_java",
 +    "//chrome/browser/settings:java",
     "//components/browser_ui/settings/android:java",
     "//components/browser_ui/site_settings/android:java",
-     "//components/cached_flags:java",
+     "//components/browser_ui/styles/android:java",
 diff --git a/components/browser_ui/accessibility/android/java/res/xml/accessibility_preferences.xml b/components/browser_ui/accessibility/android/java/res/xml/accessibility_preferences.xml
 --- a/components/browser_ui/accessibility/android/java/res/xml/accessibility_preferences.xml
 +++ b/components/browser_ui/accessibility/android/java/res/xml/accessibility_preferences.xml
@@ -1026,15 +1038,15 @@ diff --git a/components/browser_ui/accessibility/android/java/res/xml/accessibil
 -<PreferenceScreen xmlns:android="http://schemas.android.com/apk/res/android">
 +<PreferenceScreen xmlns:android="http://schemas.android.com/apk/res/android"
 +                  xmlns:app="http://schemas.android.com/apk/res-auto">
- 
-     <org.chromium.components.browser_ui.accessibility.PageZoomPreference
-         android:key="page_zoom_default_zoom"
+     <Preference
+         android:key="zoom_info"
+         android:title="@string/zoom_info_preference_title"/>
 diff --git a/components/browser_ui/accessibility/android/java/src/org/chromium/components/browser_ui/accessibility/AccessibilitySettings.java b/components/browser_ui/accessibility/android/java/src/org/chromium/components/browser_ui/accessibility/AccessibilitySettings.java
 --- a/components/browser_ui/accessibility/android/java/src/org/chromium/components/browser_ui/accessibility/AccessibilitySettings.java
 +++ b/components/browser_ui/accessibility/android/java/src/org/chromium/components/browser_ui/accessibility/AccessibilitySettings.java
-@@ -28,9 +28,11 @@ import org.chromium.components.omnibox.OmniboxFeatures;
- import org.chromium.content_public.browser.ContentFeatureList;
+@@ -30,9 +30,11 @@ import org.chromium.content_public.browser.ContentFeatureList;
 import org.chromium.content_public.browser.ContentFeatureMap;
+ import org.chromium.ui.base.UiAndroidFeatureList;
 
 +import org.chromium.chrome.browser.settings.ChromeBaseSettingsFragment;
 +
@@ -1042,10 +1054,10 @@ diff --git a/components/browser_ui/accessibility/android/java/src/org/chromium/c
 @NullMarked
 -public class AccessibilitySettings extends PreferenceFragmentCompat
 +public class AccessibilitySettings extends ChromeBaseSettingsFragment
-         implements EmbeddableSettingsPage, Preference.OnPreferenceChangeListener {
-     public static final String PREF_PAGE_ZOOM_DEFAULT_ZOOM = "page_zoom_default_zoom";
-     public static final String PREF_PAGE_ZOOM_INCLUDE_OS_ADJUSTMENT =
-@@ -69,7 +71,7 @@ public class AccessibilitySettings extends PreferenceFragmentCompat
+         implements EmbeddableSettingsPage,
+                 Preference.OnPreferenceChangeListener,
+                 CustomDividerFragment {
+@@ -78,7 +80,7 @@ public class AccessibilitySettings extends PreferenceFragmentCompat
     }
 
     @Override
@@ -1053,7 +1065,7 @@ diff --git a/components/browser_ui/accessibility/android/java/src/org/chromium/c
 +    public void onCreatePreferencesCromite(@Nullable Bundle savedInstanceState, @Nullable String rootKey) {
         SettingsUtils.addPreferencesFromResource(this, R.xml.accessibility_preferences);
 
-         mPageZoomDefaultZoomPref = findPreference(PREF_PAGE_ZOOM_DEFAULT_ZOOM);
+         // TODO(crbug.com/439911511): Add PageZoomPreference directly to the xml file instead.
 diff --git a/components/browser_ui/settings/android/java/res/values/attrs.xml b/components/browser_ui/settings/android/java/res/values/attrs.xml
 --- a/components/browser_ui/settings/android/java/res/values/attrs.xml
 +++ b/components/browser_ui/settings/android/java/res/values/attrs.xml
@@ -1071,7 +1083,7 @@ diff --git a/components/browser_ui/settings/android/java/res/values/attrs.xml b/
 diff --git a/components/browser_ui/settings/android/widget/java/src/org/chromium/components/browser_ui/settings/ChromeSwitchPreference.java b/components/browser_ui/settings/android/widget/java/src/org/chromium/components/browser_ui/settings/ChromeSwitchPreference.java
 --- a/components/browser_ui/settings/android/widget/java/src/org/chromium/components/browser_ui/settings/ChromeSwitchPreference.java
 +++ b/components/browser_ui/settings/android/widget/java/src/org/chromium/components/browser_ui/settings/ChromeSwitchPreference.java
-@@ -13,6 +13,8 @@ import android.view.accessibility.AccessibilityEvent;
+@@ -15,6 +15,8 @@ import android.view.accessibility.AccessibilityEvent;
 import android.view.accessibility.AccessibilityNodeInfo;
 import android.widget.TextView;
 
@@ -1080,7 +1092,7 @@ diff --git a/components/browser_ui/settings/android/widget/java/src/org/chromium
 import androidx.annotation.ColorInt;
 import androidx.annotation.VisibleForTesting;
 import androidx.preference.PreferenceViewHolder;
-@@ -38,6 +40,11 @@ public class ChromeSwitchPreference extends SwitchPreferenceCompat {
+@@ -42,6 +44,11 @@ public class ChromeSwitchPreference extends SwitchPreferenceCompat implements Co
     /** Indicates if the preference uses a custom layout. */
     private final boolean mHasCustomLayout;
 
@@ -1092,7 +1104,7 @@ diff --git a/components/browser_ui/settings/android/widget/java/src/org/chromium
     // TOOD(crbug.com/1451550): This is an interim solution. In the long-term, we should migrate
     // away from a switch with dynamically changing summaries onto a radio group.
     /**
-@@ -57,6 +64,18 @@ public class ChromeSwitchPreference extends SwitchPreferenceCompat {
+@@ -66,6 +73,18 @@ public class ChromeSwitchPreference extends SwitchPreferenceCompat implements Co
 
         mHasCustomLayout = ManagedPreferencesUtils.isCustomLayoutApplied(context, attrs);
         mUseSummaryAsTitle = true;
@@ -1114,7 +1126,7 @@ diff --git a/components/browser_ui/settings/android/widget/java/src/org/chromium
 diff --git a/components/cached_flags/android/java/src/org/chromium/components/cached_flags/CachedFlag.java b/components/cached_flags/android/java/src/org/chromium/components/cached_flags/CachedFlag.java
 --- a/components/cached_flags/android/java/src/org/chromium/components/cached_flags/CachedFlag.java
 +++ b/components/cached_flags/android/java/src/org/chromium/components/cached_flags/CachedFlag.java
-@@ -155,7 +155,7 @@ public class CachedFlag extends Flag {
+@@ -159,7 +159,7 @@ public class CachedFlag extends Flag {
         editor.putBoolean(getSharedPreferenceKey(), featureValue);
     }
 
@@ -1123,7 +1135,7 @@ diff --git a/components/cached_flags/android/java/src/org/chromium/components/ca
         // Create the key only once to avoid String concatenation every flag check.
         if (mPreferenceKey == null) {
             mPreferenceKey = CachedFlagsSharedPreferences.FLAGS_CACHED.createKey(mFeatureName);
-@@ -163,6 +163,12 @@ public class CachedFlag extends Flag {
+@@ -167,6 +167,12 @@ public class CachedFlag extends Flag {
         return mPreferenceKey;
     }
 
@@ -1146,13 +1158,13 @@ diff --git a/components/components_strings.grd b/components/components_strings.g
 +      <part file="cromite_components_strings_grd/placeholder.txt"/>
       <part file="arc_strings.grdp" />
       <part file="autofill_payments_strings.grdp" />
-       <part file="autofill_prediction_improvements_strings.grdp" />
+       <part file="autofill_strings.grdp" />
 diff --git a/components/content_settings/core/common/features.cc b/components/content_settings/core/common/features.cc
 --- a/components/content_settings/core/common/features.cc
 +++ b/components/content_settings/core/common/features.cc
-@@ -167,5 +167,6 @@ BASE_FEATURE(kForceAllowStorageAccess,
-              "ForceAllowStorageAccess",
-              base::FEATURE_DISABLED_BY_DEFAULT);
+@@ -143,5 +143,6 @@ const base::FeatureParam<EnableForIframeTypes>
+ 
+ BASE_FEATURE(kForceAllowStorageAccess, base::FEATURE_DISABLED_BY_DEFAULT);
 
 +#include "cromite_flags/components_content_settings_core_common_features_cc.inc"
 }  // namespace features
@@ -1166,7 +1178,7 @@ new file mode 100644
 diff --git a/components/offline_pages/core/offline_page_feature.cc b/components/offline_pages/core/offline_page_feature.cc
 --- a/components/offline_pages/core/offline_page_feature.cc
 +++ b/components/offline_pages/core/offline_page_feature.cc
-@@ -48,4 +48,5 @@ bool IsOfflinePagesNetworkStateLikelyUnknown() {
+@@ -47,4 +47,5 @@ bool IsOfflinePagesNetworkStateLikelyUnknown() {
   return base::FeatureList::IsEnabled(kOfflinePagesNetworkStateLikelyUnknown);
 }
 
@@ -1186,8 +1198,8 @@ diff --git a/components/offline_pages/core/offline_page_feature.h b/components/o
 diff --git a/components/password_manager/core/browser/features/password_features.cc b/components/password_manager/core/browser/features/password_features.cc
 --- a/components/password_manager/core/browser/features/password_features.cc
 +++ b/components/password_manager/core/browser/features/password_features.cc
-@@ -183,4 +183,5 @@ BASE_FEATURE(kImprovedPasswordChangeService,
-              "ImprovedPasswordChangeService",
+@@ -201,4 +201,5 @@ BASE_FEATURE(kRetrieveTrustedVaultKeyKeyboardAccessoryAction,
+ BASE_FEATURE(kUseActionablesForImprovedPasswordChange,
              base::FEATURE_DISABLED_BY_DEFAULT);
 
 +#include "cromite_flags/components_password_manager_core_browser_features_password_features_cc.inc"
@@ -1195,15 +1207,14 @@ diff --git a/components/password_manager/core/browser/features/password_features
 diff --git a/components/permissions/features.cc b/components/permissions/features.cc
 --- a/components/permissions/features.cc
 +++ b/components/permissions/features.cc
-@@ -146,6 +146,8 @@ BASE_FEATURE(kOsAdditionalSecurityPermissionKillSwitch,
-              "OsAdditionalSecurityPermissionKillSwitch",
+@@ -120,6 +120,7 @@ BASE_FEATURE(kReturnDeniedForNotificationsWhenNoAppLevelSettings,
+ BASE_FEATURE(kPermissionPredictionsGeolocationAccuracy,
              base::FEATURE_DISABLED_BY_DEFAULT);
- #endif
-+
+ 
 +#include "cromite_flags/components_permissions_features_cc.inc"
 }  // namespace features
- namespace feature_params {
 
+ namespace feature_params {
 diff --git a/components/variations/synthetic_trials_active_group_id_provider.cc b/components/variations/synthetic_trials_active_group_id_provider.cc
 --- a/components/variations/synthetic_trials_active_group_id_provider.cc
 +++ b/components/variations/synthetic_trials_active_group_id_provider.cc
@@ -1249,7 +1260,7 @@ diff --git a/components/variations/synthetic_trials_active_group_id_provider.h b
 diff --git a/components/webui/flags/flags_state.cc b/components/webui/flags/flags_state.cc
 --- a/components/webui/flags/flags_state.cc
 +++ b/components/webui/flags/flags_state.cc
-@@ -376,6 +376,21 @@ void FlagsState::GetSwitchesAndFeaturesFromFlags(
+@@ -377,6 +377,21 @@ void FlagsState::GetSwitchesAndFeaturesFromFlags(
 
   for (const std::string& entry_name : enabled_entries) {
     const auto& entry_it = name_to_switch_map.find(entry_name);
@@ -1271,7 +1282,7 @@ diff --git a/components/webui/flags/flags_state.cc b/components/webui/flags/flag
     CHECK(entry_it != name_to_switch_map.end());
 
     const SwitchEntry& entry = entry_it->second;
-@@ -709,6 +724,27 @@ void FlagsState::GetFlagFeatureEntries(
+@@ -710,6 +725,27 @@ void FlagsState::GetFlagFeatureEntries(
       data.Set("links", std::move(links));
     }
 
@@ -1299,7 +1310,7 @@ diff --git a/components/webui/flags/flags_state.cc b/components/webui/flags/flag
     switch (entry.type) {
       case FeatureEntry::SINGLE_VALUE:
       case FeatureEntry::SINGLE_DISABLE_VALUE:
-@@ -836,6 +872,16 @@ void FlagsState::AddSwitchesToCommandLine(
+@@ -837,6 +873,16 @@ void FlagsState::AddSwitchesToCommandLine(
   for (const std::string& entry_name : enabled_entries) {
     const auto& entry_it = name_to_switch_map.find(entry_name);
     if (entry_it == name_to_switch_map.end()) {
@@ -1316,7 +1327,7 @@ diff --git a/components/webui/flags/flags_state.cc b/components/webui/flags/flag
       NOTREACHED();
     }
 
-@@ -1092,6 +1138,14 @@ const FeatureEntry* FlagsState::FindFeatureEntryByName(
+@@ -1093,6 +1139,14 @@ const FeatureEntry* FlagsState::FindFeatureEntryByName(
 bool FlagsState::IsSupportedFeature(const FlagsStorage* storage,
                                     const std::string& name,
                                     int platform_mask) const {
@@ -1331,7 +1342,7 @@ diff --git a/components/webui/flags/flags_state.cc b/components/webui/flags/flag
   for (const auto& entry : feature_entries_) {
     DCHECK(entry.IsValid());
     if (!(entry.supported_platforms & platform_mask)) {
-@@ -1130,6 +1184,11 @@ void FlagsState::SetFlags(
+@@ -1131,6 +1185,11 @@ void FlagsState::SetFlags(
         FindFeatureEntryByName(feature_internal_name);
     // Since this flag is currently enabled, we know for sure that we can find
     // its feature entry using its internal name.
@@ -1346,7 +1357,7 @@ diff --git a/components/webui/flags/flags_state.cc b/components/webui/flags/flag
 diff --git a/components/webui/flags/resources/app.css b/components/webui/flags/resources/app.css
 --- a/components/webui/flags/resources/app.css
 +++ b/components/webui/flags/resources/app.css
-@@ -383,3 +383,27 @@ cr-tabs {
+@@ -391,3 +391,27 @@ cr-tabs {
     padding-top: 1.5rem;
   }
 }
@@ -1385,7 +1396,7 @@ diff --git a/components/webui/flags/resources/app.html.ts b/components/webui/fla
 <div id="header">
   <div class="flex-container">
     <div class="flex search-container">
-@@ -107,6 +108,32 @@ export function getHtml(this: AppElement) {
+@@ -109,6 +110,32 @@ export function getHtml(this: AppElement) {
         <div class="no-match" role="alert" hidden>$i18n{no-results}</div>
       </div>
 </if>
@@ -1418,7 +1429,7 @@ diff --git a/components/webui/flags/resources/app.html.ts b/components/webui/fla
     </div>
     <div id="needs-restart" ?show="${this.needsRestart}"
         role="${this.getNeedsRestartRole_()}">
-@@ -127,6 +154,7 @@ export function getHtml(this: AppElement) {
+@@ -129,6 +156,7 @@ export function getHtml(this: AppElement) {
     </div>
   </div>
 </div>
@@ -1491,7 +1502,7 @@ diff --git a/components/webui/flags/resources/app.ts b/components/webui/flags/re
 diff --git a/components/webui/flags/resources/experiment.css b/components/webui/flags/resources/experiment.css
 --- a/components/webui/flags/resources/experiment.css
 +++ b/components/webui/flags/resources/experiment.css
-@@ -12,6 +12,7 @@
+@@ -17,6 +17,7 @@
 }
 
 .experiment {
@@ -1499,7 +1510,7 @@ diff --git a/components/webui/flags/resources/experiment.css b/components/webui/
   color: var(--secondary-color);
   line-height: 1.45;
   width: 100%;
-@@ -79,6 +80,11 @@
+@@ -84,6 +85,11 @@
   resize: none;
 }
 
@@ -1511,7 +1522,7 @@ diff --git a/components/webui/flags/resources/experiment.css b/components/webui/
 select {
   background: white;
   border: 1px solid var(--link-color);
-@@ -155,6 +161,7 @@ input {
+@@ -160,6 +166,7 @@ input {
 @media (max-width: 480px) {
   .experiment {
     border-bottom: 1px solid var(--separator-color);
@@ -1519,7 +1530,7 @@ diff --git a/components/webui/flags/resources/experiment.css b/components/webui/
   }
 
   .experiment-name {
-@@ -172,7 +179,6 @@ input {
+@@ -177,7 +184,6 @@ input {
   .experiment .experiment-actions {
     max-width: 100%;
     padding-top: 12px;
@@ -1527,7 +1538,7 @@ diff --git a/components/webui/flags/resources/experiment.css b/components/webui/
     width: 100%;
   }
 
-@@ -180,7 +186,6 @@ input {
+@@ -185,7 +191,6 @@ input {
   .body {
     overflow: hidden;
     text-overflow: ellipsis;
@@ -1543,15 +1554,15 @@ diff --git a/components/webui/flags/resources/experiment.html.ts b/components/we
   return html`<!--_html_template_start_-->
 <div class="experiment" id="${this.feature_.internal_name}">
 -  <div class="flex-container">
-+  <div class="flex-container" class="${(this.feature_.is_cromite && this.feature_.is_new ? "cromite " : "")
-+                                       + (this.feature_.is_default_value_on ? "experiment-on" : "")}">
+  <div class="${"flex-container " + (this.feature_.is_cromite && this.feature_.is_new ? "cromite " : "")
+                                  + (this.feature_.is_default_value_on ? "experiment-on" : "")}">
     <div class="flex">
       ${this.showingSearchHit_? html`
         <h2 class="experiment-name clone" id="${this.getHeaderId_()}"
@@ -86,7 +87,9 @@ export function getHtml(this: ExperimentElement) {
             @change="${this.onExperimentSelectChange_}">
           ${this.feature_.options!.map(option => html`
-             <option ?selected="${option.selected}">
+             <option .selected="${option.selected}">
 -              ${option.description}
 +              ${option.description == "Default" && this.feature_.default_value !== undefined
 +                  ? option.description + " (" + this.feature_.default_value + ")"
@@ -1574,7 +1585,7 @@ diff --git a/components/webui/flags/resources/experiment.ts b/components/webui/f
   };
 
   // Whether the controls to change the experiment state should be hidden.
-@@ -127,9 +132,12 @@ export class ExperimentElement extends CrLitElement {
+@@ -121,9 +126,12 @@ export class ExperimentElement extends CrLitElement {
   }
 
   protected getExperimentTitle_(): string {
@@ -1628,16 +1639,16 @@ diff --git a/components/webui/version/version_handler_helper.cc b/components/web
 diff --git a/content/common/features.cc b/content/common/features.cc
 --- a/content/common/features.cc
 +++ b/content/common/features.cc
-@@ -596,4 +596,5 @@ BASE_FEATURE(kDisallowRasterInterfaceWithoutSkiaBackend,
- 
- // Please keep features in alphabetical order.
+@@ -750,4 +750,5 @@ bool IsEnforceSameDocumentOriginInvariantsEnabled() {
+              blink::features::kTreatMhtmlInitialDocumentLoadsAsCrossDocument);
+ }
 
 +#include "cromite_flags/content_common_features_cc.inc"
 }  // namespace features
 diff --git a/content/public/common/content_features.cc b/content/public/common/content_features.cc
 --- a/content/public/common/content_features.cc
 +++ b/content/public/common/content_features.cc
-@@ -1527,4 +1527,5 @@ bool IsPushSubscriptionChangeEventEnabled() {
+@@ -1438,4 +1438,5 @@ bool IsPushSubscriptionChangeEventEnabled() {
              features::kPushSubscriptionChangeEventOnResubscribe);
 }
 
@@ -1646,7 +1657,7 @@ diff --git a/content/public/common/content_features.cc b/content/public/common/c
 diff --git a/content/public/common/content_features.h b/content/public/common/content_features.h
 --- a/content/public/common/content_features.h
 +++ b/content/public/common/content_features.h
-@@ -361,6 +361,7 @@ CONTENT_EXPORT bool IsVideoCaptureServiceEnabledForOutOfProcess();
+@@ -420,6 +420,7 @@ CONTENT_EXPORT bool IsVideoCaptureServiceEnabledForOutOfProcess();
 CONTENT_EXPORT bool IsVideoCaptureServiceEnabledForBrowserProcess();
 CONTENT_EXPORT bool IsPushSubscriptionChangeEventEnabled();
 
@@ -1992,7 +2003,7 @@ new file mode 100755
 diff --git a/media/base/media_switches.cc b/media/base/media_switches.cc
 --- a/media/base/media_switches.cc
 +++ b/media/base/media_switches.cc
-@@ -1843,5 +1843,5 @@ uint32_t GetPassthroughAudioFormats() {
+@@ -1750,5 +1750,5 @@ uint32_t GetPassthroughAudioFormats() {
   return 0;
 #endif  // BUILDFLAG(ENABLE_PASSTHROUGH_AUDIO_CODECS)
 }
@@ -2002,7 +2013,7 @@ diff --git a/media/base/media_switches.cc b/media/base/media_switches.cc
 diff --git a/media/base/media_switches.h b/media/base/media_switches.h
 --- a/media/base/media_switches.h
 +++ b/media/base/media_switches.h
-@@ -569,5 +569,5 @@ MEDIA_EXPORT bool IsOutOfProcessVideoDecodingEnabled();
+@@ -556,5 +556,5 @@ MEDIA_EXPORT bool IsOutOfProcessVideoDecodingEnabled();
 MEDIA_EXPORT uint32_t GetPassthroughAudioFormats();
 
 }  // namespace media
@@ -2012,8 +2023,8 @@ diff --git a/media/base/media_switches.h b/media/base/media_switches.h
 diff --git a/net/base/features.cc b/net/base/features.cc
 --- a/net/base/features.cc
 +++ b/net/base/features.cc
-@@ -784,4 +784,5 @@ BASE_FEATURE(kRestrictAbusePortsOnLocalhost,
-              "RestrictAbusePortsOnLocalhost",
+@@ -846,4 +846,5 @@ BASE_FEATURE(kAddAutomaticWithDohFallbackMode,
+ BASE_FEATURE(kUseQuicProxiesWithoutWaitingForConnectResponse,
              base::FEATURE_DISABLED_BY_DEFAULT);
 
 +#include "cromite_flags/net_base_features_cc.inc"
@@ -2021,9 +2032,9 @@ diff --git a/net/base/features.cc b/net/base/features.cc
 diff --git a/net/base/features.h b/net/base/features.h
 --- a/net/base/features.h
 +++ b/net/base/features.h
-@@ -800,6 +800,7 @@ NET_EXPORT extern const base::FeatureParam<std::string>
- // Finch-controlled list of ports that should be blocked on localhost.
- NET_EXPORT BASE_DECLARE_FEATURE(kRestrictAbusePortsOnLocalhost);
+@@ -911,6 +911,7 @@ NET_EXPORT BASE_DECLARE_FEATURE(kAddAutomaticWithDohFallbackMode);
+ NET_EXPORT BASE_DECLARE_FEATURE(
+     kUseQuicProxiesWithoutWaitingForConnectResponse);
 
 +#include "cromite_flags/net_base_features_h.inc"
 }  // namespace net::features
@@ -2032,18 +2043,18 @@ diff --git a/net/base/features.h b/net/base/features.h
 diff --git a/services/network/public/cpp/features.cc b/services/network/public/cpp/features.cc
 --- a/services/network/public/cpp/features.cc
 +++ b/services/network/public/cpp/features.cc
-@@ -617,4 +617,5 @@ BASE_FEATURE_PARAM(size_t,
-                    /*name=*/"max_size",
-                    1'000'000);
+@@ -611,4 +611,5 @@ BASE_FEATURE(kNetworkServicePerPriorityTaskQueues,
+ BASE_FEATURE(kUseUnexportableKeyServiceInBrowserProcess,
+              base::FEATURE_DISABLED_BY_DEFAULT);
 
 +#include "cromite_flags/services_network_public_cpp_features_cc.inc"
 }  // namespace network::features
 diff --git a/services/network/public/cpp/features.h b/services/network/public/cpp/features.h
 --- a/services/network/public/cpp/features.h
 +++ b/services/network/public/cpp/features.h
-@@ -340,6 +340,7 @@ BASE_DECLARE_FEATURE_PARAM(size_t, kSharedDictionaryCacheSize);
+@@ -383,6 +383,7 @@ BASE_DECLARE_FEATURE(kNetworkServicePerPriorityTaskQueues);
 COMPONENT_EXPORT(NETWORK_CPP_FLAGS_AND_SWITCHES)
- BASE_DECLARE_FEATURE_PARAM(size_t, kSharedDictionaryCacheMaxSizeBytes);
+ BASE_DECLARE_FEATURE(kUseUnexportableKeyServiceInBrowserProcess);
 
 +#include "cromite_flags/services_network_public_cpp_features_h.inc"
 }  // namespace network::features
@@ -2052,7 +2063,7 @@ diff --git a/services/network/public/cpp/features.h b/services/network/public/cp
 diff --git a/third_party/blink/common/features.cc b/third_party/blink/common/features.cc
 --- a/third_party/blink/common/features.cc
 +++ b/third_party/blink/common/features.cc
-@@ -2912,4 +2912,5 @@ bool IsLinkPreviewTriggerTypeEnabled(LinkPreviewTriggerType type) {
+@@ -2647,4 +2647,5 @@ bool IsXrDevice() {
 //
 // DO NOT ADD NEW FEATURES HERE.
 
@@ -2061,7 +2072,7 @@ diff --git a/third_party/blink/common/features.cc b/third_party/blink/common/fea
 diff --git a/third_party/blink/public/common/features.h b/third_party/blink/public/common/features.h
 --- a/third_party/blink/public/common/features.h
 +++ b/third_party/blink/public/common/features.h
-@@ -1896,6 +1896,7 @@ BLINK_COMMON_EXPORT bool IsUpdateComplexSafaAreaConstraintsEnabled();
+@@ -1960,6 +1960,7 @@ BLINK_COMMON_EXPORT bool IsXrDevice();
 //
 // DO NOT ADD NEW FEATURES HERE.
 
@@ -2072,18 +2083,18 @@ diff --git a/third_party/blink/public/common/features.h b/third_party/blink/publ
 diff --git a/ui/base/ui_base_features.cc b/ui/base/ui_base_features.cc
 --- a/ui/base/ui_base_features.cc
 +++ b/ui/base/ui_base_features.cc
-@@ -506,4 +506,5 @@ bool IsPixelCanvasRecordingEnabled() {
-   return base::FeatureList::IsEnabled(features::kEnablePixelCanvasRecording);
- }
+@@ -449,4 +449,5 @@ BASE_FEATURE(kUseSystemDefaultAccentColors, base::FEATURE_ENABLED_BY_DEFAULT);
+ 
+ BASE_FEATURE(kStringWidthCache, base::FEATURE_DISABLED_BY_DEFAULT);
 
 +#include "cromite_flags/ui_base_features_cc.inc"
 }  // namespace features
 diff --git a/ui/base/ui_base_features.h b/ui/base/ui_base_features.h
 --- a/ui/base/ui_base_features.h
 +++ b/ui/base/ui_base_features.h
-@@ -252,6 +252,7 @@ BASE_DECLARE_FEATURE(kEnablePixelCanvasRecording);
- 
- bool COMPONENT_EXPORT(UI_BASE_FEATURES) IsPixelCanvasRecordingEnabled();
+@@ -270,6 +270,7 @@ BASE_DECLARE_FEATURE(kUseSystemDefaultAccentColors);
+ COMPONENT_EXPORT(UI_BASE_FEATURES)
+ BASE_DECLARE_FEATURE(kStringWidthCache);
 
 +#include "cromite_flags/ui_base_features_h.inc"
 }  // namespace features
@@ -0,0 +1,932 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Fri, 22 Aug 2025 15:41:58 +0000
+Subject: Add cromite test support
+
+Allows the activation of specific APIs used for cromite testing.
+API are only available on the chrome://version page.
+It allows the use of tools such as Browserstack for test automation.
+Do not activate the corresponding options (available in the developer
+settings) if you do not know what you are doing.
+
+License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
+---
+ .../java/res/xml/developer_preferences.xml    |  12 ++
+ .../init/ProcessInitializationHandler.java    |   6 +-
+ .../tracing/settings/DeveloperSettings.java   |   2 +-
+ chrome/browser/BUILD.gn                       |   5 +
+ chrome/browser/android/devtools_server.cc     |  10 +
+ ...ontent_browser_client_receiver_bindings.cc |  10 +
+ .../cromite/cromite_private_api_host.cc       |  74 +++++++
+ .../cromite/cromite_private_api_host.h        |  54 +++++
+ .../browser/flags/cromite/sActAsWebView.java  |  33 +++
+ .../cromite/sEnableCromiteTestSupport.java    |  33 +++
+ .../NotificationPermissionController.java     |   1 +
+ chrome/browser/ui/startup/bad_flags_prompt.cc |   1 +
+ chrome/common/BUILD.gn                        |   1 +
+ .../cromite_private_api_extension.mojom       |   7 +
+ chrome/renderer/BUILD.gn                      |   2 +
+ .../chrome_content_renderer_client.cc         |   2 +
+ .../cromite/cromite_private_api_extension.cc  | 203 ++++++++++++++++++
+ .../cromite/cromite_private_api_extension.h   |  65 ++++++
+ .../component_updater_service.h               |   1 +
+ .../browser/devtools/devtools_http_handler.cc |   7 +-
+ content/browser/log_console_message.cc        |  15 +-
+ content/browser/log_console_message.h         |   3 +-
+ .../renderer_host/render_frame_host_impl.cc   |  13 +-
+ .../about_flags_cc/Enable-test-support.inc    |  19 ++
+ .../Enable-test-support.inc                   |   7 +
+ .../Enable-test-support.inc                   |   2 +
+ 26 files changed, 581 insertions(+), 7 deletions(-)
+ create mode 100644 chrome/browser/cromite/cromite_private_api_host.cc
+ create mode 100644 chrome/browser/cromite/cromite_private_api_host.h
+ create mode 100644 chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/cromite/sActAsWebView.java
+ create mode 100644 chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/cromite/sEnableCromiteTestSupport.java
+ create mode 100644 chrome/common/cromite_private_api_extension.mojom
+ create mode 100644 chrome/renderer/cromite/cromite_private_api_extension.cc
+ create mode 100644 chrome/renderer/cromite/cromite_private_api_extension.h
+ create mode 100644 cromite_flags/chrome/browser/about_flags_cc/Enable-test-support.inc
+ create mode 100644 cromite_flags/content/public/common/content_features_cc/Enable-test-support.inc
+ create mode 100644 cromite_flags/content/public/common/content_features_h/Enable-test-support.inc
+
+diff --git a/chrome/android/java/res/xml/developer_preferences.xml b/chrome/android/java/res/xml/developer_preferences.xml
+--- a/chrome/android/java/res/xml/developer_preferences.xml
+++ b/chrome/android/java/res/xml/developer_preferences.xml
+@@ -12,6 +12,18 @@ found in the LICENSE file.
+         android:fragment="org.chromium.chrome.browser.tracing.settings.TracingSettings"
+         android:key="tracing"
+         android:title="Tracing" />
+    <org.chromium.components.browser_ui.settings.ChromeSwitchPreference
+        android:key="enable_cromite_test_support"
+        android:title="Enable support for cromite test"
+        android:summary="Setting allows the activation of specific APIs used for cromite testing. Do not activate if you do not know what you are doing."
+        app:featureName="enable-cromite-test-support"
+        app:needRestart="true" />
+    <org.chromium.components.browser_ui.settings.ChromeSwitchPreference
+        android:key="act_as_webview"
+        android:title="Enable webview support for cromite test"
+        android:summary="Setting allows the activation of specific APIs used for cromite testing. Do not activate if you do not know what you are doing."
+        app:featureName="act-as-webview"
+        app:needRestart="true" />
+     <Preference
+         android:key="test_gwp_asan"
+         android:title="Test Gwp Asan"/>
+diff --git a/chrome/android/java/src/org/chromium/chrome/browser/init/ProcessInitializationHandler.java b/chrome/android/java/src/org/chromium/chrome/browser/init/ProcessInitializationHandler.java
+--- a/chrome/android/java/src/org/chromium/chrome/browser/init/ProcessInitializationHandler.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/init/ProcessInitializationHandler.java
+@@ -149,6 +149,7 @@ import org.chromium.ui.base.SelectFileDialog;
+ import org.chromium.ui.base.WindowAndroid;
+ import org.chromium.ui.edge_to_edge.EdgeToEdgeStateProvider;
+ import org.chromium.url.GURL;
+import org.chromium.chrome.browser.flags.cromite.sActAsWebView;
+ 
+ import java.io.File;
+ import java.nio.charset.StandardCharsets;
+@@ -729,7 +730,10 @@ public class ProcessInitializationHandler {
+ 
+         tasks.add(
+                 () -> {
+-                    mDevToolsServer = new DevToolsServer(DEV_TOOLS_SERVER_SOCKET_PREFIX);
+                    String socketPrefix = DEV_TOOLS_SERVER_SOCKET_PREFIX;
+                    if (sActAsWebView.getInstance().isEnabled())
+                        socketPrefix = "weblayer";
+                    mDevToolsServer = new DevToolsServer(socketPrefix);
+                     mDevToolsServer.setRemoteDebuggingEnabled(
+                             true, DevToolsServer.Security.ALLOW_DEBUG_PERMISSION);
+                 });
+diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tracing/settings/DeveloperSettings.java b/chrome/android/java/src/org/chromium/chrome/browser/tracing/settings/DeveloperSettings.java
+--- a/chrome/android/java/src/org/chromium/chrome/browser/tracing/settings/DeveloperSettings.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/tracing/settings/DeveloperSettings.java
+@@ -35,7 +35,7 @@ public class DeveloperSettings extends ChromeBaseSettingsFragment implements Emb
+     private final ObservableSupplier<String> mPageTitle =
+             new ObservableSupplierImpl<>(MSG_DEVELOPER_OPTIONS_TITLE);
+ 
+-    private static @Nullable Boolean sIsEnabledForTests;
+    private static @Nullable Boolean sIsEnabledForTests = true;
+ 
+     public static boolean shouldShowDeveloperSettings() {
+         // Always enabled on canary, dev and local builds, otherwise can be enabled by tapping the
+diff --git a/chrome/browser/BUILD.gn b/chrome/browser/BUILD.gn
+--- a/chrome/browser/BUILD.gn
+++ b/chrome/browser/BUILD.gn
+@@ -190,6 +190,11 @@ source_set("shell_integration") {
+ # require many files from it. This makes linking more efficient.
+ static_library("browser") {
+   sources = [
+    "cromite/cromite_private_api_host.cc",
+    "cromite/cromite_private_api_host.h",
+  ]
+
+  sources += [
+     "about_flags.cc",
+     "accessibility/accessibility_labels_service.cc",
+     "accessibility/accessibility_labels_service.h",
+diff --git a/chrome/browser/android/devtools_server.cc b/chrome/browser/android/devtools_server.cc
+--- a/chrome/browser/android/devtools_server.cc
+++ b/chrome/browser/android/devtools_server.cc
+@@ -12,6 +12,7 @@
+ #include "base/command_line.h"
+ #include "base/compiler_specific.h"
+ #include "base/files/file_path.h"
+#include "base/feature_list.h"
+ #include "base/functional/bind.h"
+ #include "base/functional/callback.h"
+ #include "base/strings/string_number_conversions.h"
+@@ -32,6 +33,7 @@
+ #include "content/public/browser/render_view_host.h"
+ #include "content/public/browser/web_contents.h"
+ #include "content/public/browser/web_contents_delegate.h"
+#include "content/public/common/content_features.h"
+ #include "content/public/common/content_switches.h"
+ #include "content/public/common/url_constants.h"
+ #include "net/base/net_errors.h"
+@@ -64,6 +66,8 @@ const int kBackLog = 4096;
+ 
+ bool AuthorizeSocketAccessWithDebugPermission(
+     const net::UnixDomainServerSocket::Credentials& credentials) {
+  if (base::FeatureList::IsEnabled(features::kEnableCromiteTestSupport))
+    return true;
+   JNIEnv* env = base::android::AttachCurrentThread();
+   return Java_DevToolsServer_checkDebugPermission(env, credentials.process_id,
+                                                   credentials.user_id) ||
+@@ -127,6 +131,10 @@ DevToolsServer::DevToolsServer(const std::string& socket_name_prefix)
+     : socket_name_(base::StringPrintf(kDevToolsChannelNameFormat,
+                                       socket_name_prefix.c_str())),
+       is_started_(false) {
+  if (base::FeatureList::IsEnabled(features::kActAsWebView)) {
+    socket_name_ = base::StringPrintf("%s_devtools_remote_%d",
+        socket_name_prefix.c_str(), getpid());
+  }
+   // Override the socket name if one is specified on the command line.
+   const base::CommandLine& command_line =
+       *base::CommandLine::ForCurrentProcess();
+@@ -144,6 +152,8 @@ void DevToolsServer::Start(bool allow_debug_permission) {
+   if (is_started_)
+     return;
+ 
+  DLOG(INFO) << "---DevToolsServer::Start allow_debug_permission=" << allow_debug_permission;
+  DLOG(INFO) << "---socket_name_=" << socket_name_;
+   net::UnixDomainServerSocket::AuthCallback auth_callback =
+       allow_debug_permission
+           ? base::BindRepeating(&AuthorizeSocketAccessWithDebugPermission)
+diff --git a/chrome/browser/chrome_content_browser_client_receiver_bindings.cc b/chrome/browser/chrome_content_browser_client_receiver_bindings.cc
+--- a/chrome/browser/chrome_content_browser_client_receiver_bindings.cc
+++ b/chrome/browser/chrome_content_browser_client_receiver_bindings.cc
+@@ -10,6 +10,7 @@
+ #include "build/build_config.h"
+ #include "chrome/browser/browser_process.h"
+ #include "chrome/browser/chrome_browser_interface_binders.h"
+#include "chrome/browser/cromite/cromite_private_api_host.h"
+ #include "chrome/browser/chrome_browser_interface_binders_webui.h"
+ #include "chrome/browser/chrome_content_browser_client.h"
+ #include "chrome/browser/chrome_content_browser_client_parts.h"
+@@ -492,6 +493,15 @@ void ChromeContentBrowserClient::
+                                                     render_frame_host);
+       },
+       &render_frame_host));
+  associated_registry.AddInterface<
+      chrome::mojom::CromitePrivateApiExtension>(base::BindRepeating(
+      [](content::RenderFrameHost* render_frame_host,
+         mojo::PendingAssociatedReceiver<
+             chrome::mojom::CromitePrivateApiExtension> receiver) {
+        CromitePrivateApiHost::BindHost(std::move(receiver),
+                                        render_frame_host);
+      },
+      &render_frame_host));
+   associated_registry.AddInterface<
+       chrome::mojom::GoogleAccountsPrivateApiExtension>(base::BindRepeating(
+       [](content::RenderFrameHost* render_frame_host,
+diff --git a/chrome/browser/cromite/cromite_private_api_host.cc b/chrome/browser/cromite/cromite_private_api_host.cc
+new file mode 100644
+--- /dev/null
+++ b/chrome/browser/cromite/cromite_private_api_host.cc
+@@ -0,0 +1,74 @@
+#include "chrome/browser/cromite/cromite_private_api_host.h"
+
+#include "base/json/json_writer.h"
+
+#include "chrome/browser/browser_process.h"
+#include "components/component_updater/component_updater_service.h"
+#include "components/update_client/crx_update_item.h"
+#include "content/public/browser/document_user_data.h"
+#include "content/public/browser/navigation_handle.h"
+#include "content/public/browser/render_frame_host.h"
+#include "content/public/browser/site_instance.h"
+
+CromitePrivateApiHost::CromitePrivateApiHost(
+    content::RenderFrameHost* rfh)
+    : DocumentUserData<CromitePrivateApiHost>(rfh),
+      receiver_(this) {}
+
+CromitePrivateApiHost::~CromitePrivateApiHost() = default;
+
+DOCUMENT_USER_DATA_KEY_IMPL(CromitePrivateApiHost);
+
+void CromitePrivateApiHost::BindReceiver(
+    mojo::PendingAssociatedReceiver<
+        chrome::mojom::CromitePrivateApiExtension> receiver) {
+  receiver_.Bind(std::move(receiver));
+}
+
+void CromitePrivateApiHost::GetComponentData(
+    const std::string& id,
+    GetComponentDataCallback callback) {
+  LOG(INFO) << "---CromitePrivateApiHost::GetComponentData "
+            << "id=" << id;
+  const raw_ptr<component_updater::ComponentUpdateService>
+    component_updater = g_browser_process->component_updater();
+
+  update_client::CrxUpdateItem item;
+  if (component_updater->GetComponentDetails(id, &item) && item.component) {
+    base::Value::Dict dict;
+    dict.Set("id", id);
+    dict.Set("version", item.component->version.GetString());
+    dict.Set("status", (int)item.state);
+
+    std::string json_string;
+      base::JSONWriter::WriteWithOptions(
+          dict, base::JSONWriter::OPTIONS_PRETTY_PRINT, &json_string);
+      base::TrimWhitespaceASCII(json_string, base::TRIM_ALL, &json_string);
+
+    std::move(callback).Run(json_string);
+  }
+}
+
+void CromitePrivateApiHost::StartComponentUpdate(const std::string& id) {
+  LOG(INFO) << "---CromitePrivateApiHost::StartComponentUpdate "
+            << "id=" << id;
+  const raw_ptr<component_updater::ComponentUpdateService>
+    component_updater = g_browser_process->component_updater();
+  component_updater->GetOnDemandUpdater().OnDemandUpdate(
+      id, component_updater::OnDemandUpdater::Priority::FOREGROUND,
+      component_updater::Callback());
+}
+
+void CromitePrivateApiHost::SetEnableLogConsole(bool enabled) {
+  enable_log_console_ = enabled;
+}
+
+// static
+void CromitePrivateApiHost::BindHost(
+    mojo::PendingAssociatedReceiver<
+        chrome::mojom::CromitePrivateApiExtension> receiver,
+    content::RenderFrameHost* render_frame_host) {
+  CromitePrivateApiHost* api_host =
+      CromitePrivateApiHost::GetOrCreateForCurrentDocument(render_frame_host);
+  api_host->BindReceiver(std::move(receiver));
+}
+diff --git a/chrome/browser/cromite/cromite_private_api_host.h b/chrome/browser/cromite/cromite_private_api_host.h
+new file mode 100644
+--- /dev/null
+++ b/chrome/browser/cromite/cromite_private_api_host.h
+@@ -0,0 +1,54 @@
+#ifndef CHROME_BROWSER_CROMITE_PRIVATE_API_HOST_H_
+#define CHROME_BROWSER_CROMITE_PRIVATE_API_HOST_H_
+
+#include <string>
+
+#include "base/functional/callback.h"
+#include "chrome/common/cromite_private_api_extension.mojom.h"
+#include "content/public/browser/document_user_data.h"
+#include "mojo/public/cpp/bindings/associated_receiver.h"
+
+namespace content {
+class NavigationHandle;
+class RenderFrameHost;
+}  // namespace content
+
+class CromitePrivateApiHost
+    : public chrome::mojom::CromitePrivateApiExtension,
+      public content::DocumentUserData<CromitePrivateApiHost> {
+ public:
+  ~CromitePrivateApiHost() override;
+  CromitePrivateApiHost(const CromitePrivateApiHost&) = delete;
+  CromitePrivateApiHost& operator=(const CromitePrivateApiHost&) =
+      delete;
+
+  static void BindHost(
+      mojo::PendingAssociatedReceiver<
+          chrome::mojom::CromitePrivateApiExtension> receiver,
+      content::RenderFrameHost* render_frame_host);
+
+  void BindReceiver(mojo::PendingAssociatedReceiver<
+                    chrome::mojom::CromitePrivateApiExtension> receiver);
+
+  bool IsLogConsoleEnabled() const { return enable_log_console_; }
+
+  // chrome::mojom::CromitePrivateApiExtension:
+  void GetComponentData(const std::string& id,
+                        GetComponentDataCallback callback) override;
+  void StartComponentUpdate(const std::string& id) override;
+  void SetEnableLogConsole(bool can_show) override;
+
+ private:
+  explicit CromitePrivateApiHost(
+      content::RenderFrameHost* rfh);
+
+  friend DocumentUserData;
+  DOCUMENT_USER_DATA_KEY_DECL();
+
+  mojo::AssociatedReceiver<chrome::mojom::CromitePrivateApiExtension>
+      receiver_;
+
+  bool enable_log_console_ = false;
+};
+
+#endif  // CHROME_BROWSER_CROMITE_PRIVATE_API_HOST_H_
+diff --git a/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/cromite/sActAsWebView.java b/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/cromite/sActAsWebView.java
+new file mode 100644
+--- /dev/null
+++ b/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/cromite/sActAsWebView.java
+@@ -0,0 +1,33 @@
+/*
+    This file is part of Cromite.
+
+    Cromite is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    Cromite is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with Cromite. If not, see <https://www.gnu.org/licenses/>.
+*/
+
+package org.chromium.chrome.browser.flags.cromite;
+
+import org.chromium.components.cached_flags.CachedFlag;
+import org.chromium.chrome.browser.flags.ChromeFeatureMap;
+
+public class sActAsWebView {
+    private static final CachedFlag sInstance =
+        new CachedFlag(ChromeFeatureMap.getInstance(),
+            "ActAsWebView", false);
+
+    private sActAsWebView() {}
+
+    public static CachedFlag getInstance() {
+        return sInstance;
+    }
+}
+diff --git a/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/cromite/sEnableCromiteTestSupport.java b/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/cromite/sEnableCromiteTestSupport.java
+new file mode 100644
+--- /dev/null
+++ b/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/cromite/sEnableCromiteTestSupport.java
+@@ -0,0 +1,33 @@
+/*
+    This file is part of Cromite.
+
+    Cromite is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    Cromite is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with Cromite. If not, see <https://www.gnu.org/licenses/>.
+*/
+
+package org.chromium.chrome.browser.flags.cromite;
+
+import org.chromium.components.cached_flags.CachedFlag;
+import org.chromium.chrome.browser.flags.ChromeFeatureMap;
+
+public class sEnableCromiteTestSupport {
+    private static final CachedFlag sInstance =
+        new CachedFlag(ChromeFeatureMap.getInstance(),
+            "EnableCromiteTestSupport", false);
+
+    private sEnableCromiteTestSupport() {}
+
+    public static CachedFlag getInstance() {
+        return sInstance;
+    }
+}
+diff --git a/chrome/browser/notifications/android/java/src/org/chromium/chrome/browser/notifications/permissions/NotificationPermissionController.java b/chrome/browser/notifications/android/java/src/org/chromium/chrome/browser/notifications/permissions/NotificationPermissionController.java
+--- a/chrome/browser/notifications/android/java/src/org/chromium/chrome/browser/notifications/permissions/NotificationPermissionController.java
+++ b/chrome/browser/notifications/android/java/src/org/chromium/chrome/browser/notifications/permissions/NotificationPermissionController.java
+@@ -181,6 +181,7 @@ public class NotificationPermissionController {
+      * @return True if any UI was shown (either rationale dialog or OS prompt), false otherwise.
+      */
+     public boolean requestPermissionIfNeeded(boolean contextual) {
+        if (!contextual) return false;
+         if (Build.VERSION.SDK_INT < Build.VERSION_CODES.TIRAMISU || DeviceInfo.isRetailDemoMode()) {
+             return false;
+         }
+diff --git a/chrome/browser/ui/startup/bad_flags_prompt.cc b/chrome/browser/ui/startup/bad_flags_prompt.cc
+--- a/chrome/browser/ui/startup/bad_flags_prompt.cc
+++ b/chrome/browser/ui/startup/bad_flags_prompt.cc
+@@ -220,6 +220,7 @@ static const std::variant<const base::Feature*, const char*>
+ 
+ #if BUILDFLAG(IS_ANDROID)
+         &chrome::android::kCommandLineOnNonRooted,
+        &features::kEnableCromiteTestSupport,
+ #endif
+ 
+         // This flag disables security for the Page Embedded Permission Control,
+diff --git a/chrome/common/BUILD.gn b/chrome/common/BUILD.gn
+--- a/chrome/common/BUILD.gn
+++ b/chrome/common/BUILD.gn
+@@ -666,6 +666,7 @@ mojom("mojo_bindings") {
+   sources = [
+     "chrome_render_frame.mojom",
+     "google_accounts_private_api_extension.mojom",
+    "cromite_private_api_extension.mojom",
+     "media/webrtc_logging.mojom",
+     "net/net_error_page_support.mojom",
+     "net_benchmarking.mojom",
+diff --git a/chrome/common/cromite_private_api_extension.mojom b/chrome/common/cromite_private_api_extension.mojom
+new file mode 100644
+--- /dev/null
+++ b/chrome/common/cromite_private_api_extension.mojom
+@@ -0,0 +1,7 @@
+module chrome.mojom;
+
+interface CromitePrivateApiExtension {
+  GetComponentData(string id) => (string response);
+  StartComponentUpdate(string id);
+  SetEnableLogConsole(bool enabled);
+};
+diff --git a/chrome/renderer/BUILD.gn b/chrome/renderer/BUILD.gn
+--- a/chrome/renderer/BUILD.gn
+++ b/chrome/renderer/BUILD.gn
+@@ -79,6 +79,8 @@ static_library("renderer") {
+     "chrome_render_thread_observer.cc",
+     "chrome_render_thread_observer.h",
+     "custom_menu_commands.h",
+    "cromite/cromite_private_api_extension.cc",
+    "cromite/cromite_private_api_extension.h",
+     "google_accounts_private_api_extension.cc",
+     "google_accounts_private_api_extension.h",
+     "google_accounts_private_api_util.cc",
+diff --git a/chrome/renderer/chrome_content_renderer_client.cc b/chrome/renderer/chrome_content_renderer_client.cc
+--- a/chrome/renderer/chrome_content_renderer_client.cc
+++ b/chrome/renderer/chrome_content_renderer_client.cc
+@@ -56,6 +56,7 @@
+ #include "chrome/renderer/chrome_render_frame_observer.h"
+ #include "chrome/renderer/chrome_render_thread_observer.h"
+ #include "chrome/renderer/controlled_frame/controlled_frame_extensions_renderer_api_provider.h"
+#include "chrome/renderer/cromite/cromite_private_api_extension.h"
+ #include "chrome/renderer/google_accounts_private_api_extension.h"
+ #include "chrome/renderer/loadtimes_extension_bindings.h"
+ #include "chrome/renderer/media/flash_embed_rewrite.h"
+@@ -650,6 +651,7 @@ void ChromeContentRendererClient::RenderFrameCreated(
+ 
+   TrustedVaultEncryptionKeysExtension::Create(render_frame);
+   GoogleAccountsPrivateApiExtension::Create(render_frame);
+  CromitePrivateApiExtension::Create(render_frame);
+ 
+   if (render_frame->IsMainFrame())
+     new webapps::WebPageMetadataAgent(render_frame);
+diff --git a/chrome/renderer/cromite/cromite_private_api_extension.cc b/chrome/renderer/cromite/cromite_private_api_extension.cc
+new file mode 100644
+--- /dev/null
+++ b/chrome/renderer/cromite/cromite_private_api_extension.cc
+@@ -0,0 +1,203 @@
+#include "chrome/renderer/cromite/cromite_private_api_extension.h"
+
+#include "chrome/common/chrome_features.h"
+#include "content/public/common/content_features.h"
+#include "content/public/common/isolated_world_ids.h"
+#include "content/public/renderer/chrome_object_extensions_utils.h"
+#include "content/public/renderer/render_frame.h"
+#include "gin/arguments.h"
+#include "gin/function_template.h"
+#include "third_party/blink/public/common/associated_interfaces/associated_interface_provider.h"
+#include "third_party/blink/public/platform/platform.h"
+#include "third_party/blink/public/platform/scheduler/web_agent_group_scheduler.h"
+#include "third_party/blink/public/web/web_local_frame.h"
+#include "v8/include/v8-context.h"
+#include "v8/include/v8-function.h"
+
+namespace {
+
+bool ShouldExposeCromitePrivateApi(
+    content::RenderFrame* render_frame) {
+  DCHECK(render_frame);
+  if (!base::FeatureList::IsEnabled(features::kEnableCromiteTestSupport))
+    return false;
+
+  GURL origin_url = GURL("chrome://version");
+  const url::Origin& allowed_origin = url::Origin::Create(origin_url);
+
+  const url::Origin origin = render_frame->GetWebFrame()->GetSecurityOrigin();
+  return origin == allowed_origin;
+}
+
+}
+
+CromitePrivateApiExtension::PendingRequest::PendingRequest(
+    v8::Isolate* isolate,
+    v8::Local<v8::Context> context,
+    v8::Local<v8::Promise::Resolver> resolver)
+    : isolate(isolate),
+      context(isolate, context),
+      promise_resolver(isolate, resolver) {}
+
+CromitePrivateApiExtension::PendingRequest::~PendingRequest() = default;
+
+// static
+void CromitePrivateApiExtension::Create(content::RenderFrame* frame) {
+  new CromitePrivateApiExtension(frame);
+}
+
+CromitePrivateApiExtension::CromitePrivateApiExtension(
+    content::RenderFrame* frame)
+    : content::RenderFrameObserver(frame) {}
+
+CromitePrivateApiExtension::~CromitePrivateApiExtension() =
+    default;
+
+void CromitePrivateApiExtension::OnDestruct() {
+  delete this;
+}
+
+void CromitePrivateApiExtension::DidCreateScriptContext(
+    v8::Local<v8::Context> v8_context,
+    int32_t world_id) {
+  if (!render_frame() || world_id != content::ISOLATED_WORLD_ID_GLOBAL) {
+    return;
+  }
+
+  if (ShouldExposeCromitePrivateApi(render_frame())) {
+    InjectScript();
+  }
+}
+
+void CromitePrivateApiExtension::InjectScript() {
+  DCHECK(render_frame());
+
+  blink::WebLocalFrame* web_frame = render_frame()->GetWebFrame();
+  v8::Isolate* isolate = web_frame->GetAgentGroupScheduler()->Isolate();
+  v8::HandleScope handle_scope(isolate);
+  v8::Local<v8::Context> context = web_frame->MainWorldScriptContext();
+  if (context.IsEmpty()) {
+    return;
+  }
+
+  v8::Context::Scope context_scope(context);
+
+  v8::Local<v8::Object> window =
+      content::GetOrCreateObject(isolate, context, "window");
+  v8::Local<v8::Object> oCromiteObject =
+      content::GetOrCreateObject(isolate, context, window, "cromite");
+
+  oCromiteObject
+      ->Set(
+          context, gin::StringToSymbol(isolate, "getComponentData"),
+          gin::CreateFunctionTemplate(
+              isolate, base::BindRepeating(
+                           &CromitePrivateApiExtension::GetComponentData,
+                           weak_ptr_factory_.GetWeakPtr()))
+              ->GetFunction(context)
+              .ToLocalChecked())
+      .Check();
+
+  oCromiteObject
+      ->Set(
+          context, gin::StringToSymbol(isolate, "startComponentUpdate"),
+          gin::CreateFunctionTemplate(
+              isolate, base::BindRepeating(
+                           &CromitePrivateApiExtension::StartComponentUpdate,
+                           weak_ptr_factory_.GetWeakPtr()))
+              ->GetFunction(context)
+              .ToLocalChecked())
+      .Check();
+
+  oCromiteObject
+      ->Set(
+          context, gin::StringToSymbol(isolate, "setEnableLogConsole"),
+          gin::CreateFunctionTemplate(
+              isolate, base::BindRepeating(
+                           &CromitePrivateApiExtension::SetEnableLogConsole,
+                           weak_ptr_factory_.GetWeakPtr()))
+              ->GetFunction(context)
+              .ToLocalChecked())
+      .Check();
+}
+
+void CromitePrivateApiExtension::GetComponentData(gin::Arguments* args) {
+  std::string component_id;
+  if (!args->GetNext(&component_id)) {
+    args->ThrowError();
+    return;
+  }
+
+  if (!remote_.is_bound()) {
+    render_frame()->GetRemoteAssociatedInterfaces()->GetInterface(&remote_);
+  }
+
+  v8::Isolate* isolate = args->isolate();
+  v8::Local<v8::Context> context = isolate->GetCurrentContext();
+
+  v8::Local<v8::Promise::Resolver> resolver =
+      v8::Promise::Resolver::New(context).ToLocalChecked();
+  v8::Local<v8::Promise> promise = resolver->GetPromise();
+
+  base::UnguessableToken request_id = base::UnguessableToken::Create();
+  pending_requests_.emplace(
+      request_id,
+      std::make_unique<PendingRequest>(isolate, context, resolver));
+
+  remote_->GetComponentData(component_id,
+      base::BindOnce(&CromitePrivateApiExtension::OnGetComponentData,
+                     weak_ptr_factory_.GetWeakPtr(), request_id));
+
+  args->Return(promise);
+}
+
+void CromitePrivateApiExtension::OnGetComponentData(const base::UnguessableToken callback_id,
+                                                    const std::string& result) {
+  auto iter = pending_requests_.find(callback_id);
+  if (iter == pending_requests_.end())
+    return;
+
+  std::unique_ptr<PendingRequest> request = std::move(iter->second);
+  pending_requests_.erase(iter);
+
+  v8::HandleScope handle_scope(request->isolate);
+  v8::Local<v8::Context> context =
+    request->context.Get(request->isolate);
+  v8::Local<v8::Promise::Resolver> resolver =
+    request->promise_resolver.Get(request->isolate);
+
+  LOG(INFO) << "---CromitePrivateApiExtension::OnGetComponentData4";
+  resolver->Resolve(context,
+                    gin::StringToV8(request->isolate, result))
+      .ToChecked();
+
+  LOG(INFO) << "---CromitePrivateApiExtension::OnGetComponentData5";
+}
+
+void CromitePrivateApiExtension::StartComponentUpdate(gin::Arguments* args) {
+  std::string component_id;
+  if (!args->GetNext(&component_id)) {
+    args->ThrowError();
+    return;
+  }
+
+  if (!remote_.is_bound()) {
+    render_frame()->GetRemoteAssociatedInterfaces()->GetInterface(&remote_);
+  }
+
+  remote_->StartComponentUpdate(component_id);
+}
+
+void CromitePrivateApiExtension::SetEnableLogConsole(gin::Arguments* args) {
+  bool enabled;
+  if (!args->GetNext(&enabled)) {
+    args->ThrowError();
+    return;
+  }
+
+  if (!remote_.is_bound()) {
+    render_frame()->GetRemoteAssociatedInterfaces()->GetInterface(&remote_);
+  }
+
+  remote_->SetEnableLogConsole(enabled);
+}
+diff --git a/chrome/renderer/cromite/cromite_private_api_extension.h b/chrome/renderer/cromite/cromite_private_api_extension.h
+new file mode 100644
+--- /dev/null
+++ b/chrome/renderer/cromite/cromite_private_api_extension.h
+@@ -0,0 +1,65 @@
+#ifndef CHROME_RENDERER_CROMITE_PRIVATE_API_EXTENSION_H_
+#define CHROME_RENDERER_CROMITE_PRIVATE_API_EXTENSION_H_
+
+#include "base/memory/weak_ptr.h"
+#include "chrome/common/cromite_private_api_extension.mojom.h"
+#include "content/public/renderer/render_frame_observer.h"
+#include "mojo/public/cpp/bindings/associated_remote.h"
+#include "v8/include/v8.h"
+
+namespace gin {
+class Arguments;
+}  // namespace gin
+
+class CromitePrivateApiExtension : public content::RenderFrameObserver {
+ public:
+  // Creates a new instance, with ownership transferred to |*frame|.
+  static void Create(content::RenderFrame* frame);
+
+  CromitePrivateApiExtension(const CromitePrivateApiExtension&) =
+      delete;
+  CromitePrivateApiExtension& operator=(
+      const CromitePrivateApiExtension&) = delete;
+
+  ~CromitePrivateApiExtension() override;
+
+  // content::RenderFrameObserver:
+  void OnDestruct() override;
+  void DidCreateScriptContext(v8::Local<v8::Context> v8_context,
+                              int32_t world_id) override;
+
+ private:
+
+ struct PendingRequest {
+    PendingRequest(
+        v8::Isolate* isolate,
+        v8::Local<v8::Context> context,
+        v8::Local<v8::Promise::Resolver> resolver);
+
+    ~PendingRequest();
+
+    raw_ptr<v8::Isolate> isolate;
+    v8::Global<v8::Context> context;
+    v8::Global<v8::Promise::Resolver> promise_resolver;
+  };
+
+  explicit CromitePrivateApiExtension(content::RenderFrame* frame);
+
+  void InjectScript();
+
+  void GetComponentData(gin::Arguments* args);
+  void OnGetComponentData(const base::UnguessableToken callback_id,
+                          const std::string& label);
+  void StartComponentUpdate(gin::Arguments* args);
+  void SetEnableLogConsole(gin::Arguments* args);
+
+  std::map<const base::UnguessableToken,
+           std::unique_ptr<PendingRequest>> pending_requests_;
+
+  mojo::AssociatedRemote<chrome::mojom::CromitePrivateApiExtension>
+      remote_;
+  base::WeakPtrFactory<CromitePrivateApiExtension> weak_ptr_factory_{
+      this};
+};
+
+#endif  // CHROME_RENDERER_CROMITE_PRIVATE_API_EXTENSION_H_
+diff --git a/components/component_updater/component_updater_service.h b/components/component_updater/component_updater_service.h
+--- a/components/component_updater/component_updater_service.h
+++ b/components/component_updater/component_updater_service.h
+@@ -242,6 +242,7 @@ class OnDemandUpdater {
+   // the update will be applied. The caller can subscribe to component update
+   // service notifications and provide an optional callback to get the result
+   // of the call. The function does not implement any cooldown interval.
+ public:
+   virtual void OnDemandUpdate(const std::string& id,
+                               Priority priority,
+                               Callback callback) = 0;
+diff --git a/content/browser/devtools/devtools_http_handler.cc b/content/browser/devtools/devtools_http_handler.cc
+--- a/content/browser/devtools/devtools_http_handler.cc
+++ b/content/browser/devtools/devtools_http_handler.cc
+@@ -16,6 +16,7 @@
+ #include "base/command_line.h"
+ #include "base/compiler_specific.h"
+ #include "base/files/file_util.h"
+#include "base/feature_list.h"
+ #include "base/functional/bind.h"
+ #include "base/functional/callback_helpers.h"
+ #include "base/json/json_writer.h"
+@@ -47,6 +48,7 @@
+ #include "content/public/browser/devtools_socket_factory.h"
+ #include "content/public/common/content_client.h"
+ #include "content/public/common/content_constants.h"
+#include "content/public/common/content_features.h"
+ #include "content/public/common/content_switches.h"
+ #include "content/public/common/url_constants.h"
+ #include "net/base/io_buffer.h"
+@@ -602,9 +604,12 @@ void DevToolsHttpHandler::OnJsonRequest(
+ 
+   if (command == "version") {
+     base::Value::Dict version;
+    auto browser = GetContentClient()->browser()->GetProduct();
+    if (base::FeatureList::IsEnabled(features::kEnableCromiteTestSupport))
+      browser = "Chrome/0.0.0.0";
+     version.Set("Protocol-Version", DevToolsAgentHost::GetProtocolVersion());
+     version.Set("WebKit-Version", embedder_support::GetWebKitVersion());
+-    version.Set("Browser", GetContentClient()->browser()->GetProduct());
+    version.Set("Browser", browser);
+     version.Set("User-Agent", GetContentClient()->browser()->GetUserAgent());
+     version.Set("V8-Version", V8_VERSION_STRING);
+     std::string host = info.GetHeaderValue("host");
+diff --git a/content/browser/log_console_message.cc b/content/browser/log_console_message.cc
+--- a/content/browser/log_console_message.cc
+++ b/content/browser/log_console_message.cc
+@@ -17,10 +17,23 @@ void LogConsoleMessage(blink::mojom::ConsoleMessageLevel log_level,
+                        int32_t line_number,
+                        bool is_builtin_component,
+                        bool is_off_the_record,
+-                       const std::u16string& source_id) {
+                       const std::u16string& source_id,
+                       bool is_log_console_enabled) {
+  if (base::FeatureList::IsEnabled(features::kEnableCromiteTestSupport)) {
+    LOG(INFO) << "CONSOLE:"
+        << "\"" << message << "\", source: " << source_id << " (" << line_number
+        << ")";
+    return;
+  }
+   const int32_t resolved_level =
+       is_builtin_component ? ConsoleMessageLevelToLogSeverity(log_level)
+                            : ::logging::LOGGING_INFO;
+  if (is_log_console_enabled) {
+    logging::LogMessage("CONSOLE", line_number, resolved_level).stream()
+        << "\"" << message << "\", source: " << source_id << " (" << line_number
+        << ")";
+    return;
+  }
+   if (::logging::GetMinLogLevel() > resolved_level)
+     return;
+ 
+diff --git a/content/browser/log_console_message.h b/content/browser/log_console_message.h
+--- a/content/browser/log_console_message.h
+++ b/content/browser/log_console_message.h
+@@ -19,7 +19,8 @@ void LogConsoleMessage(blink::mojom::ConsoleMessageLevel log_level,
+                        int32_t line_number,
+                        bool is_builtin_component,
+                        bool is_off_the_record,
+-                       const std::u16string& source_id);
+                       const std::u16string& source_id,
+                       bool is_log_console_enabled = false);
+ 
+ }  // namespace content
+ 
+diff --git a/content/browser/renderer_host/render_frame_host_impl.cc b/content/browser/renderer_host/render_frame_host_impl.cc
+--- a/content/browser/renderer_host/render_frame_host_impl.cc
+++ b/content/browser/renderer_host/render_frame_host_impl.cc
+@@ -316,6 +316,8 @@
+ #include "url/origin.h"
+ #include "url/url_constants.h"
+ 
+//#include "chrome/browser/cromite/cromite_private_api_host.h"
+
+ #if BUILDFLAG(IS_ANDROID)
+ #include "content/browser/accessibility/browser_accessibility_manager_android.h"
+ #include "content/browser/android/content_url_loader_factory.h"
+@@ -4786,7 +4788,8 @@ void RenderFrameHostImpl::DidAddMessageToConsole(
+   if (delegate_->DidAddMessageToConsole(this, log_level, message, line_no,
+                                         updated_source_id,
+                                         untrusted_stack_trace)) {
+-    return;
+    if (!base::FeatureList::IsEnabled(features::kEnableCromiteTestSupport))
+      return;
+   }
+ 
+   // Pass through log severity only on builtin components pages to limit console
+@@ -4803,8 +4806,14 @@ void RenderFrameHostImpl::DidAddMessageToConsole(
+   const bool is_off_the_record =
+       GetSiteInstance()->GetBrowserContext()->IsOffTheRecord();
+ 
+  bool is_log_console_enabled = false;
+  // CromitePrivateApiHost* cromite_data =
+  //     CromitePrivateApiHost::GetForCurrentDocument(this);
+  // if (cromite_data) {
+  //   is_log_console_enabled = cromite_data->IsLogConsoleEnabled();
+  // }
+   LogConsoleMessage(log_level, message, line_no, is_builtin_component,
+-                    is_off_the_record, updated_source_id);
+                    is_off_the_record, updated_source_id, is_log_console_enabled);
+ }
+ 
+ void RenderFrameHostImpl::FrameSizeChanged(const gfx::Size& frame_size) {
+diff --git a/cromite_flags/chrome/browser/about_flags_cc/Enable-test-support.inc b/cromite_flags/chrome/browser/about_flags_cc/Enable-test-support.inc
+new file mode 100644
+--- /dev/null
+++ b/cromite_flags/chrome/browser/about_flags_cc/Enable-test-support.inc
+@@ -0,0 +1,19 @@
+#ifdef FLAG_SECTION
+
+    {"enable-cromite-test-support",
+     "Enable support for cromite test",
+     "Setting allows the activation of specific APIs used for cromite testing. "
+     "Do not activate if you do not know what you are doing.", kOsAll,
+     FEATURE_VALUE_TYPE(features::kEnableCromiteTestSupport)},
+
+#if BUILDFLAG(IS_ANDROID)
+
+    {"act-as-webview",
+     "Enable webview support for cromite test",
+     "Setting allows the activation of specific APIs used for cromite testing. "
+     "Do not activate if you do not know what you are doing.", kOsAndroid,
+     FEATURE_VALUE_TYPE(features::kActAsWebView)},
+
+#endif
+
+#endif
+diff --git a/cromite_flags/content/public/common/content_features_cc/Enable-test-support.inc b/cromite_flags/content/public/common/content_features_cc/Enable-test-support.inc
+new file mode 100644
+--- /dev/null
+++ b/cromite_flags/content/public/common/content_features_cc/Enable-test-support.inc
+@@ -0,0 +1,7 @@
+CROMITE_FEATURE(kEnableCromiteTestSupport,
+                "EnableCromiteTestSupport",
+                base::FEATURE_DISABLED_BY_DEFAULT);
+
+CROMITE_FEATURE(kActAsWebView,
+                "ActAsWebView",
+                base::FEATURE_DISABLED_BY_DEFAULT);
+diff --git a/cromite_flags/content/public/common/content_features_h/Enable-test-support.inc b/cromite_flags/content/public/common/content_features_h/Enable-test-support.inc
+new file mode 100644
+--- /dev/null
+++ b/cromite_flags/content/public/common/content_features_h/Enable-test-support.inc
+@@ -0,0 +1,2 @@
+CONTENT_EXPORT BASE_DECLARE_FEATURE(kEnableCromiteTestSupport);
+CONTENT_EXPORT BASE_DECLARE_FEATURE(kActAsWebView);
+--
@@ -14,25 +14,25 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 ---
 .../java/res/xml/privacy_preferences.xml      | 15 ++++++
 .../browser/LaunchIntentDispatcher.java       | 21 ++++++++
- .../CustomTabIntentDataProvider.java          |  4 +-
- .../customtabs/CustomTabsConnection.java      |  1 +
- .../IncognitoCustomTabIntentDataProvider.java | 14 ++++++
- .../privacy/settings/PrivacySettings.java     | 50 +++++++++++++++++++
- .../flags/android/chrome_feature_list.cc      |  2 +-
+ .../CustomTabIntentDataProvider.java          | 22 ++++----
+ .../customtabs/CustomTabsConnection.java      |  3 +-
+ .../IncognitoCustomTabIntentDataProvider.java | 14 +++++
+ .../privacy/settings/PrivacySettings.java     | 51 +++++++++++++++++++
+ .../flags/android/chrome_feature_list.cc      |  4 +-
 .../browser/flags/ChromeFeatureList.java      |  3 ++
 .../chrome/browser/tab/TabAssociatedApp.java  |  6 ++-
- ...Add-custom-tab-intents-privacy-option.grdp | 25 ++++++++++
+ ...Add-custom-tab-intents-privacy-option.grdp | 25 +++++++++
 .../OriginVerifier.java                       |  5 ++
 .../core/common/language_experiments.cc       |  1 +
 .../add-custom-tab-intents-privacy-option.inc |  1 +
- 13 files changed, 145 insertions(+), 3 deletions(-)
+ 13 files changed, 158 insertions(+), 13 deletions(-)
 create mode 100644 chrome/browser/ui/android/strings/cromite_android_chrome_strings_grd/Add-custom-tab-intents-privacy-option.grdp
 create mode 100644 cromite_flags/chrome/browser/flags/android/chrome_feature_list_cc/add-custom-tab-intents-privacy-option.inc

 diff --git a/chrome/android/java/res/xml/privacy_preferences.xml b/chrome/android/java/res/xml/privacy_preferences.xml
 --- a/chrome/android/java/res/xml/privacy_preferences.xml
 +++ b/chrome/android/java/res/xml/privacy_preferences.xml
-@@ -52,6 +52,21 @@ found in the LICENSE file.
+@@ -46,6 +46,21 @@ found in the LICENSE file.
         android:key="cromite_flags"
         android:title="@string/cromite_flags_title"
         app:url="@string/cromite_flags_url" />
@@ -57,7 +57,7 @@ diff --git a/chrome/android/java/res/xml/privacy_preferences.xml b/chrome/androi
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/LaunchIntentDispatcher.java b/chrome/android/java/src/org/chromium/chrome/browser/LaunchIntentDispatcher.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/LaunchIntentDispatcher.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/LaunchIntentDispatcher.java
-@@ -61,6 +61,9 @@ import java.lang.annotation.Retention;
+@@ -65,6 +65,9 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.util.Set;
 
@@ -67,7 +67,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/LaunchIntentDis
 /**
  * Dispatches incoming intents to the appropriate activity based on the current configuration and
  * Intent fired.
-@@ -263,6 +266,9 @@ public class LaunchIntentDispatcher {
+@@ -262,6 +265,9 @@ public class LaunchIntentDispatcher {
      */
     public static boolean isCustomTabIntent(Intent intent) {
         if (intent == null) return false;
@@ -77,7 +77,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/LaunchIntentDis
         Log.w(
                 TAG,
                 "CustomTabsIntent#shouldAlwaysUseBrowserUI() = "
-@@ -291,6 +297,10 @@ public class LaunchIntentDispatcher {
+@@ -290,6 +296,10 @@ public class LaunchIntentDispatcher {
         // Make sure the result of the CustomTabActivity is forwarded to the client.
         newIntent.addFlags(Intent.FLAG_ACTIVITY_FORWARD_RESULT);
 
@@ -88,7 +88,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/LaunchIntentDis
         // Since configureIntentForResizableCustomTab() might change the componenet/class
         // associated with the passed intent, it needs to be called after #setClassName(context,
         // CustomTabActivity.class.getName());
-@@ -483,6 +493,17 @@ public class LaunchIntentDispatcher {
+@@ -486,6 +496,17 @@ public class LaunchIntentDispatcher {
 
         if (Intent.ACTION_VIEW.equals(newIntent.getAction())
                 && !IntentHandler.wasIntentSenderChrome(newIntent)) {
@@ -103,13 +103,56 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/LaunchIntentDis
 +                IntentHandler.setTabLaunchType(newIntent, TabLaunchType.FROM_EXTERNAL_APP);
 +                newIntent.setFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
 +            }
-             if (!chromeTabbedTaskExists()) {
+             if (!chromeTabbedTaskExists(mActivity)) {
                 newIntent.putExtra(IntentHandler.EXTRA_STARTED_TABBED_CHROME_TASK, true);
             }
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabIntentDataProvider.java b/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabIntentDataProvider.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabIntentDataProvider.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabIntentDataProvider.java
-@@ -1257,7 +1257,9 @@ public class CustomTabIntentDataProvider extends BrowserServicesIntentDataProvid
+@@ -239,16 +239,16 @@ public class CustomTabIntentDataProvider extends BrowserServicesIntentDataProvid
+ 
+     // Extra whose value is an array of ints that is supplied to
+     // SyntheticTrialRegistry::RegisterExternalExperiments().
+-    public static final String EXPERIMENT_IDS =
+-            "org.chromium.chrome.browser.customtabs.AGA_EXPERIMENT_IDS";
+    // public static final String EXPERIMENT_IDS =
+    //         "org.chromium.chrome.browser.customtabs.AGA_EXPERIMENT_IDS";
+ 
+     // These Extra Intent parameters allow an Intent to enable or disable a set of Features.
+     // The set of Features that may be enabled or disabled is restricted by the code,
+     // and initially only two Features may be enabled together, or disabled together.
+-    public static final String EXPERIMENTS_ENABLE =
+-            "org.chromium.chrome.browser.customtabs.EXPERIMENTS_ENABLE";
+-    public static final String EXPERIMENTS_DISABLE =
+-            "org.chromium.chrome.browser.customtabs.EXPERIMENTS_DISABLE";
+    // public static final String EXPERIMENTS_ENABLE =
+    //         "org.chromium.chrome.browser.customtabs.EXPERIMENTS_ENABLE";
+    // public static final String EXPERIMENTS_DISABLE =
+    //         "org.chromium.chrome.browser.customtabs.EXPERIMENTS_DISABLE";
+ 
+     /**
+      * Extra that, if set, makes the Custom Tab Activity's height to be x pixels, the Custom Tab
+@@ -697,7 +697,7 @@ public class CustomTabIntentDataProvider extends BrowserServicesIntentDataProvid
+                                 TrustedWebActivityIntentBuilder.EXTRA_SCREEN_ORIENTATION,
+                                 ScreenOrientation.DEFAULT));
+ 
+-        mGsaExperimentIds = IntentUtils.safeGetIntArrayExtra(intent, EXPERIMENT_IDS);
+        mGsaExperimentIds = null; //IntentUtils.safeGetIntArrayExtra(intent, EXPERIMENT_IDS);
+ 
+         mBreakPointDp = getActivityBreakPointFromIntent(intent);
+         mInitialActivityHeight = getInitialActivityHeightFromIntent(intent);
+@@ -710,8 +710,8 @@ public class CustomTabIntentDataProvider extends BrowserServicesIntentDataProvid
+                         intent, EXTRA_ACTIVITY_HEIGHT_RESIZE_BEHAVIOR, ACTIVITY_HEIGHT_DEFAULT);
+         mIsPartialCustomTabFixedHeight = activityHeightResizeBehavior == ACTIVITY_HEIGHT_FIXED;
+ 
+-        mInteractWithBackground = CustomTabsIntent.isBackgroundInteractionEnabled(intent);
+-        if (IntentUtils.safeHasExtra(intent, EXTRA_ENABLE_BACKGROUND_INTERACTION)) {
+        mInteractWithBackground = false; // CustomTabsIntent.isBackgroundInteractionEnabled(intent);
+        if (((false)) && IntentUtils.safeHasExtra(intent, EXTRA_ENABLE_BACKGROUND_INTERACTION)) {
+             @BackgroundInteractBehavior
+             int backgroundInteractBehavior =
+                     IntentUtils.safeGetIntExtra(
+@@ -1369,7 +1369,9 @@ public class CustomTabIntentDataProvider extends BrowserServicesIntentDataProvid
     public @CustomTabProfileType int getCustomTabMode() {
         return AlwaysIncognitoLinkInterceptor.isAlwaysIncognito()
                 ? CustomTabProfileType.INCOGNITO
@@ -123,7 +166,16 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/customtabs/Cust
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabsConnection.java b/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabsConnection.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabsConnection.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabsConnection.java
-@@ -968,6 +968,7 @@ public class CustomTabsConnection {
+@@ -786,7 +786,7 @@ public class CustomTabsConnection {
+         ThreadUtils.assertOnUiThread();
+         if (extras == null) return;
+         int[] experimentIds =
+-                IntentUtils.safeGetIntArray(extras, CustomTabIntentDataProvider.EXPERIMENT_IDS);
+                null; //IntentUtils.safeGetIntArray(extras, CustomTabIntentDataProvider.EXPERIMENT_IDS);
+         if (experimentIds == null) return;
+         // When ids are set through cct, they should not override existing ids.
+         boolean override = false;
+@@ -1003,6 +1003,7 @@ public class CustomTabsConnection {
         PostTask.postTask(
                 TaskTraits.UI_DEFAULT,
                 () -> {
@@ -134,7 +186,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/customtabs/Cust
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/customtabs/IncognitoCustomTabIntentDataProvider.java b/chrome/android/java/src/org/chromium/chrome/browser/customtabs/IncognitoCustomTabIntentDataProvider.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/customtabs/IncognitoCustomTabIntentDataProvider.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/customtabs/IncognitoCustomTabIntentDataProvider.java
-@@ -40,6 +40,9 @@ import org.chromium.components.browser_ui.widget.TintedDrawable;
+@@ -44,6 +44,9 @@ import org.chromium.components.browser_ui.widget.TintedDrawable;
 import java.util.ArrayList;
 import java.util.List;
 
@@ -144,7 +196,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/customtabs/Inco
 /**
  * A model class that parses the incoming intent for incognito Custom Tabs specific customization
  * data.
-@@ -121,6 +124,9 @@ public class IncognitoCustomTabIntentDataProvider extends BrowserServicesIntentD
+@@ -133,6 +136,9 @@ public class IncognitoCustomTabIntentDataProvider extends BrowserServicesIntentD
     }
 
     private static boolean isIntentFromThirdPartyAllowed() {
@@ -154,7 +206,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/customtabs/Inco
         return ChromeFeatureList.sCctIncognitoAvailableToThirdParty.isEnabled();
     }
 
-@@ -220,6 +226,10 @@ public class IncognitoCustomTabIntentDataProvider extends BrowserServicesIntentD
+@@ -230,6 +236,10 @@ public class IncognitoCustomTabIntentDataProvider extends BrowserServicesIntentD
     }
 
     public static boolean isValidIncognitoIntent(Intent intent, boolean recordMetrics) {
@@ -165,7 +217,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/customtabs/Inco
         if (!isIncognitoRequested(intent)) return false;
         var session = SessionHolder.getSessionHolderFromIntent(intent);
         if (isIntentFromThirdPartyAllowed()
-@@ -329,6 +339,10 @@ public class IncognitoCustomTabIntentDataProvider extends BrowserServicesIntentD
+@@ -340,6 +350,10 @@ public class IncognitoCustomTabIntentDataProvider extends BrowserServicesIntentD
 
     @Override
     public @CustomTabProfileType int getCustomTabMode() {
@@ -179,7 +231,15 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/customtabs/Inco
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/privacy/settings/PrivacySettings.java b/chrome/android/java/src/org/chromium/chrome/browser/privacy/settings/PrivacySettings.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/privacy/settings/PrivacySettings.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/privacy/settings/PrivacySettings.java
-@@ -80,6 +80,15 @@ import org.chromium.ui.text.SpanApplier;
+@@ -11,6 +11,7 @@ import android.content.Context;
+ import android.content.Intent;
+ import android.content.SharedPreferences;
+ import android.graphics.drawable.Drawable;
+import android.os.Build;
+ import android.os.Bundle;
+ import android.text.SpannableString;
+ import android.text.style.ClickableSpan;
+@@ -80,6 +81,15 @@ import org.chromium.ui.text.SpanApplier;
 import java.util.concurrent.TimeUnit;
 import java.util.function.Consumer;
 
@@ -195,7 +255,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/privacy/setting
 import androidx.preference.PreferenceCategory;
 import org.chromium.chrome.browser.contextualsearch.ContextualSearchManager;
 import org.chromium.base.shared_preferences.SharedPreferencesManager;
-@@ -149,6 +158,9 @@ public class PrivacySettings extends ChromeBaseSettingsFragment
+@@ -148,6 +158,9 @@ public class PrivacySettings extends ChromeBaseSettingsFragment
                 startTag, endTag, new ChromeClickableSpan(context, onClickCallback));
     }
 
@@ -205,7 +265,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/privacy/setting
     @Override
     public void onCreatePreferencesCromite(@Nullable Bundle savedInstanceState, @Nullable String rootKey) {
         mPageTitle.set(getString(R.string.prefs_privacy_security));
-@@ -376,6 +388,9 @@ public class PrivacySettings extends ChromeBaseSettingsFragment
+@@ -376,6 +389,9 @@ public class PrivacySettings extends ChromeBaseSettingsFragment
                 new SpanApplier.SpanInfo("<link2>", "</link2>", servicesLink));
     }
 
@@ -215,7 +275,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/privacy/setting
     @Override
     public boolean onPreferenceChange(Preference preference, Object newValue) {
         String key = preference.getKey();
-@@ -396,6 +411,31 @@ public class PrivacySettings extends ChromeBaseSettingsFragment
+@@ -396,6 +412,31 @@ public class PrivacySettings extends ChromeBaseSettingsFragment
         } else if (PREF_SEARCH_SUGGESTIONS.equals(key)) {
             UserPrefs.get(getProfile())
                     .setBoolean(Pref.SEARCH_SUGGEST_ENABLED, (boolean) newValue);
@@ -247,7 +307,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/privacy/setting
         }
         return true;
     }
-@@ -428,6 +468,16 @@ public class PrivacySettings extends ChromeBaseSettingsFragment
+@@ -428,6 +469,16 @@ public class PrivacySettings extends ChromeBaseSettingsFragment
                     UserPrefs.get(getProfile()).getBoolean(Pref.CAN_MAKE_PAYMENT_ENABLED));
         }
 
@@ -267,29 +327,31 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/privacy/setting
 diff --git a/chrome/browser/flags/android/chrome_feature_list.cc b/chrome/browser/flags/android/chrome_feature_list.cc
 --- a/chrome/browser/flags/android/chrome_feature_list.cc
 +++ b/chrome/browser/flags/android/chrome_feature_list.cc
-@@ -1020,7 +1020,7 @@ BASE_FEATURE(kMagicStackAndroid,
+@@ -713,7 +713,9 @@ BASE_FEATURE(kMagicStackAndroid, base::FEATURE_ENABLED_BY_DEFAULT);
 // Enables an experimental feature which forces mayLaunchUrl to use a different
 // storage partition. This may reduce performance. This should not be enabled by
 // default.
-BASE_FEATURE(kMayLaunchUrlUsesSeparateStoragePartition,
+-BASE_FEATURE(kMayLaunchUrlUsesSeparateStoragePartition, base::FEATURE_DISABLED_BY_DEFAULT);
 +CROMITE_FEATURE(kMayLaunchUrlUsesSeparateStoragePartition,
-              "MayLaunchUrlUsesSeparateStoragePartition",
-              base::FEATURE_DISABLED_BY_DEFAULT);
- 
+                "MayLaunchUrlUsesSeparateStoragePartition",
+                base::FEATURE_DISABLED_BY_DEFAULT);
+ BASE_FEATURE(kMediaIndicatorsAndroid, base::FEATURE_DISABLED_BY_DEFAULT);
+ BASE_FEATURE(kMiniOriginBar, base::FEATURE_ENABLED_BY_DEFAULT);
+ BASE_FEATURE(kMostVisitedTilesCustomization, base::FEATURE_ENABLED_BY_DEFAULT);
 diff --git a/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureList.java b/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureList.java
 --- a/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureList.java
 +++ b/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureList.java
-@@ -825,6 +825,8 @@ public abstract class ChromeFeatureList {
-     public static final CachedFlag sMiniOriginBar = newCachedFlag(MINI_ORIGIN_BAR, false, true);
-     public static final CachedFlag sMostVisitedTilesCustomization =
-             newCachedFlag(MOST_VISITED_TILES_CUSTOMIZATION, false);
+@@ -989,6 +989,8 @@ public abstract class ChromeFeatureList {
+                     MOST_VISITED_TILES_CUSTOMIZATION,
+                     /* defaultValue= */ true,
+                     /* defaultValueInTests= */ true);
 +    public static final CachedFlag sMayLaunchurlUsesSeparateStoragePartition =
 +            newCachedFlag(MAYLAUNCHURL_USES_SEPARATE_STORAGE_PARTITION, false);
     public static final CachedFlag sMostVisitedTilesReselect =
             newCachedFlag(MOST_VISITED_TILES_RESELECT, false);
     public static final CachedFlag sMultiInstanceApplicationStatusCleanup =
-@@ -1013,6 +1015,7 @@ public abstract class ChromeFeatureList {
-                     sMagicStackAndroid,
+@@ -1236,6 +1238,7 @@ public abstract class ChromeFeatureList {
+                     sMaliciousApkDownloadCheck,
                     sMiniOriginBar,
                     sMostVisitedTilesCustomization,
 +                    sMayLaunchurlUsesSeparateStoragePartition,
@@ -345,7 +407,7 @@ new file mode 100644
 diff --git a/components/content_relationship_verification/android/java/src/org/chromium/components/content_relationship_verification/OriginVerifier.java b/components/content_relationship_verification/android/java/src/org/chromium/components/content_relationship_verification/OriginVerifier.java
 --- a/components/content_relationship_verification/android/java/src/org/chromium/components/content_relationship_verification/OriginVerifier.java
 +++ b/components/content_relationship_verification/android/java/src/org/chromium/components/content_relationship_verification/OriginVerifier.java
-@@ -180,6 +180,11 @@ public abstract class OriginVerifier {
+@@ -181,6 +181,11 @@ public abstract class OriginVerifier {
         assert mNativeOriginVerifier != 0
                 : "Either provide a browserContextHandle to "
                         + "OriginVerifier#ctor or call initNativeOriginVerifier.";
@@ -360,9 +422,9 @@ diff --git a/components/content_relationship_verification/android/java/src/org/c
 diff --git a/components/language/core/common/language_experiments.cc b/components/language/core/common/language_experiments.cc
 --- a/components/language/core/common/language_experiments.cc
 +++ b/components/language/core/common/language_experiments.cc
-@@ -32,4 +32,5 @@ BASE_FEATURE(kDisableGeoLanguageModel,
- // Params:
- const char kContentLanguagesDisableObserversParam[] = "disable_observers";
+@@ -20,4 +20,5 @@ BASE_FEATURE(kTranslateOpenSettings, base::FEATURE_DISABLED_BY_DEFAULT);
+ 
+ BASE_FEATURE(kDisableGeoLanguageModel, base::FEATURE_ENABLED_BY_DEFAULT);
 
 +SET_CROMITE_FEATURE_DISABLED(kCctAutoTranslate);
 }  // namespace language
@@ -371,5 +433,5 @@ new file mode 100644
 --- /dev/null
 +++ b/cromite_flags/chrome/browser/flags/android/chrome_feature_list_cc/add-custom-tab-intents-privacy-option.inc
@@ -0,0 +1 @@
-+SET_CROMITE_FEATURE_DISABLED(kCCTIntentFeatureOverrides);
+// explicitly empty
 --
@@ -6,49 +6,38 @@ Corrected Exit functionality

 License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 ---
- chrome/android/java/res/menu/main_menu.xml                  | 6 ++++++
- .../org/chromium/chrome/browser/ChromeTabbedActivity.java   | 4 ++++
- .../src/org/chromium/chrome/browser/app/ChromeActivity.java | 6 ++++++
- .../chrome/browser/init/ChromeLifetimeController.java       | 2 ++
- .../browser/ui/android/strings/android_chrome_strings.grd   | 3 +++
- 5 files changed, 21 insertions(+)
+ chrome/android/java/res/values/ids.xml                     | 1 +
+ .../org/chromium/chrome/browser/ChromeTabbedActivity.java  | 4 ++++
+ .../org/chromium/chrome/browser/app/ChromeActivity.java    | 6 ++++++
+ .../chrome/browser/init/ChromeLifetimeController.java      | 2 ++
+ .../tabbed_mode/TabbedAppMenuPropertiesDelegate.java       | 7 +++++++
+ .../browser/ui/android/strings/android_chrome_strings.grd  | 3 +++
+ 6 files changed, 23 insertions(+)

-diff --git a/chrome/android/java/res/menu/main_menu.xml b/chrome/android/java/res/menu/main_menu.xml
--- a/chrome/android/java/res/menu/main_menu.xml
-+++ b/chrome/android/java/res/menu/main_menu.xml
-@@ -181,6 +181,9 @@ found in the LICENSE file.
-         <item android:id="@+id/managed_by_menu_id"
-             android:title="@string/managed_browser"
-             android:icon="@drawable/ic_business" />
-+        <item android:id="@+id/exit_id"
-+            android:title="@string/menu_exit"
-+            android:icon="@drawable/ic_exit_to_app_white_24dp" />
-     </group>
+diff --git a/chrome/android/java/res/values/ids.xml b/chrome/android/java/res/values/ids.xml
+--- a/chrome/android/java/res/values/ids.xml
+++ b/chrome/android/java/res/values/ids.xml
+@@ -125,6 +125,7 @@ found in the LICENSE file.
+     <item type="id" name="ntp_feed_header_menu_item_toggle_switch" />
 
-     <!-- Items shown only in the tab switcher -->
-@@ -213,6 +216,9 @@ found in the LICENSE file.
-         <item android:id="@id/preferences_id"
-             android:title="@string/menu_settings"
-             android:icon="@drawable/settings_cog" />
-+        <item android:id="@+id/exit_id"
-+            android:title="@string/menu_exit"
-+            android:icon="@drawable/ic_exit_to_app_white_24dp" />
-     </group>
- 
-     <!-- Items shown only when the tablet has no visible tabs -->
+     <!-- App Menu -->
+    <item type="id" name="exit_id" />
+     <item type="id" name="icon_row_menu_id" />
+     <item type="id" name="submenu_header_menu_id" />
+     <item type="id" name="forward_menu_id" />
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java b/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java
-@@ -326,6 +326,8 @@ import java.util.Map;
- import java.util.Set;
+@@ -363,6 +363,8 @@ import java.util.Set;
 import java.util.concurrent.atomic.AtomicBoolean;
+ import java.util.function.Supplier;
 
 +import org.chromium.chrome.browser.lifetime.ApplicationLifetime;
 +
 /**
  * This is the main activity for ChromeMobile when not running in document mode. All the tabs are
  * accessible via a chrome specific tab switching UI.
-@@ -3361,6 +3363,8 @@ public class ChromeTabbedActivity extends ChromeActivity {
+@@ -3901,6 +3903,8 @@ public class ChromeTabbedActivity extends ChromeActivity implements PreAttachInt
                     .closeTabs(
                             TabClosureParams.closeTab(currentTab).build(), /* allowDialog= */ true);
             RecordUserAction.record("MobileTabClosed");
@@ -60,7 +49,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedAct
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/app/ChromeActivity.java b/chrome/android/java/src/org/chromium/chrome/browser/app/ChromeActivity.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/app/ChromeActivity.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/app/ChromeActivity.java
-@@ -60,6 +60,7 @@ import org.chromium.base.supplier.UnownedUserDataSupplier;
+@@ -68,6 +68,7 @@ import org.chromium.base.supplier.UnownedUserDataSupplier;
 import org.chromium.chrome.R;
 import org.chromium.chrome.browser.ActivityTabProvider;
 import org.chromium.chrome.browser.ActivityUtils;
@@ -68,7 +57,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/app/ChromeActiv
 import org.chromium.chrome.browser.ChromeActivitySessionTracker;
 import org.chromium.chrome.browser.ChromeApplicationImpl;
 import org.chromium.chrome.browser.ChromeKeyboardVisibilityDelegate;
-@@ -2419,6 +2420,11 @@ public abstract class ChromeActivity extends AsyncInitializationActivity
+@@ -2633,6 +2634,11 @@ public abstract class ChromeActivity extends AsyncInitializationActivity
             return true;
         }
 
@@ -83,15 +72,15 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/app/ChromeActiv
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/init/ChromeLifetimeController.java b/chrome/android/java/src/org/chromium/chrome/browser/init/ChromeLifetimeController.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/init/ChromeLifetimeController.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/init/ChromeLifetimeController.java
-@@ -18,6 +18,7 @@ import org.chromium.base.ContextUtils;
- import org.chromium.base.ThreadUtils;
+@@ -20,6 +20,7 @@ import org.chromium.build.annotations.MonotonicNonNull;
+ import org.chromium.build.annotations.NullMarked;
 import org.chromium.chrome.browser.BrowserRestartActivity;
 import org.chromium.chrome.browser.lifetime.ApplicationLifetime;
 +import org.chromium.chrome.browser.incognito.IncognitoNotificationManager;
 
 /**
  * Answers requests to kill and (potentially) restart Chrome's main browser process.
-@@ -73,6 +74,7 @@ class ChromeLifetimeController
+@@ -76,6 +77,7 @@ class ChromeLifetimeController
 
     @Override
     public void onTerminate(boolean restart) {
@@ -99,10 +88,27 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/init/ChromeLife
         mRestartChromeOnDestroy = restart;
 
         // Tell all Chrome Activities to finish themselves.
+diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedAppMenuPropertiesDelegate.java b/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedAppMenuPropertiesDelegate.java
+--- a/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedAppMenuPropertiesDelegate.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedAppMenuPropertiesDelegate.java
+@@ -422,6 +422,13 @@ public class TabbedAppMenuPropertiesDelegate extends AppMenuPropertiesDelegateIm
+             maybeAddDividerLine(modelList, R.id.menu_item_content_filter_divider_line_id);
+             modelList.add(buildContentFilterHelpCenterMenuItem(currentTab));
+         }
+
+        modelList.add(new MVCListAdapter.ListItem(
+                AppMenuHandler.AppMenuItemType.STANDARD,
+                buildModelForStandardMenuItem(
+                        R.id.exit_id,
+                        R.string.menu_exit,
+                        shouldShowIconBeforeItem() ? R.drawable.ic_exit_to_app_white_24dp : 0)));
+     }
+ 
+     private Runnable buildUpdateStateChangedObserver() {
 diff --git a/chrome/browser/ui/android/strings/android_chrome_strings.grd b/chrome/browser/ui/android/strings/android_chrome_strings.grd
 --- a/chrome/browser/ui/android/strings/android_chrome_strings.grd
 +++ b/chrome/browser/ui/android/strings/android_chrome_strings.grd
-@@ -4436,6 +4436,9 @@ To change this setting, <ph name="BEGIN_LINK">BEGIN_LINK</ph>delete the Chrome d
+@@ -4437,6 +4437,9 @@ To change this setting, <ph name="BEGIN_LINK">BEGIN_LINK</ph>delete the Chrome d
       <message name="IDS_MENU_AUTO_DARK_WEB_CONTENTS" desc="Menu item in Chrome's overflow/options menu. When Chrome's browser UI is set to dark theme and this option is checked, sites will have a dark theme automatically applied as well. [CHAR_LIMIT=24]">
         Dark theme
       </message>
@@ -18,7 +18,7 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 diff --git a/components/omnibox/browser/autocomplete_controller.cc b/components/omnibox/browser/autocomplete_controller.cc
 --- a/components/omnibox/browser/autocomplete_controller.cc
 +++ b/components/omnibox/browser/autocomplete_controller.cc
-@@ -22,6 +22,7 @@
+@@ -23,6 +23,7 @@
 
 #include "base/check_op.h"
 #include "base/containers/contains.h"
@@ -26,20 +26,20 @@ diff --git a/components/omnibox/browser/autocomplete_controller.cc b/components/
 #include "base/feature_list.h"
 #include "base/format_macros.h"
 #include "base/functional/bind.h"
-@@ -567,6 +568,15 @@ AutocompleteController::AutocompleteController(
-           provider_client_->GetOmniboxTriggeredFeatureService()),
+@@ -553,6 +554,15 @@ AutocompleteController::AutocompleteController(
       steady_state_omnibox_position_(
-           metrics::OmniboxEventProto::UNKNOWN_POSITION) {
+           metrics::OmniboxEventProto::UNKNOWN_POSITION),
+       config_(config) {
 +  if (base::CommandLine::ForCurrentProcess()->HasSwitch("omnibox-autocomplete-filtering")) {
 +    const std::string flag_value = base::CommandLine::ForCurrentProcess()->GetSwitchValueASCII("omnibox-autocomplete-filtering");
-+    provider_types &= AutocompleteProvider::TYPE_KEYWORD | AutocompleteProvider::TYPE_SEARCH |
+    config_.provider_types &= AutocompleteProvider::TYPE_KEYWORD | AutocompleteProvider::TYPE_SEARCH |
 +        AutocompleteProvider::TYPE_HISTORY_URL | AutocompleteProvider::TYPE_BOOKMARK | AutocompleteProvider::TYPE_BUILTIN;
 +    if (!base::Contains(flag_value, "bookmarks"))
-+      provider_types &= ~AutocompleteProvider::TYPE_BOOKMARK;
+      config_.provider_types &= ~AutocompleteProvider::TYPE_BOOKMARK;
 +    if (!base::Contains(flag_value, "chrome"))
-+      provider_types &= ~AutocompleteProvider::TYPE_BUILTIN;
+      config_.provider_types &= ~AutocompleteProvider::TYPE_BUILTIN;
 +  }
-   provider_types &= ~OmniboxFieldTrial::GetDisabledProviderTypes();
+   config_.provider_types &= ~OmniboxFieldTrial::GetDisabledProviderTypes();
 
   // Providers run in the order they're added. Async providers should run first
 diff --git a/components/omnibox/browser/history_url_provider.cc b/components/omnibox/browser/history_url_provider.cc
@@ -58,7 +58,7 @@ diff --git a/components/omnibox/browser/history_url_provider.cc b/components/omn
 diff --git a/components/omnibox/browser/search_provider.cc b/components/omnibox/browser/search_provider.cc
 --- a/components/omnibox/browser/search_provider.cc
 +++ b/components/omnibox/browser/search_provider.cc
-@@ -14,6 +14,7 @@
+@@ -17,6 +17,7 @@
 #include "base/base64.h"
 #include "base/feature_list.h"
 #include "base/functional/bind.h"
@@ -66,7 +66,7 @@ diff --git a/components/omnibox/browser/search_provider.cc b/components/omnibox/
 #include "base/functional/callback.h"
 #include "base/i18n/break_iterator.h"
 #include "base/i18n/case_conversion.h"
-@@ -628,6 +629,9 @@ void SearchProvider::Run(bool query_is_private) {
+@@ -659,6 +660,9 @@ void SearchProvider::Run(bool query_is_private) {
 }
 
 void SearchProvider::DoHistoryQuery(bool minimal_changes) {
@@ -79,16 +79,16 @@ diff --git a/components/omnibox/browser/search_provider.cc b/components/omnibox/
 diff --git a/components/url_formatter/url_fixer.cc b/components/url_formatter/url_fixer.cc
 --- a/components/url_formatter/url_fixer.cc
 +++ b/components/url_formatter/url_fixer.cc
-@@ -15,6 +15,8 @@
- #include <string_view>
+@@ -11,6 +11,8 @@
 
 #include "base/check_op.h"
+ #include "base/compiler_specific.h"
 +#include "base/containers/contains.h"
 +#include "base/command_line.h"
 #include "base/files/file_path.h"
 #include "base/files/file_util.h"
 #include "base/i18n/char_iterator.h"
-@@ -655,6 +657,8 @@ GURL FixupURLInternal(const std::string& text,
+@@ -640,6 +642,8 @@ GURL FixupURLInternal(const std::string& text,
 
     FixupHost(trimmed, parts.host, parts.scheme.is_valid(), desired_tld, &url);
     if (chrome_url && !parts.host.is_valid()) {
@@ -8,40 +8,13 @@ with limited CPU/memory resources and it is disabled by default.

 License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 ---
- .../common/network_features.cc                  |  3 +++
- .../common/network_features.h                   |  4 ++++
 .../common/network_switch_list.h                |  4 ++++
 .../spoof_checks/top_domains/BUILD.gn           |  1 +
 ...o-configure-maximum-connections-per-host.inc | 17 +++++++++++++++++
 net/socket/client_socket_pool_manager.cc        | 17 +++++++++++++++++
- 6 files changed, 46 insertions(+)
+ 4 files changed, 39 insertions(+)
 create mode 100644 cromite_flags/chrome/browser/about_flags_cc/add-flag-to-configure-maximum-connections-per-host.inc

-diff --git a/components/network_session_configurator/common/network_features.cc b/components/network_session_configurator/common/network_features.cc
--- a/components/network_session_configurator/common/network_features.cc
-+++ b/components/network_session_configurator/common/network_features.cc
-@@ -8,4 +8,7 @@
- 
- namespace features {
- 
-+const char kMaxConnectionsPerHostChoiceDefault[] = "6",
-+                 kMaxConnectionsPerHostChoice15[] = "15";
-+
- }  // namespace features
-diff --git a/components/network_session_configurator/common/network_features.h b/components/network_session_configurator/common/network_features.h
--- a/components/network_session_configurator/common/network_features.h
-+++ b/components/network_session_configurator/common/network_features.h
-@@ -10,6 +10,10 @@
- 
- namespace features {
- 
-+NETWORK_SESSION_CONFIGURATOR_EXPORT extern const char kMaxConnectionsPerHostChoiceDefault[],
-+                 kMaxConnectionsPerHostChoice6[],
-+                 kMaxConnectionsPerHostChoice15[];
-+
- }  // namespace features
- 
- #endif  // COMPONENTS_NETWORK_SESSION_CONFIGURATOR_COMMON_NETWORK_FEATURES_H_
 diff --git a/components/network_session_configurator/common/network_switch_list.h b/components/network_session_configurator/common/network_switch_list.h
 --- a/components/network_session_configurator/common/network_switch_list.h
 +++ b/components/network_session_configurator/common/network_switch_list.h
@@ -54,8 +27,8 @@ diff --git a/components/network_session_configurator/common/network_switch_list.
 +NETWORK_SWITCH(kMaxConnectionsPerHost, "max-connections-per-host")
 +
 // Ignores certificate-related errors.
- NETWORK_SWITCH(kIgnoreCertificateErrors, "ignore-certificate-errors")
- 
+ // Note: In tests using net::EmbeddedTestServer with a custom hostname not
+ // covered by the default test certs, using this switch is usually incorrect.
 diff --git a/components/url_formatter/spoof_checks/top_domains/BUILD.gn b/components/url_formatter/spoof_checks/top_domains/BUILD.gn
 --- a/components/url_formatter/spoof_checks/top_domains/BUILD.gn
 +++ b/components/url_formatter/spoof_checks/top_domains/BUILD.gn
@@ -75,8 +48,8 @@ new file mode 100644
 +#ifdef FEATURE_PARAM_SECTION
 +
 +const FeatureEntry::Choice kMaxConnectionsPerHostChoices[] = {
-+    {features::kMaxConnectionsPerHostChoiceDefault, "", ""},
-+    {features::kMaxConnectionsPerHostChoice15, switches::kMaxConnectionsPerHost, "15"},
+    {/*features::kMaxConnectionsPerHostChoiceDefault*/ "6", "", ""},
+    {/*features::kMaxConnectionsPerHostChoice15*/ "15", switches::kMaxConnectionsPerHost, "15"},
 +};
 +
 +#endif
@@ -92,7 +65,7 @@ new file mode 100644
 diff --git a/net/socket/client_socket_pool_manager.cc b/net/socket/client_socket_pool_manager.cc
 --- a/net/socket/client_socket_pool_manager.cc
 +++ b/net/socket/client_socket_pool_manager.cc
-@@ -22,6 +22,10 @@
+@@ -21,6 +21,10 @@
 #include "net/socket/client_socket_handle.h"
 #include "net/socket/client_socket_pool.h"
 #include "net/socket/connect_job.h"
@@ -103,8 +76,8 @@ diff --git a/net/socket/client_socket_pool_manager.cc b/net/socket/client_socket
 #include "net/ssl/ssl_config.h"
 #include "url/gurl.h"
 #include "url/scheme_host_port.h"
-@@ -164,6 +168,19 @@ void ClientSocketPoolManager::set_max_sockets_per_pool(
- int ClientSocketPoolManager::max_sockets_per_group(
+@@ -165,6 +169,19 @@ void ClientSocketPoolManager::set_socket_soft_cap_per_pool_for_test(
+ size_t ClientSocketPoolManager::max_sockets_per_group(
     HttpNetworkSession::SocketPoolType pool_type) {
   DCHECK_LT(pool_type, HttpNetworkSession::NUM_SOCKET_POOL_TYPES);
 +
@@ -45,13 +45,13 @@ new file mode 100644
 diff --git a/net/BUILD.gn b/net/BUILD.gn
 --- a/net/BUILD.gn
 +++ b/net/BUILD.gn
-@@ -1145,6 +1145,7 @@ component("net") {
+@@ -1182,6 +1182,7 @@ component("net") {
     ":net_deps",
-     "//components/miracle_parameter/common",
     "//components/network_time/time_tracker",
+     "//components/unexportable_keys",
 +    "//components/network_session_configurator/common",
     "//net/http:transport_security_state_generated_files",
-     "//third_party/simdutf:simdutf",
+     "//third_party/simdutf",
   ]
 diff --git a/net/dns/host_resolver_manager.cc b/net/dns/host_resolver_manager.cc
 --- a/net/dns/host_resolver_manager.cc
@@ -64,7 +64,7 @@ diff --git a/net/dns/host_resolver_manager.cc b/net/dns/host_resolver_manager.cc
 #include "net/log/net_log_with_source.h"
 #include "net/socket/client_socket_factory.h"
 #include "net/url_request/url_request_context.h"
-@@ -1489,6 +1490,13 @@ int HostResolverManager::StartIPv6ReachabilityCheck(
+@@ -1493,6 +1494,13 @@ int HostResolverManager::StartIPv6ReachabilityCheck(
     return OK;
   }
 
@@ -15,14 +15,14 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 .../ExternalNavigationDelegateImpl.java       |  4 ++-
 .../cromite/sAllowExternalIntentRequests.java | 33 +++++++++++++++++++
 ...g-to-disable-external-intent-requests.grdp |  9 +++++
- .../android/external_intents_features.cc      |  7 +++-
+ .../android/external_intents_features.cc      |  6 ++++
 .../android/external_intents_features.h       |  1 +
 .../ExternalIntentsFeatures.java              |  6 ++++
 .../ExternalNavigationHandler.java            | 21 ++++++++++++
 ...ag-to-disable-external-intent-requests.inc | 13 ++++++++
 ...t-Delete-block-external-form-redirects.inc | 15 +++++++++
 ...ag-to-disable-external-intent-requests.inc |  3 ++
- 12 files changed, 118 insertions(+), 3 deletions(-)
+ 12 files changed, 118 insertions(+), 2 deletions(-)
 create mode 100644 chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/cromite/sAllowExternalIntentRequests.java
 create mode 100644 chrome/browser/ui/android/strings/cromite_android_chrome_strings_grd/Add-flag-to-disable-external-intent-requests.grdp
 create mode 100644 cromite_flags/chrome/browser/about_flags_cc/Add-flag-to-disable-external-intent-requests.inc
@@ -32,7 +32,7 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 diff --git a/chrome/android/java/res/xml/privacy_preferences.xml b/chrome/android/java/res/xml/privacy_preferences.xml
 --- a/chrome/android/java/res/xml/privacy_preferences.xml
 +++ b/chrome/android/java/res/xml/privacy_preferences.xml
-@@ -77,7 +77,12 @@ found in the LICENSE file.
+@@ -71,7 +71,12 @@ found in the LICENSE file.
         android:title="@string/settings_incognito_tab_lock_title"
         android:summary="@string/settings_incognito_tab_lock_summary_android_setting_off"
         android:persistent="false" />
@@ -49,7 +49,7 @@ diff --git a/chrome/android/java/res/xml/privacy_preferences.xml b/chrome/androi
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabDelegateFactory.java b/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabDelegateFactory.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabDelegateFactory.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabDelegateFactory.java
-@@ -35,6 +35,7 @@ import org.chromium.chrome.browser.ephemeraltab.EphemeralTabCoordinator;
+@@ -38,6 +38,7 @@ import org.chromium.chrome.browser.ephemeraltab.EphemeralTabCoordinator;
 import org.chromium.chrome.browser.externalnav.ExternalNavigationDelegateImpl;
 import org.chromium.chrome.browser.flags.ActivityType;
 import org.chromium.chrome.browser.flags.ChromeFeatureList;
@@ -57,7 +57,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/customtabs/Cust
 import org.chromium.chrome.browser.fullscreen.BrowserControlsManager;
 import org.chromium.chrome.browser.fullscreen.FullscreenManager;
 import org.chromium.chrome.browser.init.ChromeActivityNativeDelegate;
-@@ -126,6 +127,7 @@ public class CustomTabDelegateFactory implements TabDelegateFactory {
+@@ -155,6 +156,7 @@ public class CustomTabDelegateFactory implements TabDelegateFactory {
 
         @Override
         public boolean shouldDisableAllExternalIntents() {
@@ -68,20 +68,20 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/customtabs/Cust
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/externalnav/ExternalNavigationDelegateImpl.java b/chrome/android/java/src/org/chromium/chrome/browser/externalnav/ExternalNavigationDelegateImpl.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/externalnav/ExternalNavigationDelegateImpl.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/externalnav/ExternalNavigationDelegateImpl.java
-@@ -20,6 +20,7 @@ import org.chromium.base.IntentUtils;
- import org.chromium.base.PackageManagerUtils;
- import org.chromium.base.supplier.Supplier;
+@@ -26,6 +26,7 @@ import org.chromium.base.ResettersForTesting;
+ import org.chromium.build.annotations.NullMarked;
+ import org.chromium.build.annotations.Nullable;
 import org.chromium.chrome.browser.ChromeTabbedActivity2;
 +import org.chromium.chrome.browser.flags.cromite.sAllowExternalIntentRequests;
 import org.chromium.chrome.browser.IntentHandler;
- import org.chromium.chrome.browser.password_manager.CctPasswordSavingMetricsRecorderBridge;
- import org.chromium.chrome.browser.safe_browsing.SafeBrowsingBridge;
-@@ -107,7 +108,8 @@ public class ExternalNavigationDelegateImpl implements ExternalNavigationDelegat
- 
+ import org.chromium.chrome.browser.browserservices.intents.WebappConstants;
+ import org.chromium.chrome.browser.document.ChromeLauncherActivity;
+@@ -134,7 +135,8 @@ public class ExternalNavigationDelegateImpl implements ExternalNavigationDelegat
     @Override
-     public boolean shouldDisableExternalIntentRequestsForUrl(GURL url) {
+     public boolean shouldDisableExternalIntentRequestsForUrl(
+             ExternalNavigationParams params, Intent intent) {
 -        return false;
-+        if ("tel".equals(url.getScheme())) return false;
+        if ("tel".equals(params.getUrl().getScheme())) return false;
 +        return !sAllowExternalIntentRequests.getInstance().isEnabled();
     }
 
@@ -141,16 +141,8 @@ new file mode 100644
 diff --git a/components/external_intents/android/external_intents_features.cc b/components/external_intents/android/external_intents_features.cc
 --- a/components/external_intents/android/external_intents_features.cc
 +++ b/components/external_intents/android/external_intents_features.cc
-@@ -28,7 +28,6 @@ const base::Feature* const kFeaturesExposedToJava[] = {
-     &kExternalNavigationDebugLogs,       &kBlockIntentsToSelf,
-     &kNavigationCaptureRefactorAndroid,  &kAuxiliaryNavigationStaysInBrowser,
-     &kReparentTopLevelNavigationFromPWA, &kReparentAuxiliaryNavigationFromPWA};
-
- }  // namespace
- 
- // Alphabetical:
-@@ -57,7 +56,13 @@ BASE_FEATURE(kReparentAuxiliaryNavigationFromPWA,
-              "ReparentAuxiliaryNavigationFromPWA",
+@@ -35,7 +35,13 @@ BASE_FEATURE(kExternalNavigationDebugLogs, base::FEATURE_DISABLED_BY_DEFAULT);
+ BASE_FEATURE(kNavigationCaptureRefactorAndroid,
              base::FEATURE_DISABLED_BY_DEFAULT);
 
 +CROMITE_FEATURE(kIntentBlockExternalFormRedirectsNoGesture,
@@ -173,7 +165,7 @@ diff --git a/components/external_intents/android/external_intents_features.h b/c
 +BASE_DECLARE_FEATURE(kIntentBlockExternalFormRedirectsNoGesture);
 BASE_DECLARE_FEATURE(kExternalNavigationDebugLogs);
 BASE_DECLARE_FEATURE(kBlockFrameRenavigations);
- BASE_DECLARE_FEATURE(kBlockIntentsToSelf);
+ BASE_DECLARE_FEATURE(kNavigationCaptureRefactorAndroid);
 diff --git a/components/external_intents/android/java/src/org/chromium/components/external_intents/ExternalIntentsFeatures.java b/components/external_intents/android/java/src/org/chromium/components/external_intents/ExternalIntentsFeatures.java
 --- a/components/external_intents/android/java/src/org/chromium/components/external_intents/ExternalIntentsFeatures.java
 +++ b/components/external_intents/android/java/src/org/chromium/components/external_intents/ExternalIntentsFeatures.java
@@ -188,13 +180,13 @@ diff --git a/components/external_intents/android/java/src/org/chromium/component
 +            new ExternalIntentsFeature(-1, INTENT_BLOCK_EXTERNAL_FORM_REDIRECT_NO_GESTURE_NAME);
 +
     public static final String EXTERNAL_NAVIGATION_DEBUG_LOGS_NAME = "ExternalNavigationDebugLogs";
-     public static final String BLOCK_INTENTS_TO_SELF_NAME = "BlockIntentsToSelf";
     public static final String NAVIGATION_CAPTURE_REFACTOR_ANDROID_NAME =
+             "NavigationCaptureRefactorAndroid";
 diff --git a/components/external_intents/android/java/src/org/chromium/components/external_intents/ExternalNavigationHandler.java b/components/external_intents/android/java/src/org/chromium/components/external_intents/ExternalNavigationHandler.java
 --- a/components/external_intents/android/java/src/org/chromium/components/external_intents/ExternalNavigationHandler.java
 +++ b/components/external_intents/android/java/src/org/chromium/components/external_intents/ExternalNavigationHandler.java
-@@ -1560,6 +1560,12 @@ public class ExternalNavigationHandler {
-                 || ignoreBackForwardNav(params);
+@@ -1726,6 +1726,12 @@ public class ExternalNavigationHandler {
+         return false;
     }
 
 +    /** Wrapper of check against the feature to support overriding for testing. */
@@ -206,7 +198,7 @@ diff --git a/components/external_intents/android/java/src/org/chromium/component
     private OverrideUrlLoadingResult shouldOverrideUrlLoadingInternal(
             ExternalNavigationParams params,
             Intent targetIntent,
-@@ -1617,6 +1623,21 @@ public class ExternalNavigationHandler {
+@@ -1811,6 +1817,21 @@ public class ExternalNavigationHandler {
             return OverrideUrlLoadingResult.forNoOverride();
         }
 
@@ -20,7 +20,7 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 diff --git a/content/child/runtime_features.cc b/content/child/runtime_features.cc
 --- a/content/child/runtime_features.cc
 +++ b/content/child/runtime_features.cc
-@@ -104,6 +104,7 @@ void SetRuntimeFeatureDefaultsForPlatform(
+@@ -106,6 +106,7 @@ void SetRuntimeFeatureDefaultsForPlatform(
   if (command_line.HasSwitch(switches::kDisableMediaSessionAPI)) {
     WebRuntimeFeatures::EnableMediaSession(false);
   }
@@ -59,14 +59,14 @@ new file mode 100644
 diff --git a/third_party/blink/public/platform/web_runtime_features.h b/third_party/blink/public/platform/web_runtime_features.h
 --- a/third_party/blink/public/platform/web_runtime_features.h
 +++ b/third_party/blink/public/platform/web_runtime_features.h
-@@ -71,6 +71,7 @@ class BLINK_PLATFORM_EXPORT WebRuntimeFeatures : public WebRuntimeFeaturesBase {
+@@ -70,6 +70,7 @@ class BLINK_PLATFORM_EXPORT WebRuntimeFeatures : public WebRuntimeFeaturesBase {
   static void EnableFingerprintingCanvasImageDataNoise(bool);
   static void EnableFluentScrollbars(bool);
   static void EnableFluentOverlayScrollbars(bool);
 +  static void EnableVibration(bool);
 
-   WebRuntimeFeatures() = delete;
- };
+   static void EnableLocalNetworkAccessWebRTC(bool);
+ 
 diff --git a/third_party/blink/renderer/modules/vibration/vibration_controller.cc b/third_party/blink/renderer/modules/vibration/vibration_controller.cc
 --- a/third_party/blink/renderer/modules/vibration/vibration_controller.cc
 +++ b/third_party/blink/renderer/modules/vibration/vibration_controller.cc
@@ -78,7 +78,7 @@ diff --git a/third_party/blink/renderer/modules/vibration/vibration_controller.c
 
 // Maximum number of entries in a vibration pattern.
 const unsigned kVibrationPatternLengthMax = 99;
-@@ -108,6 +109,8 @@ bool VibrationController::vibrate(Navigator& navigator,
+@@ -105,6 +106,8 @@ bool VibrationController::vibrate(Navigator& navigator,
   // reference to |window| or |navigator| was retained in another window.
   if (!navigator.DomWindow())
     return false;
@@ -104,7 +104,7 @@ diff --git a/third_party/blink/renderer/platform/exported/web_runtime_features.c
 diff --git a/third_party/blink/renderer/platform/runtime_enabled_features.json5 b/third_party/blink/renderer/platform/runtime_enabled_features.json5
 --- a/third_party/blink/renderer/platform/runtime_enabled_features.json5
 +++ b/third_party/blink/renderer/platform/runtime_enabled_features.json5
-@@ -987,6 +987,10 @@
+@@ -1138,6 +1138,10 @@
     {
       name: "CompositingDecisionAtAnimationPhaseBoundaries"
     },
@@ -7,41 +7,44 @@ Allows build with clangd by suppressing unsupported parameters
 Original License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 ---
- build/config/compiler/BUILD.gn | 14 +++++++++++---
- build_overrides/build.gni      |  3 +++
- 2 files changed, 14 insertions(+), 3 deletions(-)
+ build/config/compiler/BUILD.gn | 17 ++++++++++++++---
+ build_overrides/build.gni      |  5 +++++
+ 2 files changed, 19 insertions(+), 3 deletions(-)

 diff --git a/build/config/compiler/BUILD.gn b/build/config/compiler/BUILD.gn
 --- a/build/config/compiler/BUILD.gn
 +++ b/build/config/compiler/BUILD.gn
-@@ -640,7 +640,7 @@ config("compiler") {
-     # Enable ELF CREL (see crbug.com/357878242) for all platforms that use ELF
-     # (excluding toolchains that use an older version of LLVM).
+@@ -734,7 +734,7 @@ config("compiler") {
     # TODO(crbug.com/376278218): This causes segfault on Linux ARM builds.
-    if (is_linux && use_lld && !llvm_android_mainline && current_cpu != "arm" &&
-+    if (is_linux && !skip_clangd_unsupported_options && use_lld && !llvm_android_mainline && current_cpu != "arm" &&
-         default_toolchain != "//build/toolchain/cros:target") {
+     # It also causes segfault on Linux s390x:
+     # https://github.com/llvm/llvm-project/issues/149511
+-    if (is_linux && use_lld && current_cpu != "arm" && current_cpu != "s390x") {
+    if (is_linux && !skip_clangd_unsupported_options && use_lld && current_cpu != "arm" && current_cpu != "s390x") {
       cflags += [ "-Wa,--crel,--allow-experimental-crel" ]
     }
-@@ -1784,7 +1784,7 @@ config("clang_revision") {
+   }
+@@ -1830,7 +1830,7 @@ config("clang_revision") {
+ # e.g. by setting in the the project's .gn file.
 config("clang_warning_suppression") {
   # Some build configs use older versions of clang that don't support WSMs
-   if (!is_nacl && default_toolchain != "//build/toolchain/cros:target" &&
-      !llvm_android_mainline && is_clang &&
-+      !llvm_android_mainline && is_clang && !skip_clangd_unsupported_options &&
-       clang_warning_suppression_file != "") {
+-  if (use_clang_warning_suppression_file) {
+  if (use_clang_warning_suppression_file && !skip_clangd_unsupported_options) {
     from_build_root =
         rebase_path(clang_warning_suppression_file, root_build_dir)
-@@ -2146,7 +2146,6 @@ config("default_warnings") {
-         # TODO(crbug.com/376641662): Fix and re-enable.
-         "-Wno-nontrivial-memcall",
-       ]
+     inputs = [ clang_warning_suppression_file ]
+@@ -2192,7 +2192,9 @@ config("default_warnings") {
+       # TODO(crbug.com/432275627): Fix and re-enable.
+       "-Wno-uninitialized-const-pointer",
+     ]
 -
-       cflags_cc += [
-         # TODO(crbug.com/328490295): Fix and re-enable for C flags.
-         "-Wenum-compare-conditional",
-@@ -2187,6 +2186,15 @@ config("default_warnings") {
-       ]
+    if (skip_clangd_unsupported_options) {
+      cflags -= [ "-Wno-uninitialized-const-pointer" ]
+    }
+     cflags_cc += [
+       # TODO(crbug.com/328490295): Fix and re-enable for C flags.
+       "-Wenum-compare-conditional",
+@@ -2246,6 +2248,15 @@ config("default_warnings") {
+       ldflags += [ "-Wno-version-check" ]
     }
 
 +    if (skip_clangd_unsupported_options) {
@@ -59,14 +62,16 @@ diff --git a/build/config/compiler/BUILD.gn b/build/config/compiler/BUILD.gn
 diff --git a/build_overrides/build.gni b/build_overrides/build.gni
 --- a/build_overrides/build.gni
 +++ b/build_overrides/build.gni
-@@ -62,6 +62,9 @@ declare_args() {
-   # to lack of toolchain support.
-   gtest_enable_absl_printers = !is_nacl
+@@ -54,6 +54,11 @@ declare_args() {
+   gtest_enable_absl_printers = true
+ }
 
+declare_args() {
 +  # Allows clangd builds by suppressing unsupported parameters
 +  skip_clangd_unsupported_options = false
+}
 +
-   # Allow projects that wish to stay on C++17 to override Chromium's default.
-   # TODO(crbug.com/40251117): evaluate removing this end of 2023
-   use_cxx17 = false
+ # Features used by //base/trace_event.
+ declare_args() {
+   # Use Perfetto's trace processor for converting protobuf-encoded traces to
 --
@@ -4,8 +4,9 @@ Subject: Add menu item to bookmark all tabs

 License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 ---
- chrome/android/java/res/menu/main_menu.xml    |  7 +++
+ chrome/android/java/res/values/ids.xml        |  1 +
 .../chrome/browser/ChromeTabbedActivity.java  | 43 +++++++++++++++++++
+ .../TabbedAppMenuPropertiesDelegate.java      | 15 +++++++
 .../bookmarks/android/bookmark_bridge.cc      | 42 ++++++++++++++++++
 .../bookmarks/android/bookmark_bridge.h       |  8 ++++
 .../browser/bookmarks/BookmarkBridge.java     | 41 ++++++++++++++++++
@@ -15,9 +16,10 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 .../dialogs/DownloadLocationCustomView.java   |  4 +-
 .../strings/android_chrome_strings.grd        |  3 ++
 .../bookmark_ui_operations_helper.cc          |  2 +
+ .../bookmark_bar_page_handler.cc              |  2 +
 components/bookmark_bar_strings.grdp          |  6 +++
- .../bookmarks/browser/bookmark_codec.cc       | 20 +++++++--
- components/bookmarks/browser/bookmark_codec.h |  7 ++-
+ .../bookmarks/browser/bookmark_codec.cc       | 14 +++++-
+ components/bookmarks/browser/bookmark_codec.h |  4 ++
 .../browser/bookmark_load_details.cc          | 15 +++++--
 .../bookmarks/browser/bookmark_load_details.h |  2 +
 .../bookmarks/browser/bookmark_model.cc       |  3 +-
@@ -28,38 +30,24 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 .../bookmarks/browser/bookmark_uuids.cc       |  3 ++
 components/bookmarks/browser/bookmark_uuids.h |  1 +
 components/bookmarks/browser/model_loader.cc  |  9 +++-
- ...ookmark_model_merger_comparison_metrics.cc |  4 ++
 .../bookmark_specifics_conversions.cc         |  1 +
- 26 files changed, 250 insertions(+), 14 deletions(-)
+ 27 files changed, 251 insertions(+), 11 deletions(-)

-diff --git a/chrome/android/java/res/menu/main_menu.xml b/chrome/android/java/res/menu/main_menu.xml
--- a/chrome/android/java/res/menu/main_menu.xml
-+++ b/chrome/android/java/res/menu/main_menu.xml
-@@ -77,6 +77,10 @@ found in the LICENSE file.
-         <item android:id="@+id/all_bookmarks_menu_id"
-             android:title="@string/menu_bookmarks"
-             android:icon="@drawable/btn_star_filled" />
-+        <item android:id="@+id/bookmark_all_tabs_menu_id"
-+            android:title="@string/menu_bookmark_all_tabs"
-+            android:titleCondensed="@string/menu_bookmark_all_tabs"
-+            android:icon="@drawable/ic_folder_blue_24dp" />
-         <item android:id="@+id/recent_tabs_menu_id"
-             android:title="@string/menu_recent_tabs"
-             android:icon="@drawable/devices_black_24dp" />
-@@ -207,6 +211,9 @@ found in the LICENSE file.
-         <item android:id="@id/tinker_tank_menu_id"
-             android:title="@string/menu_tinker_tank"
-             android:icon="@drawable/ic_add_box_rounded_corner" />
-+        <item android:id="@+id/bookmark_all_tabs_menu_id"
-+            android:title="@string/menu_bookmark_all_tabs"
-+            android:icon="@drawable/ic_folder_blue_24dp" />
-         <item android:id="@+id/menu_select_tabs"
-             android:title="@string/menu_select_tabs"
-             android:icon="@drawable/ic_select_check_box_24dp" />
+diff --git a/chrome/android/java/res/values/ids.xml b/chrome/android/java/res/values/ids.xml
+--- a/chrome/android/java/res/values/ids.xml
+++ b/chrome/android/java/res/values/ids.xml
+@@ -197,6 +197,7 @@ found in the LICENSE file.
+     <item type="id" name="menu_item_content_filter_divider_line_id" />
+     <item type="id" name="menu_item_content_filter_help_center_id" />
+     <item type="id" name="duplicate_tab_menu_id" />
+    <item type="id" name="bookmark_all_tabs_menu_id" />
+ 
+     <!-- Custom Tabs -->
+     <item type="id" name="view_id_tag_key" />
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java b/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java
-@@ -103,6 +103,7 @@ import org.chromium.chrome.browser.bookmarks.BookmarkPane;
+@@ -100,6 +100,7 @@ import org.chromium.chrome.browser.bookmarks.BookmarkPane;
 import org.chromium.chrome.browser.bookmarks.BookmarkUtils;
 import org.chromium.chrome.browser.browserservices.intents.WebappConstants;
 import org.chromium.chrome.browser.compositor.CompositorViewHolder;
@@ -67,35 +55,35 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedAct
 import org.chromium.chrome.browser.compositor.layouts.Layout;
 import org.chromium.chrome.browser.compositor.layouts.LayoutManagerChrome;
 import org.chromium.chrome.browser.compositor.layouts.LayoutManagerChromePhone;
-@@ -275,6 +276,9 @@ import org.chromium.chrome.browser.ui.appmenu.AppMenuPropertiesDelegate;
+@@ -299,6 +300,9 @@ import org.chromium.chrome.browser.ui.appmenu.AppMenuPropertiesDelegate;
+ import org.chromium.chrome.browser.ui.browser_window.BrowserWindowType;
 import org.chromium.chrome.browser.ui.desktop_windowing.AppHeaderUtils;
 import org.chromium.chrome.browser.ui.edge_to_edge.EdgeToEdgeUtils;
- import org.chromium.chrome.browser.ui.extensions.ExtensionKeybindingRegistry;
 +import org.chromium.chrome.browser.ui.messages.snackbar.Snackbar;
 +import org.chromium.chrome.browser.ui.messages.snackbar.SnackbarManager;
 +import org.chromium.chrome.browser.ui.messages.snackbar.SnackbarManager.SnackbarController;
 import org.chromium.chrome.browser.ui.searchactivityutils.SearchActivityClient;
 import org.chromium.chrome.browser.ui.searchactivityutils.SearchActivityExtras.IntentOrigin;
 import org.chromium.chrome.browser.ui.signin.BottomSheetSigninAndHistorySyncConfig;
-@@ -284,6 +288,8 @@ import org.chromium.chrome.browser.undo_tab_close_snackbar.UndoBarController;
- import org.chromium.chrome.browser.usage_stats.UsageStatsService;
- import org.chromium.chrome.browser.util.ChromeAccessibilityUtil;
- import org.chromium.chrome.browser.xr.XrLayoutStateObserver;
+@@ -314,6 +318,8 @@ import org.chromium.chrome.browser.util.ChromeAccessibilityUtil;
+ import org.chromium.chrome.browser.xr.scenecore.XrSceneCoreSessionInitializerImpl;
+ import org.chromium.chrome.browser.xr.scenecore.XrSceneCoreSessionManagerImpl;
+ import org.chromium.components.browser_ui.accessibility.AccessibilityFeatureMap;
 +import org.chromium.components.bookmarks.BookmarkId;
 +import org.chromium.components.bookmarks.BookmarkItem;
 import org.chromium.components.browser_ui.bottomsheet.BottomSheetController;
- import org.chromium.components.browser_ui.edge_to_edge.SystemBarColorHelper;
- import org.chromium.components.browser_ui.edge_to_edge.TabbedSystemBarColorHelper;
-@@ -3394,6 +3400,8 @@ public class ChromeTabbedActivity extends ChromeActivity {
-                     getTabModelSelectorSupplier().get(),
-                     closeAllTabsRunnable);
+ import org.chromium.components.browser_ui.share.ShareParams;
+ import org.chromium.components.browser_ui.util.BrowserControlsVisibilityDelegate;
+@@ -3929,6 +3935,8 @@ public class ChromeTabbedActivity extends ChromeActivity implements PreAttachInt
+             CloseAllTabsDialog.show(
+                     this, getModalDialogManagerSupplier(), tabModelSelector, closeAllTabsRunnable);
             RecordUserAction.record("MobileMenuCloseAllTabs");
 +        } else if (id == R.id.bookmark_all_tabs_menu_id) {
 +            bookmarkAllTabs();
         } else if (id == R.id.close_all_incognito_tabs_menu_id) {
             boolean allowUndo = TabClosureParamsUtils.shouldAllowUndo(triggeringMotion);
 
-@@ -3502,6 +3510,41 @@ public class ChromeTabbedActivity extends ChromeActivity {
+@@ -4058,6 +4066,41 @@ public class ChromeTabbedActivity extends ChromeActivity implements PreAttachInt
         getTabModalLifetimeHandler().onOmniboxFocusChanged(hasFocus);
     }
 
@@ -137,10 +125,42 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedAct
     private void recordLauncherShortcutAction(boolean isIncognito) {
         if (isIncognito) {
             RecordUserAction.record("Android.LauncherShortcut.NewIncognitoTab");
+diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedAppMenuPropertiesDelegate.java b/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedAppMenuPropertiesDelegate.java
+--- a/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedAppMenuPropertiesDelegate.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedAppMenuPropertiesDelegate.java
+@@ -292,6 +292,14 @@ public class TabbedAppMenuPropertiesDelegate extends AppMenuPropertiesDelegateIm
+         // Bookmarks
+         modelList.add(buildBookmarksItem());
+ 
+        // Add bookmark all item
+        modelList.add(new MVCListAdapter.ListItem(
+                AppMenuHandler.AppMenuItemType.STANDARD,
+                buildModelForStandardMenuItem(
+                        R.id.bookmark_all_tabs_menu_id,
+                        R.string.menu_bookmark_all_tabs,
+                        shouldShowIconBeforeItem() ? R.drawable.ic_folder_blue_24dp : 0)));
+
+         // Recent Tabs
+         if (shouldShowRecentTabsItem()) modelList.add(buildRecentTabsItem());
+ 
+@@ -478,6 +486,13 @@ public class TabbedAppMenuPropertiesDelegate extends AppMenuPropertiesDelegateIm
+         }
+         modelList.add(buildCloseAllTabsItem());
+         if (shouldShowTinkerTank()) modelList.add(buildTinkerTankItem());
+        // Add bookmark all item
+        modelList.add(new MVCListAdapter.ListItem(
+                AppMenuHandler.AppMenuItemType.STANDARD,
+                buildModelForStandardMenuItem(
+                        R.id.bookmark_all_tabs_menu_id,
+                        R.string.menu_bookmark_all_tabs,
+                        shouldShowIconBeforeItem() ? R.drawable.ic_folder_blue_24dp : 0)));
+         modelList.add(buildSelectTabsItem());
+         if (shouldShowQuickDeleteItem()) modelList.add(buildQuickDeleteItem());
+         modelList.add(buildSettingsItem());
 diff --git a/chrome/browser/bookmarks/android/bookmark_bridge.cc b/chrome/browser/bookmarks/android/bookmark_bridge.cc
 --- a/chrome/browser/bookmarks/android/bookmark_bridge.cc
 +++ b/chrome/browser/bookmarks/android/bookmark_bridge.cc
-@@ -390,6 +390,33 @@ jboolean BookmarkBridge::AreAccountBookmarkFoldersActive(JNIEnv* env) {
+@@ -336,6 +336,33 @@ jboolean BookmarkBridge::AreAccountBookmarkFoldersActive(JNIEnv* env) {
   return bookmark_model_->account_mobile_node() != nullptr;
 }
 
@@ -174,7 +194,7 @@ diff --git a/chrome/browser/bookmarks/android/bookmark_bridge.cc b/chrome/browse
 base::android::ScopedJavaLocalRef<jobject>
 BookmarkBridge::GetMostRecentlyAddedUserBookmarkIdForUrl(JNIEnv* env,
                                                          const GURL& url) {
-@@ -502,6 +529,7 @@ void BookmarkBridge::GetAllFoldersWithDepths(
+@@ -448,6 +475,7 @@ void BookmarkBridge::GetAllFoldersWithDepths(
   // Vector to temporarily contain all child bookmarks at same level for sorting
   std::vector<const BookmarkNode*> bookmarks = {
       bookmark_model_->mobile_node(),
@@ -182,7 +202,7 @@ diff --git a/chrome/browser/bookmarks/android/bookmark_bridge.cc b/chrome/browse
       bookmark_model_->bookmark_bar_node(),
       bookmark_model_->other_node(),
   };
-@@ -610,6 +638,9 @@ std::vector<const BookmarkNode*> BookmarkBridge::GetTopLevelFolderIdsImpl(
+@@ -556,6 +584,9 @@ std::vector<const BookmarkNode*> BookmarkBridge::GetTopLevelFolderIdsImpl(
     top_level_folders.push_back(other_node);
   }
 
@@ -192,7 +212,7 @@ diff --git a/chrome/browser/bookmarks/android/bookmark_bridge.cc b/chrome/browse
   const BookmarkNode* reading_list_node =
       local_or_syncable_reading_list_manager_->GetRoot();
   if (IsPermanentFolderVisible(
-@@ -1337,6 +1368,17 @@ void BookmarkBridge::GetBookmarksOfType(
+@@ -1229,6 +1260,17 @@ void BookmarkBridge::GetBookmarksOfType(
   AddBookmarkNodesToBookmarkIdList(env, j_list, results);
 }
 
@@ -224,7 +244,7 @@ diff --git a/chrome/browser/bookmarks/android/bookmark_bridge.h b/chrome/browser
   base::android::ScopedJavaLocalRef<jobject>
   GetMostRecentlyAddedUserBookmarkIdForUrl(JNIEnv* env, const GURL& url);
   const bookmarks::BookmarkNode* GetMostRecentlyAddedUserBookmarkIdForUrlImpl(
-@@ -250,6 +254,10 @@ class BookmarkBridge : public ProfileObserver,
+@@ -245,6 +249,10 @@ class BookmarkBridge : public ProfileObserver,
                           const base::android::JavaParamRef<jobject>& j_list,
                           jint type);
 
@@ -279,7 +299,7 @@ diff --git a/chrome/browser/bookmarks/android/java/src/org/chromium/chrome/brows
     /** Returns Id representing the special "other" folder from bookmark model. */
     public @Nullable BookmarkId getOtherFolderId() {
         ThreadUtils.assertOnUiThread();
-@@ -898,6 +911,29 @@ class BookmarkBridge {
+@@ -882,6 +895,29 @@ class BookmarkBridge {
                 .addToReadingList(mNativeBookmarkBridge, parentId, title, url);
     }
 
@@ -309,7 +329,7 @@ diff --git a/chrome/browser/bookmarks/android/java/src/org/chromium/chrome/brows
     /**
      * Helper method to mark an item as read.
      *
-@@ -1115,6 +1151,9 @@ class BookmarkBridge {
+@@ -1099,6 +1135,9 @@ class BookmarkBridge {
         BookmarkId getMostRecentlyAddedUserBookmarkIdForUrl(
                 long nativeBookmarkBridge, @JniType("GURL") GURL url);
 
@@ -319,7 +339,7 @@ diff --git a/chrome/browser/bookmarks/android/java/src/org/chromium/chrome/brows
         BookmarkItem getBookmarkById(long nativeBookmarkBridge, long id, int type);
 
         void getTopLevelFolderIds(
-@@ -1136,6 +1175,8 @@ class BookmarkBridge {
+@@ -1120,6 +1159,8 @@ class BookmarkBridge {
 
         BookmarkId getRootFolderId(long nativeBookmarkBridge);
 
@@ -440,7 +460,7 @@ diff --git a/chrome/browser/download/android/java/src/org/chromium/chrome/browse
 diff --git a/chrome/browser/ui/android/strings/android_chrome_strings.grd b/chrome/browser/ui/android/strings/android_chrome_strings.grd
 --- a/chrome/browser/ui/android/strings/android_chrome_strings.grd
 +++ b/chrome/browser/ui/android/strings/android_chrome_strings.grd
-@@ -4541,6 +4541,9 @@ To change this setting, <ph name="BEGIN_LINK">BEGIN_LINK</ph>delete the Chrome d
+@@ -4562,6 +4562,9 @@ To change this setting, <ph name="BEGIN_LINK">BEGIN_LINK</ph>delete the Chrome d
       <message name="IDS_MENU_SELECT_TABS" desc="Menu item for bulk editing tabs. [CHAR_LIMIT=27]">
         Select tabs
       </message>
@@ -453,7 +473,7 @@ diff --git a/chrome/browser/ui/android/strings/android_chrome_strings.grd b/chro
 diff --git a/chrome/browser/ui/bookmarks/bookmark_ui_operations_helper.cc b/chrome/browser/ui/bookmarks/bookmark_ui_operations_helper.cc
 --- a/chrome/browser/ui/bookmarks/bookmark_ui_operations_helper.cc
 +++ b/chrome/browser/ui/bookmarks/bookmark_ui_operations_helper.cc
-@@ -104,6 +104,8 @@ ui::mojom::DragOperation BookmarkUIOperationsHelper::DropBookmarks(
+@@ -105,6 +105,8 @@ ui::mojom::DragOperation BookmarkUIOperationsHelper::DropBookmarks(
   if (is_reorder) {
     base::UmaHistogramEnumeration("Bookmarks.ReorderDropTarget", target);
     switch (target_parent()->GetType()) {
@@ -462,6 +482,18 @@ diff --git a/chrome/browser/ui/bookmarks/bookmark_ui_operations_helper.cc b/chro
       case bookmarks::BookmarkNode::URL:
         NOTREACHED();
       case bookmarks::BookmarkNode::FOLDER:
+diff --git a/chrome/browser/ui/webui_browser/bookmark_bar_page_handler.cc b/chrome/browser/ui/webui_browser/bookmark_bar_page_handler.cc
+--- a/chrome/browser/ui/webui_browser/bookmark_bar_page_handler.cc
+++ b/chrome/browser/ui/webui_browser/bookmark_bar_page_handler.cc
+@@ -37,6 +37,8 @@ bookmark_bar::mojom::BookmarkType ConvertType(
+       return bookmark_bar::mojom::BookmarkType::OTHER_NODE;
+     case bookmarks::BookmarkNode::MOBILE:
+       return bookmark_bar::mojom::BookmarkType::MOBILE;
+    case bookmarks::BookmarkNode::TABS_COLLECTION:
+      NOTREACHED();
+   }
+   NOTREACHED();
+ }
 diff --git a/components/bookmark_bar_strings.grdp b/components/bookmark_bar_strings.grdp
 --- a/components/bookmark_bar_strings.grdp
 +++ b/components/bookmark_bar_strings.grdp
@@ -488,15 +520,15 @@ diff --git a/components/bookmark_bar_strings.grdp b/components/bookmark_bar_stri
 diff --git a/components/bookmarks/browser/bookmark_codec.cc b/components/bookmarks/browser/bookmark_codec.cc
 --- a/components/bookmarks/browser/bookmark_codec.cc
 +++ b/components/bookmarks/browser/bookmark_codec.cc
-@@ -36,6 +36,7 @@ const char BookmarkCodec::kBookmarkBarFolderNameKey[] = "bookmark_bar";
+@@ -39,6 +39,7 @@ const char BookmarkCodec::kBookmarkBarFolderNameKey[] = "bookmark_bar";
 const char BookmarkCodec::kOtherBookmarkFolderNameKey[] = "other";
 // The value is left as 'synced' for historical reasons.
 const char BookmarkCodec::kMobileBookmarkFolderNameKey[] = "synced";
 +const char BookmarkCodec::kTabsBookmarkFolderNameKey[] = "tabs";
 const char BookmarkCodec::kVersionKey[] = "version";
 const char BookmarkCodec::kChecksumKey[] = "checksum";
- const char BookmarkCodec::kIdKey[] = "id";
-@@ -73,6 +74,7 @@ base::Value::Dict BookmarkCodec::Encode(
+ const char BookmarkCodec::kChecksumSHA256Key[] = "checksum_sha256";
+@@ -99,6 +100,7 @@ base::Value::Dict BookmarkCodec::Encode(
     const BookmarkNode* bookmark_bar_node,
     const BookmarkNode* other_folder_node,
     const BookmarkNode* mobile_folder_node,
@@ -504,7 +536,7 @@ diff --git a/components/bookmarks/browser/bookmark_codec.cc b/components/bookmar
     std::string sync_metadata_str) {
   ids_reassigned_ = false;
   uuids_reassigned_ = false;
-@@ -98,6 +100,8 @@ base::Value::Dict BookmarkCodec::Encode(
+@@ -124,6 +126,8 @@ base::Value::Dict BookmarkCodec::Encode(
     roots.Set(kBookmarkBarFolderNameKey, EncodeNode(bookmark_bar_node));
     roots.Set(kOtherBookmarkFolderNameKey, EncodeNode(other_folder_node));
     roots.Set(kMobileBookmarkFolderNameKey, EncodeNode(mobile_folder_node));
@@ -513,15 +545,15 @@ diff --git a/components/bookmarks/browser/bookmark_codec.cc b/components/bookmar
   } else {
     // No permanent node should have been provided.
     CHECK(!other_folder_node);
-@@ -119,6 +123,7 @@ bool BookmarkCodec::Decode(const base::Value::Dict& value,
+@@ -144,6 +148,7 @@ bool BookmarkCodec::Decode(const base::Value::Dict& value,
                            BookmarkNode* bb_node,
                            BookmarkNode* other_folder_node,
                            BookmarkNode* mobile_folder_node,
 +                           BookmarkNode* tabs_folder_node,
                            int64_t* max_id,
                            std::string* sync_metadata_str) {
-   const int64_t max_already_assigned_id =
-@@ -133,7 +138,8 @@ bool BookmarkCodec::Decode(const base::Value::Dict& value,
+   if (sync_metadata_str) {
+@@ -156,13 +161,15 @@ bool BookmarkCodec::Decode(const base::Value::Dict& value,
             base::Uuid::ParseLowercase(kBookmarkBarNodeUuid),
             base::Uuid::ParseLowercase(kOtherBookmarksNodeUuid),
             base::Uuid::ParseLowercase(kMobileBookmarksNodeUuid),
@@ -530,24 +562,15 @@ diff --git a/components/bookmarks/browser/bookmark_codec.cc b/components/bookmar
 +            base::Uuid::ParseLowercase(kTabsCollectionBookmarksNodeUuid)};
   ids_reassigned_ = false;
   uuids_reassigned_ = false;
-   ids_valid_ = true;
-@@ -141,13 +147,14 @@ bool BookmarkCodec::Decode(const base::Value::Dict& value,
-   stored_checksum_.clear();
-   InitializeChecksum();
+   nodes_requiring_id_reassignment_.clear();
+   reassigned_ids_per_old_id_.clear();
+ 
   bool success = DecodeHelper(bb_node, other_folder_node, mobile_folder_node,
 +                              tabs_folder_node,
                               value, sync_metadata_str);
-   FinalizeChecksum();
-   // If either the checksums differ or some IDs were missing/not unique,
-   // reassign IDs.
-   if (!ids_valid_ || computed_checksum_ != stored_checksum_) {
-     maximum_id_ = max_already_assigned_id;
-    ReassignIDs(bb_node, other_folder_node, mobile_folder_node);
-+    ReassignIDs(bb_node, other_folder_node, mobile_folder_node, tabs_folder_node);
-   }
-   *max_id = maximum_id_ + 1;
-   return success;
-@@ -205,6 +212,7 @@ base::Value::Dict BookmarkCodec::EncodeMetaInfo(
+   ReassignIDsIfRequired();
+ 
+@@ -220,6 +227,7 @@ base::Value::Dict BookmarkCodec::EncodeMetaInfo(
 bool BookmarkCodec::DecodeHelper(BookmarkNode* bb_node,
                                  BookmarkNode* other_folder_node,
                                  BookmarkNode* mobile_folder_node,
@@ -555,7 +578,7 @@ diff --git a/components/bookmarks/browser/bookmark_codec.cc b/components/bookmar
                                  const base::Value::Dict& value,
                                  std::string* sync_metadata_str) {
   std::optional<int> version = value.FindInt(kVersionKey);
-@@ -237,6 +245,8 @@ bool BookmarkCodec::DecodeHelper(BookmarkNode* bb_node,
+@@ -243,6 +251,8 @@ bool BookmarkCodec::DecodeHelper(BookmarkNode* bb_node,
       roots->FindDict(kOtherBookmarkFolderNameKey);
   const base::Value::Dict* mobile_folder_value =
       roots->FindDict(kMobileBookmarkFolderNameKey);
@@ -564,7 +587,7 @@ diff --git a/components/bookmarks/browser/bookmark_codec.cc b/components/bookmar
 
   if (!bb_value || !other_folder_value || !mobile_folder_value)
     return false;
-@@ -244,6 +254,8 @@ bool BookmarkCodec::DecodeHelper(BookmarkNode* bb_node,
+@@ -250,6 +260,8 @@ bool BookmarkCodec::DecodeHelper(BookmarkNode* bb_node,
   DecodeNode(*bb_value, nullptr, bb_node);
   DecodeNode(*other_folder_value, nullptr, other_folder_node);
   DecodeNode(*mobile_folder_value, nullptr, mobile_folder_node);
@@ -573,26 +596,10 @@ diff --git a/components/bookmarks/browser/bookmark_codec.cc b/components/bookmar
 
   // Need to reset the title as the title is persisted and restored from
   // the file.
-@@ -475,12 +487,14 @@ void BookmarkCodec::DecodeMetaInfoHelper(
- 
- void BookmarkCodec::ReassignIDs(BookmarkNode* bb_node,
-                                 BookmarkNode* other_node,
-                                BookmarkNode* mobile_node) {
-+                                BookmarkNode* mobile_node,
-+                                BookmarkNode* tabs_folder_node) {
-   ids_.clear();
-   reassigned_ids_per_old_id_.clear();
-   ReassignIDsHelper(bb_node);
-   ReassignIDsHelper(other_node);
-   ReassignIDsHelper(mobile_node);
-+  ReassignIDsHelper(tabs_folder_node);
-   ids_reassigned_ = true;
- }
- 
 diff --git a/components/bookmarks/browser/bookmark_codec.h b/components/bookmarks/browser/bookmark_codec.h
 --- a/components/bookmarks/browser/bookmark_codec.h
 +++ b/components/bookmarks/browser/bookmark_codec.h
-@@ -43,6 +43,7 @@ class BookmarkCodec {
+@@ -44,6 +44,7 @@ class BookmarkCodec {
       const BookmarkNode* bookmark_bar_node,
       const BookmarkNode* other_folder_node,
       const BookmarkNode* mobile_folder_node,
@@ -600,7 +607,7 @@ diff --git a/components/bookmarks/browser/bookmark_codec.h b/components/bookmark
       std::string sync_metadata_str);
 
   // Decodes the previously encoded value to the specified nodes as well as
-@@ -61,6 +62,7 @@ class BookmarkCodec {
+@@ -62,6 +63,7 @@ class BookmarkCodec {
               BookmarkNode* bb_node,
               BookmarkNode* other_folder_node,
               BookmarkNode* mobile_folder_node,
@@ -608,15 +615,15 @@ diff --git a/components/bookmarks/browser/bookmark_codec.h b/components/bookmark
               int64_t* max_node_id,
               std::string* sync_metadata_str);
 
-@@ -92,6 +94,7 @@ class BookmarkCodec {
+@@ -95,6 +97,7 @@ class BookmarkCodec {
   static const char kBookmarkBarFolderNameKey[];
   static const char kOtherBookmarkFolderNameKey[];
   static const char kMobileBookmarkFolderNameKey[];
 +  static const char kTabsBookmarkFolderNameKey[];
   static const char kVersionKey[];
   static const char kChecksumKey[];
-   static const char kIdKey[];
-@@ -124,6 +127,7 @@ class BookmarkCodec {
+   static const char kChecksumSHA256Key[];
+@@ -128,6 +131,7 @@ class BookmarkCodec {
   bool DecodeHelper(BookmarkNode* bb_node,
                     BookmarkNode* other_folder_node,
                     BookmarkNode* mobile_folder_node,
@@ -624,16 +631,6 @@ diff --git a/components/bookmarks/browser/bookmark_codec.h b/components/bookmark
                     const base::Value::Dict& value,
                     std::string* sync_metadata_str);
 
-@@ -134,7 +138,8 @@ class BookmarkCodec {
-   // Reassigns bookmark IDs for all nodes.
-   void ReassignIDs(BookmarkNode* bb_node,
-                    BookmarkNode* other_node,
-                   BookmarkNode* mobile_node);
-+                   BookmarkNode* mobile_node,
-+                   BookmarkNode* tabs_folder_node);
- 
-   // Helper to recursively reassign IDs.
-   void ReassignIDsHelper(BookmarkNode* node);
 diff --git a/components/bookmarks/browser/bookmark_load_details.cc b/components/bookmarks/browser/bookmark_load_details.cc
 --- a/components/bookmarks/browser/bookmark_load_details.cc
 +++ b/components/bookmarks/browser/bookmark_load_details.cc
@@ -884,31 +881,10 @@ diff --git a/components/bookmarks/browser/model_loader.cc b/components/bookmarks
                      &sync_metadata_str)) {
       details->set_local_or_syncable_sync_metadata_str(
           std::move(sync_metadata_str));
-diff --git a/components/sync_bookmarks/bookmark_model_merger_comparison_metrics.cc b/components/sync_bookmarks/bookmark_model_merger_comparison_metrics.cc
--- a/components/sync_bookmarks/bookmark_model_merger_comparison_metrics.cc
-+++ b/components/sync_bookmarks/bookmark_model_merger_comparison_metrics.cc
-@@ -38,6 +38,7 @@ const char kOtherBookmarksTag[] = "other_bookmarks";
- constexpr char16_t kBookmarkBarFolderName[] = u"__Bookmarks bar__";
- constexpr char16_t kOtherBookmarksFolderName[] = u"__Other bookmarks__";
- constexpr char16_t kMobileBookmarksFolderName[] = u"__Mobile bookmarks__";
-+constexpr char16_t kTabsCollectionBookmarksFolderName[] = u"__Tabs collection__";
- 
- using RemoteForest = BookmarkModelMerger::RemoteForest;
- using RemoteTreeNode = BookmarkModelMerger::RemoteTreeNode;
-@@ -129,6 +130,9 @@ std::u16string_view GetBookmarkNodeTitle(const bookmarks::BookmarkNode* node) {
-       return kOtherBookmarksFolderName;
-     case bookmarks::BookmarkNode::MOBILE:
-       return kMobileBookmarksFolderName;
-+    case bookmarks::BookmarkNode::TABS_COLLECTION:
-+      return kTabsCollectionBookmarksFolderName;
-+
-   }
-   NOTREACHED();
- }
 diff --git a/components/sync_bookmarks/bookmark_specifics_conversions.cc b/components/sync_bookmarks/bookmark_specifics_conversions.cc
 --- a/components/sync_bookmarks/bookmark_specifics_conversions.cc
 +++ b/components/sync_bookmarks/bookmark_specifics_conversions.cc
-@@ -442,6 +442,7 @@ sync_pb::BookmarkSpecifics::Type GetProtoTypeFromBookmarkNode(
+@@ -447,6 +447,7 @@ sync_pb::BookmarkSpecifics::Type GetProtoTypeFromBookmarkNode(
     case bookmarks::BookmarkNode::BOOKMARK_BAR:
     case bookmarks::BookmarkNode::OTHER_NODE:
     case bookmarks::BookmarkNode::MOBILE:
@@ -4,46 +4,30 @@ Subject: Add menu item to view source

 License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 ---
- .../android/java/res/menu/custom_tabs_menu.xml  |  3 +++
- chrome/android/java/res/menu/main_menu.xml      |  3 +++
- .../chrome/browser/ChromeTabbedActivity.java    |  2 ++
- .../chrome/browser/app/ChromeActivity.java      |  5 +++++
- .../appmenu/AppMenuPropertiesDelegateImpl.java  | 17 +++++++++++++++++
- .../CustomTabAppMenuPropertiesDelegate.java     |  2 +-
- .../TabbedAppMenuPropertiesDelegate.java        |  6 +++---
- .../android/strings/android_chrome_strings.grd  |  4 ++++
- 8 files changed, 38 insertions(+), 4 deletions(-)
+ chrome/android/java/res/values/ids.xml        |  1 +
+ .../chrome/browser/ChromeTabbedActivity.java  |  2 ++
+ .../chrome/browser/app/ChromeActivity.java    |  5 ++++
+ .../AppMenuPropertiesDelegateImpl.java        | 24 +++++++++++++++++++
+ .../CustomTabAppMenuPropertiesDelegate.java   |  3 +++
+ .../TabbedAppMenuPropertiesDelegate.java      |  3 +++
+ .../strings/android_chrome_strings.grd        |  4 ++++
+ 7 files changed, 42 insertions(+)

-diff --git a/chrome/android/java/res/menu/custom_tabs_menu.xml b/chrome/android/java/res/menu/custom_tabs_menu.xml
--- a/chrome/android/java/res/menu/custom_tabs_menu.xml
-+++ b/chrome/android/java/res/menu/custom_tabs_menu.xml
-@@ -73,6 +73,9 @@ found in the LICENSE file.
-         <item android:id="@+id/universal_install"
-             android:title="@string/menu_add_to_homescreen"
-             android:orderInCategory="2" />
-+        <item android:id="@+id/view_source_id"
-+            android:title="@string/view_source"
-+            android:orderInCategory="2" />
-         <item android:id="@+id/open_webapk_id"
-             android:title="@string/menu_open_webapk"
-             android:orderInCategory="2" />
-diff --git a/chrome/android/java/res/menu/main_menu.xml b/chrome/android/java/res/menu/main_menu.xml
--- a/chrome/android/java/res/menu/main_menu.xml
-+++ b/chrome/android/java/res/menu/main_menu.xml
-@@ -131,6 +131,9 @@ found in the LICENSE file.
-         <item android:id="@+id/universal_install"
-             android:title="@string/menu_add_to_homescreen"
-             android:icon="@drawable/ic_add_to_home_screen" />
-+        <item android:id="@+id/view_source_id"
-+            android:title="@string/view_source"
-+            android:icon="@drawable/ic_drive_document_24dp" />
-         <item android:id="@+id/open_webapk_id"
-             android:title="@string/menu_open_webapk"
-             android:icon="@drawable/ic_open_webapk" />
+diff --git a/chrome/android/java/res/values/ids.xml b/chrome/android/java/res/values/ids.xml
+--- a/chrome/android/java/res/values/ids.xml
+++ b/chrome/android/java/res/values/ids.xml
+@@ -136,6 +136,7 @@ found in the LICENSE file.
+     <item type="id" name="update_menu_id" />
+     <item type="id" name="new_tab_menu_id" />
+     <item type="id" name="new_incognito_tab_menu_id" />
+    <item type="id" name="view_source_id" />
+     <item type="id" name="add_to_group_menu_id" />
+     <item type="id" name="pin_tab_menu_id" />
+     <item type="id" name="unpin_tab_menu_id" />
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java b/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java
-@@ -3434,6 +3434,8 @@ public class ChromeTabbedActivity extends ChromeActivity {
+@@ -3965,6 +3965,8 @@ public class ChromeTabbedActivity extends ChromeActivity implements PreAttachInt
                 NewTabPageUma.recordAction(NewTabPageUma.ACTION_OPENED_DOWNLOADS_MANAGER);
             }
             RecordUserAction.record("MobileMenuDownloadManager");
@@ -55,7 +39,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedAct
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/app/ChromeActivity.java b/chrome/android/java/src/org/chromium/chrome/browser/app/ChromeActivity.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/app/ChromeActivity.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/app/ChromeActivity.java
-@@ -2576,6 +2576,11 @@ public abstract class ChromeActivity extends AsyncInitializationActivity
+@@ -2797,6 +2797,11 @@ public abstract class ChromeActivity extends AsyncInitializationActivity
             return doOpenWebApk(currentTab);
         }
 
@@ -70,8 +54,8 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/app/ChromeActiv
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/app/appmenu/AppMenuPropertiesDelegateImpl.java b/chrome/android/java/src/org/chromium/chrome/browser/app/appmenu/AppMenuPropertiesDelegateImpl.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/app/appmenu/AppMenuPropertiesDelegateImpl.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/app/appmenu/AppMenuPropertiesDelegateImpl.java
-@@ -864,6 +864,23 @@ public abstract class AppMenuPropertiesDelegateImpl implements AppMenuProperties
-         }
+@@ -1024,6 +1024,30 @@ public abstract class AppMenuPropertiesDelegateImpl implements AppMenuProperties
+         return false;
     }
 
 +    /**
@@ -80,67 +64,58 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/app/appmenu/App
 +     * @param menu {@link Menu} for view source.
 +     * @param currentTab      Current tab being displayed.
 +     */
-+    protected void updateViewSourceMenuItem(
-+            Menu menu, Tab currentTab) {
-+        MenuItem viewSourceMenuItem = menu.findItem(R.id.view_source_id);
+    protected void buildAddViewSourceItem(
+            MVCListAdapter.ModelList modelList,
+            @Nullable Tab currentTab) {
 +        boolean visible = false;
 +        if (currentTab != null) {
-+                String url = currentTab.getUrl().getSpec();
-+                visible = !url.isEmpty() && !url.startsWith("view-source:");
+            String url = currentTab.getUrl().getSpec();
+            visible = !url.isEmpty() && !url.startsWith("view-source:");
+        }
+        if (visible) {
+            modelList.add(new MVCListAdapter.ListItem(
+                AppMenuHandler.AppMenuItemType.STANDARD,
+                 buildModelForStandardMenuItem(
+                    R.id.view_source_id,
+                    R.string.view_source,
+                    shouldShowIconBeforeItem() ? R.drawable.ic_drive_document_24dp : 0)));
 +        }
-+        viewSourceMenuItem.setVisible(visible);
 +    }
 +
     /**
-      * Updates the request desktop site item's state.
+      * Updates the bookmark item's visibility.
      *
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabAppMenuPropertiesDelegate.java b/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabAppMenuPropertiesDelegate.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabAppMenuPropertiesDelegate.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabAppMenuPropertiesDelegate.java
-@@ -331,7 +331,7 @@ public class CustomTabAppMenuPropertiesDelegate extends AppMenuPropertiesDelegat
-             // --- Request Desktop Site ---
-             updateRequestDesktopSiteMenuItem(
-                     menu, currentTab, requestDesktopSiteVisible, isNativePage);
-
-+            updateViewSourceMenuItem(menu, currentTab);
-             // --- Translate ---
-             prepareTranslateMenuItem(menu, currentTab);
+@@ -406,6 +406,9 @@ public class CustomTabAppMenuPropertiesDelegate extends AppMenuPropertiesDelegat
+             modelList.add(buildAddToHomescreenListItem(currentTab, false));
+         }
 
+        // Add view source item
+        buildAddViewSourceItem(modelList, currentTab);
+
+         // --- Request Desktop Site ---
+         if (requestDesktopSiteVisible) {
+             MVCListAdapter.ListItem rdsListItem =
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedAppMenuPropertiesDelegate.java b/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedAppMenuPropertiesDelegate.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedAppMenuPropertiesDelegate.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedAppMenuPropertiesDelegate.java
-@@ -173,7 +173,7 @@ public class TabbedAppMenuPropertiesDelegate extends AppMenuPropertiesDelegateIm
-         if (menuGroup == MenuGroup.PAGE_MENU) {
-             preparePageMenu(menu, currentTab, handler, isIncognito);
+@@ -370,6 +370,9 @@ public class TabbedAppMenuPropertiesDelegate extends AppMenuPropertiesDelegateIm
+             modelList.add(buildAddToHomescreenListItem(currentTab, shouldShowIconBeforeItem()));
         }
-        prepareCommonMenuItems(menu, menuGroup, isIncognito);
-+        prepareCommonMenuItems(menu, menuGroup, isIncognito, currentTab);
-     }
 
-     private void setMenuGroupVisibility(@MenuGroup int menuGroup, Menu menu) {
-@@ -338,7 +338,7 @@ public class TabbedAppMenuPropertiesDelegate extends AppMenuPropertiesDelegateIm
-                         isNativePage, isFileScheme, isContentScheme, isIncognito, url));
- 
-         updateRequestDesktopSiteMenuItem(menu, currentTab, true /* can show */, isNativePage);
-
-+        updateViewSourceMenuItem(menu, currentTab);
-         updateAutoDarkMenuItem(menu, currentTab, isNativePage);
- 
-         // Only display reader mode settings menu option if the current page is in reader mode.
-@@ -371,7 +371,7 @@ public class TabbedAppMenuPropertiesDelegate extends AppMenuPropertiesDelegateIm
-                 && UrlUtilities.isNtpUrl(currentTab.getUrl());
-     }
- 
-    private void prepareCommonMenuItems(Menu menu, @MenuGroup int menuGroup, boolean isIncognito) {
-+    private void prepareCommonMenuItems(Menu menu, @MenuGroup int menuGroup, boolean isIncognito, Tab currentTab) {
-         boolean always_incognito = AlwaysIncognitoLinkInterceptor.isAlwaysIncognito();
-         if (always_incognito) {
-             final MenuItem newTabOption = menu.findItem(R.id.new_tab_menu_id);
+        // Add view source item
+        buildAddViewSourceItem(modelList, currentTab);
+
+         // RDS
+         MVCListAdapter.ListItem rdsListItem =
+                 maybeBuildRequestDesktopSiteListItem(
 diff --git a/chrome/browser/ui/android/strings/android_chrome_strings.grd b/chrome/browser/ui/android/strings/android_chrome_strings.grd
 --- a/chrome/browser/ui/android/strings/android_chrome_strings.grd
 +++ b/chrome/browser/ui/android/strings/android_chrome_strings.grd
-@@ -321,6 +321,10 @@ CHAR_LIMIT guidelines:
-         Collaboration
+@@ -339,6 +339,10 @@ CHAR_LIMIT guidelines:
+         Chrome Tips
       </message>
 
 +      <message name="IDS_VIEW_SOURCE" desc="Title for the menu command to view the source of the current page. [CHAR-LIMIT=40]">
@@ -15,12 +15,12 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 diff --git a/chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser/tasks/tab_management/TabGridViewBinder.java b/chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser/tasks/tab_management/TabGridViewBinder.java
 --- a/chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser/tasks/tab_management/TabGridViewBinder.java
 +++ b/chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser/tasks/tab_management/TabGridViewBinder.java
-@@ -457,7 +457,12 @@ class TabGridViewBinder {
+@@ -512,7 +512,12 @@ class TabGridViewBinder {
                     if (result != null) {
                         TabUtils.setDrawableAndUpdateImageMatrix(thumbnail, result, thumbnailSize);
                     } else {
 -                        thumbnail.setImageDrawable(null);
-+                        TabListFaviconProvider.TabFavicon tabFavicon = model.get(TabProperties.FAVICON);
+                        TabFavicon tabFavicon = model.get(TabProperties.FAVICON);
 +                        if (tabFavicon != null) {
 +                            thumbnail.setScaleType(ImageView.ScaleType.CENTER);
 +                            thumbnail.setImageDrawable(
@@ -29,10 +29,10 @@ diff --git a/chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser
                     }
                 };
         if (sThumbnailFetcherForTesting != null) {
-@@ -498,6 +503,7 @@ class TabGridViewBinder {
+@@ -550,6 +555,7 @@ class TabGridViewBinder {
      */
     private static void setFavicon(
-             ImageView faviconView, PropertyModel model, TabListFaviconProvider.TabFavicon favicon) {
+             ImageView faviconView, PropertyModel model, @Nullable TabFavicon favicon) {
 +        model.set(TabProperties.FAVICON, favicon);
         if (favicon == null) {
             faviconView.setImageDrawable(null);
@@ -40,7 +40,7 @@ diff --git a/chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser
 diff --git a/chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser/tasks/tab_management/TabProperties.java b/chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser/tasks/tab_management/TabProperties.java
 --- a/chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser/tasks/tab_management/TabProperties.java
 +++ b/chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser/tasks/tab_management/TabProperties.java
-@@ -85,6 +85,9 @@ public class TabProperties {
+@@ -130,6 +130,9 @@ public class TabProperties {
     public static final WritableBooleanPropertyKey FAVICON_FETCHED =
             new WritableBooleanPropertyKey();
 
@@ -50,15 +50,15 @@ diff --git a/chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser
     /** Property for lazily fetching favicons when required by an item in a UI. */
     public static final WritableObjectPropertyKey<TabListFaviconProvider.TabFaviconFetcher>
             FAVICON_FETCHER = new WritableObjectPropertyKey<>();
-@@ -174,6 +177,7 @@ public class TabProperties {
+@@ -224,6 +227,7 @@ public class TabProperties {
                 CARD_TYPE,
                 CONTENT_DESCRIPTION_TEXT_RESOLVER,
                 ACTION_BUTTON_DESCRIPTION_TEXT_RESOLVER,
 +                FAVICON,
                 QUICK_DELETE_ANIMATION_STATUS,
                 TAB_GROUP_COLOR_VIEW_PROVIDER,
-                 VISIBILITY,
-@@ -210,6 +214,7 @@ public class TabProperties {
+                 TAB_GROUP_CARD_COLOR,
+@@ -264,6 +268,7 @@ public class TabProperties {
                 TAB_ACTION_BUTTON_DATA,
                 FAVICON_FETCHED,
                 FAVICON_FETCHER,
@@ -69,7 +69,7 @@ diff --git a/chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser
 diff --git a/chrome/android/java/res/xml/privacy_preferences.xml b/chrome/android/java/res/xml/privacy_preferences.xml
 --- a/chrome/android/java/res/xml/privacy_preferences.xml
 +++ b/chrome/android/java/res/xml/privacy_preferences.xml
-@@ -73,6 +73,11 @@ found in the LICENSE file.
+@@ -67,6 +67,11 @@ found in the LICENSE file.
         android:title="@string/open_external_links_incognito_title"
         android:summary="@string/open_external_links_incognito_summary"
         android:defaultValue="false" />
@@ -84,19 +84,19 @@ diff --git a/chrome/android/java/res/xml/privacy_preferences.xml b/chrome/androi
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/app/ChromeActivity.java b/chrome/android/java/src/org/chromium/chrome/browser/app/ChromeActivity.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/app/ChromeActivity.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/app/ChromeActivity.java
-@@ -145,6 +145,7 @@ import org.chromium.chrome.browser.preferences.ChromeSharedPreferences;
+@@ -158,6 +158,7 @@ import org.chromium.chrome.browser.preferences.ChromeSharedPreferences;
 import org.chromium.chrome.browser.preferences.Pref;
 import org.chromium.chrome.browser.price_tracking.PriceDropNotificationManagerFactory;
 import org.chromium.chrome.browser.printing.TabPrinter;
 +import org.chromium.chrome.browser.privacy.settings.PrivacySettings;
 import org.chromium.chrome.browser.profiles.Profile;
 import org.chromium.chrome.browser.profiles.ProfileManager;
- import org.chromium.chrome.browser.profiles.ProfileProvider;
-@@ -637,7 +638,8 @@ public abstract class ChromeActivity extends AsyncInitializationActivity
+ import org.chromium.chrome.browser.profiles.ProfileManagerUtils;
+@@ -679,7 +680,8 @@ public abstract class ChromeActivity extends AsyncInitializationActivity
                     new TabContentManager(
                             this,
                             mBrowserControlsManagerSupplier.get(),
-                            !TabUiFeatureUtilities.shouldUseListMode(),
+-                            /* snapshotsEnabled= */ true,
 +                            !TabUiFeatureUtilities.shouldUseListMode()
 +                                && !ContextUtils.getAppSharedPreferences().getBoolean(PrivacySettings.PREF_TABGRID_USE_ICONS, false),
                             tabModelSelector != null ? tabModelSelector::getTabById : null,
@@ -109,11 +109,11 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/privacy/setting
 import org.chromium.base.IntentUtils;
 import org.chromium.base.metrics.RecordHistogram;
 import org.chromium.base.metrics.RecordUserAction;
-+import org.chromium.base.supplier.Supplier;
+import java.util.function.Supplier;
 import org.chromium.base.supplier.ObservableSupplier;
 import org.chromium.base.supplier.ObservableSupplierImpl;
- import org.chromium.build.annotations.Nullable;
-@@ -98,12 +99,26 @@ import org.chromium.chrome.browser.preferences.ChromeSharedPreferences;
+ import org.chromium.build.annotations.NullMarked;
+@@ -99,13 +100,27 @@ import org.chromium.chrome.browser.preferences.ChromeSharedPreferences;
 import org.chromium.components.browser_ui.settings.ChromeSwitchPreference;
 import org.chromium.components.browser_ui.settings.ManagedPreferenceDelegate;
 
@@ -126,6 +126,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/privacy/setting
 import java.util.List;
 
 /** Fragment to keep track of the all the privacy related preferences. */
+ @NullMarked
 public class PrivacySettings extends ChromeBaseSettingsFragment
 -        implements Preference.OnPreferenceChangeListener {
 +        implements Preference.OnPreferenceChangeListener, INeedSnackbarManager {
@@ -141,7 +142,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/privacy/setting
     private static final String PREF_CAN_MAKE_PAYMENT = "can_make_payment";
     private static final String PREF_PRELOAD_PAGES = "preload_pages";
     private static final String PREF_HTTPS_FIRST_MODE = "https_first_mode";
-@@ -206,6 +221,21 @@ public class PrivacySettings extends ChromeBaseSettingsFragment
+@@ -201,6 +216,21 @@ public class PrivacySettings extends ChromeBaseSettingsFragment
             }
         }
 
@@ -155,7 +156,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/privacy/setting
 +                                ApplicationLifetime.terminate(true);
 +                        }
 +                }, Snackbar.TYPE_NOTIFICATION, Snackbar.UMA_UNKNOWN)
-+                .setSingleLine(false)
+                .setDefaultLines(false)
 +                .setAction(getActivity().getString(R.string.relaunch),
 +                        /*actionData*/null)
 +                .setDuration(/*durationMs*/70000);
@@ -163,7 +164,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/privacy/setting
         Preference privacyGuidePreference = findPreference(PREF_PRIVACY_GUIDE);
         // Record the launch of PG from the S&P link-row entry point
         privacyGuidePreference.setOnPreferenceClickListener(
-@@ -432,6 +462,7 @@ public class PrivacySettings extends ChromeBaseSettingsFragment
+@@ -433,6 +463,7 @@ public class PrivacySettings extends ChromeBaseSettingsFragment
 
     public static final String PREF_ALLOW_CUSTOM_TAB_INTENTS = "allow_custom_tab_intents";
     public static final String PREF_OPEN_EXTERNAL_LINKS_INCOGNITO = "open_external_links_incognito";
@@ -171,7 +172,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/privacy/setting
 
     @Override
     public boolean onPreferenceChange(Preference preference, Object newValue) {
-@@ -478,6 +509,13 @@ public class PrivacySettings extends ChromeBaseSettingsFragment
+@@ -479,6 +510,13 @@ public class PrivacySettings extends ChromeBaseSettingsFragment
             SharedPreferences.Editor sharedPreferencesEditor = ContextUtils.getAppSharedPreferences().edit();
             sharedPreferencesEditor.putBoolean(PREF_OPEN_EXTERNAL_LINKS_INCOGNITO, (boolean)newValue);
             sharedPreferencesEditor.apply();
@@ -185,7 +186,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/privacy/setting
         }
         return true;
     }
-@@ -528,6 +566,10 @@ public class PrivacySettings extends ChromeBaseSettingsFragment
+@@ -529,6 +567,10 @@ public class PrivacySettings extends ChromeBaseSettingsFragment
                             : R.string.text_off);
         }
 
@@ -199,7 +200,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/privacy/setting
 diff --git a/chrome/browser/ui/android/strings/android_chrome_strings.grd b/chrome/browser/ui/android/strings/android_chrome_strings.grd
 --- a/chrome/browser/ui/android/strings/android_chrome_strings.grd
 +++ b/chrome/browser/ui/android/strings/android_chrome_strings.grd
-@@ -6198,6 +6198,14 @@ To change this setting, <ph name="BEGIN_LINK">BEGIN_LINK</ph>delete the Chrome d
+@@ -6506,6 +6506,14 @@ To change this setting, <ph name="BEGIN_LINK">BEGIN_LINK</ph>delete the Chrome d
         Your <ph name="FQDN">%1$s<ex>www.amazon.com</ex></ph> timer ran out. It'll start again tomorrow.
       </message>
 
@@ -9,9 +9,9 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 .../java/res/values-sw600dp/dimens.xml        |  4 ++--
 chrome/android/java/res/values/dimens.xml     |  6 +++++-
 .../browser/ChromeBaseAppCompatActivity.java  |  3 +++
- .../chrome/browser/WarmupManager.java         |  5 ++++-
- .../ChromeAccessibilitySettingsDelegate.java  | 19 ++++++++++++++++++
- .../chrome/browser/app/ChromeActivity.java    |  4 +++-
+ .../chrome/browser/WarmupManager.java         |  7 +++++--
+ .../ChromeAccessibilitySettingsDelegate.java  | 19 +++++++++++++++++++
+ .../chrome/browser/app/ChromeActivity.java    |  5 ++++-
 .../overlays/strip/StripLayoutHelper.java     | 10 ++++++++--
 .../strip/StripLayoutHelperManager.java       |  6 +++++-
 .../scene_layer/TabStripSceneLayer.java       |  8 ++++++++
@@ -20,30 +20,29 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 .../chrome/browser/ui/RootUiCoordinator.java  |  6 +++++-
 chrome/browser/preferences/BUILD.gn           |  1 +
 .../preferences/ChromePreferenceKeys.java     |  1 +
- .../preferences/ChromeSharedPreferences.java  | 12 +++++++++++
+ .../preferences/ChromeSharedPreferences.java  | 12 ++++++++++++
 .../LegacyChromePreferenceKeys.java           |  1 +
- .../AppHeaderCoordinator.java                 |  2 ++
+ .../ui/desktop_windowing/AppHeaderUtils.java  |  2 ++
 .../omnibox/LocationBarCoordinator.java       |  2 +-
 .../strings/android_chrome_strings.grd        |  7 +++++++
 .../java/res/layout/control_container.xml     |  8 ++++----
 .../java/res/layout/toolbar_tablet.xml        |  2 +-
 .../java/res/values-sw600dp/dimens.xml        |  5 +++--
 .../toolbar/java/res/values/dimens.xml        |  6 ++++--
- .../browser/toolbar/ControlContainer.java     |  2 +-
- .../toolbar/top/ToolbarControlContainer.java  | 20 ++++++++++++++++++-
+ .../toolbar/top/ToolbarControlContainer.java  | 19 +++++++++++++++++++
 .../browser/toolbar/top/ToolbarLayout.java    |  5 ++++-
 .../tab_strip/HeightTransitionHandler.java    |  2 ++
 .../TabStripTransitionCoordinator.java        |  6 +++++-
 .../res/xml/accessibility_preferences.xml     |  5 +++++
- .../accessibility/AccessibilitySettings.java  | 13 ++++++++++++
+ .../accessibility/AccessibilitySettings.java  | 13 +++++++++++++
 .../AccessibilitySettingsDelegate.java        |  2 ++
- .../chromium/ui/base/DeviceFormFactor.java    | 14 +++++++++++++
- 34 files changed, 171 insertions(+), 26 deletions(-)
+ .../chromium/ui/base/DeviceFormFactor.java    | 14 ++++++++++++++
+ 33 files changed, 172 insertions(+), 25 deletions(-)

 diff --git a/chrome/android/java/res/layout/custom_tabs_control_container.xml b/chrome/android/java/res/layout/custom_tabs_control_container.xml
 --- a/chrome/android/java/res/layout/custom_tabs_control_container.xml
 +++ b/chrome/android/java/res/layout/custom_tabs_control_container.xml
-@@ -32,7 +32,7 @@ found in the LICENSE file.
+@@ -31,7 +31,7 @@ found in the LICENSE file.
             android:id="@+id/find_toolbar_stub"
             android:inflatedId="@+id/find_toolbar"
             android:visibility="gone"
@@ -81,8 +80,8 @@ diff --git a/chrome/android/java/res/values-sw600dp/dimens.xml b/chrome/android/
 diff --git a/chrome/android/java/res/values/dimens.xml b/chrome/android/java/res/values/dimens.xml
 --- a/chrome/android/java/res/values/dimens.xml
 +++ b/chrome/android/java/res/values/dimens.xml
-@@ -117,9 +117,13 @@ found in the LICENSE file.
-     <dimen name="tab_modal_scrim_vertical_margin">16dp</dimen>
+@@ -116,9 +116,13 @@ found in the LICENSE file.
+     <dimen name="signin_screen_top_padding">50dp</dimen>
 
     <!-- Should match toolbar_height_no_shadow -->
 -    <dimen name="control_container_height">@dimen/default_action_bar_height</dimen>
@@ -99,15 +98,15 @@ diff --git a/chrome/android/java/res/values/dimens.xml b/chrome/android/java/res
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ChromeBaseAppCompatActivity.java b/chrome/android/java/src/org/chromium/chrome/browser/ChromeBaseAppCompatActivity.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/ChromeBaseAppCompatActivity.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/ChromeBaseAppCompatActivity.java
-@@ -58,6 +58,7 @@ import org.chromium.chrome.browser.metrics.UmaSessionStats;
- import org.chromium.chrome.browser.night_mode.GlobalNightModeStateProviderHolder;
- import org.chromium.chrome.browser.night_mode.NightModeStateProvider;
- import org.chromium.chrome.browser.night_mode.NightModeUtils;
-+import org.chromium.chrome.browser.preferences.ChromeSharedPreferences;
+@@ -63,6 +63,7 @@ import org.chromium.chrome.browser.ui.edge_to_edge.EdgeToEdgeController;
+ import org.chromium.chrome.browser.ui.edge_to_edge.EdgeToEdgeControllerCreator;
+ import org.chromium.chrome.browser.ui.edge_to_edge.EdgeToEdgeFieldTrialImpl;
 import org.chromium.chrome.browser.ui.edge_to_edge.EdgeToEdgeUtils;
- import org.chromium.components.browser_ui.edge_to_edge.EdgeToEdgeManager;
- import org.chromium.components.browser_ui.edge_to_edge.EdgeToEdgeStateProvider;
-@@ -133,6 +134,8 @@ public class ChromeBaseAppCompatActivity extends AppCompatActivity
+import org.chromium.chrome.browser.preferences.ChromeSharedPreferences;
+ import org.chromium.chrome.browser.ui.edge_to_edge.SimpleEdgeToEdgeController;
+ import org.chromium.components.browser_ui.styles.SemanticColorUtils;
+ import org.chromium.components.browser_ui.util.AutomotiveUtils;
+@@ -145,6 +146,8 @@ public class ChromeBaseAppCompatActivity extends AppCompatActivity
     protected void attachBaseContext(Context newBase) {
         super.attachBaseContext(newBase);
 
@@ -119,22 +118,24 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ChromeBaseAppCo
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/WarmupManager.java b/chrome/android/java/src/org/chromium/chrome/browser/WarmupManager.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/WarmupManager.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/WarmupManager.java
-@@ -66,6 +66,7 @@ import org.chromium.content_public.browser.WebContents;
- import org.chromium.content_public.browser.WebContentsObserver;
- import org.chromium.net.NetId;
+@@ -63,6 +63,7 @@ import org.chromium.chrome.browser.toolbar.ControlContainer;
+ import org.chromium.components.embedder_support.util.UrlConstants;
+ import org.chromium.content_public.browser.WebContents;
 import org.chromium.ui.LayoutInflaterUtils;
 +import org.chromium.ui.base.DeviceFormFactor;
 import org.chromium.ui.base.WindowAndroid;
 import org.chromium.ui.display.DisplayUtil;
 import org.chromium.url.GURL;
-@@ -481,7 +482,9 @@ public class WarmupManager {
+@@ -472,8 +473,10 @@ public class WarmupManager {
             ControlContainer controlContainer = mainView.findViewById(R.id.control_container);
 
             if (toolbarId != ActivityUtils.NO_RESOURCE_ID && controlContainer != null) {
-                controlContainer.initWithToolbar(toolbarId);
+-                controlContainer.initWithToolbar(
+-                        toolbarId, R.dimen.custom_tabs_control_container_height);
 +                controlContainer.initWithToolbar(toolbarId,
 +                        DeviceFormFactor.isForceTabletUI()
-+                            ? R.dimen.control_container_height_tabletui : 0);
+                            ? R.dimen.control_container_height_tabletui
+                            :  R.dimen.custom_tabs_control_container_height);
             }
             return mainView;
         } catch (InflateException e) {
@@ -170,21 +171,22 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/accessibility/s
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/app/ChromeActivity.java b/chrome/android/java/src/org/chromium/chrome/browser/app/ChromeActivity.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/app/ChromeActivity.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/app/ChromeActivity.java
-@@ -787,7 +787,9 @@ public abstract class ChromeActivity extends AsyncInitializationActivity
+@@ -830,7 +830,10 @@ public abstract class ChromeActivity extends AsyncInitializationActivity
             // Inflate the correct toolbar layout for the device.
             int toolbarLayoutId = getToolbarLayoutId();
             if (toolbarLayoutId != ActivityUtils.NO_RESOURCE_ID && controlContainer != null) {
-                controlContainer.initWithToolbar(toolbarLayoutId);
+-                controlContainer.initWithToolbar(toolbarLayoutId, getToolbarLayoutHeightResId());
 +                controlContainer.initWithToolbar(toolbarLayoutId,
 +                        DeviceFormFactor.isForceTabletUI()
-+                            ? R.dimen.control_container_height_tabletui : 0);
+                            ? R.dimen.control_container_height_tabletui
+                            : getToolbarLayoutHeightResId());
             }
             onInitialLayoutInflationComplete();
         }
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/compositor/overlays/strip/StripLayoutHelper.java b/chrome/android/java/src/org/chromium/chrome/browser/compositor/overlays/strip/StripLayoutHelper.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/compositor/overlays/strip/StripLayoutHelper.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/compositor/overlays/strip/StripLayoutHelper.java
-@@ -120,6 +120,7 @@ import org.chromium.components.tab_group_sync.TabGroupSyncService;
+@@ -137,6 +137,7 @@ import org.chromium.components.tab_group_sync.TabGroupSyncService;
 import org.chromium.components.tab_group_sync.TriggerSource;
 import org.chromium.components.tab_groups.TabGroupColorId;
 import org.chromium.ui.accessibility.AccessibilityState;
@@ -192,7 +194,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/compositor/over
 import org.chromium.ui.base.LocalizationUtils;
 import org.chromium.ui.base.WindowAndroid;
 import org.chromium.ui.util.ColorUtils;
-@@ -4472,8 +4473,13 @@ public class StripLayoutHelper
+@@ -5317,8 +5318,13 @@ public class StripLayoutHelper
         mCloseButtonMenu.setAnchorView(tabView);
         // 3. Set the vertical offset to align the close button menu with bottom of the tab strip
         int tabHeight = mManagerHost.getHeight();
@@ -211,7 +213,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/compositor/over
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/compositor/overlays/strip/StripLayoutHelperManager.java b/chrome/android/java/src/org/chromium/chrome/browser/compositor/overlays/strip/StripLayoutHelperManager.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/compositor/overlays/strip/StripLayoutHelperManager.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/compositor/overlays/strip/StripLayoutHelperManager.java
-@@ -98,6 +98,7 @@ import org.chromium.components.browser_ui.desktop_windowing.DesktopWindowStateMa
+@@ -105,6 +105,7 @@ import org.chromium.components.browser_ui.desktop_windowing.DesktopWindowStateMa
 import org.chromium.components.browser_ui.styles.SemanticColorUtils;
 import org.chromium.components.browser_ui.widget.scrim.ScrimProperties;
 import org.chromium.content_public.browser.LoadUrlParams;
@@ -219,9 +221,9 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/compositor/over
 import org.chromium.ui.base.LocalizationUtils;
 import org.chromium.ui.base.PageTransition;
 import org.chromium.ui.base.WindowAndroid;
-@@ -467,7 +468,10 @@ public class StripLayoutHelperManager
-         mIsLayoutOptimizationsEnabled =
-                 ToolbarFeatures.isTabStripWindowLayoutOptimizationEnabled(
+@@ -498,7 +499,10 @@ public class StripLayoutHelperManager
+         mIsHeaderCustomizationSupported =
+                 ToolbarFeatures.isAppHeaderCustomizationSupported(
                         /* isTablet= */ true, DisplayUtil.isContextInDefaultDisplay(mContext));
 -        mScrollableStripHeight = res.getDimension(R.dimen.tab_strip_height) / mDensity;
 +        mScrollableStripHeight =
@@ -229,12 +231,12 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/compositor/over
 +                ? res.getDimension(R.dimen.tab_strip_height_tabletui)
 +                : res.getDimension(R.dimen.tab_strip_height_cromite)) / mDensity;
         mHeight =
-                 mIsLayoutOptimizationsEnabled
+                 mIsHeaderCustomizationSupported
                         ? toolbarManager.getTabStripHeightSupplier().get() / mDensity
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/compositor/scene_layer/TabStripSceneLayer.java b/chrome/android/java/src/org/chromium/chrome/browser/compositor/scene_layer/TabStripSceneLayer.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/compositor/scene_layer/TabStripSceneLayer.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/compositor/scene_layer/TabStripSceneLayer.java
-@@ -111,6 +111,14 @@ public class TabStripSceneLayer extends SceneOverlayLayer {
+@@ -120,6 +120,14 @@ public class TabStripSceneLayer extends SceneOverlayLayer {
         if (mNativePtr == 0) return;
         final boolean visible = yOffset > -layoutHelper.getHeight();
 
@@ -248,19 +250,19 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/compositor/scen
 +
         // This will hide the tab strips if necessary.
         TabStripSceneLayerJni.get()
-                 .beginBuildingFrame(mNativePtr, TabStripSceneLayer.this, visible);
+                 .beginBuildingFrame(mNativePtr, visible, resourceManager, layerTitleCache);
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/init/ChromeBrowserInitializer.java b/chrome/android/java/src/org/chromium/chrome/browser/init/ChromeBrowserInitializer.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/init/ChromeBrowserInitializer.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/init/ChromeBrowserInitializer.java
-@@ -17,6 +17,7 @@ import org.chromium.base.library_loader.LibraryProcessType;
- import org.chromium.base.task.ChainedTasks;
- import org.chromium.base.task.TaskTraits;
+@@ -18,6 +18,7 @@ import org.chromium.base.task.TaskTraits;
+ import org.chromium.build.annotations.NullMarked;
+ import org.chromium.build.annotations.Nullable;
 import org.chromium.chrome.browser.flags.ChromeSwitches;
 +import org.chromium.chrome.browser.preferences.ChromeSharedPreferences;
 import org.chromium.chrome.browser.profiles.ProfileManager;
 import org.chromium.chrome.browser.signin.SigninCheckerProvider;
 import org.chromium.components.background_task_scheduler.BackgroundTaskSchedulerFactory;
-@@ -107,6 +108,7 @@ public class ChromeBrowserInitializer {
+@@ -110,6 +111,7 @@ public class ChromeBrowserInitializer {
     public void handlePreNativeStartupAndLoadLibraries(final BrowserParts parts) {
         ThreadUtils.checkUiThread();
         if (parts.isActivityFinishingOrDestroyed()) return;
@@ -271,7 +273,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/init/ChromeBrow
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedRootUiCoordinator.java b/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedRootUiCoordinator.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedRootUiCoordinator.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedRootUiCoordinator.java
-@@ -725,7 +725,9 @@ public class TabbedRootUiCoordinator extends RootUiCoordinator {
+@@ -807,7 +807,9 @@ public class TabbedRootUiCoordinator extends RootUiCoordinator {
 
     @Override
     public int getControlContainerHeightResource() {
@@ -285,7 +287,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/Tab
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ui/RootUiCoordinator.java b/chrome/android/java/src/org/chromium/chrome/browser/ui/RootUiCoordinator.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/ui/RootUiCoordinator.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/ui/RootUiCoordinator.java
-@@ -104,6 +104,8 @@ import org.chromium.chrome.browser.paint_preview.DemoPaintPreview;
+@@ -120,6 +120,8 @@ import org.chromium.chrome.browser.paint_preview.DemoPaintPreview;
 import org.chromium.chrome.browser.password_manager.ManagePasswordsReferrer;
 import org.chromium.chrome.browser.password_manager.PasswordManagerLauncher;
 import org.chromium.chrome.browser.pdf.PdfPage;
@@ -294,9 +296,9 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ui/RootUiCoordi
 import org.chromium.chrome.browser.profiles.Profile;
 import org.chromium.chrome.browser.quick_delete.QuickDeleteController;
 import org.chromium.chrome.browser.quick_delete.QuickDeleteDelegateImpl;
-@@ -1645,7 +1647,9 @@ public class RootUiCoordinator
-         if (!mSupportsFindInPageSupplier.getAsBoolean()) return;
+@@ -1947,7 +1949,9 @@ public class RootUiCoordinator
 
+     protected int getFindToolbarStub() {
         int stubId = R.id.find_toolbar_stub;
 -        if (DeviceFormFactor.isNonMultiDisplayContextOnTablet(mActivity)) {
 +        if (DeviceFormFactor.isNonMultiDisplayContextOnTablet(mActivity) &&
@@ -304,7 +306,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ui/RootUiCoordi
 +                      ChromePreferenceKeys.FLAGS_FORCE_TABLET_UI_ENABLED, false)) {
             stubId = R.id.find_toolbar_tablet_stub;
         }
-         mFindToolbarManager =
+         return stubId;
 diff --git a/chrome/browser/preferences/BUILD.gn b/chrome/browser/preferences/BUILD.gn
 --- a/chrome/browser/preferences/BUILD.gn
 +++ b/chrome/browser/preferences/BUILD.gn
@@ -319,7 +321,7 @@ diff --git a/chrome/browser/preferences/BUILD.gn b/chrome/browser/preferences/BU
 diff --git a/chrome/browser/preferences/android/java/src/org/chromium/chrome/browser/preferences/ChromePreferenceKeys.java b/chrome/browser/preferences/android/java/src/org/chromium/chrome/browser/preferences/ChromePreferenceKeys.java
 --- a/chrome/browser/preferences/android/java/src/org/chromium/chrome/browser/preferences/ChromePreferenceKeys.java
 +++ b/chrome/browser/preferences/android/java/src/org/chromium/chrome/browser/preferences/ChromePreferenceKeys.java
-@@ -313,6 +313,7 @@ public final class ChromePreferenceKeys {
+@@ -358,6 +358,7 @@ public final class ChromePreferenceKeys {
     /** Whether the app-specific history info text was already seen by users. */
     public static final String HISTORY_APP_SPECIFIC_INFO_SEEN =
             "Chrome.History.AppSpecificInfoSeen";
@@ -367,29 +369,29 @@ diff --git a/chrome/browser/preferences/android/java/src/org/chromium/chrome/bro
                 ChromePreferenceKeys.FIRST_RUN_SKIP_WELCOME_PAGE,
                 ChromePreferenceKeys.HISTORY_SHOW_HISTORY_INFO,
                 ChromePreferenceKeys.HOMEPAGE_ENABLED,
-diff --git a/chrome/browser/ui/android/desktop_windowing/java/src/org/chromium/chrome/browser/ui/desktop_windowing/AppHeaderCoordinator.java b/chrome/browser/ui/android/desktop_windowing/java/src/org/chromium/chrome/browser/ui/desktop_windowing/AppHeaderCoordinator.java
--- a/chrome/browser/ui/android/desktop_windowing/java/src/org/chromium/chrome/browser/ui/desktop_windowing/AppHeaderCoordinator.java
-+++ b/chrome/browser/ui/android/desktop_windowing/java/src/org/chromium/chrome/browser/ui/desktop_windowing/AppHeaderCoordinator.java
-@@ -39,6 +39,7 @@ import org.chromium.components.browser_ui.desktop_windowing.AppHeaderState;
+diff --git a/chrome/browser/ui/android/desktop_windowing/java/src/org/chromium/chrome/browser/ui/desktop_windowing/AppHeaderUtils.java b/chrome/browser/ui/android/desktop_windowing/java/src/org/chromium/chrome/browser/ui/desktop_windowing/AppHeaderUtils.java
+--- a/chrome/browser/ui/android/desktop_windowing/java/src/org/chromium/chrome/browser/ui/desktop_windowing/AppHeaderUtils.java
+++ b/chrome/browser/ui/android/desktop_windowing/java/src/org/chromium/chrome/browser/ui/desktop_windowing/AppHeaderUtils.java
+@@ -26,6 +26,7 @@ import org.chromium.chrome.browser.lifecycle.ActivityLifecycleDispatcher.Activit
+ import org.chromium.chrome.browser.preferences.ChromePreferenceKeys;
+ import org.chromium.chrome.browser.preferences.ChromeSharedPreferences;
 import org.chromium.components.browser_ui.desktop_windowing.DesktopWindowStateManager;
- import org.chromium.components.browser_ui.edge_to_edge.EdgeToEdgeStateProvider;
- import org.chromium.ui.CaptionBarInsetsRectProvider;
 +import org.chromium.ui.base.DeviceFormFactor;
- import org.chromium.ui.InsetObserver;
- import org.chromium.ui.InsetObserver.WindowInsetsConsumer;
- import org.chromium.ui.InsetsRectProvider;
-@@ -267,6 +268,7 @@ public class AppHeaderCoordinator
-             InsetsRectProvider insetsRectProvider,
-             @DesktopWindowHeuristicResult int currentResult,
-             boolean isOnExternalDisplay) {
+ import org.chromium.ui.display.DisplayUtil;
+ import org.chromium.ui.insets.InsetsRectProvider;
+ 
+@@ -245,6 +246,7 @@ public class AppHeaderUtils {
+      */
+     static @DesktopWindowHeuristicResult int checkIsInDesktopWindow(
+             InsetsRectProvider insetsRectProvider, Context context) {
 +        if (DeviceFormFactor.isForceTabletUI()) return DesktopWindowHeuristicResult.IN_DESKTOP_WINDOW;
         @DesktopWindowHeuristicResult int newResult;
 
-         Insets captionBarInset = insetsRectProvider.getCachedInset();
+         boolean isOnExternalDisplay = !DisplayUtil.isContextInDefaultDisplay(context);
 diff --git a/chrome/browser/ui/android/omnibox/java/src/org/chromium/chrome/browser/omnibox/LocationBarCoordinator.java b/chrome/browser/ui/android/omnibox/java/src/org/chromium/chrome/browser/omnibox/LocationBarCoordinator.java
 --- a/chrome/browser/ui/android/omnibox/java/src/org/chromium/chrome/browser/omnibox/LocationBarCoordinator.java
 +++ b/chrome/browser/ui/android/omnibox/java/src/org/chromium/chrome/browser/omnibox/LocationBarCoordinator.java
-@@ -857,7 +857,7 @@ public class LocationBarCoordinator
+@@ -1008,7 +1008,7 @@ public class LocationBarCoordinator
     }
 
     private boolean isTabletWindow() {
@@ -401,7 +403,7 @@ diff --git a/chrome/browser/ui/android/omnibox/java/src/org/chromium/chrome/brow
 diff --git a/chrome/browser/ui/android/strings/android_chrome_strings.grd b/chrome/browser/ui/android/strings/android_chrome_strings.grd
 --- a/chrome/browser/ui/android/strings/android_chrome_strings.grd
 +++ b/chrome/browser/ui/android/strings/android_chrome_strings.grd
-@@ -1654,6 +1654,13 @@ Your Google account may have other forms of browsing history like searches and a
+@@ -1507,6 +1507,13 @@ Your Google account may have other forms of browsing history like searches and a
         Privacy guide explanation closed
       </message>
 
@@ -422,30 +424,28 @@ diff --git a/chrome/browser/ui/android/toolbar/java/res/layout/control_container
     android:id="@+id/control_container"
     android:layout_width="match_parent"
     android:layout_height="wrap_content"
-    android:minHeight="@dimen/control_container_height" >
-+    android:minHeight="@dimen/control_container_height_cromite" >
+-    android:minHeight="@dimen/control_container_height">
+    android:minHeight="@dimen/control_container_height_cromite">
 
     <view
-         class="org.chromium.chrome.browser.toolbar.top.ToolbarControlContainer$ToolbarViewResourceFrameLayout"
+         class="org.chromium.chrome.browser.toolbar.top.ToolbarControlContainer$ToolbarViewResourceCoordinatorLayout"
@@ -20,7 +20,7 @@ found in the LICENSE file.
         <ViewStub
             android:id="@+id/toolbar_stub"
             android:layout_width="match_parent"
 -            android:layout_marginTop="@dimen/tab_strip_height"
 +            android:layout_marginTop="@dimen/tab_strip_height_cromite"
+             android:layout_marginBottom="@dimen/toolbar_hairline_height"
             android:layout_height="@dimen/toolbar_height_no_shadow" />
 
-         <ImageView
-@@ -28,7 +28,7 @@ found in the LICENSE file.
-             android:src="@drawable/toolbar_hairline"
-             android:layout_width="match_parent"
+@@ -30,13 +30,13 @@ found in the LICENSE file.
             android:layout_height="wrap_content"
-            android:layout_marginTop="@dimen/control_container_height"
-+            android:layout_marginTop="@dimen/control_container_height_cromite"
-             android:scaleType="fitXY"
-             android:importantForAccessibility="no" />
+             android:layout_gravity="bottom"
+             app:layout_anchorGravity="bottom"
+-            />
+            android:layout_marginTop="@dimen/control_container_height_cromite" />
 
-@@ -36,7 +36,7 @@ found in the LICENSE file.
+         <ViewStub
             android:id="@+id/find_toolbar_stub"
             android:inflatedId="@+id/find_toolbar"
             android:visibility="gone"
@@ -494,19 +494,7 @@ diff --git a/chrome/browser/ui/android/toolbar/java/res/values/dimens.xml b/chro
 +    <dimen name="tab_strip_reserved_top_padding_tabletui">2dp</dimen>
 
     <dimen name="ntp_search_box_height">64dp</dimen>
- 
-diff --git a/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/ControlContainer.java b/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/ControlContainer.java
--- a/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/ControlContainer.java
-+++ b/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/ControlContainer.java
-@@ -27,7 +27,7 @@ public interface ControlContainer {
-      *
-      * @param toolbarLayoutId The ID of the toolbar layout to use.
-      */
-    void initWithToolbar(int toolbarLayoutId);
-+    void initWithToolbar(int toolbarLayoutId, int controlContainerHeightOverrideId);
- 
-     /**
-      * @return The {@link ViewResourceAdapter} that exposes this {@link View} as a CC resource.
+     <dimen name="ntp_search_box_height_tall">72dp</dimen>
 diff --git a/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/top/ToolbarControlContainer.java b/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/top/ToolbarControlContainer.java
 --- a/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/top/ToolbarControlContainer.java
 +++ b/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/top/ToolbarControlContainer.java
@@ -518,16 +506,14 @@ diff --git a/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/brow
 import android.graphics.Canvas;
 import android.graphics.Color;
 import android.graphics.PorterDuff;
-@@ -157,8 +158,25 @@ public class ToolbarControlContainer extends OptimizedFrameLayout
- 
-     @Override
+@@ -172,6 +173,24 @@ public class ToolbarControlContainer extends OptimizedFrameLayout
     @Initializer
-    public void initWithToolbar(int toolbarLayoutId) {
-+    public void initWithToolbar(int toolbarLayoutId, int controlContainerHeightOverrideId) {
+     public void initWithToolbar(int toolbarLayoutId, int toolbarLayoutHeightResId) {
         try (TraceEvent te = TraceEvent.scoped("ToolbarControlContainer.initWithToolbar")) {
-+            if (controlContainerHeightOverrideId != 0) {
+            if (DeviceFormFactor.isForceTabletUI() && toolbarLayoutHeightResId != 0) {
+                toolbarLayoutHeightResId = R.dimen.tab_strip_height_tabletui;
 +                Resources res = getContext().getResources();
-+                setMinimumHeight((int) res.getDimension(controlContainerHeightOverrideId));
+                setMinimumHeight((int) res.getDimension(toolbarLayoutHeightResId));
 +                int tab_strip_height =
 +                    (int) res.getDimension(R.dimen.tab_strip_height_tabletui);
 +
@@ -543,12 +529,12 @@ diff --git a/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/brow
 +                    ((MarginLayoutParams)view.getLayoutParams()).topMargin = tab_strip_height;
 +            }
             mToolbarContainer = findViewById(R.id.toolbar_container);
+             mToolbarLayoutHeight = getResources().getDimensionPixelSize(toolbarLayoutHeightResId);
             ViewStub toolbarStub = findViewById(R.id.toolbar_stub);
-             toolbarStub.setLayoutResource(toolbarLayoutId);
 diff --git a/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/top/ToolbarLayout.java b/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/top/ToolbarLayout.java
 --- a/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/top/ToolbarLayout.java
 +++ b/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/top/ToolbarLayout.java
-@@ -68,6 +68,7 @@ import org.chromium.chrome.browser.util.BrowserUiUtils.ModuleTypeOnStartAndNtp;
+@@ -65,6 +65,7 @@ import org.chromium.chrome.browser.util.BrowserUiUtils.ModuleTypeOnStartAndNtp;
 import org.chromium.components.feature_engagement.Tracker;
 import org.chromium.ui.base.ViewUtils;
 import org.chromium.ui.util.MotionEventUtils;
@@ -556,7 +542,7 @@ diff --git a/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/brow
 import org.chromium.ui.util.TokenHolder;
 import org.chromium.url.GURL;
 
-@@ -586,7 +587,9 @@ public abstract class ToolbarLayout extends FrameLayout
+@@ -588,7 +589,9 @@ public abstract class ToolbarLayout extends FrameLayout
      * not have a tab strip.
      */
     protected int getTabStripHeightFromResource() {
@@ -570,34 +556,34 @@ diff --git a/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/brow
 diff --git a/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/top/tab_strip/HeightTransitionHandler.java b/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/top/tab_strip/HeightTransitionHandler.java
 --- a/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/top/tab_strip/HeightTransitionHandler.java
 +++ b/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/top/tab_strip/HeightTransitionHandler.java
-@@ -29,6 +29,7 @@ import org.chromium.chrome.browser.toolbar.top.ToolbarLayout;
- import org.chromium.chrome.browser.toolbar.top.tab_strip.TabStripTransitionCoordinator.TabStripHeightObserver;
+@@ -27,6 +27,7 @@ import org.chromium.chrome.browser.toolbar.ControlContainer;
 import org.chromium.chrome.browser.toolbar.top.tab_strip.TabStripTransitionCoordinator.TabStripTransitionDelegate;
+ import org.chromium.chrome.browser.toolbar.top.tab_strip.TabStripTransitionCoordinator.TabStripTransitionHandler;
 import org.chromium.ui.base.ViewUtils;
 +import org.chromium.ui.base.DeviceFormFactor;
 import org.chromium.ui.resources.dynamics.DynamicResourceReadyOnceCallback;
 import org.chromium.ui.util.TokenHolder;
 
-@@ -559,6 +560,7 @@ class HeightTransitionHandler {
+@@ -492,6 +493,7 @@ class HeightTransitionHandler {
+ 
+     /** Get the min screen width (in dp) required for the tab strip to become visible. */
+     private static int getScreenWidthThresholdDp() {
+        if (DeviceFormFactor.isForceTabletUI()) return 0;
         if (TabStripTransitionCoordinator.sHeightTransitionThresholdForTesting != null) {
             return TabStripTransitionCoordinator.sHeightTransitionThresholdForTesting;
         }
-+        if (DeviceFormFactor.isForceTabletUI()) return 0;
-         return TRANSITION_THRESHOLD_DP;
-     }
- 
 diff --git a/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/top/tab_strip/TabStripTransitionCoordinator.java b/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/top/tab_strip/TabStripTransitionCoordinator.java
 --- a/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/top/tab_strip/TabStripTransitionCoordinator.java
 +++ b/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/top/tab_strip/TabStripTransitionCoordinator.java
-@@ -28,6 +28,7 @@ import org.chromium.chrome.browser.ui.desktop_windowing.AppHeaderUtils;
+@@ -24,6 +24,7 @@ import org.chromium.chrome.browser.ui.desktop_windowing.AppHeaderUtils;
 import org.chromium.components.browser_ui.desktop_windowing.AppHeaderState;
 import org.chromium.components.browser_ui.desktop_windowing.DesktopWindowStateManager;
 import org.chromium.components.browser_ui.desktop_windowing.DesktopWindowStateManager.AppHeaderObserver;
 +import org.chromium.ui.base.DeviceFormFactor;
 
- /** Class used to manage tab strip visibility and height updates. */
- @NullMarked
-@@ -153,7 +154,10 @@ public class TabStripTransitionCoordinator implements ComponentCallbacks, AppHea
+ /**
+  * Class used to manage tab strip visibility and height updates.
+@@ -170,7 +171,10 @@ public class TabStripTransitionCoordinator implements ComponentCallbacks, AppHea
         mTabStripReservedTopPadding =
                 controlContainerView()
                         .getResources()
@@ -613,8 +599,8 @@ diff --git a/components/browser_ui/accessibility/android/java/res/xml/accessibil
 --- a/components/browser_ui/accessibility/android/java/res/xml/accessibility_preferences.xml
 +++ b/components/browser_ui/accessibility/android/java/res/xml/accessibility_preferences.xml
@@ -41,6 +41,11 @@ found in the LICENSE file.
-         android:summary="@string/jump_start_omnibox_summary"
-         android:title="@string/jump_start_omnibox_title" />
+         android:summary="@string/caret_browsing_summary"
+         android:title="@string/caret_browsing_title" />
 
 +    <org.chromium.components.browser_ui.settings.ChromeSwitchPreference
 +        android:key="force_tablet_ui"
@@ -627,17 +613,17 @@ diff --git a/components/browser_ui/accessibility/android/java/res/xml/accessibil
 diff --git a/components/browser_ui/accessibility/android/java/src/org/chromium/components/browser_ui/accessibility/AccessibilitySettings.java b/components/browser_ui/accessibility/android/java/src/org/chromium/components/browser_ui/accessibility/AccessibilitySettings.java
 --- a/components/browser_ui/accessibility/android/java/src/org/chromium/components/browser_ui/accessibility/AccessibilitySettings.java
 +++ b/components/browser_ui/accessibility/android/java/src/org/chromium/components/browser_ui/accessibility/AccessibilitySettings.java
-@@ -29,6 +29,7 @@ import org.chromium.content_public.browser.ContentFeatureList;
- import org.chromium.content_public.browser.ContentFeatureMap;
+@@ -31,6 +31,7 @@ import org.chromium.content_public.browser.ContentFeatureMap;
+ import org.chromium.ui.base.UiAndroidFeatureList;
 
 import org.chromium.chrome.browser.settings.ChromeBaseSettingsFragment;
 +import org.chromium.components.browser_ui.accessibility.AccessibilitySettingsDelegate.BooleanPreferenceDelegate;
 
 /** Fragment to keep track of all the accessibility related preferences. */
 @NullMarked
-@@ -44,6 +45,9 @@ public class AccessibilitySettings extends ChromeBaseSettingsFragment
-     public static final String PREF_ZOOM_INFO = "zoom_info";
-     public static final String PREF_IMAGE_DESCRIPTIONS = "image_descriptions";
+@@ -51,6 +52,9 @@ public class AccessibilitySettings extends ChromeBaseSettingsFragment
+     public static final String PREF_TOUCHPAD_OVERSCROLL_HISTORY_NAVIGATION =
+             "touchpad_overscroll_history_navigation";
 
 +    private BooleanPreferenceDelegate mForceTabletUIDelegate;
 +    static final String PREF_FORCE_TABLET_UI = "force_tablet_ui";
@@ -645,7 +631,7 @@ diff --git a/components/browser_ui/accessibility/android/java/src/org/chromium/c
     private PageZoomPreference mPageZoomDefaultZoomPref;
     private ChromeSwitchPreference mPageZoomIncludeOSAdjustment;
     private ChromeSwitchPreference mPageZoomAlwaysShowPref;
-@@ -108,6 +112,12 @@ public class AccessibilitySettings extends ChromeBaseSettingsFragment
+@@ -126,6 +130,12 @@ public class AccessibilitySettings extends ChromeBaseSettingsFragment
                 mDelegate.getReaderAccessibilityDelegate().getValue());
         readerForAccessibilityPref.setOnPreferenceChangeListener(this);
 
@@ -658,7 +644,7 @@ diff --git a/components/browser_ui/accessibility/android/java/src/org/chromium/c
         Preference captions = findPreference(PREF_CAPTIONS);
         captions.setOnPreferenceClickListener(
                 preference -> {
-@@ -167,6 +177,9 @@ public class AccessibilitySettings extends ChromeBaseSettingsFragment
+@@ -212,6 +222,9 @@ public class AccessibilitySettings extends ChromeBaseSettingsFragment
     public boolean onPreferenceChange(Preference preference, Object newValue) {
         if (PREF_FORCE_ENABLE_ZOOM.equals(preference.getKey())) {
             mDelegate.getForceEnableZoomAccessibilityDelegate().setValue((Boolean) newValue);
@@ -683,9 +669,9 @@ diff --git a/components/browser_ui/accessibility/android/java/src/org/chromium/c
 diff --git a/ui/android/java/src/org/chromium/ui/base/DeviceFormFactor.java b/ui/android/java/src/org/chromium/ui/base/DeviceFormFactor.java
 --- a/ui/android/java/src/org/chromium/ui/base/DeviceFormFactor.java
 +++ b/ui/android/java/src/org/chromium/ui/base/DeviceFormFactor.java
-@@ -83,6 +83,14 @@ public class DeviceFormFactor {
-         return BuildConfig.IS_DESKTOP_ANDROID;
-     }
+@@ -87,6 +87,14 @@ public class DeviceFormFactor {
+     /** See {@link #setIsTabletForTesting(boolean)}. */
+     private static @Nullable Boolean sIsTabletForTesting;
 
 +    private static boolean mForceTabletUI = false;
 +    public static void setForceTabletUI(boolean forceTabletUI) {
@@ -698,7 +684,7 @@ diff --git a/ui/android/java/src/org/chromium/ui/base/DeviceFormFactor.java b/ui
     /**
      * Each activity could be on a different display, and this will just tell you whether the
      * display associated with the application context is "tablet sized". Use {@link
-@@ -91,6 +99,7 @@ public class DeviceFormFactor {
+@@ -95,6 +103,7 @@ public class DeviceFormFactor {
     @CalledByNative
     @Deprecated
     public static boolean isTablet() {
@@ -706,7 +692,7 @@ diff --git a/ui/android/java/src/org/chromium/ui/base/DeviceFormFactor.java b/ui
         if (sIsTabletForTesting != null) {
             return sIsTabletForTesting;
         }
-@@ -121,6 +130,7 @@ public class DeviceFormFactor {
+@@ -125,6 +134,7 @@ public class DeviceFormFactor {
      *     E.g. http://developer.samsung.com/samsung-dex/testing
      */
     public static boolean isNonMultiDisplayContextOnTablet(Context context) {
@@ -714,7 +700,7 @@ diff --git a/ui/android/java/src/org/chromium/ui/base/DeviceFormFactor.java b/ui
         return detectScreenWidthBucket(context) >= SCREEN_BUCKET_TABLET;
     }
 
-@@ -156,6 +166,7 @@ public class DeviceFormFactor {
+@@ -159,6 +169,7 @@ public class DeviceFormFactor {
      * @return The screen width bucket the device is in (see constants at the top of this class).
      */
     private static int detectScreenWidthBucket(Context context) {
@@ -722,7 +708,7 @@ diff --git a/ui/android/java/src/org/chromium/ui/base/DeviceFormFactor.java b/ui
         return context.getResources().getInteger(R.integer.min_screen_width_bucket);
     }
 
-@@ -163,6 +174,7 @@ public class DeviceFormFactor {
+@@ -166,6 +177,7 @@ public class DeviceFormFactor {
         ThreadUtils.assertOnUiThread();
         Context context = windowAndroid.getContext().get();
         if (context == null) return 0;
@@ -730,7 +716,7 @@ diff --git a/ui/android/java/src/org/chromium/ui/base/DeviceFormFactor.java b/ui
         return context.getResources().getInteger(R.integer.min_screen_width_bucket);
     }
 
-@@ -172,6 +184,7 @@ public class DeviceFormFactor {
+@@ -175,6 +187,7 @@ public class DeviceFormFactor {
      */
     @UiThread
     public static int getNonMultiDisplayMinimumTabletWidthPx(Context context) {
@@ -738,7 +724,7 @@ diff --git a/ui/android/java/src/org/chromium/ui/base/DeviceFormFactor.java b/ui
         return getMinimumTabletWidthPx(DisplayAndroid.getNonMultiDisplay(context));
     }
 
-@@ -180,6 +193,7 @@ public class DeviceFormFactor {
+@@ -183,6 +196,7 @@ public class DeviceFormFactor {
      *         layout.
      */
     public static int getMinimumTabletWidthPx(DisplayAndroid display) {
@@ -4,16 +4,17 @@ Subject: Add option to not persist tabs across sessions

 License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 ---
- .../android/java/res/xml/privacy_preferences.xml |  5 +++++
- .../chrome/browser/ChromeTabbedActivity.java     |  5 ++++-
- .../privacy/settings/PrivacySettings.java        | 16 +++++++++++++++-
- .../android/strings/android_chrome_strings.grd   |  6 ++++++
- 4 files changed, 30 insertions(+), 2 deletions(-)
+ .../android/java/res/xml/privacy_preferences.xml  |  5 +++++
+ .../chrome/browser/ChromeTabbedActivity.java      |  5 ++++-
+ .../browser/privacy/settings/PrivacySettings.java | 15 ++++++++++++++-
+ .../browser/tab_group_sync/StartupHelper.java     |  6 ++++++
+ .../ui/android/strings/android_chrome_strings.grd |  6 ++++++
+ 5 files changed, 35 insertions(+), 2 deletions(-)

 diff --git a/chrome/android/java/res/xml/privacy_preferences.xml b/chrome/android/java/res/xml/privacy_preferences.xml
 --- a/chrome/android/java/res/xml/privacy_preferences.xml
 +++ b/chrome/android/java/res/xml/privacy_preferences.xml
-@@ -95,6 +95,11 @@ found in the LICENSE file.
+@@ -89,6 +89,11 @@ found in the LICENSE file.
         android:title="@string/incognito_settings_title"
         android:summary="@string/incognito_settings_summary"
         android:fragment="org.chromium.chrome.browser.privacy.settings.IncognitoSettings"/>
@@ -28,15 +29,15 @@ diff --git a/chrome/android/java/res/xml/privacy_preferences.xml b/chrome/androi
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java b/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java
-@@ -47,6 +47,7 @@ import org.chromium.base.Callback;
+@@ -47,6 +47,7 @@ import org.chromium.base.ApplicationStatus;
+ import org.chromium.base.Callback;
 import org.chromium.base.CallbackController;
 import org.chromium.base.CallbackUtils;
- import org.chromium.base.CommandLine;
 +import org.chromium.base.ContextUtils;
+ import org.chromium.base.CommandLine;
+ import org.chromium.base.DeviceInfo;
 import org.chromium.base.IntentUtils;
- import org.chromium.base.Log;
- import org.chromium.base.MemoryPressureListener;
-@@ -1849,8 +1850,10 @@ public class ChromeTabbedActivity extends ChromeActivity {
+@@ -2175,8 +2176,10 @@ public class ChromeTabbedActivity extends ChromeActivity implements PreAttachInt
             boolean hadCipherData =
                     CipherLazyHolder.sCipherInstance.restoreFromBundle(getSavedInstanceState());
 
@@ -51,25 +52,23 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedAct
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/privacy/settings/PrivacySettings.java b/chrome/android/java/src/org/chromium/chrome/browser/privacy/settings/PrivacySettings.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/privacy/settings/PrivacySettings.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/privacy/settings/PrivacySettings.java
-@@ -8,6 +8,7 @@ import static org.chromium.components.content_settings.PrefNames.COOKIE_CONTROLS
+@@ -9,6 +9,7 @@ import static org.chromium.components.content_settings.PrefNames.COOKIE_CONTROLS
 
 import android.content.Context;
 import android.content.Intent;
 +import android.content.SharedPreferences;
 import android.graphics.drawable.Drawable;
- import android.os.Build;
 import android.os.Bundle;
-@@ -21,7 +22,9 @@ import android.view.View;
- import androidx.annotation.VisibleForTesting;
+ import android.text.SpannableString;
+@@ -22,6 +23,7 @@ import androidx.annotation.VisibleForTesting;
 import androidx.preference.Preference;
 
-+import org.chromium.base.BuildInfo;
 import org.chromium.base.Callback;
 +import org.chromium.base.ContextUtils;
 import org.chromium.base.IntentUtils;
 import org.chromium.base.metrics.RecordHistogram;
 import org.chromium.base.metrics.RecordUserAction;
-@@ -113,6 +116,8 @@ public class PrivacySettings extends ChromeBaseSettingsFragment
+@@ -113,6 +115,8 @@ public class PrivacySettings extends ChromeBaseSettingsFragment
     private final SharedPreferencesManager mSharedPreferencesManager =
             ChromeSharedPreferences.getInstance();
 
@@ -78,7 +77,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/privacy/setting
     private ManagedPreferenceDelegate mManagedPreferenceDelegate;
     @VisibleForTesting static final String PREF_THIRD_PARTY_COOKIES = "third_party_cookies";
     @VisibleForTesting static final String PREF_TRACKING_PROTECTION = "tracking_protection";
-@@ -373,7 +378,11 @@ public class PrivacySettings extends ChromeBaseSettingsFragment
+@@ -374,7 +378,11 @@ public class PrivacySettings extends ChromeBaseSettingsFragment
     @Override
     public boolean onPreferenceChange(Preference preference, Object newValue) {
         String key = preference.getKey();
@@ -91,7 +90,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/privacy/setting
             UserPrefs.get(getProfile())
                     .setBoolean(Pref.CAN_MAKE_PAYMENT_ENABLED, (boolean) newValue);
         } else if (PREF_HTTPS_FIRST_MODE_LEGACY.equals(key)) {
-@@ -433,6 +442,11 @@ public class PrivacySettings extends ChromeBaseSettingsFragment
+@@ -434,6 +442,11 @@ public class PrivacySettings extends ChromeBaseSettingsFragment
                             getContext(), getProfile()));
         }
 
@@ -103,12 +102,35 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/privacy/setting
         Preference secureDnsPref = findPreference(PREF_SECURE_DNS);
         if (secureDnsPref != null && secureDnsPref.isVisible()) {
             secureDnsPref.setSummary(SecureDnsSettings.getSummary(getContext()));
+diff --git a/chrome/browser/tab_group_sync/android/java/src/org/chromium/chrome/browser/tab_group_sync/StartupHelper.java b/chrome/browser/tab_group_sync/android/java/src/org/chromium/chrome/browser/tab_group_sync/StartupHelper.java
+--- a/chrome/browser/tab_group_sync/android/java/src/org/chromium/chrome/browser/tab_group_sync/StartupHelper.java
+++ b/chrome/browser/tab_group_sync/android/java/src/org/chromium/chrome/browser/tab_group_sync/StartupHelper.java
+@@ -4,6 +4,7 @@
+ 
+ package org.chromium.chrome.browser.tab_group_sync;
+ 
+import org.chromium.base.ContextUtils;
+ import org.chromium.base.metrics.RecordHistogram;
+ import org.chromium.build.annotations.NullMarked;
+ import org.chromium.chrome.browser.preferences.Pref;
+@@ -74,6 +75,11 @@ public class StartupHelper {
+      */
+     public void initializeTabGroupSync() {
+         LogUtils.log(TAG, "initializeTabGroupSync");
+        if (ContextUtils.getAppSharedPreferences().getBoolean("close_tabs_on_exit", false)) {
+            for (String tabGroupId : mTabGroupSyncService.getAllGroupIds()) {
+                mTabGroupSyncService.removeGroup(tabGroupId);
+            }
+        }
+         // First close the groups that were deleted remotely when the activity was not running.
+         closeDeletedGroupsFromTabModel();
+ 
 diff --git a/chrome/browser/ui/android/strings/android_chrome_strings.grd b/chrome/browser/ui/android/strings/android_chrome_strings.grd
 --- a/chrome/browser/ui/android/strings/android_chrome_strings.grd
 +++ b/chrome/browser/ui/android/strings/android_chrome_strings.grd
-@@ -5714,6 +5714,12 @@ To change this setting, <ph name="BEGIN_LINK">BEGIN_LINK</ph>delete the Chrome d
-       <message name="IDS_CONTEXTMENU_IMAGE_TITLE" desc="The title of a context menu tab when the item pressed contains more than one type. This indicates that all the actions are related to the image.">
-         IMAGE
+@@ -2898,6 +2898,12 @@ To change this setting, <ph name="BEGIN_LINK">BEGIN_LINK</ph>delete the Chrome d
+       <message name="IDS_ACCESSIBILITY_TAB_SWITCHER_TITLE" desc="Accessibility label of the current window when Grid Tab Switcher is shown.">
+         All tabs
       </message>
 +      <message name="IDS_CLOSE_TABS_ON_EXIT_TITLE" desc="Text for 'Close tabs on exit' settings-privacy option.">
 +        Close all open tabs on exit
@@ -116,7 +138,7 @@ diff --git a/chrome/browser/ui/android/strings/android_chrome_strings.grd b/chro
 +      <message name="IDS_CLOSE_TABS_ON_EXIT_SUMMARY" desc="Summary text for 'Close tabs on exit' settings-privacy option.">
 +        Don't persist tabs between browsing sessions. Caution: parameters in urls allow linking between different sessions.
 +      </message>
-       <message name="IDS_CONTEXTMENU_LINK_TITLE" desc="The title of a context menu tab when the item pressed contains more than one type. This indicates that all the actions are related to the link.">
-         LINK
+       <message name="IDS_TAB_LOADING_DEFAULT_TITLE" desc="The title of a tab when we are still waiting for either the URL or the real title. This generally shows when the page is first loading.">
+         Loading…
       </message>
 --
@@ -6,7 +6,7 @@ And allow use about:blank as default homepage

 License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 ---
- .../tab_management/TabGridDialogMediator.java    | 11 ++++++++++-
+ .../tab_management/TabGridDialogMediator.java    | 12 +++++++++++-
 .../tasks/tab_management/TabGroupUiMediator.java |  8 +++++++-
 .../java/res/xml/homepage_preferences.xml        |  5 +++++
 .../strip/TabGroupContextMenuCoordinator.java    | 11 ++++++++++-
@@ -19,14 +19,22 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 .../android/strings/android_chrome_strings.grd   |  3 +++
 chrome/browser/ui/browser_ui_prefs.cc            |  2 ++
 chrome/common/pref_names.h                       |  4 ++++
- 13 files changed, 79 insertions(+), 4 deletions(-)
+ 13 files changed, 80 insertions(+), 4 deletions(-)

 diff --git a/chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser/tasks/tab_management/TabGridDialogMediator.java b/chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser/tasks/tab_management/TabGridDialogMediator.java
 --- a/chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser/tasks/tab_management/TabGridDialogMediator.java
 +++ b/chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser/tasks/tab_management/TabGridDialogMediator.java
-@@ -114,6 +114,9 @@ import java.util.Objects;
- import java.util.Optional;
+@@ -101,6 +101,7 @@ import org.chromium.components.collaboration.messaging.PersistentNotificationTyp
+ import org.chromium.components.data_sharing.DataSharingService;
+ import org.chromium.components.data_sharing.GroupMember;
+ import org.chromium.components.data_sharing.member_role.MemberRole;
+import org.chromium.components.embedder_support.util.UrlConstants;
+ import org.chromium.components.tab_group_sync.EitherId.EitherGroupId;
+ import org.chromium.components.tab_group_sync.LocalTabGroupId;
+ import org.chromium.components.tab_group_sync.TabGroupSyncService;
+@@ -121,6 +122,9 @@ import java.util.Objects;
 import java.util.Set;
+ import java.util.function.Supplier;
 
 +import org.chromium.chrome.browser.homepage.HomepageManager;
 +import org.chromium.url.GURL;
@@ -34,21 +42,21 @@ diff --git a/chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser
 /**
  * A mediator for the TabGridDialog component, responsible for communicating with the components'
  * coordinator as well as managing the business logic for dialog show/hide.
-@@ -1028,9 +1031,15 @@ public class TabGridDialogMediator
-                 return;
-             }
+@@ -1034,9 +1038,15 @@ public class TabGridDialogMediator
+             UrlConstantResolver urlConstantResolver =
+                     UrlConstantResolverFactory.getForProfile(profile);
 
-+            String url = UrlConstants.NTP_URL;
+            String url = urlConstantResolver.getNtpUrl();
 +            if (UrlConstants.NTP_URL.equals(url)
 +                    && HomepageManager.getInstance().getPrefNTPIsHomepageEnabled()) {
-+                GURL gurl = HomepageManager.getInstance().getHomepageGurl();
+                GURL gurl = HomepageManager.getInstance().getHomepageGurl(profile.isIncognitoBranded());
 +                url = gurl != null ? gurl.getSpec() : url;
 +            }
             TabGroupUtils.openUrlInGroup(
-                     mCurrentTabGroupModelFilterSupplier.get(),
-                    UrlConstants.NTP_URL,
+                     assumeNonNull(mCurrentTabGroupModelFilterSupplier.get()),
+-                    urlConstantResolver.getNtpUrl(),
 +                    url,
-                     currentTab.getId(),
+                     tabsInGroup.get(tabsInGroup.size() - 1).getId(),
                     TabLaunchType.FROM_TAB_GROUP_UI);
             RecordUserAction.record("MobileNewTabOpened." + mComponentName);
 diff --git a/chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser/tasks/tab_management/TabGroupUiMediator.java b/chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser/tasks/tab_management/TabGroupUiMediator.java
@@ -62,19 +70,19 @@ diff --git a/chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser
 import org.chromium.chrome.browser.layouts.LayoutStateProvider.LayoutStateObserver;
 import org.chromium.chrome.browser.layouts.LayoutType;
 import org.chromium.chrome.browser.profiles.Profile;
-@@ -415,10 +416,15 @@ public class TabGroupUiMediator implements BackPressHandler {
-                     assert relatedTabs.size() > 0;
+@@ -425,10 +426,15 @@ public class TabGroupUiMediator implements BackPressHandler {
+                             UrlConstantResolverFactory.getForProfile(currentTabProfile);
 
                     Tab parentTabToAttach = relatedTabs.get(relatedTabs.size() - 1);
-+                    String url = UrlConstants.NTP_URL;
+                    String url = urlConstantResolver.getNtpUrl();
 +                    if (HomepageManager.getInstance().getPrefNTPIsHomepageEnabled()) {
-+                        GURL gurl = HomepageManager.getInstance().getHomepageGurl();
+                        GURL gurl = HomepageManager.getInstance().getHomepageGurl(currentTab.isIncognito());
 +                        url = gurl != null ? gurl.getSpec() : url;
 +                    }
                     mTabCreatorManager
                             .getTabCreator(currentTab.isIncognito())
                             .createNewTab(
-                                    new LoadUrlParams(UrlConstants.NTP_URL),
+-                                    new LoadUrlParams(urlConstantResolver.getNtpUrl()),
 +                                    new LoadUrlParams(url),
                                     TabLaunchType.FROM_TAB_GROUP_UI,
                                     parentTabToAttach);
@@ -97,9 +105,9 @@ diff --git a/chrome/android/java/res/xml/homepage_preferences.xml b/chrome/andro
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/compositor/overlays/strip/TabGroupContextMenuCoordinator.java b/chrome/android/java/src/org/chromium/chrome/browser/compositor/overlays/strip/TabGroupContextMenuCoordinator.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/compositor/overlays/strip/TabGroupContextMenuCoordinator.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/compositor/overlays/strip/TabGroupContextMenuCoordinator.java
-@@ -71,6 +71,9 @@ import org.chromium.ui.text.EmptyTextWatcher;
- import org.chromium.ui.widget.AnchoredPopupWindow.HorizontalOrientation;
- import org.chromium.ui.widget.RectProvider;
+@@ -89,6 +89,9 @@ import java.util.List;
+ import java.util.function.BiConsumer;
+ import java.util.function.Supplier;
 
 +import org.chromium.chrome.browser.homepage.HomepageManager;
 +import org.chromium.url.GURL;
@@ -107,14 +115,14 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/compositor/over
 /**
  * A coordinator for the context menu on the tab strip by long-pressing on the group titles. It is
  * responsible for creating a list of menu items, setting up the menu and displaying the menu.
-@@ -208,9 +211,15 @@ public class TabGroupContextMenuCoordinator extends TabGroupOverflowMenuCoordina
+@@ -239,9 +242,15 @@ public class TabGroupContextMenuCoordinator extends TabStripReorderingHelper<Tok
                         /* didCloseCallback= */ null);
                 RecordUserAction.record("MobileToolbarTabGroupMenu.DeleteGroup");
-             } else if (menuId == org.chromium.chrome.R.id.open_new_tab_in_group) {
+             } else if (menuId == R.id.open_new_tab_in_group) {
 +                String url = UrlConstants.NTP_URL;
 +                if (UrlConstants.NTP_URL.equals(url)
 +                        && HomepageManager.getInstance().getPrefNTPIsHomepageEnabled()) {
-+                    GURL gurl = HomepageManager.getInstance().getHomepageGurl();
+                    GURL gurl = HomepageManager.getInstance().getHomepageGurl(tabModelSupplier.get().isIncognitoBranded());
 +                    url = gurl != null ? gurl.getSpec() : url;
 +                }
                 TabGroupUtils.openUrlInGroup(
@@ -127,7 +135,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/compositor/over
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/homepage/HomepageManager.java b/chrome/android/java/src/org/chromium/chrome/browser/homepage/HomepageManager.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/homepage/HomepageManager.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/homepage/HomepageManager.java
-@@ -231,6 +231,22 @@ public class HomepageManager
+@@ -264,6 +264,22 @@ public class HomepageManager
         notifyHomepageUpdated();
     }
 
@@ -153,15 +161,15 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/homepage/Homepa
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/homepage/settings/HomepageSettings.java b/chrome/android/java/src/org/chromium/chrome/browser/homepage/settings/HomepageSettings.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/homepage/settings/HomepageSettings.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/homepage/settings/HomepageSettings.java
-@@ -25,6 +25,7 @@ import org.chromium.components.browser_ui.settings.SettingsUtils;
+@@ -27,6 +27,7 @@ import org.chromium.components.browser_ui.settings.SettingsUtils;
 import org.chromium.components.embedder_support.util.UrlUtilities;
 import org.chromium.components.url_formatter.UrlFormatter;
 import org.chromium.url.GURL;
 +import org.chromium.components.embedder_support.util.UrlConstants;
 
 /** Fragment that allows the user to configure homepage related preferences. */
- public class HomepageSettings extends ChromeBaseSettingsFragment {
-@@ -33,6 +34,8 @@ public class HomepageSettings extends ChromeBaseSettingsFragment {
+ @NullMarked
+@@ -36,6 +37,8 @@ public class HomepageSettings extends ChromeBaseSettingsFragment {
     @VisibleForTesting
     public static final String PREF_HOMEPAGE_RADIO_GROUP = "homepage_radio_group";
 
@@ -170,8 +178,8 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/homepage/settin
     private HomepageManager mHomepageManager;
     private RadioButtonGroupHomepagePreference mRadioButtons;
     private final ObservableSupplierImpl<String> mPageTitle = new ObservableSupplierImpl<>();
-@@ -69,6 +72,15 @@ public class HomepageSettings extends ChromeBaseSettingsFragment {
-                 });
+@@ -103,6 +106,15 @@ public class HomepageSettings extends ChromeBaseSettingsFragment {
+         mRadioButtons.setOnHomepagePreferenceChangeListener(this::onRadioButtonGroupChanged);
         mRadioButtons.setupPreferenceValues(createPreferenceValuesForRadioGroup());
 
 +        ChromeSwitchPreference mNTPIsHomepageSwitch =
@@ -189,7 +197,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/homepage/settin
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/metrics/LaunchMetrics.java b/chrome/android/java/src/org/chromium/chrome/browser/metrics/LaunchMetrics.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/metrics/LaunchMetrics.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/metrics/LaunchMetrics.java
-@@ -113,7 +113,6 @@ public class LaunchMetrics {
+@@ -136,7 +136,6 @@ public class LaunchMetrics {
     public static void recordHomePageLaunchMetrics(
             boolean showHomeButton, boolean homepageIsNtp, GURL homepageGurl) {
         if (homepageGurl.isEmpty()) {
@@ -200,21 +208,21 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/metrics/LaunchM
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/ChromeTabCreator.java b/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/ChromeTabCreator.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/ChromeTabCreator.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/ChromeTabCreator.java
-@@ -23,6 +23,7 @@ import org.chromium.chrome.browser.app.tab_activity_glue.ReparentingDelegateFact
+@@ -25,6 +25,7 @@ import org.chromium.chrome.browser.app.tab_activity_glue.ReparentingDelegateFact
 import org.chromium.chrome.browser.app.tab_activity_glue.ReparentingTask;
 import org.chromium.chrome.browser.compositor.CompositorViewHolder;
 import org.chromium.chrome.browser.flags.ChromeFeatureList;
 +import org.chromium.chrome.browser.homepage.HomepageManager;
+ import org.chromium.chrome.browser.multiwindow.MultiInstanceManager;
+ import org.chromium.chrome.browser.multiwindow.MultiInstanceManager.NewWindowAppSource;
 import org.chromium.chrome.browser.prefetch.settings.PreloadPagesSettingsBridge;
- import org.chromium.chrome.browser.prefetch.settings.PreloadPagesState;
- import org.chromium.chrome.browser.profiles.Profile;
-@@ -530,6 +531,13 @@ public class ChromeTabCreator extends TabCreator
-      * @return the created tab.
+@@ -583,6 +584,13 @@ public class ChromeTabCreator implements TabCreator, NeedsTabModel, NeedsTabMode
      */
-     public Tab launchUrl(String url, @TabLaunchType int type, Intent intent, long intentTimestamp) {
+     public @Nullable Tab launchUrl(
+             String url, @TabLaunchType int type, @Nullable Intent intent, long intentTimestamp) {
 +        if (!mIncognito && url.equals(UrlConstants.NTP_URL)) {
 +            if (HomepageManager.getInstance().getPrefNTPIsHomepageEnabled()) {
-+                GURL gurl = HomepageManager.getInstance().getHomepageGurl();
+                GURL gurl = HomepageManager.getInstance().getHomepageGurl(mIncognito);
 +                url = gurl != null ? gurl.getSpec() : url;
 +            }
 +        }
@@ -225,7 +233,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/Chrome
 diff --git a/chrome/browser/preferences/android/java/src/org/chromium/chrome/browser/preferences/ChromePreferenceKeys.java b/chrome/browser/preferences/android/java/src/org/chromium/chrome/browser/preferences/ChromePreferenceKeys.java
 --- a/chrome/browser/preferences/android/java/src/org/chromium/chrome/browser/preferences/ChromePreferenceKeys.java
 +++ b/chrome/browser/preferences/android/java/src/org/chromium/chrome/browser/preferences/ChromePreferenceKeys.java
-@@ -326,6 +326,7 @@ public final class ChromePreferenceKeys {
+@@ -371,6 +371,7 @@ public final class ChromePreferenceKeys {
     public static final String HOMEPAGE_USE_CHROME_NTP = "Chrome.Homepage.UseNTP";
     public static final String HOMEPAGE_USE_DEFAULT_URI = "homepage_partner_enabled";
 
@@ -247,7 +255,7 @@ diff --git a/chrome/browser/preferences/android/java/src/org/chromium/chrome/bro
 diff --git a/chrome/browser/ui/android/strings/android_chrome_strings.grd b/chrome/browser/ui/android/strings/android_chrome_strings.grd
 --- a/chrome/browser/ui/android/strings/android_chrome_strings.grd
 +++ b/chrome/browser/ui/android/strings/android_chrome_strings.grd
-@@ -1480,6 +1480,9 @@ Your Google account may have other forms of browsing history like searches and a
+@@ -1348,6 +1348,9 @@ Your Google account may have other forms of browsing history like searches and a
       <message name="IDS_CLEAR_BROWSING_DATA_TAB_PERIOD_HOUR" desc="The option to delete browsing data from the last hour.">
         Last hour
       </message>
@@ -260,8 +268,8 @@ diff --git a/chrome/browser/ui/android/strings/android_chrome_strings.grd b/chro
 diff --git a/chrome/browser/ui/browser_ui_prefs.cc b/chrome/browser/ui/browser_ui_prefs.cc
 --- a/chrome/browser/ui/browser_ui_prefs.cc
 +++ b/chrome/browser/ui/browser_ui_prefs.cc
-@@ -107,6 +107,8 @@ void RegisterBrowserUserPrefs(user_prefs::PrefRegistrySyncable* registry) {
- 
+@@ -123,6 +123,8 @@ void RegisterBrowserUserPrefs(user_prefs::PrefRegistrySyncable* registry) {
+                                 pref_registration_flags);
   registry->RegisterBooleanPref(prefs::kPinSplitTabButton, false,
                                 pref_registration_flags);
 +  registry->RegisterBooleanPref(prefs::kNewTabPageIsHomePage, false,
@@ -272,7 +280,7 @@ diff --git a/chrome/browser/ui/browser_ui_prefs.cc b/chrome/browser/ui/browser_u
 diff --git a/chrome/common/pref_names.h b/chrome/common/pref_names.h
 --- a/chrome/common/pref_names.h
 +++ b/chrome/common/pref_names.h
-@@ -1328,6 +1328,10 @@ inline constexpr char kPinSplitTabButton[] = "browser.pin_split_tab_button";
+@@ -1347,6 +1347,10 @@ inline constexpr char kSplitViewDragAndDropNudgeUsedCount[] =
 // by enterprise policy.
 inline constexpr char kGeminiSettings[] = "browser.gemini_settings";
 
@@ -12,7 +12,7 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 components/search_engines/BUILD.gn            |   3 ++
 components/search_engines/cromite/BUILD.gn    |  12 ++++++
 .../cromite/cromite_prepopulated_engines.json |  37 ++++++++++++++++++
- .../search_engine_choice_utils.cc             |   5 +--
+ .../search_engine_choice_utils.cc             |   9 +----
 .../search_engines/search_engine_type.h       |   5 +++
 .../template_url_prepopulate_data.cc          |  21 +++++++++-
 .../template_url_prepopulate_data.h           |   9 -----
@@ -20,7 +20,7 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 tools/json_to_struct/json_to_struct.py        |  26 ++++++++----
 tools/json_to_struct/struct_generator.py      |  10 +++--
 tools/variations/fieldtrial_to_struct.py      |   4 +-
- 12 files changed, 113 insertions(+), 28 deletions(-)
+ 12 files changed, 113 insertions(+), 32 deletions(-)
 create mode 100644 components/resources/default_100_percent/search_engine_choice/default_favicon.png
 create mode 100644 components/search_engines/cromite/BUILD.gn
 create mode 100644 components/search_engines/cromite/cromite_prepopulated_engines.json
@@ -63,7 +63,7 @@ diff --git a/components/search_engines/BUILD.gn b/components/search_engines/BUIL
   ]
 
   deps = [
-@@ -163,6 +164,7 @@ source_set("search_engine_utils") {
+@@ -161,6 +162,7 @@ source_set("search_engine_utils") {
     ":search_engine_type",
     "//components/google/core/common",
     "//third_party/search_engines_data:prepopulated_engines",
@@ -71,7 +71,7 @@ diff --git a/components/search_engines/BUILD.gn b/components/search_engines/BUIL
   ]
 
   deps = [ "//url" ]
-@@ -252,6 +254,7 @@ source_set("unit_tests") {
+@@ -256,6 +258,7 @@ source_set("unit_tests") {
     "//testing/gmock",
     "//testing/gtest",
     "//third_party/search_engines_data:prepopulated_engines",
@@ -141,7 +141,7 @@ new file mode 100644
 diff --git a/components/search_engines/search_engine_choice/search_engine_choice_utils.cc b/components/search_engines/search_engine_choice/search_engine_choice_utils.cc
 --- a/components/search_engines/search_engine_choice/search_engine_choice_utils.cc
 +++ b/components/search_engines/search_engine_choice/search_engine_choice_utils.cc
-@@ -182,10 +182,7 @@ void RecordChoiceScreenDefaultSearchProviderType(
+@@ -209,14 +209,7 @@ void RecordChoiceScreenDefaultSearchProviderType(
 }
 
 void RecordChoiceScreenSelectedIndex(int selected_engine_index) {
@@ -149,6 +149,10 @@ diff --git a/components/search_engines/search_engine_choice/search_engine_choice
 -      kSearchEngineChoiceScreenSelectedEngineIndexHistogram,
 -      selected_engine_index,
 -      TemplateURLPrepopulateData::kMaxEeaPrepopulatedEngines);
+-  base::PumaHistogramExactLinear(
+-      base::PumaType::kRc, kPumaSearchChoiceScreenSelectedEngineIndexHistogram,
+-      selected_engine_index,
+-      TemplateURLPrepopulateData::kMaxEeaPrepopulatedEngines);
 +  // do nothing in Cromite
 }
 
@@ -156,12 +160,12 @@ diff --git a/components/search_engines/search_engine_choice/search_engine_choice
 diff --git a/components/search_engines/search_engine_type.h b/components/search_engines/search_engine_type.h
 --- a/components/search_engines/search_engine_type.h
 +++ b/components/search_engines/search_engine_type.h
-@@ -97,11 +97,16 @@ enum SearchEngineType {
-   SEARCH_ENGINE_MCAFEE = 77,
+@@ -98,11 +98,16 @@ enum SearchEngineType {
   SEARCH_ENGINE_FREESPOKE = 78,
   SEARCH_ENGINE_KAGI = 79,
-+  SEARCH_ENGINE_GOOGLE_EN = 80,
-+  SEARCH_ENGINE_DUCKDUCKGOLIGHT = 81,
+   SEARCH_ENGINE_STARTER_PACK_AI_MODE = 80,
+  SEARCH_ENGINE_GOOGLE_EN = 81,
+  SEARCH_ENGINE_DUCKDUCKGOLIGHT = 82,
 
   SEARCH_ENGINE_MAX  // Bounding value needed for UMA histogram macro.
 };
@@ -185,22 +189,22 @@ diff --git a/components/search_engines/template_url_prepopulate_data.cc b/compon
 namespace TemplateURLPrepopulateData {
 
 // Helpers --------------------------------------------------------------------
-@@ -123,7 +125,7 @@ int GetDataVersion(PrefService* prefs) {
+@@ -154,7 +156,7 @@ int GetDataVersion(PrefService* prefs) {
       kCurrentDataVersion;
 }
 
 -std::vector<std::unique_ptr<TemplateURLData>> GetPrepopulatedEngines(
 +std::vector<std::unique_ptr<TemplateURLData>> GetPrepopulatedEnginesChromium(
     PrefService& prefs,
-     std::vector<const TemplateURLPrepopulateData::PrepopulatedEngine*>
+     const std::vector<const PrepopulatedEngine*>&
         regional_prepopulated_engines) {
-@@ -139,6 +141,17 @@ std::vector<std::unique_ptr<TemplateURLData>> GetPrepopulatedEngines(
+@@ -170,6 +172,17 @@ std::vector<std::unique_ptr<TemplateURLData>> GetPrepopulatedEngines(
                         &PrepopulatedEngineToTemplateURLData);
 }
 
 +std::vector<std::unique_ptr<TemplateURLData>> GetPrepopulatedEngines(
 +    PrefService& prefs,
-+    std::vector<const TemplateURLPrepopulateData::PrepopulatedEngine*>
+    const std::vector<const PrepopulatedEngine*>&
 +        regional_prepopulated_engines) {
 +  std::vector<std::unique_ptr<TemplateURLData>> t_urls =
 +    GetPrepopulatedEnginesChromium(prefs, regional_prepopulated_engines);
@@ -211,16 +215,17 @@ diff --git a/components/search_engines/template_url_prepopulate_data.cc b/compon
 +
 std::unique_ptr<TemplateURLData> GetPrepopulatedEngine(
     PrefService& prefs,
-     std::vector<const TemplateURLPrepopulateData::PrepopulatedEngine*>
-@@ -160,9 +173,13 @@ std::vector<std::unique_ptr<TemplateURLData>> GetLocalPrepopulatedEngines(
+     const std::vector<const PrepopulatedEngine*>& regional_prepopulated_engines,
+@@ -190,10 +203,14 @@ std::vector<std::unique_ptr<TemplateURLData>> GetLocalPrepopulatedEngines(
     return std::vector<std::unique_ptr<TemplateURLData>>();
   }
 
-  return base::ToVector(
+-  return base::ToVector(regional_capabilities::GetPrepopulatedEngines(
 +  std::vector<std::unique_ptr<TemplateURLData>> t_urls =
-+    base::ToVector(
-       regional_capabilities::GetPrepopulatedEngines(country_id, prefs),
-       &PrepopulatedEngineToTemplateURLData);
+    base::ToVector(regional_capabilities::GetPrepopulatedEngines(
+                             country_id, prefs,
+                             regional_capabilities::SearchEngineListType::kTopN),
+                         &PrepopulatedEngineToTemplateURLData);
 +  t_urls.push_back(TemplateURLDataFromPrepopulatedEngine(googleen));
 +  t_urls.push_back(TemplateURLDataFromPrepopulatedEngine(duckduckgo_light));
 +  return t_urls;
@@ -275,7 +280,7 @@ diff --git a/tools/json_to_struct/json_to_struct.gni b/tools/json_to_struct/json
 diff --git a/tools/json_to_struct/json_to_struct.py b/tools/json_to_struct/json_to_struct.py
 --- a/tools/json_to_struct/json_to_struct.py
 +++ b/tools/json_to_struct/json_to_struct.py
-@@ -103,7 +103,7 @@ def _GenerateHeaderGuard(h_filename):
+@@ -104,7 +104,7 @@ def _GenerateHeaderGuard(h_filename):
   return re.sub(u'^_*', '', result) + u'_'  # Remove leading underscores.
 
 
@@ -284,7 +289,7 @@ diff --git a/tools/json_to_struct/json_to_struct.py b/tools/json_to_struct/json_
   """Generates the .h file containing the definition of the structure specified
   by the schema.
 
-@@ -147,11 +147,15 @@ def _GenerateH(basepath, fileroot, head, namespace, schema, description):
+@@ -148,11 +148,15 @@ def _GenerateH(basepath, fileroot, head, namespace, schema, description):
       f.write(u'#include "%s"\n' % header)
     f.write(u'\n')
 
@@ -301,7 +306,7 @@ diff --git a/tools/json_to_struct/json_to_struct.py b/tools/json_to_struct/json_
       schema['type_name'], schema['schema']))
     f.write(u'\n')
 
-@@ -176,7 +180,7 @@ def _GenerateH(basepath, fileroot, head, namespace, schema, description):
+@@ -177,7 +181,7 @@ def _GenerateH(basepath, fileroot, head, namespace, schema, description):
     f.write(u'#endif  // %s\n' % header_guard)
 
 
@@ -310,7 +315,7 @@ diff --git a/tools/json_to_struct/json_to_struct.py b/tools/json_to_struct/json_
   """Generates the .cc file containing the static initializers for the
   of the elements specified in the description.
 
-@@ -211,7 +215,7 @@ def _GenerateCC(basepath, fileroot, head, namespace, schema, description):
+@@ -212,7 +216,7 @@ def _GenerateCC(basepath, fileroot, head, namespace, schema, description):
     f.write(element_generator.GenerateElements(schema['type_name'],
         schema['schema'], description))
 
@@ -319,7 +324,7 @@ diff --git a/tools/json_to_struct/json_to_struct.py b/tools/json_to_struct/json_
       f.write('\n}  // anonymous namespace \n\n')
 
     aggregated = GenerateCCAggregation(schema['type_name'], aggregation)
-@@ -298,7 +302,7 @@ def GenerateClass(basepath,
+@@ -299,7 +303,7 @@ def GenerateClass(basepath,
 
 
 def GenerateStruct(basepath, output_root, namespace, schema, description,
@@ -328,7 +333,7 @@ diff --git a/tools/json_to_struct/json_to_struct.py b/tools/json_to_struct/json_
   """Generates a C++ struct from a JSON description.
 
   Args:
-@@ -317,8 +321,8 @@ def GenerateStruct(basepath, output_root, namespace, schema, description,
+@@ -318,8 +322,8 @@ def GenerateStruct(basepath, output_root, namespace, schema, description,
   """
   year = int(year) if year else datetime.now().year
   head = HEAD % (year, schema_filename, description_filename)
@@ -339,7 +344,7 @@ diff --git a/tools/json_to_struct/json_to_struct.py b/tools/json_to_struct/json_
 
 if __name__ == '__main__':
   parser = optparse.OptionParser(
-@@ -333,11 +337,17 @@ if __name__ == '__main__':
+@@ -334,11 +338,17 @@ if __name__ == '__main__':
   parser.add_option('-s', '--schema', help='path to the schema file, '
       'mandatory.')
   parser.add_option('-o', '--output', help='output filename, ')
@@ -357,7 +362,7 @@ diff --git a/tools/json_to_struct/json_to_struct.py b/tools/json_to_struct/json_
   description_filename = os.path.normpath(args[0])
   root, ext = os.path.splitext(description_filename)
   shortroot = opts.output if opts.output else os.path.split(root)[1]
-@@ -354,4 +364,4 @@ if __name__ == '__main__':
+@@ -355,4 +365,4 @@ if __name__ == '__main__':
   schema = _Load(opts.schema)
   description = _Load(description_filename)
   GenerateStruct(basepath, output_root, opts.namespace, schema, description,
@@ -18,7 +18,7 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 .../api/settings_private/prefs_util.cc        | 17 ++++
 .../browser/profiles/ProfileManagerUtils.java |  5 ++
 .../profiles/android/profile_manager_utils.cc |  5 ++
- chrome/browser/profiles/profile_manager.cc    | 15 +++-
+ chrome/browser/profiles/profile_manager.cc    | 17 +++-
 chrome/browser/profiles/profile_manager.h     |  2 +
 .../clear_browsing_data_dialog.html           | 44 +++++++++++
 .../clear_browsing_data_dialog.ts             |  2 +
@@ -31,16 +31,17 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 .../core/browsing_data_policies_utils.h       | 11 +++
 .../browsing_data/core/browsing_data_utils.cc | 31 ++++++++
 .../core/clear_browsing_data_tab.h            |  3 +-
+ components/browsing_data/core/features.h      |  1 +
 components/browsing_data/core/pref_names.cc   | 17 ++++
 components/browsing_data/core/pref_names.h    | 10 +++
 components/favicon/core/favicon_database.cc   |  9 +++
- components/favicon/core/favicon_database.h    |  2 +
+ components/favicon/core/favicon_database.h    |  3 +
 .../search_engines/template_url_service.cc    |  1 +
 content/browser/btm/btm_service_impl.cc       |  2 +-
- content/browser/storage_partition_impl.cc     |  1 +
+ content/browser/storage_partition_impl.cc     |  2 +
 .../public/browser/browsing_data_remover.h    |  7 +-
 .../Add-setting-to-clear-data-on-exit.inc     |  8 ++
- 36 files changed, 406 insertions(+), 33 deletions(-)
+ 37 files changed, 410 insertions(+), 34 deletions(-)
 create mode 100644 chrome/android/java/src/org/chromium/chrome/browser/browsing_data/ClearBrowsingDataFragmentAtStart.java
 create mode 100644 chrome/browser/ui/android/strings/cromite_android_chrome_strings_grd/Add-setting-to-clear-data-on-exit.grdp
 create mode 100644 cromite_flags/chrome/browser/about_flags_cc/Add-setting-to-clear-data-on-exit.inc
@@ -48,7 +49,7 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 diff --git a/chrome/android/chrome_java_sources.gni b/chrome/android/chrome_java_sources.gni
 --- a/chrome/android/chrome_java_sources.gni
 +++ b/chrome/android/chrome_java_sources.gni
-@@ -257,6 +257,7 @@ chrome_java_sources = [
+@@ -270,6 +270,7 @@ chrome_java_sources = [
   "java/src/org/chromium/chrome/browser/browsing_data/ClearBrowsingDataCheckBoxPreference.java",
   "java/src/org/chromium/chrome/browser/browsing_data/ClearBrowsingDataFetcher.java",
   "java/src/org/chromium/chrome/browser/browsing_data/ClearBrowsingDataFragment.java",
@@ -74,7 +75,7 @@ diff --git a/chrome/android/java/res/xml/privacy_preferences.xml b/chrome/androi
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java b/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java
-@@ -198,6 +198,7 @@ import org.chromium.chrome.browser.profiles.ProfileProvider;
+@@ -208,6 +208,7 @@ import org.chromium.chrome.browser.profiles.ProfileProvider;
 import org.chromium.chrome.browser.quick_delete.QuickDeleteController;
 import org.chromium.chrome.browser.quick_delete.QuickDeleteDelegateImpl;
 import org.chromium.chrome.browser.quick_delete.QuickDeleteMetricsDelegate;
@@ -82,7 +83,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedAct
 import org.chromium.chrome.browser.read_later.ReadingListBackPressHandler;
 import org.chromium.chrome.browser.recent_tabs.CrossDevicePaneFactory;
 import org.chromium.chrome.browser.reengagement.ReengagementNotificationController;
-@@ -1854,7 +1855,11 @@ public class ChromeTabbedActivity extends ChromeActivity {
+@@ -2181,7 +2182,11 @@ public class ChromeTabbedActivity extends ChromeActivity implements PreAttachInt
             Intent intent = getIntent();
 
             boolean hadCipherData =
@@ -98,7 +99,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedAct
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/browsing_data/BrowsingDataBridge.java b/chrome/android/java/src/org/chromium/chrome/browser/browsing_data/BrowsingDataBridge.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/browsing_data/BrowsingDataBridge.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/browsing_data/BrowsingDataBridge.java
-@@ -218,8 +218,8 @@ public final class BrowsingDataBridge implements Destroyable {
+@@ -205,8 +205,8 @@ public final class BrowsingDataBridge {
      *     BrowsingDataType}).
      * @return The state of the corresponding deletion preference.
      */
@@ -109,7 +110,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/browsing_data/B
     }
 
     /**
-@@ -229,8 +229,8 @@ public final class BrowsingDataBridge implements Destroyable {
+@@ -216,8 +216,8 @@ public final class BrowsingDataBridge {
      *     BrowsingDataType}).
      * @param value The state to be set.
      */
@@ -120,7 +121,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/browsing_data/B
     }
 
     /**
-@@ -338,10 +338,10 @@ public final class BrowsingDataBridge implements Destroyable {
+@@ -278,10 +278,10 @@ public final class BrowsingDataBridge {
                 @JniType("Profile*") Profile profile, @JniType("std::string") String origin);
 
         boolean getBrowsingDataDeletionPreference(
@@ -136,7 +137,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/browsing_data/B
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/browsing_data/ClearBrowsingDataFragment.java b/chrome/android/java/src/org/chromium/chrome/browser/browsing_data/ClearBrowsingDataFragment.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/browsing_data/ClearBrowsingDataFragment.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/browsing_data/ClearBrowsingDataFragment.java
-@@ -161,6 +161,12 @@ public class ClearBrowsingDataFragment extends ChromeBaseSettingsFragment
+@@ -164,6 +164,12 @@ public class ClearBrowsingDataFragment extends ChromeBaseSettingsFragment
             assert mCheckbox == preference;
 
             mParent.updateButtonState();
@@ -149,7 +150,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/browsing_data/C
             return true;
         }
 
-@@ -242,7 +248,7 @@ public class ClearBrowsingDataFragment extends ChromeBaseSettingsFragment
+@@ -245,7 +251,7 @@ public class ClearBrowsingDataFragment extends ChromeBaseSettingsFragment
     private @TimePeriod int mLastSelectedTimePeriod;
     private boolean mShouldShowPostDeleteFeedback;
 
@@ -158,16 +159,16 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/browsing_data/C
 
     /**
      * @return All available {@link DialogOption} entries.
-@@ -348,7 +354,7 @@ public class ClearBrowsingDataFragment extends ChromeBaseSettingsFragment
+@@ -351,7 +357,7 @@ public class ClearBrowsingDataFragment extends ChromeBaseSettingsFragment
     }
 
     /** Called when browsing data is about to be cleared. */
 -    private void onClearBrowsingData() {
 +    protected void onClearBrowsingData() {
         RecordUserAction.record("ClearBrowsingData_AdvancedTab");
+     }
 
-         if (ChromeFeatureList.sClearBrowsingDataAndroidSurvey.isEnabled()) {
-@@ -438,6 +444,7 @@ public class ClearBrowsingDataFragment extends ChromeBaseSettingsFragment
+@@ -437,6 +443,7 @@ public class ClearBrowsingDataFragment extends ChromeBaseSettingsFragment
             BrowsingDataBridge.getForProfile(getProfile())
                     .setBrowsingDataDeletionPreference(
                             ClearBrowsingDataFragment.getDataType(item.getOption()),
@@ -175,7 +176,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/browsing_data/C
                             item.isSelected());
         }
 
-@@ -445,8 +452,12 @@ public class ClearBrowsingDataFragment extends ChromeBaseSettingsFragment
+@@ -444,8 +451,12 @@ public class ClearBrowsingDataFragment extends ChromeBaseSettingsFragment
                 .setBrowsingDataDeletionTimePeriod(mLastSelectedTimePeriod);
     }
 
@@ -189,7 +190,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/browsing_data/C
         String referrer =
                 fragmentArgs.getString(
                         ClearBrowsingDataFragment.CLEAR_BROWSING_DATA_REFERRER, null);
-@@ -472,6 +483,10 @@ public class ClearBrowsingDataFragment extends ChromeBaseSettingsFragment
+@@ -471,6 +482,10 @@ public class ClearBrowsingDataFragment extends ChromeBaseSettingsFragment
                 DialogOption.CLEAR_SITE_SETTINGS);
     }
 
@@ -200,7 +201,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/browsing_data/C
     /**
      * Decides whether a given dialog option should be selected when the dialog is initialized.
      *
-@@ -480,7 +495,7 @@ public class ClearBrowsingDataFragment extends ChromeBaseSettingsFragment
+@@ -479,7 +494,7 @@ public class ClearBrowsingDataFragment extends ChromeBaseSettingsFragment
      */
     private boolean isOptionSelectedByDefault(@DialogOption int option) {
         return BrowsingDataBridge.getForProfile(getProfile())
@@ -209,7 +210,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/browsing_data/C
     }
 
     /**
-@@ -548,6 +563,7 @@ public class ClearBrowsingDataFragment extends ChromeBaseSettingsFragment
+@@ -547,6 +562,7 @@ public class ClearBrowsingDataFragment extends ChromeBaseSettingsFragment
      * options.
      */
     private void onClearButtonClicked() {
@@ -217,15 +218,15 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/browsing_data/C
         if (shouldShowImportantSitesDialog()) {
             showImportantDialogThenClear();
             return;
-@@ -577,6 +593,7 @@ public class ClearBrowsingDataFragment extends ChromeBaseSettingsFragment
-         Button clearButton = (Button) getView().findViewById(R.id.clear_button);
+@@ -576,6 +592,7 @@ public class ClearBrowsingDataFragment extends ChromeBaseSettingsFragment
+         Button clearButton = (Button) assumeNonNull(getView()).findViewById(R.id.clear_button);
         boolean isEnabled = !getSelectedOptions().isEmpty();
         clearButton.setEnabled(isEnabled);
 +        clearButton.setVisibility(shouldClearBrowsingData() ? View.VISIBLE : View.INVISIBLE);
     }
 
     private int getSpinnerIndex(
-@@ -652,7 +669,7 @@ public class ClearBrowsingDataFragment extends ChromeBaseSettingsFragment
+@@ -653,7 +670,7 @@ public class ClearBrowsingDataFragment extends ChromeBaseSettingsFragment
                             .getBoolean(Pref.ALLOW_DELETING_BROWSER_HISTORY)) {
                 enabled = false;
                 browsingDataBridge.setBrowsingDataDeletionPreference(
@@ -234,7 +235,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/browsing_data/C
             }
 
             // Disable tabs closure if the user is in multi-window mode.
-@@ -682,8 +699,12 @@ public class ClearBrowsingDataFragment extends ChromeBaseSettingsFragment
+@@ -683,8 +700,12 @@ public class ClearBrowsingDataFragment extends ChromeBaseSettingsFragment
         mSigninManager.addSignInStateObserver(this);
 
         setHasOptionsMenu(true);
@@ -334,7 +335,7 @@ new file mode 100644
 diff --git a/chrome/app/settings_strings.grdp b/chrome/app/settings_strings.grdp
 --- a/chrome/app/settings_strings.grdp
 +++ b/chrome/app/settings_strings.grdp
-@@ -1973,6 +1973,16 @@
+@@ -2148,6 +2148,16 @@
   <message name="IDS_SETTINGS_CLEAR_BROWSING_DATA" desc="Text for delete browsing data button in Privacy options">
     Delete browsing data
   </message>
@@ -354,9 +355,9 @@ diff --git a/chrome/app/settings_strings.grdp b/chrome/app/settings_strings.grdp
 diff --git a/chrome/browser/about_flags.cc b/chrome/browser/about_flags.cc
 --- a/chrome/browser/about_flags.cc
 +++ b/chrome/browser/about_flags.cc
-@@ -105,6 +105,7 @@
+@@ -109,6 +109,7 @@
+ #include "components/enterprise/client_certificates/core/features.h"
 #include "components/enterprise/data_controls/core/browser/features.h"
- #include "components/enterprise/obfuscation/core/utils.h"
 #include "components/error_page/common/error_page_switches.h"
 +#include "components/favicon/core/favicon_database.h"
 #include "components/feature_engagement/public/feature_constants.h"
@@ -365,7 +366,7 @@ diff --git a/chrome/browser/about_flags.cc b/chrome/browser/about_flags.cc
 diff --git a/chrome/browser/android/browsing_data/browsing_data_bridge.cc b/chrome/browser/android/browsing_data/browsing_data_bridge.cc
 --- a/chrome/browser/android/browsing_data/browsing_data_bridge.cc
 +++ b/chrome/browser/android/browsing_data/browsing_data_bridge.cc
-@@ -70,6 +70,15 @@ PrefService* GetPrefService(Profile* profile) {
+@@ -67,6 +67,15 @@ PrefService* GetPrefService(Profile* profile) {
   return profile->GetOriginalProfile()->GetPrefs();
 }
 
@@ -381,7 +382,7 @@ diff --git a/chrome/browser/android/browsing_data/browsing_data_bridge.cc b/chro
 void OnBrowsingDataModelBuilt(JNIEnv* env,
                               const ScopedJavaGlobalRef<jobject>& java_callback,
                               std::unique_ptr<BrowsingDataModel> model) {
-@@ -222,7 +231,8 @@ static void JNI_BrowsingDataBridge_MarkOriginAsImportantForTesting(
+@@ -219,7 +228,8 @@ static void JNI_BrowsingDataBridge_MarkOriginAsImportantForTesting(
 static jboolean JNI_BrowsingDataBridge_GetBrowsingDataDeletionPreference(
     JNIEnv* env,
     Profile* profile,
@@ -391,7 +392,7 @@ diff --git a/chrome/browser/android/browsing_data/browsing_data_bridge.cc b/chro
   DCHECK_GE(data_type, 0);
   DCHECK_LE(data_type,
             static_cast<int>(browsing_data::BrowsingDataType::MAX_VALUE));
-@@ -234,7 +244,7 @@ static jboolean JNI_BrowsingDataBridge_GetBrowsingDataDeletionPreference(
+@@ -231,7 +241,7 @@ static jboolean JNI_BrowsingDataBridge_GetBrowsingDataDeletionPreference(
   std::string pref;
   if (!browsing_data::GetDeletionPreferenceFromDataType(
           static_cast<browsing_data::BrowsingDataType>(data_type),
@@ -400,7 +401,7 @@ diff --git a/chrome/browser/android/browsing_data/browsing_data_bridge.cc b/chro
     return false;
   }
 
-@@ -245,6 +255,7 @@ static void JNI_BrowsingDataBridge_SetBrowsingDataDeletionPreference(
+@@ -242,6 +252,7 @@ static void JNI_BrowsingDataBridge_SetBrowsingDataDeletionPreference(
     JNIEnv* env,
     Profile* profile,
     jint data_type,
@@ -408,7 +409,7 @@ diff --git a/chrome/browser/android/browsing_data/browsing_data_bridge.cc b/chro
     jboolean value) {
   DCHECK_GE(data_type, 0);
   DCHECK_LE(data_type,
-@@ -253,7 +264,7 @@ static void JNI_BrowsingDataBridge_SetBrowsingDataDeletionPreference(
+@@ -250,7 +261,7 @@ static void JNI_BrowsingDataBridge_SetBrowsingDataDeletionPreference(
   std::string pref;
   if (!browsing_data::GetDeletionPreferenceFromDataType(
           static_cast<browsing_data::BrowsingDataType>(data_type),
@@ -420,7 +421,7 @@ diff --git a/chrome/browser/android/browsing_data/browsing_data_bridge.cc b/chro
 diff --git a/chrome/browser/browsing_data/chrome_browsing_data_lifetime_manager.cc b/chrome/browser/browsing_data/chrome_browsing_data_lifetime_manager.cc
 --- a/chrome/browser/browsing_data/chrome_browsing_data_lifetime_manager.cc
 +++ b/chrome/browser/browsing_data/chrome_browsing_data_lifetime_manager.cc
-@@ -324,8 +324,25 @@ void ChromeBrowsingDataLifetimeManager::Shutdown() {
+@@ -327,8 +327,25 @@ void ChromeBrowsingDataLifetimeManager::Shutdown() {
 
 void ChromeBrowsingDataLifetimeManager::ClearBrowsingDataForOnExitPolicy(
     bool keep_browser_alive) {
@@ -448,7 +449,7 @@ diff --git a/chrome/browser/browsing_data/chrome_browsing_data_lifetime_manager.
 
   if (!data_types.empty() &&
       IsConditionSatisfiedForBrowsingDataRemoval(GetSyncTypesForPolicyPref(
-@@ -434,6 +451,7 @@ void ChromeBrowsingDataLifetimeManager::StartScheduledBrowsingDataRemoval() {
+@@ -437,6 +454,7 @@ void ChromeBrowsingDataLifetimeManager::StartScheduledBrowsingDataRemoval() {
 bool ChromeBrowsingDataLifetimeManager::
     IsConditionSatisfiedForBrowsingDataRemoval(
         const syncer::UserSelectableTypeSet sync_types) {
@@ -459,7 +460,7 @@ diff --git a/chrome/browser/browsing_data/chrome_browsing_data_lifetime_manager.
 diff --git a/chrome/browser/browsing_data/chrome_browsing_data_remover_delegate.cc b/chrome/browser/browsing_data/chrome_browsing_data_remover_delegate.cc
 --- a/chrome/browser/browsing_data/chrome_browsing_data_remover_delegate.cc
 +++ b/chrome/browser/browsing_data/chrome_browsing_data_remover_delegate.cc
-@@ -359,6 +359,7 @@ void ChromeBrowsingDataRemoverDelegate::RemoveEmbedderData(
+@@ -352,6 +352,7 @@ void ChromeBrowsingDataRemoverDelegate::RemoveEmbedderData(
     uint64_t origin_type_mask,
     base::OnceCallback<void(uint64_t)> callback) {
   CHECK(((remove_mask &
@@ -467,7 +468,7 @@ diff --git a/chrome/browser/browsing_data/chrome_browsing_data_remover_delegate.
           ~content::BrowsingDataRemover::DATA_TYPE_AVOID_CLOSING_CONNECTIONS &
           ~constants::FILTERABLE_DATA_TYPES) == 0) ||
         filter_builder->MatchesAllOriginsAndDomains());
-@@ -466,6 +467,9 @@ void ChromeBrowsingDataRemoverDelegate::RemoveEmbedderData(
+@@ -455,6 +456,9 @@ void ChromeBrowsingDataRemoverDelegate::RemoveEmbedderData(
           CreateTaskCompletionClosure(TracingDataType::kHistory),
           &history_task_tracker_);
     }
@@ -477,7 +478,7 @@ diff --git a/chrome/browser/browsing_data/chrome_browsing_data_remover_delegate.
     if (ClipboardRecentContent::GetInstance())
       ClipboardRecentContent::GetInstance()->SuppressClipboardContent();
 
-@@ -574,6 +578,11 @@ void ChromeBrowsingDataRemoverDelegate::RemoveEmbedderData(
+@@ -563,6 +567,11 @@ void ChromeBrowsingDataRemoverDelegate::RemoveEmbedderData(
     // and SSL host state are scoped to hosts and represent them as std::string.
     // Rename the method to indicate its more general usage.
     if (profile_->GetSSLHostStateDelegate()) {
@@ -489,7 +490,7 @@ diff --git a/chrome/browser/browsing_data/chrome_browsing_data_remover_delegate.
       profile_->GetSSLHostStateDelegate()->Clear(
           filter_builder->MatchesAllOriginsAndDomains()
               ? base::RepeatingCallback<bool(const std::string&)>()
-@@ -602,9 +611,13 @@ void ChromeBrowsingDataRemoverDelegate::RemoveEmbedderData(
+@@ -591,9 +600,13 @@ void ChromeBrowsingDataRemoverDelegate::RemoveEmbedderData(
     }
 
     device_event_log::Clear(delete_begin_, delete_end_);
@@ -503,7 +504,7 @@ diff --git a/chrome/browser/browsing_data/chrome_browsing_data_remover_delegate.
     content::BackgroundTracingManager::GetInstance().DeleteTracesInDateRange(
         delete_begin_, delete_end_);
 
-@@ -1324,6 +1337,8 @@ void ChromeBrowsingDataRemoverDelegate::RemoveEmbedderData(
+@@ -1320,6 +1333,8 @@ void ChromeBrowsingDataRemoverDelegate::RemoveEmbedderData(
 
     if (should_clear_zero_suggest_and_session_token && template_url_service)
       template_url_service->ClearSessionToken();
@@ -515,7 +516,7 @@ diff --git a/chrome/browser/browsing_data/chrome_browsing_data_remover_delegate.
 diff --git a/chrome/browser/extensions/api/settings_private/prefs_util.cc b/chrome/browser/extensions/api/settings_private/prefs_util.cc
 --- a/chrome/browser/extensions/api/settings_private/prefs_util.cc
 +++ b/chrome/browser/extensions/api/settings_private/prefs_util.cc
-@@ -543,6 +543,23 @@ const PrefsUtil::TypedPrefMap& PrefsUtil::GetAllowlistedKeys() {
+@@ -564,6 +564,23 @@ const PrefsUtil::TypedPrefMap& PrefsUtil::GetAllowlistedKeys() {
   (*s_allowlist)[browsing_data::prefs::kLastClearBrowsingDataTab] =
       settings_api::PrefType::kNumber;
 
@@ -562,19 +563,20 @@ diff --git a/chrome/browser/profiles/android/java/src/org/chromium/chrome/browse
 diff --git a/chrome/browser/profiles/android/profile_manager_utils.cc b/chrome/browser/profiles/android/profile_manager_utils.cc
 --- a/chrome/browser/profiles/android/profile_manager_utils.cc
 +++ b/chrome/browser/profiles/android/profile_manager_utils.cc
-@@ -64,3 +64,8 @@ static void JNI_ProfileManagerUtils_RemoveSessionCookiesForAllProfiles(
-       g_browser_process->profile_manager()->GetLoadedProfiles(),
+@@ -65,4 +65,9 @@ static void JNI_ProfileManagerUtils_RemoveSessionCookiesForAllProfiles(
       RemoveSessionCookiesForProfile);
 }
-+
+ 
 +static void JNI_ProfileManagerUtils_RemoveBrowsingDataAtStart(
 +    JNIEnv* env) {
 +  g_browser_process->profile_manager()->RemoveBrowsingDataAtStart();
 +}
+
+ DEFINE_JNI(ProfileManagerUtils)
 diff --git a/chrome/browser/profiles/profile_manager.cc b/chrome/browser/profiles/profile_manager.cc
 --- a/chrome/browser/profiles/profile_manager.cc
 +++ b/chrome/browser/profiles/profile_manager.cc
-@@ -1446,6 +1446,19 @@ void ProfileManager::DoFinalInit(ProfileInfo* profile_info,
+@@ -1516,6 +1516,19 @@ void ProfileManager::DoFinalInit(ProfileInfo* profile_info,
   }
 }
 
@@ -594,19 +596,22 @@ diff --git a/chrome/browser/profiles/profile_manager.cc b/chrome/browser/profile
 void ProfileManager::DoFinalInitForServices(Profile* profile,
                                             bool go_off_the_record) {
   if (!do_final_services_init_ ||
-@@ -2122,7 +2135,7 @@ void ProfileManager::OnBrowserClosed(Browser* browser) {
-   Profile* original_profile = profile->GetOriginalProfile();
+@@ -2185,9 +2198,9 @@ void ProfileManager::OnBrowserClosed(Browser* browser) {
   // Do nothing if the closed window is not the last window of the same profile.
-   for (Browser* browser_iter : *BrowserList::GetInstance()) {
-    if (browser_iter->profile()->GetOriginalProfile() == original_profile)
-+    if (browser_iter->profile() == profile)
-       return;
-   }
- 
+   bool has_other_window = false;
+   ForEachCurrentBrowserWindowInterfaceOrderedByActivation(
+-      [original_profile, &has_other_window](BrowserWindowInterface* browser) {
+      [profile, &has_other_window](BrowserWindowInterface* browser) {
+         const Profile* const iter_profile = browser->GetProfile();
+-        if (iter_profile->GetOriginalProfile() == original_profile) {
+        if (iter_profile == profile) {
+           has_other_window = true;
+         }
+         return !has_other_window;
 diff --git a/chrome/browser/profiles/profile_manager.h b/chrome/browser/profiles/profile_manager.h
 --- a/chrome/browser/profiles/profile_manager.h
 +++ b/chrome/browser/profiles/profile_manager.h
-@@ -215,6 +215,8 @@ class ProfileManager : public Profile::Delegate {
+@@ -231,6 +231,8 @@ class ProfileManager : public Profile::Delegate {
   //   profiles.
   std::vector<Profile*> GetLoadedProfiles() const;
 
@@ -672,7 +677,7 @@ diff --git a/chrome/browser/resources/settings/clear_browsing_data_dialog/clear_
 diff --git a/chrome/browser/resources/settings/clear_browsing_data_dialog/clear_browsing_data_dialog.ts b/chrome/browser/resources/settings/clear_browsing_data_dialog/clear_browsing_data_dialog.ts
 --- a/chrome/browser/resources/settings/clear_browsing_data_dialog/clear_browsing_data_dialog.ts
 +++ b/chrome/browser/resources/settings/clear_browsing_data_dialog/clear_browsing_data_dialog.ts
-@@ -214,6 +214,7 @@ export class SettingsClearBrowsingDataDialogElement extends
+@@ -216,6 +216,7 @@ export class SettingsClearBrowsingDataDialogElement extends
         value: () =>
             [loadTimeData.getString('basicPageTitle'),
              loadTimeData.getString('advancedPageTitle'),
@@ -680,7 +685,7 @@ diff --git a/chrome/browser/resources/settings/clear_browsing_data_dialog/clear_
     ],
       },
 
-@@ -336,6 +337,7 @@ export class SettingsClearBrowsingDataDialogElement extends
+@@ -344,6 +345,7 @@ export class SettingsClearBrowsingDataDialogElement extends
     }
     this.clearButtonDisabled_ =
         this.getSelectedDataTypes_(page as HTMLElement).length === 0;
@@ -691,7 +696,7 @@ diff --git a/chrome/browser/resources/settings/clear_browsing_data_dialog/clear_
 diff --git a/chrome/browser/ui/android/strings/android_chrome_strings.grd b/chrome/browser/ui/android/strings/android_chrome_strings.grd
 --- a/chrome/browser/ui/android/strings/android_chrome_strings.grd
 +++ b/chrome/browser/ui/android/strings/android_chrome_strings.grd
-@@ -1575,6 +1575,9 @@ Your Google account may have other forms of browsing history like searches and a
+@@ -1443,6 +1443,9 @@ Your Google account may have other forms of browsing history like searches and a
       <message name="IDS_ANDROID_APP_HISTORY_OPEN_FULL_OTHER_FORMS" desc="The informational message at the top of the history page letting users know that app-specific history may be missing some entries, followed by the info on the other forms of browing history.">
         Some of your history might not show up here. To see all your Chrome history, open full Chrome history. Also, your Google Account may have other forms of browsing history at <ph name="BEGIN_LINK">&lt;link&gt;</ph>myactivity.google.com<ph name="END_LINK">&lt;/link&gt;</ph>.
       </message>
@@ -718,7 +723,7 @@ new file mode 100644
 diff --git a/chrome/browser/ui/webui/settings/settings_localized_strings_provider.cc b/chrome/browser/ui/webui/settings/settings_localized_strings_provider.cc
 --- a/chrome/browser/ui/webui/settings/settings_localized_strings_provider.cc
 +++ b/chrome/browser/ui/webui/settings/settings_localized_strings_provider.cc
-@@ -1925,6 +1925,7 @@ void AddPrivacyStrings(content::WebUIDataSource* html_source,
+@@ -2218,6 +2218,7 @@ void AddPrivacyStrings(content::WebUIDataSource* html_source,
       {"clearedData", IDS_SETTINGS_CLEARED_DATA},
       {"clearBrowsingData", IDS_SETTINGS_CLEAR_BROWSING_DATA},
       {"clearBrowsingDataDescription", IDS_SETTINGS_CLEAR_DATA_DESCRIPTION},
@@ -729,10 +734,10 @@ diff --git a/chrome/browser/ui/webui/settings/settings_localized_strings_provide
 diff --git a/components/browsing_data/content/browsing_data_helper.cc b/components/browsing_data/content/browsing_data_helper.cc
 --- a/components/browsing_data/content/browsing_data_helper.cc
 +++ b/components/browsing_data/content/browsing_data_helper.cc
-@@ -39,8 +39,13 @@ bool WebsiteSettingsFilterAdapter(
-   // this filter is used for is DURABLE_STORAGE, which also only uses
-   // origin-scoped patterns. Such patterns can be directly translated to a GURL.
-   GURL url(primary_pattern.ToString());
+@@ -44,8 +44,13 @@ bool WebsiteSettingsFilterAdapter(
+   // `example.com`).
+   GURL url = primary_pattern.ToRepresentativeUrl();
+ 
 -  DCHECK(url.is_valid()) << "url: '" << url.possibly_invalid_spec() << "' "
 -                         << "pattern: '" << primary_pattern.ToString() << "'";
 +  if (!url.is_valid()) {
@@ -770,7 +775,7 @@ diff --git a/components/browsing_data/core/BUILD.gn b/components/browsing_data/c
 diff --git a/components/browsing_data/core/browsing_data_policies_utils.cc b/components/browsing_data/core/browsing_data_policies_utils.cc
 --- a/components/browsing_data/core/browsing_data_policies_utils.cc
 +++ b/components/browsing_data/core/browsing_data_policies_utils.cc
-@@ -17,21 +17,21 @@
+@@ -18,21 +18,21 @@
 
 namespace browsing_data {
 
@@ -826,7 +831,7 @@ diff --git a/components/browsing_data/core/browsing_data_policies_utils.h b/comp
 diff --git a/components/browsing_data/core/browsing_data_utils.cc b/components/browsing_data/core/browsing_data_utils.cc
 --- a/components/browsing_data/core/browsing_data_utils.cc
 +++ b/components/browsing_data/core/browsing_data_utils.cc
-@@ -407,6 +407,37 @@ bool GetDeletionPreferenceFromDataType(
+@@ -418,6 +418,37 @@ bool GetDeletionPreferenceFromDataType(
     BrowsingDataType data_type,
     ClearBrowsingDataTab clear_browsing_data_tab,
     std::string* out_pref) {
@@ -877,6 +882,17 @@ diff --git a/components/browsing_data/core/clear_browsing_data_tab.h b/component
 
 }  // namespace browsing_data
 
+diff --git a/components/browsing_data/core/features.h b/components/browsing_data/core/features.h
+--- a/components/browsing_data/core/features.h
+++ b/components/browsing_data/core/features.h
+@@ -19,6 +19,7 @@ BASE_DECLARE_FEATURE(kBrowsingDataModel);
+ // updates to history counter logic and removal of the bulk password deletion
+ // option from the dialog.
+ BASE_DECLARE_FEATURE(kDbdRevampDesktop);
+SET_CROMITE_FEATURE_DISABLED(kDbdRevampDesktop);
+ 
+ // When enabled, calls to browsingData.removePasswords extension API would
+ // result in an error response instead of a console warning.
 diff --git a/components/browsing_data/core/pref_names.cc b/components/browsing_data/core/pref_names.cc
 --- a/components/browsing_data/core/pref_names.cc
 +++ b/components/browsing_data/core/pref_names.cc
@@ -938,7 +954,7 @@ diff --git a/components/favicon/core/favicon_database.cc b/components/favicon/co
 // Description of database tables:
 //
 // icon_mapping
-@@ -507,6 +511,11 @@ bool FaviconDatabase::SetFaviconBitmapLastUpdateTime(FaviconBitmapID bitmap_id,
+@@ -505,6 +509,11 @@ bool FaviconDatabase::SetFaviconBitmapLastUpdateTime(FaviconBitmapID bitmap_id,
 
 bool FaviconDatabase::SetFaviconsOutOfDateBetween(base::Time begin,
                                                   base::Time end) {
@@ -953,7 +969,15 @@ diff --git a/components/favicon/core/favicon_database.cc b/components/favicon/co
 diff --git a/components/favicon/core/favicon_database.h b/components/favicon/core/favicon_database.h
 --- a/components/favicon/core/favicon_database.h
 +++ b/components/favicon/core/favicon_database.h
-@@ -33,6 +33,8 @@ namespace favicon {
+@@ -9,6 +9,7 @@
+ #include <optional>
+ #include <vector>
+ 
+#include "base/feature_list.h"
+ #include "base/gtest_prod_util.h"
+ #include "base/memory/ref_counted.h"
+ #include "components/favicon/core/favicon_types.h"
+@@ -33,6 +34,8 @@ namespace favicon {
 // All earlier updates are ignored.
 static const int kFaviconUpdateLastRequestedAfterDays = 10;
 
@@ -965,7 +989,7 @@ diff --git a/components/favicon/core/favicon_database.h b/components/favicon/cor
 diff --git a/components/search_engines/template_url_service.cc b/components/search_engines/template_url_service.cc
 --- a/components/search_engines/template_url_service.cc
 +++ b/components/search_engines/template_url_service.cc
-@@ -885,6 +885,7 @@ void TemplateURLService::RemoveAutoGeneratedForUrlsBetween(
+@@ -924,6 +924,7 @@ void TemplateURLService::RemoveAutoGeneratedForUrlsBetween(
     if (turl->date_created() >= created_after &&
         (created_before.is_null() || turl->date_created() < created_before) &&
         turl->safe_for_autoreplace() && turl->prepopulate_id() == 0 &&
@@ -976,7 +1000,7 @@ diff --git a/components/search_engines/template_url_service.cc b/components/sear
 diff --git a/content/browser/btm/btm_service_impl.cc b/content/browser/btm/btm_service_impl.cc
 --- a/content/browser/btm/btm_service_impl.cc
 +++ b/content/browser/btm/btm_service_impl.cc
-@@ -210,7 +210,7 @@ class StateClearer : public BrowsingDataRemover::Observer {
+@@ -261,7 +261,7 @@ class StateClearer : public BrowsingDataRemover::Observer {
     remove_mask &= ~BrowsingDataRemover::DATA_TYPE_PRIVACY_SANDBOX;
     remover->RemoveWithFilterAndReply(
         base::Time::Min(), base::Time::Max(),
@@ -988,7 +1012,15 @@ diff --git a/content/browser/btm/btm_service_impl.cc b/content/browser/btm/btm_s
 diff --git a/content/browser/storage_partition_impl.cc b/content/browser/storage_partition_impl.cc
 --- a/content/browser/storage_partition_impl.cc
 +++ b/content/browser/storage_partition_impl.cc
-@@ -1514,6 +1514,7 @@ void StoragePartitionImpl::Initialize(
+@@ -19,6 +19,7 @@
+ #include "base/containers/contains.h"
+ #include "base/dcheck_is_on.h"
+ #include "base/feature_list.h"
+#include "base/files/file_util.h"
+ #include "base/functional/bind.h"
+ #include "base/functional/callback_helpers.h"
+ #include "base/functional/concurrent_closures.h"
+@@ -1557,6 +1558,7 @@ void StoragePartitionImpl::Initialize(
                             .AppendASCII("Code Cache");
     }
     DCHECK_GE(settings.size_in_bytes(), 0);
@@ -999,17 +1031,17 @@ diff --git a/content/browser/storage_partition_impl.cc b/content/browser/storage
 diff --git a/content/public/browser/browsing_data_remover.h b/content/public/browser/browsing_data_remover.h
 --- a/content/public/browser/browsing_data_remover.h
 +++ b/content/public/browser/browsing_data_remover.h
-@@ -162,11 +162,16 @@ class BrowsingDataRemover {
+@@ -157,11 +157,16 @@ class BrowsingDataRemover {
 
   // Clear-Site-Data Interaction with Prefetch and Prerender.
-   static constexpr DataType DATA_TYPE_PREFETCH_CACHE = 1 << 27;
-  static constexpr DataType DATA_TYPE_PRERENDER_CACHE = 1 << 28;
-+  static constexpr DataType DATA_TYPE_PRERENDER_CACHE = 1 << 29;
+   static constexpr DataType DATA_TYPE_PREFETCH_CACHE = 1 << 24;
+-  static constexpr DataType DATA_TYPE_PRERENDER_CACHE = 1 << 25;
+  static constexpr DataType DATA_TYPE_PRERENDER_CACHE = 1 << 26;
 
   // Embedders can add more datatypes beyond this point.
   static constexpr DataType DATA_TYPE_CONTENT_END = DATA_TYPE_PRERENDER_CACHE;
 
-+  static constexpr DataType DATA_TYPE_SKIP_SSL_HOST_STATE = 1 << 28;
+  static constexpr DataType DATA_TYPE_SKIP_SSL_HOST_STATE = 1 << 25;
 +
 +  static_assert(DATA_TYPE_CONTENT_END == DATA_TYPE_PRERENDER_CACHE,
 +              "Please check.");
@@ -0,0 +1,356 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Thu, 9 Oct 2025 09:11:01 +0000
+Subject: Add setting to enable Credman for passkeys
+
+Enables Credential Manager for passkey management on A14+ devices via a switch
+in the settings. By default, the feature is disabled.
+In other versions of Android, webauthn appears to be enabled on websites but
+always returns a timeout error as per specifications.
+Conditional immediate support is disabled.
+
+License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
+---
+ .../settings/PasswordSettings.java            | 27 +++++++++++++++++
+ .../touch_to_fill_controller.cc               |  2 ++
+ ...etting-to-enable-Credman-for-passkeys.grdp | 12 ++++++++
+ .../webauthn/AuthenticatorImpl.java           | 29 +++++++------------
+ .../components/webauthn/WebauthnFeatures.java |  2 ++
+ .../cred_man/CredManSupportProvider.java      | 25 ++++------------
+ .../webauthn/android/webauthn_feature_map.cc  |  1 +
+ components/webauthn/features.cc               |  4 +++
+ components/webauthn/features.h                |  3 ++
+ device/fido/features.cc                       |  2 ++
+ .../authentication_credentials_container.cc   |  5 ++++
+ 11 files changed, 75 insertions(+), 37 deletions(-)
+ create mode 100644 chrome/browser/ui/android/strings/cromite_android_chrome_strings_grd/Add-setting-to-enable-Credman-for-passkeys.grdp
+
+diff --git a/chrome/android/java/src/org/chromium/chrome/browser/password_manager/settings/PasswordSettings.java b/chrome/android/java/src/org/chromium/chrome/browser/password_manager/settings/PasswordSettings.java
+--- a/chrome/android/java/src/org/chromium/chrome/browser/password_manager/settings/PasswordSettings.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/password_manager/settings/PasswordSettings.java
+@@ -10,6 +10,7 @@ import android.app.Activity;
+ import android.content.Context;
+ import android.content.Intent;
+ import android.net.Uri;
+import android.os.Build;
+ import android.os.Bundle;
+ import android.text.SpannableString;
+ import android.text.style.ForegroundColorSpan;
+@@ -64,6 +65,10 @@ import org.chromium.chrome.browser.ui.messages.snackbar.INeedSnackbarManager;
+ import org.chromium.chrome.browser.ui.messages.snackbar.Snackbar;
+ import org.chromium.chrome.browser.lifetime.ApplicationLifetime;
+ 
+import org.chromium.chrome.browser.flags.CromiteNativeUtils;
+import org.chromium.components.webauthn.WebauthnFeatureMap;
+import org.chromium.components.webauthn.WebauthnFeatures;
+
+ /**
+  * The "Passwords" screen in Settings, which allows the user to enable or disable password saving,
+  * to view saved passwords (just the username and URL), and to delete saved passwords.
+@@ -322,6 +327,7 @@ public class PasswordSettings extends ChromeBaseSettingsFragment
+         createSavePasswordsSwitch();
+         createAutoSignInCheckbox();
+         createEnableAndroidAutofillSwitch();
+        createCredManSwitch();
+ 
+         PasswordManagerHandlerProvider.getForProfile(getProfile())
+                 .getPasswordManagerHandler()
+@@ -673,6 +679,27 @@ public class PasswordSettings extends ChromeBaseSettingsFragment
+                 getPrefService().getBoolean(Pref.CREDENTIALS_ENABLE_AUTOSIGNIN));
+     }
+ 
+    private void createCredManSwitch() {
+        ChromeSwitchPreference credManSwitch =
+                new ChromeSwitchPreference(getStyledContext(), null);
+        credManSwitch.setTitle(R.string.enable_android_credman_title);
+        credManSwitch.setOrder(0);
+        credManSwitch.setSummary(R.string.enable_android_credman_summary);
+        credManSwitch.setChecked(
+                WebauthnFeatureMap.getInstance().isEnabled(WebauthnFeatures.WEBAUTHN_ANDROID_PASSKEY));
+        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.UPSIDE_DOWN_CAKE) {
+            credManSwitch.setSummary(R.string.enable_android_credman_disabled_summary);
+            credManSwitch.setEnabled(false);
+        }
+        credManSwitch.setOnPreferenceChangeListener((preference, newValue) -> {
+            CromiteNativeUtils.setFlagEnabled("WebAuthenticationAndroidPasskey", (boolean)newValue);
+            if (!mSnackbarManagerSupplier.get().isShowing())
+                mSnackbarManagerSupplier.get().showSnackbar(mSnackbar);
+            return true;
+        });
+        getPreferenceScreen().addPreference(credManSwitch);
+    }
+
+     private void displayManageAccountLink() {
+         SyncService syncService = SyncServiceFactory.getForProfile(getProfile());
+         if (syncService == null || !syncService.isEngineInitialized()) {
+diff --git a/chrome/browser/touch_to_fill/password_manager/touch_to_fill_controller.cc b/chrome/browser/touch_to_fill/password_manager/touch_to_fill_controller.cc
+--- a/chrome/browser/touch_to_fill/password_manager/touch_to_fill_controller.cc
+++ b/chrome/browser/touch_to_fill/password_manager/touch_to_fill_controller.cc
+@@ -312,6 +312,7 @@ void TouchToFillController::Reset() {
+   }
+   visibility_controller_->Reset();
+   credentials_.clear();
+  cred_man_delegate_ = nullptr;
+ }
+ 
+ void TouchToFillController::ActionCompleted() {
+@@ -319,6 +320,7 @@ void TouchToFillController::ActionCompleted() {
+     visibility_controller_->SetShown();
+   }
+   ttf_delegate_.reset();
+  cred_man_delegate_ = nullptr;
+ }
+ 
+ DisplayTarget TouchToFillController::GetResponsibleDisplayTarget(
+diff --git a/chrome/browser/ui/android/strings/cromite_android_chrome_strings_grd/Add-setting-to-enable-Credman-for-passkeys.grdp b/chrome/browser/ui/android/strings/cromite_android_chrome_strings_grd/Add-setting-to-enable-Credman-for-passkeys.grdp
+new file mode 100644
+--- /dev/null
+++ b/chrome/browser/ui/android/strings/cromite_android_chrome_strings_grd/Add-setting-to-enable-Credman-for-passkeys.grdp
+@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="utf-8"?>
+<grit-part>
+    <message name="IDS_ENABLE_ANDROID_CREDMAN_TITLE" desc="" formatter_data="android_java">
+        Enable Android Credential Manager
+    </message>
+    <message name="IDS_ENABLE_ANDROID_CREDMAN_SUMMARY" desc="" formatter_data="android_java">
+        Enable support for Android Credential Manager
+    </message>
+    <message name="IDS_ENABLE_ANDROID_CREDMAN_DISABLED_SUMMARY" desc="" formatter_data="android_java">
+        Not supported on your device (require A14+)
+    </message>
+</grit-part>
+diff --git a/components/webauthn/android/java/src/org/chromium/components/webauthn/AuthenticatorImpl.java b/components/webauthn/android/java/src/org/chromium/components/webauthn/AuthenticatorImpl.java
+--- a/components/webauthn/android/java/src/org/chromium/components/webauthn/AuthenticatorImpl.java
+++ b/components/webauthn/android/java/src/org/chromium/components/webauthn/AuthenticatorImpl.java
+@@ -34,6 +34,8 @@ import org.chromium.blink.mojom.PublicKeyCredentialReportOptions;
+ import org.chromium.blink.mojom.WebAuthnClientCapability;
+ import org.chromium.build.annotations.NullMarked;
+ import org.chromium.build.annotations.Nullable;
+import org.chromium.components.webauthn.CredManSupport;
+import org.chromium.components.webauthn.cred_man.CredManSupportProvider;
+ import org.chromium.components.ukm.UkmRecorder;
+ import org.chromium.content_public.browser.RenderFrameHost;
+ import org.chromium.content_public.browser.WebContents;
+@@ -170,8 +172,7 @@ public final class AuthenticatorImpl implements Authenticator, AuthenticationCon
+         mIsPaymentRequest = options.isPaymentCredentialCreation;
+         mMakeCredentialCallback = callback;
+         mIsOperationPending = true;
+-        if (!GmsCoreUtils.isWebauthnSupported()
+-                || (!isChrome(mWebContents) && !GmsCoreUtils.isResultReceiverSupported())) {
+        if (CredManSupportProvider.getCredManSupport() == CredManSupport.DISABLED) {
+             recordOutcomeEvent(MakeCredentialOutcome.OTHER_FAILURE);
+             onError(AuthenticatorStatus.NOT_IMPLEMENTED);
+             return;
+@@ -235,8 +236,7 @@ public final class AuthenticatorImpl implements Authenticator, AuthenticationCon
+         mIsConditionalRequest = options.mediation == Mediation.CONDITIONAL;
+         mIsImmediateRequest = options.mediation == Mediation.IMMEDIATE;
+ 
+-        if (!GmsCoreUtils.isWebauthnSupported()
+-                || (!isChrome(mWebContents) && !GmsCoreUtils.isResultReceiverSupported())
+        if (CredManSupportProvider.getCredManSupport() == CredManSupport.DISABLED
+                 || options.publicKey == null) {
+             recordOutcomeEvent(GetAssertionOutcome.OTHER_FAILURE);
+             onError(AuthenticatorStatus.NOT_IMPLEMENTED);
+@@ -277,12 +277,11 @@ public final class AuthenticatorImpl implements Authenticator, AuthenticationCon
+     }
+ 
+     private boolean couldSupportConditionalMediation() {
+-        return GmsCoreUtils.isWebauthnSupported() && isChrome(mWebContents);
+        return isChrome(mWebContents);
+     }
+ 
+     private boolean couldSupportUvpaa() {
+-        return GmsCoreUtils.isWebauthnSupported()
+-                && (isChrome(mWebContents) || GmsCoreUtils.isResultReceiverSupported());
+        return isChrome(mWebContents);
+     }
+ 
+     @Override
+@@ -356,26 +355,20 @@ public final class AuthenticatorImpl implements Authenticator, AuthenticationCon
+                             capabilities.add(
+                                     createWebAuthnClientCapability(
+                                             AuthenticatorConstants.CAPABILITY_CONDITIONAL_GET,
+-                                            couldSupportConditionalMediation() && isUvpaa));
+                                            true));
+                             capabilities.add(
+                                     createWebAuthnClientCapability(
+                                             AuthenticatorConstants.CAPABILITY_UVPAA,
+-                                            couldSupportUvpaa() && isUvpaa));
+-                            boolean conditionalCreateEnabled =
+-                                    couldSupportConditionalMediation()
+-                                            && DeviceFeatureMap.isEnabled(
+-                                                    DeviceFeatureList.WEBAUTHN_PASSKEY_UPGRADE);
+                                            true));
+                             capabilities.add(
+                                     createWebAuthnClientCapability(
+                                             AuthenticatorConstants.CAPABILITY_CONDITIONAL_CREATE,
+-                                            isUvpaa && conditionalCreateEnabled));
+                                            DeviceFeatureMap.isEnabled(
+                                                    DeviceFeatureList.WEBAUTHN_PASSKEY_UPGRADE)));
+                             capabilities.add(
+                                     createWebAuthnClientCapability(
+                                             AuthenticatorConstants.CAPABILITY_IMMEDIATE_GET,
+-                                            DeviceFeatureMap.isEnabled(
+-                                                            DeviceFeatureList
+-                                                                    .WEBAUTHN_IMMEDIATE_GET)
+-                                                    && isUvpaa));
+                                            false));
+                             boolean signalSupported =
+                                     isUvpaa
+                                             && DeviceFeatureMap.isEnabled(
+diff --git a/components/webauthn/android/java/src/org/chromium/components/webauthn/WebauthnFeatures.java b/components/webauthn/android/java/src/org/chromium/components/webauthn/WebauthnFeatures.java
+--- a/components/webauthn/android/java/src/org/chromium/components/webauthn/WebauthnFeatures.java
+++ b/components/webauthn/android/java/src/org/chromium/components/webauthn/WebauthnFeatures.java
+@@ -17,4 +17,6 @@ public abstract class WebauthnFeatures {
+     public static final String WEBAUTHN_ANDROID_PASSKEY_CACHE_MIGRATION =
+             "WebAuthenticationAndroidPasskeyCacheMigration";
+     public static final String WEBAUTHN_ANDROID_CRED_MAN_FOR_DEV = "WebAuthnAndroidCredManForDev";
+    public static final String WEBAUTHN_ANDROID_PASSKEY =
+            "WebAuthenticationAndroidPasskey";
+ }
+diff --git a/components/webauthn/android/java/src/org/chromium/components/webauthn/cred_man/CredManSupportProvider.java b/components/webauthn/android/java/src/org/chromium/components/webauthn/cred_man/CredManSupportProvider.java
+--- a/components/webauthn/android/java/src/org/chromium/components/webauthn/cred_man/CredManSupportProvider.java
+++ b/components/webauthn/android/java/src/org/chromium/components/webauthn/cred_man/CredManSupportProvider.java
+@@ -19,11 +19,11 @@ import org.chromium.base.version_info.VersionInfo;
+ import org.chromium.build.annotations.NullMarked;
+ import org.chromium.build.annotations.Nullable;
+ import org.chromium.components.webauthn.CredManSupport;
+-import org.chromium.components.webauthn.GmsCoreUtils;
+ import org.chromium.components.webauthn.WebauthnFeatureMap;
+ import org.chromium.components.webauthn.WebauthnFeatures;
+ import org.chromium.components.webauthn.WebauthnMode;
+ import org.chromium.components.webauthn.WebauthnModeProvider;
+import org.chromium.components.webauthn.WebauthnLogger;
+ 
+ @NullMarked
+ public class CredManSupportProvider {
+@@ -79,12 +79,12 @@ public class CredManSupportProvider {
+         }
+         if (getAndroidVersion() < Build.VERSION_CODES.UPSIDE_DOWN_CAKE) {
+             sCredManSupport = CredManSupport.DISABLED;
+-            log(TAG, "Disabled because of Android version.");
+            WebauthnLogger.logError(TAG, "Disabled because of Android version.");
+             return sCredManSupport;
+         }
+-        if (notSkippedBecauseInTests() && hasOldGmsVersion()) {
+        if (!WebauthnFeatureMap.getInstance().isEnabled(WebauthnFeatures.WEBAUTHN_ANDROID_PASSKEY)) {
+             sCredManSupport = CredManSupport.DISABLED;
+-            log(TAG, "Disabled because of old GMS version.");
+            WebauthnLogger.logError(TAG, "Disabled because of user.");
+             return sCredManSupport;
+         }
+         if (notSkippedBecauseInTests()
+@@ -92,14 +92,14 @@ public class CredManSupportProvider {
+                         == null) {
+             sCredManSupport = CredManSupport.DISABLED;
+             recordCredManAvailability(/* available= */ false);
+-            log(TAG, "Disabled because CredentialManager is not available.");
+            WebauthnLogger.logError(TAG, "Disabled because CredentialManager is not available.");
+             return sCredManSupport;
+         }
+         recordCredManAvailability(/* available= */ true);
+ 
+         final CredManUiRecommender recommender =
+                 ServiceLoaderUtil.maybeCreate(CredManUiRecommender.class);
+-        boolean customUiRecommended = recommender != null && recommender.recommendsCustomUi();
+        boolean customUiRecommended = true;
+         boolean gpmInCredMan =
+                 sOverrideForcesGpm != null ? sOverrideForcesGpm : customUiRecommended;
+         boolean isChrome3pPwmMode =
+@@ -138,13 +138,6 @@ public class CredManSupportProvider {
+                 "WebAuthentication.Android.CredManAvailability", available);
+     }
+ 
+-    private static boolean hasOldGmsVersion() {
+-        assert sOverrideAndroidVersion == null : "Don't use in testing!";
+-        // The check works for unavailable and low GMS versions. `getGmsCoreVersion()` is -1 if the
+-        // GMS version can't be retrieved. Chrome assumes an insufficient GMS availability then.
+-        return GmsCoreUtils.getGmsCoreVersion() < getMinGmsVersionForCurrentChannel();
+-    }
+-
+     private static int getAndroidVersion() {
+         return sOverrideAndroidVersion == null ? Build.VERSION.SDK_INT : sOverrideAndroidVersion;
+     }
+@@ -152,10 +145,4 @@ public class CredManSupportProvider {
+     private static boolean notSkippedBecauseInTests() {
+         return sOverrideForcesGpm == null && sOverrideAndroidVersion == null;
+     }
+-
+-    private static int getMinGmsVersionForCurrentChannel() {
+-        return (VersionInfo.isBetaBuild() || VersionInfo.isStableBuild())
+-                ? GMSCORE_MIN_VERSION_BETA_STABLE
+-                : GMSCORE_MIN_VERSION_CANARY_DEV;
+-    }
+ }
+diff --git a/components/webauthn/android/webauthn_feature_map.cc b/components/webauthn/android/webauthn_feature_map.cc
+--- a/components/webauthn/android/webauthn_feature_map.cc
+++ b/components/webauthn/android/webauthn_feature_map.cc
+@@ -17,6 +17,7 @@ namespace {
+ const base::Feature* const kFeaturesExposedToJava[] = {
+     &kWebAuthnAndroidPasskeyCacheMigration,
+     &kWebAuthnAndroidCredManForDev,
+    &kWebAuthnAndroidPasskey,
+ };
+ 
+ // static
+diff --git a/components/webauthn/features.cc b/components/webauthn/features.cc
+--- a/components/webauthn/features.cc
+++ b/components/webauthn/features.cc
+@@ -25,6 +25,10 @@ BASE_FEATURE(kWebAuthnAndroidCredManForDev, base::FEATURE_DISABLED_BY_DEFAULT);
+ const base::FeatureParam<std::string> kWebAuthnAndroidCredManForDevMode{
+     &kWebAuthnAndroidCredManForDev, "mode", ""};
+ 
+CROMITE_FEATURE(kWebAuthnAndroidPasskey,
+                "WebAuthenticationAndroidPasskey",
+                base::FEATURE_DISABLED_BY_DEFAULT);
+
+ #endif  // BUILDFLAG(IS_ANDROID)
+ 
+ #if !BUILDFLAG(IS_ANDROID)
+diff --git a/components/webauthn/features.h b/components/webauthn/features.h
+--- a/components/webauthn/features.h
+++ b/components/webauthn/features.h
+@@ -27,6 +27,9 @@ BASE_DECLARE_FEATURE(kWebAuthnAndroidCredManForDev);
+ COMPONENT_EXPORT(WEBAUTHN)
+ extern const base::FeatureParam<std::string> kWebAuthnAndroidCredManForDevMode;
+ 
+COMPONENT_EXPORT(WEBAUTHN)
+BASE_DECLARE_FEATURE(kWebAuthnAndroidPasskey);
+
+ #endif  // BUILDFLAG(IS_ANDROID)
+ 
+ #if !BUILDFLAG(IS_ANDROID)
+diff --git a/device/fido/features.cc b/device/fido/features.cc
+--- a/device/fido/features.cc
+++ b/device/fido/features.cc
+@@ -188,6 +188,7 @@ BASE_FEATURE(kWebAuthnImmediateGet,
+ #else
+              base::FEATURE_ENABLED_BY_DEFAULT);
+ #endif  // BUILDFLAG(IS_ANDROID)
+SET_CROMITE_FEATURE_DISABLED(kWebAuthnImmediateGet);
+ 
+ BASE_FEATURE_PARAM(int,
+                    kWebAuthnImmediateMediationTimeoutMilliseconds,
+@@ -200,6 +201,7 @@ BASE_FEATURE_PARAM(int,
+ BASE_FEATURE(kWebAuthnImmediateGetAutoselect,
+              "WebAuthenticationImmediateGetAutoselect",
+              base::FEATURE_ENABLED_BY_DEFAULT);
+SET_CROMITE_FEATURE_DISABLED(kWebAuthnImmediateGetAutoselect);
+ 
+ // Default enabled in M140. Remove in or after M143.
+ BASE_FEATURE(kWebAuthnLargeBlobForGPM,
+diff --git a/third_party/blink/renderer/modules/credentialmanagement/authentication_credentials_container.cc b/third_party/blink/renderer/modules/credentialmanagement/authentication_credentials_container.cc
+--- a/third_party/blink/renderer/modules/credentialmanagement/authentication_credentials_container.cc
+++ b/third_party/blink/renderer/modules/credentialmanagement/authentication_credentials_container.cc
+@@ -1090,6 +1090,11 @@ DOMException* AuthenticatorStatusToDOMException(
+     const WebAuthnDOMExceptionDetailsPtr& dom_exception_details) {
+   DCHECK_EQ(status != AuthenticatorStatus::ERROR_WITH_DOM_EXCEPTION_DETAILS,
+             dom_exception_details.is_null());
+  if (status == AuthenticatorStatus::UNKNOWN_ERROR ||
+      status == AuthenticatorStatus::NOT_IMPLEMENTED) {
+      status = AuthenticatorStatus::NOT_ALLOWED_ERROR;
+      base::PlatformThread::Sleep(base::Milliseconds(base::RandInt(1000, 6000)));
+  }
+   switch (status) {
+     case AuthenticatorStatus::SUCCESS:
+       NOTREACHED();
+--
@@ -28,9 +28,9 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 .../renderer/core/html/html_anchor_element.h  |  7 +++-
 .../renderer/core/html/html_image_element.cc  | 17 +++++++++
 .../renderer/core/html/html_image_element.h   |  2 ++
- .../core/page/context_menu_controller.cc      | 33 ++++++++++++-----
+ .../core/page/context_menu_controller.cc      | 23 +++++++++---
 .../core/page/context_menu_controller.h       |  5 +--
- 22 files changed, 170 insertions(+), 20 deletions(-)
+ 22 files changed, 164 insertions(+), 16 deletions(-)
 create mode 100644 cromite_flags/chrome/browser/about_flags_cc/Add-setting-to-invert-tap-and-long-tap.inc
 create mode 100644 cromite_flags/third_party/blink/common/features_cc/Add-setting-to-invert-tap-and-long-tap.inc
 create mode 100644 cromite_flags/third_party/blink/common/features_h/Add-setting-to-invert-tap-and-long-tap.inc
@@ -38,15 +38,15 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 diff --git a/android_webview/java/src/org/chromium/android_webview/contextmenu/AwContextMenuItemDelegate.java b/android_webview/java/src/org/chromium/android_webview/contextmenu/AwContextMenuItemDelegate.java
 --- a/android_webview/java/src/org/chromium/android_webview/contextmenu/AwContextMenuItemDelegate.java
 +++ b/android_webview/java/src/org/chromium/android_webview/contextmenu/AwContextMenuItemDelegate.java
-@@ -12,6 +12,7 @@ import org.chromium.base.IntentUtils;
+@@ -11,6 +11,7 @@ import android.net.Uri;
+ import org.chromium.base.IntentUtils;
 import org.chromium.build.annotations.NullMarked;
 import org.chromium.components.embedder_support.contextmenu.ContextMenuItemDelegate;
- import org.chromium.components.embedder_support.contextmenu.ContextMenuParams;
 +import org.chromium.content_public.common.Referrer;
 import org.chromium.content_public.browser.WebContents;
 import org.chromium.ui.base.Clipboard;
 import org.chromium.url.GURL;
-@@ -54,6 +55,9 @@ public class AwContextMenuItemDelegate implements ContextMenuItemDelegate {
+@@ -52,6 +53,9 @@ public class AwContextMenuItemDelegate implements ContextMenuItemDelegate {
         IntentUtils.safeStartActivity(mActivity, intent);
     }
 
@@ -59,7 +59,7 @@ diff --git a/android_webview/java/src/org/chromium/android_webview/contextmenu/A
 diff --git a/chrome/android/java/res/values/ids.xml b/chrome/android/java/res/values/ids.xml
 --- a/chrome/android/java/res/values/ids.xml
 +++ b/chrome/android/java/res/values/ids.xml
-@@ -104,6 +104,7 @@ found in the LICENSE file.
+@@ -111,6 +111,7 @@ found in the LICENSE file.
 
     <!-- Menu item IDs for FullscreenActivities -->
     <item type="id" name="contextmenu_open_in_chrome" />
@@ -98,28 +98,28 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/accessibility/s
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/contextmenu/ChromeContextMenuItem.java b/chrome/android/java/src/org/chromium/chrome/browser/contextmenu/ChromeContextMenuItem.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/contextmenu/ChromeContextMenuItem.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/contextmenu/ChromeContextMenuItem.java
-@@ -123,8 +123,9 @@ class ChromeContextMenuItem {
-         int PRINT_PAGE = 38;
+@@ -135,8 +135,9 @@ class ChromeContextMenuItem {
         // Developer Group
-         int INSPECT_ELEMENT = 39;
-+        int FOLLOW_LINK = 40;
+         int VIEW_PAGE_SOURCE = 41;
+         int INSPECT_ELEMENT = 42;
+        int FOLLOW_LINK = 43;
         // ALWAYS UPDATE!
-        int NUM_ENTRIES = 40;
-+        int NUM_ENTRIES = 41;
+-        int NUM_ENTRIES = 43;
+        int NUM_ENTRIES = 44;
     }
 
     /** Mapping from {@link Item} to the ID found in the ids.xml. */
-@@ -169,6 +170,7 @@ class ChromeContextMenuItem {
-         R.id.contextmenu_share_page, // Item.SHARE_PAGE
+@@ -184,6 +185,7 @@ class ChromeContextMenuItem {
         R.id.contextmenu_print_page, // Item.PRINT_PAGE
+         R.id.contextmenu_view_page_source, // Item.VIEW_PAGE_SOURCE
         R.id.contextmenu_inspect_element, // Item.INSPECT_ELEMENT
 +        R.id.contextmenu_open_in_tab, // Item.OPEN_IN_NEW_CHROME_TAB
     };
 
     /** Mapping from {@link Item} to the ID of the string that describes the action of the item. */
-@@ -213,6 +215,7 @@ class ChromeContextMenuItem {
-         R.string.contextmenu_share_page, // Item.SHARE_PAGE
+@@ -231,6 +233,7 @@ class ChromeContextMenuItem {
         R.string.contextmenu_print_page, // Item.PRINT_PAGE
+         R.string.contextmenu_view_page_source, // Item.VIEW_PAGE_SOURCE
         R.string.contextmenu_inspect_element, // Item.INSPECT_ELEMENT
 +        R.string.contextmenu_open_in_tab, // Item.OPEN_IN_NEW_CHROME_TAB
     };
@@ -128,7 +128,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/contextmenu/Chr
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/contextmenu/ChromeContextMenuPopulator.java b/chrome/android/java/src/org/chromium/chrome/browser/contextmenu/ChromeContextMenuPopulator.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/contextmenu/ChromeContextMenuPopulator.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/contextmenu/ChromeContextMenuPopulator.java
-@@ -369,6 +369,9 @@ public class ChromeContextMenuPopulator implements ContextMenuPopulator {
+@@ -474,6 +474,9 @@ public class ChromeContextMenuPopulator implements ContextMenuPopulator {
         }
         if (mParams.isAnchor()) {
             ModelList linkGroup = new ModelList();
@@ -138,7 +138,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/contextmenu/Chr
             if (FirstRunStatus.getFirstRunFlowComplete()
                     && !isEmptyUrl(mParams.getUrl())
                     && UrlUtilities.isAcceptedScheme(mParams.getUrl())) {
-@@ -834,6 +837,8 @@ public class ChromeContextMenuPopulator implements ContextMenuPopulator {
+@@ -1083,6 +1086,8 @@ public class ChromeContextMenuPopulator implements ContextMenuPopulator {
                                 getProfile(),
                                 false);
                     });
@@ -150,7 +150,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/contextmenu/Chr
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tab/TabContextMenuItemDelegate.java b/chrome/android/java/src/org/chromium/chrome/browser/tab/TabContextMenuItemDelegate.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/tab/TabContextMenuItemDelegate.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/tab/TabContextMenuItemDelegate.java
-@@ -356,6 +356,14 @@ public class TabContextMenuItemDelegate implements ContextMenuItemDelegate {
+@@ -414,6 +414,14 @@ public class TabContextMenuItemDelegate implements ContextMenuItemDelegate {
         mTab.loadUrl(loadUrlParams);
     }
 
@@ -168,18 +168,18 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tab/TabContextM
 diff --git a/chrome/browser/flags/android/chrome_feature_list.cc b/chrome/browser/flags/android/chrome_feature_list.cc
 --- a/chrome/browser/flags/android/chrome_feature_list.cc
 +++ b/chrome/browser/flags/android/chrome_feature_list.cc
-@@ -382,6 +382,7 @@ const base::Feature* const kFeaturesExposedToJava[] = {
+@@ -446,6 +446,7 @@ const base::Feature* const kFeaturesExposedToJava[] = {
     &kTabGroupParityBottomSheetAndroid,
-     &kTabletTabStripAnimation,
-     &kToolbarPhoneCleanup,
+     &kTabModelInitFixes,
+     &kTabStorageSqlitePrototype,
 +    &blink::features::kShowAlwaysContextMenuOnLinks,
-     &kTabStateFlatBuffer,
-     &kTabStripContextMenuAndroid,
+     &kTabStripAutoSelectOnCloseChange,
     &kTabStripDensityChangeAndroid,
+     &kTabStripGroupDragDropAndroid,
 diff --git a/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureList.java b/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureList.java
 --- a/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureList.java
 +++ b/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureList.java
-@@ -455,6 +455,8 @@ public abstract class ChromeFeatureList {
+@@ -517,6 +517,8 @@ public abstract class ChromeFeatureList {
             "DisableToolbarSwipeUp";
     public static final String MOVE_TOP_TOOLBAR_TO_BOTTOM =
             "MoveTopToolbarToBottom";
@@ -187,8 +187,8 @@ diff --git a/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/f
 +            "ShowAlwaysContextMenuOnLinks";
     public static final String NEW_TAB_PAGE_CUSTOMIZATION_TOOLBAR_BUTTON =
             "NewTabPageCustomizationToolbarButton";
-     public static final String NOTIFICATION_ONE_TAP_UNSUBSCRIBE = "NotificationOneTapUnsubscribe";
-@@ -868,6 +870,8 @@ public abstract class ChromeFeatureList {
+     public static final String NEW_TAB_PAGE_CUSTOMIZATION_V2 = "NewTabPageCustomizationV2";
+@@ -1031,6 +1033,8 @@ public abstract class ChromeFeatureList {
             newCachedFlag(DISABLE_TOOLBAR_SWIPE_UP, false);
     public static final CachedFlag sMoveTopToolbarToBottom =
             newCachedFlag(MOVE_TOP_TOOLBAR_TO_BOTTOM, false);
@@ -197,18 +197,18 @@ diff --git a/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/f
     public static final CachedFlag sPaintPreviewDemo = newCachedFlag(PAINT_PREVIEW_DEMO, false);
     public static final CachedFlag sPostGetMyMemoryStateToBackground =
             newCachedFlag(POST_GET_MEMORY_PRESSURE_TO_BACKGROUND, true);
-@@ -1072,6 +1076,7 @@ public abstract class ChromeFeatureList {
-                     sTabWindowManagerReportIndicesMismatch,
+@@ -1303,6 +1307,7 @@ public abstract class ChromeFeatureList {
                     sTopControlsRefactor,
-                     sTraceBinderIpc,
+                     sTopControlsRefactorV2,
+                     sTouchToSearchCallout,
 +                    sShowAlwaysContextMenuOnLinks,
-                     sUseChimeAndroidSdk,
                     sUseActivityManagerForTabActivation,
-                     sUseLibunwindstackNativeUnwinderAndroid,
+                     sUseChimeAndroidSdk,
+                     sUseInitialNetworkStateAtStartup,
 diff --git a/chrome/browser/ui/android/strings/android_chrome_strings.grd b/chrome/browser/ui/android/strings/android_chrome_strings.grd
 --- a/chrome/browser/ui/android/strings/android_chrome_strings.grd
 +++ b/chrome/browser/ui/android/strings/android_chrome_strings.grd
-@@ -1719,6 +1719,12 @@ Your Google account may have other forms of browsing history like searches and a
+@@ -1572,6 +1572,12 @@ Your Google account may have other forms of browsing history like searches and a
       <message name="IDS_DISABLE_TOOLBAR_SWIPE_UP" desc="Summary of the preference that allows the user to disable toolbar swipeup.">
         Disable toolbar swipe up
       </message>
@@ -221,20 +221,20 @@ diff --git a/chrome/browser/ui/android/strings/android_chrome_strings.grd b/chro
 
       <!-- Safety check -->
       <message name="IDS_PREFS_SAFETY_CHECK" desc="Title of the Safety check element in settings, allowing the user to check multiple areas of browser safety. [CHAR_LIMIT=32]">
-@@ -3330,6 +3336,9 @@ To change this setting, <ph name="BEGIN_LINK">BEGIN_LINK</ph>delete the Chrome d
+@@ -3237,6 +3243,9 @@ To change this setting, <ph name="BEGIN_LINK">BEGIN_LINK</ph>delete the Chrome d
       <message name="IDS_CONTEXTMENU_OPEN_IN_NEW_CHROME_TAB" desc="Context sensitive menu item to open the selected link in a new Chrome tab from Chrome Custom Tab. [CHAR_LIMIT=30]">
         Open in new Chrome tab
       </message>
 +      <message name="IDS_CONTEXTMENU_OPEN_IN_TAB" desc="Context sensitive menu item to open the selected link in tab. [CHAR_LIMIT=30]">
 +        Open in current tab
 +      </message>
-       <message name="IDS_CONTEXTMENU_OPEN_IN_CHROME_INCOGNITO_TAB" desc="Context sensitive menu item to open the selected link in a Chrome Incognito tab from Chrome Custom Tab. [CHAR_LIMIT=30]">
-         Open in Incognito tab
+       <message name="IDS_CONTEXTMENU_OPEN_IN_CHROME_WINDOW" desc="Context sensitive menu item to open the selected link in a Chrome window from Chrome Custom Tab. Used when there is a dedicated window for Incognito tabs. [CHAR_LIMIT=30]">
+         Open in Chrome window
       </message>
 diff --git a/components/browser_ui/accessibility/android/java/res/xml/accessibility_preferences.xml b/components/browser_ui/accessibility/android/java/res/xml/accessibility_preferences.xml
 --- a/components/browser_ui/accessibility/android/java/res/xml/accessibility_preferences.xml
 +++ b/components/browser_ui/accessibility/android/java/res/xml/accessibility_preferences.xml
-@@ -31,6 +31,11 @@ found in the LICENSE file.
+@@ -26,6 +26,11 @@ found in the LICENSE file.
         android:summary="@string/page_zoom_always_show_preference_summary"
         android:title="@string/page_zoom_always_show_preference_title" />
 
@@ -249,7 +249,7 @@ diff --git a/components/browser_ui/accessibility/android/java/res/xml/accessibil
 diff --git a/components/browser_ui/accessibility/android/java/src/org/chromium/components/browser_ui/accessibility/AccessibilitySettings.java b/components/browser_ui/accessibility/android/java/src/org/chromium/components/browser_ui/accessibility/AccessibilitySettings.java
 --- a/components/browser_ui/accessibility/android/java/src/org/chromium/components/browser_ui/accessibility/AccessibilitySettings.java
 +++ b/components/browser_ui/accessibility/android/java/src/org/chromium/components/browser_ui/accessibility/AccessibilitySettings.java
-@@ -53,6 +53,9 @@ public class AccessibilitySettings extends ChromeBaseSettingsFragment
+@@ -60,6 +60,9 @@ public class AccessibilitySettings extends ChromeBaseSettingsFragment
     private BooleanPreferenceDelegate mMoveTopToolbarToBottomDelegate;
     private BooleanPreferenceDelegate mDisableToolbarSwipeUpDelegate;
 
@@ -259,7 +259,7 @@ diff --git a/components/browser_ui/accessibility/android/java/src/org/chromium/c
     private PageZoomPreference mPageZoomDefaultZoomPref;
     private ChromeSwitchPreference mPageZoomIncludeOSAdjustment;
     private ChromeSwitchPreference mPageZoomAlwaysShowPref;
-@@ -139,6 +142,12 @@ public class AccessibilitySettings extends ChromeBaseSettingsFragment
+@@ -157,6 +160,12 @@ public class AccessibilitySettings extends ChromeBaseSettingsFragment
         mDisableToolbarSwipeUpPref.setChecked(mDisableToolbarSwipeUpDelegate.getValue());
         mDisableToolbarSwipeUpPref.setOnPreferenceChangeListener(this);
 
@@ -272,7 +272,7 @@ diff --git a/components/browser_ui/accessibility/android/java/src/org/chromium/c
         Preference captions = findPreference(PREF_CAPTIONS);
         captions.setOnPreferenceClickListener(
                 preference -> {
-@@ -220,6 +229,9 @@ public class AccessibilitySettings extends ChromeBaseSettingsFragment
+@@ -265,6 +274,9 @@ public class AccessibilitySettings extends ChromeBaseSettingsFragment
         } else if (PREF_DISABLE_TOOLBAR_SWIPE_UP.equals(preference.getKey())) {
             mDisableToolbarSwipeUpDelegate.setValue((Boolean) newValue);
             mDelegate.requestRestart(getActivity());
@@ -344,15 +344,15 @@ new file mode 100644
 diff --git a/third_party/blink/renderer/core/html/html_anchor_element.cc b/third_party/blink/renderer/core/html/html_anchor_element.cc
 --- a/third_party/blink/renderer/core/html/html_anchor_element.cc
 +++ b/third_party/blink/renderer/core/html/html_anchor_element.cc
-@@ -66,6 +66,7 @@
+@@ -65,6 +65,7 @@
 #include "third_party/blink/renderer/core/loader/render_blocking_resource_manager.h"
 #include "third_party/blink/renderer/core/navigation_api/navigation_api.h"
 #include "third_party/blink/renderer/core/page/chrome_client.h"
 +#include "third_party/blink/renderer/core/page/context_menu_controller.h"
 #include "third_party/blink/renderer/core/page/page.h"
+ #include "third_party/blink/renderer/core/scroll/scroll_into_view_util.h"
 #include "third_party/blink/renderer/core/speculation_rules/document_speculation_rules.h"
- #include "third_party/blink/renderer/platform/heap/garbage_collected.h"
-@@ -500,6 +501,17 @@ void HTMLAnchorElementBase::NavigateToHyperlink(
+@@ -415,6 +416,17 @@ void HTMLAnchorElementBase::NavigateToHyperlink(
     bool is_trusted,
     base::TimeTicks platform_time_stamp,
     KURL completed_url) {
@@ -370,7 +370,7 @@ diff --git a/third_party/blink/renderer/core/html/html_anchor_element.cc b/third
   LocalDOMWindow* window = GetDocument().domWindow();
   if (!window) {
     return;
-@@ -590,6 +602,15 @@ void HTMLAnchorElementBase::NavigateToHyperlink(
+@@ -495,6 +507,15 @@ void HTMLAnchorElementBase::NavigateToHyperlink(
     frame_request.SetImpression(impression);
   }
 
@@ -386,8 +386,8 @@ diff --git a/third_party/blink/renderer/core/html/html_anchor_element.cc b/third
   Frame* target_frame =
       frame->Tree().FindOrCreateFrameForNavigation(frame_request, target).frame;
 
-@@ -633,7 +654,7 @@ Element* HTMLAnchorElementBase::InterestTargetElement() const {
-       html_names::kInteresttargetAttr);
+@@ -531,7 +552,7 @@ bool HTMLAnchorElementBase::IsValidInterestInvoker(Element& target) const {
+   return IsLink();
 }
 
 -void HTMLAnchorElementBase::HandleClick(MouseEvent& event) {
@@ -395,25 +395,25 @@ diff --git a/third_party/blink/renderer/core/html/html_anchor_element.cc b/third
   event.SetDefaultHandled();
 
   LocalDOMWindow* window = GetDocument().domWindow();
-@@ -729,13 +750,12 @@ void HTMLAnchorElementBase::HandleClick(MouseEvent& event) {
+@@ -583,13 +604,12 @@ void HTMLAnchorElementBase::HandleClick(MouseEvent& event) {
     return;
   }
 
-  base::OnceClosure navigate_closure = WTF::BindOnce(
+-  base::OnceClosure navigate_closure = blink::BindOnce(
 -      &HTMLAnchorElementBase::NavigateToHyperlink, WrapWeakPersistent(this),
 -      std::move(request), navigation_policy, event.isTrusted(),
 -      event.PlatformTimeStamp(), std::move(completed_url));
 -
   if (navigation_policy == kNavigationPolicyDownload ||
       navigation_policy == kNavigationPolicyLinkPreview) {
-+    base::OnceClosure navigate_closure = WTF::BindOnce(
+    base::OnceClosure navigate_closure = blink::BindOnce(
 +        &HTMLAnchorElementBase::NavigateToHyperlink, WrapWeakPersistent(this),
 +        std::move(request), navigation_policy, event.isTrusted(),
 +        event.PlatformTimeStamp(), std::move(completed_url));
     // We distinguish single/double click with some modifiers.
     // See the comment of `EventHandler.delayed_navigation_task_handle_`.
     auto task_handle = PostDelayedCancellableTask(
-@@ -745,7 +765,9 @@ void HTMLAnchorElementBase::HandleClick(MouseEvent& event) {
+@@ -599,7 +619,9 @@ void HTMLAnchorElementBase::HandleClick(MouseEvent& event) {
     frame->GetEventHandler().SetDelayedNavigationTaskHandle(
         std::move(task_handle));
   } else {
@@ -427,15 +427,15 @@ diff --git a/third_party/blink/renderer/core/html/html_anchor_element.cc b/third
 diff --git a/third_party/blink/renderer/core/html/html_anchor_element.h b/third_party/blink/renderer/core/html/html_anchor_element.h
 --- a/third_party/blink/renderer/core/html/html_anchor_element.h
 +++ b/third_party/blink/renderer/core/html/html_anchor_element.h
-@@ -112,6 +112,7 @@ class CORE_EXPORT HTMLAnchorElementBase : public HTMLElement,
-   Element* InterestTargetElement() const override;
+@@ -90,6 +90,7 @@ class CORE_EXPORT HTMLAnchorElementBase : public HTMLElement,
+   bool IsValidInterestInvoker(Element& target) const override;
 
   void Trace(Visitor*) const override;
 +  void HandleClick(MouseEvent&, bool do_not_show_context_menu = false);
 
  protected:
   HTMLAnchorElementBase(const QualifiedName& tag_name, Document&);
-@@ -143,7 +144,11 @@ class CORE_EXPORT HTMLAnchorElementBase : public HTMLElement,
+@@ -121,7 +122,11 @@ class CORE_EXPORT HTMLAnchorElementBase : public HTMLElement,
                            bool is_trusted,
                            base::TimeTicks platform_time_stamp,
                            KURL);
@@ -459,7 +459,7 @@ diff --git a/third_party/blink/renderer/core/html/html_image_element.cc b/third_
 #include "third_party/blink/renderer/core/frame/attribution_src_loader.h"
 #include "third_party/blink/renderer/core/frame/deprecation/deprecation.h"
 #include "third_party/blink/renderer/core/frame/local_dom_window.h"
-@@ -64,6 +65,7 @@
+@@ -65,6 +66,7 @@
 #include "third_party/blink/renderer/core/media_type_names.h"
 #include "third_party/blink/renderer/core/page/chrome_client.h"
 #include "third_party/blink/renderer/core/page/page.h"
@@ -467,7 +467,7 @@ diff --git a/third_party/blink/renderer/core/html/html_image_element.cc b/third_
 #include "third_party/blink/renderer/core/paint/timing/paint_timing.h"
 #include "third_party/blink/renderer/core/probe/core_probes.h"
 #include "third_party/blink/renderer/core/resize_observer/resize_observer_entry.h"
-@@ -815,6 +817,21 @@ void HTMLImageElement::DidFinishLifecycleUpdate(
+@@ -782,6 +784,21 @@ void HTMLImageElement::DidFinishLayout() {
   }
 }
 
@@ -492,19 +492,19 @@ diff --git a/third_party/blink/renderer/core/html/html_image_element.cc b/third_
 diff --git a/third_party/blink/renderer/core/html/html_image_element.h b/third_party/blink/renderer/core/html/html_image_element.h
 --- a/third_party/blink/renderer/core/html/html_image_element.h
 +++ b/third_party/blink/renderer/core/html/html_image_element.h
-@@ -217,6 +217,8 @@ class CORE_EXPORT HTMLImageElement
+@@ -211,6 +211,8 @@ class CORE_EXPORT HTMLImageElement
   void DidAddUserAgentShadowRoot(ShadowRoot&) override;
   void AdjustStyle(ComputedStyleBuilder&) override;
 
 +  void DefaultEventHandler(Event&) override;
 +
  private:
-   bool AreAuthorShadowsAllowed() const override { return false; }
- 
+   void ParseAttribute(const AttributeModificationParams&) override;
+   bool IsPresentationAttribute(const QualifiedName&) const override;
 diff --git a/third_party/blink/renderer/core/page/context_menu_controller.cc b/third_party/blink/renderer/core/page/context_menu_controller.cc
 --- a/third_party/blink/renderer/core/page/context_menu_controller.cc
 +++ b/third_party/blink/renderer/core/page/context_menu_controller.cc
-@@ -200,14 +200,16 @@ void ContextMenuController::DocumentDetached(Document* document) {
+@@ -201,15 +201,17 @@ void ContextMenuController::DocumentDetached(Document* document) {
   }
 }
 
@@ -514,7 +514,8 @@ diff --git a/third_party/blink/renderer/core/page/context_menu_controller.cc b/t
 +  if (!base::FeatureList::IsEnabled(features::kShowAlwaysContextMenuOnLinks)) {
 +    DCHECK(mouse_event->type() == event_type_names::kContextmenu);
 +  }
-   LocalFrame* frame = mouse_event->target()->ToNode()->GetDocument().GetFrame();
+   LocalFrame* frame =
+       mouse_event->RawTarget()->ToNode()->GetDocument().GetFrame();
   PhysicalOffset location =
       PhysicalOffset::FromPointFRound(mouse_event->AbsoluteLocation());
 
@@ -524,7 +525,7 @@ diff --git a/third_party/blink/renderer/core/page/context_menu_controller.cc b/t
     mouse_event->SetDefaultHandled();
 }
 
-@@ -432,7 +434,8 @@ bool ContextMenuController::ShouldShowContextMenuFromTouch(
+@@ -440,7 +442,8 @@ bool ContextMenuController::ShowContextMenu(LocalFrame* frame,
 bool ContextMenuController::ShowContextMenu(LocalFrame* frame,
                                             const PhysicalOffset& point,
                                             WebMenuSourceType source_type,
@@ -534,7 +535,7 @@ diff --git a/third_party/blink/renderer/core/page/context_menu_controller.cc b/t
   // Displaying the context menu in this function is a big hack as we don't
   // have context, i.e. whether this is being invoked via a script or in
   // response to user input (Mouse event WM_RBUTTONDOWN,
-@@ -455,6 +458,16 @@ bool ContextMenuController::ShowContextMenu(LocalFrame* frame,
+@@ -463,6 +466,16 @@ bool ContextMenuController::ShowContextMenu(LocalFrame* frame,
   if (!result.InnerNodeOrImageMapImage())
     return false;
 
@@ -551,29 +552,19 @@ diff --git a/third_party/blink/renderer/core/page/context_menu_controller.cc b/t
   // Clear any previously set cached results if we are resetting the hit test
   // result.
   image_selection_cached_result_ = nullptr;
-@@ -830,11 +843,13 @@ bool ContextMenuController::ShowContextMenu(LocalFrame* frame,
+@@ -844,7 +857,7 @@ bool ContextMenuController::ShowContextMenu(LocalFrame* frame,
 
   SetAutofillData(result.InnerNode(), data);
 
-  const bool from_touch = source_type == kMenuSourceTouch ||
-                          source_type == kMenuSourceLongPress ||
-                          source_type == kMenuSourceLongTap;
 -  if (from_touch && !ShouldShowContextMenuFromTouch(data))
-    return false;
-+  if (!base::FeatureList::IsEnabled(features::kShowAlwaysContextMenuOnLinks)) {
-+    const bool from_touch = source_type == kMenuSourceTouch ||
-+                            source_type == kMenuSourceLongPress ||
-+                            source_type == kMenuSourceLongTap;
-+    if (from_touch && !ShouldShowContextMenuFromTouch(data))
-+      return false;
-+  }
+  if (!base::FeatureList::IsEnabled(features::kShowAlwaysContextMenuOnLinks) && from_touch && !ShouldShowContextMenuFromTouch(data))
+     return false;
 
   WebLocalFrameImpl* selected_web_frame =
-       WebLocalFrameImpl::FromFrame(selected_frame);
 diff --git a/third_party/blink/renderer/core/page/context_menu_controller.h b/third_party/blink/renderer/core/page/context_menu_controller.h
 --- a/third_party/blink/renderer/core/page/context_menu_controller.h
 +++ b/third_party/blink/renderer/core/page/context_menu_controller.h
-@@ -58,7 +58,7 @@ class CORE_EXPORT ContextMenuController final
+@@ -58,7 +58,7 @@ class CORE_EXPORT ContextMenuController
 
   void DocumentDetached(Document*);
 
@@ -582,13 +573,13 @@ diff --git a/third_party/blink/renderer/core/page/context_menu_controller.h b/th
   void ShowContextMenuAtPoint(LocalFrame*,
                               float x,
                               float y,
-@@ -125,7 +125,8 @@ class CORE_EXPORT ContextMenuController final
-   bool ShowContextMenu(LocalFrame*,
-                        const PhysicalOffset&,
-                        WebMenuSourceType,
-                       const MouseEvent* mouse_event = nullptr);
-+                       const MouseEvent* mouse_event = nullptr,
-+                       bool do_not_show_context_menu = false);
+@@ -127,7 +127,8 @@ class CORE_EXPORT ContextMenuController
+   virtual bool ShowContextMenu(LocalFrame*,
+                                const PhysicalOffset&,
+                                WebMenuSourceType,
+-                               const MouseEvent* mouse_event);
+                               const MouseEvent* mouse_event,
+                               bool do_not_show_context_menu = false);
 
   bool ShouldShowContextMenuFromTouch(const ContextMenuData&);
 
@@ -9,6 +9,8 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 ---
 chrome/browser/about_flags.cc                 |  1 +
 .../engagement/important_sites_util.cc        |  9 +++++
+ .../browser/media/media_engagement_service.cc |  4 ++-
+ .../auto_picture_in_picture_tab_helper.cc     |  2 +-
 .../internal/tracker_impl.cc                  |  3 ++
 .../public/feature_configurations.cc          |  7 ++++
 .../content/site_engagement_score.cc          |  5 +++
@@ -16,7 +18,7 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 components/site_engagement/core/features.cc   | 30 ++++++++++++++++
 components/site_engagement/core/features.h    | 34 +++++++++++++++++++
 .../Add-site-engagement-flag.inc              | 10 ++++++
- 9 files changed, 105 insertions(+)
+ 11 files changed, 109 insertions(+), 2 deletions(-)
 create mode 100644 components/site_engagement/core/features.cc
 create mode 100644 components/site_engagement/core/features.h
 create mode 100644 cromite_flags/chrome/browser/about_flags_cc/Add-site-engagement-flag.inc
@@ -24,9 +26,9 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 diff --git a/chrome/browser/about_flags.cc b/chrome/browser/about_flags.cc
 --- a/chrome/browser/about_flags.cc
 +++ b/chrome/browser/about_flags.cc
-@@ -164,6 +164,7 @@
- #include "components/sensitive_content/features.h"
+@@ -169,6 +169,7 @@
 #include "components/services/heap_profiling/public/cpp/switches.h"
+ #include "components/services/on_device_translation/buildflags/buildflags.h"
 #include "components/services/storage/public/cpp/buckets/bucket_info.h"
 +#include "components/site_engagement/core/features.h"
 #include "components/shared_highlighting/core/common/shared_highlighting_features.h"
@@ -43,7 +45,7 @@ diff --git a/chrome/browser/engagement/important_sites_util.cc b/chrome/browser/
 #include "components/site_engagement/core/mojom/site_engagement_details.mojom.h"
 #include "components/webapps/browser/banners/app_banner_settings_helper.h"
 #include "net/base/registry_controlled_domains/registry_controlled_domain.h"
-@@ -344,6 +345,10 @@ void ImportantSitesUtil::RegisterProfilePrefs(
+@@ -345,6 +346,10 @@ void ImportantSitesUtil::RegisterProfilePrefs(
 // static
 std::set<std::string> ImportantSitesUtil::GetInstalledRegisterableDomains(
     Profile* profile) {
@@ -54,7 +56,7 @@ diff --git a/chrome/browser/engagement/important_sites_util.cc b/chrome/browser/
   std::set<GURL> installed_origins = GetOriginsWithInstalledWebApps(profile);
   std::set<std::string> registerable_domains;
 
-@@ -358,6 +363,10 @@ std::vector<ImportantDomainInfo>
+@@ -359,6 +364,10 @@ std::vector<ImportantDomainInfo>
 ImportantSitesUtil::GetImportantRegisterableDomains(Profile* profile,
                                                     size_t max_results) {
   SCOPED_UMA_HISTOGRAM_TIMER("Storage.ImportantSites.GenerationTime");
@@ -65,6 +67,39 @@ diff --git a/chrome/browser/engagement/important_sites_util.cc b/chrome/browser/
   std::map<std::string, ImportantDomainInfo> important_info;
   std::map<GURL, double> engagement_map;
 
+diff --git a/chrome/browser/media/media_engagement_service.cc b/chrome/browser/media/media_engagement_service.cc
+--- a/chrome/browser/media/media_engagement_service.cc
+++ b/chrome/browser/media/media_engagement_service.cc
+@@ -25,6 +25,7 @@
+ #include "components/history/core/browser/history_service.h"
+ #include "components/no_state_prefetch/browser/no_state_prefetch_contents.h"
+ #include "components/prefs/pref_service.h"
+#include "components/site_engagement/core/features.h"
+ #include "content/public/browser/web_contents.h"
+ #include "media/base/media_switches.h"
+ #include "url/origin.h"
+@@ -54,7 +55,8 @@ enum class MediaEngagementClearReason {
+ 
+ // static
+ bool MediaEngagementService::IsEnabled() {
+-  return base::FeatureList::IsEnabled(media::kRecordMediaEngagementScores);
+  return base::FeatureList::IsEnabled(media::kRecordMediaEngagementScores)
+           && base::FeatureList::IsEnabled(site_engagement::features::kSiteEngagement);
+ }
+ 
+ // static
+diff --git a/chrome/browser/picture_in_picture/auto_picture_in_picture_tab_helper.cc b/chrome/browser/picture_in_picture/auto_picture_in_picture_tab_helper.cc
+--- a/chrome/browser/picture_in_picture/auto_picture_in_picture_tab_helper.cc
+++ b/chrome/browser/picture_in_picture/auto_picture_in_picture_tab_helper.cc
+@@ -46,7 +46,7 @@ AutoPictureInPictureTabHelper::AutoPictureInPictureTabHelper(
+           Profile::FromBrowserContext(web_contents->GetBrowserContext()))),
+       auto_blocker_(PermissionDecisionAutoBlockerFactory::GetForProfile(
+           Profile::FromBrowserContext(web_contents->GetBrowserContext()))),
+-      media_engagement_service_(MediaEngagementService::Get(
+      media_engagement_service_(!MediaEngagementService::IsEnabled() ? nullptr : MediaEngagementService::Get(
+           Profile::FromBrowserContext(web_contents->GetBrowserContext()))),
+       clock_(base::DefaultTickClock::GetInstance()) {
+   // `base::Unretained` is safe here since we own `tab_observer_helper_`.
 diff --git a/components/feature_engagement/internal/tracker_impl.cc b/components/feature_engagement/internal/tracker_impl.cc
 --- a/components/feature_engagement/internal/tracker_impl.cc
 +++ b/components/feature_engagement/internal/tracker_impl.cc
@@ -76,19 +111,19 @@ diff --git a/components/feature_engagement/internal/tracker_impl.cc b/components
 #include "components/feature_engagement/internal/availability_model_impl.h"
 #include "components/feature_engagement/internal/blocked_iph_features.h"
 #include "components/feature_engagement/internal/chrome_variations_configuration.h"
-@@ -236,6 +237,8 @@ TrackerImpl::TrackerImpl(
+@@ -291,6 +292,8 @@ TrackerImpl::TrackerImpl(
 TrackerImpl::~TrackerImpl() = default;
 
 void TrackerImpl::NotifyEvent(const std::string& event) {
 +  if (!base::FeatureList::IsEnabled(site_engagement::features::kSiteEngagement))
 +    return;
-   event_model_->IncrementEvent(event, time_provider_->GetCurrentDay());
+   GetEventModelWriter()->IncrementEvent(event, time_provider_->GetCurrentDay());
   stats::RecordNotifyEvent(event, configuration_.get(),
-                            event_model_->IsReady());
+                            event_model_provider_->IsReady());
 diff --git a/components/feature_engagement/public/feature_configurations.cc b/components/feature_engagement/public/feature_configurations.cc
 --- a/components/feature_engagement/public/feature_configurations.cc
 +++ b/components/feature_engagement/public/feature_configurations.cc
-@@ -11,6 +11,7 @@
+@@ -6,6 +6,7 @@
 
 #include "base/strings/string_util.h"
 #include "build/build_config.h"
@@ -96,7 +131,7 @@ diff --git a/components/feature_engagement/public/feature_configurations.cc b/co
 #include "components/feature_engagement/public/configuration.h"
 #include "components/feature_engagement/public/event_constants.h"
 #include "components/feature_engagement/public/feature_constants.h"
-@@ -118,6 +119,12 @@ std::optional<FeatureConfig> GetClientSideFeatureConfig(
+@@ -121,6 +122,12 @@ std::optional<FeatureConfig> GetClientSideFeatureConfig(
   }
 
 #endif  // BUILDFLAG(IS_MAC) || BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_WIN)
@@ -12,18 +12,18 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/settings/SettingsActivity.java b/chrome/android/java/src/org/chromium/chrome/browser/settings/SettingsActivity.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/settings/SettingsActivity.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/settings/SettingsActivity.java
-@@ -56,6 +56,7 @@ import org.chromium.chrome.browser.ui.messages.snackbar.Snackbar;
+@@ -68,6 +68,7 @@ import org.chromium.chrome.browser.ui.messages.snackbar.Snackbar;
 import org.chromium.components.browser_ui.bottomsheet.BottomSheetController;
 import org.chromium.components.browser_ui.bottomsheet.BottomSheetControllerFactory;
 import org.chromium.components.browser_ui.bottomsheet.ManagedBottomSheetController;
 +import org.chromium.components.browser_ui.settings.SettingsUtils;
 import org.chromium.components.browser_ui.modaldialog.AppModalPresenter;
 import org.chromium.components.browser_ui.settings.EmbeddableSettingsPage;
- import org.chromium.components.browser_ui.settings.SettingsFragment;
-@@ -466,8 +467,12 @@ public class SettingsActivity extends ChromeBaseAppCompatActivity
-             finishCurrentSettings(mainFragment);
+ import org.chromium.components.browser_ui.settings.PreferenceUpdateObserver;
+@@ -922,8 +923,12 @@ public class SettingsActivity extends ChromeBaseAppCompatActivity
             return true;
         } else if (item.getItemId() == R.id.menu_id_general_help) {
+             RecordUserAction.record("Settings.MobileHelpAndFeedback");
 -            HelpAndFeedbackLauncherImpl.getForProfile(mProfile)
 -                    .show(this, getString(R.string.help_context_settings), null);
 +            if (mainFragment instanceof SettingsUtils.ISupportHelpAndFeedback) {
@@ -38,7 +38,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/settings/Settin
 diff --git a/components/browser_ui/settings/android/java/src/org/chromium/components/browser_ui/settings/SettingsUtils.java b/components/browser_ui/settings/android/java/src/org/chromium/components/browser_ui/settings/SettingsUtils.java
 --- a/components/browser_ui/settings/android/java/src/org/chromium/components/browser_ui/settings/SettingsUtils.java
 +++ b/components/browser_ui/settings/android/java/src/org/chromium/components/browser_ui/settings/SettingsUtils.java
-@@ -28,6 +28,10 @@ import org.chromium.ui.drawable.StateListDrawableBuilder;
+@@ -33,6 +33,10 @@ import java.util.ArrayList;
 /** A helper class for Settings. */
 @NullMarked
 public class SettingsUtils {
@@ -15,7 +15,7 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 diff --git a/base/android/content_uri_utils.cc b/base/android/content_uri_utils.cc
 --- a/base/android/content_uri_utils.cc
 +++ b/base/android/content_uri_utils.cc
-@@ -134,6 +134,16 @@ void JNI_ContentUriUtils_AddFileInfoToVector(JNIEnv* env,
+@@ -137,6 +137,16 @@ static void JNI_ContentUriUtils_AddFileInfoToVector(JNIEnv* env,
                        Time::FromMillisecondsSinceUnixEpoch(last_modified));
 }
 
@@ -52,7 +52,7 @@ new file mode 100644
 +import org.chromium.components.browser_ui.site_settings.BromiteCustomContentSetting;
 +import org.chromium.components.browser_ui.site_settings.ContentSettingsResources;
 +import org.chromium.components.browser_ui.site_settings.SiteSettingsCategory;
-+import org.chromium.components.content_settings.ContentSettingValues;
+import org.chromium.components.content_settings.ContentSetting;
 +import org.chromium.components.content_settings.ContentSettingsType;
 +import org.chromium.content_public.browser.BrowserContextHandle;
 +
@@ -65,8 +65,8 @@ new file mode 100644
 +public class BromiteWebGLContentSetting extends BromiteCustomContentSetting {
 +    public BromiteWebGLContentSetting() {
 +        super(/*contentSettingsType*/ ContentSettingsType.WEBGL,
-+              /*defaultEnabledValue*/ ContentSettingValues.ALLOW,
-+              /*defaultDisabledValue*/ ContentSettingValues.BLOCK,
+              /*defaultEnabledValue*/ ContentSetting.ALLOW,
+              /*defaultDisabledValue*/ ContentSetting.BLOCK,
 +              /*allowException*/ true,
 +              /*preferenceKey*/ "webgl",
 +              /*profilePrefKey*/ "webgl");
@@ -85,11 +85,11 @@ new file mode 100644
 +    }
 +
 +    @Override
-+    public int getCategorySummary(@Nullable @ContentSettingValues int value) {
+    public int getCategorySummary(@Nullable @ContentSetting int value) {
 +        switch (value) {
-+            case ContentSettingValues.ALLOW:
+            case ContentSetting.ALLOW:
 +                return R.string.website_settings_category_webgl_enabled;
-+            case ContentSettingValues.BLOCK:
+            case ContentSetting.BLOCK:
 +                return R.string.website_settings_category_webgl_disabled;
 +            default:
 +                return 0;
@@ -117,8 +117,8 @@ new file mode 100644
 +    }
 +
 +    @Override
-+    public @Nullable Boolean considerException(SiteSettingsCategory category, @ContentSettingValues int value) {
-+        return value != ContentSettingValues.BLOCK;
+    public @Nullable Boolean considerException(SiteSettingsCategory category, @ContentSetting int value) {
+        return value != ContentSetting.BLOCK;
 +    }
 +}
 diff --git a/components/browser_ui/strings/bromite_content_settings/webgl.grdp b/components/browser_ui/strings/bromite_content_settings/webgl.grdp
@@ -166,7 +166,7 @@ new file mode 100644
 +           WebsiteSettingsInfo::TOP_ORIGIN_ONLY_SCOPE,
 +           WebsiteSettingsRegistry::ALL_PLATFORMS,
 +           ContentSettingsInfo::INHERIT_IN_INCOGNITO,
-+           ContentSettingsInfo::EXCEPTIONS_ON_SECURE_AND_INSECURE_ORIGINS);
+           PermissionSettingsInfo::EXCEPTIONS_ON_SECURE_AND_INSECURE_ORIGINS);
 +
 +  content_settings::WebsiteSettingsRegistry::GetInstance()
 +    ->GetMutable(ContentSettingsType::WEBGL)
@@ -189,7 +189,7 @@ new file mode 100644
 diff --git a/third_party/blink/renderer/core/execution_context/execution_context.cc b/third_party/blink/renderer/core/execution_context/execution_context.cc
 --- a/third_party/blink/renderer/core/execution_context/execution_context.cc
 +++ b/third_party/blink/renderer/core/execution_context/execution_context.cc
-@@ -86,6 +86,13 @@ blink::WebContentSettingsClient* GetContentSettingsClientFor(
+@@ -94,6 +94,13 @@ blink::WebContentSettingsClient* GetContentSettingsClientFor(
   return settings;
 }
 
@@ -206,7 +206,7 @@ diff --git a/third_party/blink/renderer/core/execution_context/execution_context
 diff --git a/third_party/blink/renderer/core/execution_context/execution_context.h b/third_party/blink/renderer/core/execution_context/execution_context.h
 --- a/third_party/blink/renderer/core/execution_context/execution_context.h
 +++ b/third_party/blink/renderer/core/execution_context/execution_context.h
-@@ -115,6 +115,8 @@ enum ReasonForCallingCanExecuteScripts {
+@@ -149,6 +149,8 @@ enum ReasonForCallingCanExecuteScripts {
 
 enum ReferrerPolicySource { kPolicySourceHttpHeader, kPolicySourceMetaTag };
 
@@ -218,7 +218,7 @@ diff --git a/third_party/blink/renderer/core/execution_context/execution_context
 diff --git a/third_party/blink/renderer/modules/webgl/webgl_rendering_context_base.cc b/third_party/blink/renderer/modules/webgl/webgl_rendering_context_base.cc
 --- a/third_party/blink/renderer/modules/webgl/webgl_rendering_context_base.cc
 +++ b/third_party/blink/renderer/modules/webgl/webgl_rendering_context_base.cc
-@@ -339,6 +339,13 @@ void WebGLRenderingContextBase::InitializeWebGLContextLimits(
+@@ -341,6 +341,13 @@ void WebGLRenderingContextBase::InitializeWebGLContextLimits(
   }
 }
 
@@ -232,8 +232,8 @@ diff --git a/third_party/blink/renderer/modules/webgl/webgl_rendering_context_ba
 unsigned WebGLRenderingContextBase::CurrentMaxGLContexts() {
   base::AutoLock locker(WebGLContextLimitLock());
   DCHECK(webgl_context_limits_initialized_);
-@@ -608,25 +615,6 @@ static String ExtractWebGLContextCreationError(
-     const Platform::GraphicsInfo& info) {
+@@ -611,25 +618,6 @@ static String ExtractWebGLContextCreationError(
+     const Platform::WebGLContextInfo& info) {
   StringBuilder builder;
   builder.Append("Could not create a WebGL context");
 -  FormatWebGLStatusString(
@@ -258,10 +258,10 @@ diff --git a/third_party/blink/renderer/modules/webgl/webgl_rendering_context_ba
   FormatWebGLStatusString("ErrorMessage", info.error_message.Utf8().c_str(),
                           builder);
   builder.Append('.');
-@@ -686,6 +674,12 @@ WebGLRenderingContextBase::CreateWebGraphicsContext3DProvider(
+@@ -690,6 +678,12 @@ WebGLRenderingContextBase::CreateWebGraphicsContext3DProvider(
     const CanvasContextCreationAttributesCore& attributes,
-     Platform::ContextType context_type,
-     Platform::GraphicsInfo* graphics_info) {
+     Platform::WebGLContextType context_type,
+     Platform::WebGLContextInfo* context_info) {
 +  if (!AllowWebglForHost(host)) {
 +    host->HostDispatchEvent(WebGLContextEvent::Create(
 +        event_type_names::kWebglcontextcreationerror,
@@ -274,7 +274,7 @@ diff --git a/third_party/blink/renderer/modules/webgl/webgl_rendering_context_ba
 diff --git a/third_party/blink/renderer/modules/webgl/webgl_rendering_context_base.h b/third_party/blink/renderer/modules/webgl/webgl_rendering_context_base.h
 --- a/third_party/blink/renderer/modules/webgl/webgl_rendering_context_base.h
 +++ b/third_party/blink/renderer/modules/webgl/webgl_rendering_context_base.h
-@@ -1932,6 +1932,8 @@ class MODULES_EXPORT WebGLRenderingContextBase
+@@ -1965,6 +1965,8 @@ class MODULES_EXPORT WebGLRenderingContextBase
                         DOMArrayBufferView* pixels,
                         int64_t offset);
 
@@ -12,9 +12,9 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 .../bromite_content_settings/webrtc.inc       | 22 +++++
 .../bromite_content_settings/WEBRTC.inc       |  1 +
 .../peer_connection_dependency_factory.cc     |  6 ++
- .../peerconnection/rtc_rtp_receiver.cc        | 10 ++
- .../modules/peerconnection/rtc_rtp_sender.cc  | 10 ++
- 7 files changed, 170 insertions(+)
+ .../peerconnection/rtc_rtp_receiver.cc        | 11 +++
+ .../modules/peerconnection/rtc_rtp_sender.cc  | 11 +++
+ 7 files changed, 172 insertions(+)
 create mode 100644 components/browser_ui/site_settings/android/java/src/org/chromium/components/browser_ui/site_settings/impl/BromiteWebRTCContentSetting.java
 create mode 100644 components/browser_ui/strings/bromite_content_settings/webrtc.grdp
 create mode 100644 components/content_settings/core/browser/bromite_content_settings/webrtc.inc
@@ -49,7 +49,7 @@ new file mode 100644
 +import org.chromium.components.browser_ui.site_settings.BromiteCustomContentSetting;
 +import org.chromium.components.browser_ui.site_settings.ContentSettingsResources;
 +import org.chromium.components.browser_ui.site_settings.SiteSettingsCategory;
-+import org.chromium.components.content_settings.ContentSettingValues;
+import org.chromium.components.content_settings.ContentSetting;
 +import org.chromium.components.content_settings.ContentSettingsType;
 +import org.chromium.content_public.browser.BrowserContextHandle;
 +
@@ -62,8 +62,8 @@ new file mode 100644
 +public class BromiteWebRTCContentSetting extends BromiteCustomContentSetting {
 +    public BromiteWebRTCContentSetting() {
 +        super(/*contentSettingsType*/ ContentSettingsType.WEBRTC,
-+              /*defaultEnabledValue*/ ContentSettingValues.ALLOW,
-+              /*defaultDisabledValue*/ ContentSettingValues.BLOCK,
+              /*defaultEnabledValue*/ ContentSetting.ALLOW,
+              /*defaultDisabledValue*/ ContentSetting.BLOCK,
 +              /*allowException*/ true,
 +              /*preferenceKey*/ "webrtc",
 +              /*profilePrefKey*/ "webrtc");
@@ -82,11 +82,11 @@ new file mode 100644
 +    }
 +
 +    @Override
-+    public int getCategorySummary(@Nullable @ContentSettingValues int value) {
+    public int getCategorySummary(@Nullable @ContentSetting int value) {
 +        switch (value) {
-+            case ContentSettingValues.ALLOW:
+            case ContentSetting.ALLOW:
 +                return R.string.website_settings_category_webrtc_enabled;
-+            case ContentSettingValues.BLOCK:
+            case ContentSetting.BLOCK:
 +                return R.string.website_settings_category_webrtc_disabled;
 +            default:
 +                // this will cause a runtime exception
@@ -115,8 +115,8 @@ new file mode 100644
 +    }
 +
 +    @Override
-+    public @Nullable Boolean considerException(SiteSettingsCategory category, @ContentSettingValues int value) {
-+        return value != ContentSettingValues.BLOCK;
+    public @Nullable Boolean considerException(SiteSettingsCategory category, @ContentSetting int value) {
+        return value != ContentSetting.BLOCK;
 +    }
 +}
 diff --git a/components/browser_ui/strings/bromite_content_settings/webrtc.grdp b/components/browser_ui/strings/bromite_content_settings/webrtc.grdp
@@ -164,7 +164,7 @@ new file mode 100644
 +           WebsiteSettingsInfo::TOP_ORIGIN_ONLY_SCOPE,
 +           WebsiteSettingsRegistry::ALL_PLATFORMS,
 +           ContentSettingsInfo::INHERIT_IN_INCOGNITO,
-+           ContentSettingsInfo::EXCEPTIONS_ON_SECURE_AND_INSECURE_ORIGINS);
+           PermissionSettingsInfo::EXCEPTIONS_ON_SECURE_AND_INSECURE_ORIGINS);
 +
 +  content_settings::WebsiteSettingsRegistry::GetInstance()
 +    ->GetMutable(ContentSettingsType::WEBRTC)
@@ -187,7 +187,7 @@ new file mode 100644
 diff --git a/third_party/blink/renderer/modules/peerconnection/peer_connection_dependency_factory.cc b/third_party/blink/renderer/modules/peerconnection/peer_connection_dependency_factory.cc
 --- a/third_party/blink/renderer/modules/peerconnection/peer_connection_dependency_factory.cc
 +++ b/third_party/blink/renderer/modules/peerconnection/peer_connection_dependency_factory.cc
-@@ -41,6 +41,7 @@
+@@ -47,6 +47,7 @@
 #include "third_party/blink/public/platform/modules/webrtc/webrtc_logging.h"
 #include "third_party/blink/public/platform/platform.h"
 #include "third_party/blink/public/platform/task_type.h"
@@ -195,7 +195,7 @@ diff --git a/third_party/blink/renderer/modules/peerconnection/peer_connection_d
 #include "third_party/blink/public/platform/web_url.h"
 #include "third_party/blink/public/web/modules/mediastream/media_stream_video_source.h"
 #include "third_party/blink/public/web/web_document.h"
-@@ -936,6 +937,11 @@ PeerConnectionDependencyFactory::CreatePortAllocator(
+@@ -1041,6 +1042,11 @@ PeerConnectionDependencyFactory::CreatePortAllocator(
       // |request_multiple_routes|. Whether local IP addresses could be
       // collected depends on if mic/camera permission is granted for this
       // origin.
@@ -210,16 +210,17 @@ diff --git a/third_party/blink/renderer/modules/peerconnection/peer_connection_d
 diff --git a/third_party/blink/renderer/modules/peerconnection/rtc_rtp_receiver.cc b/third_party/blink/renderer/modules/peerconnection/rtc_rtp_receiver.cc
 --- a/third_party/blink/renderer/modules/peerconnection/rtc_rtp_receiver.cc
 +++ b/third_party/blink/renderer/modules/peerconnection/rtc_rtp_receiver.cc
-@@ -16,6 +16,8 @@
- #include "third_party/blink/public/common/privacy_budget/identifiable_surface.h"
- #include "third_party/blink/public/common/privacy_budget/identifiable_token_builder.h"
+@@ -12,6 +12,9 @@
+ #include "base/synchronization/lock.h"
+ #include "base/task/single_thread_task_runner.h"
 #include "third_party/blink/public/platform/modules/webrtc/webrtc_logging.h"
 +#include "third_party/blink/public/platform/web_content_settings_client.h"
 +#include "third_party/blink/public/web/web_local_frame.h"
+#include "third_party/blink/renderer/core/frame/local_dom_window.h"
 #include "third_party/blink/renderer/bindings/core/v8/script_promise_resolver.h"
 #include "third_party/blink/renderer/bindings/modules/v8/v8_rtc_insertable_streams.h"
 #include "third_party/blink/renderer/bindings/modules/v8/v8_rtc_rtcp_parameters.h"
-@@ -288,6 +290,14 @@ RTCRtpCapabilities* RTCRtpReceiver::getCapabilities(ScriptState* state,
+@@ -277,6 +280,14 @@ RTCRtpCapabilities* RTCRtpReceiver::getCapabilities(ScriptState* state,
   if (kind != "audio" && kind != "video")
     return nullptr;
 
@@ -237,16 +238,17 @@ diff --git a/third_party/blink/renderer/modules/peerconnection/rtc_rtp_receiver.
 diff --git a/third_party/blink/renderer/modules/peerconnection/rtc_rtp_sender.cc b/third_party/blink/renderer/modules/peerconnection/rtc_rtp_sender.cc
 --- a/third_party/blink/renderer/modules/peerconnection/rtc_rtp_sender.cc
 +++ b/third_party/blink/renderer/modules/peerconnection/rtc_rtp_sender.cc
-@@ -21,6 +21,8 @@
- #include "third_party/blink/public/common/privacy_budget/identifiable_surface.h"
- #include "third_party/blink/public/common/privacy_budget/identifiable_token_builder.h"
+@@ -17,6 +17,9 @@
+ #include "base/strings/to_string.h"
+ #include "base/task/single_thread_task_runner.h"
 #include "third_party/blink/public/platform/modules/webrtc/webrtc_logging.h"
 +#include "third_party/blink/public/platform/web_content_settings_client.h"
 +#include "third_party/blink/public/web/web_local_frame.h"
+#include "third_party/blink/renderer/core/frame/local_dom_window.h"
 #include "third_party/blink/renderer/bindings/core/v8/script_promise_resolver.h"
 #include "third_party/blink/renderer/bindings/modules/v8/v8_rtc_encoding_options.h"
 #include "third_party/blink/renderer/bindings/modules/v8/v8_rtc_insertable_streams.h"
-@@ -1035,6 +1037,14 @@ RTCRtpCapabilities* RTCRtpSender::getCapabilities(ScriptState* state,
+@@ -1019,6 +1022,14 @@ RTCRtpCapabilities* RTCRtpSender::getCapabilities(ScriptState* state,
   if (kind != "audio" && kind != "video")
     return nullptr;
 
@@ -15,7 +15,7 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/media/PictureInPicture.java b/chrome/android/java/src/org/chromium/chrome/browser/media/PictureInPicture.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/media/PictureInPicture.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/media/PictureInPicture.java
-@@ -27,6 +27,7 @@ public abstract class PictureInPicture {
+@@ -29,6 +29,7 @@ public abstract class PictureInPicture {
      * @return boolean true if Picture-In-Picture is enabled, otherwise false.
      */
     public static boolean isEnabled(Context context) {
@@ -26,15 +26,15 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/media/PictureIn
 diff --git a/third_party/blink/renderer/modules/document_picture_in_picture/picture_in_picture_controller_impl.cc b/third_party/blink/renderer/modules/document_picture_in_picture/picture_in_picture_controller_impl.cc
 --- a/third_party/blink/renderer/modules/document_picture_in_picture/picture_in_picture_controller_impl.cc
 +++ b/third_party/blink/renderer/modules/document_picture_in_picture/picture_in_picture_controller_impl.cc
-@@ -27,6 +27,7 @@
- #include "third_party/blink/renderer/core/html/media/html_media_element.h"
- #include "third_party/blink/renderer/core/html/media/html_video_element.h"
+@@ -31,6 +31,7 @@
 #include "third_party/blink/renderer/core/layout/layout_video.h"
+ #include "third_party/blink/renderer/modules/document_picture_in_picture/document_picture_in_picture.h"
+ #include "third_party/blink/renderer/modules/document_picture_in_picture/document_picture_in_picture_event.h"
 +#include "third_party/blink/renderer/core/loader/document_loader.h"
 #include "third_party/blink/renderer/modules/picture_in_picture/picture_in_picture_event.h"
 #include "third_party/blink/renderer/platform/heap/garbage_collected.h"
 #include "third_party/blink/renderer/platform/runtime_enabled_features.h"
-@@ -392,6 +393,12 @@ void PictureInPictureControllerImpl::CreateDocumentPictureInPictureWindow(
+@@ -388,6 +389,12 @@ void PictureInPictureControllerImpl::CreateDocumentPictureInPictureWindow(
     return;
   }
 
@@ -25,14 +25,14 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 .../blink/renderer/core/frame/local_frame.h      |  3 +++
 .../renderer/core/frame/reporting_context.cc     |  9 +++++++++
 .../renderer/core/frame/reporting_context.h      |  7 +++++--
- .../renderer/core/frame/reporting_observer.cc    |  3 +--
- 22 files changed, 64 insertions(+), 25 deletions(-)
+ .../renderer/core/frame/reporting_observer.cc    |  4 +---
+ 22 files changed, 64 insertions(+), 26 deletions(-)
 create mode 100644 cromite_flags/services/network/public/cpp/features_cc/Allow-building-without-enable_reporting.inc

 diff --git a/chrome/browser/net/chrome_report_sender.cc b/chrome/browser/net/chrome_report_sender.cc
 --- a/chrome/browser/net/chrome_report_sender.cc
 +++ b/chrome/browser/net/chrome_report_sender.cc
-@@ -85,6 +85,7 @@ void SendReport(
+@@ -88,6 +88,7 @@ void SendReport(
     const std::string& report,
     base::OnceClosure success_callback,
     ErrorCallback error_callback) {
@@ -43,7 +43,7 @@ diff --git a/chrome/browser/net/chrome_report_sender.cc b/chrome/browser/net/chr
 diff --git a/content/browser/devtools/protocol/network_handler.cc b/content/browser/devtools/protocol/network_handler.cc
 --- a/content/browser/devtools/protocol/network_handler.cc
 +++ b/content/browser/devtools/protocol/network_handler.cc
-@@ -1484,6 +1484,7 @@ String BuildReportStatus(const net::ReportingReport::Status status) {
+@@ -1517,6 +1517,7 @@ String BuildReportStatus(const net::ReportingReport::Status status) {
   }
 }
 
@@ -51,7 +51,7 @@ diff --git a/content/browser/devtools/protocol/network_handler.cc b/content/brow
 std::vector<GURL> ComputeReportingURLs(RenderFrameHostImpl* frame_host) {
   std::vector<GURL> urls;
   frame_host->ForEachRenderFrameHostImplWithAction(
-@@ -1497,6 +1498,7 @@ std::vector<GURL> ComputeReportingURLs(RenderFrameHostImpl* frame_host) {
+@@ -1530,6 +1531,7 @@ std::vector<GURL> ComputeReportingURLs(RenderFrameHostImpl* frame_host) {
       });
   return urls;
 }
@@ -106,9 +106,9 @@ diff --git a/content/browser/network/reporting_service_proxy.cc b/content/browse
 #include "base/values.h"
 +#include "net/base/features.h"
 #include "content/browser/service_worker/service_worker_host.h"
+ #include "content/browser/shared_storage/shared_storage_worklet_host.h"
 #include "content/browser/worker_host/dedicated_worker_host.h"
- #include "content/browser/worker_host/shared_worker_host.h"
-@@ -240,12 +241,14 @@ class ReportingServiceProxyImpl : public blink::mojom::ReportingServiceProxy {
+@@ -241,12 +242,14 @@ class ReportingServiceProxyImpl : public blink::mojom::ReportingServiceProxy {
                    const std::string& group,
                    const std::string& type,
                    base::Value::Dict body) {
@@ -126,7 +126,7 @@ diff --git a/content/browser/network/reporting_service_proxy.cc b/content/browse
 diff --git a/content/browser/renderer_host/render_frame_host_impl.cc b/content/browser/renderer_host/render_frame_host_impl.cc
 --- a/content/browser/renderer_host/render_frame_host_impl.cc
 +++ b/content/browser/renderer_host/render_frame_host_impl.cc
-@@ -15928,12 +15928,6 @@ void RenderFrameHostImpl::MaybeGenerateCrashReport(
+@@ -16347,12 +16347,6 @@ void RenderFrameHostImpl::MaybeGenerateCrashReport(
       }
     }
   }
@@ -281,7 +281,7 @@ new file mode 100644
 diff --git a/net/reporting/reporting_header_parser.cc b/net/reporting/reporting_header_parser.cc
 --- a/net/reporting/reporting_header_parser.cc
 +++ b/net/reporting/reporting_header_parser.cc
-@@ -337,6 +337,7 @@ void ReportingHeaderParser::ProcessParsedReportingEndpointsHeader(
+@@ -344,6 +344,7 @@ void ReportingHeaderParser::ProcessParsedReportingEndpointsHeader(
     const NetworkAnonymizationKey& network_anonymization_key,
     const url::Origin& origin,
     base::flat_map<std::string, std::string> header) {
@@ -308,7 +308,7 @@ diff --git a/net/reporting/reporting_service.cc b/net/reporting/reporting_servic
 diff --git a/services/network/network_context.h b/services/network/network_context.h
 --- a/services/network/network_context.h
 +++ b/services/network/network_context.h
-@@ -486,14 +486,14 @@ class COMPONENT_EXPORT(NETWORK_SERVICE) NetworkContext
+@@ -499,14 +499,14 @@ class COMPONENT_EXPORT(NETWORK_SERVICE) NetworkContext
       const GURL& url,
       const std::optional<base::UnguessableToken>& reporting_source,
       const net::NetworkAnonymizationKey& network_anonymization_key,
@@ -329,7 +329,7 @@ diff --git a/services/network/network_context.h b/services/network/network_conte
 diff --git a/services/network/public/cpp/parsed_headers.cc b/services/network/public/cpp/parsed_headers.cc
 --- a/services/network/public/cpp/parsed_headers.cc
 +++ b/services/network/public/cpp/parsed_headers.cc
-@@ -125,6 +125,7 @@ mojom::ParsedHeadersPtr PopulateParsedHeaders(
+@@ -140,6 +140,7 @@ mojom::ParsedHeadersPtr PopulateParsedHeaders(
   }
 
 #if BUILDFLAG(ENABLE_REPORTING)
@@ -340,7 +340,7 @@ diff --git a/services/network/public/cpp/parsed_headers.cc b/services/network/pu
 diff --git a/services/network/public/mojom/BUILD.gn b/services/network/public/mojom/BUILD.gn
 --- a/services/network/public/mojom/BUILD.gn
 +++ b/services/network/public/mojom/BUILD.gn
-@@ -1791,7 +1791,6 @@ mojom("mojom") {
+@@ -1833,7 +1833,6 @@ mojom("mojom") {
     export_define_blink = "BLINK_PLATFORM_IMPLEMENTATION=1"
     export_header_blink = "third_party/blink/public/platform/web_common.h"
     if (enable_reporting) {
@@ -351,7 +351,7 @@ diff --git a/services/network/public/mojom/BUILD.gn b/services/network/public/mo
 diff --git a/services/network/public/mojom/network_context.mojom b/services/network/public/mojom/network_context.mojom
 --- a/services/network/public/mojom/network_context.mojom
 +++ b/services/network/public/mojom/network_context.mojom
-@@ -1234,6 +1234,7 @@ interface NetworkContext {
+@@ -1245,6 +1245,7 @@ interface NetworkContext {
   // provided `network_anonymization_key`.
   //
   // Spec: https://w3c.github.io/reporting/#concept-reports
@@ -359,7 +359,7 @@ diff --git a/services/network/public/mojom/network_context.mojom b/services/netw
   QueueReport(string type,
               string group,
               url.mojom.Url url,
-@@ -1241,6 +1242,7 @@ interface NetworkContext {
+@@ -1252,6 +1253,7 @@ interface NetworkContext {
               NetworkAnonymizationKey network_anonymization_key,
               mojo_base.mojom.DictionaryValue body);
 
@@ -367,7 +367,7 @@ diff --git a/services/network/public/mojom/network_context.mojom b/services/netw
   QueueEnterpriseReport(string type,
                         string group,
                         url.mojom.Url url,
-@@ -1251,6 +1253,7 @@ interface NetworkContext {
+@@ -1262,6 +1264,7 @@ interface NetworkContext {
   // Note that this queued report will never be delivered if no reporting
   // endpoint matching is registered for with the provided
   // `network_anonymization_key`.
@@ -386,15 +386,15 @@ diff --git a/third_party/blink/renderer/core/frame/csp/content_security_policy.c
 #include "base/containers/contains.h"
 #include "base/debug/dump_without_crashing.h"
 #include "base/feature_list.h"
-@@ -1260,6 +1261,7 @@ void ContentSecurityPolicy::ReportViolation(
+@@ -1355,6 +1356,7 @@ void ContentSecurityPolicy::ReportViolation(
+       ShouldBypassContentSecurityPolicy(KURL(violation_data->sourceFile()))) {
     return;
   }
- 
 +#if BUILDFLAG(ENABLE_REPORTING)
   PostViolationReport(violation_data, context_frame, report_endpoints,
                       use_reporting_api);
 
-@@ -1267,6 +1269,7 @@ void ContentSecurityPolicy::ReportViolation(
+@@ -1362,6 +1364,7 @@ void ContentSecurityPolicy::ReportViolation(
   // `context_frame` (i.e. we're not processing 'frame-ancestors').
   if (delegate_ && !context_frame)
     delegate_->DispatchViolationEvent(*violation_data, element);
@@ -405,7 +405,7 @@ diff --git a/third_party/blink/renderer/core/frame/csp/content_security_policy.c
 diff --git a/third_party/blink/renderer/core/frame/local_frame.cc b/third_party/blink/renderer/core/frame/local_frame.cc
 --- a/third_party/blink/renderer/core/frame/local_frame.cc
 +++ b/third_party/blink/renderer/core/frame/local_frame.cc
-@@ -47,6 +47,7 @@
+@@ -49,6 +49,7 @@
 #include "build/build_config.h"
 #include "mojo/public/cpp/bindings/self_owned_receiver.h"
 #include "mojo/public/cpp/system/message_pipe.h"
@@ -413,7 +413,7 @@ diff --git a/third_party/blink/renderer/core/frame/local_frame.cc b/third_party/
 #include "services/network/public/cpp/features.h"
 #include "services/network/public/mojom/content_security_policy.mojom-blink.h"
 #include "services/network/public/mojom/source_location.mojom-blink.h"
-@@ -2740,9 +2741,11 @@ DocumentResourceCoordinator* LocalFrame::GetDocumentResourceCoordinator() {
+@@ -2871,9 +2872,11 @@ DocumentResourceCoordinator* LocalFrame::GetDocumentResourceCoordinator() {
   return CHECK_DEREF(GetDocument()).GetResourceCoordinator();
 }
 
@@ -428,15 +428,15 @@ diff --git a/third_party/blink/renderer/core/frame/local_frame.cc b/third_party/
 diff --git a/third_party/blink/renderer/core/frame/local_frame.h b/third_party/blink/renderer/core/frame/local_frame.h
 --- a/third_party/blink/renderer/core/frame/local_frame.h
 +++ b/third_party/blink/renderer/core/frame/local_frame.h
-@@ -37,6 +37,7 @@
- #include "base/time/time.h"
+@@ -38,6 +38,7 @@
 #include "base/unguessable_token.h"
 #include "build/build_config.h"
-+#include "net/net_buildflags.h"
- #include "mojo/public/cpp/bindings/pending_associated_receiver.h"
 #include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "net/net_buildflags.h"
 #include "net/storage_access_api/status.h"
-@@ -667,7 +668,9 @@ class CORE_EXPORT LocalFrame final
+ #include "services/metrics/public/cpp/ukm_source_id.h"
+ #include "services/network/public/mojom/fetch_api.mojom-blink-forward.h"
+@@ -670,7 +671,9 @@ class CORE_EXPORT LocalFrame final
     return client_hints_preferences_;
   }
 
@@ -457,17 +457,17 @@ diff --git a/third_party/blink/renderer/core/frame/reporting_context.cc b/third_
 #include "third_party/blink/public/platform/browser_interface_broker_proxy.h"
 #include "third_party/blink/public/platform/platform.h"
 #include "third_party/blink/public/platform/task_type.h"
-@@ -59,7 +60,9 @@ const char ReportingContext::kSupplementName[] = "ReportingContext";
+@@ -55,7 +56,9 @@ bool ShouldReportBeVisibleToObservers(Report* report) {
+ 
 ReportingContext::ReportingContext(ExecutionContext& context)
-     : Supplement<ExecutionContext>(context),
-       execution_context_(context),
+     : execution_context_(context),
 +#if BUILDFLAG(ENABLE_REPORTING)
       reporting_service_(&context),
 +#endif
       receivers_(this, &context) {}
 
 // static
-@@ -126,7 +129,9 @@ void ReportingContext::Trace(Visitor* visitor) const {
+@@ -121,7 +124,9 @@ void ReportingContext::Trace(Visitor* visitor) const {
   visitor->Trace(observers_);
   visitor->Trace(report_buffer_);
   visitor->Trace(execution_context_);
@@ -475,9 +475,9 @@ diff --git a/third_party/blink/renderer/core/frame/reporting_context.cc b/third_
   visitor->Trace(reporting_service_);
 +#endif
   visitor->Trace(receivers_);
-   Supplement<ExecutionContext>::Trace(visitor);
 }
-@@ -149,6 +154,7 @@ void ReportingContext::CountReport(Report* report) {
+ 
+@@ -143,6 +148,7 @@ void ReportingContext::CountReport(Report* report) {
   UseCounter::Count(execution_context_, feature);
 }
 
@@ -485,7 +485,7 @@ diff --git a/third_party/blink/renderer/core/frame/reporting_context.cc b/third_
 const HeapMojoRemote<mojom::blink::ReportingServiceProxy>&
 ReportingContext::GetReportingService() const {
   if (!reporting_service_.is_bound()) {
-@@ -158,6 +164,7 @@ ReportingContext::GetReportingService() const {
+@@ -152,6 +158,7 @@ ReportingContext::GetReportingService() const {
   }
   return reporting_service_;
 }
@@ -493,7 +493,7 @@ diff --git a/third_party/blink/renderer/core/frame/reporting_context.cc b/third_
 
 void ReportingContext::NotifyInternal(Report* report) {
   if (!ShouldReportBeVisibleToObservers(report)) {
-@@ -184,6 +191,7 @@ void ReportingContext::NotifyInternal(Report* report) {
+@@ -178,6 +185,7 @@ void ReportingContext::NotifyInternal(Report* report) {
 
 void ReportingContext::SendToReportingAPI(Report* report,
                                           const String& endpoint) const {
@@ -501,7 +501,7 @@ diff --git a/third_party/blink/renderer/core/frame/reporting_context.cc b/third_
   const String& type = report->type();
   if (!(type == ReportType::kCSPViolation || type == ReportType::kCSPHash ||
         type == ReportType::kDeprecation ||
-@@ -263,6 +271,7 @@ void ReportingContext::SendToReportingAPI(Report* report,
+@@ -262,6 +270,7 @@ void ReportingContext::SendToReportingAPI(Report* report,
         url, endpoint, body->featureId(), body->disposition(), body->message(),
         body->sourceFile(), line_number, column_number);
   }
@@ -520,7 +520,7 @@ diff --git a/third_party/blink/renderer/core/frame/reporting_context.h b/third_p
 #include "third_party/blink/public/mojom/frame/reporting_observer.mojom-blink.h"
 #include "third_party/blink/public/mojom/reporting/reporting.mojom-blink.h"
 #include "third_party/blink/renderer/core/core_export.h"
-@@ -56,10 +57,10 @@ class CORE_EXPORT ReportingContext : public GarbageCollected<ReportingContext>,
+@@ -52,10 +53,10 @@ class CORE_EXPORT ReportingContext : public GarbageCollected<ReportingContext>,
  private:
   // Counts the use of a report type via UseCounter.
   void CountReport(Report*);
@@ -533,7 +533,7 @@ diff --git a/third_party/blink/renderer/core/frame/reporting_context.h b/third_p
   void NotifyInternal(Report* report);
   // Send |report| via the Reporting API to |endpoint|.
   void SendToReportingAPI(Report* report, const String& endpoint) const;
-@@ -71,8 +72,10 @@ class CORE_EXPORT ReportingContext : public GarbageCollected<ReportingContext>,
+@@ -67,8 +68,10 @@ class CORE_EXPORT ReportingContext : public GarbageCollected<ReportingContext>,
 
   // This is declared mutable so that the service endpoint can be cached by
   // const methods.
@@ -547,12 +547,13 @@ diff --git a/third_party/blink/renderer/core/frame/reporting_context.h b/third_p
 diff --git a/third_party/blink/renderer/core/frame/reporting_observer.cc b/third_party/blink/renderer/core/frame/reporting_observer.cc
 --- a/third_party/blink/renderer/core/frame/reporting_observer.cc
 +++ b/third_party/blink/renderer/core/frame/reporting_observer.cc
-@@ -62,8 +62,7 @@ void ReportingObserver::QueueReport(Report* report) {
+@@ -61,9 +61,7 @@ void ReportingObserver::QueueReport(Report* report) {
 }
 
 bool ReportingObserver::ObservedType(const String& type) {
-  return !options_->hasTypesNonNull() || options_->typesNonNull().empty() ||
-         options_->typesNonNull().Find(type) != kNotFound;
+-  return !options_->hasTypes() || !options_->types() ||
+-         options_->types()->empty() ||
+-         options_->types()->Find(type) != kNotFound;
 +  return false;
 }
 
@@ -17,25 +17,25 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 .../core/browser/supervised_user_pref_store.cc             | 1 +
 .../core/browser/supervised_user_preferences.cc            | 6 +++++-
 .../core/browser/supervised_user_service.cc                | 1 +
- components/supervised_user/core/common/features.cc         | 2 +-
+ components/supervised_user/core/common/features.cc         | 3 ++-
 extensions/browser/api/management/management_api.cc        | 1 +
- 15 files changed, 13 insertions(+), 27 deletions(-)
+ 15 files changed, 14 insertions(+), 27 deletions(-)

 diff --git a/chrome/android/BUILD.gn b/chrome/android/BUILD.gn
 --- a/chrome/android/BUILD.gn
 +++ b/chrome/android/BUILD.gn
-@@ -805,7 +805,6 @@ if (_is_default_toolchain) {
+@@ -815,7 +815,6 @@ if (_is_default_toolchain) {
       "//components/offline_pages/core:offline_page_model_enums_java",
       "//components/sharing_message:sharing_dialog_type_generated_enum",
       "//components/sharing_message:sharing_send_message_result_generated_enum",
 -      "//components/supervised_user/core/browser:supervised_user_utils_enum_javagen",
+       "//components/touch_to_search/core/browser:quick_action_category_enum_javagen",
     ]
 
-     # From java_sources.gni.
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/feedback/ChromeFeedbackCollector.java b/chrome/android/java/src/org/chromium/chrome/browser/feedback/ChromeFeedbackCollector.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/feedback/ChromeFeedbackCollector.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/feedback/ChromeFeedbackCollector.java
-@@ -93,7 +93,6 @@ public class ChromeFeedbackCollector extends FeedbackCollector<ChromeFeedbackCol
+@@ -95,7 +95,6 @@ public class ChromeFeedbackCollector extends FeedbackCollector<ChromeFeedbackCol
         // FamilyInfoFeedbackSource relies on IdentityManager which is not available for the
         // incognito profile.
         if (!initParams.profile.isOffTheRecord()) {
@@ -65,19 +65,19 @@ diff --git a/chrome/browser/feedback/android/BUILD.gn b/chrome/browser/feedback/
 diff --git a/chrome/browser/prefs/chrome_pref_service_factory.cc b/chrome/browser/prefs/chrome_pref_service_factory.cc
 --- a/chrome/browser/prefs/chrome_pref_service_factory.cc
 +++ b/chrome/browser/prefs/chrome_pref_service_factory.cc
-@@ -328,7 +328,7 @@ void PrepareFactory(
+@@ -332,7 +332,7 @@ void PrepareFactory(
     policy::BrowserPolicyConnector* policy_connector) {
   factory->SetManagedPolicies(policy_service, policy_connector);
   factory->SetRecommendedPolicies(policy_service, policy_connector);
 -  if (supervised_user_settings) {
 +  if (((false)) && supervised_user_settings) {
+     // supervised_user_prefs handles the case when content_filters_service is
+     // nullptr. It's simply not subscribing to empty service's notifications.
     scoped_refptr<PrefStore> supervised_user_prefs =
-         base::MakeRefCounted<SupervisedUserPrefStore>(supervised_user_settings);
-     DCHECK(async || supervised_user_prefs->IsInitializationComplete());
 diff --git a/chrome/browser/profiles/profile_attributes_entry.cc b/chrome/browser/profiles/profile_attributes_entry.cc
 --- a/chrome/browser/profiles/profile_attributes_entry.cc
 +++ b/chrome/browser/profiles/profile_attributes_entry.cc
-@@ -467,7 +467,7 @@ bool ProfileAttributesEntry::IsSigninRequired() const {
+@@ -476,7 +476,7 @@ bool ProfileAttributesEntry::IsSigninRequired() const {
 }
 
 std::string ProfileAttributesEntry::GetSupervisedUserId() const {
@@ -89,7 +89,7 @@ diff --git a/chrome/browser/profiles/profile_attributes_entry.cc b/chrome/browse
 diff --git a/chrome/browser/profiles/profile_impl.cc b/chrome/browser/profiles/profile_impl.cc
 --- a/chrome/browser/profiles/profile_impl.cc
 +++ b/chrome/browser/profiles/profile_impl.cc
-@@ -674,10 +674,6 @@ void ProfileImpl::DoFinalInit(CreateMode create_mode) {
+@@ -679,10 +679,6 @@ void ProfileImpl::DoFinalInit(CreateMode create_mode) {
     prefs->SetTime(prefs::kProfileCreationTime, path_creation_time_);
 
   pref_change_registrar_.Init(prefs);
@@ -100,7 +100,7 @@ diff --git a/chrome/browser/profiles/profile_impl.cc b/chrome/browser/profiles/p
 
   // Changes in the profile avatar.
   pref_change_registrar_.Add(
-@@ -1619,6 +1615,7 @@ GURL ProfileImpl::GetHomePage() {
+@@ -1603,6 +1599,7 @@ GURL ProfileImpl::GetHomePage() {
 }
 
 void ProfileImpl::UpdateSupervisedUserIdInStorage() {
@@ -111,7 +111,7 @@ diff --git a/chrome/browser/profiles/profile_impl.cc b/chrome/browser/profiles/p
 diff --git a/chrome/browser/profiles/profile_manager.cc b/chrome/browser/profiles/profile_manager.cc
 --- a/chrome/browser/profiles/profile_manager.cc
 +++ b/chrome/browser/profiles/profile_manager.cc
-@@ -1192,10 +1192,6 @@ void ProfileManager::InitProfileUserPrefs(Profile* profile) {
+@@ -1262,10 +1262,6 @@ void ProfileManager::InitProfileUserPrefs(Profile* profile) {
     profile->GetPrefs()->SetString(prefs::kProfileName, profile_name);
   }
 
@@ -119,10 +119,10 @@ diff --git a/chrome/browser/profiles/profile_manager.cc b/chrome/browser/profile
 -    profile->GetPrefs()->SetString(prefs::kSupervisedUserId,
 -                                   supervised_user_id);
 -  }
- #if !BUILDFLAG(IS_ANDROID)
-   if (profile->IsNewProfile()) {
-     profile->GetPrefs()->SetBoolean(prefs::kHasSeenWelcomePage, false);
-@@ -1978,9 +1974,6 @@ void ProfileManager::AddProfileToStorage(Profile* profile) {
+ }
+ 
+ void ProfileManager::RegisterTestingProfile(std::unique_ptr<Profile> profile,
+@@ -2044,9 +2040,6 @@ void ProfileManager::AddProfileToStorage(Profile* profile) {
   init_params.icon_index =
       profile->GetPrefs()->GetInteger(prefs::kProfileAvatarIndex);
 
@@ -135,7 +135,7 @@ diff --git a/chrome/browser/profiles/profile_manager.cc b/chrome/browser/profile
 diff --git a/chrome/browser/supervised_user/supervised_user_browser_utils.cc b/chrome/browser/supervised_user/supervised_user_browser_utils.cc
 --- a/chrome/browser/supervised_user/supervised_user_browser_utils.cc
 +++ b/chrome/browser/supervised_user/supervised_user_browser_utils.cc
-@@ -99,6 +99,7 @@ bool SupervisedUserCanSkipExtensionParentApprovals(const Profile* profile) {
+@@ -98,6 +98,7 @@ bool SupervisedUserCanSkipExtensionParentApprovals(const Profile* profile) {
 }
 
 bool AreExtensionsPermissionsEnabled(Profile* profile) {
@@ -160,7 +160,7 @@ diff --git a/chrome/browser/ui/webui/managed_ui_handler.cc b/chrome/browser/ui/w
 diff --git a/chrome/browser/ui/webui/management/management_ui_handler.cc b/chrome/browser/ui/webui/management/management_ui_handler.cc
 --- a/chrome/browser/ui/webui/management/management_ui_handler.cc
 +++ b/chrome/browser/ui/webui/management/management_ui_handler.cc
-@@ -595,10 +595,6 @@ bool ManagementUIHandler::managed() const {
+@@ -623,10 +623,6 @@ bool ManagementUIHandler::managed() const {
 
 void ManagementUIHandler::RegisterPrefChange(
     PrefChangeRegistrar& pref_registrar) {
@@ -174,7 +174,7 @@ diff --git a/chrome/browser/ui/webui/management/management_ui_handler.cc b/chrom
 diff --git a/components/supervised_user/core/browser/supervised_user_pref_store.cc b/components/supervised_user/core/browser/supervised_user_pref_store.cc
 --- a/components/supervised_user/core/browser/supervised_user_pref_store.cc
 +++ b/components/supervised_user/core/browser/supervised_user_pref_store.cc
-@@ -142,6 +142,7 @@ SupervisedUserPrefStore::~SupervisedUserPrefStore() = default;
+@@ -172,6 +172,7 @@ void SupervisedUserPrefStore::OnNewContentFiltersStateAvailable(
 
 void SupervisedUserPrefStore::OnNewSettingsAvailable(
     const base::Value::Dict& settings) {
@@ -185,7 +185,7 @@ diff --git a/components/supervised_user/core/browser/supervised_user_pref_store.
 diff --git a/components/supervised_user/core/browser/supervised_user_preferences.cc b/components/supervised_user/core/browser/supervised_user_preferences.cc
 --- a/components/supervised_user/core/browser/supervised_user_preferences.cc
 +++ b/components/supervised_user/core/browser/supervised_user_preferences.cc
-@@ -164,6 +164,10 @@ void RegisterProfilePrefs(PrefRegistrySimple* registry) {
+@@ -160,6 +160,10 @@ void RegisterProfilePrefs(PrefRegistrySimple* registry) {
 }
 
 void EnableParentalControls(PrefService& pref_service) {
@@ -196,7 +196,7 @@ diff --git a/components/supervised_user/core/browser/supervised_user_preferences
   pref_service.SetString(prefs::kSupervisedUserId,
                          supervised_user::kChildAccountSUID);
 #if BUILDFLAG(IS_CHROMEOS)
-@@ -197,7 +201,7 @@ bool IsSafeSitesEnabled(const PrefService& pref_service) {
+@@ -187,7 +191,7 @@ bool IsSafeSitesEnabled(const PrefService& pref_service) {
 }
 
 bool IsSubjectToParentalControls(const PrefService& pref_service) {
@@ -208,7 +208,7 @@ diff --git a/components/supervised_user/core/browser/supervised_user_preferences
 diff --git a/components/supervised_user/core/browser/supervised_user_service.cc b/components/supervised_user/core/browser/supervised_user_service.cc
 --- a/components/supervised_user/core/browser/supervised_user_service.cc
 +++ b/components/supervised_user/core/browser/supervised_user_service.cc
-@@ -168,6 +168,7 @@ SupervisedUserService::SupervisedUserService(
+@@ -244,6 +244,7 @@ SupervisedUserService::SupervisedUserService(
 }
 
 void SupervisedUserService::SetSettingsServiceActive(bool active) {
@@ -219,7 +219,7 @@ diff --git a/components/supervised_user/core/browser/supervised_user_service.cc
 diff --git a/components/supervised_user/core/common/features.cc b/components/supervised_user/core/common/features.cc
 --- a/components/supervised_user/core/common/features.cc
 +++ b/components/supervised_user/core/common/features.cc
-@@ -35,7 +35,6 @@ BASE_FEATURE(kAllowSubframeLocalWebApprovals,
+@@ -30,7 +30,6 @@ BASE_FEATURE(kAllowSubframeLocalWebApprovals,
 #else
              base::FEATURE_DISABLED_BY_DEFAULT);
 #endif
@@ -227,16 +227,24 @@ diff --git a/components/supervised_user/core/common/features.cc b/components/sup
 #if BUILDFLAG(IS_IOS) || BUILDFLAG(IS_MAC) || BUILDFLAG(IS_LINUX) || \
     BUILDFLAG(IS_WIN)
 const int kLocalWebApprovalBottomSheetLoadTimeoutDefaultValueMs = 5000;
-@@ -148,4 +147,5 @@ BASE_FEATURE(kDecoupleSafeSitesFromMainSwitch,
-              "DecoupleSafeSitesFromMainSwitch",
-              base::FEATURE_ENABLED_BY_DEFAULT);
+@@ -116,6 +115,7 @@ const base::FeatureParam<std::string>
+ 
+ namespace {
+ bool PlatformSupportsLocalSupervision() {
+  if ((true)) return false;
+   int32_t major, minor, bugfix;
+   base::SysInfo::OperatingSystemVersionNumbers(&major, &minor, &bugfix);
+   bool supported_by_os = (major == 16 && minor >= 1) || major > 16;
+@@ -151,4 +151,5 @@ bool ClassifyUrlWithoutCredentialsForLocalSupervision() {
+ 
+ #endif
 
 +SET_CROMITE_FEATURE_DISABLED(kLocalWebApprovals);
 }  // namespace supervised_user
 diff --git a/extensions/browser/api/management/management_api.cc b/extensions/browser/api/management/management_api.cc
 --- a/extensions/browser/api/management/management_api.cc
 +++ b/extensions/browser/api/management/management_api.cc
-@@ -310,6 +310,7 @@ void AddExtensionInfo(const Extension* source_extension,
+@@ -324,6 +324,7 @@ void AddExtensionInfo(const Extension* source_extension,
 }
 
 bool PlatformSupportsApprovalFlowForExtensions() {
@@ -4,15 +4,27 @@ Subject: Allow playing audio in background

 License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 ---
+ .../renderer/render_frame_media_playback_options.cc   |  1 +
 .../renderer/platform/media/web_media_player_impl.cc  | 11 ++++++++++-
 .../renderer/platform/media/web_media_player_impl.h   |  3 +++
- 2 files changed, 13 insertions(+), 1 deletion(-)
+ 3 files changed, 14 insertions(+), 1 deletion(-)

+diff --git a/content/public/renderer/render_frame_media_playback_options.cc b/content/public/renderer/render_frame_media_playback_options.cc
+--- a/content/public/renderer/render_frame_media_playback_options.cc
+++ b/content/public/renderer/render_frame_media_playback_options.cc
+@@ -14,6 +14,7 @@
+ 
+ namespace content {
+ bool IsBackgroundMediaSuspendEnabled() {
+  if ((true)) return false;
+ #if BUILDFLAG(IS_ANDROID)
+   // For Android devices, do not suspend background media for devices with large
+   // displays. Exception is for Webview.
 diff --git a/third_party/blink/renderer/platform/media/web_media_player_impl.cc b/third_party/blink/renderer/platform/media/web_media_player_impl.cc
 --- a/third_party/blink/renderer/platform/media/web_media_player_impl.cc
 +++ b/third_party/blink/renderer/platform/media/web_media_player_impl.cc
-@@ -1340,6 +1340,12 @@ void WebMediaPlayerImpl::OnSelectedVideoTrackChanged(
-   pipeline_controller_->OnSelectedVideoTrackChanged(selected);
+@@ -1287,6 +1287,12 @@ bool WebMediaPlayerImpl::HasAudio() const {
+   return pipeline_metadata_.has_audio;
 }
 
 +bool WebMediaPlayerImpl::HasVideoNonEmptySize() const {
@@ -22,11 +34,11 @@ diff --git a/third_party/blink/renderer/platform/media/web_media_player_impl.cc
 +}
 +
 void WebMediaPlayerImpl::EnabledAudioTracksChanged(
-     const std::vector<WebMediaPlayer::TrackId>& enabled_track_ids) {
+     std::optional<WebMediaPlayer::TrackId> enabled_track_id) {
   DCHECK(main_task_runner_->BelongsToCurrentThread());
-@@ -3710,7 +3716,10 @@ bool WebMediaPlayerImpl::ShouldPausePlaybackWhenHidden() const {
-           : HasAudio();
+@@ -3654,7 +3660,10 @@ bool WebMediaPlayerImpl::ShouldPausePlaybackWhenHidden() const {
 
+   const bool preserve_audio = HasUnmutedAudio() || audio_source_provider_->IsAudioBeingCaptured();
   // Audio only stream is allowed to play when in background.
 -  if (!HasVideo() && preserve_audio)
 +  //pipeline_metadata_.has_video is true for MediaPlayerRenderer,
@@ -39,7 +51,7 @@ diff --git a/third_party/blink/renderer/platform/media/web_media_player_impl.cc
 diff --git a/third_party/blink/renderer/platform/media/web_media_player_impl.h b/third_party/blink/renderer/platform/media/web_media_player_impl.h
 --- a/third_party/blink/renderer/platform/media/web_media_player_impl.h
 +++ b/third_party/blink/renderer/platform/media/web_media_player_impl.h
-@@ -212,6 +212,9 @@ class PLATFORM_EXPORT WebMediaPlayerImpl
+@@ -211,6 +211,9 @@ class PLATFORM_EXPORT WebMediaPlayerImpl
   bool HasVideo() const override;
   bool HasAudio() const override;
 
@@ -47,6 +59,6 @@ diff --git a/third_party/blink/renderer/platform/media/web_media_player_impl.h b
 +  bool HasVideoNonEmptySize() const;
 +
   void EnabledAudioTracksChanged(
-       const std::vector<WebMediaPlayer::TrackId>& enabled_track_ids) override;
+       std::optional<WebMediaPlayer::TrackId> enabled_track_id) override;
   void SelectedVideoTrackChanged(
 --
@@ -12,7 +12,7 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 diff --git a/chrome/browser/resources/inspect/inspect.js b/chrome/browser/resources/inspect/inspect.js
 --- a/chrome/browser/resources/inspect/inspect.js
 +++ b/chrome/browser/resources/inspect/inspect.js
-@@ -45,6 +45,7 @@ if ('browser-inspector' in queryParamsObject) {
+@@ -46,6 +46,7 @@ if ('browser-inspector' in queryParamsObject) {
 })();
 
 function isVersionNewerThanHost(version) {
@@ -20,7 +20,7 @@ diff --git a/chrome/browser/resources/inspect/inspect.js b/chrome/browser/resour
   if (!HOST_CHROME_VERSION) {
     return false;
   }
-@@ -566,7 +567,7 @@ function formatValue(data, property) {
+@@ -597,7 +598,7 @@ function formatValue(data, property) {
 function addFavicon(row, data) {
   const favicon = document.createElement('img');
   if (data['faviconUrl']) {
@@ -10,15 +10,15 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tab/TabContextMenuItemDelegate.java b/chrome/android/java/src/org/chromium/chrome/browser/tab/TabContextMenuItemDelegate.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/tab/TabContextMenuItemDelegate.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/tab/TabContextMenuItemDelegate.java
-@@ -21,6 +21,7 @@ import org.chromium.base.IntentUtils;
- import org.chromium.base.PackageManagerUtils;
+@@ -23,6 +23,7 @@ import org.chromium.base.PackageManagerUtils;
 import org.chromium.base.metrics.RecordUserAction;
- import org.chromium.base.supplier.Supplier;
+ import org.chromium.build.annotations.NullMarked;
+ import org.chromium.build.annotations.Nullable;
 +import org.chromium.cc.input.BrowserControlsState;
 import org.chromium.chrome.browser.DefaultBrowserInfo;
 import org.chromium.chrome.browser.IntentHandler;
 import org.chromium.chrome.browser.bookmarks.BookmarkManagerOpenerImpl;
-@@ -38,6 +39,7 @@ import org.chromium.chrome.browser.preferences.Pref;
+@@ -45,6 +46,7 @@ import org.chromium.chrome.browser.preferences.Pref;
 import org.chromium.chrome.browser.price_tracking.PriceDropNotificationManagerFactory;
 import org.chromium.chrome.browser.printing.TabPrinter;
 import org.chromium.chrome.browser.profiles.Profile;
@@ -26,18 +26,18 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tab/TabContextM
 import org.chromium.chrome.browser.tabmodel.TabModelSelector;
 import org.chromium.chrome.browser.tabmodel.document.ChromeAsyncTabLauncher;
 import org.chromium.chrome.browser.ui.messages.snackbar.SnackbarManager;
-@@ -290,6 +292,7 @@ public class TabContextMenuItemDelegate implements ContextMenuItemDelegate {
-             Referrer referrer,
+@@ -348,6 +350,7 @@ public class TabContextMenuItemDelegate implements ContextMenuItemDelegate {
+             @Nullable Referrer referrer,
             boolean navigateToTab,
             @Nullable AdditionalNavigationParams additionalNavigationParams) {
 +        TabBrowserControlsConstraintsHelper.get(mTab).update(BrowserControlsState.SHOWN, true);
         RecordUserAction.record("MobileNewTabOpened");
         RecordUserAction.record("LinkOpenedInNewTab");
         LoadUrlParams loadUrlParams = new LoadUrlParams(url.getSpec());
-@@ -310,6 +313,7 @@ public class TabContextMenuItemDelegate implements ContextMenuItemDelegate {
+@@ -368,6 +371,7 @@ public class TabContextMenuItemDelegate implements ContextMenuItemDelegate {
      * @param url The URL to open.
      */
-     public void onOpenInNewTabInGroup(GURL url, Referrer referrer) {
+     public void onOpenInNewTabInGroup(GURL url, @Nullable Referrer referrer) {
 +        TabBrowserControlsConstraintsHelper.get(mTab).update(BrowserControlsState.SHOWN, true);
         RecordUserAction.record("MobileNewTabOpened");
         RecordUserAction.record("LinkOpenedInNewTab");
@@ -7,24 +7,24 @@ Ignore any partner-provided home page.
 License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 ---
 .../org/chromium/chrome/browser/homepage/HomepageManager.java | 4 ----
- .../chrome/browser/new_tab_url/DseNewTabUrlManager.java       | 1 +
+ .../chrome/browser/new_tab_url/DseNewTabUrlManager.java       | 2 +-
 .../partnerbookmarks/PartnerBookmarksProviderIterator.java    | 1 +
 .../partnercustomizations/PartnerBrowserCustomizations.java   | 2 +-
 .../org/chromium/components/search_engines/TemplateUrl.java   | 1 +
 .../search_engines/android/template_url_service_android.cc    | 1 +
 .../always-use-new-tab-page-for-default-home-page.inc         | 1 +
- 7 files changed, 6 insertions(+), 5 deletions(-)
+ 7 files changed, 6 insertions(+), 6 deletions(-)
 create mode 100755 cromite_flags/chrome/browser/flags/android/chrome_feature_list_cc/always-use-new-tab-page-for-default-home-page.inc

 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/homepage/HomepageManager.java b/chrome/android/java/src/org/chromium/chrome/browser/homepage/HomepageManager.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/homepage/HomepageManager.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/homepage/HomepageManager.java
-@@ -148,10 +148,6 @@ public class HomepageManager
+@@ -164,10 +164,6 @@ public class HomepageManager
      *     tab page if the homepage button is force enabled via flag.
      */
-     public GURL getDefaultHomepageGurl() {
+     public GURL getDefaultHomepageGurl(boolean isIncognito) {
 -        if (PartnerBrowserCustomizations.getInstance().isHomepageProviderAvailableAndEnabled()) {
-            return PartnerBrowserCustomizations.getInstance().getHomePageUrl();
+-            return assumeNonNull(PartnerBrowserCustomizations.getInstance().getHomePageUrl());
 -        }
 -
         String homepagePartnerDefaultGurlSerialized =
@@ -33,14 +33,15 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/homepage/Homepa
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/new_tab_url/DseNewTabUrlManager.java b/chrome/android/java/src/org/chromium/chrome/browser/new_tab_url/DseNewTabUrlManager.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/new_tab_url/DseNewTabUrlManager.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/new_tab_url/DseNewTabUrlManager.java
-@@ -54,6 +54,7 @@ public class DseNewTabUrlManager {
+@@ -59,7 +59,7 @@ public class DseNewTabUrlManager {
 
     /** Returns whether the feature NewTabSearchEngineUrlAndroid is enabled. */
     public static boolean isNewTabSearchEngineUrlAndroidEnabled() {
-+        if ((true)) return false;
-         return ChromeSharedPreferences.getInstance()
-                         .readBoolean(ChromePreferenceKeys.IS_EEA_CHOICE_COUNTRY, false)
-                 || (OmniboxFeatures.sOmniboxMobileParityUpdate.isEnabled()
+-        return true;
+        return false;
+     }
+ 
+     /**
 diff --git a/chrome/browser/partnerbookmarks/android/java/src/org/chromium/chrome/browser/partnerbookmarks/PartnerBookmarksProviderIterator.java b/chrome/browser/partnerbookmarks/android/java/src/org/chromium/chrome/browser/partnerbookmarks/PartnerBookmarksProviderIterator.java
 --- a/chrome/browser/partnerbookmarks/android/java/src/org/chromium/chrome/browser/partnerbookmarks/PartnerBookmarksProviderIterator.java
 +++ b/chrome/browser/partnerbookmarks/android/java/src/org/chromium/chrome/browser/partnerbookmarks/PartnerBookmarksProviderIterator.java
@@ -67,7 +68,7 @@ diff --git a/chrome/browser/partnercustomizations/java/src/org/chromium/chrome/b
 diff --git a/components/search_engines/android/java/src/org/chromium/components/search_engines/TemplateUrl.java b/components/search_engines/android/java/src/org/chromium/components/search_engines/TemplateUrl.java
 --- a/components/search_engines/android/java/src/org/chromium/components/search_engines/TemplateUrl.java
 +++ b/components/search_engines/android/java/src/org/chromium/components/search_engines/TemplateUrl.java
-@@ -85,6 +85,7 @@ public class TemplateUrl {
+@@ -88,6 +88,7 @@ public class TemplateUrl {
      *     prepopulated_engines.json.
      */
     public String getNewTabURL() {
@@ -78,7 +79,7 @@ diff --git a/components/search_engines/android/java/src/org/chromium/components/
 diff --git a/components/search_engines/android/template_url_service_android.cc b/components/search_engines/android/template_url_service_android.cc
 --- a/components/search_engines/android/template_url_service_android.cc
 +++ b/components/search_engines/android/template_url_service_android.cc
-@@ -403,6 +403,7 @@ jboolean TemplateUrlServiceAndroid::SetPlayAPISearchEngine(
+@@ -404,6 +404,7 @@ jboolean TemplateUrlServiceAndroid::SetPlayAPISearchEngine(
         jimage_translate_source_language_param_key,
     const base::android::JavaParamRef<jstring>&
         jimage_translate_target_language_param_key) {
@@ -1,353 +0,0 @@
-From: uazo <uazo@users.noreply.github.com>
-Date: Mon, 26 May 2025 12:17:48 +0000
-Subject: Android Import Passwords
-
-Adds the possibility of importing a csv file containing the list of passwords,
-with the same functionality available on desktops.
-
-License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
---
- ...e_password_preferences_action_bar_menu.xml |  6 ++
- .../settings/PasswordSettings.java            | 34 +++++++++
- .../settings/PasswordManagerHandler.java      |  3 +
- .../settings/PasswordUiView.java              |  8 +++
- .../android/password_ui_view_android.cc       | 71 +++++++++++++++++++
- .../android/password_ui_view_android.h        | 20 +++++-
- .../Import-Password-Android.grdp              |  9 +++
- .../core/browser/import/password_importer.cc  | 11 +++
- 8 files changed, 161 insertions(+), 1 deletion(-)
- create mode 100644 chrome/browser/ui/android/strings/cromite_android_chrome_strings_grd/Import-Password-Android.grdp
-
-diff --git a/chrome/android/java/res/menu/save_password_preferences_action_bar_menu.xml b/chrome/android/java/res/menu/save_password_preferences_action_bar_menu.xml
--- a/chrome/android/java/res/menu/save_password_preferences_action_bar_menu.xml
-+++ b/chrome/android/java/res/menu/save_password_preferences_action_bar_menu.xml
-@@ -22,6 +22,12 @@ found in the LICENSE file.
-         android:visibility="gone"
-         app:showAsAction="ifRoom"/>
- 
-+    <item
-+        android:id="@+id/import_passwords"
-+        android:title="@string/password_settings_import_action_title"
-+        android:contentDescription="@string/password_settings_import_action_description"
-+        app:showAsAction="never"/>
-+
-     <item
-         android:id="@+id/export_passwords"
-         android:title="@string/password_settings_export_action_title"
-diff --git a/chrome/android/java/src/org/chromium/chrome/browser/password_manager/settings/PasswordSettings.java b/chrome/android/java/src/org/chromium/chrome/browser/password_manager/settings/PasswordSettings.java
--- a/chrome/android/java/src/org/chromium/chrome/browser/password_manager/settings/PasswordSettings.java
-+++ b/chrome/android/java/src/org/chromium/chrome/browser/password_manager/settings/PasswordSettings.java
-@@ -57,6 +57,9 @@ import org.chromium.components.sync.PassphraseType;
- import org.chromium.components.sync.SyncService;
- import org.chromium.components.user_prefs.UserPrefs;
- import org.chromium.ui.text.SpanApplier;
-+import org.chromium.ui.base.ActivityWindowAndroid;
-+import org.chromium.ui.base.ActivityIntentRequestTrackerDelegate;
-+import org.chromium.ui.base.IntentRequestTracker;
- 
- import java.lang.annotation.Retention;
- import java.lang.annotation.RetentionPolicy;
-@@ -151,6 +154,8 @@ public class PasswordSettings extends ChromeBaseSettingsFragment
- 
-     /** For controlling the UX flow of exporting passwords. */
-     private final ExportFlow mExportFlow = new ExportFlow(PasswordAccessLossWarningType.NONE);
-+    private ActivityWindowAndroid mWindowAndroid;
-+    private IntentRequestTracker mIntentRequestTracker;
- 
-     public ExportFlow getExportFlowForTesting() {
-         return mExportFlow;
-@@ -199,6 +204,19 @@ public class PasswordSettings extends ChromeBaseSettingsFragment
- 
-         mManagePasswordsReferrer = getReferrerFromInstanceStateOrLaunchBundle(savedInstanceState);
- 
-+        mIntentRequestTracker = IntentRequestTracker.createFromDelegate(
-+                                new ActivityIntentRequestTrackerDelegate(getActivity()) {
-+                                    @Override
-+                                    public boolean startActivityForResult(@Nullable Intent intent, int requestCode) {
-+                                        PasswordSettings.this.startActivityForResult(intent, requestCode);
-+                                        return true;
-+                                    }
-+                                });
-+        mWindowAndroid = new ActivityWindowAndroid(
-+            getActivity(), /* listenToActivityState */ true,
-+            mIntentRequestTracker, /*InsetObserver*/ null,
-+            /* trackOcclusion= */ true);
-+
-         if (savedInstanceState == null) return;
- 
-         if (savedInstanceState.containsKey(SAVED_STATE_SEARCH_QUERY)) {
-@@ -263,6 +281,12 @@ public class PasswordSettings extends ChromeBaseSettingsFragment
-     @Override
-     public boolean onOptionsItemSelected(MenuItem item) {
-         int id = item.getItemId();
-+        if (id == R.id.import_passwords) {
-+            PasswordManagerHandlerProvider.getForProfile(getProfile())
-+                    .getPasswordManagerHandler()
-+                    .startImporting(mWindowAndroid);
-+            return true;
-+        }
-         if (id == R.id.export_passwords) {
-             RecordHistogram.recordEnumeratedHistogram(
-                     mExportFlow.getExportEventHistogramName(),
-@@ -506,6 +530,7 @@ public class PasswordSettings extends ChromeBaseSettingsFragment
-     @Override
-     public void onActivityResult(int requestCode, int resultCode, Intent intent) {
-         super.onActivityResult(requestCode, resultCode, intent);
-+        mWindowAndroid.getIntentRequestTracker().onActivityResult(requestCode, resultCode, intent);
-         if (requestCode != PASSWORD_EXPORT_INTENT_REQUEST_CODE) return;
-         if (resultCode != Activity.RESULT_OK) return;
-         if (intent == null || intent.getData() == null) return;
-@@ -517,12 +542,21 @@ public class PasswordSettings extends ChromeBaseSettingsFragment
-     public void onSaveInstanceState(Bundle outState) {
-         super.onSaveInstanceState(outState);
-         mExportFlow.onSaveInstanceState(outState);
-+        mWindowAndroid.getIntentRequestTracker().saveInstanceState(outState);
-         if (mSearchQuery != null) {
-             outState.putString(SAVED_STATE_SEARCH_QUERY, mSearchQuery);
-         }
-         outState.putInt(PasswordManagerHelper.MANAGE_PASSWORDS_REFERRER, mManagePasswordsReferrer);
-     }
- 
-+    @Override
-+    public void onRequestPermissionsResult(
-+            int requestCode, String[] permissions, int[] grantResults) {
-+        if (mWindowAndroid.handlePermissionResult(requestCode, permissions, grantResults))
-+            return;
-+        super.onRequestPermissionsResult(requestCode, permissions, grantResults);
-+    }
-+
-     @Override
-     public void onDestroy() {
-         super.onDestroy();
-diff --git a/chrome/browser/password_manager/android/java/src/org/chromium/chrome/browser/password_manager/settings/PasswordManagerHandler.java b/chrome/browser/password_manager/android/java/src/org/chromium/chrome/browser/password_manager/settings/PasswordManagerHandler.java
--- a/chrome/browser/password_manager/android/java/src/org/chromium/chrome/browser/password_manager/settings/PasswordManagerHandler.java
-+++ b/chrome/browser/password_manager/android/java/src/org/chromium/chrome/browser/password_manager/settings/PasswordManagerHandler.java
-@@ -9,6 +9,7 @@ import android.content.Context;
- import org.chromium.base.Callback;
- import org.chromium.base.IntStringCallback;
- import org.chromium.build.annotations.NullMarked;
-+import org.chromium.ui.base.WindowAndroid;
- 
- /**
-  * Interface for retrieving passwords and password exceptions (websites for which Chrome should not
-@@ -80,4 +81,6 @@ public interface PasswordManagerHandler {
-      * @return Returns true if the request to fetch the passwords is still pending.
-      */
-     boolean isWaitingForPasswordStore();
-+
-+    boolean startImporting(WindowAndroid window);
- }
-diff --git a/chrome/browser/password_manager/android/java/src/org/chromium/chrome/browser/password_manager/settings/PasswordUiView.java b/chrome/browser/password_manager/android/java/src/org/chromium/chrome/browser/password_manager/settings/PasswordUiView.java
--- a/chrome/browser/password_manager/android/java/src/org/chromium/chrome/browser/password_manager/settings/PasswordUiView.java
-+++ b/chrome/browser/password_manager/android/java/src/org/chromium/chrome/browser/password_manager/settings/PasswordUiView.java
-@@ -12,6 +12,7 @@ import org.jni_zero.NativeMethods;
- 
- import org.chromium.base.Callback;
- import org.chromium.base.IntStringCallback;
-+import org.chromium.ui.base.WindowAndroid;
- import org.chromium.build.annotations.NullMarked;
- import org.chromium.chrome.browser.profiles.Profile;
- 
-@@ -158,6 +159,12 @@ public final class PasswordUiView implements PasswordManagerHandler {
-         }
-     }
- 
-+    @Override
-+    public boolean startImporting(WindowAndroid window) {
-+        return PasswordUiViewJni.get()
-+                .startImporting(mNativePasswordUiViewAndroid, PasswordUiView.this, window);
-+    }
-+
-     @NativeMethods
-     interface Natives {
-         long init(PasswordUiView caller, @JniType("Profile*") Profile profile);
-@@ -190,6 +197,7 @@ public final class PasswordUiView implements PasswordManagerHandler {
-         String getTrustedVaultLearnMoreURL();
- 
-         boolean isWaitingForPasswordStore(long nativePasswordUiViewAndroid, PasswordUiView caller);
-+        boolean startImporting(long nativePasswordUiViewAndroid, PasswordUiView caller, WindowAndroid window);
- 
-         void destroy(long nativePasswordUiViewAndroid, PasswordUiView caller);
- 
-diff --git a/chrome/browser/password_manager/android/password_ui_view_android.cc b/chrome/browser/password_manager/android/password_ui_view_android.cc
--- a/chrome/browser/password_manager/android/password_ui_view_android.cc
-+++ b/chrome/browser/password_manager/android/password_ui_view_android.cc
-@@ -41,6 +41,11 @@
- #include "ui/base/l10n/l10n_util.h"
- #include "url/gurl.h"
- 
-+#include "chrome/browser/ui/chrome_select_file_policy.h"
-+#include "ui/shell_dialogs/selected_file_info.h"
-+#include "ui/shell_dialogs/select_file_dialog.h"
-+#include "ui/android/window_android.h"
-+
- // Must come after other includes, because FromJniType() uses Profile.
- #include "chrome/browser/password_manager/android/jni_headers/PasswordUiView_jni.h"
- 
-@@ -123,6 +128,8 @@ PasswordUiViewAndroid::PasswordUiViewAndroid(
- 
- PasswordUiViewAndroid::~PasswordUiViewAndroid() {
-   saved_passwords_presenter_.RemoveObserver(this);
-+  if (select_file_dialog_)
-+    select_file_dialog_->ListenerDestroyed();
- }
- 
- void PasswordUiViewAndroid::Destroy(JNIEnv*, const JavaRef<jobject>&) {
-@@ -314,6 +321,70 @@ jboolean PasswordUiViewAndroid::IsWaitingForPasswordStore(
-   return saved_passwords_presenter_.IsWaitingForPasswordStore();
- }
- 
-+void PasswordUiViewAndroid::ImportFinished(
-+    const password_manager::ImportResults& results) {
-+  std::string error;
-+  if (results.status == password_manager::ImportResults::Status::SUCCESS)
-+    error = "Success.";
-+  else if (results.status == password_manager::ImportResults::Status::IO_ERROR)
-+    error = "Failed to read provided file.";
-+  else if (results.status == password_manager::ImportResults::Status::BAD_FORMAT)
-+    error = "Header is missing, invalid or could not be read.";
-+  else if (results.status == password_manager::ImportResults::Status::NUM_PASSWORDS_EXCEEDED)
-+    error = "Too many passwords.";
-+  else
-+    error = "UNKNOWN ERROR.";
-+
-+  std::stringstream message;
-+  message << error << " Imported " << results.number_imported << " passwords.";
-+  auto result = message.str();
-+
-+  select_file_dialog_->ShowToast(result);
-+
-+  importer_.reset();
-+}
-+
-+jboolean PasswordUiViewAndroid::StartImporting(
-+    JNIEnv* env,
-+    const base::android::JavaRef<jobject>& obj,
-+    const JavaParamRef<jobject>& java_window) {
-+  ui::WindowAndroid* window =
-+      ui::WindowAndroid::FromJavaWindowAndroid(java_window);
-+  CHECK(window);
-+
-+  select_file_dialog_ = ui::SelectFileDialog::Create(
-+    this, std::make_unique<ChromeSelectFilePolicy>(nullptr));
-+
-+  ui::SelectFileDialog::FileTypeInfo file_type_info;
-+
-+  const std::vector<std::u16string> v_accept_types = { u"application/octet-stream" };
-+  select_file_dialog_->SetAcceptTypes(v_accept_types);
-+
-+  select_file_dialog_->SelectFile(
-+        ui::SelectFileDialog::SELECT_OPEN_FILE,
-+        std::u16string(),
-+        base::FilePath(),
-+        &file_type_info,
-+        0,
-+        base::FilePath::StringType(),
-+        window);
-+
-+  return true;
-+}
-+
-+void PasswordUiViewAndroid::FileSelectionCanceled() {}
-+
-+void PasswordUiViewAndroid::FileSelected(const ui::SelectedFileInfo& file, int index) {
-+  base::FilePath path = file.path();
-+
-+  importer_ =
-+    std::make_unique<password_manager::PasswordImporter>(&saved_passwords_presenter_);
-+  importer_->Import(path,
-+    password_manager::PasswordForm::Store::kProfileStore,
-+    base::BindOnce(&PasswordUiViewAndroid::ImportFinished,
-+                     base::Unretained(this)));
-+}
-+
- // static
- static jlong JNI_PasswordUiView_Init(JNIEnv* env,
-                                      const JavaParamRef<jobject>& obj,
-diff --git a/chrome/browser/password_manager/android/password_ui_view_android.h b/chrome/browser/password_manager/android/password_ui_view_android.h
--- a/chrome/browser/password_manager/android/password_ui_view_android.h
-+++ b/chrome/browser/password_manager/android/password_ui_view_android.h
-@@ -21,6 +21,8 @@
- #include "chrome/browser/signin/identity_manager_factory.h"
- #include "components/password_manager/core/browser/password_store/password_store_consumer.h"
- #include "components/password_manager/core/browser/ui/saved_passwords_presenter.h"
-+#include "components/password_manager/core/browser/import/password_importer.h"
-+#include "ui/shell_dialogs/select_file_dialog.h"
- 
- class Profile;
- 
-@@ -31,7 +33,8 @@ class CredentialProviderInterface;
- // PasswordUIView for Android, contains jni hooks that allows Android UI to
- // display passwords and route UI commands back to SavedPasswordsPresenter.
- class PasswordUiViewAndroid
-    : public password_manager::SavedPasswordsPresenter::Observer {
-+    : public password_manager::SavedPasswordsPresenter::Observer,
-+      public ui::SelectFileDialog::Listener {
-  public:
-   // Result of transforming a vector of PasswordForms into their CSV
-   // description and writing that to disk.
-@@ -95,6 +98,18 @@ class PasswordUiViewAndroid
-       const base::android::JavaParamRef<jobject>& obj);
-   jboolean IsWaitingForPasswordStore(JNIEnv* env,
-                                      const base::android::JavaRef<jobject>&);
-+
-+  void FileSelected(const ui::SelectedFileInfo& file,
-+                    int index) override;
-+  void FileSelectionCanceled() override;
-+
-+  void ImportFinished(
-+       const password_manager::ImportResults& results);
-+
-+  jboolean StartImporting(JNIEnv* env,
-+                          const base::android::JavaRef<jobject>& obj,
-+                          const base::android::JavaParamRef<jobject>& java_window);
-+
-   // Destroy the native implementation.
-   void Destroy(JNIEnv*, const base::android::JavaRef<jobject>&);
- 
-@@ -162,6 +177,9 @@ class PasswordUiViewAndroid
-   std::vector<password_manager::CredentialUIEntry> passwords_;
-   std::vector<password_manager::CredentialUIEntry> blocked_sites_;
- 
-+  scoped_refptr<ui::SelectFileDialog> select_file_dialog_;
-+  std::unique_ptr<password_manager::PasswordImporter> importer_;
-+
-   // If not null, passwords for exporting will be obtained from
-   // |*credential_provider_for_testing_|, otherwise from
-   // |saved_passwords_presenter_|. This must remain null in production code.
-diff --git a/chrome/browser/ui/android/strings/cromite_android_chrome_strings_grd/Import-Password-Android.grdp b/chrome/browser/ui/android/strings/cromite_android_chrome_strings_grd/Import-Password-Android.grdp
-new file mode 100644
--- /dev/null
-+++ b/chrome/browser/ui/android/strings/cromite_android_chrome_strings_grd/Import-Password-Android.grdp
-@@ -0,0 +1,9 @@
-+<?xml version="1.0" encoding="utf-8"?>
-+<grit-part>
-+    <message name="IDS_PASSWORD_SETTINGS_IMPORT_ACTION_TITLE" desc="The title of a menu item to trigger importing passwords from the password settings.">
-+        Import passwords…
-+    </message>
-+    <message name="IDS_PASSWORD_SETTINGS_IMPORT_ACTION_DESCRIPTION" desc="The description of a menu item to trigger importing passwords from the password settings.">
-+        Import passwords stored with Chrome
-+    </message>
-+</grit-part>
-diff --git a/components/password_manager/core/browser/import/password_importer.cc b/components/password_manager/core/browser/import/password_importer.cc
--- a/components/password_manager/core/browser/import/password_importer.cc
-+++ b/components/password_manager/core/browser/import/password_importer.cc
-@@ -75,6 +75,17 @@ const int32_t kMaxFileSizeBytes = 150 * 1024;
- // optional string. The string will be present if the status is SUCCESS.
- base::expected<std::string, ImportResults::Status> ReadFileToString(
-     const base::FilePath& path) {
-+#if BUILDFLAG(IS_ANDROID)
-+  if (path.IsContentUri()) {
-+    base::File file(path, base::File::FLAG_OPEN | base::File::FLAG_READ);
-+    auto fileLength = file.GetLength();
-+    std::vector<char> buffer(fileLength);
-+    file.ReadAtCurrentPos(base::as_writable_byte_span(buffer));
-+
-+    std::string file_contents(buffer.begin(), buffer.end());
-+    return std::move(file_contents);
-+  }
-+#endif
-   std::optional<int64_t> file_size = base::GetFileSize(path);
- 
-   if (file_size.has_value()) {
--
@@ -18,15 +18,15 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 diff --git a/chrome/browser/browser_controls/android/java/src/org/chromium/chrome/browser/browser_controls/BrowserStateBrowserControlsVisibilityDelegate.java b/chrome/browser/browser_controls/android/java/src/org/chromium/chrome/browser/browser_controls/BrowserStateBrowserControlsVisibilityDelegate.java
 --- a/chrome/browser/browser_controls/android/java/src/org/chromium/chrome/browser/browser_controls/BrowserStateBrowserControlsVisibilityDelegate.java
 +++ b/chrome/browser/browser_controls/android/java/src/org/chromium/chrome/browser/browser_controls/BrowserStateBrowserControlsVisibilityDelegate.java
-@@ -40,6 +40,7 @@ public class BrowserStateBrowserControlsVisibilityDelegate extends BrowserContro
-     private final Supplier<Boolean> mPersistentFullscreenMode;
+@@ -41,6 +41,7 @@ public class BrowserStateBrowserControlsVisibilityDelegate extends BrowserContro
+     private final ObservableSupplier<Boolean> mPersistentFullscreenMode;
 
     private long mCurrentShowingStartTime;
 +    private int temporaryToken;
 
     /**
      * Constructs a BrowserControlsVisibilityDelegate designed to deal with overrides driven by
-@@ -65,7 +66,8 @@ public class BrowserStateBrowserControlsVisibilityDelegate extends BrowserContro
+@@ -66,7 +67,8 @@ public class BrowserStateBrowserControlsVisibilityDelegate extends BrowserContro
         long currentShowingTime = SystemClock.uptimeMillis() - mCurrentShowingStartTime;
         if (currentShowingTime >= MINIMUM_SHOW_DURATION_MS) return;
 
@@ -53,7 +53,7 @@ new file mode 100644
 diff --git a/components/browser_ui/accessibility/android/java/res/xml/accessibility_preferences.xml b/components/browser_ui/accessibility/android/java/res/xml/accessibility_preferences.xml
 --- a/components/browser_ui/accessibility/android/java/res/xml/accessibility_preferences.xml
 +++ b/components/browser_ui/accessibility/android/java/res/xml/accessibility_preferences.xml
-@@ -79,6 +79,12 @@ found in the LICENSE file.
+@@ -84,6 +84,12 @@ found in the LICENSE file.
         android:key="disable_toolbar_swipeup"
         android:title="@string/disable_toolbar_swipe_up" />
 
@@ -8,16 +8,18 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 ---
 .../common/ProductionSupportedFlagList.java   |    3 +
 .../component_updater/registration.cc         |    9 +
+ build/config/freetype/freetype.gni            |    2 +-
 .../java/res/xml/developer_preferences.xml    |    5 +
 chrome/browser/BUILD.gn                       |    7 +
 .../browser/component_updater/registration.cc |   10 +
 ...droid-fonts-fingerprinting-mitigation.grdp |    9 +
- chrome/renderer/BUILD.gn                      |    3 +
+ chrome/browser/ui/prefs/prefs_tab_helper.cc   |    9 +-
+ chrome/renderer/BUILD.gn                      |    4 +
 .../installer_policies/BUILD.gn               |    7 +
 .../fonts_pack_component_installer.cc         |   96 +
 .../fonts_pack_component_installer.h          |   60 +
 components/services/font/BUILD.gn             |   10 +
- components/services/font/font_service_app.cc  |   44 +
+ components/services/font/font_service_app.cc  |   46 +
 components/services/font/font_service_app.h   |    1 +
 .../services/font/public/cpp/font_loader.cc   |   11 +
 .../services/font/public/cpp/font_loader.h    |    1 +
@@ -29,20 +31,24 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 content/child/BUILD.gn                        |    7 +
 content/renderer/BUILD.gn                     |    4 +
 .../renderer/renderer_blink_platform_impl.cc  |   55 +-
+ ...renderer_main_platform_delegate_android.cc |    2 +-
 ...ndroid-fonts-fingerprinting-mitigation.inc |   12 +
 ...ndroid-fonts-fingerprinting-mitigation.inc |    7 +
 ...ndroid-fonts-fingerprinting-mitigation.inc |    5 +
 skia/BUILD.gn                                 |   12 +
+ skia/ext/font_utils.cc                        |    1 +
+ .../freetype/config/ftoption.h                |    2 +-
 .../include/ports/SkFontConfigInterface.h     |    2 +
 .../skia/include/ports/SkFontMgr_android.h    |   42 +-
- .../skia/src/ports/SkFontConfigInterface.cpp  |    4 +
+ .../skia/src/ports/SkFontConfigInterface.cpp  |    5 +
 .../ports/SkFontConfigInterface_direct.cpp    |    5 +
 .../src/ports/SkFontConfigInterface_direct.h  |    1 +
- .../skia/src/ports/SkFontMgr_android.cpp      |  278 ++-
- .../skia/src/ports/SkFontMgr_android_data.cpp | 1640 +++++++++++++++++
- .../src/ports/SkFontMgr_android_parser.cpp    |   49 +-
+ .../skia/src/ports/SkFontMgr_android.cpp      |  282 ++-
+ .../skia/src/ports/SkFontMgr_android_data.cpp | 1641 +++++++++++++++++
+ .../skia/src/ports/SkFontMgr_android_ndk.cpp  |    2 +-
+ .../src/ports/SkFontMgr_android_parser.cpp    |   66 +-
 .../skia/src/ports/SkFontMgr_android_parser.h |    5 +-
- 36 files changed, 2410 insertions(+), 79 deletions(-)
+ 42 files changed, 2448 insertions(+), 85 deletions(-)
 create mode 100644 chrome/browser/ui/android/strings/cromite_android_chrome_strings_grd/Android-fonts-fingerprinting-mitigation.grdp
 create mode 100644 components/component_updater/installer_policies/fonts_pack_component_installer.cc
 create mode 100644 components/component_updater/installer_policies/fonts_pack_component_installer.h
@@ -54,7 +60,7 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 diff --git a/android_webview/java/src/org/chromium/android_webview/common/ProductionSupportedFlagList.java b/android_webview/java/src/org/chromium/android_webview/common/ProductionSupportedFlagList.java
 --- a/android_webview/java/src/org/chromium/android_webview/common/ProductionSupportedFlagList.java
 +++ b/android_webview/java/src/org/chromium/android_webview/common/ProductionSupportedFlagList.java
-@@ -1046,6 +1046,9 @@ public final class ProductionSupportedFlagList {
+@@ -933,6 +933,9 @@ public final class ProductionSupportedFlagList {
                 "Hides user preference on the system keyboard by setting the standard "
                  + "eng layout and removing the layout information from the "
                  + "javascript keyboard events."),
@@ -67,9 +73,9 @@ diff --git a/android_webview/java/src/org/chromium/android_webview/common/Produc
 diff --git a/android_webview/nonembedded/component_updater/registration.cc b/android_webview/nonembedded/component_updater/registration.cc
 --- a/android_webview/nonembedded/component_updater/registration.cc
 +++ b/android_webview/nonembedded/component_updater/registration.cc
-@@ -27,6 +27,9 @@
+@@ -20,6 +20,9 @@
+ #include "components/component_updater/installer_policies/origin_trials_component_installer.h"
 #include "components/update_client/update_client.h"
- #include "mojo/public/cpp/base/proto_wrapper.h"
 
 +#include "third_party/blink/public/common/features.h"
 +#include "components/component_updater/installer_policies/fonts_pack_component_installer.h"
@@ -77,7 +83,7 @@ diff --git a/android_webview/nonembedded/component_updater/registration.cc b/and
 namespace android_webview {
 
 void RegisterComponentsForUpdate(
-@@ -43,6 +46,12 @@ void RegisterComponentsForUpdate(
+@@ -36,6 +39,12 @@ void RegisterComponentsForUpdate(
   std::vector<std::unique_ptr<component_updater::ComponentInstallerPolicy>>
       component_installer_list_cromite;
 
@@ -90,6 +96,16 @@ diff --git a/android_webview/nonembedded/component_updater/registration.cc b/and
   component_installer_list.push_back(
       std::make_unique<
           component_updater::OriginTrialsComponentInstallerPolicy>());
+diff --git a/build/config/freetype/freetype.gni b/build/config/freetype/freetype.gni
+--- a/build/config/freetype/freetype.gni
+++ b/build/config/freetype/freetype.gni
+@@ -26,5 +26,5 @@ declare_args() {
+   #   https://crbug.com/370816215
+   #
+   # Note: //build should not import directly from //pdf for layering reasons.
+-  enable_freetype = !is_android && !is_ios && (is_linux || !is_castos)
+  enable_freetype = is_android || (!is_ios && (is_linux || !is_castos))
+ }
 diff --git a/chrome/android/java/res/xml/developer_preferences.xml b/chrome/android/java/res/xml/developer_preferences.xml
 --- a/chrome/android/java/res/xml/developer_preferences.xml
 +++ b/chrome/android/java/res/xml/developer_preferences.xml
@@ -106,8 +122,8 @@ diff --git a/chrome/android/java/res/xml/developer_preferences.xml b/chrome/andr
 diff --git a/chrome/browser/BUILD.gn b/chrome/browser/BUILD.gn
 --- a/chrome/browser/BUILD.gn
 +++ b/chrome/browser/BUILD.gn
-@@ -7888,6 +7888,13 @@ static_library("browser") {
-     }
+@@ -8012,6 +8012,13 @@ static_library("browser") {
+     ]
   }
 
 +  if (is_android) {
@@ -123,7 +139,7 @@ diff --git a/chrome/browser/BUILD.gn b/chrome/browser/BUILD.gn
 diff --git a/chrome/browser/component_updater/registration.cc b/chrome/browser/component_updater/registration.cc
 --- a/chrome/browser/component_updater/registration.cc
 +++ b/chrome/browser/component_updater/registration.cc
-@@ -123,10 +123,20 @@
+@@ -115,10 +115,20 @@
 #include "chrome/browser/component_updater/file_type_policies_component_installer.h"
 #endif
 
@@ -158,23 +174,50 @@ new file mode 100644
 +        Replaces all system fonts with the same for all devices
 +    </message>
 +</grit-part>
+diff --git a/chrome/browser/ui/prefs/prefs_tab_helper.cc b/chrome/browser/ui/prefs/prefs_tab_helper.cc
+--- a/chrome/browser/ui/prefs/prefs_tab_helper.cc
+++ b/chrome/browser/ui/prefs/prefs_tab_helper.cc
+@@ -64,8 +64,7 @@
+ #include <windows.h>
+ #endif
+ 
+-#if BUILDFLAG(IS_MAC) || BUILDFLAG(IS_WIN) || BUILDFLAG(IS_LINUX) || \
+-    BUILDFLAG(IS_ANDROID) || BUILDFLAG(ENABLE_DESKTOP_ANDROID_EXTENSIONS)
+#if BUILDFLAG(IS_MAC) || BUILDFLAG(IS_WIN) || BUILDFLAG(IS_LINUX)
+ // If a font name in prefs default values starts with a comma, consider it's a
+ // comma-separated font list and resolve it to the first available font.
+ #define PREFS_FONT_LIST 1
+@@ -442,9 +441,9 @@ void PrefsTabHelper::RegisterProfilePrefs(
+         value = gfx::FontList::FirstAvailableOrFirst(value);
+       }
+ #else   // !PREFS_FONT_LIST
+-      DCHECK(!value.starts_with(','))
+-          << "This platform doesn't support default font lists. "
+-          << pref.pref_name << "=" << value;
+      // DCHECK(!value.starts_with(','))
+      //     << "This platform doesn't support default font lists. "
+      //     << pref.pref_name << "=" << value;
+ #endif  // PREFS_FONT_LIST
+       registry->RegisterStringPref(pref.pref_name, value);
+       fonts_with_defaults.insert(pref.pref_name);
 diff --git a/chrome/renderer/BUILD.gn b/chrome/renderer/BUILD.gn
 --- a/chrome/renderer/BUILD.gn
 +++ b/chrome/renderer/BUILD.gn
-@@ -292,6 +292,9 @@ static_library("renderer") {
-       "//ppapi/shared_impl",
-     ]
+@@ -266,6 +266,10 @@ static_library("renderer") {
+     deps += [ "//components/strings" ]
+   }
 
-+    if (is_android) {
-+      deps += [ "//components/services/font/public/cpp" ]
-+    }
-     if (is_linux || is_chromeos) {
-       deps += [ "//components/services/font/public/cpp" ]
-     }
+  if (is_android) {
+    deps += [ "//components/services/font/public/cpp" ]
+  }
+
+   if (enable_pdf) {
+     deps += [
+       "//components/pdf/renderer",
 diff --git a/components/component_updater/installer_policies/BUILD.gn b/components/component_updater/installer_policies/BUILD.gn
 --- a/components/component_updater/installer_policies/BUILD.gn
 +++ b/components/component_updater/installer_policies/BUILD.gn
-@@ -36,6 +36,13 @@ static_library("installer_policies_no_content_deps") {
+@@ -32,6 +32,13 @@ static_library("installer_policies_no_content_deps") {
     "trust_token_key_commitments_component_installer_policy.h",
   ]
 
@@ -357,7 +400,7 @@ new file mode 100644
 diff --git a/components/services/font/BUILD.gn b/components/services/font/BUILD.gn
 --- a/components/services/font/BUILD.gn
 +++ b/components/services/font/BUILD.gn
-@@ -24,6 +24,16 @@ source_set("lib") {
+@@ -23,6 +23,16 @@ source_set("lib") {
     "//ui/gfx",
   ]
 
@@ -377,7 +420,17 @@ diff --git a/components/services/font/BUILD.gn b/components/services/font/BUILD.
 diff --git a/components/services/font/font_service_app.cc b/components/services/font/font_service_app.cc
 --- a/components/services/font/font_service_app.cc
 +++ b/components/services/font/font_service_app.cc
-@@ -20,6 +20,12 @@
+@@ -4,7 +4,9 @@
+ 
+ #include "components/services/font/font_service_app.h"
+ 
+#if !BUILDFLAG(IS_ANDROID)
+ #include <fontconfig/fontconfig.h>
+#endif
+ 
+ #include <set>
+ #include <utility>
+@@ -25,6 +27,12 @@
 #include "ui/gfx/font_fallback_linux.h"
 #include "ui/gfx/font_render_params.h"
 
@@ -390,7 +443,7 @@ diff --git a/components/services/font/font_service_app.cc b/components/services/
 #if BUILDFLAG(ENABLE_PDF)
 #include "components/services/font/pdf_fontconfig_matching.h"  // nogncheck
 #endif
-@@ -95,6 +101,7 @@ void FontServiceApp::BindReceiver(
+@@ -100,6 +108,7 @@ void FontServiceApp::BindReceiver(
 void FontServiceApp::MatchFamilyName(const std::string& family_name,
                                      mojom::TypefaceStylePtr requested_style,
                                      MatchFamilyNameCallback callback) {
@@ -398,7 +451,7 @@ diff --git a/components/services/font/font_service_app.cc b/components/services/
   TRACE_EVENT0("fonts", "FontServiceApp::MatchFamilyName");
 
   SkFontConfigInterface::FontIdentity result_identity;
-@@ -155,6 +162,7 @@ void FontServiceApp::MatchFamilyName(const std::string& family_name,
+@@ -160,6 +169,7 @@ void FontServiceApp::MatchFamilyName(const std::string& family_name,
 
   std::move(callback).Run(std::move(identity), result_family_cppstring,
                           std::move(style));
@@ -406,7 +459,7 @@ diff --git a/components/services/font/font_service_app.cc b/components/services/
 }
 
 void FontServiceApp::OpenStream(uint32_t id_number,
-@@ -169,12 +177,43 @@ void FontServiceApp::OpenStream(uint32_t id_number,
+@@ -174,12 +184,43 @@ void FontServiceApp::OpenStream(uint32_t id_number,
   std::move(callback).Run(std::move(file));
 }
 
@@ -450,7 +503,7 @@ diff --git a/components/services/font/font_service_app.cc b/components/services/
   gfx::FallbackFontData fallback_font;
   if (gfx::GetFallbackFontForChar(character, locale, &fallback_font)) {
     size_t index = FindOrAddPath(fallback_font.filepath);
-@@ -189,6 +228,7 @@ void FontServiceApp::FallbackFontForCharacter(
+@@ -194,6 +235,7 @@ void FontServiceApp::FallbackFontForCharacter(
   } else {
     std::move(callback).Run(nullptr, "", false, false);
   }
@@ -458,7 +511,7 @@ diff --git a/components/services/font/font_service_app.cc b/components/services/
 }
 
 void FontServiceApp::FontRenderStyleForStrike(
-@@ -232,6 +272,9 @@ void FontServiceApp::MatchFontByPostscriptNameOrFullFontName(
+@@ -237,6 +279,9 @@ void FontServiceApp::MatchFontByPostscriptNameOrFullFontName(
   TRACE_EVENT0("fonts",
                "FontServiceApp::MatchFontByPostscriptNameOrFullFontName");
 
@@ -468,7 +521,7 @@ diff --git a/components/services/font/font_service_app.cc b/components/services/
   std::optional<FontConfigLocalMatching::FontConfigMatchResult> match_result =
       FontConfigLocalMatching::FindFontByPostscriptNameOrFullFontName(family);
   if (match_result) {
-@@ -243,6 +286,7 @@ void FontServiceApp::MatchFontByPostscriptNameOrFullFontName(
+@@ -248,6 +293,7 @@ void FontServiceApp::MatchFontByPostscriptNameOrFullFontName(
     return;
   }
   std::move(callback).Run(nullptr);
@@ -511,7 +564,7 @@ diff --git a/components/services/font/public/cpp/font_loader.cc b/components/ser
 diff --git a/components/services/font/public/cpp/font_loader.h b/components/services/font/public/cpp/font_loader.h
 --- a/components/services/font/public/cpp/font_loader.h
 +++ b/components/services/font/public/cpp/font_loader.h
-@@ -54,6 +54,7 @@ class FontLoader : public SkFontConfigInterface,
+@@ -56,6 +56,7 @@ class FontLoader : public SkFontConfigInterface,
                        SkFontStyle* out_style) override;
   SkStreamAsset* openStream(const FontIdentity& identity) override
       LOCKS_EXCLUDED(mapped_font_files_lock_);
@@ -522,7 +575,7 @@ diff --git a/components/services/font/public/cpp/font_loader.h b/components/serv
 diff --git a/components/services/font/public/cpp/font_service_thread.cc b/components/services/font/public/cpp/font_service_thread.cc
 --- a/components/services/font/public/cpp/font_service_thread.cc
 +++ b/components/services/font/public/cpp/font_service_thread.cc
-@@ -247,6 +247,54 @@ void FontServiceThread::OpenStreamImpl(base::WaitableEvent* done_event,
+@@ -258,6 +258,54 @@ void FontServiceThread::OpenStreamImpl(base::WaitableEvent* done_event,
                                 done_event, output_file));
 }
 
@@ -580,7 +633,7 @@ diff --git a/components/services/font/public/cpp/font_service_thread.cc b/compon
 diff --git a/components/services/font/public/cpp/font_service_thread.h b/components/services/font/public/cpp/font_service_thread.h
 --- a/components/services/font/public/cpp/font_service_thread.h
 +++ b/components/services/font/public/cpp/font_service_thread.h
-@@ -55,6 +55,8 @@ class FontServiceThread : public base::RefCountedThreadSafe<FontServiceThread> {
+@@ -57,6 +57,8 @@ class FontServiceThread : public base::RefCountedThreadSafe<FontServiceThread> {
                        SkFontStyle* out_style);
   scoped_refptr<MappedFontFile> OpenStream(
       const SkFontConfigInterface::FontIdentity& identity);
@@ -589,7 +642,7 @@ diff --git a/components/services/font/public/cpp/font_service_thread.h b/compone
 
   bool FallbackFontForCharacter(
       uint32_t character,
-@@ -118,6 +120,9 @@ class FontServiceThread : public base::RefCountedThreadSafe<FontServiceThread> {
+@@ -121,6 +123,9 @@ class FontServiceThread : public base::RefCountedThreadSafe<FontServiceThread> {
   void OpenStreamImpl(base::WaitableEvent* done_event,
                       base::File* output_file,
                       const uint32_t id_number);
@@ -614,7 +667,7 @@ diff --git a/components/services/font/public/mojom/font_service.mojom b/componen
 diff --git a/content/browser/BUILD.gn b/content/browser/BUILD.gn
 --- a/content/browser/BUILD.gn
 +++ b/content/browser/BUILD.gn
-@@ -2581,6 +2581,17 @@ source_set("browser") {
+@@ -2608,6 +2608,17 @@ source_set("browser") {
     ]
   }
 
@@ -632,8 +685,8 @@ diff --git a/content/browser/BUILD.gn b/content/browser/BUILD.gn
   if (is_linux || is_chromeos) {
     sources -=
         [ "file_system_access/file_path_watcher/file_path_watcher_stub.cc" ]
-@@ -2626,6 +2637,13 @@ source_set("browser") {
-     ]
+@@ -2654,6 +2665,13 @@ source_set("browser") {
+     deps += [ "//components/services/font_data:lib" ]
   }
 
 +  if (is_android) {
@@ -649,7 +702,7 @@ diff --git a/content/browser/BUILD.gn b/content/browser/BUILD.gn
 diff --git a/content/browser/renderer_host/render_process_host_impl_receiver_bindings.cc b/content/browser/renderer_host/render_process_host_impl_receiver_bindings.cc
 --- a/content/browser/renderer_host/render_process_host_impl_receiver_bindings.cc
 +++ b/content/browser/renderer_host/render_process_host_impl_receiver_bindings.cc
-@@ -51,6 +51,11 @@
+@@ -52,6 +52,11 @@
 #include "third_party/blink/public/mojom/android_font_lookup/android_font_lookup.mojom.h"
 #endif
 
@@ -661,7 +714,7 @@ diff --git a/content/browser/renderer_host/render_process_host_impl_receiver_bin
 #if BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_CHROMEOS)
 #include "components/services/font/public/mojom/font_service.mojom.h"  // nogncheck
 #include "content/browser/font_service.h"  // nogncheck
-@@ -336,6 +341,13 @@ void RenderProcessHostImpl::IOThreadHostImpl::BindHostReceiver(
+@@ -351,6 +356,13 @@ void RenderProcessHostImpl::IOThreadHostImpl::BindHostReceiver(
   }
 #endif
 
@@ -678,7 +731,7 @@ diff --git a/content/browser/renderer_host/render_process_host_impl_receiver_bin
 diff --git a/content/child/BUILD.gn b/content/child/BUILD.gn
 --- a/content/child/BUILD.gn
 +++ b/content/child/BUILD.gn
-@@ -136,6 +136,13 @@ target(link_target_type, "child") {
+@@ -135,6 +135,13 @@ target(link_target_type, "child") {
     ]
   }
 
@@ -695,7 +748,7 @@ diff --git a/content/child/BUILD.gn b/content/child/BUILD.gn
 diff --git a/content/renderer/BUILD.gn b/content/renderer/BUILD.gn
 --- a/content/renderer/BUILD.gn
 +++ b/content/renderer/BUILD.gn
-@@ -347,6 +347,10 @@ target(link_target_type, "renderer") {
+@@ -350,6 +350,10 @@ target(link_target_type, "renderer") {
     deps += [ "//services/screen_ai/public/mojom" ]
   }
 
@@ -709,7 +762,7 @@ diff --git a/content/renderer/BUILD.gn b/content/renderer/BUILD.gn
 diff --git a/content/renderer/renderer_blink_platform_impl.cc b/content/renderer/renderer_blink_platform_impl.cc
 --- a/content/renderer/renderer_blink_platform_impl.cc
 +++ b/content/renderer/renderer_blink_platform_impl.cc
-@@ -136,6 +136,23 @@
+@@ -142,6 +142,23 @@
 #include "content/common/android/sync_compositor_statics.h"
 #endif
 
@@ -733,7 +786,7 @@ diff --git a/content/renderer/renderer_blink_platform_impl.cc b/content/renderer
 using blink::Platform;
 using blink::WebAudioDevice;
 using blink::WebAudioLatencyHint;
-@@ -178,6 +195,37 @@ gpu::ContextType ToGpuContextType(blink::Platform::ContextType type) {
+@@ -192,6 +209,37 @@ viz::command_buffer_metrics::ContextType ToVizContextType(
   NOTREACHED();
 }
 
@@ -771,7 +824,7 @@ diff --git a/content/renderer/renderer_blink_platform_impl.cc b/content/renderer
 }  // namespace
 
 //------------------------------------------------------------------------------
-@@ -191,18 +239,21 @@ RendererBlinkPlatformImpl::RendererBlinkPlatformImpl(
+@@ -205,18 +253,21 @@ RendererBlinkPlatformImpl::RendererBlinkPlatformImpl(
       is_locked_to_site_(false),
       main_thread_scheduler_(main_thread_scheduler),
       next_frame_sink_id_(uint32_t{std::numeric_limits<int32_t>::max()} + 1) {
@@ -794,7 +847,19 @@ diff --git a/content/renderer/renderer_blink_platform_impl.cc b/content/renderer
 +#endif
 #endif
 
- #if BUILDFLAG(IS_WIN)
+ #if BUILDFLAG(IS_WIN) || BUILDFLAG(IS_LINUX)
+diff --git a/content/renderer/renderer_main_platform_delegate_android.cc b/content/renderer/renderer_main_platform_delegate_android.cc
+--- a/content/renderer/renderer_main_platform_delegate_android.cc
+++ b/content/renderer/renderer_main_platform_delegate_android.cc
+@@ -35,7 +35,7 @@ void RendererMainPlatformDelegate::PlatformInitialize() {
+   // Android 14+ user devices with updated system fonts will call statx and
+   // possibly other system calls that are not allowed in the sandbox.
+   // See https://crbug.com/40618213 for details.
+-  [[maybe_unused]] auto mgr = skia::DefaultFontMgr();
+  // [[maybe_unused]] auto mgr = skia::DefaultFontMgr();
+ }
+ 
+ void RendererMainPlatformDelegate::PlatformUninitialize() {
 diff --git a/cromite_flags/chrome/browser/about_flags_cc/Android-fonts-fingerprinting-mitigation.inc b/cromite_flags/chrome/browser/about_flags_cc/Android-fonts-fingerprinting-mitigation.inc
 new file mode 100644
 --- /dev/null
@@ -837,7 +902,7 @@ new file mode 100644
 diff --git a/skia/BUILD.gn b/skia/BUILD.gn
 --- a/skia/BUILD.gn
 +++ b/skia/BUILD.gn
-@@ -457,6 +457,18 @@ component("skia") {
+@@ -449,6 +449,18 @@ component("skia") {
     sources += skia_ports_fci_sources
   }
 
@@ -856,6 +921,29 @@ diff --git a/skia/BUILD.gn b/skia/BUILD.gn
   if (is_linux || is_chromeos || is_android) {
     # Retain the files for the SkFontMgr_Android on linux to emulate android
     # fonts. See content/zygote/zygote_main_linux.cc
+diff --git a/skia/ext/font_utils.cc b/skia/ext/font_utils.cc
+--- a/skia/ext/font_utils.cc
+++ b/skia/ext/font_utils.cc
+@@ -59,6 +59,7 @@ SkFontMgr* g_fontmgr_override = nullptr;
+ #if BUILDFLAG(IS_ANDROID)
+ // https://crbug.com/461659286 Failure to create any font causes crash.
+ BASE_FEATURE(kUseAndroidNDKFontAPI, base::FEATURE_DISABLED_BY_DEFAULT);
+SET_CROMITE_FEATURE_DISABLED(kUseAndroidNDKFontAPI);
+ #endif
+ 
+ }  // namespace
+diff --git a/third_party/freetype/include/freetype-custom/freetype/config/ftoption.h b/third_party/freetype/include/freetype-custom/freetype/config/ftoption.h
+--- a/third_party/freetype/include/freetype-custom/freetype/config/ftoption.h
+++ b/third_party/freetype/include/freetype-custom/freetype/config/ftoption.h
+@@ -607,7 +607,7 @@ FT_BEGIN_HEADER
+    * module (namely TrueType~& OpenType).
+    */
+ /* Not needed since PDFs do not support any of the color font formats. */
+-/* #define TT_CONFIG_OPTION_COLOR_LAYERS */
+#define TT_CONFIG_OPTION_COLOR_LAYERS
+ 
+ 
+   /**************************************************************************
 diff --git a/third_party/skia/include/ports/SkFontConfigInterface.h b/third_party/skia/include/ports/SkFontConfigInterface.h
 --- a/third_party/skia/include/ports/SkFontConfigInterface.h
 +++ b/third_party/skia/include/ports/SkFontConfigInterface.h
@@ -883,7 +971,7 @@ diff --git a/third_party/skia/include/ports/SkFontMgr_android.h b/third_party/sk
 
 #include <memory>
 
-@@ -40,13 +45,46 @@ struct SkFontMgr_Android_CustomFonts {
+@@ -40,9 +45,44 @@ struct SkFontMgr_Android_CustomFonts {
      *  system IO resources on initialization.
      */
     bool fIsolated;
@@ -923,23 +1011,21 @@ diff --git a/third_party/skia/include/ports/SkFontMgr_android.h b/third_party/sk
 };
 
 /** Create a font manager for Android. If 'custom' is NULL, use only system fonts. */
- 
- // Deprecated
-SK_API sk_sp<SkFontMgr> SkFontMgr_New_Android(const SkFontMgr_Android_CustomFonts* custom);
-+SK_API sk_sp<SkFontMgr> SkFontMgr_New_Android(std::unique_ptr<SkFontMgr_Android_CustomFonts> custom);
- 
 -SK_API sk_sp<SkFontMgr> SkFontMgr_New_Android(const SkFontMgr_Android_CustomFonts* custom,
+SK_API sk_sp<SkFontMgr> SkFontMgr_New_Android(std::unique_ptr<SkFontMgr_Android_CustomFonts> custom);
+
 +SK_API sk_sp<SkFontMgr> SkFontMgr_New_Android(std::unique_ptr<SkFontMgr_Android_CustomFonts> custom,
                                               std::unique_ptr<SkFontScanner> scanner);
 #endif // SkFontMgr_android_DEFINED
 diff --git a/third_party/skia/src/ports/SkFontConfigInterface.cpp b/third_party/skia/src/ports/SkFontConfigInterface.cpp
 --- a/third_party/skia/src/ports/SkFontConfigInterface.cpp
 +++ b/third_party/skia/src/ports/SkFontConfigInterface.cpp
-@@ -22,7 +22,11 @@ sk_sp<SkFontConfigInterface> SkFontConfigInterface::RefGlobal() {
+@@ -22,7 +22,12 @@ sk_sp<SkFontConfigInterface> SkFontConfigInterface::RefGlobal() {
     if (gFontConfigInterface) {
         return sk_ref_sp(gFontConfigInterface);
     }
 +#if defined(CROMITE_IS_ANDROID)
+    SkASSERT(false);
 +    return nullptr;
 +#else
     return sk_ref_sp(SkFontConfigInterface::GetSingletonDirectInterface());
@@ -950,7 +1036,7 @@ diff --git a/third_party/skia/src/ports/SkFontConfigInterface.cpp b/third_party/
 diff --git a/third_party/skia/src/ports/SkFontConfigInterface_direct.cpp b/third_party/skia/src/ports/SkFontConfigInterface_direct.cpp
 --- a/third_party/skia/src/ports/SkFontConfigInterface_direct.cpp
 +++ b/third_party/skia/src/ports/SkFontConfigInterface_direct.cpp
-@@ -707,3 +707,8 @@ bool SkFontConfigInterfaceDirect::matchFamilyName(const char familyName[],
+@@ -715,3 +715,8 @@ bool SkFontConfigInterfaceDirect::matchFamilyName(const char familyName[],
 SkStreamAsset* SkFontConfigInterfaceDirect::openStream(const FontIdentity& identity) {
     return SkStream::MakeFromFile(identity.fString.c_str()).release();
 }
@@ -973,7 +1059,15 @@ diff --git a/third_party/skia/src/ports/SkFontConfigInterface_direct.h b/third_p
 diff --git a/third_party/skia/src/ports/SkFontMgr_android.cpp b/third_party/skia/src/ports/SkFontMgr_android.cpp
 --- a/third_party/skia/src/ports/SkFontMgr_android.cpp
 +++ b/third_party/skia/src/ports/SkFontMgr_android.cpp
-@@ -27,6 +27,7 @@
+@@ -16,6 +16,7 @@
+ #include "include/core/SkStream.h"
+ #include "include/core/SkString.h"
+ #include "include/ports/SkFontMgr_android.h"
+#include "include/ports/SkFontScanner_FreeType.h"
+ #include "include/private/base/SkFixed.h"
+ #include "include/private/base/SkTArray.h"
+ #include "include/private/base/SkTDArray.h"
+@@ -27,6 +28,7 @@
 #include "src/core/SkTypefaceCache.h"
 #include "src/ports/SkFontMgr_android_parser.h"
 #include "src/ports/SkTypeface_proxy.h"
@@ -981,10 +1075,12 @@ diff --git a/third_party/skia/src/ports/SkFontMgr_android.cpp b/third_party/skia
 
 #include <algorithm>
 #include <limits>
-@@ -36,6 +37,91 @@ using namespace skia_private;
- class SkData;
+@@ -37,7 +39,95 @@ class SkData;
 
 namespace {
+ 
+-[[maybe_unused]] static inline const constexpr bool kSkFontMgrVerbose = false;
+static inline const constexpr bool kSkFontMgrVerbose = true;
 +
 +#include "SkFontMgr_android_data.cpp"
 +
@@ -1032,18 +1128,22 @@ diff --git a/third_party/skia/src/ports/SkFontMgr_android.cpp b/third_party/skia
 +        desc->setFactoryId(SkTypeface_FreeType::FactoryId);
 +        *serialize = false;
 +    }
+
 +    std::unique_ptr<SkStreamAsset> onOpenStream(int* ttcIndex) const override {
 +        *ttcIndex = fIndex;
 +        return this->makeStream();
 +    }
+
 +    std::unique_ptr<SkFontData> onMakeFontData() const override {
 +        return std::make_unique<SkFontData>(
 +                this->makeStream(), fIndex, 0, fAxes.begin(), fAxes.size(), nullptr, 0);
 +    }
+
 +    sk_sp<SkTypeface> onMakeClone(const SkFontArguments& args) const override {
 +        SkFontStyle style = this->fontStyle();
 +        std::unique_ptr<SkFontData> data = this->cloneFontData(args, &style);
 +        if (!data) {
+            SkASSERT(false);
 +            return nullptr;
 +        }
 +        return sk_make_sp<SkTypeface_AndroidSystemCustom>(
@@ -1069,11 +1169,10 @@ diff --git a/third_party/skia/src/ports/SkFontMgr_android.cpp b/third_party/skia
 +
 +    using INHERITED = SkTypeface_FreeType;
 +};
-+
+ 
 class SkTypeface_AndroidSystem : public SkTypeface_proxy {
 public:
-     static sk_sp<SkTypeface_AndroidSystem> Make(sk_sp<SkTypeface> realTypeface,
-@@ -110,7 +196,8 @@ using StreamForPathCache = skia_private::THashMap<SkString, std::unique_ptr<SkSt
+@@ -112,7 +202,8 @@ using StreamForPathCache = skia_private::THashMap<SkString, std::unique_ptr<SkSt
 class SkFontStyleSet_Android : public SkFontStyleSet {
 public:
     explicit SkFontStyleSet_Android(const FontFamily& family, const SkFontScanner* scanner,
@@ -1083,7 +1182,7 @@ diff --git a/third_party/skia/src/ports/SkFontMgr_android.cpp b/third_party/skia
         const SkString* cannonicalFamilyName = nullptr;
         if (!family.fNames.empty()) {
             cannonicalFamilyName = &family.fNames[0];
-@@ -119,38 +206,60 @@ public:
+@@ -121,38 +212,60 @@ public:
 
         // TODO? make this lazy
         for (int i = 0; i < family.fFonts.size(); ++i) {
@@ -1132,7 +1231,7 @@ diff --git a/third_party/skia/src/ports/SkFontMgr_android.cpp b/third_party/skia
 +                use_custom = true;
 +                if (!GetFontData(fontFile.fFileName,
 +                                  &familyName, &fontStyle, &isFixedWidth, &axisDefinitions)) {
-+                    stream = custom->getPlatformFile(pathName.c_str());
+                    stream = custom->getPlatformFile(fontFile.fFileName.c_str());
 +                }
 +                pathName = fontFile.fFileName;
             }
@@ -1167,7 +1266,7 @@ diff --git a/third_party/skia/src/ports/SkFontMgr_android.cpp b/third_party/skia
             }
 
             uint32_t variant = family.fVariant;
-@@ -161,13 +270,25 @@ public:
+@@ -163,13 +276,25 @@ public:
             // The first specified family name overrides the family name found in the font.
             // TODO: SkTypeface_AndroidSystem::onCreateFamilyNameIterator should return
             // all of the specified family names in addition to the names found in the font.
@@ -1199,7 +1298,7 @@ diff --git a/third_party/skia/src/ports/SkFontMgr_android.cpp b/third_party/skia
             int weight = fontFile.fWeight != 0 ? fontFile.fWeight : fontStyle.weight();
             SkFontStyle::Slant slant = fontStyle.slant();
             switch (fontFile.fStyle) {
-@@ -178,6 +299,19 @@ public:
+@@ -180,6 +305,19 @@ public:
             }
             fontStyle = SkFontStyle(weight, fontStyle.width(), slant);
 
@@ -1219,7 +1318,7 @@ diff --git a/third_party/skia/src/ports/SkFontMgr_android.cpp b/third_party/skia
             fStyles.push_back(
                 SkTypeface_AndroidSystem::Make(proxy,
                                                fontStyle, proxy->isFixedPitch(),
-@@ -206,15 +340,18 @@ public:
+@@ -208,15 +346,18 @@ public:
         return fStyles[index];
     }
 
@@ -1241,7 +1340,7 @@ diff --git a/third_party/skia/src/ports/SkFontMgr_android.cpp b/third_party/skia
     SkString fFallbackFor;
 
     friend struct NameToFamily;
-@@ -235,24 +372,26 @@ struct NameToFamily {
+@@ -237,24 +378,26 @@ struct NameToFamily {
 
 class SkFontMgr_Android : public SkFontMgr {
 public:
@@ -1251,7 +1350,7 @@ diff --git a/third_party/skia/src/ports/SkFontMgr_android.cpp b/third_party/skia
         : fScanner(std::move(scanner)) {
 +        custom_ = std::move(custom_in);
 +        auto* custom = custom_.get();
-         SkTDArray<FontFamily*> families;
+         std::vector<std::unique_ptr<FontFamily>> families;
         if (custom && SkFontMgr_Android_CustomFonts::kPreferSystem != custom->fSystemFontUse) {
             SkString base(custom->fBasePath);
             SkFontMgr_Android_Parser::GetCustomFontFamilies(
@@ -1272,22 +1371,24 @@ diff --git a/third_party/skia/src/ports/SkFontMgr_android.cpp b/third_party/skia
         }
         this->buildNameToFamilyMap(families, custom ? custom->fIsolated : false);
         this->findDefaultStyleSet();
-@@ -310,33 +449,53 @@ protected:
-         return sset->matchStyle(style);
+@@ -309,12 +452,12 @@ protected:
     }
 
+     enum class NameType { Self, Fallback };
 -    static sk_sp<SkTypeface_AndroidSystem> find_family_style_character(
 +    sk_sp<SkTypeface> find_family_style_character(
             const SkString& familyName,
-             const TArray<NameToFamily, true>& fallbackNameToFamilyMap,
+             const TArray<NameToFamily, true>& nameToFamilyMap,
+             NameType nameType,
             const SkFontStyle& style, bool elegant,
 -            const SkString& langTag, SkUnichar character)
 +            const SkString& langTag, SkUnichar character) const
     {
-         for (int i = 0; i < fallbackNameToFamilyMap.size(); ++i) {
-             SkFontStyleSet_Android* family = fallbackNameToFamilyMap[i].styleSet;
-             if (familyName != family->fFallbackFor) {
-                 continue;
+         for (auto&& nameToFamily : nameToFamilyMap) {
+             SkFontStyleSet_Android* family = nameToFamily.styleSet;
+@@ -325,22 +468,42 @@ protected:
+                     continue;
+                 }
             }
 -            sk_sp<SkTypeface_AndroidSystem> face(family->matchAStyle(style));
 +            if (custom_) {
@@ -1328,38 +1429,29 @@ diff --git a/third_party/skia/src/ports/SkFontMgr_android.cpp b/third_party/skia
 +                {
 +                    continue;
 +                }
-+
-+                if (SkToBool(face->fVariantStyle & kElegant_FontVariant) != elegant) {
-+                    continue;
-+                }
 
 -            if (face->unicharToGlyph(character) != 0) {
 -                return face;
+                if (SkToBool(face->fVariantStyle & kElegant_FontVariant) != elegant) {
+                    continue;
+                }
+
 +                if (face->unicharToGlyph(character) != 0) {
 +                    return face;
 +                }
             }
         }
         return nullptr;
-@@ -359,7 +518,7 @@ protected:
-                 for (int bcp47Index = bcp47Count; bcp47Index --> 0;) {
-                     SkLanguage lang(bcp47[bcp47Index]);
-                     while (!lang.getTag().isEmpty()) {
-                        sk_sp<SkTypeface_AndroidSystem> matchingTypeface =
-+                        sk_sp<SkTypeface> matchingTypeface =
-                             find_family_style_character(currentFamilyName, fFallbackNameToFamilyMap,
-                                                         style, SkToBool(elegant),
-                                                         lang.getTag(), character);
-@@ -370,7 +529,7 @@ protected:
-                         lang = lang.getParent();
-                     }
-                 }
-                sk_sp<SkTypeface_AndroidSystem> matchingTypeface =
-+                sk_sp<SkTypeface> matchingTypeface =
-                     find_family_style_character(currentFamilyName, fFallbackNameToFamilyMap,
-                                                 style, SkToBool(elegant),
-                                                 SkString(), character);
-@@ -421,6 +580,7 @@ protected:
+@@ -355,7 +518,7 @@ protected:
+         // The variant 'default' means 'compact and elegant'.
+         // As a result, it is not possible to know the variant context from the font alone.
+         // TODO: add 'is_elegant' and 'is_compact' bits to 'style' request.
+-        sk_sp<SkTypeface_AndroidSystem> matchingTypeface;
+        sk_sp<SkTypeface> matchingTypeface;
+         SkString familyNameString(familyName);
+         for (const SkString& currentFamilyName : { familyNameString, SkString() }) {
+             // The first time match anything elegant, second time anything not elegant.
+@@ -435,6 +598,7 @@ protected:
 private:
 
     std::unique_ptr<SkFontScanner> fScanner;
@@ -1367,7 +1459,7 @@ diff --git a/third_party/skia/src/ports/SkFontMgr_android.cpp b/third_party/skia
 
     TArray<sk_sp<SkFontStyleSet_Android>> fStyleSets;
     sk_sp<SkFontStyleSet> fDefaultStyleSet;
-@@ -442,7 +602,7 @@ private:
+@@ -456,7 +620,7 @@ private:
         }
 
         sk_sp<SkFontStyleSet_Android> newSet =
@@ -1376,24 +1468,22 @@ diff --git a/third_party/skia/src/ports/SkFontMgr_android.cpp b/third_party/skia
         if (0 == newSet->count()) {
             return;
         }
-@@ -487,11 +647,11 @@ static char const * const gSystemFontUseStrings[] = {
+@@ -502,7 +666,11 @@ static char const * const gSystemFontUseStrings[] = {
 
 }  // namespace
 
-sk_sp<SkFontMgr> SkFontMgr_New_Android(const SkFontMgr_Android_CustomFonts* custom) {
-    return SkFontMgr_New_Android(custom, SkFontScanner_Make_FreeType());
+-sk_sp<SkFontMgr> SkFontMgr_New_Android(const SkFontMgr_Android_CustomFonts* custom,
 +sk_sp<SkFontMgr> SkFontMgr_New_Android(std::unique_ptr<SkFontMgr_Android_CustomFonts> custom) {
 +    return SkFontMgr_New_Android(std::move(custom), SkFontScanner_Make_FreeType());
- }
- 
-sk_sp<SkFontMgr> SkFontMgr_New_Android(const SkFontMgr_Android_CustomFonts* custom, std::unique_ptr<SkFontScanner> scanner) {
-+sk_sp<SkFontMgr> SkFontMgr_New_Android(std::unique_ptr<SkFontMgr_Android_CustomFonts> custom, std::unique_ptr<SkFontScanner> scanner) {
+}
+
+sk_sp<SkFontMgr> SkFontMgr_New_Android(std::unique_ptr<SkFontMgr_Android_CustomFonts> custom,
+                                        std::unique_ptr<SkFontScanner> scanner) {
     if (custom) {
         SkASSERT(0 <= custom->fSystemFontUse);
-         SkASSERT(custom->fSystemFontUse < std::size(gSystemFontUseStrings));
-@@ -501,5 +661,5 @@ sk_sp<SkFontMgr> SkFontMgr_New_Android(const SkFontMgr_Android_CustomFonts* cust
-                  custom->fFontsXml,
-                  custom->fFallbackFontsXml);
+@@ -515,5 +683,5 @@ sk_sp<SkFontMgr> SkFontMgr_New_Android(const SkFontMgr_Android_CustomFonts* cust
+                      custom->fFallbackFontsXml);
+         }
     }
 -    return sk_make_sp<SkFontMgr_Android>(custom, std::move(scanner));
 +    return sk_make_sp<SkFontMgr_Android>(std::move(custom), std::move(scanner));
@@ -1402,7 +1492,7 @@ diff --git a/third_party/skia/src/ports/SkFontMgr_android_data.cpp b/third_party
 new file mode 100644
 --- /dev/null
 +++ b/third_party/skia/src/ports/SkFontMgr_android_data.cpp
-@@ -0,0 +1,1640 @@
+@@ -0,0 +1,1641 @@
 +// AUTOGENERATED
 +//
 +// SkString dumpAxis("axis|");
@@ -2992,6 +3082,7 @@ new file mode 100644
 +        return true;
 +    }
 +    else if (file.equals("RobotoStatic-Regular.ttf")) {
+        // see https://android.googlesource.com/platform/frameworks/base/+/89abe560d722a6f4136b7a05d80f23b269413aad
 +        familyName->set("RobotoStatic");
 +        *style = SkFontStyle(400, 5, SkFontStyle::kUpright_Slant);
 +        *isFixedPitch = false;
@@ -3043,13 +3134,25 @@ new file mode 100644
 +
 +    return false;
 +}
+diff --git a/third_party/skia/src/ports/SkFontMgr_android_ndk.cpp b/third_party/skia/src/ports/SkFontMgr_android_ndk.cpp
+--- a/third_party/skia/src/ports/SkFontMgr_android_ndk.cpp
+++ b/third_party/skia/src/ports/SkFontMgr_android_ndk.cpp
+@@ -996,7 +996,7 @@ public:
+         }
+ 
+         std::vector<std::unique_ptr<FontFamily>> xmlFamilies;
+-        SkFontMgr_Android_Parser::GetSystemFontFamilies(xmlFamilies);
+        SkFontMgr_Android_Parser::GetSystemFontFamilies(xmlFamilies, /*custom*/ nullptr);
+ 
+         skia_private::THashMap<SkString, std::unique_ptr<SkStreamAsset>> streamForPath;
+ 
 diff --git a/third_party/skia/src/ports/SkFontMgr_android_parser.cpp b/third_party/skia/src/ports/SkFontMgr_android_parser.cpp
 --- a/third_party/skia/src/ports/SkFontMgr_android_parser.cpp
 +++ b/third_party/skia/src/ports/SkFontMgr_android_parser.cpp
-@@ -652,14 +652,27 @@ static const XML_Memory_Handling_Suite sk_XML_alloc = {
-  * families array. Returns the version of the file, negative if the file does not exist.
+@@ -654,14 +654,27 @@ static const XML_Memory_Handling_Suite sk_XML_alloc = {
  */
- static int parse_config_file(const char* filename, SkTDArray<FontFamily*>& families,
+ static int parse_config_file(const char* filename,
+                              std::vector<std::unique_ptr<FontFamily>>& families,
 -                             const SkString& basePath, bool isFallback)
 +                             const SkString& basePath, bool isFallback,
 +                             const SkFontMgr_Android_CustomFonts* custom = nullptr)
@@ -3080,7 +3183,7 @@ diff --git a/third_party/skia/src/ports/SkFontMgr_android_parser.cpp b/third_par
         return -1;
     }
 
-@@ -691,8 +704,8 @@ static int parse_config_file(const char* filename, SkTDArray<FontFamily*>& famil
+@@ -693,8 +706,8 @@ static int parse_config_file(const char* filename,
             SkDebugf(SK_FONTMGR_ANDROID_PARSER_PREFIX "could not buffer enough to continue\n");
             return -1;
         }
@@ -3091,57 +3194,83 @@ diff --git a/third_party/skia/src/ports/SkFontMgr_android_parser.cpp b/third_par
         XML_Status status = XML_ParseBuffer(parser, len, done);
         if (XML_STATUS_ERROR == status) {
             XML_Error error = XML_GetErrorCode(parser);
-@@ -765,8 +778,10 @@ static void append_fallback_font_families_for_locale(SkTDArray<FontFamily*>& fal
+@@ -706,6 +719,23 @@ static int parse_config_file(const char* filename,
+             return -1;
+         }
+     }
+    if (custom) {
+        // remove NotoColorEmojiLegacy.ttf
+        for (int i = 0; i < families.size(); ++i) {
+            bool exists = false;
+            auto& family = families[i];
+            for (auto& font : family->fFonts) {
+                if (font.fFileName.equals("NotoColorEmojiLegacy.ttf")) {
+                    exists = true;
+                    break;
+                }
+            }
+            if (exists) {
+                families.erase(families.begin() + i);
+                break;
+            }
+        }
+    }
+     return self.fVersion;
 }
 
- static void append_system_fallback_font_families(SkTDArray<FontFamily*>& fallbackFonts,
-                                                 const SkString& basePath)
-+                                                 const SkString& basePath,
-+                                                 const SkFontMgr_Android_CustomFonts* custom)
+@@ -768,8 +798,10 @@ static void append_fallback_font_families_for_locale(
+ 
+ static void append_system_fallback_font_families(
+     std::vector<std::unique_ptr<FontFamily>>& fallbackFonts,
+-    const SkString& basePath)
+    const SkString& basePath,
+    const SkFontMgr_Android_CustomFonts* custom)
 {
 +    if (custom) return;
     parse_config_file(FALLBACK_FONTS_FILE, fallbackFonts, basePath, true);
     append_fallback_font_families_for_locale(fallbackFonts,
                                              LOCALE_FALLBACK_FONTS_SYSTEM_DIR,
-@@ -774,8 +789,10 @@ static void append_system_fallback_font_families(SkTDArray<FontFamily*>& fallbac
- }
+@@ -778,8 +810,10 @@ static void append_system_fallback_font_families(
 
- static void mixin_vendor_fallback_font_families(SkTDArray<FontFamily*>& fallbackFonts,
-                                                const SkString& basePath)
-+                                                const SkString& basePath,
-+                                                const SkFontMgr_Android_CustomFonts* custom)
+ static void mixin_vendor_fallback_font_families(
+         std::vector<std::unique_ptr<FontFamily>>& fallbackFonts,
+-        const SkString& basePath)
+        const SkString& basePath,
+        const SkFontMgr_Android_CustomFonts* custom)
 {
 +    if (custom) return;
-     SkTDArray<FontFamily*> vendorFonts;
+     std::vector<std::unique_ptr<FontFamily>> vendorFonts;
     parse_config_file(VENDOR_FONTS_FILE, vendorFonts, basePath, true);
     append_fallback_font_families_for_locale(vendorFonts,
-@@ -806,7 +823,8 @@ static void mixin_vendor_fallback_font_families(SkTDArray<FontFamily*>& fallback
-     }
+@@ -811,7 +845,8 @@ static void mixin_vendor_fallback_font_families(
 }
 
-void SkFontMgr_Android_Parser::GetSystemFontFamilies(SkTDArray<FontFamily*>& fontFamilies) {
-+void SkFontMgr_Android_Parser::GetSystemFontFamilies(SkTDArray<FontFamily*>& fontFamilies,
-+                                                     const SkFontMgr_Android_CustomFonts* custom) {
+ void SkFontMgr_Android_Parser::GetSystemFontFamilies(
+-        std::vector<std::unique_ptr<FontFamily>>& fontFamilies)
+        std::vector<std::unique_ptr<FontFamily>>& fontFamilies,
+        const SkFontMgr_Android_CustomFonts* custom)
+ {
     // Version 21 of the system font configuration does not need any fallback configuration files.
     SkString basePath(getenv("ANDROID_ROOT"));
-     basePath.append(SK_FONT_FILE_PREFIX, sizeof(SK_FONT_FILE_PREFIX) - 1);
-@@ -817,22 +835,23 @@ void SkFontMgr_Android_Parser::GetSystemFontFamilies(SkTDArray<FontFamily*>& fon
+@@ -823,8 +858,8 @@ void SkFontMgr_Android_Parser::GetSystemFontFamilies(
 
     // Append all the fallback fonts to system fonts
-     SkTDArray<FontFamily*> fallbackFonts;
+     std::vector<std::unique_ptr<FontFamily>> fallbackFonts;
 -    append_system_fallback_font_families(fallbackFonts, basePath);
 -    mixin_vendor_fallback_font_families(fallbackFonts, basePath);
 +    append_system_fallback_font_families(fallbackFonts, basePath, custom);
 +    mixin_vendor_fallback_font_families(fallbackFonts, basePath, custom);
-     fontFamilies.append(fallbackFonts.size(), fallbackFonts.begin());
- }
- 
- void SkFontMgr_Android_Parser::GetCustomFontFamilies(SkTDArray<FontFamily*>& fontFamilies,
-                                                      const SkString& basePath,
-+                                                     const SkFontMgr_Android_CustomFonts* custom,
-                                                      const char* fontsXml,
-                                                      const char* fallbackFontsXml,
-                                                      const char* langFallbackFontsDir)
+     fontFamilies.insert(fontFamilies.end(),
+                         std::make_move_iterator(fallbackFonts.begin()),
+                         std::make_move_iterator(fallbackFonts.end()));
+@@ -833,15 +868,16 @@ void SkFontMgr_Android_Parser::GetSystemFontFamilies(
+ void SkFontMgr_Android_Parser::GetCustomFontFamilies(
+         std::vector<std::unique_ptr<FontFamily>>& fontFamilies,
+         const SkString& basePath,
+        const SkFontMgr_Android_CustomFonts* custom,
+         const char* fontsXml,
+         const char* fallbackFontsXml,
+         const char* langFallbackFontsDir)
 {
     if (fontsXml) {
 -        parse_config_file(fontsXml, fontFamilies, basePath, false);
@@ -3156,7 +3285,7 @@ diff --git a/third_party/skia/src/ports/SkFontMgr_android_parser.cpp b/third_par
 diff --git a/third_party/skia/src/ports/SkFontMgr_android_parser.h b/third_party/skia/src/ports/SkFontMgr_android_parser.h
 --- a/third_party/skia/src/ports/SkFontMgr_android_parser.h
 +++ b/third_party/skia/src/ports/SkFontMgr_android_parser.h
-@@ -15,6 +15,7 @@
+@@ -17,6 +17,7 @@
 #include "include/private/base/SkTArray.h"
 #include "include/private/base/SkTDArray.h"
 #include "src/core/SkTHash.h"
@@ -3164,16 +3293,16 @@ diff --git a/third_party/skia/src/ports/SkFontMgr_android_parser.h b/third_party
 
 #include <climits>
 #include <limits>
-@@ -105,11 +106,13 @@ struct FontFamily {
+@@ -109,11 +110,13 @@ struct FontFamily {
 namespace SkFontMgr_Android_Parser {
 
 /** Parses system font configuration files and appends result to fontFamilies. */
-void GetSystemFontFamilies(SkTDArray<FontFamily*>& fontFamilies);
-+void GetSystemFontFamilies(SkTDArray<FontFamily*>& fontFamilies,
+-void GetSystemFontFamilies(std::vector<std::unique_ptr<FontFamily>>& fontFamilies);
+void GetSystemFontFamilies(std::vector<std::unique_ptr<FontFamily>>& fontFamilies,
 +                           const SkFontMgr_Android_CustomFonts* custom);
 
 /** Parses font configuration files and appends result to fontFamilies. */
- void GetCustomFontFamilies(SkTDArray<FontFamily*>& fontFamilies,
+ void GetCustomFontFamilies(std::vector<std::unique_ptr<FontFamily>>& fontFamilies,
                            const SkString& basePath,
 +                           const SkFontMgr_Android_CustomFonts* custom,
                            const char* fontsXml,
@@ -76,7 +76,7 @@ diff --git a/chrome/android/java/res/xml/homepage_preferences.xml b/chrome/andro
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/net/connectivitydetector/ConnectivityDetector.java b/chrome/android/java/src/org/chromium/chrome/browser/net/connectivitydetector/ConnectivityDetector.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/net/connectivitydetector/ConnectivityDetector.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/net/connectivitydetector/ConnectivityDetector.java
-@@ -468,7 +468,6 @@ public class ConnectivityDetector implements NetworkChangeNotifier.ConnectionTyp
+@@ -470,7 +470,6 @@ public class ConnectivityDetector implements NetworkChangeNotifier.ConnectionTyp
     @VisibleForTesting(otherwise = VisibleForTesting.PACKAGE_PRIVATE)
     public void setConnectionState(@ConnectionState int connectionState) {
         Log.i(TAG, "setConnectionState connectionState=" + connectionState);
@@ -87,7 +87,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/net/connectivit
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/offlinepages/indicator/OfflineDetector.java b/chrome/android/java/src/org/chromium/chrome/browser/offlinepages/indicator/OfflineDetector.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/offlinepages/indicator/OfflineDetector.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/offlinepages/indicator/OfflineDetector.java
-@@ -21,16 +21,38 @@ import org.chromium.base.version_info.VersionInfo;
+@@ -22,10 +22,31 @@ import org.chromium.build.annotations.Nullable;
 import org.chromium.chrome.browser.flags.ChromeFeatureList;
 import org.chromium.chrome.browser.net.connectivitydetector.ConnectivityDetector;
 import org.chromium.chrome.browser.net.connectivitydetector.ConnectivityDetector.ConnectionState;
@@ -118,10 +118,12 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/offlinepages/in
 +import org.chromium.content_public.browser.WebContents;
 +import org.chromium.net.NetworkChangeNotifier;
 +
+ import java.util.function.Supplier;
+ 
 /**
-  * Class that detects if the network is offline. Waits for the network to stablize before notifying
-  * the observer.
+@@ -34,7 +55,8 @@ import java.util.function.Supplier;
  */
+ @NullMarked
 class OfflineDetector
 -        implements ConnectivityDetector.Observer, ApplicationStatus.ApplicationStateListener {
 +        implements ConnectivityDetector.Observer, ApplicationStatus.ApplicationStateListener,
@@ -129,7 +131,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/offlinepages/in
     // If the connection is online, then we report that immediately via |mIsOfflineCallback|.
     // |STATUS_INDICATOR_WAIT_ON_OFFLINE_DURATION_MS| and
     // |mStatusIndicatorWaitOnSwitchOnlineToOfflineDurationMs| control the duration before
-@@ -116,6 +138,11 @@ class OfflineDetector
+@@ -120,6 +142,11 @@ class OfflineDetector
 
     private static final String TAG = "OfflineDetector";
 
@@ -141,7 +143,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/offlinepages/in
     /**
      * Constructs the offline indicator.
      * @param isOfflineCallback The {@link Callback} is invoked when the connectivity status is
-@@ -127,7 +154,13 @@ class OfflineDetector
+@@ -131,7 +158,13 @@ class OfflineDetector
     OfflineDetector(
             Callback<Boolean> isOfflineCallback,
             Callback<Boolean> isForegroundCallback,
@@ -156,7 +158,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/offlinepages/in
         mIsOfflineCallback = isOfflineCallback;
         mIsForegroundCallback = isForegroundCallback;
         mContext = context;
-@@ -231,6 +264,75 @@ class OfflineDetector
+@@ -235,6 +268,75 @@ class OfflineDetector
         updateState();
     }
 
@@ -197,7 +199,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/offlinepages/in
 +            Snackbar snackbar = Snackbar.make(
 +                mContext.getString(R.string.ask_to_restart_on_connection_change_restart),
 +                /* snackbarController */ this, Snackbar.TYPE_PERSISTENT, Snackbar.UMA_UNKNOWN)
-+                .setSingleLine(false)
+                .setDefaultLines(false)
 +                .setAction(mContext.getString(R.string.relaunch), /*actionData*/0)
 +                .setDismissAction(mContext.getString(R.string.ask_to_restart_on_connection_change_close_notification), /*actionData*/1);
 +            SnackbarManager snackbarManager = mSnackbarManagerSupplier.get();
@@ -232,7 +234,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/offlinepages/in
     private void logToAdbConsoleNow(String prefix) {
         Log.i(
                 TAG,
-@@ -316,6 +418,7 @@ class OfflineDetector
+@@ -321,6 +423,7 @@ class OfflineDetector
      ** Calls |mUpdateOfflineStatusIndicatorDelayedRunnable| to update the connection state.
      */
     private void updateState() {
@@ -243,9 +245,9 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/offlinepages/in
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/offlinepages/indicator/OfflineIndicatorControllerV2.java b/chrome/android/java/src/org/chromium/chrome/browser/offlinepages/indicator/OfflineIndicatorControllerV2.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/offlinepages/indicator/OfflineIndicatorControllerV2.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/offlinepages/indicator/OfflineIndicatorControllerV2.java
-@@ -28,6 +28,11 @@ import org.chromium.content_public.common.ContentSwitches;
- import java.lang.annotation.Retention;
+@@ -31,6 +31,11 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
+ import java.util.function.Supplier;
 
 +import org.chromium.base.supplier.ObservableSupplierImpl;
 +import org.chromium.chrome.browser.layouts.LayoutManager;
@@ -255,7 +257,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/offlinepages/in
 /**
  * Class that controls visibility and content of {@link StatusIndicatorCoordinator} to relay
  * connectivity information.
-@@ -101,7 +106,10 @@ public class OfflineIndicatorControllerV2 {
+@@ -104,7 +109,10 @@ public class OfflineIndicatorControllerV2 {
             Context context,
             StatusIndicatorCoordinator statusIndicator,
             ObservableSupplier<Boolean> isUrlBarFocusedSupplier,
@@ -264,10 +266,10 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/offlinepages/in
 +            ObservableSupplier<TabModelSelector> tabModelSelectorSupplier,
 +            ObservableSupplierImpl<LayoutManager> layoutManager,
 +            Supplier<SnackbarManager> snackbarManagerSupplier) {
-         if (CommandLine.getInstance()
-                 .hasSwitch(ContentSwitches.FORCE_ONLINE_CONNECTION_STATE_FOR_INDICATOR)) {
-             // If "force online connection state" switch is set, the offline indicator should never
-@@ -129,7 +137,10 @@ public class OfflineIndicatorControllerV2 {
+         // If "force online connection state" switch is set, the offline indicator should never
+         // show.
+         assert !CommandLine.getInstance()
+@@ -130,7 +138,10 @@ public class OfflineIndicatorControllerV2 {
                     new OfflineDetector(
                             (Boolean offline) -> onConnectionStateChanged(offline),
                             (Boolean isForeground) -> onApplicationStateChanged(isForeground),
@@ -282,22 +284,22 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/offlinepages/in
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedRootUiCoordinator.java b/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedRootUiCoordinator.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedRootUiCoordinator.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedRootUiCoordinator.java
-@@ -1373,7 +1373,10 @@ public class TabbedRootUiCoordinator extends RootUiCoordinator {
-                         mActivity,
-                         mStatusIndicatorCoordinator,
-                         isUrlBarFocusedSupplier,
-                        mCanAnimateBrowserControls);
-+                        mCanAnimateBrowserControls,
-+                        mTabModelSelectorSupplier,
-+                        mLayoutManagerSupplier,
-+                        mSnackbarManagerSupplier);
-         if (mToolbarManager.getOmniboxStub() != null) {
-             mToolbarManager.getOmniboxStub().addUrlFocusChangeListener(mUrlFocusChangeListener);
+@@ -1525,7 +1525,10 @@ public class TabbedRootUiCoordinator extends RootUiCoordinator {
+                             mActivity,
+                             mStatusIndicatorCoordinator,
+                             isUrlBarFocusedSupplier,
+-                            mCanAnimateBrowserControls);
+                            mCanAnimateBrowserControls,
+                            mTabModelSelectorSupplier,
+                            mLayoutManagerSupplier,
+                            mSnackbarManagerSupplier);
         }
+ 
+         if (mToolbarManager.getOmniboxStub() != null) {
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/TabModelSelectorBase.java b/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/TabModelSelectorBase.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/TabModelSelectorBase.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/TabModelSelectorBase.java
-@@ -195,6 +195,13 @@ public abstract class TabModelSelectorBase
+@@ -200,6 +200,13 @@ public abstract class TabModelSelectorBase
         return null;
     }
 
@@ -309,7 +311,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/TabMod
 +    }
 +
     @Override
-     public @NonNull TabModel getCurrentModel() {
+     public TabModel getCurrentModel() {
         if (mTabModelInternals.size() == 0) return EmptyTabModel.getInstance(false);
 diff --git a/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/cromite/sAskForRestartOnConnectionChange.java b/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/cromite/sAskForRestartOnConnectionChange.java
 new file mode 100644
@@ -351,9 +353,9 @@ new file mode 100644
 diff --git a/chrome/browser/tabmodel/android/java/src/org/chromium/chrome/browser/tabmodel/TabModelSelector.java b/chrome/browser/tabmodel/android/java/src/org/chromium/chrome/browser/tabmodel/TabModelSelector.java
 --- a/chrome/browser/tabmodel/android/java/src/org/chromium/chrome/browser/tabmodel/TabModelSelector.java
 +++ b/chrome/browser/tabmodel/android/java/src/org/chromium/chrome/browser/tabmodel/TabModelSelector.java
-@@ -146,6 +146,8 @@ public interface TabModelSelector {
-     /** Get total tab count across all tab models */
-     int getTotalTabCount();
+@@ -150,6 +150,8 @@ public interface TabModelSelector {
+     /** Get total pinned tab count across all tab models */
+     int getTotalPinnedTabCount();
 
 +    void setPagesFrozen(boolean frozen);
 +
@@ -363,7 +365,7 @@ diff --git a/chrome/browser/tabmodel/android/java/src/org/chromium/chrome/browse
 diff --git a/chrome/browser/tabmodel/android/java/src/org/chromium/chrome/browser/tabmodel/TabModelUtils.java b/chrome/browser/tabmodel/android/java/src/org/chromium/chrome/browser/tabmodel/TabModelUtils.java
 --- a/chrome/browser/tabmodel/android/java/src/org/chromium/chrome/browser/tabmodel/TabModelUtils.java
 +++ b/chrome/browser/tabmodel/android/java/src/org/chromium/chrome/browser/tabmodel/TabModelUtils.java
-@@ -16,12 +16,16 @@ import org.chromium.build.annotations.Nullable;
+@@ -15,6 +15,7 @@ import org.chromium.build.annotations.Nullable;
 import org.chromium.chrome.browser.tab.Tab;
 import org.chromium.chrome.browser.tab.TabSelectionType;
 import org.chromium.content_public.browser.WebContents;
@@ -371,16 +373,17 @@ diff --git a/chrome/browser/tabmodel/android/java/src/org/chromium/chrome/browse
 import org.chromium.ui.base.WindowAndroid;
 
 import java.util.ArrayList;
- import java.util.Collection;
+@@ -22,6 +23,9 @@ import java.util.Collection;
 import java.util.List;
 import java.util.function.Predicate;
+ import java.util.function.Supplier;
 +import java.util.Collections;
 +import java.util.stream.IntStream;
 +import java.util.stream.Collectors;
 
 /**
  * A set of convenience methods used for interacting with {@link TabList}s and {@link TabModel}s.
-@@ -55,6 +59,20 @@ public class TabModelUtils {
+@@ -54,6 +58,20 @@ public class TabModelUtils {
         return TabModel.INVALID_TAB_INDEX;
     }
 
@@ -416,7 +419,7 @@ diff --git a/chrome/browser/tabwindow/android/java/src/org/chromium/chrome/brows
 diff --git a/chrome/browser/tabwindow/internal/android/java/src/org/chromium/chrome/browser/tabwindow/TabWindowManagerImpl.java b/chrome/browser/tabwindow/internal/android/java/src/org/chromium/chrome/browser/tabwindow/TabWindowManagerImpl.java
 --- a/chrome/browser/tabwindow/internal/android/java/src/org/chromium/chrome/browser/tabwindow/TabWindowManagerImpl.java
 +++ b/chrome/browser/tabwindow/internal/android/java/src/org/chromium/chrome/browser/tabwindow/TabWindowManagerImpl.java
-@@ -555,6 +555,16 @@ public class TabWindowManagerImpl implements TabWindowManager {
+@@ -568,6 +568,16 @@ public class TabWindowManagerImpl implements TabWindowManager {
         return tabGroupModelFilter.getTabsInGroup(tabGroupId);
     }
 
@@ -494,7 +497,7 @@ diff --git a/chrome/browser/ui/messages/android/java/res/layout/snackbar.xml b/c
 diff --git a/chrome/browser/ui/messages/android/java/src/org/chromium/chrome/browser/ui/messages/snackbar/Snackbar.java b/chrome/browser/ui/messages/android/java/src/org/chromium/chrome/browser/ui/messages/snackbar/Snackbar.java
 --- a/chrome/browser/ui/messages/android/java/src/org/chromium/chrome/browser/ui/messages/snackbar/Snackbar.java
 +++ b/chrome/browser/ui/messages/android/java/src/org/chromium/chrome/browser/ui/messages/snackbar/Snackbar.java
-@@ -136,6 +136,8 @@ public class Snackbar {
+@@ -140,6 +140,8 @@ public class Snackbar {
     private @Nullable String mTemplateText;
     private @Nullable String mActionText;
     private @Nullable Object mActionData;
@@ -502,8 +505,8 @@ diff --git a/chrome/browser/ui/messages/android/java/src/org/chromium/chrome/bro
 +    private Object mDismissActionData;
     private int mBackgroundColor;
     private int mTextApperanceResId;
-     private boolean mSingleLine = true;
-@@ -241,6 +243,20 @@ public class Snackbar {
+     private boolean mDefaultLines = true;
+@@ -246,6 +248,20 @@ public class Snackbar {
         return this;
     }
 
@@ -527,7 +530,7 @@ diff --git a/chrome/browser/ui/messages/android/java/src/org/chromium/chrome/bro
 diff --git a/chrome/browser/ui/messages/android/java/src/org/chromium/chrome/browser/ui/messages/snackbar/SnackbarManager.java b/chrome/browser/ui/messages/android/java/src/org/chromium/chrome/browser/ui/messages/snackbar/SnackbarManager.java
 --- a/chrome/browser/ui/messages/android/java/src/org/chromium/chrome/browser/ui/messages/snackbar/SnackbarManager.java
 +++ b/chrome/browser/ui/messages/android/java/src/org/chromium/chrome/browser/ui/messages/snackbar/SnackbarManager.java
-@@ -326,6 +326,12 @@ public class SnackbarManager
+@@ -348,6 +348,12 @@ public class SnackbarManager
                         new SnackbarView(
                                 mActivity,
                                 this,
@@ -551,38 +554,38 @@ diff --git a/chrome/browser/ui/messages/android/java/src/org/chromium/chrome/bro
     private final ImageView mProfileImageView;
     private final int mAnimationDuration;
     private final boolean mIsTablet;
-@@ -101,11 +102,12 @@ public class SnackbarView implements InsetObserver.WindowInsetObserver {
+@@ -100,11 +101,12 @@ public class SnackbarView implements InsetObserver.WindowInsetObserver {
     public SnackbarView(
             Activity activity,
-             OnClickListener listener,
+             SnackbarManager manager,
 +            OnClickListener dismissListener,
             Snackbar snackbar,
             ViewGroup parentView,
             @Nullable WindowAndroid windowAndroid,
             boolean isTablet) {
-        this(activity, listener, snackbar, parentView, windowAndroid, null, isTablet);
-+        this(activity, listener, dismissListener, snackbar, parentView, windowAndroid, null, isTablet);
+-        this(activity, manager, snackbar, parentView, windowAndroid, null, isTablet);
+        this(activity, manager, dismissListener, snackbar, parentView, windowAndroid, null, isTablet);
     }
 
     /**
-@@ -124,6 +126,7 @@ public class SnackbarView implements InsetObserver.WindowInsetObserver {
+@@ -122,6 +124,7 @@ public class SnackbarView implements InsetObserver.WindowInsetObserver {
     public SnackbarView(
             Activity activity,
-             OnClickListener listener,
+             SnackbarManager manager,
 +            OnClickListener dismissListener,
             Snackbar snackbar,
             ViewGroup parentView,
             @Nullable WindowAndroid windowAndroid,
-@@ -154,6 +157,8 @@ public class SnackbarView implements InsetObserver.WindowInsetObserver {
+@@ -158,6 +161,8 @@ public class SnackbarView implements InsetObserver.WindowInsetObserver {
                 (TemplatePreservingTextView) mContainerView.findViewById(R.id.snackbar_message);
         mActionButtonView = (TextView) mContainerView.findViewById(R.id.snackbar_button);
-         mActionButtonView.setOnClickListener(listener);
+         mActionButtonView.setOnClickListener(manager);
 +        mDismissButtonView = (TextView) mContainerView.findViewById(R.id.snackbar_dismiss);
 +        mDismissButtonView.setOnClickListener(dismissListener);
         mProfileImageView = (ImageView) mContainerView.findViewById(R.id.snackbar_profile_image);
         mEdgeToEdgeSupplier = edgeToEdgeSupplier;
-         if (SnackbarManager.isFloatingSnackbarEnabled()) {
-@@ -428,6 +433,12 @@ public class SnackbarView implements InsetObserver.WindowInsetObserver {
+         // TODO(crbug.com/451807932): Replace with a custom pad adjuster to account for inset
+@@ -434,6 +439,12 @@ public class SnackbarView implements InsetObserver.WindowInsetObserver {
             mActionButtonView.setVisibility(View.VISIBLE);
             mActionButtonView.setContentDescription(snackbar.getActionText());
             setViewText(mActionButtonView, snackbar.getActionText(), animate);
@@ -598,7 +601,7 @@ diff --git a/chrome/browser/ui/messages/android/java/src/org/chromium/chrome/bro
 diff --git a/content/browser/web_contents/web_contents_android.cc b/content/browser/web_contents/web_contents_android.cc
 --- a/content/browser/web_contents/web_contents_android.cc
 +++ b/content/browser/web_contents/web_contents_android.cc
-@@ -899,6 +899,22 @@ void WebContentsAndroid::SetFocus(JNIEnv* env, jboolean focused) {
+@@ -911,6 +911,22 @@ void WebContentsAndroid::SetFocus(JNIEnv* env, jboolean focused) {
   view->SetFocus(focused);
 }
 
@@ -624,7 +627,7 @@ diff --git a/content/browser/web_contents/web_contents_android.cc b/content/brow
 diff --git a/content/browser/web_contents/web_contents_android.h b/content/browser/web_contents/web_contents_android.h
 --- a/content/browser/web_contents/web_contents_android.h
 +++ b/content/browser/web_contents/web_contents_android.h
-@@ -194,6 +194,7 @@ class CONTENT_EXPORT WebContentsAndroid {
+@@ -199,6 +199,7 @@ class CONTENT_EXPORT WebContentsAndroid {
 
   void OnScaleFactorChanged(JNIEnv* env);
   void SetFocus(JNIEnv* env, jboolean focused);
@@ -635,7 +638,7 @@ diff --git a/content/browser/web_contents/web_contents_android.h b/content/brows
 diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
 --- a/content/browser/web_contents/web_contents_impl.cc
 +++ b/content/browser/web_contents/web_contents_impl.cc
-@@ -3991,8 +3991,10 @@ void WebContentsImpl::Stop() {
+@@ -4096,8 +4096,10 @@ void WebContentsImpl::Stop() {
 void WebContentsImpl::SetPageFrozen(bool frozen) {
   TRACE_EVENT1("content", "WebContentsImpl::SetPageFrozen", "frozen", frozen);
 
@@ -649,7 +652,7 @@ diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser
 diff --git a/content/public/android/java/src/org/chromium/content/browser/webcontents/WebContentsImpl.java b/content/public/android/java/src/org/chromium/content/browser/webcontents/WebContentsImpl.java
 --- a/content/public/android/java/src/org/chromium/content/browser/webcontents/WebContentsImpl.java
 +++ b/content/public/android/java/src/org/chromium/content/browser/webcontents/WebContentsImpl.java
-@@ -1130,6 +1130,12 @@ public class WebContentsImpl
+@@ -1143,6 +1143,12 @@ public class WebContentsImpl
         WebContentsImplJni.get().setFocus(mNativeWebContentsAndroid, hasFocus);
     }
 
@@ -662,7 +665,7 @@ diff --git a/content/public/android/java/src/org/chromium/content/browser/webcon
     @Override
     public void setDisplayCutoutSafeArea(Rect insets) {
         if (mNativeWebContentsAndroid == 0) return;
-@@ -1450,6 +1456,8 @@ public class WebContentsImpl
+@@ -1486,6 +1492,8 @@ public class WebContentsImpl
 
         void setFocus(long nativeWebContentsAndroid, boolean focused);
 
@@ -674,7 +677,7 @@ diff --git a/content/public/android/java/src/org/chromium/content/browser/webcon
 diff --git a/content/public/android/java/src/org/chromium/content_public/browser/WebContents.java b/content/public/android/java/src/org/chromium/content_public/browser/WebContents.java
 --- a/content/public/android/java/src/org/chromium/content_public/browser/WebContents.java
 +++ b/content/public/android/java/src/org/chromium/content_public/browser/WebContents.java
-@@ -283,6 +283,8 @@ public interface WebContents extends Parcelable {
+@@ -297,6 +297,8 @@ public interface WebContents extends Parcelable {
      */
     void setFocus(boolean hasFocus);
 
@@ -686,7 +689,7 @@ diff --git a/content/public/android/java/src/org/chromium/content_public/browser
 diff --git a/content/public/test/android/javatests/src/org/chromium/content_public/browser/test/mock/MockWebContents.java b/content/public/test/android/javatests/src/org/chromium/content_public/browser/test/mock/MockWebContents.java
 --- a/content/public/test/android/javatests/src/org/chromium/content_public/browser/test/mock/MockWebContents.java
 +++ b/content/public/test/android/javatests/src/org/chromium/content_public/browser/test/mock/MockWebContents.java
-@@ -188,6 +188,9 @@ public class MockWebContents implements WebContents, WebContentsObserver.Observa
+@@ -191,6 +191,9 @@ public class MockWebContents implements WebContents, WebContentsObserver.Observa
     @Override
     public void setFocus(boolean hasFocus) {}
 
@@ -731,7 +734,7 @@ new file mode 100644
 diff --git a/third_party/blink/renderer/core/dom/document.cc b/third_party/blink/renderer/core/dom/document.cc
 --- a/third_party/blink/renderer/core/dom/document.cc
 +++ b/third_party/blink/renderer/core/dom/document.cc
-@@ -4387,6 +4387,7 @@ void Document::DispatchUnloadEvents(UnloadEventTimingInfo* unload_timing_info) {
+@@ -4665,6 +4665,7 @@ void Document::DispatchUnloadEvents(UnloadEventTimingInfo* unload_timing_info) {
 }
 
 void Document::DispatchFreezeEvent() {
@@ -742,7 +745,7 @@ diff --git a/third_party/blink/renderer/core/dom/document.cc b/third_party/blink
 diff --git a/third_party/blink/renderer/core/frame/local_frame.cc b/third_party/blink/renderer/core/frame/local_frame.cc
 --- a/third_party/blink/renderer/core/frame/local_frame.cc
 +++ b/third_party/blink/renderer/core/frame/local_frame.cc
-@@ -3178,6 +3178,7 @@ void LocalFrame::DidFreeze() {
+@@ -3321,6 +3321,7 @@ void LocalFrame::DidFreeze() {
   LoaderFreezeMode freeze_mode = GetLoaderFreezeMode();
   GetDocument()->Fetcher()->SetDefersLoading(freeze_mode);
   Loader().SetDefersLoading(freeze_mode);
@@ -750,7 +753,7 @@ diff --git a/third_party/blink/renderer/core/frame/local_frame.cc b/third_party/
 }
 
 void LocalFrame::DidResume() {
-@@ -3192,6 +3193,7 @@ void LocalFrame::DidResume() {
+@@ -3335,6 +3336,7 @@ void LocalFrame::DidResume() {
   GetDocument()->Fetcher()->SetDefersLoading(LoaderFreezeMode::kNone);
   Loader().SetDefersLoading(LoaderFreezeMode::kNone);
 
@@ -761,7 +764,7 @@ diff --git a/third_party/blink/renderer/core/frame/local_frame.cc b/third_party/
 diff --git a/third_party/blink/renderer/platform/scheduler/main_thread/frame_scheduler_impl.cc b/third_party/blink/renderer/platform/scheduler/main_thread/frame_scheduler_impl.cc
 --- a/third_party/blink/renderer/platform/scheduler/main_thread/frame_scheduler_impl.cc
 +++ b/third_party/blink/renderer/platform/scheduler/main_thread/frame_scheduler_impl.cc
-@@ -998,7 +998,9 @@ SchedulingLifecycleState FrameSchedulerImpl::CalculateLifecycleState(
+@@ -1025,7 +1025,9 @@ SchedulingLifecycleState FrameSchedulerImpl::CalculateLifecycleState(
   if (!parent_page_scheduler_)
     return SchedulingLifecycleState::kNotThrottled;
   if (parent_page_scheduler_->IsFrozen()) {
@@ -774,7 +777,7 @@ diff --git a/third_party/blink/renderer/platform/scheduler/main_thread/frame_sch
 diff --git a/third_party/blink/renderer/platform/scheduler/main_thread/page_scheduler_impl.cc b/third_party/blink/renderer/platform/scheduler/main_thread/page_scheduler_impl.cc
 --- a/third_party/blink/renderer/platform/scheduler/main_thread/page_scheduler_impl.cc
 +++ b/third_party/blink/renderer/platform/scheduler/main_thread/page_scheduler_impl.cc
-@@ -238,10 +238,12 @@ void PageSchedulerImpl::SetPageFrozen(bool frozen) {
+@@ -236,10 +236,12 @@ void PageSchedulerImpl::SetPageFrozen(bool frozen) {
   // it is desirable to reject the page freeze to prevent the scheduler from
   // being put in a bad state. See https://crbug.com/873214 for context of how
   // this can happen on the browser side.
@@ -787,7 +790,7 @@ diff --git a/third_party/blink/renderer/platform/scheduler/main_thread/page_sche
   PolicyUpdater policy_updater;
   SetPageFrozenImpl(frozen, policy_updater);
 }
-@@ -801,7 +803,12 @@ bool PageSchedulerImpl::IsBackgrounded() const {
+@@ -804,7 +806,12 @@ bool PageSchedulerImpl::IsBackgrounded() const {
   // expire immediately when a page is backgrounded, which is undesirable in
   // headless mode. To prevent that, a page is never considerer backgrounded
   // when virtual time is enabled.
@@ -15,9 +15,9 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 .../modules/webaudio/base_audio_context.cc         | 12 ++++++++++++
 .../renderer/modules/webaudio/base_audio_context.h |  2 ++
 .../modules/webaudio/offline_audio_context.cc      |  1 +
- .../renderer/modules/webaudio/realtime_analyser.cc |  7 +++++++
+ .../renderer/modules/webaudio/realtime_analyser.cc | 13 ++++++++++---
 .../platform/runtime_enabled_features.json5        |  5 ++---
- 11 files changed, 56 insertions(+), 4 deletions(-)
+ 11 files changed, 59 insertions(+), 7 deletions(-)
 create mode 100644 cromite_flags/chrome/browser/about_flags_cc/AudioBuffer-AnalyserNode-fp-mitigations.inc
 create mode 100644 cromite_flags/third_party/blink/common/features_cc/AudioBuffer-AnalyserNode-fp-mitigations.inc
 create mode 100644 cromite_flags/third_party/blink/common/features_h/AudioBuffer-AnalyserNode-fp-mitigations.inc
@@ -52,7 +52,7 @@ new file mode 100644
 diff --git a/third_party/blink/renderer/modules/webaudio/audio_buffer.cc b/third_party/blink/renderer/modules/webaudio/audio_buffer.cc
 --- a/third_party/blink/renderer/modules/webaudio/audio_buffer.cc
 +++ b/third_party/blink/renderer/modules/webaudio/audio_buffer.cc
-@@ -199,6 +199,20 @@ AudioBuffer::AudioBuffer(AudioBus* bus)
+@@ -200,6 +200,20 @@ AudioBuffer::AudioBuffer(AudioBus* bus)
   }
 }
 
@@ -76,7 +76,7 @@ diff --git a/third_party/blink/renderer/modules/webaudio/audio_buffer.cc b/third
 diff --git a/third_party/blink/renderer/modules/webaudio/audio_buffer.h b/third_party/blink/renderer/modules/webaudio/audio_buffer.h
 --- a/third_party/blink/renderer/modules/webaudio/audio_buffer.h
 +++ b/third_party/blink/renderer/modules/webaudio/audio_buffer.h
-@@ -116,6 +116,8 @@ class MODULES_EXPORT AudioBuffer final : public ScriptWrappable {
+@@ -115,6 +115,8 @@ class MODULES_EXPORT AudioBuffer final : public ScriptWrappable {
 
   std::unique_ptr<SharedAudioBuffer> CreateSharedAudioBuffer();
 
@@ -88,7 +88,7 @@ diff --git a/third_party/blink/renderer/modules/webaudio/audio_buffer.h b/third_
 diff --git a/third_party/blink/renderer/modules/webaudio/audio_context.cc b/third_party/blink/renderer/modules/webaudio/audio_context.cc
 --- a/third_party/blink/renderer/modules/webaudio/audio_context.cc
 +++ b/third_party/blink/renderer/modules/webaudio/audio_context.cc
-@@ -15,6 +15,7 @@
+@@ -20,6 +20,7 @@
 #include "third_party/blink/public/common/features.h"
 #include "third_party/blink/public/common/mediastream/media_devices.h"
 #include "third_party/blink/public/platform/browser_interface_broker_proxy.h"
@@ -96,7 +96,7 @@ diff --git a/third_party/blink/renderer/modules/webaudio/audio_context.cc b/thir
 #include "third_party/blink/public/platform/modules/webrtc/webrtc_logging.h"
 #include "third_party/blink/public/platform/web_audio_latency_hint.h"
 #include "third_party/blink/renderer/bindings/core/v8/script_promise_resolver.h"
-@@ -660,7 +661,9 @@ double AudioContext::baseLatency() const {
+@@ -921,7 +922,9 @@ double AudioContext::baseLatency() const {
   DCHECK_CALLED_ON_VALID_SEQUENCE(main_thread_sequence_checker_);
   DCHECK(destination());
 
@@ -110,15 +110,15 @@ diff --git a/third_party/blink/renderer/modules/webaudio/audio_context.cc b/thir
 diff --git a/third_party/blink/renderer/modules/webaudio/base_audio_context.cc b/third_party/blink/renderer/modules/webaudio/base_audio_context.cc
 --- a/third_party/blink/renderer/modules/webaudio/base_audio_context.cc
 +++ b/third_party/blink/renderer/modules/webaudio/base_audio_context.cc
-@@ -29,6 +29,7 @@
- 
+@@ -30,6 +30,7 @@
 #include "base/metrics/histogram_functions.h"
 #include "build/build_config.h"
+ #include "media/base/audio_bus.h"
 +#include "third_party/blink/public/common/features.h"
 #include "third_party/blink/public/mojom/devtools/console_message.mojom-blink.h"
 #include "third_party/blink/public/mojom/frame/lifecycle.mojom-shared.h"
 #include "third_party/blink/public/platform/platform.h"
-@@ -715,6 +716,17 @@ LocalDOMWindow* BaseAudioContext::GetWindow() const {
+@@ -777,6 +778,17 @@ LocalDOMWindow* BaseAudioContext::GetWindow() const {
   return To<LocalDOMWindow>(GetExecutionContext());
 }
 
@@ -151,7 +151,7 @@ diff --git a/third_party/blink/renderer/modules/webaudio/base_audio_context.h b/
 diff --git a/third_party/blink/renderer/modules/webaudio/offline_audio_context.cc b/third_party/blink/renderer/modules/webaudio/offline_audio_context.cc
 --- a/third_party/blink/renderer/modules/webaudio/offline_audio_context.cc
 +++ b/third_party/blink/renderer/modules/webaudio/offline_audio_context.cc
-@@ -372,6 +372,7 @@ void OfflineAudioContext::FireCompletionEvent() {
+@@ -395,6 +395,7 @@ void OfflineAudioContext::FireCompletionEvent() {
     if (!rendered_buffer) {
       return;
     }
@@ -162,52 +162,63 @@ diff --git a/third_party/blink/renderer/modules/webaudio/offline_audio_context.c
 diff --git a/third_party/blink/renderer/modules/webaudio/realtime_analyser.cc b/third_party/blink/renderer/modules/webaudio/realtime_analyser.cc
 --- a/third_party/blink/renderer/modules/webaudio/realtime_analyser.cc
 +++ b/third_party/blink/renderer/modules/webaudio/realtime_analyser.cc
-@@ -36,6 +36,7 @@
- #include <bit>
- #include <complex>
+@@ -33,6 +33,7 @@
 
+ #include "base/compiler_specific.h"
+ #include "media/base/audio_bus.h"
 +#include "third_party/blink/renderer/modules/webaudio/base_audio_context.h"
 #include "third_party/blink/renderer/platform/audio/audio_bus.h"
 #include "third_party/blink/renderer/platform/audio/audio_utilities.h"
 #include "third_party/blink/renderer/platform/audio/vector_math.h"
-@@ -160,6 +161,7 @@ void RealtimeAnalyser::GetFloatTimeDomainData(
-           input_buffer[(i + write_index - fft_size + kInputBufferSize) %
-                        kInputBufferSize];
- 
-+      value = BaseAudioContext::ShuffleAudioData(value, i);
-       destination[i] = value;
+@@ -118,7 +119,8 @@ void RealtimeAnalyser::GetFloatFrequencyData(DOMFloat32Array* destination_array,
+     for (unsigned i = 0; i < len; ++i) {
+       const float linear_value = UNSAFE_TODO(source[i]);
+       const double db_mag = audio_utilities::LinearToDecibels(linear_value);
+-      UNSAFE_TODO(destination[i]) = static_cast<float>(db_mag);
+      auto v = static_cast<float>(db_mag);
+      UNSAFE_TODO(destination[i]) = BaseAudioContext::ShuffleAudioData(v, i);
     }
   }
-@@ -187,6 +189,8 @@ void RealtimeAnalyser::GetByteTimeDomainData(DOMUint8Array* destination_array) {
-           input_buffer[(i + write_index - fft_size + kInputBufferSize) %
-                        kInputBufferSize];
+ }
+@@ -156,9 +158,11 @@ void RealtimeAnalyser::GetByteFrequencyData(DOMUint8Array* destination_array,
 
-+      value = BaseAudioContext::ShuffleAudioData(value, i);
-+
-       // Scale from nominal -1 -> +1 to unsigned byte.
-       double scaled_value = 128 * (value + 1);
- 
-@@ -306,6 +310,8 @@ void RealtimeAnalyser::ConvertToByteData(DOMUint8Array* destination_array) {
-       double scaled_value =
+       // The range m_minDecibels to m_maxDecibels will be scaled to byte values
+       // from 0 to UCHAR_MAX.
+-      const double scaled_value =
+      double scaled_value =
           UCHAR_MAX * (db_mag - min_decibels) * range_scale_factor;
 
 +      scaled_value = BaseAudioContext::ShuffleAudioData(scaled_value, i);
 +
       // Clip to valid range.
-       destination[i] =
+       UNSAFE_TODO(destination[i]) =
           static_cast<unsigned char>(ClampTo(scaled_value, 0, UCHAR_MAX));
-@@ -325,6 +331,7 @@ void RealtimeAnalyser::ConvertFloatToDb(DOMFloat32Array* destination_array) {
-       float linear_value = source[i];
-       double db_mag = audio_utilities::LinearToDecibels(linear_value);
-       destination[i] = static_cast<float>(db_mag);
-+      destination[i] = BaseAudioContext::ShuffleAudioData(destination[i], i);
+@@ -189,6 +193,7 @@ void RealtimeAnalyser::GetFloatTimeDomainData(
+           input_buffer[(i + write_index - fft_size + kInputBufferSize) %
+                        kInputBufferSize]);
+ 
+      value = BaseAudioContext::ShuffleAudioData(value, i);
+       UNSAFE_TODO(destination[i]) = value;
     }
   }
- }
+@@ -212,10 +217,12 @@ void RealtimeAnalyser::GetByteTimeDomainData(DOMUint8Array* destination_array) {
+ 
+     for (unsigned i = 0; i < len; ++i) {
+       // Buffer access is protected due to modulo operation.
+-      const float value = UNSAFE_TODO(
+      float value = UNSAFE_TODO(
+           input_buffer[(i + write_index - fft_size + kInputBufferSize) %
+                        kInputBufferSize]);
+ 
+      value = BaseAudioContext::ShuffleAudioData(value, i);
+
+       // Scale from nominal -1 -> +1 to unsigned byte.
+       const double scaled_value = 128 * (value + 1);
+ 
 diff --git a/third_party/blink/renderer/platform/runtime_enabled_features.json5 b/third_party/blink/renderer/platform/runtime_enabled_features.json5
 --- a/third_party/blink/renderer/platform/runtime_enabled_features.json5
 +++ b/third_party/blink/renderer/platform/runtime_enabled_features.json5
-@@ -562,9 +562,8 @@
+@@ -639,9 +639,8 @@
     {
       // AudioContext.playoutStats interface.
       // https://chromestatus.com/feature/5172818344148992
@@ -12,7 +12,7 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 diff --git a/third_party/blink/renderer/modules/battery/battery_manager.cc b/third_party/blink/renderer/modules/battery/battery_manager.cc
 --- a/third_party/blink/renderer/modules/battery/battery_manager.cc
 +++ b/third_party/blink/renderer/modules/battery/battery_manager.cc
-@@ -80,46 +80,28 @@ ScriptPromise<BatteryManager> BatteryManager::StartRequest(
+@@ -77,46 +77,28 @@ ScriptPromise<BatteryManager> BatteryManager::StartRequest(
 }
 
 bool BatteryManager::charging() {
@@ -7,49 +7,23 @@ This approach is not comprehensive, see also:

 License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 ---
- .../execution_context/execution_context.cc    | 15 +++++++++
 .../execution_context/execution_context.h     |  1 +
 .../renderer/core/loader/base_fetch_context.h |  1 +
 .../core/loader/frame_fetch_context.cc        | 20 ++++++++++++
 .../core/loader/frame_fetch_context.h         |  1 +
 .../core/loader/worker_fetch_context.cc       | 21 +++++++++++++
 .../core/loader/worker_fetch_context.h        |  1 +
- .../core/workers/installed_scripts_manager.cc |  4 +--
+ .../core/workers/installed_scripts_manager.cc |  2 +-
 .../background_fetch_manager.cc               | 31 +++++++++++++++++++
 .../websockets/websocket_channel_impl.cc      |  5 +++
 .../modules/websockets/websocket_common.cc    | 30 ++++++++++++++++++
 .../modules/websockets/websocket_common.h     |  4 +++
- 12 files changed, 132 insertions(+), 2 deletions(-)
+ 11 files changed, 116 insertions(+), 1 deletion(-)

-diff --git a/third_party/blink/renderer/core/execution_context/execution_context.cc b/third_party/blink/renderer/core/execution_context/execution_context.cc
--- a/third_party/blink/renderer/core/execution_context/execution_context.cc
-+++ b/third_party/blink/renderer/core/execution_context/execution_context.cc
-@@ -713,6 +713,21 @@ void ExecutionContext::WriteIntoTrace(
-   proto->set_world_type(GetWorldType(*this));
- }
- 
-+String ExecutionContext::addressSpaceForBindings() const {
-+  switch (AddressSpace()) {
-+    case network::mojom::IPAddressSpace::kPublic:
-+    case network::mojom::IPAddressSpace::kUnknown:
-+      return "public";
-+
-+    case network::mojom::IPAddressSpace::kPrivate:
-+      return "private";
-+
-+    case network::mojom::IPAddressSpace::kLocal:
-+      return "local";
-+  }
-+  NOTREACHED();
-+}
-+
- bool ExecutionContext::CrossOriginIsolatedCapabilityOrDisabledWebSecurity()
-     const {
-   return Agent::IsWebSecurityDisabled() || CrossOriginIsolatedCapability();
 diff --git a/third_party/blink/renderer/core/execution_context/execution_context.h b/third_party/blink/renderer/core/execution_context/execution_context.h
 --- a/third_party/blink/renderer/core/execution_context/execution_context.h
 +++ b/third_party/blink/renderer/core/execution_context/execution_context.h
-@@ -396,6 +396,7 @@ class CORE_EXPORT ExecutionContext : public Supplementable<ExecutionContext>,
+@@ -425,6 +425,7 @@ class CORE_EXPORT ExecutionContext : public MojoBindingContext,
   void SetAddressSpace(network::mojom::blink::IPAddressSpace ip_address_space);
 
   HeapObserverList<ContextLifecycleObserver>& ContextLifecycleObserverSet();
@@ -71,7 +45,7 @@ diff --git a/third_party/blink/renderer/core/loader/base_fetch_context.h b/third
 diff --git a/third_party/blink/renderer/core/loader/frame_fetch_context.cc b/third_party/blink/renderer/core/loader/frame_fetch_context.cc
 --- a/third_party/blink/renderer/core/loader/frame_fetch_context.cc
 +++ b/third_party/blink/renderer/core/loader/frame_fetch_context.cc
-@@ -1033,6 +1033,26 @@ bool FrameFetchContext::ShouldBlockRequestByInspector(const KURL& url) const {
+@@ -1122,6 +1122,26 @@ bool FrameFetchContext::ShouldBlockRequestByInspector(const KURL& url) const {
   return should_block_request;
 }
 
@@ -84,7 +58,7 @@ diff --git a/third_party/blink/renderer/core/loader/frame_fetch_context.cc b/thi
 +  network::mojom::IPAddressSpace target_space =
 +      network::mojom::IPAddressSpace::kPublic;
 +  if (network_utils::IsReservedIPAddress(request_url.Host()))
-+    target_space = network::mojom::IPAddressSpace::kPrivate;
+    target_space = network::mojom::IPAddressSpace::kLocal;
 +  if (SecurityOrigin::Create(request_url)->IsLocalhost())
 +    target_space = network::mojom::IPAddressSpace::kLocal;
 +
@@ -101,7 +75,7 @@ diff --git a/third_party/blink/renderer/core/loader/frame_fetch_context.cc b/thi
 diff --git a/third_party/blink/renderer/core/loader/frame_fetch_context.h b/third_party/blink/renderer/core/loader/frame_fetch_context.h
 --- a/third_party/blink/renderer/core/loader/frame_fetch_context.h
 +++ b/third_party/blink/renderer/core/loader/frame_fetch_context.h
-@@ -184,6 +184,7 @@ class CORE_EXPORT FrameFetchContext final : public BaseFetchContext,
+@@ -191,6 +191,7 @@ class CORE_EXPORT FrameFetchContext final : public BaseFetchContext,
   bool ShouldBlockWebSocketByMixedContentCheck(const KURL&) const override;
   std::unique_ptr<WebSocketHandshakeThrottle> CreateWebSocketHandshakeThrottle()
       override;
@@ -119,8 +93,8 @@ diff --git a/third_party/blink/renderer/core/loader/worker_fetch_context.cc b/th
 +#include "third_party/blink/renderer/platform/network/network_utils.h"
 #include "third_party/blink/renderer/platform/runtime_enabled_features.h"
 #include "third_party/blink/renderer/platform/scheduler/public/virtual_time_controller.h"
- #include "third_party/blink/renderer/platform/supplementable.h"
-@@ -90,6 +91,26 @@ bool WorkerFetchContext::ShouldBlockRequestByInspector(const KURL& url) const {
+ #include "third_party/blink/renderer/platform/weborigin/security_policy.h"
+@@ -89,6 +90,26 @@ bool WorkerFetchContext::ShouldBlockRequestByInspector(const KURL& url) const {
   return should_block_request;
 }
 
@@ -133,7 +107,7 @@ diff --git a/third_party/blink/renderer/core/loader/worker_fetch_context.cc b/th
 +  network::mojom::IPAddressSpace target_space =
 +      network::mojom::IPAddressSpace::kPublic;
 +  if (network_utils::IsReservedIPAddress(request_url.Host()))
-+    target_space = network::mojom::IPAddressSpace::kPrivate;
+    target_space = network::mojom::IPAddressSpace::kLocal;
 +  if (SecurityOrigin::Create(request_url)->IsLocalhost())
 +    target_space = network::mojom::IPAddressSpace::kLocal;
 +
@@ -161,12 +135,9 @@ diff --git a/third_party/blink/renderer/core/loader/worker_fetch_context.h b/thi
 diff --git a/third_party/blink/renderer/core/workers/installed_scripts_manager.cc b/third_party/blink/renderer/core/workers/installed_scripts_manager.cc
 --- a/third_party/blink/renderer/core/workers/installed_scripts_manager.cc
 +++ b/third_party/blink/renderer/core/workers/installed_scripts_manager.cc
-@@ -33,9 +33,9 @@ InstalledScriptsManager::ScriptData::ScriptData(
-   // place so that this is shareable out of worker code.
-   response_address_space_ = network::mojom::IPAddressSpace::kPublic;
+@@ -35,7 +35,7 @@ InstalledScriptsManager::ScriptData::ScriptData(
   if (network_utils::IsReservedIPAddress(script_url_.Host()))
-    response_address_space_ = network::mojom::IPAddressSpace::kLocal;
-+    response_address_space_ = network::mojom::IPAddressSpace::kPrivate;
+     response_address_space_ = network::mojom::IPAddressSpace::kLocal;
   if (SecurityOrigin::Create(script_url_)->IsLocalhost())
 -    response_address_space_ = network::mojom::IPAddressSpace::kLoopback;
 +    response_address_space_ = network::mojom::IPAddressSpace::kLocal;
@@ -176,7 +147,7 @@ diff --git a/third_party/blink/renderer/core/workers/installed_scripts_manager.c
 diff --git a/third_party/blink/renderer/modules/background_fetch/background_fetch_manager.cc b/third_party/blink/renderer/modules/background_fetch/background_fetch_manager.cc
 --- a/third_party/blink/renderer/modules/background_fetch/background_fetch_manager.cc
 +++ b/third_party/blink/renderer/modules/background_fetch/background_fetch_manager.cc
-@@ -103,6 +103,30 @@ bool ShouldBlockDanglingMarkup(const KURL& request_url) {
+@@ -104,6 +104,30 @@ bool ShouldBlockDanglingMarkup(const KURL& request_url) {
          request_url.ProtocolIsInHTTPFamily();
 }
 
@@ -193,7 +164,7 @@ diff --git a/third_party/blink/renderer/modules/background_fetch/background_fetc
 +    network::mojom::IPAddressSpace target_space =
 +        network::mojom::IPAddressSpace::kPublic;
 +    if (network_utils::IsReservedIPAddress(request_url.Host()))
-+      target_space = network::mojom::IPAddressSpace::kPrivate;
+      target_space = network::mojom::IPAddressSpace::kLocal;
 +    if (SecurityOrigin::Create(request_url)->IsLocalhost())
 +      target_space = network::mojom::IPAddressSpace::kLocal;
 +
@@ -207,7 +178,7 @@ diff --git a/third_party/blink/renderer/modules/background_fetch/background_fetc
 scoped_refptr<BlobDataHandle> ExtractBlobHandle(
     Request* request,
     ExceptionState& exception_state) {
-@@ -190,6 +214,13 @@ ScriptPromise<BackgroundFetchRegistration> BackgroundFetchManager::fetch(
+@@ -191,6 +215,13 @@ ScriptPromise<BackgroundFetchRegistration> BackgroundFetchManager::fetch(
                                  exception_state);
     }
 
@@ -224,7 +195,7 @@ diff --git a/third_party/blink/renderer/modules/background_fetch/background_fetc
 diff --git a/third_party/blink/renderer/modules/websockets/websocket_channel_impl.cc b/third_party/blink/renderer/modules/websockets/websocket_channel_impl.cc
 --- a/third_party/blink/renderer/modules/websockets/websocket_channel_impl.cc
 +++ b/third_party/blink/renderer/modules/websockets/websocket_channel_impl.cc
-@@ -284,6 +284,11 @@ bool WebSocketChannelImpl::Connect(const KURL& url, const String& protocol) {
+@@ -288,6 +288,11 @@ bool WebSocketChannelImpl::Connect(const KURL& url, const String& protocol) {
     return false;
   }
 
@@ -239,7 +210,7 @@ diff --git a/third_party/blink/renderer/modules/websockets/websocket_channel_imp
 diff --git a/third_party/blink/renderer/modules/websockets/websocket_common.cc b/third_party/blink/renderer/modules/websockets/websocket_common.cc
 --- a/third_party/blink/renderer/modules/websockets/websocket_common.cc
 +++ b/third_party/blink/renderer/modules/websockets/websocket_common.cc
-@@ -135,9 +135,39 @@ WebSocketCommon::ConnectResult WebSocketCommon::Connect(
+@@ -139,9 +139,39 @@ WebSocketCommon::ConnectResult WebSocketCommon::Connect(
     return ConnectResult::kException;
   }
 
@@ -265,7 +236,7 @@ diff --git a/third_party/blink/renderer/modules/websockets/websocket_common.cc b
 +  network::mojom::IPAddressSpace target_space =
 +      network::mojom::IPAddressSpace::kPublic;
 +  if (network_utils::IsReservedIPAddress(request_url.Host()))
-+    target_space = network::mojom::IPAddressSpace::kPrivate;
+    target_space = network::mojom::IPAddressSpace::kLocal;
 +  if (SecurityOrigin::Create(request_url)->IsLocalhost())
 +    target_space = network::mojom::IPAddressSpace::kLocal;
 +
@@ -25,7 +25,7 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 diff --git a/content/browser/renderer_host/render_frame_host_impl.cc b/content/browser/renderer_host/render_frame_host_impl.cc
 --- a/content/browser/renderer_host/render_frame_host_impl.cc
 +++ b/content/browser/renderer_host/render_frame_host_impl.cc
-@@ -5023,7 +5023,17 @@ void RenderFrameHostImpl::SetLastCommittedOrigin(
+@@ -5158,7 +5158,17 @@ void RenderFrameHostImpl::SetLastCommittedOrigin(
 }
 
 void RenderFrameHostImpl::SetInheritedBaseUrl(const GURL& inherited_base_url) {
@@ -82,7 +82,7 @@ diff --git a/third_party/blink/renderer/core/frame/location.cc b/third_party/bli
 #include "third_party/blink/renderer/bindings/core/v8/binding_security.h"
 #include "third_party/blink/renderer/bindings/core/v8/v8_binding_for_core.h"
 #include "third_party/blink/renderer/core/dom/document.h"
-@@ -126,8 +127,20 @@ DOMStringList* Location::ancestorOrigins() const {
+@@ -127,8 +128,20 @@ DOMStringList* Location::ancestorOrigins() const {
   auto* origins = MakeGarbageCollected<DOMStringList>();
   if (!IsAttached())
     return origins;
@@ -106,7 +106,7 @@ diff --git a/third_party/blink/renderer/core/frame/location.cc b/third_party/bli
 diff --git a/third_party/blink/renderer/core/loader/document_loader.cc b/third_party/blink/renderer/core/loader/document_loader.cc
 --- a/third_party/blink/renderer/core/loader/document_loader.cc
 +++ b/third_party/blink/renderer/core/loader/document_loader.cc
-@@ -832,6 +832,11 @@ WebString DocumentLoader::HttpMethod() const {
+@@ -835,6 +835,11 @@ WebString DocumentLoader::HttpMethod() const {
 }
 
 const AtomicString& DocumentLoader::GetReferrer() const {
@@ -118,7 +118,7 @@ diff --git a/third_party/blink/renderer/core/loader/document_loader.cc b/third_p
   return referrer_;
 }
 
-@@ -2897,6 +2902,13 @@ void DocumentLoader::CommitNavigation() {
+@@ -2913,6 +2918,13 @@ void DocumentLoader::CommitNavigation() {
         response_.HttpHeaderField(http_names::kDocumentPolicyReportOnly));
   }
 
@@ -135,7 +135,7 @@ diff --git a/third_party/blink/renderer/core/loader/document_loader.cc b/third_p
 diff --git a/third_party/blink/renderer/core/loader/document_loader.h b/third_party/blink/renderer/core/loader/document_loader.h
 --- a/third_party/blink/renderer/core/loader/document_loader.h
 +++ b/third_party/blink/renderer/core/loader/document_loader.h
-@@ -775,7 +775,7 @@ class CORE_EXPORT DocumentLoader : public GarbageCollected<DocumentLoader>,
+@@ -768,7 +768,7 @@ class CORE_EXPORT DocumentLoader : public GarbageCollected<DocumentLoader>,
   // |archive_|, but won't have |loading_main_document_from_mhtml_archive_| set.
   bool loading_main_document_from_mhtml_archive_ = false;
   const bool loading_srcdoc_ = false;
@@ -1,277 +0,0 @@
-From: csagan5 <32685696+csagan5@users.noreply.github.com>
-Date: Wed, 30 Oct 2019 11:50:13 +0100
-Subject: Block 'qjz9zk' or 'trk:' requests
-
-An info bar is displayed unless the --disable-trkbar command-line flag or the chrome://flag option is used.
-This patch is based on Iridium's 'net: add "trk:" scheme and help identify URLs being retrieved'
-
-License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
---
- .../chrome_autocomplete_scheme_classifier.cc  |  1 +
- chrome/browser/history/history_utils.cc       |  1 +
- chrome/browser/ui/singleton_tabs.cc           |  5 ++++
- .../omnibox/browser/autocomplete_input.cc     |  8 ++++-
- components/url_formatter/url_fixer.cc         |  4 +++
- .../child_process_security_policy_impl.cc     |  1 +
- net/BUILD.gn                                  |  2 ++
- net/url_request/trk_protocol_handler.cc       | 25 ++++++++++++++++
- net/url_request/trk_protocol_handler.h        | 30 +++++++++++++++++++
- net/url_request/url_request.cc                |  8 +++++
- .../url_request_context_builder.cc            |  3 ++
- url/url_constants.h                           |  1 +
- url/url_util.cc                               |  2 ++
- 13 files changed, 90 insertions(+), 1 deletion(-)
- create mode 100644 net/url_request/trk_protocol_handler.cc
- create mode 100644 net/url_request/trk_protocol_handler.h
-
-diff --git a/chrome/browser/autocomplete/chrome_autocomplete_scheme_classifier.cc b/chrome/browser/autocomplete/chrome_autocomplete_scheme_classifier.cc
--- a/chrome/browser/autocomplete/chrome_autocomplete_scheme_classifier.cc
-+++ b/chrome/browser/autocomplete/chrome_autocomplete_scheme_classifier.cc
-@@ -56,6 +56,7 @@ ChromeAutocompleteSchemeClassifier::GetInputTypeForScheme(
-   if (base::IsStringASCII(scheme) &&
-       (ProfileIOData::IsHandledProtocol(scheme) ||
-        base::EqualsCaseInsensitiveASCII(scheme, content::kViewSourceScheme) ||
-+       base::EqualsCaseInsensitiveASCII(scheme, url::kTraceScheme) ||
-        base::EqualsCaseInsensitiveASCII(scheme, url::kJavaScriptScheme) ||
-        base::EqualsCaseInsensitiveASCII(scheme, url::kDataScheme))) {
-     return metrics::OmniboxInputType::URL;
-diff --git a/chrome/browser/history/history_utils.cc b/chrome/browser/history/history_utils.cc
--- a/chrome/browser/history/history_utils.cc
-+++ b/chrome/browser/history/history_utils.cc
-@@ -22,6 +22,7 @@ bool CanAddURLToHistory(const GURL& url) {
-       url.SchemeIs(content::kChromeUIScheme) ||
-       url.SchemeIs(content::kChromeUIUntrustedScheme) ||
-       url.SchemeIs(content::kViewSourceScheme) ||
-+      url.SchemeIs(url::kTraceScheme) ||
-       url.SchemeIs(chrome::kChromeNativeScheme) ||
-       url.SchemeIs(chrome::kChromeSearchScheme) ||
-       url.SchemeIs(dom_distiller::kDomDistillerScheme))
-diff --git a/chrome/browser/ui/singleton_tabs.cc b/chrome/browser/ui/singleton_tabs.cc
--- a/chrome/browser/ui/singleton_tabs.cc
-+++ b/chrome/browser/ui/singleton_tabs.cc
-@@ -136,6 +136,11 @@ int GetIndexOfExistingTab(Browser* browser, const NavigateParams& params) {
-       continue;
-     }
- 
-+    // trk: URLs must not be rewritten
-+    if (tab_url.SchemeIs(url::kTraceScheme)) {
-+      continue;
-+    }
-+
-     GURL rewritten_tab_url = tab_url;
-     content::BrowserURLHandler::GetInstance()->RewriteURLIfNecessary(
-         &rewritten_tab_url, browser->profile());
-diff --git a/components/omnibox/browser/autocomplete_input.cc b/components/omnibox/browser/autocomplete_input.cc
--- a/components/omnibox/browser/autocomplete_input.cc
-+++ b/components/omnibox/browser/autocomplete_input.cc
-@@ -92,10 +92,15 @@ void OffsetComponentsExcludingScheme(url::Parsed* parts, int offset) {
- bool HasScheme(const std::u16string& input, const char* scheme) {
-   std::string utf8_input(base::UTF16ToUTF8(input));
-   url::Component view_source_scheme;
-+
-+  if (url::FindAndCompareScheme(utf8_input, url::kTraceScheme, &view_source_scheme)) {
-+    return false;
-+  }
-   if (url::FindAndCompareScheme(utf8_input, kViewSourceScheme,
-                                 &view_source_scheme)) {
-     utf8_input.erase(0, view_source_scheme.end() + 1);
-   }
-+
-   return url::FindAndCompareScheme(utf8_input, scheme, nullptr);
- }
- 
-@@ -578,7 +583,8 @@ void AutocompleteInput::ParseForEmphasizeComponents(
-   // For the view-source and blob schemes, we should emphasize the host of the
-   // URL qualified by the view-source or blob prefix.
-   if ((base::EqualsCaseInsensitiveASCII(scheme_str, kViewSourceScheme) ||
-       base::EqualsCaseInsensitiveASCII(scheme_str, url::kBlobScheme)) &&
-+       base::EqualsCaseInsensitiveASCII(scheme_str, url::kBlobScheme) ||
-+       base::EqualsCaseInsensitiveASCII(scheme_str, url::kTraceScheme)) &&
-       (static_cast<int>(text.length()) > after_scheme_and_colon)) {
-     // Obtain the URL prefixed by view-source or blob and parse it.
-     std::u16string real_url(text.substr(after_scheme_and_colon));
-diff --git a/components/url_formatter/url_fixer.cc b/components/url_formatter/url_fixer.cc
--- a/components/url_formatter/url_fixer.cc
-+++ b/components/url_formatter/url_fixer.cc
-@@ -607,6 +607,10 @@ GURL FixupURLInternal(const std::string& text,
-     }
-   }
- 
-+  if (scheme == url::kTraceScheme) {
-+    return GURL();
-+  }
-+
-   // We handle the file scheme separately.
-   if (scheme == url::kFileScheme) {
-     return GURL(parts.scheme.is_valid() ? text : FixupPath(text));
-diff --git a/content/browser/child_process_security_policy_impl.cc b/content/browser/child_process_security_policy_impl.cc
--- a/content/browser/child_process_security_policy_impl.cc
-+++ b/content/browser/child_process_security_policy_impl.cc
-@@ -950,6 +950,7 @@ ChildProcessSecurityPolicyImpl::ChildProcessSecurityPolicyImpl()
-   RegisterPseudoScheme(url::kJavaScriptScheme);
-   RegisterPseudoScheme(kViewSourceScheme);
-   RegisterPseudoScheme(kGoogleChromeScheme);
-+  RegisterWebSafeScheme(url::kTraceScheme);
- }
- 
- ChildProcessSecurityPolicyImpl::~ChildProcessSecurityPolicyImpl() {
-diff --git a/net/BUILD.gn b/net/BUILD.gn
--- a/net/BUILD.gn
-+++ b/net/BUILD.gn
-@@ -1115,6 +1115,8 @@ component("net") {
-     "url_request/url_request_http_job.cc",
-     "url_request/url_request_http_job.h",
-     "url_request/url_request_interceptor.cc",
-+    "url_request/trk_protocol_handler.cc",
-+    "url_request/trk_protocol_handler.h",
-     "url_request/url_request_interceptor.h",
-     "url_request/url_request_job.cc",
-     "url_request/url_request_job.h",
-diff --git a/net/url_request/trk_protocol_handler.cc b/net/url_request/trk_protocol_handler.cc
-new file mode 100644
--- /dev/null
-+++ b/net/url_request/trk_protocol_handler.cc
-@@ -0,0 +1,25 @@
-+// Copyright (c) 2018 The ungoogled-chromium Authors. All rights reserved.
-+// Use of this source code is governed by a BSD-style license that can be
-+// found in the LICENSE file.
-+
-+#include "net/url_request/trk_protocol_handler.h"
-+
-+#include "base/logging.h"
-+#include "net/base/net_errors.h"
-+#include "net/url_request/url_request_error_job.h"
-+
-+namespace net {
-+
-+TrkProtocolHandler::TrkProtocolHandler() = default;
-+
-+std::unique_ptr<URLRequestJob> TrkProtocolHandler::CreateJob(
-+    URLRequest* request) const {
-+  LOG(ERROR) << "Blocked URL in TrkProtocolHandler: " << request->original_url();
-+  return std::make_unique<URLRequestErrorJob>(request, ERR_BLOCKED_BY_CLIENT);
-+}
-+
-+bool TrkProtocolHandler::IsSafeRedirectTarget(const GURL& location) const {
-+  return true;
-+}
-+
-+}  // namespace net
-diff --git a/net/url_request/trk_protocol_handler.h b/net/url_request/trk_protocol_handler.h
-new file mode 100644
--- /dev/null
-+++ b/net/url_request/trk_protocol_handler.h
-@@ -0,0 +1,30 @@
-+// Copyright (c) 2018 The ungoogled-chromium Authors. All rights reserved.
-+// Use of this source code is governed by a BSD-style license that can be
-+// found in the LICENSE file.
-+
-+#ifndef NET_URL_REQUEST_TRK_PROTOCOL_HANDLER_H_
-+#define NET_URL_REQUEST_TRK_PROTOCOL_HANDLER_H_
-+
-+#include "base/compiler_specific.h"
-+#include "net/base/net_export.h"
-+#include "net/url_request/url_request_job_factory.h"
-+
-+namespace net {
-+
-+class URLRequestJob;
-+
-+// Implements a ProtocolHandler for Trk jobs.
-+class NET_EXPORT TrkProtocolHandler
-+    : public URLRequestJobFactory::ProtocolHandler {
-+ public:
-+  TrkProtocolHandler(const TrkProtocolHandler&) = delete;
-+  TrkProtocolHandler& operator=(const TrkProtocolHandler&) = delete;
-+
-+  TrkProtocolHandler();
-+  std::unique_ptr<URLRequestJob> CreateJob(URLRequest* request) const override;
-+  bool IsSafeRedirectTarget(const GURL& location) const override;
-+};
-+
-+}  // namespace net
-+
-+#endif  // NET_URL_REQUEST_TRK_PROTOCOL_HANDLER_H_
-diff --git a/net/url_request/url_request.cc b/net/url_request/url_request.cc
--- a/net/url_request/url_request.cc
-+++ b/net/url_request/url_request.cc
-@@ -15,6 +15,7 @@
- #include "base/notreached.h"
- #include "base/rand_util.h"
- #include "base/strings/utf_string_conversions.h"
-+#include "base/strings/string_util.h"
- #include "base/synchronization/lock.h"
- #include "base/task/single_thread_task_runner.h"
- #include "base/types/optional_util.h"
-@@ -55,6 +56,7 @@
- #include "net/url_request/url_request_redirect_job.h"
- #include "url/gurl.h"
- #include "url/origin.h"
-+#include "url/url_constants.h"
- 
- namespace net {
- 
-@@ -653,6 +655,12 @@ URLRequest::URLRequest(base::PassKey<URLRequestContext> pass_key,
-   // Sanity check out environment.
-   DCHECK(base::SingleThreadTaskRunner::HasCurrentDefault());
- 
-+  if (!url.SchemeIs(url::kTraceScheme) &&
-+      base::EndsWith(url.host(), "qjz9zk", base::CompareCase::INSENSITIVE_ASCII)) {
-+    LOG(ERROR) << "Block URL in URLRequest: " << url;
-+    url_chain_[0] = GURL(url::kTraceScheme + (":" + url.possibly_invalid_spec()));
-+  }
-+
-   context->url_requests()->insert(this);
-   net_log_.BeginEvent(NetLogEventType::REQUEST_ALIVE, [&] {
-     return NetLogURLRequestConstructorParams(url, priority_,
-diff --git a/net/url_request/url_request_context_builder.cc b/net/url_request/url_request_context_builder.cc
--- a/net/url_request/url_request_context_builder.cc
-+++ b/net/url_request/url_request_context_builder.cc
-@@ -53,6 +53,7 @@
- #include "net/socket/network_binding_client_socket_factory.h"
- #include "net/ssl/ssl_config_service_defaults.h"
- #include "net/url_request/static_http_user_agent_settings.h"
-+#include "net/url_request/trk_protocol_handler.h"
- #include "net/url_request/url_request_context.h"
- #include "net/url_request/url_request_job_factory.h"
- #include "url/url_constants.h"
-@@ -610,6 +611,8 @@ std::unique_ptr<URLRequestContext> URLRequestContextBuilder::Build() {
-     job_factory->SetProtocolHandler(scheme_handler.first,
-                                     std::move(scheme_handler.second));
-   }
-+  job_factory->SetProtocolHandler(url::kTraceScheme,
-+                                  std::make_unique<TrkProtocolHandler>());
-   protocol_handlers_.clear();
- 
-   context->set_job_factory(std::move(job_factory));
-diff --git a/url/url_constants.h b/url/url_constants.h
--- a/url/url_constants.h
-+++ b/url/url_constants.h
-@@ -34,6 +34,7 @@ inline constexpr char16_t kDataScheme16[] = u"data";
- inline constexpr char kDrivefsScheme[] = "drivefs";
- inline constexpr char kFileScheme[] = "file";
- inline constexpr char16_t kFileScheme16[] = u"file";
-+inline constexpr char kTraceScheme[] = "trk";
- inline constexpr char kFileSystemScheme[] = "filesystem";
- inline constexpr char16_t kFileSystemScheme16[] = u"filesystem";
- inline constexpr char kFtpScheme[] = "ftp";
-diff --git a/url/url_util.cc b/url/url_util.cc
--- a/url/url_util.cc
-+++ b/url/url_util.cc
-@@ -53,6 +53,7 @@ struct SchemeRegistry {
-   std::vector<SchemeWithType> standard_schemes = {
-       {kHttpsScheme, SCHEME_WITH_HOST_PORT_AND_USER_INFORMATION},
-       {kHttpScheme, SCHEME_WITH_HOST_PORT_AND_USER_INFORMATION},
-+      {kTraceScheme, SCHEME_WITH_HOST_PORT_AND_USER_INFORMATION},
-       // Yes, file URLs can have a hostname, so file URLs should be handled as
-       // "standard". File URLs never have a port as specified by the SchemeType
-       // field.  Unlike other SCHEME_WITH_HOST schemes, the 'host' in a file
-@@ -98,6 +99,7 @@ struct SchemeRegistry {
-       kAboutScheme,
-       kJavaScriptScheme,
-       kDataScheme,
-+      kTraceScheme,
-   };
- 
-   // Schemes that can be sent CORS requests.
--
@@ -57,10 +57,10 @@ diff --git a/chrome/browser/bookmarks/android/java/src/org/chromium/chrome/brows
         }
 +        if (menuItem.getItemId() == R.id.select_all_menu_id) {
 +            if (mBookmarkModel.isBookmarkModelLoaded()) {
-+                List<BookmarkItem> items = mBookmarkModel.getBookmarksForFolder(mCurrentFolder.getId());
-+                HashSet<BookmarkId> ids = new HashSet<>(items.size());
-+                for (BookmarkItem item : items) {
-+                    ids.add(item.getId());
+                List<BookmarkId> childs = mBookmarkModel.getChildIds(mCurrentFolder.getId());
+                HashSet<BookmarkId> ids = new HashSet<>(childs.size());
+                for (BookmarkId item : childs) {
+                    ids.add(item);
 +                }
 +                mSelectionDelegate.setSelectedItems(ids);
 +            }
@@ -80,7 +80,7 @@ diff --git a/chrome/browser/bookmarks/android/java/src/org/chromium/chrome/brows
 diff --git a/chrome/browser/ui/android/strings/android_chrome_strings.grd b/chrome/browser/ui/android/strings/android_chrome_strings.grd
 --- a/chrome/browser/ui/android/strings/android_chrome_strings.grd
 +++ b/chrome/browser/ui/android/strings/android_chrome_strings.grd
-@@ -249,6 +249,9 @@ CHAR_LIMIT guidelines:
+@@ -264,6 +264,9 @@ CHAR_LIMIT guidelines:
       <message name="IDS_NOTIFICATION_CATEGORY_SITES" desc="Label for notifications from websites, within a list of notification categories. [CHAR_LIMIT=32]">
         Sites
       </message>
@@ -21,12 +21,13 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 chrome/browser/endpoint_fetcher/BUILD.gn      |  32 ++
 chrome/browser/endpoint_fetcher/DEPS          |   3 +
 chrome/browser/endpoint_fetcher/OWNERS        |   1 +
- .../endpoint_fetcher_android.cc               | 149 +++++++++
- .../endpoint_fetcher/EndpointFetcher.java     | 116 +++++++
+ .../endpoint_fetcher_android.cc               | 107 +++++++
+ .../endpoint_fetcher/EndpointFetcher.java     |  63 ++++
 .../EndpointHeaderResponse.java               |  31 ++
 .../endpoint_fetcher/EndpointResponse.java    |  30 ++
 .../flags/android/chrome_feature_list.cc      |   1 +
 .../browser/flags/ChromeFeatureList.java      |   1 +
+ .../access_code_cast_discovery_interface.cc   |   2 +-
 chrome/browser/omaha/android/BUILD.gn         |   3 +
 .../chrome/browser/omaha/OmahaPrefUtils.java  |  52 +++-
 .../chrome/browser/omaha/UpdateConfigs.java   |  27 +-
@@ -34,14 +35,22 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 .../browser/omaha/VersionNumberGetter.java    |   4 +-
 .../omaha/inline/InlineUpdateController.java  |  57 ++++
 .../safety_hub/SafetyHubFetchService.java     |   5 -
+ .../browser/save_to_drive/drive_uploader.cc   |   2 +-
 .../strings/android_chrome_strings.grd        |  23 +-
- .../ui/lens/lens_overlay_query_controller.cc  |   1 +
- .../endpoint_fetcher/endpoint_fetcher.cc      | 132 ++++++--
- .../endpoint_fetcher/endpoint_fetcher.h       |  24 ++
- components/manta/base_provider.cc             |   1 +
+ .../ui/lens/lens_overlay_query_controller.cc  |   2 +-
+ components/commerce/core/account_checker.cc   |   2 +-
+ .../core/compare/cluster_server_proxy.cc      |   2 +-
+ .../product_specifications_server_proxy.cc    |   2 +-
+ .../subscriptions_server_proxy.cc             |   2 +-
+ .../internal/composebox_query_controller.cc   |   2 +-
+ .../data_sharing_network_loader_impl.cc       |   2 +-
+ .../internal/preview_server_proxy.cc          |   2 +-
+ .../endpoint_fetcher/endpoint_fetcher.cc      | 127 ++++++--
+ .../endpoint_fetcher/endpoint_fetcher.h       |  28 +-
+ components/manta/base_provider.cc             |   4 +-
 .../Bromite-auto-updater.inc                  |   3 +
 .../Bromite-auto-updater.inc                  |   1 +
- 33 files changed, 1239 insertions(+), 95 deletions(-)
+ 42 files changed, 1154 insertions(+), 106 deletions(-)
 create mode 100644 chrome/android/java/src/org/chromium/chrome/browser/omaha/CromiteUpdateStatusProvider.java
 create mode 100644 chrome/android/java/src/org/chromium/chrome/browser/omaha/inline/BromiteInlineUpdateController.java
 create mode 100644 chrome/browser/endpoint_fetcher/BUILD.gn
@@ -70,7 +79,7 @@ diff --git a/build/android/java/templates/BuildConfig.template b/build/android/j
 diff --git a/build/config/android/rules.gni b/build/config/android/rules.gni
 --- a/build/config/android/rules.gni
 +++ b/build/config/android/rules.gni
-@@ -1936,6 +1936,9 @@ if (!is_robolectric && enable_java_templates) {
+@@ -1959,6 +1959,9 @@ if (!is_robolectric && enable_java_templates) {
       sources = [ "//build/android/java/templates/BuildConfig.template" ]
       defines = []
 
@@ -83,7 +92,7 @@ diff --git a/build/config/android/rules.gni b/build/config/android/rules.gni
 diff --git a/chrome/android/chrome_java_sources.gni b/chrome/android/chrome_java_sources.gni
 --- a/chrome/android/chrome_java_sources.gni
 +++ b/chrome/android/chrome_java_sources.gni
-@@ -820,6 +820,8 @@ chrome_java_sources = [
+@@ -871,6 +871,8 @@ chrome_java_sources = [
   "java/src/org/chromium/chrome/browser/omaha/OmahaBase.java",
   "java/src/org/chromium/chrome/browser/omaha/OmahaDelegate.java",
   "java/src/org/chromium/chrome/browser/omaha/OmahaDelegateBase.java",
@@ -110,7 +119,7 @@ diff --git a/chrome/android/java/res/xml/about_chrome_preferences.xml b/chrome/a
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/about_settings/AboutChromeSettings.java b/chrome/android/java/src/org/chromium/chrome/browser/about_settings/AboutChromeSettings.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/about_settings/AboutChromeSettings.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/about_settings/AboutChromeSettings.java
-@@ -29,13 +29,19 @@ import org.chromium.ui.widget.Toast;
+@@ -31,10 +31,15 @@ import org.chromium.ui.widget.Toast;
 
 import java.util.Calendar;
 
@@ -120,10 +129,14 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/about_settings/
 +
 /** Settings fragment that displays information about Chrome. */
 @NullMarked
- public class AboutChromeSettings extends PreferenceFragmentCompat
+ public class AboutChromeSettings extends ChromeBaseSettingsFragment
 -        implements EmbeddableSettingsPage, Preference.OnPreferenceClickListener {
 +        implements EmbeddableSettingsPage, Preference.OnPreferenceClickListener,
 +                   Preference.OnPreferenceChangeListener {
+     static {
+         CalendarFactory.warmUp();
+     }
+@@ -42,6 +47,7 @@ public class AboutChromeSettings extends ChromeBaseSettingsFragment
     private static final int TAPS_FOR_DEVELOPER_SETTINGS = 7;
 
     private static final String PREF_APPLICATION_VERSION = "application_version";
@@ -131,9 +144,9 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/about_settings/
     private static final String PREF_OS_VERSION = "os_version";
     private static final String PREF_LEGAL_INFORMATION = "legal_information";
 
-@@ -72,6 +78,13 @@ public class AboutChromeSettings extends PreferenceFragmentCompat
+@@ -78,6 +84,13 @@ public class AboutChromeSettings extends ChromeBaseSettingsFragment
         assumeNonNull(p);
-         int currentYear = Calendar.getInstance().get(Calendar.YEAR);
+         int currentYear = CalendarFactory.get().get(Calendar.YEAR);
         p.setSummary(getString(R.string.legal_information_summary, currentYear));
 +
 +        ChromeSwitchPreference allowInlineUpdate =
@@ -145,7 +158,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/about_settings/
     }
 
     @Override
-@@ -142,6 +155,19 @@ public class AboutChromeSettings extends PreferenceFragmentCompat
+@@ -148,6 +161,19 @@ public class AboutChromeSettings extends ChromeBaseSettingsFragment
         return true;
     }
 
@@ -215,7 +228,7 @@ new file mode 100644
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/omaha/OmahaBase.java b/chrome/android/java/src/org/chromium/chrome/browser/omaha/OmahaBase.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/omaha/OmahaBase.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/omaha/OmahaBase.java
-@@ -140,7 +140,8 @@ public class OmahaBase {
+@@ -149,7 +149,8 @@ public class OmahaBase {
     }
 
     static boolean isDisabled() {
@@ -225,7 +238,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/omaha/OmahaBase
     }
 
     /**
-@@ -580,6 +581,10 @@ public class OmahaBase {
+@@ -592,6 +593,10 @@ public class OmahaBase {
     /** Sends the request to the server and returns the response. */
     static String sendRequestToServer(HttpURLConnection urlConnection, String request)
             throws RequestFailureException {
@@ -239,15 +252,15 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/omaha/OmahaBase
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/omaha/UpdateMenuItemHelper.java b/chrome/android/java/src/org/chromium/chrome/browser/omaha/UpdateMenuItemHelper.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/omaha/UpdateMenuItemHelper.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/omaha/UpdateMenuItemHelper.java
-@@ -12,6 +12,7 @@ import android.view.Choreographer;
- 
- import androidx.annotation.NonNull;
- import androidx.annotation.Nullable;
+@@ -9,6 +9,7 @@ import android.content.ActivityNotFoundException;
+ import android.content.res.Resources;
+ import android.text.TextUtils;
+ import android.view.Choreographer;
 +import androidx.annotation.StringRes;
 
- import org.chromium.base.BuildInfo;
+ import org.chromium.base.ApkInfo;
 import org.chromium.base.Callback;
-@@ -24,6 +25,7 @@ import org.chromium.base.task.TaskTraits;
+@@ -23,6 +24,7 @@ import org.chromium.build.annotations.Nullable;
 import org.chromium.chrome.R;
 import org.chromium.chrome.browser.omaha.UpdateStatusProvider.UpdateState;
 import org.chromium.chrome.browser.omaha.UpdateStatusProvider.UpdateStatus;
@@ -311,7 +324,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/omaha/UpdateMen
                 // The badge is hidden if the update menu item has been clicked until there is an
                 // even newer version of Chrome available.
                 showBadge |=
-@@ -255,6 +270,72 @@ public class UpdateMenuItemHelper {
+@@ -254,6 +269,72 @@ public class UpdateMenuItemHelper {
                 mMenuUiState.itemState.icon = R.drawable.ic_error_24dp_filled;
                 mMenuUiState.itemState.enabled = false;
                 break;
@@ -677,7 +690,7 @@ new file mode 100644
 diff --git a/chrome/browser/BUILD.gn b/chrome/browser/BUILD.gn
 --- a/chrome/browser/BUILD.gn
 +++ b/chrome/browser/BUILD.gn
-@@ -2620,6 +2620,12 @@ static_library("browser") {
+@@ -2652,6 +2652,12 @@ static_library("browser") {
   }
 
   if (is_android) {
@@ -745,7 +758,7 @@ diff --git a/chrome/browser/endpoint_fetcher/endpoint_fetcher_android.cc b/chrom
 new file mode 100644
 --- /dev/null
 +++ b/chrome/browser/endpoint_fetcher/endpoint_fetcher_android.cc
-@@ -0,0 +1,149 @@
+@@ -0,0 +1,107 @@
 +// Copyright 2019 The Chromium Authors
 +// Use of this source code is governed by a BSD-style license that can be
 +// found in the LICENSE file.
@@ -800,48 +813,6 @@ new file mode 100644
 +}
 +}  // namespace
 +
-+// TODO(crbug.com/1077537) Create a KeyProvider so
-+// we can have one centralized API.
-+
-+static void JNI_EndpointFetcher_NativeFetchOAuth(
-+    JNIEnv* env,
-+    const base::android::JavaParamRef<jobject>& jprofile,
-+    const base::android::JavaParamRef<jstring>& joauth_consumer_name,
-+    const base::android::JavaParamRef<jstring>& jurl,
-+    const base::android::JavaParamRef<jstring>& jhttps_method,
-+    const base::android::JavaParamRef<jstring>& jcontent_type,
-+    const base::android::JavaParamRef<jobjectArray>& jscopes,
-+    const base::android::JavaParamRef<jstring>& jpost_data,
-+    jlong jtimeout,
-+    jint jannotation_hash_code,
-+    const base::android::JavaParamRef<jobject>& jcallback) {
-+  std::vector<std::string> scopes;
-+  base::android::AppendJavaStringArrayToStringVector(env, jscopes, &scopes);
-+  auto endpoint_fetcher = std::make_unique<endpoint_fetcher::EndpointFetcher>(
-+      Profile::FromJavaObject(jprofile)
-+          ->GetDefaultStoragePartition()
-+          ->GetURLLoaderFactoryForBrowserProcess(),
-+      base::android::ConvertJavaStringToUTF8(env, joauth_consumer_name),
-+      GURL(base::android::ConvertJavaStringToUTF8(env, jurl)),
-+      base::android::ConvertJavaStringToUTF8(env, jhttps_method),
-+      base::android::ConvertJavaStringToUTF8(env, jcontent_type), scopes,
-+      base::Milliseconds(jtimeout), base::android::ConvertJavaStringToUTF8(env, jpost_data),
-+      net::NetworkTrafficAnnotationTag::FromJavaAnnotation(
-+          jannotation_hash_code),
-+      IdentityManagerFactory::GetForProfile(
-+          Profile::FromJavaObject(jprofile)),
-+      // TODO(crbug.com/1466445): ConsentLevel::kSync is deprecated and should
-+      //     be removed. See ConsentLevel::kSync documentation for details.
-+      signin::ConsentLevel::kSync);
-+  auto* const endpoint_fetcher_ptr = endpoint_fetcher.get();
-+  endpoint_fetcher_ptr->Fetch(
-+      base::BindOnce(&OnEndpointFetcherComplete,
-+                     base::android::ScopedJavaGlobalRef<jobject>(jcallback),
-+                     // unique_ptr endpoint_fetcher is passed until the callback
-+                     // to ensure its lifetime across the request.
-+                     std::move(endpoint_fetcher)));
-+}
-+
 +static void JNI_EndpointFetcher_NativeFetchWithNoAuth(
 +    JNIEnv* env,
 +    const base::android::JavaParamRef<jobject>& jprofile,
@@ -899,7 +870,7 @@ diff --git a/chrome/browser/endpoint_fetcher/java/src/org/chromium/chrome/browse
 new file mode 100644
 --- /dev/null
 +++ b/chrome/browser/endpoint_fetcher/java/src/org/chromium/chrome/browser/endpoint_fetcher/EndpointFetcher.java
-@@ -0,0 +1,116 @@
+@@ -0,0 +1,63 @@
 +// Copyright 2019 The Chromium Authors
 +// Use of this source code is governed by a BSD-style license that can be
 +// found in the LICENSE file.
@@ -927,47 +898,6 @@ new file mode 100644
 +public final class EndpointFetcher {
 +    private EndpointFetcher() {}
 +
-+    /**
-+     * Calls an endpoint using OAuth and returns the response via a callback
-+     * @param callback callback function response is returned in
-+     * @param profile profile via which the endpoint is called
-+     * @param oathConsumerName consumer name for OAuth
-+     * @param url endpoint URL called
-+     * @param httpsMethod the HTTPS method used e.g. "GET" or "POST"
-+     * @param contentType the content type e.g. "application/json"
-+     * @param scopes scopes used as part of authentication
-+     * @param postData data for a "POST" request
-+     * @param timeout time after which the request will terminate in the event a response hasn't
-+     *         been received
-+     */
-+    @MainThread
-+    public static void fetchUsingOAuth(
-+            Callback<EndpointResponse> callback,
-+            Profile profile,
-+            String oathConsumerName,
-+            String url,
-+            String httpsMethod,
-+            String contentType,
-+            String[] scopes,
-+            String postData,
-+            long timeout,
-+            NetworkTrafficAnnotationTag annotation) {
-+        // EndpointFetcher currently does not support incognito mode
-+        assert !profile.isOffTheRecord();
-+        EndpointFetcherJni.get()
-+                .nativeFetchOAuth(
-+                        profile,
-+                        oathConsumerName,
-+                        url,
-+                        httpsMethod,
-+                        contentType,
-+                        scopes,
-+                        postData,
-+                        timeout,
-+                        annotation.getHashCode(),
-+                        callback);
-+    }
-+
 +    @MainThread
 +    public static void nativeHeadWithNoAuth(
 +            Callback<EndpointHeaderResponse> callback, Profile profile,
@@ -988,18 +918,6 @@ new file mode 100644
 +
 +    @NativeMethods
 +    public interface Natives {
-+        void nativeFetchOAuth(
-+                Profile profile,
-+                String oathConsumerName,
-+                String url,
-+                String httpsMethod,
-+                String contentType,
-+                String[] scopes,
-+                String postData,
-+                long timeout,
-+                int annotationHashCode,
-+                Callback<EndpointResponse> callback);
-+
 +        void nativeFetchWithNoAuth(
 +                Profile profile,
 +                String url,
@@ -1090,25 +1008,37 @@ new file mode 100644
 diff --git a/chrome/browser/flags/android/chrome_feature_list.cc b/chrome/browser/flags/android/chrome_feature_list.cc
 --- a/chrome/browser/flags/android/chrome_feature_list.cc
 +++ b/chrome/browser/flags/android/chrome_feature_list.cc
-@@ -336,6 +336,7 @@ const base::Feature* const kFeaturesExposedToJava[] = {
+@@ -387,6 +387,7 @@ const base::Feature* const kFeaturesExposedToJava[] = {
     &kProtectedTabsAndroid,
     &kPwaRestoreUi,
     &kPwaRestoreUiAtStartup,
 +    &kInlineUpdateFlow,
-     &kOmahaMinSdkVersionAndroid,
-     &kShortCircuitUnfocusAnimation,
-     &kShowHomeButtonPolicyAndroid,
+     &kReadAloud,
+     &kReadAloudAudioOverviews,
+     &kReadAloudAudioOverviewsFeedback,
 diff --git a/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureList.java b/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureList.java
 --- a/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureList.java
 +++ b/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureList.java
-@@ -417,6 +417,7 @@ public abstract class ChromeFeatureList {
-             "HomepageIsNewTabPagePolicyAndroid";
-     public static final String HTTPS_FIRST_BALANCED_MODE = "HttpsFirstBalancedMode";
+@@ -477,6 +477,7 @@ public abstract class ChromeFeatureList {
+     public static final String INCOGNITO_NTP_SMALL_ICON = "IncognitoNtpSmallIcon";
     public static final String INCOGNITO_SCREENSHOT = "IncognitoScreenshot";
+     public static final String INCOGNITO_THEME_OVERLAY_TESTING = "IncognitoThemeOverlayTesting";
 +    public static final String INLINE_UPDATE_FLOW = "InlineUpdateFlow";
     public static final String INSTANCE_SWITCHER_V2 = "InstanceSwitcherV2";
     public static final String IP_PROTECTION_UX = "IpProtectionUx";
     public static final String KEYBOARD_ESC_BACK_NAVIGATION = "KeyboardEscBackNavigation";
+diff --git a/chrome/browser/media/router/discovery/access_code/access_code_cast_discovery_interface.cc b/chrome/browser/media/router/discovery/access_code/access_code_cast_discovery_interface.cc
+--- a/chrome/browser/media/router/discovery/access_code/access_code_cast_discovery_interface.cc
+++ b/chrome/browser/media/router/discovery/access_code/access_code_cast_discovery_interface.cc
+@@ -264,7 +264,7 @@ AccessCodeCastDiscoveryInterface::CreateEndpointFetcher(
+           .SetTimeout(kTimeout)
+           .SetUrl(GURL(base::StrCat({GetDiscoveryUrl(), "/", access_code})))
+           .SetPostData(kEmptyPostData)
+-          .Build());
+          .Build(), kTrafficAnnotation);
+ }
+ 
+ void AccessCodeCastDiscoveryInterface::ValidateDiscoveryAccessCode(
 diff --git a/chrome/browser/omaha/android/BUILD.gn b/chrome/browser/omaha/android/BUILD.gn
 --- a/chrome/browser/omaha/android/BUILD.gn
 +++ b/chrome/browser/omaha/android/BUILD.gn
@@ -1281,10 +1211,10 @@ diff --git a/chrome/browser/omaha/android/java/src/org/chromium/chrome/browser/o
 +import org.chromium.base.ActivityState;
 +import org.chromium.base.ApplicationStatus;
 +import org.chromium.base.ApplicationStatus.ActivityStateListener;
- import org.chromium.base.BuildInfo;
+ import org.chromium.base.ApkInfo;
 import org.chromium.base.Callback;
- import org.chromium.base.ObserverList;
-@@ -30,6 +33,7 @@ import org.chromium.base.task.TaskTraits;
+ import org.chromium.base.DeviceInfo;
+@@ -31,6 +34,7 @@ import org.chromium.base.task.TaskTraits;
 import org.chromium.build.annotations.NullMarked;
 import org.chromium.build.annotations.Nullable;
 import org.chromium.build.annotations.RequiresNonNull;
@@ -1292,7 +1222,7 @@ diff --git a/chrome/browser/omaha/android/java/src/org/chromium/chrome/browser/o
 import org.chromium.chrome.browser.omaha.metrics.UpdateSuccessMetrics;
 import org.chromium.chrome.browser.preferences.ChromePreferenceKeys;
 import org.chromium.chrome.browser.preferences.ChromeSharedPreferences;
-@@ -39,6 +43,11 @@ import java.io.File;
+@@ -40,6 +44,11 @@ import java.io.File;
 import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 
@@ -1304,7 +1234,7 @@ diff --git a/chrome/browser/omaha/android/java/src/org/chromium/chrome/browser/o
 /**
  * Provides the current update state for Chrome.  This update state is asynchronously determined and
  * can change as Chrome runs.
-@@ -46,24 +55,26 @@ import java.lang.annotation.RetentionPolicy;
+@@ -47,24 +56,26 @@ import java.lang.annotation.RetentionPolicy;
  * For manually testing this functionality, see {@link UpdateConfigs}.
  */
 @NullMarked
@@ -1339,7 +1269,7 @@ diff --git a/chrome/browser/omaha/android/java/src/org/chromium/chrome/browser/o
     }
 
     /** A set of properties that represent the current update state for Chrome. */
-@@ -97,6 +108,12 @@ public class UpdateStatusProvider {
+@@ -98,6 +109,12 @@ public class UpdateStatusProvider {
          */
         private boolean mIsSimulated;
 
@@ -1352,7 +1282,7 @@ diff --git a/chrome/browser/omaha/android/java/src/org/chromium/chrome/browser/o
         public UpdateStatus() {}
 
         UpdateStatus(UpdateStatus other) {
-@@ -105,11 +122,13 @@ public class UpdateStatusProvider {
+@@ -106,11 +123,13 @@ public class UpdateStatusProvider {
             latestVersion = other.latestVersion;
             latestUnsupportedVersion = other.latestUnsupportedVersion;
             mIsSimulated = other.mIsSimulated;
@@ -1366,7 +1296,7 @@ diff --git a/chrome/browser/omaha/android/java/src/org/chromium/chrome/browser/o
     private final UpdateQuery mOmahaQuery;
     private final UpdateSuccessMetrics mMetrics;
     private @Nullable UpdateStatus mStatus;
-@@ -117,11 +136,6 @@ public class UpdateStatusProvider {
+@@ -118,11 +137,6 @@ public class UpdateStatusProvider {
     /** Whether or not we've recorded the initial update status yet. */
     private boolean mRecordedInitialStatus;
 
@@ -1378,7 +1308,7 @@ diff --git a/chrome/browser/omaha/android/java/src/org/chromium/chrome/browser/o
     /**
      * Adds {@code observer} to notify about update state changes.  It is safe to call this multiple
      * times with the same {@code observer}.  This method will always notify {@code observer} of the
-@@ -177,6 +191,30 @@ public class UpdateStatusProvider {
+@@ -178,6 +192,30 @@ public class UpdateStatusProvider {
         pingObservers();
     }
 
@@ -1409,7 +1339,7 @@ diff --git a/chrome/browser/omaha/android/java/src/org/chromium/chrome/browser/o
     /**
      * Starts the intent update process, if possible
      * @param context An {@link Context} that will be used to fire off the update intent.
-@@ -184,12 +222,11 @@ public class UpdateStatusProvider {
+@@ -185,12 +223,11 @@ public class UpdateStatusProvider {
      * @return        Whether or not the update intent was sent and had a valid handler.
      */
     public boolean startIntentUpdate(Context context, boolean newTask) {
@@ -1423,7 +1353,7 @@ diff --git a/chrome/browser/omaha/android/java/src/org/chromium/chrome/browser/o
             Intent intent = new Intent(Intent.ACTION_VIEW, Uri.parse(mStatus.updateUrl));
             if (newTask) intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
             context.startActivity(intent);
-@@ -200,9 +237,15 @@ public class UpdateStatusProvider {
+@@ -201,9 +238,15 @@ public class UpdateStatusProvider {
         return true;
     }
 
@@ -1441,7 +1371,7 @@ diff --git a/chrome/browser/omaha/android/java/src/org/chromium/chrome/browser/o
     }
 
     @RequiresNonNull("mStatus")
-@@ -211,35 +254,52 @@ public class UpdateStatusProvider {
+@@ -212,35 +255,52 @@ public class UpdateStatusProvider {
     }
 
     private void resolveStatus() {
@@ -1503,7 +1433,7 @@ diff --git a/chrome/browser/omaha/android/java/src/org/chromium/chrome/browser/o
             mCallback = resultReceiver;
         }
 
-@@ -251,7 +311,7 @@ public class UpdateStatusProvider {
+@@ -252,7 +312,7 @@ public class UpdateStatusProvider {
         protected UpdateStatus doInBackground() {
             UpdateStatus testStatus = getTestStatus();
             if (testStatus != null) return testStatus;
@@ -1512,7 +1442,7 @@ diff --git a/chrome/browser/omaha/android/java/src/org/chromium/chrome/browser/o
         }
 
         @Override
-@@ -269,6 +329,8 @@ public class UpdateStatusProvider {
+@@ -270,6 +330,8 @@ public class UpdateStatusProvider {
             status.mIsSimulated = true;
             status.updateState = forcedUpdateState;
 
@@ -1521,7 +1451,7 @@ diff --git a/chrome/browser/omaha/android/java/src/org/chromium/chrome/browser/o
             // Push custom configurations for certain update states.
             switch (forcedUpdateState) {
                 case UpdateState.UPDATE_AVAILABLE:
-@@ -286,31 +348,33 @@ public class UpdateStatusProvider {
+@@ -287,31 +349,33 @@ public class UpdateStatusProvider {
             return status;
         }
 
@@ -1536,7 +1466,7 @@ diff --git a/chrome/browser/omaha/android/java/src/org/chromium/chrome/browser/o
 -                boolean allowedToUpdate =
 -                        checkForSufficientStorage()
 -                                // Disable the version update check for automotive. See b/297925838.
-                                && !BuildInfo.getInstance().isAutomotive
+-                                && !DeviceInfo.isAutomotive()
 -                                && PackageUtils.isPackageInstalled(
 -                                        GooglePlayServicesUtil.GOOGLE_PLAY_STORE_PACKAGE);
 -                status.updateState =
@@ -1657,7 +1587,7 @@ new file mode 100644
 diff --git a/chrome/browser/safety_hub/android/java/src/org/chromium/chrome/browser/safety_hub/SafetyHubFetchService.java b/chrome/browser/safety_hub/android/java/src/org/chromium/chrome/browser/safety_hub/SafetyHubFetchService.java
 --- a/chrome/browser/safety_hub/android/java/src/org/chromium/chrome/browser/safety_hub/SafetyHubFetchService.java
 +++ b/chrome/browser/safety_hub/android/java/src/org/chromium/chrome/browser/safety_hub/SafetyHubFetchService.java
-@@ -84,9 +84,6 @@ public class SafetyHubFetchService implements SigninManager.SignInStateObserver,
+@@ -85,9 +85,6 @@ public class SafetyHubFetchService implements SigninManager.SignInStateObserver,
         mLocalPasswordsFetchService =
                 new SafetyHubPasswordsFetchService(passwordManagerHelper, prefService, null);
 
@@ -1667,7 +1597,7 @@ diff --git a/chrome/browser/safety_hub/android/java/src/org/chromium/chrome/brow
         recordMetricForUnusedSitePermissionsSettingState();
     }
 
-@@ -115,8 +112,6 @@ public class SafetyHubFetchService implements SigninManager.SignInStateObserver,
+@@ -116,8 +113,6 @@ public class SafetyHubFetchService implements SigninManager.SignInStateObserver,
         if (mSigninManager != null) {
             mSigninManager.removeSignInStateObserver(this);
         }
@@ -1676,10 +1606,22 @@ diff --git a/chrome/browser/safety_hub/android/java/src/org/chromium/chrome/brow
     }
 
     /** See {@link ChromeActivitySessionTracker#onForegroundSessionStart()}. */
+diff --git a/chrome/browser/save_to_drive/drive_uploader.cc b/chrome/browser/save_to_drive/drive_uploader.cc
+--- a/chrome/browser/save_to_drive/drive_uploader.cc
+++ b/chrome/browser/save_to_drive/drive_uploader.cc
+@@ -290,7 +290,7 @@ DriveUploader::CreateEndpointFetcher(
+   return std::make_unique<endpoint_fetcher::EndpointFetcher>(
+       /*url_loader_factory=*/url_loader_factory_.get(),
+       /*identity_manager=*/identity_manager_,
+-      /*request_params=*/std::move(request_params));
+      /*request_params=*/std::move(request_params), kTrafficAnnotationTag);
+ }
+ 
+ DriveUploaderType DriveUploader::get_drive_uploader_type() const {
 diff --git a/chrome/browser/ui/android/strings/android_chrome_strings.grd b/chrome/browser/ui/android/strings/android_chrome_strings.grd
 --- a/chrome/browser/ui/android/strings/android_chrome_strings.grd
 +++ b/chrome/browser/ui/android/strings/android_chrome_strings.grd
-@@ -2420,6 +2420,12 @@ Your Google account may have other forms of browsing history like searches and a
+@@ -2315,6 +2315,12 @@ Your Google account may have other forms of browsing history like searches and a
       <message name="IDS_DEPRECATION_WARNING" desc="Warning about Chrome updates no longer being supported">
         Chrome updates are no longer supported for this version of Android
       </message>
@@ -1692,7 +1634,7 @@ diff --git a/chrome/browser/ui/android/strings/android_chrome_strings.grd b/chro
 
       <!-- Account management UI strings. -->
       <message name="IDS_ACCOUNT_MANAGEMENT_TITLE" desc="Header title for the account management screen. [CHAR_LIMIT=32]">
-@@ -4383,7 +4389,10 @@ To change this setting, <ph name="BEGIN_LINK">BEGIN_LINK</ph>delete the Chrome d
+@@ -4366,7 +4372,10 @@ To change this setting, <ph name="BEGIN_LINK">BEGIN_LINK</ph>delete the Chrome d
 
       <!-- Main menu items -->
       <message name="IDS_MENU_UPDATE" desc="Menu item for updating chrome. [CHAR_LIMIT=24]">
@@ -1704,7 +1646,7 @@ diff --git a/chrome/browser/ui/android/strings/android_chrome_strings.grd b/chro
       </message>
       <message name="IDS_MENU_UPDATE_SUMMARY_DEFAULT" desc="Summary string for update menu item explaining that a newer version of Chrome is available. [CHAR_LIMIT=30]">
         Newer version is available
-@@ -4394,6 +4403,18 @@ To change this setting, <ph name="BEGIN_LINK">BEGIN_LINK</ph>delete the Chrome d
+@@ -4377,6 +4386,18 @@ To change this setting, <ph name="BEGIN_LINK">BEGIN_LINK</ph>delete the Chrome d
       <message name="IDS_MENU_UPDATE_UNSUPPORTED_SUMMARY_DEFAULT" desc="Summary string for update menu item explaining that the Android version on the device is unsupported. [CHAR_LIMIT=30]">
         Android version is unsupported
       </message>
@@ -1726,18 +1668,103 @@ diff --git a/chrome/browser/ui/android/strings/android_chrome_strings.grd b/chro
 diff --git a/chrome/browser/ui/lens/lens_overlay_query_controller.cc b/chrome/browser/ui/lens/lens_overlay_query_controller.cc
 --- a/chrome/browser/ui/lens/lens_overlay_query_controller.cc
 +++ b/chrome/browser/ui/lens/lens_overlay_query_controller.cc
-@@ -923,6 +923,7 @@ LensOverlayQueryController::CreateEndpointFetcher(
-       /*post_data=*/std::move(request_string),
-       /*headers=*/request_headers,
-       /*cors_exempt_headers=*/cors_exempt_headers, chrome::GetChannel(),
-+      kTrafficAnnotationTag,
-       /*request_params=*/
-       EndpointFetcher::RequestParams::Builder(http_method,
-                                               kTrafficAnnotationTag)
+@@ -770,7 +770,7 @@ LensOverlayQueryController::CreateEndpointFetcher(
+           .SetTimeout(timeout)
+           .SetUrl(fetch_url)
+           .SetUploadProgressCallback(std::move(upload_progress_callback))
+-          .Build());
+          .Build(), kTrafficAnnotationTag);
+ }
+ 
+ void LensOverlayQueryController::SendLatencyGen204IfEnabled(
+diff --git a/components/commerce/core/account_checker.cc b/components/commerce/core/account_checker.cc
+--- a/components/commerce/core/account_checker.cc
+++ b/components/commerce/core/account_checker.cc
+@@ -327,7 +327,7 @@ std::unique_ptr<EndpointFetcher> AccountChecker::CreateEndpointFetcher(
+       .SetPostData(post_data);
+   MaybeUseAlternateShoppingServer(request_params);
+   return std::make_unique<EndpointFetcher>(
+-      url_loader_factory_, identity_manager_, request_params.Build());
+      url_loader_factory_, identity_manager_, request_params.Build(), annotation_tag);
+ }
+ 
+ }  // namespace commerce
+diff --git a/components/commerce/core/compare/cluster_server_proxy.cc b/components/commerce/core/compare/cluster_server_proxy.cc
+--- a/components/commerce/core/compare/cluster_server_proxy.cc
+++ b/components/commerce/core/compare/cluster_server_proxy.cc
+@@ -156,7 +156,7 @@ std::unique_ptr<EndpointFetcher> ClusterServerProxy::CreateEndpointFetcher(
+       .SetPostData(post_data);
+   commerce::MaybeUseAlternateShoppingServer(request_params);
+   return std::make_unique<EndpointFetcher>(
+-      url_loader_factory_, identity_manager_, request_params.Build());
+      url_loader_factory_, identity_manager_, request_params.Build(), kGetComparableProductsTrafficAnnotation);
+ }
+ 
+ void ClusterServerProxy::HandleCompareResponse(
+diff --git a/components/commerce/core/compare/product_specifications_server_proxy.cc b/components/commerce/core/compare/product_specifications_server_proxy.cc
+--- a/components/commerce/core/compare/product_specifications_server_proxy.cc
+++ b/components/commerce/core/compare/product_specifications_server_proxy.cc
+@@ -296,7 +296,7 @@ ProductSpecificationsServerProxy::CreateEndpointFetcher(
+       .SetPostData(post_data);
+   MaybeUseAlternateShoppingServer(request_params);
+   return std::make_unique<EndpointFetcher>(
+-      url_loader_factory_, identity_manager_, request_params.Build());
+      url_loader_factory_, identity_manager_, request_params.Build(), kShoppingListTrafficAnnotation);
+ }
+ 
+ std::optional<ProductSpecifications>
+diff --git a/components/commerce/core/subscriptions/subscriptions_server_proxy.cc b/components/commerce/core/subscriptions/subscriptions_server_proxy.cc
+--- a/components/commerce/core/subscriptions/subscriptions_server_proxy.cc
+++ b/components/commerce/core/subscriptions/subscriptions_server_proxy.cc
+@@ -302,7 +302,7 @@ SubscriptionsServerProxy::CreateEndpointFetcher(
+       .SetPostData(post_data);
+   MaybeUseAlternateShoppingServer(request_params);
+   return std::make_unique<EndpointFetcher>(
+-      url_loader_factory_, identity_manager_, request_params.Build());
+      url_loader_factory_, identity_manager_, request_params.Build(), annotation_tag);
+ }
+ 
+ void SubscriptionsServerProxy::HandleManageSubscriptionsResponses(
+diff --git a/components/contextual_search/internal/composebox_query_controller.cc b/components/contextual_search/internal/composebox_query_controller.cc
+--- a/components/contextual_search/internal/composebox_query_controller.cc
+++ b/components/contextual_search/internal/composebox_query_controller.cc
+@@ -777,7 +777,7 @@ ComposeboxQueryController::CreateEndpointFetcher(
+           .SetTimeout(timeout)
+           .SetUploadProgressCallback(std::move(upload_progress_callback))
+           .SetUrl(fetch_url)
+-          .Build());
+          .Build(), kTrafficAnnotationTag);
+ }
+ 
+ lens::LensOverlayClientContext ComposeboxQueryController::CreateClientContext()
+diff --git a/components/data_sharing/internal/data_sharing_network_loader_impl.cc b/components/data_sharing/internal/data_sharing_network_loader_impl.cc
+--- a/components/data_sharing/internal/data_sharing_network_loader_impl.cc
+++ b/components/data_sharing/internal/data_sharing_network_loader_impl.cc
+@@ -63,7 +63,7 @@ DataSharingNetworkLoaderImpl::CreateEndpointFetcher(
+           .SetUrl(url)
+           .SetOAuthConsumerId(signin::OAuthConsumerId::kDataSharingAndroid)
+           .SetPostData(post_data)
+-          .Build());
+          .Build(), annotation_tag);
+ }
+ 
+ void DataSharingNetworkLoaderImpl::OnDownloadComplete(
+diff --git a/components/data_sharing/internal/preview_server_proxy.cc b/components/data_sharing/internal/preview_server_proxy.cc
+--- a/components/data_sharing/internal/preview_server_proxy.cc
+++ b/components/data_sharing/internal/preview_server_proxy.cc
+@@ -346,7 +346,7 @@ std::unique_ptr<EndpointFetcher> PreviewServerProxy::CreateEndpointFetcher(
+           .SetContentType(kContentType)
+           .SetTimeout(kTimeout)
+           .SetUrl(url)
+-          .Build());
+          .Build(), kGetSharedDataPreviewTrafficAnnotation);
+ }
+ 
+ void PreviewServerProxy::HandleServerResponse(
 diff --git a/components/endpoint_fetcher/endpoint_fetcher.cc b/components/endpoint_fetcher/endpoint_fetcher.cc
 --- a/components/endpoint_fetcher/endpoint_fetcher.cc
 +++ b/components/endpoint_fetcher/endpoint_fetcher.cc
-@@ -21,6 +21,11 @@
+@@ -29,6 +29,11 @@
 #include "services/network/public/mojom/referrer_policy.mojom-shared.h"
 #include "services/network/public/mojom/url_response_head.mojom.h"
 
@@ -1749,65 +1776,54 @@ diff --git a/components/endpoint_fetcher/endpoint_fetcher.cc b/components/endpoi
 namespace endpoint_fetcher {
 
 namespace {
-@@ -37,6 +42,8 @@ std::string GetHttpMethodString(const HttpMethod& http_method) {
-       return "POST";
-     case HttpMethod::kDelete:
+@@ -47,6 +52,8 @@ std::string GetHttpMethodString(const HttpMethod& http_method) {
       return "DELETE";
+     case HttpMethod::kPut:
+       return "PUT";
 +    case HttpMethod::kHead:
 +      return "HEAD";
     default:
       DCHECK(0) << base::StringPrintf("Unknown HttpMethod %d\n",
                                       static_cast<int>(http_method));
-@@ -51,6 +58,8 @@ HttpMethod GetHttpMethod(const std::string& http_method_string) {
-     return HttpMethod::kPost;
-   } else if (http_method_string == "DELETE") {
-     return HttpMethod::kDelete;
-+  } else if (http_method_string == "HEAD") {
-+    return HttpMethod::kHead;
-   }
-   return HttpMethod::kUndefined;
+@@ -54,6 +61,13 @@ std::string GetHttpMethodString(const HttpMethod& http_method) {
+   return "";
 }
-@@ -117,9 +126,11 @@ EndpointFetcher::EndpointFetcher(
-     const std::vector<std::string>& headers,
-     const std::vector<std::string>& cors_exempt_headers,
-     version_info::Channel channel,
-+    const net::NetworkTrafficAnnotationTag& annotation_tag,
-     const RequestParams request_params)
+ 
+HttpMethod GetHttpMethod(const std::string& http_method_string) {
+  if (http_method_string == "HEAD") {
+    return HttpMethod::kHead;
+  }
+  return HttpMethod::kUndefined;
+}
+
+ }  // namespace
+ 
+ EndpointResponse::EndpointResponse() = default;
+@@ -109,9 +123,11 @@ EndpointFetcher::RequestParams::Builder::Build() {
+ EndpointFetcher::EndpointFetcher(
+     const scoped_refptr<network::SharedURLLoaderFactory>& url_loader_factory,
+     signin::IdentityManager* identity_manager,
+-    RequestParams request_params)
+    RequestParams request_params,
+    const net::NetworkTrafficAnnotationTag& annotation_tag)
     : url_loader_factory_(url_loader_factory),
-       identity_manager_(nullptr),
-+      intercept_redirect_(false),
-       consent_level_(std::nullopt),
-       sanitize_response_(true),
-       channel_(channel),
-@@ -139,6 +150,7 @@ EndpointFetcher::EndpointFetcher(
-     const net::NetworkTrafficAnnotationTag& annotation_tag)
-     : url_loader_factory_(url_loader_factory),
-       identity_manager_(nullptr),
-+      intercept_redirect_(false),
-       consent_level_(std::nullopt),
-       sanitize_response_(false),
-       request_params_(EndpointFetcher::RequestParams::Builder(HttpMethod::kGet,
-@@ -163,6 +175,7 @@ EndpointFetcher::EndpointFetcher(
-     : oauth_consumer_name_(oauth_consumer_name),
-       url_loader_factory_(url_loader_factory),
       identity_manager_(identity_manager),
 +      intercept_redirect_(false),
-       consent_level_(consent_level),
-       sanitize_response_(true),
-       request_params_(
-@@ -182,6 +195,7 @@ EndpointFetcher::EndpointFetcher(
+       request_params_(std::move(request_params)) {
+   if (request_params_.auth_type() == OAUTH) {
+     DCHECK(identity_manager_)
+@@ -124,12 +140,32 @@ EndpointFetcher::EndpointFetcher(
 EndpointFetcher::EndpointFetcher(
     const net::NetworkTrafficAnnotationTag& annotation_tag)
     : identity_manager_(nullptr),
 +      intercept_redirect_(false),
-       consent_level_(std::nullopt),
-       sanitize_response_(true),
       request_params_(
-@@ -190,6 +204,27 @@ EndpointFetcher::EndpointFetcher(
+           EndpointFetcher::RequestParams::Builder(HttpMethod::kUndefined,
+                                                   annotation_tag)
               .SetTimeout(kDefaultTimeOut)
               .Build()) {}
 
-+// constructor used by Bromite
+// constructor used by Cromite
 +EndpointFetcher::EndpointFetcher(
 +    const scoped_refptr<network::SharedURLLoaderFactory>& url_loader_factory,
 +    const GURL& url,
@@ -1818,8 +1834,6 @@ diff --git a/components/endpoint_fetcher/endpoint_fetcher.cc b/components/endpoi
 +    : url_loader_factory_(url_loader_factory),
 +      identity_manager_(nullptr),
 +      intercept_redirect_(intercept_redirect),
-+      consent_level_(std::nullopt),
-+      sanitize_response_(false),
 +      request_params_(
 +          EndpointFetcher::RequestParams::Builder(GetHttpMethod(http_method),
 +                                                  annotation_tag)
@@ -1831,34 +1845,32 @@ diff --git a/components/endpoint_fetcher/endpoint_fetcher.cc b/components/endpoi
 EndpointFetcher::~EndpointFetcher() = default;
 
 void EndpointFetcher::Fetch(EndpointFetcherCallback endpoint_fetcher_callback) {
-@@ -247,12 +282,9 @@ void EndpointFetcher::PerformRequest(
+@@ -212,13 +248,10 @@ void EndpointFetcher::PerformHttpRequest(
   auto resource_request = std::make_unique<network::ResourceRequest>();
   resource_request->method = GetHttpMethodString(request_params_.http_method());
   resource_request->url = request_params_.url();
 -  resource_request->credentials_mode = GetCredentialsMode();
+-
 -  if (GetSetSiteForCookies()) {
 -    resource_request->site_for_cookies =
 -        net::SiteForCookies::FromUrl(request_params_.url());
 -  }
-
 +  resource_request->credentials_mode = network::mojom::CredentialsMode::kOmit;
+ 
 +  resource_request->load_flags = net::LOAD_BYPASS_CACHE | net::LOAD_DISABLE_CACHE
 +                                  | net::LOAD_DO_NOT_SAVE_COOKIES;
-   if (request_params_.http_method() == HttpMethod::kPost) {
-     resource_request->headers.SetHeader(kContentTypeKey,
-                                         request_params_.content_type());
-@@ -280,10 +312,26 @@ void EndpointFetcher::PerformRequest(
-     default:
+   // Add Content-Type header if post data is present.
+   bool has_body_content = (request_params_.http_method() == HttpMethod::kPost ||
+                            request_params_.http_method() == HttpMethod::kPut) &&
+@@ -259,8 +292,23 @@ void EndpointFetcher::PerformHttpRequest(
       break;
   }
-+
+ 
 +  if (intercept_redirect_ == true) {
 +    // will need manual mode to capture the landing page URL
 +    resource_request->redirect_mode = network::mojom::RedirectMode::kManual; // default is kFollow
 +  }
 +
-   // TODO(crbug.com/40641804) Make simple_url_loader_ local variable passed to
-   // callback
   simple_url_loader_ = network::SimpleURLLoader::Create(
       std::move(resource_request), request_params_.annotation_tag());
 +  simple_url_loader_->SetAllowHttpErrorResults(true);
@@ -1872,15 +1884,15 @@ diff --git a/components/endpoint_fetcher/endpoint_fetcher.cc b/components/endpoi
 +      &EndpointFetcher::OnSimpleLoaderRedirect, base::Unretained(this)));
 +  }
 
-   if (request_params_.http_method() == HttpMethod::kPost) {
+   if (has_body_content) {
     simple_url_loader_->AttachStringForUpload(
-@@ -295,15 +343,25 @@ void EndpointFetcher::PerformRequest(
-   }
+@@ -273,9 +321,18 @@ void EndpointFetcher::PerformHttpRequest(
+ 
   simple_url_loader_->SetRetryOptions(GetMaxRetries(),
                                       network::SimpleURLLoader::RETRY_ON_5XX);
 -  simple_url_loader_->SetTimeoutDuration(request_params_.timeout());
 -  simple_url_loader_->SetAllowHttpErrorResults(true);
-  network::SimpleURLLoader::BodyAsStringCallbackDeprecated
+-
 +  LOG(INFO) << "performing "
 +            << GetHttpMethodString(request_params_.http_method())
 +            << " request to " << url_;
@@ -1891,22 +1903,12 @@ diff --git a/components/endpoint_fetcher/endpoint_fetcher.cc b/components/endpoi
 +        url_loader_factory_.get(),
 +        base::BindOnce(&EndpointFetcher::OnURLLoadComplete,
 +                     base::Unretained(this)));
-+  } else {
-+      network::SimpleURLLoader::BodyAsStringCallbackDeprecated
-       body_as_string_callback = base::BindOnce(
-           &EndpointFetcher::OnResponseFetched, weak_ptr_factory_.GetWeakPtr(),
-           std::move(endpoint_fetcher_callback));
-  simple_url_loader_->DownloadToString(
-      url_loader_factory_.get(), std::move(body_as_string_callback),
-      network::SimpleURLLoader::kMaxBoundedStringDownloadSize);
-+      simple_url_loader_->DownloadToString(
-+         url_loader_factory_.get(), std::move(body_as_string_callback),
-+         network::SimpleURLLoader::kMaxBoundedStringDownloadSize);
+    return;
 +  }
- }
- 
- void EndpointFetcher::OnResponseFetched(
-@@ -381,21 +439,6 @@ void EndpointFetcher::OnSanitizationResult(
+   network::SimpleURLLoader::BodyAsStringCallback body_as_string_callback =
+       base::BindOnce(&EndpointFetcher::OnResponseFetched,
+                      weak_ptr_factory_.GetWeakPtr(),
+@@ -334,21 +391,6 @@ void EndpointFetcher::OnResponseFetched(
   std::move(endpoint_fetcher_callback).Run(std::move(response));
 }
 
@@ -1926,9 +1928,9 @@ diff --git a/components/endpoint_fetcher/endpoint_fetcher.cc b/components/endpoi
 -}
 -
 int EndpointFetcher::GetMaxRetries() const {
-   if (!request_params_.max_retries.has_value()) {
-     return kNumRetries;
-@@ -421,4 +464,39 @@ std::string EndpointFetcher::GetUrlForTesting() {
+   return request_params_.max_retries.value_or(kNumRetries);
+ }
+@@ -366,4 +408,39 @@ std::string EndpointFetcher::GetUrlForTesting() {
   return request_params_.url().spec();
 }
 
@@ -1971,59 +1973,55 @@ diff --git a/components/endpoint_fetcher/endpoint_fetcher.cc b/components/endpoi
 diff --git a/components/endpoint_fetcher/endpoint_fetcher.h b/components/endpoint_fetcher/endpoint_fetcher.h
 --- a/components/endpoint_fetcher/endpoint_fetcher.h
 +++ b/components/endpoint_fetcher/endpoint_fetcher.h
-@@ -21,6 +21,8 @@
+@@ -20,6 +20,9 @@
+ #include "services/network/public/mojom/fetch_api.mojom-forward.h"
+ #include "url/gurl.h"
+ 
+#include "services/network/public/cpp/resource_request.h"
+#include "services/network/public/mojom/url_response_head.mojom.h"
+
 namespace base {
 class TimeDelta;
 }  // namespace base
-+#include "services/network/public/cpp/resource_request.h"
-+#include "services/network/public/mojom/url_response_head.mojom.h"
- 
- namespace network {
- struct ResourceRequest;
-@@ -59,6 +61,7 @@ enum class HttpMethod {
-   kGet = 0,
+@@ -61,6 +64,7 @@ enum class HttpMethod {
   kPost = 1,
   kDelete = 2,
-+  kHead = 3,
+   kPut = 3,
+  kHead = 4,
 };
 
 enum AuthType {
-@@ -74,6 +77,8 @@ enum AuthType {
+@@ -79,6 +83,8 @@ struct EndpointResponse {
+   ~EndpointResponse();
 
- struct EndpointResponse {
   std::string response;
 +  long last_modified;
 +  std::string redirect_url;
   int http_status_code{-1};
   std::optional<FetchErrorType> error_type;
- };
-@@ -294,6 +299,7 @@ class EndpointFetcher {
-       const std::vector<std::string>& headers,
-       const std::vector<std::string>& cors_exempt_headers,
-       version_info::Channel channel,
-+      const net::NetworkTrafficAnnotationTag& annotation_tag,
-       const RequestParams request_params);
- 
-   // Constructor if no authentication is needed.
-@@ -302,6 +308,14 @@ class EndpointFetcher {
-       const GURL& url,
-       const net::NetworkTrafficAnnotationTag& annotation_tag);
- 
-+  // Constructor if no authentication is needed, with timeout
+   scoped_refptr<net::HttpResponseHeaders> headers;
+@@ -301,7 +307,16 @@ class EndpointFetcher {
+   EndpointFetcher(
+       const scoped_refptr<network::SharedURLLoaderFactory>& url_loader_factory,
+       signin::IdentityManager* identity_manager,
+-      RequestParams request_params);
+      RequestParams request_params,
+      const net::NetworkTrafficAnnotationTag& annotation_tag);
+
+  // Constructor used by cromite
 +  EndpointFetcher(const scoped_refptr<network::SharedURLLoaderFactory>& url_loader_factory,
 +                  const GURL& url,
 +                  const std::string& http_method,
 +                  int64_t timeout_ms,
 +                  const bool intercept_redirect,
 +                  const net::NetworkTrafficAnnotationTag& annotation_tag);
-+
-   // Used for tests. Can be used if caller constructs their own
-   // url_loader_factory and identity_manager.
-   EndpointFetcher(
-@@ -344,6 +358,11 @@ class EndpointFetcher {
-   void OnSanitizationResult(std::unique_ptr<EndpointResponse> response,
-                             EndpointFetcherCallback endpoint_fetcher_callback,
-                             data_decoder::JsonSanitizer::Result result);
+ 
+   EndpointFetcher(const EndpointFetcher& endpoint_fetcher) = delete;
+   EndpointFetcher& operator=(const EndpointFetcher& endpoint_fetcher) = delete;
+@@ -334,11 +349,17 @@ class EndpointFetcher {
+ 
+   void OnResponseFetched(EndpointFetcherCallback callback,
+                          std::optional<std::string> response_body);
 +  void OnURLLoadComplete(scoped_refptr<net::HttpResponseHeaders> headers);
 +  void OnSimpleLoaderRedirect(const GURL& url_before_redirect,
 +                              const net::RedirectInfo& redirect_info,
@@ -2032,22 +2030,22 @@ diff --git a/components/endpoint_fetcher/endpoint_fetcher.h b/components/endpoin
 
   network::mojom::CredentialsMode GetCredentialsMode() const;
   int GetMaxRetries() const;
-@@ -354,12 +373,14 @@ class EndpointFetcher {
-   // network::SimpleURLLoader.
-   const std::string oauth_consumer_name_;
-   signin::ScopeSet oauth_scopes_;
+   bool GetSetSiteForCookies() const;
+   UploadProgressCallback GetUploadProgressCallback() const;
 +  GURL url_;
 
   // Members set in constructor
   const scoped_refptr<network::SharedURLLoaderFactory> url_loader_factory_;
-   // `identity_manager_` can be null if it is not needed for authentication (in
-   // this case, callers should invoke `PerformRequest` directly).
-   const raw_ptr<signin::IdentityManager> identity_manager_;
+@@ -349,6 +370,8 @@ class EndpointFetcher {
+   // SingleClientSharedTabGroupVersioningSyncTest.ShouldShowVersioningMessagesAfterRestart/kSyncTransportOnly
+   const raw_ptr<signin::IdentityManager, DanglingUntriaged> identity_manager_;
+ 
 +  const bool intercept_redirect_;
-   // `consent_level_` is used together with `identity_manager_`, so it can be
-   // null if `identity_manager_` is null.
-   const std::optional<signin::ConsentLevel> consent_level_;
-@@ -372,6 +393,9 @@ class EndpointFetcher {
+
+   // The complete definition of the specific network request to be performed.
+   // Contains authentication details and response handling preferences.
+   const RequestParams request_params_;
+@@ -358,6 +381,9 @@ class EndpointFetcher {
       access_token_fetcher_;
   std::unique_ptr<network::SimpleURLLoader> simple_url_loader_;
 
@@ -2060,14 +2058,24 @@ diff --git a/components/endpoint_fetcher/endpoint_fetcher.h b/components/endpoin
 diff --git a/components/manta/base_provider.cc b/components/manta/base_provider.cc
 --- a/components/manta/base_provider.cc
 +++ b/components/manta/base_provider.cc
-@@ -163,6 +163,7 @@ std::unique_ptr<EndpointFetcher> BaseProvider::CreateEndpointFetcherForDemoMode(
-       /*cors_exempt_headers=*/std::vector<std::string>(),
-       // ChromeOS always uses the stable channel API key
-       version_info::Channel::STABLE,
-+      annotation_tag,
-       EndpointFetcher::RequestParams::Builder(kHttpMethod, annotation_tag)
-           .Build());
+@@ -140,7 +140,7 @@ std::unique_ptr<EndpointFetcher> BaseProvider::CreateEndpointFetcher(
+           .SetUrl(url)
+           .SetOAuthConsumerId(signin::OAuthConsumerId::kManta)
+           .SetPostData(post_data)
+-          .Build());
+          .Build(), annotation_tag);
 }
+ 
+ std::unique_ptr<EndpointFetcher> BaseProvider::CreateEndpointFetcherForDemoMode(
+@@ -158,7 +158,7 @@ std::unique_ptr<EndpointFetcher> BaseProvider::CreateEndpointFetcherForDemoMode(
+           .SetTimeout(timeout)
+           .SetPostData(post_data)
+           .SetChannel(version_info::Channel::STABLE)
+-          .Build());
+          .Build(), annotation_tag);
+ }
+ 
+ }  // namespace manta
 diff --git a/cromite_flags/chrome/browser/flags/android/chrome_feature_list_cc/Bromite-auto-updater.inc b/cromite_flags/chrome/browser/flags/android/chrome_feature_list_cc/Bromite-auto-updater.inc
 new file mode 100644
 --- /dev/null
@@ -21,8 +21,8 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 .../java/res/xml/adblock_preferences.xml      |  25 ++
 .../android/java/res/xml/main_preferences.xml |   5 +
 .../browser/settings/AdBlockEditor.java       |  91 ++++++
- .../browser/settings/AdBlockPreferences.java  |  58 ++++
- .../chrome/browser/tabmodel/TabModelImpl.java |   4 +-
+ .../browser/settings/AdBlockPreferences.java  |  74 +++++
+ .../browser/settings/SettingsActivity.java    |   3 +
 chrome/app/generated_resources.grd            |  10 +
 chrome/browser/after_startup_task_utils.cc    |   4 +
 chrome/browser/browser_process.h              |   6 +
@@ -33,7 +33,6 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 .../flags/android/adblock_native_gateway.cc   |  31 ++
 .../browser/flags/AdBlockNativeGateway.java   |  30 ++
 .../net/system_network_context_manager.cc     |   4 +
- .../sessions/session_restore_android.cc       |   7 +-
 .../strings/android_chrome_strings.grd        |  14 +
 chrome/common/pref_names.h                    |   5 +
 .../strings/android/site_settings.grdp        |   3 +
@@ -51,7 +50,7 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 .../browser/subresource_filter_features.cc    | 118 +-------
 .../core/browser/verified_ruleset_dealer.cc   |   4 +
 .../core/common/indexed_ruleset.cc            |   5 +-
- 39 files changed, 1269 insertions(+), 132 deletions(-)
+ 38 files changed, 1282 insertions(+), 127 deletions(-)
 create mode 100644 chrome/android/java/res/layout/adblock_editor.xml
 create mode 100644 chrome/android/java/res/xml/adblock_preferences.xml
 create mode 100644 chrome/android/java/src/org/chromium/chrome/browser/settings/AdBlockEditor.java
@@ -66,7 +65,7 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 diff --git a/chrome/android/BUILD.gn b/chrome/android/BUILD.gn
 --- a/chrome/android/BUILD.gn
 +++ b/chrome/android/BUILD.gn
-@@ -328,6 +328,7 @@ if (_is_default_toolchain) {
+@@ -302,6 +302,7 @@ if (_is_default_toolchain) {
       "//chrome/android/features/tab_ui/public:ui_java_resources",
       "//chrome/android/modules/stack_unwinder/provider:java",
       "//chrome/android/webapk/libs/client:client_java",
@@ -77,15 +76,15 @@ diff --git a/chrome/android/BUILD.gn b/chrome/android/BUILD.gn
 diff --git a/chrome/android/chrome_java_resources.gni b/chrome/android/chrome_java_resources.gni
 --- a/chrome/android/chrome_java_resources.gni
 +++ b/chrome/android/chrome_java_resources.gni
-@@ -440,6 +440,7 @@ chrome_java_resources = [
-   "java/res/layout/account_divider_preference.xml",
+@@ -453,6 +453,7 @@ chrome_java_resources = [
   "java/res/layout/account_management_account_row.xml",
   "java/res/layout/app_history_filter.xml",
+   "java/res/layout/auto_pip_permission_dialog.xml",
 +  "java/res/layout/adblock_editor.xml",
   "java/res/layout/auto_sign_in_first_run_dialog.xml",
   "java/res/layout/autofill_billing_address_dropdown.xml",
   "java/res/layout/autofill_card_name_and_number.xml",
-@@ -634,6 +635,7 @@ chrome_java_resources = [
+@@ -658,6 +659,7 @@ chrome_java_resources = [
   "java/res/xml/account_management_preferences.xml",
   "java/res/xml/ad_services_config.xml",
   "java/res/xml/appearance_preferences.xml",
@@ -96,7 +95,7 @@ diff --git a/chrome/android/chrome_java_resources.gni b/chrome/android/chrome_ja
 diff --git a/chrome/android/chrome_java_sources.gni b/chrome/android/chrome_java_sources.gni
 --- a/chrome/android/chrome_java_sources.gni
 +++ b/chrome/android/chrome_java_sources.gni
-@@ -893,6 +893,8 @@ chrome_java_sources = [
+@@ -942,6 +942,8 @@ chrome_java_sources = [
   "java/src/org/chromium/chrome/browser/permissions/PermissionBlockedDialog.java",
   "java/src/org/chromium/chrome/browser/permissions/PermissionUpdateRequester.java",
   "java/src/org/chromium/chrome/browser/photo_picker/DecoderServiceImpl.java",
@@ -180,8 +179,8 @@ new file mode 100644
 diff --git a/chrome/android/java/res/values/styles.xml b/chrome/android/java/res/values/styles.xml
 --- a/chrome/android/java/res/values/styles.xml
 +++ b/chrome/android/java/res/values/styles.xml
-@@ -263,6 +263,24 @@ found in the LICENSE file.
-         <item name="android:textSize">20sp</item>
+@@ -331,6 +331,24 @@ found in the LICENSE file.
+         </item>
     </style>
 
 +    <style name="ButtonBarTopSpacer" parent="ButtonBarTopSpacerLight">
@@ -252,7 +251,7 @@ new file mode 100644
 diff --git a/chrome/android/java/res/xml/main_preferences.xml b/chrome/android/java/res/xml/main_preferences.xml
 --- a/chrome/android/java/res/xml/main_preferences.xml
 +++ b/chrome/android/java/res/xml/main_preferences.xml
-@@ -120,6 +120,11 @@ for the previous order (main_preferences_legacy). -->
+@@ -111,6 +111,11 @@ found in the LICENSE file.
         android:key="toolbar_shortcut"
         android:order="21"
         android:title="@string/toolbar_shortcut"/>
@@ -364,7 +363,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/settings/AdBloc
 new file mode 100644
 --- /dev/null
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/settings/AdBlockPreferences.java
-@@ -0,0 +1,58 @@
+@@ -0,0 +1,74 @@
 +// Copyright 2015 The Chromium Authors. All rights reserved.
 +// Use of this source code is governed by a BSD-style license that can be
 +// found in the LICENSE file.
@@ -374,30 +373,46 @@ new file mode 100644
 +import android.os.Bundle;
 +import androidx.preference.Preference;
 +import androidx.preference.PreferenceFragmentCompat;
-+import org.chromium.components.browser_ui.settings.ChromeSwitchPreference;
+
+import org.chromium.base.supplier.ObservableSupplier;
+import org.chromium.base.supplier.ObservableSupplierImpl;
+import java.util.function.Supplier;
 +
 +import org.chromium.content_public.browser.BrowserContextHandle;
+import org.chromium.components.browser_ui.settings.ChromeSwitchPreference;
 +import org.chromium.components.browser_ui.site_settings.BaseSiteSettingsFragment;
 +import org.chromium.components.browser_ui.site_settings.WebsitePreferenceBridge;
 +import org.chromium.components.content_settings.ContentSettingsType;
 +import org.chromium.components.browser_ui.settings.SettingsUtils;
-+import org.chromium.chrome.browser.flags.AdBlockNativeGateway;
-+import androidx.annotation.VisibleForTesting;
+import org.chromium.components.browser_ui.settings.SettingsFragment;
+
 +import org.chromium.chrome.R;
+import org.chromium.chrome.browser.flags.AdBlockNativeGateway;
+import org.chromium.chrome.browser.settings.ChromeBaseSettingsFragment;
 +
 +/**
 + * Fragment that allows the user to configure AdBlock related preferences.
 + */
-+public class AdBlockPreferences extends BaseSiteSettingsFragment {
-+    @VisibleForTesting
+public class AdBlockPreferences extends ChromeBaseSettingsFragment {
 +    public static final String PREF_ADBLOCK_SWITCH = "adblock_switch";
 +    private static final String PREF_ADBLOCK_EDIT = "adblock_edit";
 +
 +    private Preference mAdBlockEdit;
+    private final ObservableSupplierImpl<String> mPageTitle = new ObservableSupplierImpl<>();
+
+    @Override
+    public ObservableSupplier<String> getPageTitle() {
+        return mPageTitle;
+    }
+
+    @Override
+    public @SettingsFragment.AnimationType int getAnimationType() {
+        return SettingsFragment.AnimationType.PROPERTY;
+    }
 +
 +    @Override
 +    public void onCreatePreferences(Bundle savedInstanceState, String rootKey) {
-+        getActivity().setTitle(R.string.options_adblock_title);
+        mPageTitle.set(getString(R.string.options_adblock_title));
 +        SettingsUtils.addPreferencesFromResource(this, R.xml.adblock_preferences);
 +
 +        ChromeSwitchPreference mAdBlockSwitch =
@@ -423,24 +438,30 @@ new file mode 100644
 +        updateCurrentAdBlockUrl();
 +    }
 +}
-diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/TabModelImpl.java b/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/TabModelImpl.java
--- a/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/TabModelImpl.java
-+++ b/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/TabModelImpl.java
-@@ -942,9 +942,7 @@ public class TabModelImpl extends TabModelJniBridge {
-                         .createTabWithWebContents(
-                                 parent,
-                                 webContents,
-                                select
-                                        ? TabLaunchType.FROM_RECENT_TABS_FOREGROUND
-                                        : TabLaunchType.FROM_RECENT_TABS)
-+                                TabLaunchType.FROM_LINK)
-                 != null;
-     }
+diff --git a/chrome/android/java/src/org/chromium/chrome/browser/settings/SettingsActivity.java b/chrome/android/java/src/org/chromium/chrome/browser/settings/SettingsActivity.java
+--- a/chrome/android/java/src/org/chromium/chrome/browser/settings/SettingsActivity.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/settings/SettingsActivity.java
+@@ -95,6 +95,8 @@ import java.util.HashMap;
+ import java.util.Locale;
+ import java.util.Map;
 
+import org.chromium.chrome.browser.settings.AdBlockEditor;
+
+ /**
+  * The Chrome settings activity.
+  *
+@@ -1175,6 +1177,7 @@ public class SettingsActivity extends ChromeBaseAppCompatActivity
+                     && !MAIN_FRAGMENT_TAG.equals(fragment.getTag())) {
+                 return;
+             }
+            if (fragment instanceof AdBlockEditor) return;
+ 
+             String className = fragment.getClass().getSimpleName();
+             RecordHistogram.recordSparseHistogram(
 diff --git a/chrome/app/generated_resources.grd b/chrome/app/generated_resources.grd
 --- a/chrome/app/generated_resources.grd
 +++ b/chrome/app/generated_resources.grd
-@@ -16713,6 +16713,16 @@ Please help our engineers fix this problem. Tell us what happened right before y
+@@ -17395,6 +17395,16 @@ Please help our engineers fix this problem. Tell us what happened right before y
       Never show this again.
     </message>
 
@@ -500,7 +521,7 @@ diff --git a/chrome/browser/browser_process.h b/chrome/browser/browser_process.h
 namespace gcm {
 class GCMDriver;
 }
-@@ -271,6 +276,7 @@ class BrowserProcess {
+@@ -276,6 +281,7 @@ class BrowserProcess {
 #endif
 
   virtual component_updater::ComponentUpdateService* component_updater() = 0;
@@ -511,7 +532,7 @@ diff --git a/chrome/browser/browser_process.h b/chrome/browser/browser_process.h
 diff --git a/chrome/browser/browser_process_impl.cc b/chrome/browser/browser_process_impl.cc
 --- a/chrome/browser/browser_process_impl.cc
 +++ b/chrome/browser/browser_process_impl.cc
-@@ -1271,6 +1271,34 @@ BrowserProcessImpl::component_updater() {
+@@ -1284,6 +1284,34 @@ BrowserProcessImpl::component_updater() {
   return component_updater_.get();
 }
 
@@ -549,7 +570,7 @@ diff --git a/chrome/browser/browser_process_impl.cc b/chrome/browser/browser_pro
 diff --git a/chrome/browser/browser_process_impl.h b/chrome/browser/browser_process_impl.h
 --- a/chrome/browser/browser_process_impl.h
 +++ b/chrome/browser/browser_process_impl.h
-@@ -214,6 +214,7 @@ class BrowserProcessImpl : public BrowserProcess,
+@@ -213,6 +213,7 @@ class BrowserProcessImpl : public BrowserProcess,
 #endif
 
   component_updater::ComponentUpdateService* component_updater() override;
@@ -557,7 +578,7 @@ diff --git a/chrome/browser/browser_process_impl.h b/chrome/browser/browser_proc
   MediaFileSystemRegistry* media_file_system_registry() override;
   WebRtcLogUploader* webrtc_log_uploader() override;
   network_time::NetworkTimeTracker* network_time_tracker() override;
-@@ -431,6 +432,7 @@ class BrowserProcessImpl : public BrowserProcess,
+@@ -426,6 +427,7 @@ class BrowserProcessImpl : public BrowserProcess,
   // to concerns over integrity of data shared between profiles,
   // but some users of component updater only install per-user.
   std::unique_ptr<component_updater::ComponentUpdateService> component_updater_;
@@ -568,7 +589,7 @@ diff --git a/chrome/browser/browser_process_impl.h b/chrome/browser/browser_proc
 diff --git a/chrome/browser/chrome_browser_main.cc b/chrome/browser/chrome_browser_main.cc
 --- a/chrome/browser/chrome_browser_main.cc
 +++ b/chrome/browser/chrome_browser_main.cc
-@@ -387,6 +387,9 @@ StartupProfileInfo CreateInitialProfile(
+@@ -430,6 +430,9 @@ StartupProfileInfo CreateInitialProfile(
   // missing code in the above test.
   CHECK(profile_info.profile) << "Cannot get default profile.";
 
@@ -581,7 +602,7 @@ diff --git a/chrome/browser/chrome_browser_main.cc b/chrome/browser/chrome_brows
 diff --git a/chrome/browser/flags/BUILD.gn b/chrome/browser/flags/BUILD.gn
 --- a/chrome/browser/flags/BUILD.gn
 +++ b/chrome/browser/flags/BUILD.gn
-@@ -8,6 +8,7 @@ import("//third_party/jni_zero/jni_zero.gni")
+@@ -9,6 +9,7 @@ import("//third_party/jni_zero/jni_zero.gni")
 android_library("java") {
   sources = [ "android/java/src/org/chromium/chrome/browser/flags/CromiteNativeUtils.java" ]
   sources += [
@@ -589,7 +610,7 @@ diff --git a/chrome/browser/flags/BUILD.gn b/chrome/browser/flags/BUILD.gn
     "android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureList.java",
     "android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureMap.java",
     "android/java/src/org/chromium/chrome/browser/flags/ChromeSessionState.java",
-@@ -47,6 +48,7 @@ java_bromite_impl("java_cromite_cached_flags") {
+@@ -49,6 +50,7 @@ java_bromite_impl("java_cromite_cached_flags") {
 generate_jni("jni_headers") {
   sources = [ "android/java/src/org/chromium/chrome/browser/flags/CromiteNativeUtils.java" ]
   sources += [
@@ -597,7 +618,7 @@ diff --git a/chrome/browser/flags/BUILD.gn b/chrome/browser/flags/BUILD.gn
     "android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureMap.java",
     "android/java/src/org/chromium/chrome/browser/flags/ChromeSessionState.java",
   ]
-@@ -61,6 +63,7 @@ static_library("flags_android") {
+@@ -62,6 +64,7 @@ static_library("flags_android") {
     "android/chrome_session_state.cc",
     "android/chrome_session_state.h",
   ]
@@ -679,9 +700,9 @@ new file mode 100755
 diff --git a/chrome/browser/net/system_network_context_manager.cc b/chrome/browser/net/system_network_context_manager.cc
 --- a/chrome/browser/net/system_network_context_manager.cc
 +++ b/chrome/browser/net/system_network_context_manager.cc
-@@ -653,6 +653,10 @@ void SystemNetworkContextManager::RegisterPrefs(PrefRegistrySimple* registry) {
-   StubResolverConfigReader::RegisterPrefs(registry);
+@@ -716,6 +716,10 @@ void SystemNetworkContextManager::RegisterPrefs(PrefRegistrySimple* registry) {
   DefaultDnsOverHttpsConfigSource::RegisterPrefs(registry);
+   NetworkProcessLaunchWatcher::RegisterPrefs(registry);
 
 +  registry->RegisterBooleanPref(prefs::kAdBlockEnabled, false);
 +  registry->RegisterStringPref(prefs::kAdBlockFiltersURL,
@@ -690,28 +711,11 @@ diff --git a/chrome/browser/net/system_network_context_manager.cc b/chrome/brows
   // Static auth params
   registry->RegisterStringPref(prefs::kAuthSchemes,
                                "basic,digest,ntlm,negotiate");
-diff --git a/chrome/browser/sessions/session_restore_android.cc b/chrome/browser/sessions/session_restore_android.cc
--- a/chrome/browser/sessions/session_restore_android.cc
-+++ b/chrome/browser/sessions/session_restore_android.cc
-@@ -58,8 +58,11 @@ content::WebContents* SessionRestore::RestoreForeignSessionTab(
-   DCHECK(current_tab);
-   // If swapped, return the current tab's most up-to-date web contents.
-   if (disposition == WindowOpenDisposition::CURRENT_TAB) {
-    current_tab->SwapWebContents(std::move(new_web_contents), false, false);
-    return current_tab->web_contents();
-+    int active_tab_index = tab_model->GetActiveIndex();
-+    tab_model->CreateTab(current_tab, new_web_contents.release(),
-+      disposition == WindowOpenDisposition::NEW_BACKGROUND_TAB);
-+    tab_model->CloseTabAt(active_tab_index);
-+    return raw_new_web_contents;
-   }
-   DCHECK(disposition == WindowOpenDisposition::NEW_FOREGROUND_TAB ||
-          disposition == WindowOpenDisposition::NEW_BACKGROUND_TAB);
 diff --git a/chrome/browser/ui/android/strings/android_chrome_strings.grd b/chrome/browser/ui/android/strings/android_chrome_strings.grd
 --- a/chrome/browser/ui/android/strings/android_chrome_strings.grd
 +++ b/chrome/browser/ui/android/strings/android_chrome_strings.grd
-@@ -221,6 +221,20 @@ CHAR_LIMIT guidelines:
-         <ph name="PREF_TITLE">%1$s</ph>  <ph name="BEGIN_NEW">&lt;new&gt;</ph>New<ph name="END_NEW">&lt;/new&gt;</ph>
+@@ -236,6 +236,20 @@ CHAR_LIMIT guidelines:
+         Try searching the help center
       </message>
 
 +      <!-- AdBlock settings -->
@@ -734,7 +738,7 @@ diff --git a/chrome/browser/ui/android/strings/android_chrome_strings.grd b/chro
 diff --git a/chrome/common/pref_names.h b/chrome/common/pref_names.h
 --- a/chrome/common/pref_names.h
 +++ b/chrome/common/pref_names.h
-@@ -2895,6 +2895,11 @@ inline constexpr char kAudioCaptureAllowed[] = "hardware.audio_capture_enabled";
+@@ -2979,6 +2979,11 @@ inline constexpr char kAudioCaptureAllowed[] = "hardware.audio_capture_enabled";
 inline constexpr char kAudioCaptureAllowedUrls[] =
     "hardware.audio_capture_allowed_urls";
 
@@ -749,7 +753,7 @@ diff --git a/chrome/common/pref_names.h b/chrome/common/pref_names.h
 diff --git a/components/browser_ui/strings/android/site_settings.grdp b/components/browser_ui/strings/android/site_settings.grdp
 --- a/components/browser_ui/strings/android/site_settings.grdp
 +++ b/components/browser_ui/strings/android/site_settings.grdp
-@@ -379,6 +379,9 @@
+@@ -424,6 +424,9 @@
   <message name="IDS_INTRUSIVE_ADS_INFORMATION" desc="The extra information at the top of the Site Details page when the site tends to show intrusive ads">
     This site shows intrusive or misleading ads
   </message>
@@ -1591,7 +1595,7 @@ diff --git a/components/subresource_filter/content/browser/content_subresource_f
       web_contents_helper_(web_contents_helper) {}
 
 ContentSubresourceFilterThrottleManager::
-@@ -628,6 +632,17 @@ ContentSubresourceFilterThrottleManager::
+@@ -661,6 +665,17 @@ ContentSubresourceFilterThrottleManager::
       throttle->NotifyPageActivationWithRuleset(EnsureRulesetHandle(),
                                                 ad_tagging_state);
     }
@@ -1612,7 +1616,7 @@ diff --git a/components/subresource_filter/content/browser/content_subresource_f
 diff --git a/components/subresource_filter/content/browser/content_subresource_filter_throttle_manager.h b/components/subresource_filter/content/browser/content_subresource_filter_throttle_manager.h
 --- a/components/subresource_filter/content/browser/content_subresource_filter_throttle_manager.h
 +++ b/components/subresource_filter/content/browser/content_subresource_filter_throttle_manager.h
-@@ -403,6 +403,8 @@ class ContentSubresourceFilterThrottleManager
+@@ -410,6 +410,8 @@ class ContentSubresourceFilterThrottleManager
 
   std::unique_ptr<ProfileInteractionManager> profile_interaction_manager_;
 
@@ -1994,15 +1998,15 @@ diff --git a/components/subresource_filter/core/browser/verified_ruleset_dealer.
 diff --git a/components/subresource_filter/core/common/indexed_ruleset.cc b/components/subresource_filter/core/common/indexed_ruleset.cc
 --- a/components/subresource_filter/core/common/indexed_ruleset.cc
 +++ b/components/subresource_filter/core/common/indexed_ruleset.cc
-@@ -6,6 +6,7 @@
- 
+@@ -7,6 +7,7 @@
 #include "base/check.h"
+ #include "base/functional/callback.h"
 #include "base/hash/hash.h"
 +#include "base/logging.h"
 #include "base/metrics/histogram_functions.h"
 #include "base/strings/strcat.h"
 #include "base/trace_event/trace_event.h"
-@@ -37,7 +38,9 @@ VerifyStatus GetVerifyStatus(base::span<const uint8_t> buffer,
+@@ -38,7 +39,9 @@ VerifyStatus GetVerifyStatus(base::span<const uint8_t> buffer,
   // least once.  The verifier detects a subset of the errors detected by the
   // checksum, and is unneeded once expected_checksum is consistently nonzero.
   flatbuffers::Verifier verifier(buffer.data(), buffer.size());
@@ -15,7 +15,7 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 diff --git a/chrome/browser/ui/views/toolbar/reload_button.cc b/chrome/browser/ui/views/toolbar/reload_button.cc
 --- a/chrome/browser/ui/views/toolbar/reload_button.cc
 +++ b/chrome/browser/ui/views/toolbar/reload_button.cc
-@@ -226,6 +226,14 @@ void ReloadButton::ButtonPressed(const ui::Event& event) {
+@@ -276,6 +276,14 @@ void ReloadButton::ButtonPressed(const ui::Event& event) {
       command = IDC_RELOAD;
     }
 
@@ -33,9 +33,9 @@ diff --git a/chrome/browser/ui/views/toolbar/reload_button.cc b/chrome/browser/u
 diff --git a/ui/views/widget/widget.h b/ui/views/widget/widget.h
 --- a/ui/views/widget/widget.h
 +++ b/ui/views/widget/widget.h
-@@ -1406,6 +1406,19 @@ class VIEWS_EXPORT Widget : public internal::NativeWidgetDelegate,
-   void UpdateAccessibleNameForRootView();
-   void UpdateAccessibleURLForRootView(const GURL& url);
+@@ -1468,6 +1468,19 @@ class VIEWS_EXPORT Widget : public internal::NativeWidgetDelegate,
+   // initialized.
+   void SaveWindowPlacementIfNeeded();
 
 +  // Type of ways to ignore activation changes.
 +  enum class DisableActivationChangeHandlingType {
@@ -53,8 +53,8 @@ diff --git a/ui/views/widget/widget.h b/ui/views/widget/widget.h
  protected:
   // Creates the RootView to be used within this Widget. Subclasses may override
   // to create custom RootViews that do specialized event processing.
-@@ -1444,13 +1457,6 @@ class VIEWS_EXPORT Widget : public internal::NativeWidgetDelegate,
-   ui::ColorProviderKey GetColorProviderKey() const override;
+@@ -1508,13 +1521,6 @@ class VIEWS_EXPORT Widget : public internal::NativeWidgetDelegate,
+   void set_widget_closed() { widget_closed_ = true; }
 
  private:
 -  // Type of ways to ignore activation changes.
@@ -67,7 +67,7 @@ diff --git a/ui/views/widget/widget.h b/ui/views/widget/widget.h
   class PaintAsActiveLockImpl;
 
   friend class ButtonTest;
-@@ -1461,11 +1467,6 @@ class VIEWS_EXPORT Widget : public internal::NativeWidgetDelegate,
+@@ -1525,11 +1531,6 @@ class VIEWS_EXPORT Widget : public internal::NativeWidgetDelegate,
   friend class ui_devtools::BubbleLocking;
   friend void DisableActivationChangeHandlingForTests();
 
@@ -6,20 +6,33 @@ In site settings added ability to block all popups per site

 License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 ---
+ .../settings/site_settings/popups_page.html   |   2 +
 .../tab_under_navigation_throttle.cc          |  11 +-
 .../android/popup_blocked_message_delegate.cc |  20 +++-
 .../android/popup_blocked_message_delegate.h  |   1 +
 components/blocked_content/popup_blocker.cc   |   3 +
 components/blocked_content_strings.grdp       |   3 +
 .../impl/BromitePopupContentSetting.java      | 106 ++++++++++++++++++
- .../bromite_content_settings/popups.grdp      |  12 ++
- .../bromite_content_settings/popups.inc       |   8 ++
+ .../bromite_content_settings/popups.grdp      |  18 +++
+ .../bromite_content_settings/popups.inc       |  13 +++
 .../core/browser/content_settings_registry.cc |   2 +-
- 9 files changed, 160 insertions(+), 6 deletions(-)
+ 10 files changed, 173 insertions(+), 6 deletions(-)
 create mode 100644 components/browser_ui/site_settings/android/java/src/org/chromium/components/browser_ui/site_settings/impl/BromitePopupContentSetting.java
 create mode 100644 components/browser_ui/strings/bromite_content_settings/popups.grdp
 create mode 100644 components/content_settings/core/browser/bromite_content_settings/popups.inc

+diff --git a/chrome/browser/resources/settings/site_settings/popups_page.html b/chrome/browser/resources/settings/site_settings/popups_page.html
+--- a/chrome/browser/resources/settings/site_settings/popups_page.html
+++ b/chrome/browser/resources/settings/site_settings/popups_page.html
+@@ -10,6 +10,8 @@
+       category="[[contentSettingsTypesEnum_.POPUPS]]"
+       allow-option-label="$i18n{siteSettingsPopupsAllowed}"
+       allow-option-icon="cr:open-in-new"
+      ask-option-label="$i18n{brSiteSettingspopupsAsk}"
+      ask-option-icon="privacy:open-in-new-off"
+       block-option-label="$i18n{siteSettingsPopupsBlocked}"
+       block-option-icon="privacy:open-in-new-off">
+   </settings-category-default-radio-group>
 diff --git a/chrome/browser/ui/blocked_content/tab_under_navigation_throttle.cc b/chrome/browser/ui/blocked_content/tab_under_navigation_throttle.cc
 --- a/chrome/browser/ui/blocked_content/tab_under_navigation_throttle.cc
 +++ b/chrome/browser/ui/blocked_content/tab_under_navigation_throttle.cc
@@ -160,7 +173,7 @@ new file mode 100644
 +import org.chromium.components.browser_ui.site_settings.BromiteCustomContentSetting;
 +import org.chromium.components.browser_ui.site_settings.ContentSettingsResources;
 +import org.chromium.components.browser_ui.site_settings.SiteSettingsCategory;
-+import org.chromium.components.content_settings.ContentSettingValues;
+import org.chromium.components.content_settings.ContentSetting;
 +import org.chromium.components.content_settings.ContentSettingsType;
 +import org.chromium.content_public.browser.BrowserContextHandle;
 +
@@ -173,8 +186,8 @@ new file mode 100644
 +public class BromitePopupContentSetting extends BromiteCustomContentSetting {
 +    public BromitePopupContentSetting() {
 +        super(/*contentSettingsType*/ ContentSettingsType.POPUPS,
-+              /*defaultEnabledValue*/ ContentSettingValues.ALLOW,
-+              /*defaultDisabledValue*/ ContentSettingValues.BLOCK,
+              /*defaultEnabledValue*/ ContentSetting.ALLOW,
+              /*defaultDisabledValue*/ ContentSetting.BLOCK,
 +              /*allowException*/ true,
 +              /*preferenceKey*/ "popups",
 +              /*profilePrefKey*/ "popups");
@@ -193,13 +206,13 @@ new file mode 100644
 +    }
 +
 +    @Override
-+    public int getCategorySummary(@Nullable @ContentSettingValues int value) {
+    public int getCategorySummary(@Nullable @ContentSetting int value) {
 +        switch (value) {
-+            case ContentSettingValues.ALLOW:
+            case ContentSetting.ALLOW:
 +                return R.string.website_settings_category_popup_allowed;
-+            case ContentSettingValues.BLOCK:
+            case ContentSetting.BLOCK:
 +                return R.string.website_settings_category_popup_blocked;
-+            case ContentSettingValues.ASK:
+            case ContentSetting.ASK:
 +                return R.string.website_settings_category_popup_block_all;
 +            default:
 +                return 0;
@@ -236,17 +249,23 @@ new file mode 100644
 +    }
 +
 +    @Override
-+    public @Nullable Boolean considerException(SiteSettingsCategory category, @ContentSettingValues int value) {
-+        return ContentSettingValues.ALLOW != value;
+    public @Nullable Boolean considerException(SiteSettingsCategory category, @ContentSetting int value) {
+        return ContentSetting.ALLOW != value;
 +    }
 +}
 diff --git a/components/browser_ui/strings/bromite_content_settings/popups.grdp b/components/browser_ui/strings/bromite_content_settings/popups.grdp
 new file mode 100644
 --- /dev/null
 +++ b/components/browser_ui/strings/bromite_content_settings/popups.grdp
-@@ -0,0 +1,12 @@
+@@ -0,0 +1,18 @@
 +<?xml version="1.0" encoding="utf-8"?>
 +<grit-part>
+  <message name="IDS_WEBSITE_SETTINGS_CATEGORY_POPUP" desc="" formatter_data="android_java">
+    Block sites from showing pop-ups and redirects
+  </message>
+  <message name="IDS_WEBSITE_SETTINGS_CATEGORY_POPUP_DESCRIPTION" desc="" formatter_data="android_java">
+    When on, sites can use pop-ups and redirects. When off, sites can’t use pop-ups and redirects.
+  </message>
 +  <message name="IDS_WEBSITE_SETTINGS_CATEGORY_POPUP_BLOCK_ALL" desc="" formatter_data="android_java">
 +    Block all popups
 +  </message>
@@ -261,19 +280,24 @@ diff --git a/components/content_settings/core/browser/bromite_content_settings/p
 new file mode 100644
 --- /dev/null
 +++ b/components/content_settings/core/browser/bromite_content_settings/popups.inc
-@@ -0,0 +1,8 @@
+@@ -0,0 +1,13 @@
 +  content_settings::WebsiteSettingsRegistry::GetInstance()
 +    ->GetMutable(ContentSettingsType::POPUPS)
 +    ->set_show_into_info_page()
 +    .set_desktop_ui()
 +    .set_is_renderer_content_setting()
+    .set_title_ui(IDS_WEBSITE_SETTINGS_CATEGORY_POPUP)
+    .set_description_ui(IDS_WEBSITE_SETTINGS_CATEGORY_POPUP_DESCRIPTION)
 +    .set_allowed_ui(IDS_WEBSITE_SETTINGS_CATEGORY_POPUP_ALLOWED)
 +    .set_ask_ui(IDS_WEBSITE_SETTINGS_CATEGORY_POPUP_BLOCK_ALL)
-+    .set_blocked_ui(IDS_WEBSITE_SETTINGS_CATEGORY_POPUP_BLOCKED);
+    .set_blocked_ui(IDS_WEBSITE_SETTINGS_CATEGORY_POPUP_BLOCKED)
+    .set_allowed_exceptions_ui(IDS_WEBSITE_SETTINGS_CATEGORY_POPUP_ALLOWED)
+    .set_blocked_exceptions_ui(IDS_WEBSITE_SETTINGS_CATEGORY_POPUP_BLOCKED)
+    .set_mid_sentence_ui(IDS_WEBSITE_SETTINGS_CATEGORY_POPUP);
 diff --git a/components/content_settings/core/browser/content_settings_registry.cc b/components/content_settings/core/browser/content_settings_registry.cc
 --- a/components/content_settings/core/browser/content_settings_registry.cc
 +++ b/components/content_settings/core/browser/content_settings_registry.cc
-@@ -134,7 +134,7 @@ void ContentSettingsRegistry::Init() {
+@@ -140,7 +140,7 @@ void ContentSettingsRegistry::Init() {
            WebsiteSettingsInfo::SYNCABLE,
            /*allowlisted_primary_schemes=*/
            {kChromeUIScheme, kChromeDevToolsScheme, kExtensionScheme},
@@ -25,7 +25,7 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 .../extension_safety_check_utils.cc           |  3 +-
 .../browser/extensions/extension_service.cc   |  4 +-
 .../chrome_extension_downloader_factory.cc    |  1 -
- .../extensions/updater/extension_updater.cc   | 40 ++++++++-----
+ .../extensions/updater/extension_updater.cc   | 40 +++++++-----
 .../extensions/updater/extension_updater.h    |  4 ++
 .../extensions/webstore_install_helper.cc     |  2 +-
 .../browser/extensions/webstore_installer.cc  |  2 +-
@@ -34,22 +34,22 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 .../browser/resources/extensions/service.ts   |  5 ++
 .../browser/resources/extensions/toolbar.css  |  5 ++
 .../resources/extensions/toolbar.html.ts      |  7 +++
- .../browser/resources/extensions/toolbar.ts   | 17 ++++++
+ .../browser/resources/extensions/toolbar.ts   | 17 +++++
 .../resources/webstore_app/manifest.json      |  7 +--
 .../ui/webui/extensions/extensions_ui.cc      |  7 +++
 .../chrome_update_query_params_delegate.cc    | 13 ++--
 .../extensions/api/developer_private.idl      |  2 +
- .../update_client/update_query_params.cc      |  7 +--
+ .../update_client/update_query_params.cc      |  5 +-
 .../about_flags_cc/Webstore-protection.inc    | 19 ++++++
- .../browser/api/management/management_api.cc  | 60 ++++++++++++-------
- .../browser/updater/extension_downloader.cc   | 53 +++++++---------
+ .../browser/api/management/management_api.cc  | 62 +++++++++++++------
+ .../browser/updater/extension_downloader.cc   | 53 ++++++----------
 .../browser/updater/extension_downloader.h    |  1 -
 .../browser/updater/manifest_fetch_data.cc    |  8 +--
 .../browser/updater/safe_manifest_parser.cc   |  1 +
- extensions/common/extension_features.cc       | 14 +++++
- extensions/common/extension_features.h        |  2 +
+ extensions/common/extension_features.cc       |  7 +++
+ extensions/common/extension_features.h        | 10 +++
 .../definitions/developer_private.d.ts        |  2 +
- 36 files changed, 252 insertions(+), 108 deletions(-)
+ 36 files changed, 254 insertions(+), 107 deletions(-)
 create mode 100644 cromite_flags/chrome/browser/about_flags_cc/Webstore-protection.inc

 diff --git a/chrome/app/extensions_strings.grdp b/chrome/app/extensions_strings.grdp
@@ -71,9 +71,9 @@ diff --git a/chrome/app/extensions_strings.grdp b/chrome/app/extensions_strings.
 diff --git a/chrome/browser/extensions/api/developer_private/developer_private_api.cc b/chrome/browser/extensions/api/developer_private/developer_private_api.cc
 --- a/chrome/browser/extensions/api/developer_private/developer_private_api.cc
 +++ b/chrome/browser/extensions/api/developer_private/developer_private_api.cc
-@@ -24,6 +24,12 @@
- #include "extensions/browser/app_window/app_window_registry.h"
- #endif  // BUILDFLAG(ENABLE_EXTENSIONS)
+@@ -28,6 +28,12 @@
+ 
+ static_assert(BUILDFLAG(ENABLE_EXTENSIONS_CORE));
 
 +#include "chrome/browser/about_flags.h"
 +#include "chrome/browser/browser_process.h"
@@ -84,7 +84,7 @@ diff --git a/chrome/browser/extensions/api/developer_private/developer_private_a
 namespace extensions {
 
 namespace developer = api::developer_private;
-@@ -65,6 +71,28 @@ DeveloperPrivateAPI::GetFactoryInstance() {
+@@ -69,6 +75,28 @@ DeveloperPrivateAPI::GetFactoryInstance() {
   return g_developer_private_api_factory.Pointer();
 }
 
@@ -116,7 +116,7 @@ diff --git a/chrome/browser/extensions/api/developer_private/developer_private_a
 diff --git a/chrome/browser/extensions/api/developer_private/developer_private_api.h b/chrome/browser/extensions/api/developer_private/developer_private_api.h
 --- a/chrome/browser/extensions/api/developer_private/developer_private_api.h
 +++ b/chrome/browser/extensions/api/developer_private/developer_private_api.h
-@@ -33,6 +33,9 @@ class DeveloperPrivateAPI : public BrowserContextKeyedAPI,
+@@ -37,6 +37,9 @@ class DeveloperPrivateAPI : public BrowserContextKeyedAPI,
   static BrowserContextKeyedAPIFactory<DeveloperPrivateAPI>*
   GetFactoryInstance();
 
@@ -129,7 +129,7 @@ diff --git a/chrome/browser/extensions/api/developer_private/developer_private_a
 diff --git a/chrome/browser/extensions/api/developer_private/developer_private_functions_shared.cc b/chrome/browser/extensions/api/developer_private/developer_private_functions_shared.cc
 --- a/chrome/browser/extensions/api/developer_private/developer_private_functions_shared.cc
 +++ b/chrome/browser/extensions/api/developer_private/developer_private_functions_shared.cc
-@@ -301,6 +301,7 @@ ExtensionFunction::ResponseAction DeveloperPrivateAutoUpdateFunction::Run() {
+@@ -375,6 +375,7 @@ ExtensionFunction::ResponseAction DeveloperPrivateAutoUpdateFunction::Run() {
     ExtensionUpdater::CheckParams params;
     params.fetch_priority = DownloadFetchPriority::kForeground;
     params.install_immediately = true;
@@ -137,7 +137,7 @@ diff --git a/chrome/browser/extensions/api/developer_private/developer_private_f
     params.callback =
         base::BindOnce(&DeveloperPrivateAutoUpdateFunction::OnComplete, this);
     updater->CheckNow(std::move(params));
-@@ -439,7 +440,7 @@ DeveloperPrivateUpdateProfileConfigurationFunction::Run() {
+@@ -511,7 +512,7 @@ DeveloperPrivateUpdateProfileConfigurationFunction::Run() {
 
   const developer::ProfileConfigurationUpdate& update = params->update;
 
@@ -146,9 +146,9 @@ diff --git a/chrome/browser/extensions/api/developer_private/developer_private_f
     Profile* profile = Profile::FromBrowserContext(browser_context());
     CHECK(profile);
     if (supervised_user::AreExtensionsPermissionsEnabled(profile)) {
-@@ -456,6 +457,11 @@ DeveloperPrivateUpdateProfileConfigurationFunction::Run() {
+@@ -525,6 +526,11 @@ DeveloperPrivateUpdateProfileConfigurationFunction::Run() {
+         ->MarkNoticeAsAcknowledgedGlobally();
   }
- #endif  // !BUILDFLAG(IS_ANDROID)
 
 +  if (update.is_extension_autoupdate_enabled.has_value()) {
 +    DeveloperPrivateAPI::SetExtensionAutoupdateEnabled(
@@ -161,7 +161,7 @@ diff --git a/chrome/browser/extensions/api/developer_private/developer_private_f
 diff --git a/chrome/browser/extensions/api/developer_private/profile_info_generator.cc b/chrome/browser/extensions/api/developer_private/profile_info_generator.cc
 --- a/chrome/browser/extensions/api/developer_private/profile_info_generator.cc
 +++ b/chrome/browser/extensions/api/developer_private/profile_info_generator.cc
-@@ -9,6 +9,7 @@
+@@ -10,6 +10,7 @@
 #include "chrome/browser/prefs/incognito_mode_prefs.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/supervised_user/supervised_user_browser_utils.h"
@@ -169,9 +169,9 @@ diff --git a/chrome/browser/extensions/api/developer_private/profile_info_genera
 #include "chrome/common/pref_names.h"
 #include "components/policy/core/common/policy_pref_names.h"
 #include "components/prefs/pref_service.h"
-@@ -44,6 +45,8 @@ developer::ProfileInfo CreateProfileInfo(Profile* profile) {
+@@ -42,6 +43,8 @@ developer::ProfileInfo CreateProfileInfo(Profile* profile) {
+       ManifestV2ExperimentManager::Get(profile)
           ->DidUserAcknowledgeNoticeGlobally();
- #endif  // BUILDFLAG(ENABLE_EXTENSIONS)
 
 +  info.is_extension_autoupdate_enabled =
 +    DeveloperPrivateAPI::IsExtensionAutoupdateEnabled();
@@ -181,15 +181,15 @@ diff --git a/chrome/browser/extensions/api/developer_private/profile_info_genera
 diff --git a/chrome/browser/extensions/api/webstore_private/webstore_private_api.cc b/chrome/browser/extensions/api/webstore_private/webstore_private_api.cc
 --- a/chrome/browser/extensions/api/webstore_private/webstore_private_api.cc
 +++ b/chrome/browser/extensions/api/webstore_private/webstore_private_api.cc
-@@ -60,6 +60,7 @@
- #include "extensions/browser/extension_util.h"
- #include "extensions/browser/extensions_browser_client.h"
+@@ -68,6 +68,7 @@
+ #include "extensions/browser/scoped_active_install.h"
+ #include "extensions/buildflags/buildflags.h"
 #include "extensions/common/extension.h"
 +#include "extensions/common/extension_features.h"
 #include "extensions/common/manifest.h"
 #include "extensions/common/manifest_constants.h"
 #include "extensions/common/manifest_handlers/permissions_parser.h"
-@@ -223,6 +224,8 @@ WebstorePrivateApi::Delegate* test_delegate = nullptr;
+@@ -242,6 +243,8 @@ Profile* GetProfileInIncognito(Profile* profile) {
 // there was previously stored data, or an empty string otherwise. The Set will
 // overwrite any previous login.
 std::string GetWebstoreLogin(Profile* profile) {
@@ -198,7 +198,7 @@ diff --git a/chrome/browser/extensions/api/webstore_private/webstore_private_api
   if (profile->GetPrefs()->HasPrefPath(kWebstoreLogin)) {
     return profile->GetPrefs()->GetString(kWebstoreLogin);
   }
-@@ -230,11 +233,15 @@ std::string GetWebstoreLogin(Profile* profile) {
+@@ -249,11 +252,15 @@ std::string GetWebstoreLogin(Profile* profile) {
 }
 
 void SetWebstoreLogin(Profile* profile, const std::string& login) {
@@ -214,7 +214,7 @@ diff --git a/chrome/browser/extensions/api/webstore_private/webstore_private_api
   switch (status) {
     case kCanRequest:
       return api::webstore_private::ExtensionInstallStatus::kCanRequest;
-@@ -1157,7 +1164,8 @@ ExtensionFunction::ResponseAction
+@@ -1177,7 +1184,8 @@ ExtensionFunction::ResponseAction
 WebstorePrivateIsInIncognitoModeFunction::Run() {
   Profile* profile = Profile::FromBrowserContext(browser_context());
   return RespondNow(ArgumentList(IsInIncognitoMode::Results::Create(
@@ -224,7 +224,7 @@ diff --git a/chrome/browser/extensions/api/webstore_private/webstore_private_api
 }
 
 WebstorePrivateIsPendingCustodianApprovalFunction::
-@@ -1253,11 +1261,14 @@ WebstorePrivateGetReferrerChainFunction::Run() {
+@@ -1274,11 +1282,14 @@ WebstorePrivateGetReferrerChainFunction::Run() {
   request.mutable_referrer_chain_options()->set_recent_navigations_to_collect(
       recent_navigations_to_collect);
 
@@ -243,7 +243,7 @@ diff --git a/chrome/browser/extensions/api/webstore_private/webstore_private_api
 diff --git a/chrome/browser/extensions/chrome_extension_system.cc b/chrome/browser/extensions/chrome_extension_system.cc
 --- a/chrome/browser/extensions/chrome_extension_system.cc
 +++ b/chrome/browser/extensions/chrome_extension_system.cc
-@@ -92,6 +92,7 @@ UninstallPingSender::FilterResult ShouldSendUninstallPing(
+@@ -96,6 +96,7 @@ UninstallPingSender::FilterResult ShouldSendUninstallPing(
     Profile* profile,
     const Extension* extension,
     UninstallReason reason) {
@@ -254,7 +254,7 @@ diff --git a/chrome/browser/extensions/chrome_extension_system.cc b/chrome/brows
 diff --git a/chrome/browser/extensions/cws_info_service_factory.cc b/chrome/browser/extensions/cws_info_service_factory.cc
 --- a/chrome/browser/extensions/cws_info_service_factory.cc
 +++ b/chrome/browser/extensions/cws_info_service_factory.cc
-@@ -47,7 +47,8 @@ CWSInfoServiceFactory::CWSInfoServiceFactory()
+@@ -50,7 +50,8 @@ CWSInfoServiceFactory::CWSInfoServiceFactory()
 std::unique_ptr<KeyedService>
 CWSInfoServiceFactory::BuildServiceInstanceForBrowserContext(
     content::BrowserContext* context) const {
@@ -267,7 +267,7 @@ diff --git a/chrome/browser/extensions/cws_info_service_factory.cc b/chrome/brow
 diff --git a/chrome/browser/extensions/extension_management.cc b/chrome/browser/extensions/extension_management.cc
 --- a/chrome/browser/extensions/extension_management.cc
 +++ b/chrome/browser/extensions/extension_management.cc
-@@ -391,6 +391,7 @@ bool ExtensionManagement::IsExemptFromMV2DeprecationByPolicy(
+@@ -436,6 +436,7 @@ bool ExtensionManagement::IsExemptFromMV2DeprecationByPolicy(
 
 bool ExtensionManagement::IsAllowedByUnpublishedAvailabilityPolicy(
     const Extension* extension) {
@@ -278,7 +278,7 @@ diff --git a/chrome/browser/extensions/extension_management.cc b/chrome/browser/
 diff --git a/chrome/browser/extensions/extension_safety_check_utils.cc b/chrome/browser/extensions/extension_safety_check_utils.cc
 --- a/chrome/browser/extensions/extension_safety_check_utils.cc
 +++ b/chrome/browser/extensions/extension_safety_check_utils.cc
-@@ -240,8 +240,7 @@ developer::SafetyCheckWarningReason GetSafetyCheckWarningReasonHelper(
+@@ -243,8 +243,7 @@ developer::SafetyCheckWarningReason GetSafetyCheckWarningReasonHelper(
   developer::SafetyCheckWarningReason acknowledged_reason =
       GetPrefAcknowledgeSafetyCheckWarningReason(extension,
                                                  ExtensionPrefs::Get(profile));
@@ -291,7 +291,7 @@ diff --git a/chrome/browser/extensions/extension_safety_check_utils.cc b/chrome/
 diff --git a/chrome/browser/extensions/extension_service.cc b/chrome/browser/extensions/extension_service.cc
 --- a/chrome/browser/extensions/extension_service.cc
 +++ b/chrome/browser/extensions/extension_service.cc
-@@ -244,8 +244,6 @@ ExtensionService::ExtensionService(
+@@ -247,8 +247,6 @@ ExtensionService::ExtensionService(
   UpgradeDetector::GetInstance()->AddObserver(this);
 #endif
 
@@ -300,7 +300,7 @@ diff --git a/chrome/browser/extensions/extension_service.cc b/chrome/browser/ext
   ExtensionManagementFactory::GetForBrowserContext(profile_)->AddObserver(this);
 
   if (autoupdate_enabled) {
-@@ -756,7 +754,7 @@ void ExtensionService::OnExtensionManagementSettingsChanged() {
+@@ -763,7 +761,7 @@ void ExtensionService::OnExtensionManagementSettingsChanged() {
   // unpublished extensions should not be enabled. This update allows
   // unpublished extensions to be disabled sooner rather than waiting till the
   // next regularly scheduled fetch.
@@ -312,7 +312,7 @@ diff --git a/chrome/browser/extensions/extension_service.cc b/chrome/browser/ext
 diff --git a/chrome/browser/extensions/updater/chrome_extension_downloader_factory.cc b/chrome/browser/extensions/updater/chrome_extension_downloader_factory.cc
 --- a/chrome/browser/extensions/updater/chrome_extension_downloader_factory.cc
 +++ b/chrome/browser/extensions/updater/chrome_extension_downloader_factory.cc
-@@ -50,7 +50,6 @@ ChromeExtensionDownloaderFactory::CreateForURLLoaderFactory(
+@@ -53,7 +53,6 @@ ChromeExtensionDownloaderFactory::CreateForURLLoaderFactory(
     manifest_query_params += "&testrequest=1";
   }
   downloader->set_manifest_query_params(manifest_query_params);
@@ -323,7 +323,7 @@ diff --git a/chrome/browser/extensions/updater/chrome_extension_downloader_facto
 diff --git a/chrome/browser/extensions/updater/extension_updater.cc b/chrome/browser/extensions/updater/extension_updater.cc
 --- a/chrome/browser/extensions/updater/extension_updater.cc
 +++ b/chrome/browser/extensions/updater/extension_updater.cc
-@@ -55,6 +55,7 @@
+@@ -56,6 +56,7 @@
 #include "extensions/common/constants.h"
 #include "extensions/common/extension.h"
 #include "extensions/common/extension_id.h"
@@ -331,7 +331,7 @@ diff --git a/chrome/browser/extensions/updater/extension_updater.cc b/chrome/bro
 #include "extensions/common/extension_set.h"
 #include "extensions/common/extension_updater_uma.h"
 #include "extensions/common/extension_urls.h"
-@@ -228,6 +229,10 @@ void ExtensionUpdater::Start() {
+@@ -229,6 +230,10 @@ void ExtensionUpdater::Start() {
   DCHECK(!weak_ptr_factory_.HasWeakPtrs());
   DCHECK(registry_);
   alive_ = true;
@@ -341,8 +341,8 @@ diff --git a/chrome/browser/extensions/updater/extension_updater.cc b/chrome/bro
 +  }
   // Check soon, and set up the first delayed check.
   if (!g_skip_scheduled_checks_for_tests) {
-     if (g_should_immediately_update)
-@@ -385,7 +390,8 @@ void ExtensionUpdater::AddToDownloader(
+     CheckSoon();
+@@ -380,7 +385,8 @@ void ExtensionUpdater::AddToDownloader(
     const Extension& extension = **extension_iter;
     const ExtensionId& extension_id = extension.id();
     if (!Manifest::IsAutoUpdateableLocation(extension.location())) {
@@ -352,7 +352,7 @@ diff --git a/chrome/browser/extensions/updater/extension_updater.cc b/chrome/bro
       continue;
     }
     // An extension might be overwritten by policy, and have its update url
-@@ -399,7 +405,7 @@ void ExtensionUpdater::AddToDownloader(
+@@ -395,7 +401,7 @@ void ExtensionUpdater::AddToDownloader(
       continue;
     }
 
@@ -361,7 +361,7 @@ diff --git a/chrome/browser/extensions/updater/extension_updater.cc b/chrome/bro
       update_check_params->update_info[extension_id] =
           GetExtensionUpdateData(extension_id);
     } else if (AddExtensionToDownloader(extension, request_id,
-@@ -436,6 +442,12 @@ bool ExtensionUpdater::AddExtensionToDownloader(
+@@ -433,6 +439,12 @@ bool ExtensionUpdater::AddExtensionToDownloader(
 }
 
 void ExtensionUpdater::CheckNow(CheckParams params) {
@@ -374,16 +374,16 @@ diff --git a/chrome/browser/extensions/updater/extension_updater.cc b/chrome/bro
   CHECK(enabled_);
   if (params.ids.empty()) {
     // Checking all extensions. Cancel pending DoCheckSoon() call if there's
-@@ -445,7 +457,7 @@ void ExtensionUpdater::CheckNow(CheckParams params) {
+@@ -450,7 +462,7 @@ void ExtensionUpdater::CheckNow(CheckParams params) {
 
   int request_id = next_request_id_++;
 
 -  VLOG(2) << "Starting update check " << request_id;
 +  LOG(INFO) << "Starting extensions update check id: " << request_id;
-   if (params.ids.empty())
+   if (params.ids.empty()) {
     NotifyStarted();
- 
-@@ -513,7 +525,7 @@ void ExtensionUpdater::CheckNow(CheckParams params) {
+   }
+@@ -519,7 +531,7 @@ void ExtensionUpdater::CheckNow(CheckParams params) {
         update_check_params.update_info[pending_id] =
             GetExtensionUpdateData(pending_id);
       } else if (!Manifest::IsAutoUpdateableLocation(info->install_source())) {
@@ -392,7 +392,7 @@ diff --git a/chrome/browser/extensions/updater/extension_updater.cc b/chrome/bro
         continue;
       }
       // We have to mark high-priority extensions (such as policy-forced
-@@ -523,7 +535,7 @@ void ExtensionUpdater::CheckNow(CheckParams params) {
+@@ -529,7 +541,7 @@ void ExtensionUpdater::CheckNow(CheckParams params) {
       // See https://crbug.com/904600 and https://crbug.com/965686.
       const bool is_high_priority_extension_pending =
           pending_extension_manager->HasHighPriorityPendingExtension();
@@ -401,7 +401,7 @@ diff --git a/chrome/browser/extensions/updater/extension_updater.cc b/chrome/bro
         update_check_params.update_info[pending_id] =
             GetExtensionUpdateData(pending_id);
         update_check_params.update_info[pending_id].is_corrupt_reinstall =
-@@ -546,6 +558,8 @@ void ExtensionUpdater::CheckNow(CheckParams params) {
+@@ -552,6 +564,8 @@ void ExtensionUpdater::CheckNow(CheckParams params) {
           LOG(WARNING) << "Corrupt extension with id " << pending_id
                        << " will be reinstalled with ExtensionDownloader.";
         }
@@ -410,7 +410,7 @@ diff --git a/chrome/browser/extensions/updater/extension_updater.cc b/chrome/bro
       } else {
         InstallStageTracker::Get(profile_)->ReportFailure(
             pending_id,
-@@ -558,13 +572,6 @@ void ExtensionUpdater::CheckNow(CheckParams params) {
+@@ -564,13 +578,6 @@ void ExtensionUpdater::CheckNow(CheckParams params) {
     AddToDownloader(&registry_->disabled_extensions(), pending_ids, request_id,
                     params.fetch_priority, &update_check_params);
     ExtensionSet remotely_disabled_extensions;
@@ -424,7 +424,7 @@ diff --git a/chrome/browser/extensions/updater/extension_updater.cc b/chrome/bro
     AddToDownloader(&remotely_disabled_extensions, pending_ids, request_id,
                     params.fetch_priority, &update_check_params);
   } else {
-@@ -572,7 +579,7 @@ void ExtensionUpdater::CheckNow(CheckParams params) {
+@@ -578,7 +585,7 @@ void ExtensionUpdater::CheckNow(CheckParams params) {
       const Extension* extension =
           registry_->GetExtensionById(id, ExtensionRegistry::EVERYTHING);
       if (extension) {
@@ -433,7 +433,7 @@ diff --git a/chrome/browser/extensions/updater/extension_updater.cc b/chrome/bro
           update_check_params.update_info[id] = GetExtensionUpdateData(id);
         } else if (AddExtensionToDownloader(*extension, request_id,
                                             params.fetch_priority)) {
-@@ -716,7 +723,7 @@ void ExtensionUpdater::OnExtensionDownloadFinished(
+@@ -722,7 +729,7 @@ void ExtensionUpdater::OnExtensionDownloadFinished(
       file.extension_id, InstallStageTracker::Stage::INSTALLING);
   UpdatePingData(file.extension_id, ping);
 
@@ -442,7 +442,7 @@ diff --git a/chrome/browser/extensions/updater/extension_updater.cc b/chrome/bro
 
   FetchedCRXFile fetched(file, file_ownership_passed, request_ids,
                          std::move(callback));
-@@ -727,6 +734,7 @@ void ExtensionUpdater::OnExtensionDownloadFinished(
+@@ -733,6 +740,7 @@ void ExtensionUpdater::OnExtensionDownloadFinished(
 
 bool ExtensionUpdater::GetPingDataForExtension(const ExtensionId& id,
                                                DownloadPingData* ping_data) {
@@ -450,7 +450,7 @@ diff --git a/chrome/browser/extensions/updater/extension_updater.cc b/chrome/bro
   DCHECK(alive_);
   ping_data->rollcall_days =
       CalculatePingDaysForExtension(extension_prefs_->LastPingDay(id));
-@@ -839,7 +847,7 @@ bool ExtensionUpdater::CanUseUpdateService(
+@@ -852,7 +860,7 @@ bool ExtensionUpdater::CanUseUpdateService(
 void ExtensionUpdater::InstallCRXFile(FetchedCRXFile crx_file) {
   std::set<int> request_ids;
 
@@ -459,15 +459,15 @@ diff --git a/chrome/browser/extensions/updater/extension_updater.cc b/chrome/bro
           << crx_file.info.path.value();
 
   // The delegate is now responsible for cleaning up the temp file at
-@@ -1046,7 +1054,7 @@ void ExtensionUpdater::NotifyIfFinished(int request_id) {
-   InProgressCheck& request = requests_in_progress_[request_id];
-   if (!request.in_progress_ids.empty() || request.awaiting_update_service)
+@@ -1061,7 +1069,7 @@ void ExtensionUpdater::NotifyIfFinished(int request_id) {
+   if (!request.in_progress_ids.empty() || request.awaiting_update_service) {
     return;  // This request is not done yet.
+   }
 -  VLOG(2) << "Finished update check " << request_id;
 +  LOG(INFO) << "Finished update check id: " << request_id;
-   if (!request.callback.is_null())
+   if (!request.callback.is_null()) {
     std::move(request.callback).Run();
-   requests_in_progress_.erase(request_id);
+   }
 diff --git a/chrome/browser/extensions/updater/extension_updater.h b/chrome/browser/extensions/updater/extension_updater.h
 --- a/chrome/browser/extensions/updater/extension_updater.h
 +++ b/chrome/browser/extensions/updater/extension_updater.h
@@ -480,7 +480,7 @@ diff --git a/chrome/browser/extensions/updater/extension_updater.h b/chrome/brow
     // An extension update check can be originated by a user or by a scheduled
     // task. When the value of |fetch_priority| is FOREGROUND, the update
     // request was initiated by a user.
-@@ -401,6 +403,8 @@ class ExtensionUpdater : public KeyedService,
+@@ -397,6 +399,8 @@ class ExtensionUpdater : public KeyedService,
   base::TimeDelta frequency_;
   bool will_check_soon_ = false;
 
@@ -492,7 +492,7 @@ diff --git a/chrome/browser/extensions/updater/extension_updater.h b/chrome/brow
 diff --git a/chrome/browser/extensions/webstore_install_helper.cc b/chrome/browser/extensions/webstore_install_helper.cc
 --- a/chrome/browser/extensions/webstore_install_helper.cc
 +++ b/chrome/browser/extensions/webstore_install_helper.cc
-@@ -46,7 +46,7 @@ void WebstoreInstallHelper::Start(
+@@ -49,7 +49,7 @@ void WebstoreInstallHelper::Start(
   data_decoder::DataDecoder::ParseJsonIsolated(
       manifest_, base::BindOnce(&WebstoreInstallHelper::OnJSONParsed, this));
 
@@ -504,7 +504,7 @@ diff --git a/chrome/browser/extensions/webstore_install_helper.cc b/chrome/brows
 diff --git a/chrome/browser/extensions/webstore_installer.cc b/chrome/browser/extensions/webstore_installer.cc
 --- a/chrome/browser/extensions/webstore_installer.cc
 +++ b/chrome/browser/extensions/webstore_installer.cc
-@@ -591,7 +591,7 @@ void WebstoreInstaller::StartDownload(
+@@ -595,7 +595,7 @@ void WebstoreInstaller::StartDownload(
       traffic_annotation));
   params->set_file_path(file);
   params->set_initiator(render_frame_host->GetLastCommittedOrigin());
@@ -556,7 +556,7 @@ diff --git a/chrome/browser/resources/extensions/manager.ts b/chrome/browser/res
 diff --git a/chrome/browser/resources/extensions/service.ts b/chrome/browser/resources/extensions/service.ts
 --- a/chrome/browser/resources/extensions/service.ts
 +++ b/chrome/browser/resources/extensions/service.ts
-@@ -311,6 +311,11 @@ export class Service implements ServiceInterface {
+@@ -356,6 +356,11 @@ export class Service implements ServiceInterface {
         {inDeveloperMode: inDevMode});
   }
 
@@ -689,7 +689,7 @@ diff --git a/chrome/browser/ui/webui/extensions/extensions_ui.cc b/chrome/browse
 #include "chrome/browser/extensions/manifest_v2_experiment_manager.h"
 #include "chrome/browser/extensions/mv2_experiment_stage.h"
 #include "chrome/browser/extensions/permissions_url_constants.h"
-@@ -380,6 +381,8 @@ content::WebUIDataSource* CreateAndAddExtensionsSource(Profile* profile,
+@@ -381,6 +382,8 @@ content::WebUIDataSource* CreateAndAddExtensionsSource(Profile* profile,
       {"itemSuspiciousInstallLearnMore",
        IDS_EXTENSIONS_ADDED_WITHOUT_KNOWLEDGE_LEARN_MORE},
       {"toolbarDevMode", IDS_EXTENSIONS_DEVELOPER_MODE},
@@ -698,7 +698,7 @@ diff --git a/chrome/browser/ui/webui/extensions/extensions_ui.cc b/chrome/browse
       {"toolbarLoadUnpacked", IDS_EXTENSIONS_TOOLBAR_LOAD_UNPACKED},
       {"toolbarLoadUnpackedDone", IDS_EXTENSIONS_TOOLBAR_LOAD_UNPACKED_DONE},
       {"toolbarPack", IDS_EXTENSIONS_TOOLBAR_PACK},
-@@ -472,6 +475,10 @@ content::WebUIDataSource* CreateAndAddExtensionsSource(Profile* profile,
+@@ -466,6 +469,10 @@ content::WebUIDataSource* CreateAndAddExtensionsSource(Profile* profile,
       "hostPermissionsLearnMoreLink",
       extension_permissions_constants::kRuntimeHostPermissionsHelpURL);
   source->AddBoolean(kInDevModeKey, in_dev_mode);
@@ -735,7 +735,7 @@ diff --git a/chrome/browser/update_client/chrome_update_query_params_delegate.cc
 diff --git a/chrome/common/extensions/api/developer_private.idl b/chrome/common/extensions/api/developer_private.idl
 --- a/chrome/common/extensions/api/developer_private.idl
 +++ b/chrome/common/extensions/api/developer_private.idl
-@@ -272,6 +272,7 @@ namespace developerPrivate {
+@@ -273,6 +273,7 @@ namespace developerPrivate {
     boolean isIncognitoAvailable;
     boolean isChildAccount;
     boolean isMv2DeprecationNoticeDismissed;
@@ -743,7 +743,7 @@ diff --git a/chrome/common/extensions/api/developer_private.idl b/chrome/common/
   };
 
   dictionary GetExtensionsInfoOptions {
-@@ -295,6 +296,7 @@ namespace developerPrivate {
+@@ -296,6 +297,7 @@ namespace developerPrivate {
   dictionary ProfileConfigurationUpdate {
     boolean? inDeveloperMode;
     boolean? isMv2DeprecationNoticeDismissed;
@@ -754,19 +754,17 @@ diff --git a/chrome/common/extensions/api/developer_private.idl b/chrome/common/
 diff --git a/components/update_client/update_query_params.cc b/components/update_client/update_query_params.cc
 --- a/components/update_client/update_query_params.cc
 +++ b/components/update_client/update_query_params.cc
-@@ -85,9 +85,8 @@ UpdateQueryParamsDelegate* g_delegate = nullptr;
+@@ -87,8 +87,7 @@ UpdateQueryParamsDelegate* g_delegate = nullptr;
 // static
 std::string UpdateQueryParams::Get(ProdId prod) {
   return base::StringPrintf(
-      "os=%s&arch=%s&os_arch=%s&nacl_arch=%s&prod=%s%s&acceptformat=crx3,puff",
-      kOs, kArch, base::SysInfo().OperatingSystemArchitecture().c_str(),
-      GetNaclArch(), GetProdIdString(prod),
+-      "os=%s&arch=%s&os_arch=%s&prod=%s%s&acceptformat=crx3,puff", kOs, kArch,
+-      base::SysInfo().OperatingSystemArchitecture().c_str(),
 +      "prod=%s%s&acceptformat=crx3",
-+      GetProdIdString(prod),
+       GetProdIdString(prod),
       g_delegate ? g_delegate->GetExtraParams().c_str() : "");
 }
- 
-@@ -148,7 +147,7 @@ const char* UpdateQueryParams::GetNaclArch() {
+@@ -120,7 +119,7 @@ std::string_view UpdateQueryParams::GetArch() {
 
 // static
 std::string UpdateQueryParams::GetProdVersion() {
@@ -812,7 +810,7 @@ diff --git a/extensions/browser/api/management/management_api.cc b/extensions/br
 #include "extensions/browser/api/extensions_api_client.h"
 #include "extensions/browser/api/management/management_api_constants.h"
 #include "extensions/browser/disable_reason.h"
-@@ -41,6 +44,7 @@
+@@ -42,6 +45,7 @@
 #include "extensions/common/api/management.h"
 #include "extensions/common/error_utils.h"
 #include "extensions/common/extension.h"
@@ -820,7 +818,7 @@ diff --git a/extensions/browser/api/management/management_api.cc b/extensions/br
 #include "extensions/common/extension_id.h"
 #include "extensions/common/extension_urls.h"
 #include "extensions/common/icons/extension_icon_set.h"
-@@ -92,6 +96,27 @@ std::vector<std::string> CreateWarningsList(const Extension* extension) {
+@@ -104,6 +108,29 @@ std::vector<std::string> CreateWarningsList(const Extension* extension) {
   return warnings_list;
 }
 
@@ -829,11 +827,13 @@ diff --git a/extensions/browser/api/management/management_api.cc b/extensions/br
 +                                  const std::string& id,
 +                                  int include_mask) {
 +  bool enabled = base::FeatureList::IsEnabled(extensions_features::kEnableExtensionManagementToChromeStore);
-+  if (content::RenderFrameHost* rfh = web_contents->GetPrimaryMainFrame()) {
-+    url::Origin top_frame_origin = rfh->GetMainFrame()->GetLastCommittedOrigin();
-+    std::string scheme = top_frame_origin.scheme();
-+    if (scheme == content::kChromeUIScheme) {
-+      enabled = true;
+  if (web_contents) {
+    if (content::RenderFrameHost* rfh = web_contents->GetPrimaryMainFrame()) {
+      url::Origin top_frame_origin = rfh->GetMainFrame()->GetLastCommittedOrigin();
+      std::string scheme = top_frame_origin.scheme();
+      if (scheme == content::kChromeUIScheme) {
+        enabled = true;
+      }
 +    }
 +  }
 +  if (!enabled)
@@ -848,7 +848,7 @@ diff --git a/extensions/browser/api/management/management_api.cc b/extensions/br
 std::vector<management::LaunchType> GetAvailableLaunchTypes(
     const Extension& extension) {
   std::vector<management::LaunchType> launch_type_list;
-@@ -269,6 +294,8 @@ void AddExtensionInfo(const Extension* source_extension,
+@@ -281,6 +308,8 @@ void AddExtensionInfo(const Extension* source_extension,
                       const ExtensionSet& extensions,
                       ExtensionInfoList* extension_list,
                       content::BrowserContext* context) {
@@ -857,7 +857,7 @@ diff --git a/extensions/browser/api/management/management_api.cc b/extensions/br
   for (ExtensionSet::const_iterator iter = extensions.begin();
        iter != extensions.end(); ++iter) {
     const Extension& extension = **iter;
-@@ -311,10 +338,9 @@ ExtensionFunction::ResponseAction ManagementGetFunction::Run() {
+@@ -323,10 +352,9 @@ ExtensionFunction::ResponseAction ManagementGetFunction::Run() {
   std::optional<management::Get::Params> params =
       management::Get::Params::Create(args());
   EXTENSION_FUNCTION_VALIDATE(params);
@@ -869,7 +869,7 @@ diff --git a/extensions/browser/api/management/management_api.cc b/extensions/br
   if (!target_extension) {
     return RespondNow(Error(keys::kNoExtensionError, params->id));
   }
-@@ -335,8 +361,7 @@ ManagementGetPermissionWarningsByIdFunction::Run() {
+@@ -347,8 +375,7 @@ ManagementGetPermissionWarningsByIdFunction::Run() {
   EXTENSION_FUNCTION_VALIDATE(params);
 
   const Extension* extension =
@@ -879,7 +879,7 @@ diff --git a/extensions/browser/api/management/management_api.cc b/extensions/br
   if (!extension) {
     return RespondNow(Error(keys::kNoExtensionError, params->id));
   }
-@@ -404,8 +429,7 @@ ExtensionFunction::ResponseAction ManagementLaunchAppFunction::Run() {
+@@ -419,8 +446,7 @@ ExtensionFunction::ResponseAction ManagementLaunchAppFunction::Run() {
   }
 
   const Extension* extension =
@@ -889,7 +889,7 @@ diff --git a/extensions/browser/api/management/management_api.cc b/extensions/br
   if (!extension) {
     return RespondNow(Error(keys::kNoExtensionError, params->id));
   }
-@@ -547,8 +571,8 @@ void ManagementSetEnabledFunction::CheckPermissionsIncrease() {
+@@ -562,8 +588,8 @@ void ManagementSetEnabledFunction::CheckPermissionsIncrease() {
   // Extension could have been uninstalled externally while previous check was
   // happening.
   const Extension* extension =
@@ -900,7 +900,7 @@ diff --git a/extensions/browser/api/management/management_api.cc b/extensions/br
   if (!extension) {
     FinishEnable(Error(keys::kNoExtensionError));
     return;
-@@ -591,8 +615,8 @@ void ManagementSetEnabledFunction::CheckManifestV2Deprecation() {
+@@ -606,8 +632,8 @@ void ManagementSetEnabledFunction::CheckManifestV2Deprecation() {
   // Extension can be uninstalled externally while the previous check was
   // happening async.
   const Extension* extension =
@@ -911,7 +911,7 @@ diff --git a/extensions/browser/api/management/management_api.cc b/extensions/br
   if (!extension) {
     FinishEnable(Error(keys::kNoExtensionError));
     return;
-@@ -736,8 +760,8 @@ void ManagementSetEnabledFunction::OnSupervisedExtensionApprovalDone(
+@@ -751,8 +777,8 @@ void ManagementSetEnabledFunction::OnSupervisedExtensionApprovalDone(
 }
 
 const Extension* ManagementSetEnabledFunction::GetExtension() {
@@ -922,7 +922,7 @@ diff --git a/extensions/browser/api/management/management_api.cc b/extensions/br
 }
 
 ManagementUninstallFunctionBase::ManagementUninstallFunctionBase() = default;
-@@ -762,8 +786,7 @@ ExtensionFunction::ResponseAction ManagementUninstallFunctionBase::Uninstall(
+@@ -777,8 +803,7 @@ ExtensionFunction::ResponseAction ManagementUninstallFunctionBase::Uninstall(
                                               ->GetDelegate();
   target_extension_id_ = target_extension_id;
   const Extension* target_extension =
@@ -932,7 +932,7 @@ diff --git a/extensions/browser/api/management/management_api.cc b/extensions/br
                              ExtensionRegistry::EVERYTHING);
   if (!target_extension || !ShouldExposeViaManagementAPI(*target_extension)) {
     return RespondNow(Error(keys::kNoExtensionError, target_extension_id_));
-@@ -828,8 +851,7 @@ void ManagementUninstallFunctionBase::UninstallExtension() {
+@@ -843,8 +868,7 @@ void ManagementUninstallFunctionBase::UninstallExtension() {
   // The extension can be uninstalled in another window while the UI was
   // showing. Do nothing in that case.
   const Extension* target_extension =
@@ -942,7 +942,7 @@ diff --git a/extensions/browser/api/management/management_api.cc b/extensions/br
                              ExtensionRegistry::EVERYTHING);
   std::string error;
   bool success = false;
-@@ -909,8 +931,7 @@ ExtensionFunction::ResponseAction ManagementCreateAppShortcutFunction::Run() {
+@@ -928,8 +952,7 @@ ExtensionFunction::ResponseAction ManagementCreateAppShortcutFunction::Run() {
       management::CreateAppShortcut::Params::Create(args());
   EXTENSION_FUNCTION_VALIDATE(params);
   const Extension* extension =
@@ -952,7 +952,7 @@ diff --git a/extensions/browser/api/management/management_api.cc b/extensions/br
   if (!extension) {
     return RespondNow(Error(
         ErrorUtils::FormatErrorMessage(keys::kNoExtensionError, params->id)));
-@@ -964,8 +985,7 @@ ExtensionFunction::ResponseAction ManagementSetLaunchTypeFunction::Run() {
+@@ -983,8 +1006,7 @@ ExtensionFunction::ResponseAction ManagementSetLaunchTypeFunction::Run() {
       management::SetLaunchType::Params::Create(args());
   EXTENSION_FUNCTION_VALIDATE(params);
   const Extension* extension =
@@ -965,7 +965,7 @@ diff --git a/extensions/browser/api/management/management_api.cc b/extensions/br
 diff --git a/extensions/browser/updater/extension_downloader.cc b/extensions/browser/updater/extension_downloader.cc
 --- a/extensions/browser/updater/extension_downloader.cc
 +++ b/extensions/browser/updater/extension_downloader.cc
-@@ -494,8 +494,8 @@ void ExtensionDownloader::CreateManifestLoader() {
+@@ -485,8 +485,8 @@ void ExtensionDownloader::CreateManifestLoader() {
   std::vector<std::string_view> id_vector(extension_ids.begin(),
                                           extension_ids.end());
   std::string id_list = base::JoinString(id_vector, ",");
@@ -976,7 +976,7 @@ diff --git a/extensions/browser/updater/extension_downloader.cc b/extensions/bro
           << (active_request->foreground_check()
                   ? kUpdateInteractivityForeground
                   : kUpdateInteractivityBackground);
-@@ -520,7 +520,7 @@ void ExtensionDownloader::CreateManifestLoader() {
+@@ -511,7 +511,7 @@ void ExtensionDownloader::CreateManifestLoader() {
           destination: WEBSITE
         }
         policy {
@@ -985,7 +985,7 @@ diff --git a/extensions/browser/updater/extension_downloader.cc b/extensions/bro
           cookies_store: "user"
           setting:
             "This feature cannot be disabled. It is only enabled when the user "
-@@ -537,6 +537,7 @@ void ExtensionDownloader::CreateManifestLoader() {
+@@ -528,6 +528,7 @@ void ExtensionDownloader::CreateManifestLoader() {
   auto resource_request = std::make_unique<network::ResourceRequest>();
   resource_request->url = active_request->full_url(),
   resource_request->load_flags = net::LOAD_DISABLE_CACHE;
@@ -993,7 +993,7 @@ diff --git a/extensions/browser/updater/extension_downloader.cc b/extensions/bro
 
   if (active_request->fetch_priority() == DownloadFetchPriority::kForeground) {
     resource_request->priority = net::MEDIUM;
-@@ -545,10 +546,6 @@ void ExtensionDownloader::CreateManifestLoader() {
+@@ -536,10 +537,6 @@ void ExtensionDownloader::CreateManifestLoader() {
   // Send traffic-management headers to the webstore, and omit credentials.
   // https://bugs.chromium.org/p/chromium/issues/detail?id=647516
   if (extension_urls::IsWebstoreUpdateUrl(active_request->full_url())) {
@@ -1004,7 +1004,7 @@ diff --git a/extensions/browser/updater/extension_downloader.cc b/extensions/bro
     resource_request->headers.SetHeader(kUpdateAppIdHeader, id_list);
     resource_request->headers.SetHeader(
         kUpdateUpdaterHeader,
-@@ -833,20 +830,6 @@ void ExtensionDownloader::HandleManifestResults(
+@@ -824,20 +821,6 @@ void ExtensionDownloader::HandleManifestResults(
         update.second->info);
   }
 
@@ -1025,7 +1025,7 @@ diff --git a/extensions/browser/updater/extension_downloader.cc b/extensions/bro
   ExtensionIdSet extension_ids_with_errors;
   for (const auto& failure : failures)
     extension_ids_with_errors.insert(failure.first.id);
-@@ -868,7 +851,7 @@ ExtensionDownloader::GetUpdateAvailability(
+@@ -859,7 +842,7 @@ ExtensionDownloader::GetUpdateAvailability(
     // extensions that have already existed in the system.
     if (!delegate_->GetExtensionExistingVersion(extension_id,
                                                 &extension_version)) {
@@ -1034,7 +1034,7 @@ diff --git a/extensions/browser/updater/extension_downloader.cc b/extensions/bro
       return UpdateAvailability::kBadUpdateSpecification;
     }
     VLOG(2) << extension_id << " is at '" << extension_version << "'";
-@@ -879,11 +862,11 @@ ExtensionDownloader::GetUpdateAvailability(
+@@ -870,11 +853,11 @@ ExtensionDownloader::GetUpdateAvailability(
     const std::string& update_version_str = update->version;
     if (VLOG_IS_ON(2)) {
       if (update_version_str.empty())
@@ -1048,7 +1048,7 @@ diff --git a/extensions/browser/updater/extension_downloader.cc b/extensions/bro
                 << " latest version is '" << update_version_str << "'";
     }
 
-@@ -893,21 +876,21 @@ ExtensionDownloader::GetUpdateAvailability(
+@@ -884,21 +867,21 @@ ExtensionDownloader::GetUpdateAvailability(
       // we don't want it.
       if (update_version_str.empty()) {
         // If update manifest doesn't have version number => no update.
@@ -1073,7 +1073,7 @@ diff --git a/extensions/browser/updater/extension_downloader.cc b/extensions/bro
                 << update_version_str << "'";
         bool can_rollback =
             update_version.CompareTo(existing_version) < 0 &&
-@@ -934,7 +917,9 @@ ExtensionDownloader::GetUpdateAvailability(
+@@ -925,7 +908,9 @@ ExtensionDownloader::GetUpdateAvailability(
     }
 
     // Stop checking as soon as an update for |extension_id| is found.
@@ -1084,7 +1084,7 @@ diff --git a/extensions/browser/updater/extension_downloader.cc b/extensions/bro
     *update_result_out = const_cast<UpdateManifestResult*>(update);
     return UpdateAvailability::kAvailable;
   }
-@@ -1179,7 +1164,7 @@ void ExtensionDownloader::CreateExtensionLoader() {
+@@ -1170,7 +1155,7 @@ void ExtensionDownloader::CreateExtensionLoader() {
   int load_flags = net::LOAD_DISABLE_CACHE;
   bool is_secure = fetch->url.SchemeIsCryptographic();
   extension_loader_resource_request_->load_flags = load_flags;
@@ -1093,7 +1093,7 @@ diff --git a/extensions/browser/updater/extension_downloader.cc b/extensions/bro
     extension_loader_resource_request_->credentials_mode =
         network::mojom::CredentialsMode::kOmit;
   } else {
-@@ -1187,7 +1172,7 @@ void ExtensionDownloader::CreateExtensionLoader() {
+@@ -1178,7 +1163,7 @@ void ExtensionDownloader::CreateExtensionLoader() {
         net::SiteForCookies::FromUrl(fetch->url);
   }
 
@@ -1102,7 +1102,7 @@ diff --git a/extensions/browser/updater/extension_downloader.cc b/extensions/bro
       is_secure) {
     if (access_token_.empty()) {
       // We should try OAuth2, but we have no token cached. This
-@@ -1212,7 +1197,7 @@ void ExtensionDownloader::CreateExtensionLoader() {
+@@ -1201,7 +1186,7 @@ void ExtensionDownloader::CreateExtensionLoader() {
         base::StringPrintf("Bearer %s", access_token_.c_str()));
   }
 
@@ -1111,7 +1111,7 @@ diff --git a/extensions/browser/updater/extension_downloader.cc b/extensions/bro
 
   StartExtensionLoader();
 }
-@@ -1234,7 +1219,7 @@ void ExtensionDownloader::StartExtensionLoader() {
+@@ -1223,7 +1208,7 @@ void ExtensionDownloader::StartExtensionLoader() {
           destination: WEBSITE
         }
         policy {
@@ -1120,7 +1120,7 @@ diff --git a/extensions/browser/updater/extension_downloader.cc b/extensions/bro
           cookies_store: "user"
           setting:
             "This feature cannot be disabled. It is only enabled when the user "
-@@ -1305,6 +1290,7 @@ void ExtensionDownloader::OnExtensionLoadComplete(base::FilePath crx_path) {
+@@ -1294,6 +1279,7 @@ void ExtensionDownloader::OnExtensionLoadComplete(base::FilePath crx_path) {
     RETRY_HISTOGRAM("CrxFetchSuccess",
                     extensions_queue_.active_request_failure_count(),
                     url);
@@ -1128,7 +1128,7 @@ diff --git a/extensions/browser/updater/extension_downloader.cc b/extensions/bro
     std::unique_ptr<ExtensionFetch> fetch_data =
         std::move(extensions_queue_.reset_active_request().fetch);
     delegate_->OnExtensionDownloadStageChanged(
-@@ -1325,7 +1311,7 @@ void ExtensionDownloader::OnExtensionLoadComplete(base::FilePath crx_path) {
+@@ -1314,7 +1300,7 @@ void ExtensionDownloader::OnExtensionLoadComplete(base::FilePath crx_path) {
   } else {
     const std::set<int> request_ids = active_request.GetRequestIds();
     const ExtensionDownloaderDelegate::PingResult& ping = ping_results_[id];
@@ -1137,7 +1137,7 @@ diff --git a/extensions/browser/updater/extension_downloader.cc b/extensions/bro
             << "' response code:" << response_code;
     if (ShouldRetryRequest(extension_loader_.get()) &&
         extensions_queue_.active_request_failure_count() < kMaxRetries) {
-@@ -1419,6 +1405,7 @@ void ExtensionDownloader::NotifyExtensionsDownloadFailedWithList(
+@@ -1408,6 +1394,7 @@ void ExtensionDownloader::NotifyExtensionsDownloadFailedWithList(
 bool ExtensionDownloader::IterateFetchCredentialsAfterFailure(
     ExtensionFetch* fetch,
     int response_code) {
@@ -1201,21 +1201,14 @@ diff --git a/extensions/browser/updater/safe_manifest_parser.cc b/extensions/bro
 diff --git a/extensions/common/extension_features.cc b/extensions/common/extension_features.cc
 --- a/extensions/common/extension_features.cc
 +++ b/extensions/common/extension_features.cc
-@@ -233,4 +233,18 @@ BASE_FEATURE(kExtensionBrowserNamespaceAlternative,
-              "ExtensionBrowserNamespaceAlternative",
-              base::FEATURE_DISABLED_BY_DEFAULT);
+@@ -183,4 +183,11 @@ BASE_FEATURE(kEnableShouldShowPromotion, base::FEATURE_DISABLED_BY_DEFAULT);
+ BASE_FEATURE(kWebRequestPersistFilteredEvents,
+              base::FEATURE_ENABLED_BY_DEFAULT);
 
-+// Activates the auto update of extensions.
-+// the only data provided by default is the list of extensions.
 +CROMITE_FEATURE(kEnableExtensionAutoupdate,
 +                "EnableExtensionAutoupdate",
 +                base::FEATURE_DISABLED_BY_DEFAULT);
 +
-+// Modifies "management" and "webstorePrivate" extension api
-+// by not allowing access to the list of installed extensions
-+// and reading or changing status.
-+// Allows the installation of new extensions.
-+// If active, exposes all features to the chrome web store like chromium.
 +CROMITE_FEATURE(kEnableExtensionManagementToChromeStore,
 +                "EnableExtensionToChromeStore",
 +                base::FEATURE_DISABLED_BY_DEFAULT);
@@ -1223,11 +1216,19 @@ diff --git a/extensions/common/extension_features.cc b/extensions/common/extensi
 diff --git a/extensions/common/extension_features.h b/extensions/common/extension_features.h
 --- a/extensions/common/extension_features.h
 +++ b/extensions/common/extension_features.h
-@@ -273,6 +273,8 @@ BASE_DECLARE_FEATURE(kDebuggerAPIRestrictedToDevMode);
- // `loadTimes` , `csi`, etc. or deprecated APIs (e.g. `app`).
- BASE_DECLARE_FEATURE(kExtensionBrowserNamespaceAlternative);
+@@ -307,6 +307,16 @@ BASE_DECLARE_FEATURE(kWebRequestSecurityInfo);
+ // browser startup).
+ BASE_DECLARE_FEATURE(kWebRequestPersistFilteredEvents);
 
+// Activates the auto update of extensions.
+// the only data provided by default is the list of extensions.
 +BASE_DECLARE_FEATURE(kEnableExtensionAutoupdate);
+
+// Modifies "management" and "webstorePrivate" extension api
+// by not allowing access to the list of installed extensions
+// and reading or changing status.
+// Allows the installation of new extensions.
+// If active, exposes all features to the chrome web store like chromium.
 +BASE_DECLARE_FEATURE(kEnableExtensionManagementToChromeStore);
 }  // namespace extensions_features
 
@@ -1235,7 +1236,7 @@ diff --git a/extensions/common/extension_features.h b/extensions/common/extensio
 diff --git a/tools/typescript/definitions/developer_private.d.ts b/tools/typescript/definitions/developer_private.d.ts
 --- a/tools/typescript/definitions/developer_private.d.ts
 +++ b/tools/typescript/definitions/developer_private.d.ts
-@@ -264,6 +264,7 @@ declare global {
+@@ -265,6 +265,7 @@ declare global {
         isIncognitoAvailable: boolean;
         isChildAccount: boolean;
         isMv2DeprecationNoticeDismissed: boolean;
@@ -1243,7 +1244,7 @@ diff --git a/tools/typescript/definitions/developer_private.d.ts b/tools/typescr
       }
 
       export interface ExtensionConfigurationUpdate {
-@@ -281,6 +282,7 @@ declare global {
+@@ -282,6 +283,7 @@ declare global {
       export interface ProfileConfigurationUpdate {
         inDeveloperMode?: boolean;
         isMv2DeprecationNoticeDismissed?: boolean;
@@ -15,7 +15,7 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 diff --git a/services/network/cors/preflight_cache.cc b/services/network/cors/preflight_cache.cc
 --- a/services/network/cors/preflight_cache.cc
 +++ b/services/network/cors/preflight_cache.cc
-@@ -204,6 +204,10 @@ void PreflightCache::MayPurgeForTesting(size_t max_entries, size_t purge_unit) {
+@@ -197,6 +197,10 @@ void PreflightCache::MayPurgeForTesting(size_t max_entries, size_t purge_unit) {
   MayPurge(max_entries, purge_unit);
 }
 
@@ -29,7 +29,7 @@ diff --git a/services/network/cors/preflight_cache.cc b/services/network/cors/pr
 diff --git a/services/network/cors/preflight_cache.h b/services/network/cors/preflight_cache.h
 --- a/services/network/cors/preflight_cache.h
 +++ b/services/network/cors/preflight_cache.h
-@@ -78,6 +78,8 @@ class COMPONENT_EXPORT(NETWORK_SERVICE) PreflightCache final {
+@@ -75,6 +75,8 @@ class COMPONENT_EXPORT(NETWORK_SERVICE) PreflightCache final {
   // `max_entries` for testing.
   void MayPurgeForTesting(size_t max_entries, size_t purge_unit);
 
@@ -41,7 +41,7 @@ diff --git a/services/network/cors/preflight_cache.h b/services/network/cors/pre
 diff --git a/services/network/cors/preflight_controller.cc b/services/network/cors/preflight_controller.cc
 --- a/services/network/cors/preflight_controller.cc
 +++ b/services/network/cors/preflight_controller.cc
-@@ -834,6 +834,10 @@ void PreflightController::ClearCorsPreflightCache(
+@@ -631,6 +631,10 @@ void PreflightController::ClearCorsPreflightCache(
   cache_.ClearCache(std::move(url_filter));
 }
 
@@ -55,9 +55,9 @@ diff --git a/services/network/cors/preflight_controller.cc b/services/network/co
 diff --git a/services/network/cors/preflight_controller.h b/services/network/cors/preflight_controller.h
 --- a/services/network/cors/preflight_controller.h
 +++ b/services/network/cors/preflight_controller.h
-@@ -157,6 +157,8 @@ class COMPONENT_EXPORT(NETWORK_SERVICE) PreflightController final {
-           url_loader_network_service_observer,
-       const PreflightMode& preflight_mode);
+@@ -117,6 +117,8 @@ class COMPONENT_EXPORT(NETWORK_SERVICE) PreflightController final {
+       mojo::PendingRemote<mojom::URLLoaderNetworkServiceObserver>
+           url_loader_network_service_observer);
 
 +  void ClearCache();
 +
@@ -79,7 +79,7 @@ diff --git a/services/network/cors/preflight_result.cc b/services/network/cors/p
 diff --git a/services/network/network_context.cc b/services/network/network_context.cc
 --- a/services/network/network_context.cc
 +++ b/services/network/network_context.cc
-@@ -1356,6 +1356,7 @@ void NetworkContext::ClearHttpCache(base::Time start_time,
+@@ -1368,6 +1368,7 @@ void NetworkContext::ClearHttpCache(base::Time start_time,
                                     base::Time end_time,
                                     mojom::ClearDataFilterPtr filter,
                                     ClearHttpCacheCallback callback) {
@@ -7,30 +7,65 @@ Use Google Chrome branding for client hints

 License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 ---
- components/embedder_support/user_agent_utils.cc   |  4 +---
- content/browser/client_hints/client_hints.cc      | 15 ++++++++++-----
- .../browser/loader/navigation_url_loader_impl.cc  |  5 +++++
- .../about_flags_cc/Client-hints-overrides.inc     |  9 +++++++++
- .../common/features_cc/Client-hints-overrides.inc |  1 +
- .../cpp/features_cc/Client-hints-overrides.inc    |  1 +
- net/http/http_network_transaction.cc              |  1 +
- services/network/public/cpp/client_hints.cc       |  1 +
- .../blink/common/client_hints/client_hints.cc     |  6 ++++--
- .../common/client_hints/enabled_client_hints.cc   |  6 ++++++
- .../blink/renderer/core/frame/navigator_ua.idl    |  4 +++-
- .../renderer/core/frame/navigator_ua_data.cc      |  1 +
- .../renderer/core/frame/navigator_ua_data.idl     |  5 ++++-
- .../renderer/core/loader/frame_fetch_context.cc   |  4 +++-
- .../platform/runtime_enabled_features.json5       |  8 ++++++--
- 15 files changed, 56 insertions(+), 15 deletions(-)
+ .../SupportLibWebViewChromiumFactory.java       |  2 +-
+ components/client_hints/browser/client_hints.cc |  5 +++--
+ components/embedder_support/user_agent_utils.cc |  5 ++---
+ content/browser/client_hints/client_hints.cc    | 17 +++++++++++++++--
+ .../about_flags_cc/Client-hints-overrides.inc   |  9 +++++++++
+ .../features_cc/Client-hints-overrides.inc      |  1 +
+ .../cpp/features_cc/Client-hints-overrides.inc  |  1 +
+ net/http/http_network_transaction.cc            |  1 +
+ services/network/public/cpp/client_hints.cc     |  2 +-
+ .../blink/common/client_hints/client_hints.cc   |  6 ++++--
+ .../common/client_hints/enabled_client_hints.cc |  8 ++++++++
+ .../blink/renderer/core/frame/navigator_ua.idl  |  4 +++-
+ .../renderer/core/frame/navigator_ua_data.cc    |  1 +
+ .../renderer/core/frame/navigator_ua_data.idl   |  5 ++++-
+ .../renderer/core/loader/frame_fetch_context.cc |  4 +++-
+ .../platform/runtime_enabled_features.json5     |  8 ++++++--
+ 16 files changed, 63 insertions(+), 16 deletions(-)
 create mode 100644 cromite_flags/chrome/browser/about_flags_cc/Client-hints-overrides.inc
 create mode 100644 cromite_flags/content/common/features_cc/Client-hints-overrides.inc
 create mode 100644 cromite_flags/services/network/public/cpp/features_cc/Client-hints-overrides.inc

+diff --git a/android_webview/support_library/java/src/org/chromium/support_lib_glue/SupportLibWebViewChromiumFactory.java b/android_webview/support_library/java/src/org/chromium/support_lib_glue/SupportLibWebViewChromiumFactory.java
+--- a/android_webview/support_library/java/src/org/chromium/support_lib_glue/SupportLibWebViewChromiumFactory.java
+++ b/android_webview/support_library/java/src/org/chromium/support_lib_glue/SupportLibWebViewChromiumFactory.java
+@@ -95,7 +95,7 @@ public class SupportLibWebViewChromiumFactory implements WebViewProviderFactoryB
+                 Features.GET_COOKIE_INFO,
+                 Features.WEB_MESSAGE_ARRAY_BUFFER,
+                 Features.IMAGE_DRAG_DROP,
+-                Features.USER_AGENT_METADATA,
+                // Features.USER_AGENT_METADATA,
+                 Features.MULTI_PROFILE,
+                 Features.ATTRIBUTION_BEHAVIOR,
+                 Features.WEBVIEW_MEDIA_INTEGRITY_API_STATUS,
+diff --git a/components/client_hints/browser/client_hints.cc b/components/client_hints/browser/client_hints.cc
+--- a/components/client_hints/browser/client_hints.cc
+++ b/components/client_hints/browser/client_hints.cc
+@@ -35,7 +35,7 @@ ParseInitializeClientHintsStorage() {
+   auto results =
+       base::flat_map<url::Origin,
+                      std::vector<network::mojom::WebClientHintsType>>();
+-
+  if ((true)) return results;
+   std::string raw_client_hint_json =
+       base::CommandLine::ForCurrentProcess()->GetSwitchValueASCII(
+           switches::kInitializeClientHintsStorage);
+@@ -200,7 +200,8 @@ void ClientHints::PersistClientHints(
+   // TODO(tbansal): crbug.com/735518. Disable updates to client hints settings
+   // when cookies are disabled for |primary_origin|.
+   content_settings::ContentSettingConstraints constraints;
+-  constraints.set_session_model(content_settings::mojom::SessionModel::DURABLE);
+  constraints.set_session_model(content_settings::mojom::SessionModel::USER_SESSION);
+  constraints.set_lifetime(base::Minutes(1));
+   settings_map_->SetWebsiteSettingDefaultScope(
+       primary_url, GURL(), ContentSettingsType::CLIENT_HINTS,
+       base::Value(std::move(client_hints_dictionary)), constraints);
 diff --git a/components/embedder_support/user_agent_utils.cc b/components/embedder_support/user_agent_utils.cc
 --- a/components/embedder_support/user_agent_utils.cc
 +++ b/components/embedder_support/user_agent_utils.cc
-@@ -203,9 +203,7 @@ const blink::UserAgentBrandList GetUserAgentBrandList(
+@@ -202,9 +202,7 @@ const blink::UserAgentBrandList GetUserAgentBrandList(
   bool parse_result = base::StringToInt(major_version, &major_version_number);
   DCHECK(parse_result);
   std::optional<std::string> brand;
@@ -41,10 +76,18 @@ diff --git a/components/embedder_support/user_agent_utils.cc b/components/embedd
 
   std::string brand_version =
       output_version_type == blink::UserAgentBrandVersionType::kFullVersion
+@@ -695,6 +693,7 @@ blink::UserAgentMetadata GetUserAgentMetadata(bool only_low_entropy_ch) {
+   }
+ 
+   // High entropy client hints.
+  if ((true)) return metadata;
+   metadata.brand_full_version_list =
+       GetUserAgentBrandFullVersionListInternal(std::nullopt);
+   metadata.full_version = std::string(version_info::GetVersionNumber());
 diff --git a/content/browser/client_hints/client_hints.cc b/content/browser/client_hints/client_hints.cc
 --- a/content/browser/client_hints/client_hints.cc
 +++ b/content/browser/client_hints/client_hints.cc
-@@ -57,6 +57,7 @@
+@@ -58,6 +58,7 @@
 #include "third_party/blink/public/common/features.h"
 #include "third_party/blink/public/common/page/page_zoom.h"
 #include "third_party/blink/public/common/user_agent/user_agent_metadata.h"
@@ -52,56 +95,38 @@ diff --git a/content/browser/client_hints/client_hints.cc b/content/browser/clie
 #include "ui/display/display.h"
 #include "ui/display/screen.h"
 #include "url/origin.h"
-@@ -703,7 +704,8 @@ void UpdateNavigationRequestClientUaHeadersImpl(
-     // value, disable them. This overwrites previous decision from UI.
-     disable_due_to_custom_ua = !ua_metadata.has_value();
-   }
-
+@@ -602,10 +603,21 @@ bool IsClientHintEnabled(const ClientHintsExtendedData& data,
+ 
+ bool IsClientHintAllowed(const ClientHintsExtendedData& data,
+                          WebClientHintsType type) {
 +  if (!blink::RuntimeEnabledFeatures::UserAgentClientHintEnabled())
-+    disable_due_to_custom_ua = true;
-   if (!disable_due_to_custom_ua) {
-     if (!ua_metadata.has_value())
-       ua_metadata = delegate->GetUserAgentMetadata();
-@@ -885,10 +887,12 @@ void AddRequestClientHintsHeaders(
-     AddEctHeader(headers, network_quality_tracker, url);
-   }
- 
-  UpdateNavigationRequestClientUaHeadersImpl(
-      delegate, is_ua_override_on, frame_tree_node,
-      ClientUaHeaderCallType::kDuringCreation, headers, container_policy,
-      request_url, data);
-+  if (blink::RuntimeEnabledFeatures::UserAgentClientHintEnabled()) {
-+    UpdateNavigationRequestClientUaHeadersImpl(
-+        delegate, is_ua_override_on, frame_tree_node,
-+        ClientUaHeaderCallType::kDuringCreation, headers, container_policy,
-+        request_url, data);
+    return false;
+
+  bool allowed = false;
+  if (type == WebClientHintsType::kUA ||
+      type == WebClientHintsType::kUAMobile ||
+      type == WebClientHintsType::kUAPlatform ||
+      type == WebClientHintsType::kUAModel ||
+      type == WebClientHintsType::kUAPlatformVersion) {
+    allowed = true;
 +  }
- 
-   if (ShouldAddClientHint(data, WebClientHintsType::kPrefersColorScheme)) {
-     AddPrefersColorSchemeHeader(headers, frame_tree_node);
-@@ -969,6 +973,7 @@ ParseAndPersistAcceptCHForNavigation(
-     BrowserContext* context,
-     ClientHintsControllerDelegate* delegate,
-     FrameTreeNode* frame_tree_node) {
-+  if ((true)) return std::nullopt;
-   DCHECK_CURRENTLY_ON(BrowserThread::UI);
-   DCHECK(context);
-   DCHECK(parsed_headers);
-diff --git a/content/browser/loader/navigation_url_loader_impl.cc b/content/browser/loader/navigation_url_loader_impl.cc
--- a/content/browser/loader/navigation_url_loader_impl.cc
-+++ b/content/browser/loader/navigation_url_loader_impl.cc
-@@ -1380,6 +1380,11 @@ void NavigationURLLoaderImpl::OnAcceptCHFrameReceived(
+   if (data.is_outermost_main_frame) {
+-    return true;
+    return allowed;
+   }
+-  return (data.permissions_policy->IsFeatureEnabledForOrigin(
+  return ((false)) && (data.permissions_policy->IsFeatureEnabledForOrigin(
+       network::GetClientHintToPolicyFeatureMap().at(type),
+       data.resource_origin));
+ }
+@@ -630,6 +642,7 @@ bool IsJavascriptEnabled(FrameTreeNode* frame_tree_node) {
+ void UpdateIFramePermissionsPolicyWithDelegationSupportForClientHints(
+     ClientHintsExtendedData& data,
+     const network::ParsedPermissionsPolicy& container_policy) {
+  if ((true)) return;
+   if (container_policy.empty()) {
     return;
   }
- 
-+  if (!base::FeatureList::IsEnabled(network::features::kAcceptCHFrame)) {
-+    std::move(callback).Run(net::OK);
-+    return;
-+  }
-+
-   LogAcceptCHFrameStatus(AcceptCHFrameRestart::kFramePresent);
- 
-   // Given that this is happening in the middle of navigation, there should
 diff --git a/cromite_flags/chrome/browser/about_flags_cc/Client-hints-overrides.inc b/cromite_flags/chrome/browser/about_flags_cc/Client-hints-overrides.inc
 new file mode 100644
 --- /dev/null
@@ -121,17 +146,17 @@ new file mode 100644
 --- /dev/null
 +++ b/cromite_flags/content/common/features_cc/Client-hints-overrides.inc
@@ -0,0 +1 @@
-+SET_CROMITE_FEATURE_DISABLED(kCriticalClientHint);
+SET_CROMITE_FEATURE_ENABLED(kCriticalClientHint);
 diff --git a/cromite_flags/services/network/public/cpp/features_cc/Client-hints-overrides.inc b/cromite_flags/services/network/public/cpp/features_cc/Client-hints-overrides.inc
 new file mode 100644
 --- /dev/null
 +++ b/cromite_flags/services/network/public/cpp/features_cc/Client-hints-overrides.inc
@@ -0,0 +1 @@
-+SET_CROMITE_FEATURE_DISABLED(kAcceptCHFrame);
+SET_CROMITE_FEATURE_ENABLED(kAcceptCHFrame);
 diff --git a/net/http/http_network_transaction.cc b/net/http/http_network_transaction.cc
 --- a/net/http/http_network_transaction.cc
 +++ b/net/http/http_network_transaction.cc
-@@ -111,6 +111,7 @@ const size_t kMaxRestarts = 32;
+@@ -113,6 +113,7 @@ const size_t kMaxRestarts = 32;
 
 // Returns true when Early Hints are allowed on the given protocol.
 bool EarlyHintsAreAllowedOn(HttpConnectionInfo connection_info) {
@@ -142,11 +167,12 @@ diff --git a/net/http/http_network_transaction.cc b/net/http/http_network_transa
 diff --git a/services/network/public/cpp/client_hints.cc b/services/network/public/cpp/client_hints.cc
 --- a/services/network/public/cpp/client_hints.cc
 +++ b/services/network/public/cpp/client_hints.cc
-@@ -112,6 +112,7 @@ const DecodeMap& GetDecodeMap() {
+@@ -111,7 +111,7 @@ const DecodeMap& GetDecodeMap() {
+ }  // namespace
 
 std::optional<std::vector<network::mojom::WebClientHintsType>>
- ParseClientHintsHeader(const std::string& header) {
-+  if ((true)) return std::nullopt;
+-ParseClientHintsHeader(const std::string& header) {
+ParseClientHintsHeader(const std::string& header) { // Parse Client Hints Header
   // Accept-CH is an sh-list of tokens; see:
   // https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-header-structure-19#section-3.1
   std::optional<net::structured_headers::List> maybe_list =
@@ -179,13 +205,15 @@ diff --git a/third_party/blink/common/client_hints/client_hints.cc b/third_party
 diff --git a/third_party/blink/common/client_hints/enabled_client_hints.cc b/third_party/blink/common/client_hints/enabled_client_hints.cc
 --- a/third_party/blink/common/client_hints/enabled_client_hints.cc
 +++ b/third_party/blink/common/client_hints/enabled_client_hints.cc
-@@ -15,6 +15,12 @@ namespace {
+@@ -15,6 +15,14 @@ namespace {
 using ::network::mojom::WebClientHintsType;
 
 bool IsDisabledByFeature(const WebClientHintsType type) {
 +  if (type == WebClientHintsType::kUA ||
 +        type == WebClientHintsType::kUAMobile ||
-+        type == WebClientHintsType::kUAPlatform) {
+        type == WebClientHintsType::kUAPlatform ||
+        type == WebClientHintsType::kUAModel ||
+        type == WebClientHintsType::kUAPlatformVersion) {
 +    return false;
 +  }
 +  if ((true)) return true;
@@ -208,7 +236,7 @@ diff --git a/third_party/blink/renderer/core/frame/navigator_ua.idl b/third_part
 diff --git a/third_party/blink/renderer/core/frame/navigator_ua_data.cc b/third_party/blink/renderer/core/frame/navigator_ua_data.cc
 --- a/third_party/blink/renderer/core/frame/navigator_ua_data.cc
 +++ b/third_party/blink/renderer/core/frame/navigator_ua_data.cc
-@@ -186,6 +186,7 @@ const String& NavigatorUAData::platform() const {
+@@ -114,6 +114,7 @@ const String& NavigatorUAData::platform() const {
 }
 
 bool AllowedToCollectHighEntropyValues(ExecutionContext* execution_context) {
@@ -228,13 +256,13 @@ diff --git a/third_party/blink/renderer/core/frame/navigator_ua_data.idl b/third
 +    RuntimeEnabled=UserAgentClientHint,
 +    Exposed=(Window,Worker)
 +] interface NavigatorUAData {
-   [HighEntropy, MeasureAs=NavigatorUAData_Brands] readonly attribute FrozenArray<NavigatorUABrandVersion> brands;
-   [HighEntropy=Direct, MeasureAs=NavigatorUAData_Mobile]  readonly attribute boolean mobile;
-   [HighEntropy=Direct, MeasureAs=NavigatorUAData_Platform] readonly attribute DOMString platform;
+   [MeasureAs=NavigatorUAData_Brands] readonly attribute FrozenArray<NavigatorUABrandVersion> brands;
+   [MeasureAs=NavigatorUAData_Mobile]  readonly attribute boolean mobile;
+   [MeasureAs=NavigatorUAData_Platform] readonly attribute DOMString platform;
 diff --git a/third_party/blink/renderer/core/loader/frame_fetch_context.cc b/third_party/blink/renderer/core/loader/frame_fetch_context.cc
 --- a/third_party/blink/renderer/core/loader/frame_fetch_context.cc
 +++ b/third_party/blink/renderer/core/loader/frame_fetch_context.cc
-@@ -226,6 +226,8 @@ bool ShouldSendClientHint(const network::PermissionsPolicy& policy,
+@@ -231,6 +231,8 @@ bool ShouldSendClientHint(const network::PermissionsPolicy& policy,
                           bool is_1p_origin,
                           network::mojom::blink::WebClientHintsType type,
                           const ClientHintsPreferences& hints_preferences) {
@@ -243,7 +271,7 @@ diff --git a/third_party/blink/renderer/core/loader/frame_fetch_context.cc b/thi
   // For subresource requests, sending the hint in the fetch request based on
   // the permissions policy.
   if (!policy.IsFeatureEnabledForOrigin(
-@@ -606,7 +608,7 @@ void FrameFetchContext::AddClientHintsIfNecessary(
+@@ -715,7 +717,7 @@ void FrameFetchContext::AddClientHintsIfNecessary(
   }
 
   // Only send User Agent hints if the info is available
@@ -255,7 +283,7 @@ diff --git a/third_party/blink/renderer/core/loader/frame_fetch_context.cc b/thi
 diff --git a/third_party/blink/renderer/platform/runtime_enabled_features.json5 b/third_party/blink/renderer/platform/runtime_enabled_features.json5
 --- a/third_party/blink/renderer/platform/runtime_enabled_features.json5
 +++ b/third_party/blink/renderer/platform/runtime_enabled_features.json5
-@@ -517,6 +517,11 @@
+@@ -610,6 +610,11 @@
       name: "AriaNotifyV2",
       status: {"Android": "test", "Win": "test", "Mac": "test", "Linux": "test"},
     },
@@ -267,12 +295,12 @@ diff --git a/third_party/blink/renderer/platform/runtime_enabled_features.json5
     {
       name: "AriaRowColIndexText",
       status: "stable",
-@@ -903,8 +908,7 @@
+@@ -1016,8 +1021,7 @@
       // Allows top-level sites to restrict collection of high-entropy UA client
       // hints (from 3Ps, or itself) via the getHighEntropyValues API.
       // crbug.com/385161047
 -      name: "ClientHintUAHighEntropyValuesPermissionPolicy",
-      status: "test",
+-      status: "stable",
 +      name: "ClientHintUAHighEntropyValuesPermissionPolicy",  // disabled by default
     },
     {
@@ -9,12 +9,12 @@ No change in doh connections.

 License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 ---
- .../browser/network_session_configurator.cc        | 11 ++++-------
+ .../browser/network_session_configurator.cc        | 12 ++++--------
 .../about_flags_cc/Close-Sessions-On-Ip-Change.inc | 14 ++++++++++++++
 .../features_cc/Close-Sessions-On-Ip-Change.inc    |  5 +++++
 .../features_h/Close-Sessions-On-Ip-Change.inc     |  3 +++
 net/base/features.cc                               |  2 +-
- 5 files changed, 27 insertions(+), 8 deletions(-)
+ 5 files changed, 27 insertions(+), 9 deletions(-)
 create mode 100644 cromite_flags/chrome/browser/about_flags_cc/Close-Sessions-On-Ip-Change.inc
 create mode 100644 cromite_flags/net/base/features_cc/Close-Sessions-On-Ip-Change.inc
 create mode 100644 cromite_flags/net/base/features_h/Close-Sessions-On-Ip-Change.inc
@@ -22,7 +22,7 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 diff --git a/components/network_session_configurator/browser/network_session_configurator.cc b/components/network_session_configurator/browser/network_session_configurator.cc
 --- a/components/network_session_configurator/browser/network_session_configurator.cc
 +++ b/components/network_session_configurator/browser/network_session_configurator.cc
-@@ -220,9 +220,8 @@ quic::QuicTagVector GetQuicClientConnectionOptions(
+@@ -221,9 +221,8 @@ quic::QuicTagVector GetQuicClientConnectionOptions(
 
 bool ShouldQuicCloseSessionsOnIpChange(
     const VariationParameters& quic_trial_params) {
@@ -34,14 +34,15 @@ diff --git a/components/network_session_configurator/browser/network_session_con
 }
 
 bool ShouldQuicGoAwaySessionsOnIpChange(
-@@ -303,10 +302,8 @@ bool ShouldQuicEstimateInitialRtt(
+@@ -304,11 +303,8 @@ bool ShouldQuicEstimateInitialRtt(
 
 bool ShouldQuicMigrateSessionsOnNetworkChangeV2(
     const VariationParameters& quic_trial_params) {
 -  return GetVariationBoolParamOrFeatureSetting(
 -      quic_trial_params, "migrate_sessions_on_network_change_v2",
 -      base::FeatureList::IsEnabled(
-          net::features::kMigrateSessionsOnNetworkChangeV2));
+-          net::features::kMigrateSessionsOnNetworkChangeV2),
+-      "true");
 +  return base::FeatureList::IsEnabled(
 +          net::features::kMigrateSessionsOnNetworkChangeV2);
 }
@@ -87,7 +88,7 @@ new file mode 100644
 diff --git a/net/base/features.cc b/net/base/features.cc
 --- a/net/base/features.cc
 +++ b/net/base/features.cc
-@@ -548,7 +548,7 @@ BASE_FEATURE(kRelatedWebsitePartitionAPI,
+@@ -443,7 +443,7 @@ BASE_FEATURE(kRelatedWebsitePartitionAPI, base::FEATURE_DISABLED_BY_DEFAULT);
 // NetworkChangeNotifier::AreNetworkHandlesSupported).
 #if BUILDFLAG(IS_ANDROID)
 inline constexpr auto kMigrateSessionsOnNetworkChangeV2Default =
@@ -13,7 +13,7 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 diff --git a/chrome/android/chrome_public_apk_tmpl.gni b/chrome/android/chrome_public_apk_tmpl.gni
 --- a/chrome/android/chrome_public_apk_tmpl.gni
 +++ b/chrome/android/chrome_public_apk_tmpl.gni
-@@ -665,6 +665,7 @@ template("chrome_common_apk_or_module_tmpl") {
+@@ -674,6 +674,7 @@ template("chrome_common_apk_or_module_tmpl") {
           [ "//components/crash/core/app:chrome_crashpad_handler_named_as_so" ]
       loadable_modules += [ "$root_out_dir/libchrome_crashpad_handler.so" ]
       library_always_compress += [ "libchrome_crashpad_handler.so" ]
@@ -18,7 +18,7 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 diff --git a/chrome/android/chrome_java_resources.gni b/chrome/android/chrome_java_resources.gni
 --- a/chrome/android/chrome_java_resources.gni
 +++ b/chrome/android/chrome_java_resources.gni
-@@ -653,7 +653,7 @@ chrome_java_resources = [
+@@ -683,7 +683,7 @@ chrome_java_resources = [
   "java/res/xml/manage_sync_preferences.xml",
   "java/res/xml/personalize_google_services_preferences.xml",
   "java/res/xml/incognito_preferences.xml",
@@ -30,7 +30,7 @@ diff --git a/chrome/android/chrome_java_resources.gni b/chrome/android/chrome_ja
 diff --git a/chrome/android/java/res/xml/main_preferences.xml b/chrome/android/java/res/xml/main_preferences.xml
 --- a/chrome/android/java/res/xml/main_preferences.xml
 +++ b/chrome/android/java/res/xml/main_preferences.xml
-@@ -15,7 +15,7 @@ for the previous order (main_preferences_legacy). -->
+@@ -11,7 +11,7 @@ found in the LICENSE file.
 <!-- `order=0` is reserved and it will be added in code.  -->
 <!-- TODO(crbug.com/364906215): Move SettingsPromoCardPreference here once SyncPromoPreference is removed -->
     <PreferenceCategory
@@ -39,7 +39,7 @@ diff --git a/chrome/android/java/res/xml/main_preferences.xml b/chrome/android/j
         android:order="1001"
         android:title="@string/prefs_section_account_and_google_services"/>
     <org.chromium.chrome.browser.sync.settings.SignInPreference
-@@ -28,7 +28,7 @@ for the previous order (main_preferences_legacy). -->
+@@ -24,7 +24,7 @@ found in the LICENSE file.
         android:layout="@layout/account_management_account_row"
         android:title="@string/sync_category_title"/>
     <org.chromium.components.browser_ui.settings.ChromeBasePreference
@@ -108,6 +108,12 @@ new file mode 100644
 +        android:key="can_make_payment"
 +        android:title="@string/can_make_payment_title"
 +        android:summary="@string/settings_can_make_payment_toggle_label" />
+    <org.chromium.components.browser_ui.settings.ChromeSwitchPreference
+        android:key="throttle_main_thread_to_60hz"
+        android:title="@string/throttle_main_thread_to_60hz_title"
+        android:summary="@string/throttle_main_thread_to_60hz_summary"
+        app:featureName="throttle-main-thread-to-60hz"
+        app:needRestart="true" />
 +
 +    <PreferenceCategory
 +        android:title="@string/data_exposed_to_device_section_title"/>
@@ -217,12 +223,6 @@ new file mode 100644
 +        android:fragment="org.chromium.components.privacy_sandbox.TrackingProtectionSettings"
 +        app:isPreferenceVisible="false" />
 +    <Preference
-+        android:key="incognito_tracking_protections"
-+        android:title="@string/incognito_tracking_protections_page_title"
-+        android:summary="@string/incognito_tracking_protections_page_entrypoint_description"
-+        android:fragment="org.chromium.components.privacy_sandbox.IncognitoTrackingProtectionsFragment"
-+        app:isPreferenceVisible="false" />
-+    <Preference
 +        android:key="privacy_sandbox"
 +        android:title="@string/ad_privacy_link_row_label"
 +        android:summary="@string/ad_privacy_link_row_sub_label"
@@ -254,9 +254,9 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/privacy/setting
 -        SettingsUtils.addPreferencesFromResource(this, R.xml.privacy_preferences);
 +        SettingsUtils.addPreferencesFromResource(this, R.xml.privacy_preferences_cromite);
 
-         Preference incognitoTrackingProtectionsPreference =
-                 findPreference(PREF_INCOGNITO_TRACKING_PROTECTIONS);
-@@ -280,7 +280,9 @@ public class PrivacySettings extends ChromeBaseSettingsFragment
+         Preference sandboxPreference = findPreference(PREF_PRIVACY_SANDBOX);
+         // Overwrite the click listener to pass a correct referrer to the fragment.
+@@ -282,7 +282,9 @@ public class PrivacySettings extends ChromeBaseSettingsFragment
 
         ChromeSwitchPreference passwordLeakTogglePref =
                 (ChromeSwitchPreference) findPreference(PREF_PASSWORD_LEAK_DETECTION);
@@ -26,7 +26,11 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 .../mipmap-xxxhdpi/layered_app_icon.png       | Bin 3652 -> 29220 bytes
 .../layered_app_icon_background.png           | Bin 3519 -> 142032 bytes
 .../values/channel_constants.xml              |   8 +-
+ .../about_settings/AboutChromeSettings.java   |   4 +-
+ .../ChromeContextMenuPopulator.java           |   2 +-
+ .../browser/fullscreen/FullscreenToast.java   |   2 +-
 .../inline/BromiteInlineUpdateController.java |  19 +++-
+ .../tabbed_mode/TabbedRootUiCoordinator.java  |   4 +-
 chrome/app/extensions_strings.grdp            |   4 +-
 chrome/app/settings_strings.grdp              |   2 +-
 chrome/app/theme/chromium/BRANDING            |   8 +-
@@ -35,13 +39,15 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 .../theme/chromium/win/tiles/SmallLogo.png    | Bin 9784 -> 12363 bytes
 .../chromium/product_logo_32.png              | Bin 822 -> 2301 bytes
 chrome/browser/BUILD.gn                       |   1 +
- .../browser/flags/ChromeFeatureList.java      |   2 +-
+ .../browser/hub/HubToolbarMediator.java       |   2 +-
+ .../android/res/layout/hub_toolbar_layout.xml |  82 ++++++++-------
 .../chrome/browser/omaha/UpdateConfigs.java   |   2 +-
 chrome/browser/prefs/BUILD.gn                 |   1 +
 .../prefs/chrome_pref_service_factory.cc      |   6 +-
 .../profiles/profile_shortcut_manager_win.cc  |   2 +-
 .../settings/settings_menu/settings_menu.html |  14 ++-
- .../strings/android_chrome_strings.grd        |   2 +-
+ .../OmniboxSuggestionsContainer.java          |   8 +-
+ .../strings/android_chrome_strings.grd        |   4 +-
 .../toolbar/chrome_labs/chrome_labs_utils.cc  |   1 +
 chrome/common/url_constants.h                 |   4 +-
 .../install_static/chromium_install_modes.cc  |   2 +-
@@ -51,7 +57,9 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 .../drawable-xhdpi/fre_product_logo.png       | Bin 5151 -> 34576 bytes
 .../drawable-xxhdpi/fre_product_logo.png      | Bin 7720 -> 60959 bytes
 .../drawable-xxxhdpi/fre_product_logo.png     | Bin 10740 -> 93273 bytes
+ .../browser/autocomplete_controller.cc        |   1 +
 .../vector_icons/product_chrome_refresh.icon  |  93 +++++++++---------
+ components/policy/core/common/policy_paths.cc |   2 +-
 .../chromium/product_logo.png                 | Bin 1562 -> 3577 bytes
 .../chromium/product_logo_white.png           | Bin 1417 -> 3040 bytes
 .../chromium/product_logo.png                 | Bin 2714 -> 7923 bytes
@@ -59,9 +67,9 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 .../webui/version/resources/about_version.ts  |   4 +-
 .../resources/about_version_mobile.css        |   9 ++
 content/child/runtime_features.cc             |  44 ++++-----
- .../Cromite-Branding.inc                      |   1 +
+ .../Cromite-Branding.inc                      |   2 +
 tools/grit/grit/grd_reader.py                 |  35 +++++++
- 57 files changed, 203 insertions(+), 129 deletions(-)
+ 65 files changed, 265 insertions(+), 175 deletions(-)
 create mode 100644 cromite_flags/chrome/browser/flags/android/chrome_feature_list_cc/Cromite-Branding.inc

 diff --git a/build/BUILD.gn b/build/BUILD.gn
@@ -85,7 +93,7 @@ diff --git a/build/BUILD.gn b/build/BUILD.gn
 diff --git a/build/config/BUILDCONFIG.gn b/build/config/BUILDCONFIG.gn
 --- a/build/config/BUILDCONFIG.gn
 +++ b/build/config/BUILDCONFIG.gn
-@@ -187,6 +187,10 @@ declare_args() {
+@@ -184,6 +184,10 @@ declare_args() {
   clang_warning_suppression_file = ""
 }
 
@@ -99,7 +107,7 @@ diff --git a/build/config/BUILDCONFIG.gn b/build/config/BUILDCONFIG.gn
 diff --git a/chrome/android/java/AndroidManifest.xml b/chrome/android/java/AndroidManifest.xml
 --- a/chrome/android/java/AndroidManifest.xml
 +++ b/chrome/android/java/AndroidManifest.xml
-@@ -182,7 +182,7 @@ by a child template that "extends" this file.
+@@ -200,7 +200,7 @@ by a child template that "extends" this file.
       <application android:name="{% block application_name %}org.chromium.chrome.browser.base.SplitChromeApplication{% endblock %}"
         android:icon="@drawable/ic_launcher"
         android:roundIcon="@drawable/ic_launcher_round"
@@ -131,7 +139,7 @@ diff --git a/chrome/android/java/res/xml/legal_information_preferences.xml b/chr
 diff --git a/chrome/android/java/res/xml/main_preferences.xml b/chrome/android/java/res/xml/main_preferences.xml
 --- a/chrome/android/java/res/xml/main_preferences.xml
 +++ b/chrome/android/java/res/xml/main_preferences.xml
-@@ -16,20 +16,20 @@ for the previous order (main_preferences_legacy). -->
+@@ -12,20 +12,20 @@ found in the LICENSE file.
 <!-- TODO(crbug.com/364906215): Move SettingsPromoCardPreference here once SyncPromoPreference is removed -->
     <PreferenceCategory
         android:key="account_and_google_services_section"
@@ -9137,6 +9145,45 @@ diff --git a/chrome/android/java/res_chromium_base/values/channel_constants.xml
 +    <string name="search_widget_title" translatable="false">Cromite search</string>
 +    <string name="quick_action_search_widget_title" translatable="false">Cromite quick action search</string>
 </resources>
+diff --git a/chrome/android/java/src/org/chromium/chrome/browser/about_settings/AboutChromeSettings.java b/chrome/android/java/src/org/chromium/chrome/browser/about_settings/AboutChromeSettings.java
+--- a/chrome/android/java/src/org/chromium/chrome/browser/about_settings/AboutChromeSettings.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/about_settings/AboutChromeSettings.java
+@@ -82,7 +82,9 @@ public class AboutChromeSettings extends ChromeBaseSettingsFragment
+         p.setSummary(AboutSettingsBridge.getOSVersion());
+         p = findPreference(PREF_LEGAL_INFORMATION);
+         assumeNonNull(p);
+-        int currentYear = CalendarFactory.get().get(Calendar.YEAR);
+        Calendar calendar = CalendarFactory.get();
+        calendar.setTimeInMillis(System.currentTimeMillis());
+        int currentYear = calendar.get(Calendar.YEAR);
+         p.setSummary(getString(R.string.legal_information_summary, currentYear));
+ 
+         ChromeSwitchPreference allowInlineUpdate =
+diff --git a/chrome/android/java/src/org/chromium/chrome/browser/contextmenu/ChromeContextMenuPopulator.java b/chrome/android/java/src/org/chromium/chrome/browser/contextmenu/ChromeContextMenuPopulator.java
+--- a/chrome/android/java/src/org/chromium/chrome/browser/contextmenu/ChromeContextMenuPopulator.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/contextmenu/ChromeContextMenuPopulator.java
+@@ -481,8 +481,8 @@ public class ChromeContextMenuPopulator implements ContextMenuPopulator {
+                     && !isEmptyUrl(mParams.getUrl())
+                     && UrlUtilities.isAcceptedScheme(mParams.getUrl())) {
+                 if (mMode == ContextMenuMode.NORMAL) {
+-                    linkGroup.add(createListItem(Item.OPEN_IN_NEW_TAB));
+                     linkGroup.add(createListItem(Item.OPEN_IN_NEW_TAB_IN_GROUP));
+                    linkGroup.add(createListItem(Item.OPEN_IN_NEW_TAB));
+                     if (!mItemDelegate.isIncognito()
+                             && mItemDelegate.isIncognitoSupported()
+                             && !shouldOpenIncognitoAsWindow()) {
+diff --git a/chrome/android/java/src/org/chromium/chrome/browser/fullscreen/FullscreenToast.java b/chrome/android/java/src/org/chromium/chrome/browser/fullscreen/FullscreenToast.java
+--- a/chrome/android/java/src/org/chromium/chrome/browser/fullscreen/FullscreenToast.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/fullscreen/FullscreenToast.java
+@@ -109,7 +109,7 @@ interface FullscreenToast {
+             mNotificationToast =
+                     Toast.makeTextWithPriority(
+                             mActivity, toastTextId, Toast.LENGTH_LONG, ToastPriority.HIGH);
+-            mNotificationToast.setGravity(Gravity.BOTTOM | Gravity.CENTER, 0, 0);
+            mNotificationToast.setGravity(Gravity.TOP | Gravity.CENTER, 0, 0);
+             mNotificationToast.show();
+         }
+ 
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/omaha/inline/BromiteInlineUpdateController.java b/chrome/android/java/src/org/chromium/chrome/browser/omaha/inline/BromiteInlineUpdateController.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/omaha/inline/BromiteInlineUpdateController.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/omaha/inline/BromiteInlineUpdateController.java
@@ -9180,10 +9227,28 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/omaha/inline/Br
         Log.i(TAG, "BromiteUpdater: fetching with GET '%s'", UPSTREAM_VERSION_URL);
 
         EndpointFetcher.nativeFetchWithNoAuth(
+diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedRootUiCoordinator.java b/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedRootUiCoordinator.java
+--- a/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedRootUiCoordinator.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedRootUiCoordinator.java
+@@ -909,12 +909,12 @@ public class TabbedRootUiCoordinator extends RootUiCoordinator {
+                                 if (tab.canGoBack()) {
+                                     return ActionType.NAVIGATE_BACK;
+                                 }
+-                                if (TabAssociatedApp.isOpenedFromExternalApp(tab)) {
+                                if (TabAssociatedApp.isOpenedFromExternalApp(tab) && tab.getLaunchType() == TabLaunchType.FROM_EXTERNAL_APP) {
+                                     return ActionType.EXIT_APP;
+                                 }
+                                 return mBackButtonShouldCloseTabFn.apply(tab)
+                                         ? ActionType.CLOSE_TAB
+-                                        : ActionType.EXIT_APP;
+                                        : ActionType.CLOSE_TAB;
+                             }
+ 
+                             @Override
 diff --git a/chrome/app/extensions_strings.grdp b/chrome/app/extensions_strings.grdp
 --- a/chrome/app/extensions_strings.grdp
 +++ b/chrome/app/extensions_strings.grdp
-@@ -398,7 +398,7 @@
+@@ -404,7 +404,7 @@
     No recent activities
   </message>
   <message name="IDS_EXTENSIONS_NO_INSTALLED_ITEMS" desc="The message shown to the user on the Extensions settings page when there are no extensions or apps installed.">
@@ -9192,7 +9257,7 @@ diff --git a/chrome/app/extensions_strings.grdp b/chrome/app/extensions_strings.
   </message>
   <message name="IDS_EXTENSIONS_NO_DESCRIPTION" desc="The message shown to the user when an extension does not have any description.">
     No description provided
-@@ -536,7 +536,7 @@
+@@ -542,7 +542,7 @@
     My extensions
   </message>
   <message name="IDS_EXTENSIONS_SIDEBAR_DISCOVER_MORE" desc="The text displayed in the sidebar of the chrome://extensions page to open the Chrome Web Store to get more extensions.">
@@ -9204,7 +9269,7 @@ diff --git a/chrome/app/extensions_strings.grdp b/chrome/app/extensions_strings.
 diff --git a/chrome/app/settings_strings.grdp b/chrome/app/settings_strings.grdp
 --- a/chrome/app/settings_strings.grdp
 +++ b/chrome/app/settings_strings.grdp
-@@ -81,7 +81,7 @@
+@@ -84,7 +84,7 @@
     Accessibility
   </message>
   <message name="IDS_SETTINGS_ACCESSIBILITY_WEB_STORE" desc="Text for an external link explaining that additional accessibility features are found on the Chrome Web Store.">
@@ -13158,7 +13223,7 @@ e)fqMZZ`3a)Ds&5H<cfp<0000<MNUMnLSTYHt&Yn8
 diff --git a/chrome/browser/BUILD.gn b/chrome/browser/BUILD.gn
 --- a/chrome/browser/BUILD.gn
 +++ b/chrome/browser/BUILD.gn
-@@ -1895,6 +1895,7 @@ static_library("browser") {
+@@ -1825,6 +1825,7 @@ static_library("browser") {
     "//build/config/chromebox_for_meetings:buildflags",
     "//build/config/compiler:compiler_buildflags",
     "//build/config/linux/dbus:buildflags",
@@ -13166,18 +13231,119 @@ diff --git a/chrome/browser/BUILD.gn b/chrome/browser/BUILD.gn
     "//cc",
     "//chrome:extra_resources",
     "//chrome:resources",
-diff --git a/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureList.java b/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureList.java
--- a/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureList.java
-+++ b/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureList.java
-@@ -1173,7 +1173,7 @@ public abstract class ChromeFeatureList {
-     public static final MutableFlagWithSafeDefault sSuppressToolbarCapturesAtGestureEnd =
-             newMutableFlagWithSafeDefault(SUPPRESS_TOOLBAR_CAPTURES_AT_GESTURE_END, false);
-     public static final MutableFlagWithSafeDefault sSwapNewTabAndNewTabInGroupAndroid =
-            newMutableFlagWithSafeDefault(SWAP_NEW_TAB_AND_NEW_TAB_IN_GROUP_ANDROID, false);
-+            newMutableFlagWithSafeDefault(SWAP_NEW_TAB_AND_NEW_TAB_IN_GROUP_ANDROID, true);
-     public static final MutableFlagWithSafeDefault sTabGroupEntryPointsAndroid =
-             newMutableFlagWithSafeDefault(TAB_GROUP_ENTRY_POINTS_ANDROID, false);
-     public static final MutableFlagWithSafeDefault sTabGroupParityBottomSheetAndroid =
+diff --git a/chrome/browser/hub/internal/android/java/src/org/chromium/chrome/browser/hub/HubToolbarMediator.java b/chrome/browser/hub/internal/android/java/src/org/chromium/chrome/browser/hub/HubToolbarMediator.java
+--- a/chrome/browser/hub/internal/android/java/src/org/chromium/chrome/browser/hub/HubToolbarMediator.java
+++ b/chrome/browser/hub/internal/android/java/src/org/chromium/chrome/browser/hub/HubToolbarMediator.java
+@@ -83,7 +83,7 @@ public class HubToolbarMediator {
+                 @Override
+                 public void onConfigurationChanged(Configuration configuration) {
+                     int screenWidthDp = configuration.screenWidthDp;
+-                    boolean isTablet = HubUtils.isScreenWidthTablet(screenWidthDp);
+                    boolean isTablet = true; //HubUtils.isScreenWidthTablet(screenWidthDp);
+                     mPropertyModel.set(BACK_BUTTON_VISIBLE, isTablet);
+ 
+                     Pane pane = mPaneManager.getFocusedPaneSupplier().get();
+diff --git a/chrome/browser/hub/internal/android/res/layout/hub_toolbar_layout.xml b/chrome/browser/hub/internal/android/res/layout/hub_toolbar_layout.xml
+--- a/chrome/browser/hub/internal/android/res/layout/hub_toolbar_layout.xml
+++ b/chrome/browser/hub/internal/android/res/layout/hub_toolbar_layout.xml
+@@ -38,33 +38,20 @@ found in the LICENSE file.
+         android:layout_width="wrap_content"
+         android:layout_height="match_parent"
+         android:layout_gravity="start|center_vertical">
+-
+-        <Space
+-          android:id="@+id/margin_spacer"
+-          android:layout_width="@dimen/hub_toolbar_action_button_start_margin"
+-          android:layout_height="match_parent"
+-          android:visibility="gone"/>
+-
+-        <org.chromium.ui.widget.ChromeImageButton
+-          android:id="@+id/toolbar_back_button"
+-          android:src="@drawable/ic_arrow_back_24dp"
+-          android:layout_width="@dimen/min_touch_target_size"
+-          android:layout_height="@dimen/min_touch_target_size"
+-          android:layout_gravity="center"
+-          android:layout_marginStart="4dp"
+-          android:contentDescription="@string/back"
+-          android:tooltipText="@string/back"
+-          android:visibility="gone"
+-          style="@style/ToolbarMenuButton"
+-          app:tint="@color/default_icon_color_tint_list"/>
+-
+-        <Button
+-          android:id="@+id/toolbar_action_button"
+-          android:layout_width="wrap_content"
+-          android:layout_height="match_parent"
+-          android:layout_gravity="start|center_vertical"
+-          android:visibility="gone"
+-          style="?attr/newTabButtonStyle"/>
+          <Space
+            android:layout_width="@dimen/hub_toolbar_action_button_start_margin"
+            android:layout_height="match_parent"/>
+          <org.chromium.ui.widget.ChromeImageButton
+            android:id="@+id/search_loupe"
+            android:visibility="gone"
+            android:gravity="center_vertical"
+            android:layout_width="44dp"
+            android:layout_height="match_parent"
+            android:contentDescription="@string/search"
+            android:src="@drawable/ic_search"
+            android:tooltipText="@string/accessibility_search_loupe_tooltip_text"
+            style="@style/ToolbarMenuButton"
+            app:tint="@color/default_icon_color_tint_list" />
+       </LinearLayout>
+ 
+       <FrameLayout
+@@ -96,18 +83,39 @@ found in the LICENSE file.
+         android:layout_width="wrap_content"
+         android:layout_height="match_parent"
+         android:layout_gravity="end" >
+-        <!-- On tablets, the searchbox (R.id.search_box) is hidden in favor of a button. -->
+-        <org.chromium.ui.widget.ChromeImageButton
+-            android:id="@+id/search_loupe"
+        <LinearLayout
+          android:orientation="horizontal"
+          android:layout_width="wrap_content"
+          android:layout_height="match_parent"
+          android:layout_gravity="start|center_vertical">
+
+          <org.chromium.ui.widget.ChromeImageButton
+            android:id="@+id/toolbar_back_button"
+            android:src="@drawable/ic_arrow_back_24dp"
+            android:layout_width="@dimen/min_touch_target_size"
+            android:layout_height="@dimen/min_touch_target_size"
+            android:layout_gravity="center"
+            android:layout_marginStart="4dp"
+            android:contentDescription="@string/back"
+            android:tooltipText="@string/back"
+             android:visibility="gone"
+-            android:gravity="center_vertical"
+-            android:layout_width="44dp"
+-            android:layout_height="match_parent"
+-            android:contentDescription="@string/search"
+-            android:src="@drawable/ic_search"
+-            android:tooltipText="@string/accessibility_search_loupe_tooltip_text"
+             style="@style/ToolbarMenuButton"
+-            app:tint="@color/default_icon_color_tint_list"  />
+            app:tint="@color/default_icon_color_tint_list"/>
+
+          <Button
+            android:id="@+id/toolbar_action_button"
+            android:layout_width="wrap_content"
+            android:layout_height="match_parent"
+            android:layout_gravity="start|center_vertical"
+            android:visibility="gone"
+            style="?attr/newTabButtonStyle"/>
+
+          <Space
+            android:id="@+id/margin_spacer"
+            android:layout_width="@dimen/hub_toolbar_action_button_start_margin"
+            android:layout_height="match_parent"
+            android:visibility="gone"/>
+        </LinearLayout>
+         <include layout="@layout/menu_button" />
+       </LinearLayout>
+ 
 diff --git a/chrome/browser/omaha/android/java/src/org/chromium/chrome/browser/omaha/UpdateConfigs.java b/chrome/browser/omaha/android/java/src/org/chromium/chrome/browser/omaha/UpdateConfigs.java
 --- a/chrome/browser/omaha/android/java/src/org/chromium/chrome/browser/omaha/UpdateConfigs.java
 +++ b/chrome/browser/omaha/android/java/src/org/chromium/chrome/browser/omaha/UpdateConfigs.java
@@ -13199,8 +13365,8 @@ diff --git a/chrome/browser/prefs/BUILD.gn b/chrome/browser/prefs/BUILD.gn
     ":util",
 +    "//build:cromite_buildflags",
     "//chrome/browser:browser_process",
-     "//chrome/browser/devtools",
-     "//chrome/browser/media/prefs",
+     "//chrome/browser:flags",
+     "//chrome/browser/autocomplete:aim_eligibility_service",
 diff --git a/chrome/browser/prefs/chrome_pref_service_factory.cc b/chrome/browser/prefs/chrome_pref_service_factory.cc
 --- a/chrome/browser/prefs/chrome_pref_service_factory.cc
 +++ b/chrome/browser/prefs/chrome_pref_service_factory.cc
@@ -13212,8 +13378,8 @@ diff --git a/chrome/browser/prefs/chrome_pref_service_factory.cc b/chrome/browse
 #include "chrome/browser/browser_process.h"
 #include "chrome/browser/enterprise/signin/enterprise_signin_prefs.h"
 #include "chrome/browser/policy/chrome_browser_policy_connector.h"
-@@ -291,10 +292,7 @@ std::unique_ptr<ProfilePrefStoreManager> CreateProfilePrefStoreManager(
- #endif
+@@ -294,10 +295,7 @@ std::unique_ptr<ProfilePrefStoreManager> CreateProfilePrefStoreManager(
+     const base::FilePath& profile_path) {
   std::string seed;
   CHECK(ui::ResourceBundle::HasSharedInstance());
 -#if BUILDFLAG(GOOGLE_CHROME_BRANDING)
@@ -13221,13 +13387,13 @@ diff --git a/chrome/browser/prefs/chrome_pref_service_factory.cc b/chrome/browse
 -      IDR_PREF_HASH_SEED_BIN));
 -#endif
 +  seed = BUILDFLAG_INTERNAL_CROMITE_PREF_HASH_SEED_BIN();
-   return std::make_unique<ProfilePrefStoreManager>(profile_path, seed,
-                                                    legacy_device_id);
+   return std::make_unique<ProfilePrefStoreManager>(profile_path, seed);
 }
+ 
 diff --git a/chrome/browser/profiles/profile_shortcut_manager_win.cc b/chrome/browser/profiles/profile_shortcut_manager_win.cc
 --- a/chrome/browser/profiles/profile_shortcut_manager_win.cc
 +++ b/chrome/browser/profiles/profile_shortcut_manager_win.cc
-@@ -78,7 +78,7 @@ const int kMaxProfileShortcutFileNameLength = 64;
+@@ -79,7 +79,7 @@ const int kMaxProfileShortcutFileNameLength = 64;
 // Incrementing this number will cause profile icons to be regenerated on
 // profile startup (it should be incremented whenever the product/avatar icons
 // change, etc).
@@ -13258,7 +13424,7 @@ diff --git a/chrome/browser/resources/settings/settings_menu/settings_menu.html
       #menu {
         color: var(--google-grey-700);
         display: flex;
-@@ -164,7 +176,7 @@
+@@ -177,7 +189,7 @@
         </a>
         <a role="menuitem" id="about-menu" href="/help"
             class="cr-nav-menu-item">
@@ -13267,10 +13433,35 @@ diff --git a/chrome/browser/resources/settings/settings_menu/settings_menu.html
           $i18n{aboutPageTitle}
           <cr-ripple></cr-ripple>
         </a>
+diff --git a/chrome/browser/ui/android/omnibox/java/src/org/chromium/chrome/browser/omnibox/suggestions/OmniboxSuggestionsContainer.java b/chrome/browser/ui/android/omnibox/java/src/org/chromium/chrome/browser/omnibox/suggestions/OmniboxSuggestionsContainer.java
+--- a/chrome/browser/ui/android/omnibox/java/src/org/chromium/chrome/browser/omnibox/suggestions/OmniboxSuggestionsContainer.java
+++ b/chrome/browser/ui/android/omnibox/java/src/org/chromium/chrome/browser/omnibox/suggestions/OmniboxSuggestionsContainer.java
+@@ -24,6 +24,7 @@ import org.chromium.base.TraceEvent;
+ import org.chromium.base.metrics.TimingMetric;
+ import org.chromium.base.task.PostTask;
+ import org.chromium.base.task.TaskTraits;
+import org.chromium.base.ui.KeyboardUtils;
+ import org.chromium.build.annotations.NullMarked;
+ import org.chromium.chrome.browser.omnibox.OmniboxMetrics;
+ import org.chromium.chrome.browser.omnibox.R;
+@@ -111,8 +112,11 @@ public class OmniboxSuggestionsContainer extends FrameLayout {
+         // Omnibox.
+         // Making the container `clickable=true` achieves similar goal, but this consumes all
+         // activators, including keyboard <Enter> key.
+-        super.onTouchEvent(event);
+-        return true;
+        if (KeyboardUtils.isAndroidSoftKeyboardShowing(this)) {
+            KeyboardUtils.hideAndroidSoftKeyboard(this);
+            return true;
+        }
+        return false;
+     }
+ 
+     private void maybeUpdateLayoutParams(int topMargin) {
 diff --git a/chrome/browser/ui/android/strings/android_chrome_strings.grd b/chrome/browser/ui/android/strings/android_chrome_strings.grd
 --- a/chrome/browser/ui/android/strings/android_chrome_strings.grd
 +++ b/chrome/browser/ui/android/strings/android_chrome_strings.grd
-@@ -2485,7 +2485,7 @@ Your Google account may have other forms of browsing history like searches and a
+@@ -2380,7 +2380,7 @@ Your Google account may have other forms of browsing history like searches and a
         About Chrome
       </message>
       <message name="IDS_LEGAL_INFORMATION_SUMMARY" desc="Summary for legal information" meaning="Android">
@@ -13279,10 +13470,19 @@ diff --git a/chrome/browser/ui/android/strings/android_chrome_strings.grd b/chro
       </message>
       <message name="IDS_APPLICATION_VERSION_TITLE" desc="Title for application version">
         Application version
+@@ -5845,7 +5845,7 @@ To change this setting, <ph name="BEGIN_LINK">BEGIN_LINK</ph>delete the Chrome d
+ 
+       <!-- Storage Preference UI strings for clearing storage. -->
+       <message name="IDS_STORAGE_MANAGEMENT_ACTIVITY_LABEL" desc="Title for Chrome's Manage Space Activity.">
+-         Google <ph name="APP_NAME">%1$s<ex>Chrome</ex></ph> storage
+         <ph name="APP_NAME">%1$s<ex>Chrome</ex></ph> storage
+       </message>
+       <message name="IDS_STORAGE_MANAGEMENT_UNIMPORTANT_SITE_DATA_DESCRIPTION" desc="Text to describe the data stored by unimportant or infrequent sites.">
+         Stored data that Chrome doesn't think is important (e.g. sites with no saved settings or that you don't visit often)
 diff --git a/chrome/browser/ui/toolbar/chrome_labs/chrome_labs_utils.cc b/chrome/browser/ui/toolbar/chrome_labs/chrome_labs_utils.cc
 --- a/chrome/browser/ui/toolbar/chrome_labs/chrome_labs_utils.cc
 +++ b/chrome/browser/ui/toolbar/chrome_labs/chrome_labs_utils.cc
-@@ -140,6 +140,7 @@ bool AreNewChromeLabsExperimentsAvailable(const ChromeLabsModel* model,
+@@ -140,6 +140,7 @@ bool AreNewChromeLabsExperimentsAvailable(Profile* profile) {
 }
 
 bool IsChromeLabsEnabled() {
@@ -13302,7 +13502,7 @@ diff --git a/chrome/common/url_constants.h b/chrome/common/url_constants.h
 #if BUILDFLAG(IS_CHROMEOS)
 inline constexpr char kChromeOsHelpViaWebUIURL[] =
 #if BUILDFLAG(GOOGLE_CHROME_BRANDING)
-@@ -198,7 +198,7 @@ inline constexpr char kChromeUIUntrustedNewTabPageUrl[] =
+@@ -193,7 +193,7 @@ inline constexpr char kChromeUIUntrustedNewTabPageUrl[] =
     "chrome-untrusted://new-tab-page/";
 
 // The URL for the Chromium project used in the About dialog.
@@ -13326,7 +13526,7 @@ diff --git a/chrome/install_static/chromium_install_modes.cc b/chrome/install_st
 diff --git a/components/browser_ui/strings/android/browser_ui_strings.grd b/components/browser_ui/strings/android/browser_ui_strings.grd
 --- a/components/browser_ui/strings/android/browser_ui_strings.grd
 +++ b/components/browser_ui/strings/android/browser_ui_strings.grd
-@@ -992,7 +992,7 @@
+@@ -1020,7 +1020,7 @@
 
       <!-- Accessibility preferences -->
       <message name="IDS_PREFS_ACCESSIBILITY" desc="Title of Accessibility settings, which allows the user to change webpage font sizes. [CHAR_LIMIT=32]">
@@ -18231,6 +18431,17 @@ z-aP~TXJZ`-(Yg4YH}L#8=YM{CKWmuBV|oH(e6M*W+WLnfYBCzOQRGLiPvyZq6&Nv6
 z4G!>zy1hcOdP%7GG2>1P`Or}=o{p{?6G1~J{`Cl{gUX-*clf=;TVY)N<lVO9k)vG$
 i?Ib$(ofrX17!1R|`h|N%TnD<%35@j2bgPM^i2nno*_EOI

+diff --git a/components/omnibox/browser/autocomplete_controller.cc b/components/omnibox/browser/autocomplete_controller.cc
+--- a/components/omnibox/browser/autocomplete_controller.cc
+++ b/components/omnibox/browser/autocomplete_controller.cc
+@@ -1106,6 +1106,7 @@ bool AutocompleteController::ShouldRunProvider(
+ 
+ #if BUILDFLAG(IS_ANDROID)
+   if (omnibox::IsAndroidHub(input_.current_page_classification())) {
+    if ((true)) return provider->type() == AutocompleteProvider::TYPE_OPEN_TAB;
+     return provider->type() == AutocompleteProvider::TYPE_SEARCH ||
+            provider->type() == AutocompleteProvider::TYPE_OPEN_TAB ||
+            provider->type() == AutocompleteProvider::TYPE_BOOKMARK ||
 diff --git a/components/omnibox/browser/vector_icons/product_chrome_refresh.icon b/components/omnibox/browser/vector_icons/product_chrome_refresh.icon
 --- a/components/omnibox/browser/vector_icons/product_chrome_refresh.icon
 +++ b/components/omnibox/browser/vector_icons/product_chrome_refresh.icon
@@ -18332,6 +18543,18 @@ diff --git a/components/omnibox/browser/vector_icons/product_chrome_refresh.icon
 +CLOSE,
 +MOVE_TO, 11.2f, 8,
 CLOSE
+diff --git a/components/policy/core/common/policy_paths.cc b/components/policy/core/common/policy_paths.cc
+--- a/components/policy/core/common/policy_paths.cc
+++ b/components/policy/core/common/policy_paths.cc
+@@ -18,7 +18,7 @@ const char kPolicyPath[] = "/etc/opt/chrome/policies";
+ #elif BUILDFLAG(GOOGLE_CHROME_FOR_TESTING_BRANDING)
+ const char kPolicyPath[] = "/etc/opt/chrome_for_testing/policies";
+ #else
+-const char kPolicyPath[] = "/etc/chromium/policies";
+const char kPolicyPath[] = "/etc/cromite/policies";
+ #endif  // BUILDFLAG(GOOGLE_CHROME_BRANDING)
+ #endif  // BUILDFLAG(IS_POSIX) && !BUILDFLAG(IS_MAC)
+ 
 diff --git a/components/resources/default_100_percent/chromium/product_logo.png b/components/resources/default_100_percent/chromium/product_logo.png
 index 7b60bd8c6053346e4eb265cc77d28add65103028..66b3c4c7a4f68fba1ef098000bd373ba103a0de0 100644
 GIT binary patch
@@ -18972,7 +19195,7 @@ diff --git a/components/webui/version/resources/about_version_mobile.css b/compo
 diff --git a/content/child/runtime_features.cc b/content/child/runtime_features.cc
 --- a/content/child/runtime_features.cc
 +++ b/content/child/runtime_features.cc
-@@ -570,19 +570,22 @@ void ResolveInvalidConfigurations() {
+@@ -573,19 +573,22 @@ void ResolveInvalidConfigurations() {
        base::FeatureList::IsEnabled(
            features::kPrivacySandboxAdsAPIsM1Override)) &&
       !base::FeatureList::IsEnabled(blink::features::kFencedFrames)) {
@@ -18999,7 +19222,7 @@ diff --git a/content/child/runtime_features.cc b/content/child/runtime_features.
         << "Fenced frames must be enabled in order to enable local "
            "unpartitioned "
         << "data access. Use --" << switches::kEnableFeatures << "="
-@@ -590,12 +593,14 @@ void ResolveInvalidConfigurations() {
+@@ -593,12 +596,14 @@ void ResolveInvalidConfigurations() {
     WebRuntimeFeatures::EnableFeatureFromString(
         "FencedFramesLocalUnpartitionedDataAccess", false);
   }
@@ -19015,7 +19238,7 @@ diff --git a/content/child/runtime_features.cc b/content/child/runtime_features.
         << "Topics cannot be enabled in this configuration. Use --"
         << switches::kEnableFeatures << "="
         << network::features::kBrowsingTopics.name << " in addition.";
-@@ -603,30 +608,23 @@ void ResolveInvalidConfigurations() {
+@@ -606,30 +611,23 @@ void ResolveInvalidConfigurations() {
     WebRuntimeFeatures::EnableTopicsDocumentAPI(false);
     WebRuntimeFeatures::EnableTopicsImgAPI(false);
   } else {
@@ -19052,7 +19275,7 @@ diff --git a/content/child/runtime_features.cc b/content/child/runtime_features.
         << "AttributionReporting cannot be enabled in this "
            "configuration. Use --"
         << switches::kEnableFeatures << "="
-@@ -634,23 +632,25 @@ void ResolveInvalidConfigurations() {
+@@ -637,23 +635,25 @@ void ResolveInvalidConfigurations() {
         << " in addition.";
     WebRuntimeFeatures::EnableAttributionReporting(false);
   }
@@ -19086,8 +19309,9 @@ diff --git a/cromite_flags/chrome/browser/flags/android/chrome_feature_list_cc/C
 new file mode 100644
 --- /dev/null
 +++ b/cromite_flags/chrome/browser/flags/android/chrome_feature_list_cc/Cromite-Branding.inc
-@@ -0,0 +1 @@
-+SET_CROMITE_FEATURE_DISABLED(kSwapNewTabAndNewTabInGroupAndroid);
+@@ -0,0 +1,2 @@
+SET_CROMITE_FEATURE_ENABLED(kAndroidTabDeclutterArchiveAllButActiveTab);
+SET_CROMITE_FEATURE_ENABLED(kGridTabSwitcherUpdate);
 diff --git a/tools/grit/grit/grd_reader.py b/tools/grit/grit/grd_reader.py
 --- a/tools/grit/grit/grd_reader.py
 +++ b/tools/grit/grit/grd_reader.py
@@ -7,23 +7,67 @@ Opens tabs in foreground,  Move web search to the top of items,
 Web search in tab group and Enable smart text selection
 License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 ---
- .../browser/ChromeActionModeHandler.java      |   4 +-
- .../chrome/browser/ChromeTabbedActivity.java  |  15 +-
- ...ActivityTabWebContentsDelegateAndroid.java |  10 +-
- .../compositor/layouts/LayoutManagerImpl.java |   8 ++
- .../tab/TabContextMenuItemDelegate.java       |   7 +-
- .../chrome/browser/ui/RootUiCoordinator.java  |   8 +-
- .../Customize-selection-popup.grdp            |  34 +++++
- .../res/xml/accessibility_preferences.xml     |  24 ++++
- .../selection/SelectActionMenuHelper.java     | 129 ++++++++++++------
- .../selection/SmartSelectionClient.java       |   4 +
- 10 files changed, 192 insertions(+), 51 deletions(-)
+ .../SamsungSelectionActionMenuDelegate.java   |  7 +-
+ .../browser/ChromeActionModeHandler.java      |  4 +-
+ .../chrome/browser/ChromeTabbedActivity.java  | 15 +++-
+ ...ActivityTabWebContentsDelegateAndroid.java | 10 ++-
+ .../compositor/layouts/LayoutManagerImpl.java |  8 ++
+ .../tab/TabContextMenuItemDelegate.java       |  7 +-
+ .../chrome/browser/ui/RootUiCoordinator.java  |  8 +-
+ .../Customize-selection-popup.grdp            | 34 +++++++++
+ .../AutofillSelectionMenuItemHelper.java      |  4 +-
+ .../res/xml/accessibility_preferences.xml     | 24 ++++++
+ .../selection/SelectActionMenuHelper.java     | 20 ++---
+ .../SelectionPopupControllerImpl.java         |  2 +-
+ .../selection/SmartSelectionClient.java       |  4 +
+ .../browser/PendingSelectionMenu.java         |  8 +-
+ .../browser/SelectionMenuItem.java            | 73 ++++++++++++-------
+ .../SelectionActionMenuDelegate.java          | 32 +++++---
+ 16 files changed, 194 insertions(+), 66 deletions(-)
 create mode 100644 chrome/browser/ui/android/strings/cromite_android_chrome_strings_grd/Customize-selection-popup.grdp

+diff --git a/android_webview/java/src/org/chromium/android_webview/selection/SamsungSelectionActionMenuDelegate.java b/android_webview/java/src/org/chromium/android_webview/selection/SamsungSelectionActionMenuDelegate.java
+--- a/android_webview/java/src/org/chromium/android_webview/selection/SamsungSelectionActionMenuDelegate.java
+++ b/android_webview/java/src/org/chromium/android_webview/selection/SamsungSelectionActionMenuDelegate.java
+@@ -134,7 +134,7 @@ public class SamsungSelectionActionMenuDelegate extends AutofillSelectionActionM
+                             .setIcon(null)
+                             .setOrderAndCategory(
+                                     Menu.CATEGORY_SECONDARY,
+-                                    SelectionMenuItem.ItemGroupOffset.TEXT_PROCESSING_ITEMS)
+                                    SelectionMenuItem.ItemGroupOffset.TEXT_PROCESSING_ITEMS())
+                             .setShowAsActionFlags(MenuItem.SHOW_AS_ACTION_IF_ROOM)
+                             .setIntent(createManageAppsIntent())
+                             .build());
+@@ -167,7 +167,7 @@ public class SamsungSelectionActionMenuDelegate extends AutofillSelectionActionM
+                             .setShowAsActionFlags(MenuItem.SHOW_AS_ACTION_IF_ROOM)
+                             .setOrderAndCategory(
+                                     DefaultItem.PASTE, // Show after paste.
+-                                    SelectionMenuItem.ItemGroupOffset.DEFAULT_ITEMS)
+                                    SelectionMenuItem.ItemGroupOffset.DEFAULT_ITEMS())
+                             .setIntent(
+                                     getTranslationActionIntent(selectedText, translateResolveInfo))
+                             .build());
+@@ -180,7 +180,7 @@ public class SamsungSelectionActionMenuDelegate extends AutofillSelectionActionM
+                             .setShowAsActionFlags(MenuItem.SHOW_AS_ACTION_ALWAYS)
+                             .setOrderAndCategory(
+                                     Menu.FIRST, // Show as first item after primary assist item.
+-                                    SelectionMenuItem.ItemGroupOffset.ASSIST_ITEMS)
+                                    SelectionMenuItem.ItemGroupOffset.ASSIST_ITEMS())
+                             .setIntent(
+                                     createWritingToolkitIntent(selectedText, isSelectionReadOnly))
+                             .build());
+@@ -239,6 +239,7 @@ public class SamsungSelectionActionMenuDelegate extends AutofillSelectionActionM
+     }
+ 
+     public static boolean shouldUseSamsungMenuItemOrdering() {
+        if ((true)) return false;
+         return Build.VERSION.SDK_INT <= MAXIMUM_BUILD_VERSION_CODE_SUPPORTED && isSamsungDevice();
+     }
+ 
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ChromeActionModeHandler.java b/chrome/android/java/src/org/chromium/chrome/browser/ChromeActionModeHandler.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/ChromeActionModeHandler.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/ChromeActionModeHandler.java
-@@ -166,9 +166,7 @@ public class ChromeActionModeHandler {
+@@ -173,9 +173,7 @@ public class ChromeActionModeHandler {
                             | ActionModeCallbackHelper.MENU_ITEM_SHARE;
             // Disable options that expose additional Chrome functionality prior to the FRE being
             // completed (i.e. creation of a new tab).
@@ -37,7 +81,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ChromeActionMod
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java b/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java
-@@ -803,10 +803,17 @@ public class ChromeTabbedActivity extends ChromeActivity {
+@@ -897,10 +897,17 @@ public class ChromeTabbedActivity extends ChromeActivity implements PreAttachInt
                                 @TabLaunchType int type,
                                 @TabCreationState int creationState,
                                 boolean markedForSelection) {
@@ -62,7 +106,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedAct
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/app/tab_activity_glue/ActivityTabWebContentsDelegateAndroid.java b/chrome/android/java/src/org/chromium/chrome/browser/app/tab_activity_glue/ActivityTabWebContentsDelegateAndroid.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/app/tab_activity_glue/ActivityTabWebContentsDelegateAndroid.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/app/tab_activity_glue/ActivityTabWebContentsDelegateAndroid.java
-@@ -202,6 +202,14 @@ public class ActivityTabWebContentsDelegateAndroid extends TabWebContentsDelegat
+@@ -250,6 +250,14 @@ public class ActivityTabWebContentsDelegateAndroid extends TabWebContentsDelegat
         // Skip opening a new Tab if it doesn't make sense.
         if (mTab.isClosing()) return false;
 
@@ -74,22 +118,22 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/app/tab_activit
 +            tabLaunchType = TabLaunchType.FROM_LONGPRESS_BACKGROUND_IN_GROUP;
 +        }
 +
+         WindowAndroid window = mTab.getWindowAndroid();
         boolean openingPopup =
-                 PopupCreator.arePopupsEnabled(mActivity)
-                         && (disposition == WindowOpenDisposition.NEW_POPUP);
-@@ -225,7 +233,7 @@ public class ActivityTabWebContentsDelegateAndroid extends TabWebContentsDelegat
-                 tabCreator.createTabWithWebContents(
+                 window != null
+@@ -294,7 +302,7 @@ public class ActivityTabWebContentsDelegateAndroid extends TabWebContentsDelegat
                         mTab,
+                         /* shouldPin= */ false,
                         webContents,
 -                        TabLaunchType.FROM_LONGPRESS_FOREGROUND,
 +                        tabLaunchType,
-                         url,
+                         targetUrl,
                         !openingPopup && !willReparentTab);
         if (tab == null) return false;
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/compositor/layouts/LayoutManagerImpl.java b/chrome/android/java/src/org/chromium/chrome/browser/compositor/layouts/LayoutManagerImpl.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/compositor/layouts/LayoutManagerImpl.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/compositor/layouts/LayoutManagerImpl.java
-@@ -18,6 +18,7 @@ import androidx.annotation.Nullable;
+@@ -18,6 +18,7 @@ import android.view.ViewGroup;
 import androidx.annotation.VisibleForTesting;
 
 import org.chromium.base.Callback;
@@ -97,7 +141,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/compositor/layo
 import org.chromium.base.ObserverList;
 import org.chromium.base.TraceEvent;
 import org.chromium.base.supplier.ObservableSupplier;
-@@ -246,6 +247,13 @@ public class LayoutManagerImpl
+@@ -247,6 +248,13 @@ public class LayoutManagerImpl
                                                 != TabLaunchType
                                                         .FROM_COLLABORATION_BACKGROUND_IN_GROUP)
                                 || (!getTabModelSelector().isIncognitoSelected() && incognito);
@@ -114,8 +158,8 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/compositor/layo
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tab/TabContextMenuItemDelegate.java b/chrome/android/java/src/org/chromium/chrome/browser/tab/TabContextMenuItemDelegate.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/tab/TabContextMenuItemDelegate.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/tab/TabContextMenuItemDelegate.java
-@@ -372,8 +372,13 @@ public class TabContextMenuItemDelegate implements ContextMenuItemDelegate {
-     public void onOpenImageInNewTab(GURL url, Referrer referrer) {
+@@ -430,8 +430,13 @@ public class TabContextMenuItemDelegate implements ContextMenuItemDelegate {
+     public void onOpenImageInNewTab(GURL url, @Nullable Referrer referrer) {
         LoadUrlParams loadUrlParams = new LoadUrlParams(url.getSpec());
         loadUrlParams.setReferrer(referrer);
 +        @TabLaunchType int type = TabLaunchType.FROM_LONGPRESS_BACKGROUND;
@@ -132,15 +176,15 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tab/TabContextM
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ui/RootUiCoordinator.java b/chrome/android/java/src/org/chromium/chrome/browser/ui/RootUiCoordinator.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/ui/RootUiCoordinator.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/ui/RootUiCoordinator.java
-@@ -29,6 +29,7 @@ import androidx.core.view.WindowInsetsCompat;
- import org.chromium.base.BuildInfo;
+@@ -33,6 +33,7 @@ import androidx.core.view.WindowInsetsCompat;
 import org.chromium.base.Callback;
 import org.chromium.base.CallbackController;
+ import org.chromium.base.DeviceInfo;
 +import org.chromium.base.ContextUtils;
 import org.chromium.base.TraceEvent;
 import org.chromium.base.lifetime.Destroyable;
 import org.chromium.base.metrics.RecordUserAction;
-@@ -795,11 +796,16 @@ public class RootUiCoordinator
+@@ -1021,11 +1022,16 @@ public class RootUiCoordinator
                     TrackerFactory.getTrackerForProfile(tab.getProfile())
                             .notifyEvent(EventConstants.WEB_SEARCH_PERFORMED);
 
@@ -197,10 +241,31 @@ new file mode 100644
 +        Smart Text selection automatically augments the selected boundaries and classifies the selected text based on the context by sending selection together with its surrounding text
 +    </message>
 +</grit-part>
+diff --git a/components/android_autofill/browser/java/src/org/chromium/components/autofill/AutofillSelectionMenuItemHelper.java b/components/android_autofill/browser/java/src/org/chromium/components/autofill/AutofillSelectionMenuItemHelper.java
+--- a/components/android_autofill/browser/java/src/org/chromium/components/autofill/AutofillSelectionMenuItemHelper.java
+++ b/components/android_autofill/browser/java/src/org/chromium/components/autofill/AutofillSelectionMenuItemHelper.java
+@@ -39,7 +39,7 @@ public class AutofillSelectionMenuItemHelper {
+                             .setGroupId(R.id.select_action_menu_delegate_items)
+                             .setOrderAndCategory(
+                                     Menu.FIRST,
+-                                    SelectionMenuItem.ItemGroupOffset.SECONDARY_ASSIST_ITEMS)
+                                    SelectionMenuItem.ItemGroupOffset.SECONDARY_ASSIST_ITEMS())
+                             .setShowAsActionFlags(
+                                     MenuItem.SHOW_AS_ACTION_ALWAYS
+                                             | MenuItem.SHOW_AS_ACTION_WITH_TEXT)
+@@ -52,7 +52,7 @@ public class AutofillSelectionMenuItemHelper {
+                             .setGroupId(R.id.select_action_menu_delegate_items)
+                             .setOrderAndCategory(
+                                     Menu.CATEGORY_SECONDARY, // Show at end of section.
+-                                    SelectionMenuItem.ItemGroupOffset.SECONDARY_ASSIST_ITEMS)
+                                    SelectionMenuItem.ItemGroupOffset.SECONDARY_ASSIST_ITEMS())
+                             .setShowAsActionFlags(
+                                     MenuItem.SHOW_AS_ACTION_NEVER
+                                             | MenuItem.SHOW_AS_ACTION_WITH_TEXT)
 diff --git a/components/browser_ui/accessibility/android/java/res/xml/accessibility_preferences.xml b/components/browser_ui/accessibility/android/java/res/xml/accessibility_preferences.xml
 --- a/components/browser_ui/accessibility/android/java/res/xml/accessibility_preferences.xml
 +++ b/components/browser_ui/accessibility/android/java/res/xml/accessibility_preferences.xml
-@@ -79,4 +79,28 @@ found in the LICENSE file.
+@@ -84,4 +84,28 @@ found in the LICENSE file.
         android:key="disable_toolbar_swipeup"
         android:title="@string/disable_toolbar_swipe_up" />
 
@@ -232,31 +297,178 @@ diff --git a/components/browser_ui/accessibility/android/java/res/xml/accessibil
 diff --git a/content/public/android/java/src/org/chromium/content/browser/selection/SelectActionMenuHelper.java b/content/public/android/java/src/org/chromium/content/browser/selection/SelectActionMenuHelper.java
 --- a/content/public/android/java/src/org/chromium/content/browser/selection/SelectActionMenuHelper.java
 +++ b/content/public/android/java/src/org/chromium/content/browser/selection/SelectActionMenuHelper.java
-@@ -27,6 +27,7 @@ import androidx.core.content.ContextCompat;
- import org.chromium.base.ApiCompatibilityUtils;
- import org.chromium.base.ContextUtils;
- import org.chromium.base.Log;
-+import org.chromium.base.ContextUtils;
- import org.chromium.base.PackageManagerUtils;
- import org.chromium.base.StrictModeContext;
- import org.chromium.build.annotations.NullMarked;
-@@ -54,38 +55,84 @@ import java.util.TreeSet;
- public class SelectActionMenuHelper {
-     private static final String TAG = "SelectActionMenu"; // 20 char limit.
+@@ -169,7 +169,7 @@ public class SelectActionMenuHelper {
+         return new SelectionMenuItem.Builder(primaryAction.getTitle())
+                 .setId(android.R.id.textAssist)
+                 .setGroupId(R.id.select_action_menu_assist_items)
+-                .setOrderAndCategory(0, ItemGroupOffset.ASSIST_ITEMS)
+                .setOrderAndCategory(0, ItemGroupOffset.ASSIST_ITEMS())
+                 .setIcon(getPrimaryActionIconForClassificationResult(classificationResult, context))
+                 .setShowAsActionFlags(MenuItem.SHOW_AS_ACTION_IF_ROOM)
+                 .build();
+@@ -247,7 +247,7 @@ public class SelectActionMenuHelper {
+                             .setGroupId(groupId)
+                             .setIcon(icons == null ? null : icons.get(i))
+                             .setOrderAndCategory(
+-                                    i - startIndex, ItemGroupOffset.SECONDARY_ASSIST_ITEMS)
+                                    i - startIndex, ItemGroupOffset.SECONDARY_ASSIST_ITEMS())
+                             .setContentDescription(action.getContentDescription())
+                             .setShowAsActionFlags(MenuItem.SHOW_AS_ACTION_IF_ROOM)
+                             .build();
+@@ -296,7 +296,7 @@ public class SelectActionMenuHelper {
+                             .setId(Menu.NONE)
+                             .setGroupId(R.id.select_action_menu_text_processing_items)
+                             .setIcon(icon)
+-                            .setOrderAndCategory(i, ItemGroupOffset.TEXT_PROCESSING_ITEMS)
+                            .setOrderAndCategory(i, ItemGroupOffset.TEXT_PROCESSING_ITEMS())
+                             .setShowAsActionFlags(MenuItem.SHOW_AS_ACTION_IF_ROOM)
+                             .setIntent(intent)
+                             .build());
+@@ -341,7 +341,7 @@ public class SelectActionMenuHelper {
+                 .setGroupId(R.id.select_action_menu_default_items)
+                 .setIconAttr(android.R.attr.actionModeCutDrawable)
+                 .setAlphabeticShortcut(ItemKeyShortcuts.CUT)
+-                .setOrderAndCategory(order, ItemGroupOffset.DEFAULT_ITEMS)
+                .setOrderAndCategory(order, ItemGroupOffset.DEFAULT_ITEMS())
+                 .setShowAsActionFlags(
+                         MenuItem.SHOW_AS_ACTION_ALWAYS | MenuItem.SHOW_AS_ACTION_WITH_TEXT)
+                 .setIsEnabled(true)
+@@ -355,7 +355,7 @@ public class SelectActionMenuHelper {
+                 .setGroupId(R.id.select_action_menu_default_items)
+                 .setIconAttr(android.R.attr.actionModeCopyDrawable)
+                 .setAlphabeticShortcut(ItemKeyShortcuts.COPY)
+-                .setOrderAndCategory(order, ItemGroupOffset.DEFAULT_ITEMS)
+                .setOrderAndCategory(order, ItemGroupOffset.DEFAULT_ITEMS())
+                 .setShowAsActionFlags(
+                         MenuItem.SHOW_AS_ACTION_ALWAYS | MenuItem.SHOW_AS_ACTION_WITH_TEXT)
+                 .setIsEnabled(true)
+@@ -369,7 +369,7 @@ public class SelectActionMenuHelper {
+                 .setGroupId(R.id.select_action_menu_default_items)
+                 .setIconAttr(android.R.attr.actionModePasteDrawable)
+                 .setAlphabeticShortcut(ItemKeyShortcuts.PASTE)
+-                .setOrderAndCategory(order, ItemGroupOffset.DEFAULT_ITEMS)
+                .setOrderAndCategory(order, ItemGroupOffset.DEFAULT_ITEMS())
+                 .setShowAsActionFlags(
+                         MenuItem.SHOW_AS_ACTION_ALWAYS | MenuItem.SHOW_AS_ACTION_WITH_TEXT)
+                 .setIsEnabled(true)
+@@ -385,7 +385,7 @@ public class SelectActionMenuHelper {
+                 .setId(R.id.select_action_menu_share)
+                 .setGroupId(R.id.select_action_menu_default_items)
+                 .setIconAttr(android.R.attr.actionModeShareDrawable)
+-                .setOrderAndCategory(order, ItemGroupOffset.DEFAULT_ITEMS)
+                .setOrderAndCategory(order, ItemGroupOffset.DEFAULT_ITEMS())
+                 .setShowAsActionFlags(
+                         MenuItem.SHOW_AS_ACTION_ALWAYS | MenuItem.SHOW_AS_ACTION_WITH_TEXT)
+                 .setIsEnabled(true)
+@@ -399,7 +399,7 @@ public class SelectActionMenuHelper {
+                 .setGroupId(R.id.select_action_menu_default_items)
+                 .setIconAttr(android.R.attr.actionModeSelectAllDrawable)
+                 .setAlphabeticShortcut(ItemKeyShortcuts.SELECT_ALL)
+-                .setOrderAndCategory(order, ItemGroupOffset.DEFAULT_ITEMS)
+                .setOrderAndCategory(order, ItemGroupOffset.DEFAULT_ITEMS())
+                 .setShowAsActionFlags(
+                         MenuItem.SHOW_AS_ACTION_ALWAYS | MenuItem.SHOW_AS_ACTION_WITH_TEXT)
+                 .setIsEnabled(true)
+@@ -412,7 +412,7 @@ public class SelectActionMenuHelper {
+                 new SelectionMenuItem.Builder(android.R.string.paste_as_plain_text)
+                         .setId(R.id.select_action_menu_paste_as_plain_text)
+                         .setGroupId(R.id.select_action_menu_default_items)
+-                        .setOrderAndCategory(order, ItemGroupOffset.DEFAULT_ITEMS)
+                        .setOrderAndCategory(order, ItemGroupOffset.DEFAULT_ITEMS())
+                         .setShowAsActionFlags(
+                                 MenuItem.SHOW_AS_ACTION_ALWAYS | MenuItem.SHOW_AS_ACTION_WITH_TEXT)
+                         .setIsEnabled(true);
+@@ -432,7 +432,7 @@ public class SelectActionMenuHelper {
+                 .setId(R.id.select_action_menu_web_search)
+                 .setGroupId(R.id.select_action_menu_default_items)
+                 .setIconAttr(android.R.attr.actionModeWebSearchDrawable)
+-                .setOrderAndCategory(order, ItemGroupOffset.DEFAULT_ITEMS)
+                .setOrderAndCategory(order, ItemGroupOffset.DEFAULT_ITEMS())
+                 .setShowAsActionFlags(
+                         MenuItem.SHOW_AS_ACTION_ALWAYS | MenuItem.SHOW_AS_ACTION_WITH_TEXT)
+                 .setIsEnabled(true)
+diff --git a/content/public/android/java/src/org/chromium/content/browser/selection/SelectionPopupControllerImpl.java b/content/public/android/java/src/org/chromium/content/browser/selection/SelectionPopupControllerImpl.java
+--- a/content/public/android/java/src/org/chromium/content/browser/selection/SelectionPopupControllerImpl.java
+++ b/content/public/android/java/src/org/chromium/content/browser/selection/SelectionPopupControllerImpl.java
+@@ -1114,7 +1114,7 @@ public class SelectionPopupControllerImpl extends ActionModeCallbackHelper
 
+     private boolean handleAssistMenuItemClick(int order) {
+         // Primary assist action is always the first action in the list so offset by 1.
+-        int index = 1 + order - SelectionMenuItem.ItemGroupOffset.SECONDARY_ASSIST_ITEMS;
+        int index = 1 + order - SelectionMenuItem.ItemGroupOffset.SECONDARY_ASSIST_ITEMS();
+         if (mClassificationResult == null
+                 || mClassificationResult.textClassification == null
+                 || mClassificationResult.textClassification.getActions().size() <= index) {
+diff --git a/content/public/android/java/src/org/chromium/content/browser/selection/SmartSelectionClient.java b/content/public/android/java/src/org/chromium/content/browser/selection/SmartSelectionClient.java
+--- a/content/public/android/java/src/org/chromium/content/browser/selection/SmartSelectionClient.java
+++ b/content/public/android/java/src/org/chromium/content/browser/selection/SmartSelectionClient.java
+@@ -18,6 +18,7 @@ import org.jni_zero.CalledByNative;
+ import org.jni_zero.JNINamespace;
+ import org.jni_zero.NativeMethods;
+ 
+import org.chromium.base.ContextUtils;
+ import org.chromium.base.ObserverList;
+ import org.chromium.base.UserData;
+ import org.chromium.build.annotations.Initializer;
+@@ -84,6 +85,9 @@ public class SmartSelectionClient implements SelectionClient, UserData {
+             return null;
+         }
+ 
+        if (!ContextUtils.getAppSharedPreferences().getBoolean(
+                "selection_popup_smart_text", false)) return null;
+
+         SmartSelectionClient client =
+                 assumeNonNull(
+                         webContents.getOrSetUserData(
+diff --git a/content/public/android/java/src/org/chromium/content_public/browser/PendingSelectionMenu.java b/content/public/android/java/src/org/chromium/content_public/browser/PendingSelectionMenu.java
+--- a/content/public/android/java/src/org/chromium/content_public/browser/PendingSelectionMenu.java
+++ b/content/public/android/java/src/org/chromium/content_public/browser/PendingSelectionMenu.java
+@@ -165,13 +165,13 @@ public final class PendingSelectionMenu {
+     @VisibleForTesting
+     public @LogicalGroup int determineGroup(SelectionMenuItem item) {
+         int order = item.order;
+-        if (order >= ItemGroupOffset.TEXT_PROCESSING_ITEMS) {
+        if (order >= ItemGroupOffset.TEXT_PROCESSING_ITEMS()) {
+             return LogicalGroup.TEXT_PROCESSING_ITEMS;
+-        } else if (order >= ItemGroupOffset.SECONDARY_ASSIST_ITEMS) {
+        } else if (order >= ItemGroupOffset.SECONDARY_ASSIST_ITEMS()) {
+             return LogicalGroup.SECONDARY_ASSIST_ITEMS;
+-        } else if (order >= ItemGroupOffset.DEFAULT_ITEMS) {
+        } else if (order >= ItemGroupOffset.DEFAULT_ITEMS()) {
+             return LogicalGroup.DEFAULT_ITEMS;
+-        } else if (order >= ItemGroupOffset.ASSIST_ITEMS) {
+        } else if (order >= ItemGroupOffset.ASSIST_ITEMS()) {
+             return LogicalGroup.ASSIST_ITEMS;
+         }
+         throw new IllegalStateException("Invalid order. Must be >= 0");
+diff --git a/content/public/android/java/src/org/chromium/content_public/browser/SelectionMenuItem.java b/content/public/android/java/src/org/chromium/content_public/browser/SelectionMenuItem.java
+--- a/content/public/android/java/src/org/chromium/content_public/browser/SelectionMenuItem.java
+++ b/content/public/android/java/src/org/chromium/content_public/browser/SelectionMenuItem.java
+@@ -18,6 +18,7 @@ import androidx.annotation.IntDef;
+ import androidx.annotation.StringRes;
+ import androidx.appcompat.content.res.AppCompatResources;
+ 
+import org.chromium.base.ContextUtils;
+ import org.chromium.build.annotations.NullMarked;
+ import org.chromium.build.annotations.Nullable;
+ 
+@@ -34,18 +35,38 @@ public final class SelectionMenuItem implements Comparable<SelectionMenuItem> {
+      * less than SECONDARY_ASSIST_ITEMS will appear in the default items section. Each section is
+      * separated by a divider in dropdown menus.
+      */
 -    @Retention(RetentionPolicy.SOURCE)
 -    @IntDef({
-        GroupItemOrder.ASSIST_ITEMS,
-        GroupItemOrder.DEFAULT_ITEMS,
-        GroupItemOrder.SECONDARY_ASSIST_ITEMS,
-        GroupItemOrder.TEXT_PROCESSING_ITEMS
+-        ItemGroupOffset.ASSIST_ITEMS,
+-        ItemGroupOffset.DEFAULT_ITEMS,
+-        ItemGroupOffset.SECONDARY_ASSIST_ITEMS,
+-        ItemGroupOffset.TEXT_PROCESSING_ITEMS
 -    })
-    public @interface GroupItemOrder {
-        int ASSIST_ITEMS = 1;
-        int DEFAULT_ITEMS = 2;
-        int SECONDARY_ASSIST_ITEMS = 3;
-        int TEXT_PROCESSING_ITEMS = 4;
-+    private static class GroupItemOrderChromium {
+-    public @interface ItemGroupOffset {
+-        int ASSIST_ITEMS = 0;
+-        int DEFAULT_ITEMS = 10;
+-        int SECONDARY_ASSIST_ITEMS = 20;
+-        int TEXT_PROCESSING_ITEMS = 30;
+    public static class ItemGroupOffset {
 +        static int CHROMIUM_ASSIST_ITEMS = 1;
 +        static int CHROMIUM_DEFAULT_ITEMS = 2;
 +        static int CHROMIUM_SECONDARY_ASSIST_ITEMS = 3;
@@ -290,189 +502,93 @@ diff --git a/content/public/android/java/src/org/chromium/content/browser/select
 +        }
     }
 
-    @Retention(RetentionPolicy.SOURCE)
-    @IntDef({
-        DefaultItemOrder.CUT,
-        DefaultItemOrder.COPY,
-        DefaultItemOrder.PASTE,
-        DefaultItemOrder.PASTE_AS_PLAIN_TEXT,
-        DefaultItemOrder.SHARE,
-        DefaultItemOrder.SELECT_ALL,
-        DefaultItemOrder.WEB_SEARCH
-    })
-    public @interface DefaultItemOrder {
-        int CUT = 1;
-        int COPY = 2;
-        int PASTE = 3;
-        int PASTE_AS_PLAIN_TEXT = 4;
-        int SHARE = 5;
-        int SELECT_ALL = 6;
-        int WEB_SEARCH = 7;
-+    private static class DefaultItemOrderChromium {
-+        static int CHROMIUM_CUT = 1;
-+        static int CHROMIUM_COPY = 2;
-+        static int CHROMIUM_PASTE = 3;
-+        static int CHROMIUM_SHARE = 4;
-+        static int CHROMIUM_SELECT_ALL = 5;
-+        static int CHROMIUM_PASTE_AS_PLAIN_TEXT = 6;
-+        static int CHROMIUM_WEB_SEARCH = 7;
-+
-+        static int CROMITE_WEB_SEARCH = 1;
-+        static int CROMITE_CUT = 2;
-+        static int CROMITE_COPY = 3;
-+        static int CROMITE_PASTE = 4;
-+        static int CROMITE_SHARE = 5;
-+        static int CROMITE_SELECT_ALL = 6;
-+        static int CROMITE_PASTE_AS_PLAIN_TEXT = 7;
-+
-+        private static int GetValue(int a, int b) {
-+            return !ContextUtils.getAppSharedPreferences().getBoolean(
-+                "selection_popup_web_search_to_top", false)
-+                ? a : b;
-+        }
-+
-+        public static int CUT() {
-+            return GetValue(CHROMIUM_CUT, CROMITE_CUT);
-+        }
-+        public static int COPY() {
-+            return GetValue(CHROMIUM_COPY, CROMITE_COPY);
-+        }
-+        public static int PASTE() {
-+            return GetValue(CHROMIUM_PASTE, CROMITE_PASTE);
-+        }
-+        public static int SHARE() {
-+            return GetValue(CHROMIUM_SHARE, CROMITE_SHARE);
-+        }
-+        public static int SELECT_ALL() {
-+            return GetValue(CHROMIUM_SELECT_ALL, CROMITE_SELECT_ALL);
-+        }
-+        public static int PASTE_AS_PLAIN_TEXT() {
-+            return GetValue(CHROMIUM_PASTE_AS_PLAIN_TEXT, CROMITE_PASTE_AS_PLAIN_TEXT);
-+        }
-+        public static int WEB_SEARCH() {
-+            return GetValue(CHROMIUM_WEB_SEARCH, CROMITE_WEB_SEARCH);
+     private final @AttrRes int mIconAttr;
+@@ -210,25 +231,23 @@ public final class SelectionMenuItem implements Comparable<SelectionMenuItem> {
+          * @param order the order, must be >= 0.
+          * @param category the section of the menu in which this item should appear.
+          */
+-        public Builder setOrderAndCategory(int order, @ItemGroupOffset int category) {
+        public Builder setOrderAndCategory(int order, int category) {
+             if (order < 0) {
+                 throw new IllegalArgumentException("Invalid order. Must be >= 0");
+             }
+             // Make sure items don't spill over into the next category.
+-            mOrder =
+-                    switch (category) {
+-                        case ItemGroupOffset.ASSIST_ITEMS ->
+-                                Math.min(order + category, ItemGroupOffset.DEFAULT_ITEMS - 1);
+-                        case ItemGroupOffset.DEFAULT_ITEMS ->
+-                                Math.min(
+-                                        order + category,
+-                                        ItemGroupOffset.SECONDARY_ASSIST_ITEMS - 1);
+-                        case ItemGroupOffset.SECONDARY_ASSIST_ITEMS ->
+-                                Math.min(
+-                                        order + category,
+-                                        ItemGroupOffset.TEXT_PROCESSING_ITEMS - 1);
+-                        default -> order + category;
+-                    };
+            if (category == ItemGroupOffset.ASSIST_ITEMS())
+                mOrder = Math.min(order + category, ItemGroupOffset.DEFAULT_ITEMS() - 1);
+            else if (category == ItemGroupOffset.DEFAULT_ITEMS())
+                mOrder = Math.min(
+                        order + category,
+                        ItemGroupOffset.SECONDARY_ASSIST_ITEMS() - 1);
+            else if (category == ItemGroupOffset.SECONDARY_ASSIST_ITEMS())
+                mOrder = Math.min(
+                        order + category,
+                        ItemGroupOffset.TEXT_PROCESSING_ITEMS() - 1);
+            else
+                mOrder = order + category;
+             return this;
+         }
+ 
+diff --git a/content/public/android/java/src/org/chromium/content_public/browser/selection/SelectionActionMenuDelegate.java b/content/public/android/java/src/org/chromium/content_public/browser/selection/SelectionActionMenuDelegate.java
+--- a/content/public/android/java/src/org/chromium/content_public/browser/selection/SelectionActionMenuDelegate.java
+++ b/content/public/android/java/src/org/chromium/content_public/browser/selection/SelectionActionMenuDelegate.java
+@@ -7,6 +7,7 @@ package org.chromium.content_public.browser.selection;
+ import android.content.pm.ResolveInfo;
+ import android.view.View;
+ 
+import org.chromium.base.ContextUtils;
+ import org.chromium.base.SelectionActionMenuClientWrapper.DefaultItem;
+ import org.chromium.base.SelectionActionMenuClientWrapper.MenuType;
+ import org.chromium.build.annotations.NullMarked;
+@@ -23,15 +24,28 @@ import java.util.List;
+ @NullMarked
+ public interface SelectionActionMenuDelegate {
+     static @DefaultItem int[] getDefaultMenuItemOrder() {
+-        return new @DefaultItem int[] {
+-            DefaultItem.CUT,
+-            DefaultItem.COPY,
+-            DefaultItem.PASTE,
+-            DefaultItem.PASTE_AS_PLAIN_TEXT,
+-            DefaultItem.SHARE,
+-            DefaultItem.SELECT_ALL,
+-            DefaultItem.WEB_SEARCH
+-        };
+        if (!ContextUtils.getAppSharedPreferences().getBoolean(
+                "selection_popup_web_search_to_top", false)) {
+            return new @DefaultItem int[] {
+                DefaultItem.CUT,
+                DefaultItem.COPY,
+                DefaultItem.PASTE,
+                DefaultItem.PASTE_AS_PLAIN_TEXT,
+                DefaultItem.SHARE,
+                DefaultItem.SELECT_ALL,
+                DefaultItem.WEB_SEARCH
+            };
+        } else {
+            return new @DefaultItem int[] {
+                DefaultItem.WEB_SEARCH,
+                DefaultItem.CUT,
+                DefaultItem.COPY,
+                DefaultItem.PASTE,
+                DefaultItem.PASTE_AS_PLAIN_TEXT,
+                DefaultItem.SHARE,
+                DefaultItem.SELECT_ALL
+            };
 +        }
     }
 
-     @Retention(RetentionPolicy.SOURCE)
-@@ -196,7 +243,7 @@ public class SelectActionMenuHelper {
-         }
-         SelectionMenuGroup primaryAssistGroup =
-                 new SelectionMenuGroup(
-                        R.id.select_action_menu_assist_items, GroupItemOrder.ASSIST_ITEMS);
-+                        R.id.select_action_menu_assist_items, GroupItemOrderChromium.ASSIST_ITEMS());
-         View.OnClickListener clickListener = null;
-         if (classificationResult.onClickListener != null) {
-             clickListener = classificationResult.onClickListener;
-@@ -223,7 +270,7 @@ public class SelectActionMenuHelper {
-             String selectedText) {
-         SelectionMenuGroup defaultGroup =
-                 new SelectionMenuGroup(
-                        R.id.select_action_menu_default_items, GroupItemOrder.DEFAULT_ITEMS);
-+                        R.id.select_action_menu_default_items, GroupItemOrderChromium.DEFAULT_ITEMS());
-         List<SelectionMenuItem.Builder> menuItemBuilders = new ArrayList<>();
-         menuItemBuilders.add(cut(delegate.canCut()));
-         menuItemBuilders.add(copy(delegate.canCopy()));
-@@ -251,7 +298,7 @@ public class SelectActionMenuHelper {
-         // menu items if there is selected text.
-         @IdRes int groupId = selectedText.isEmpty() ? Menu.NONE : android.R.id.textAssist;
-         SelectionMenuGroup secondaryAssistItems =
-                new SelectionMenuGroup(groupId, GroupItemOrder.SECONDARY_ASSIST_ITEMS);
-+                new SelectionMenuGroup(groupId, GroupItemOrderChromium.SECONDARY_ASSIST_ITEMS());
- 
-         if (selectedText.isEmpty() && selectionActionMenuDelegate != null) {
-             List<SelectionMenuItem> additionalMenuItems =
-@@ -313,7 +360,7 @@ public class SelectActionMenuHelper {
-         SelectionMenuGroup textProcessingItems =
-                 new SelectionMenuGroup(
-                         R.id.select_action_menu_text_processing_items,
-                        GroupItemOrder.TEXT_PROCESSING_ITEMS);
-+                        GroupItemOrderChromium.TEXT_PROCESSING_ITEMS());
-         if (isSelectionPassword || intentHandler == null) {
-             addAdditionalTextProcessingItems(textProcessingItems, selectionActionMenuDelegate);
-             return textProcessingItems;
-@@ -415,7 +462,7 @@ public class SelectActionMenuHelper {
-                 .setId(R.id.select_action_menu_cut)
-                 .setIconAttr(android.R.attr.actionModeCutDrawable)
-                 .setAlphabeticShortcut(ItemKeyShortcuts.CUT)
-                .setOrderInCategory(DefaultItemOrder.CUT)
-+                .setOrderInCategory(DefaultItemOrderChromium.CUT())
-                 .setShowAsActionFlags(
-                         MenuItem.SHOW_AS_ACTION_ALWAYS | MenuItem.SHOW_AS_ACTION_WITH_TEXT)
-                 .setIsEnabled(isEnabled)
-@@ -427,7 +474,7 @@ public class SelectActionMenuHelper {
-                 .setId(R.id.select_action_menu_copy)
-                 .setIconAttr(android.R.attr.actionModeCopyDrawable)
-                 .setAlphabeticShortcut(ItemKeyShortcuts.COPY)
-                .setOrderInCategory(DefaultItemOrder.COPY)
-+                .setOrderInCategory(DefaultItemOrderChromium.COPY())
-                 .setShowAsActionFlags(
-                         MenuItem.SHOW_AS_ACTION_ALWAYS | MenuItem.SHOW_AS_ACTION_WITH_TEXT)
-                 .setIsEnabled(isEnabled)
-@@ -439,7 +486,7 @@ public class SelectActionMenuHelper {
-                 .setId(R.id.select_action_menu_paste)
-                 .setIconAttr(android.R.attr.actionModePasteDrawable)
-                 .setAlphabeticShortcut(ItemKeyShortcuts.PASTE)
-                .setOrderInCategory(DefaultItemOrder.PASTE)
-+                .setOrderInCategory(DefaultItemOrderChromium.PASTE())
-                 .setShowAsActionFlags(
-                         MenuItem.SHOW_AS_ACTION_ALWAYS | MenuItem.SHOW_AS_ACTION_WITH_TEXT)
-                 .setIsEnabled(isEnabled)
-@@ -453,7 +500,7 @@ public class SelectActionMenuHelper {
-         return new SelectionMenuItem.Builder(context.getString(R.string.actionbar_share))
-                 .setId(R.id.select_action_menu_share)
-                 .setIconAttr(android.R.attr.actionModeShareDrawable)
-                .setOrderInCategory(DefaultItemOrder.SHARE)
-+                .setOrderInCategory(DefaultItemOrderChromium.SHARE())
-                 .setShowAsActionFlags(
-                         MenuItem.SHOW_AS_ACTION_ALWAYS | MenuItem.SHOW_AS_ACTION_WITH_TEXT)
-                 .setIsEnabled(isEnabled)
-@@ -465,7 +512,7 @@ public class SelectActionMenuHelper {
-                 .setId(R.id.select_action_menu_select_all)
-                 .setIconAttr(android.R.attr.actionModeSelectAllDrawable)
-                 .setAlphabeticShortcut(ItemKeyShortcuts.SELECT_ALL)
-                .setOrderInCategory(DefaultItemOrder.SELECT_ALL)
-+                .setOrderInCategory(DefaultItemOrderChromium.SELECT_ALL())
-                 .setShowAsActionFlags(
-                         MenuItem.SHOW_AS_ACTION_ALWAYS | MenuItem.SHOW_AS_ACTION_WITH_TEXT)
-                 .setIsEnabled(isEnabled)
-@@ -477,7 +524,7 @@ public class SelectActionMenuHelper {
-         SelectionMenuItem.Builder builder =
-                 new SelectionMenuItem.Builder(android.R.string.paste_as_plain_text)
-                         .setId(R.id.select_action_menu_paste_as_plain_text)
-                        .setOrderInCategory(DefaultItemOrder.PASTE_AS_PLAIN_TEXT)
-+                        .setOrderInCategory(DefaultItemOrderChromium.PASTE_AS_PLAIN_TEXT())
-                         .setShowAsActionFlags(
-                                 MenuItem.SHOW_AS_ACTION_ALWAYS | MenuItem.SHOW_AS_ACTION_WITH_TEXT)
-                         .setIsEnabled(isEnabled);
-@@ -497,7 +544,7 @@ public class SelectActionMenuHelper {
-         return new SelectionMenuItem.Builder(context.getString(R.string.actionbar_web_search))
-                 .setId(R.id.select_action_menu_web_search)
-                 .setIconAttr(android.R.attr.actionModeWebSearchDrawable)
-                .setOrderInCategory(DefaultItemOrder.WEB_SEARCH)
-+                .setOrderInCategory(DefaultItemOrderChromium.WEB_SEARCH())
-                 .setShowAsActionFlags(
-                         MenuItem.SHOW_AS_ACTION_ALWAYS | MenuItem.SHOW_AS_ACTION_WITH_TEXT)
-                 .setIsEnabled(isEnabled)
-diff --git a/content/public/android/java/src/org/chromium/content/browser/selection/SmartSelectionClient.java b/content/public/android/java/src/org/chromium/content/browser/selection/SmartSelectionClient.java
--- a/content/public/android/java/src/org/chromium/content/browser/selection/SmartSelectionClient.java
-+++ b/content/public/android/java/src/org/chromium/content/browser/selection/SmartSelectionClient.java
-@@ -18,6 +18,7 @@ import org.jni_zero.CalledByNative;
- import org.jni_zero.JNINamespace;
- import org.jni_zero.NativeMethods;
- 
-+import org.chromium.base.ContextUtils;
- import org.chromium.base.ObserverList;
- import org.chromium.base.UserData;
- import org.chromium.build.annotations.Initializer;
-@@ -84,6 +85,9 @@ public class SmartSelectionClient implements SelectionClient, UserData {
-             return null;
-         }
- 
-+        if (!ContextUtils.getAppSharedPreferences().getBoolean(
-+                "selection_popup_smart_text", false)) return null;
-+
-         SmartSelectionClient client =
-                 assumeNonNull(
-                         webContents.getOrSetUserData(
+     /**
 --
@@ -10,24 +10,25 @@ Original License: BSD-3-Clause - https://spdx.org/licenses/BSD-3-Clause.html
 License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 ---
 chrome/android/java/res/layout/url_bar.xml    |  1 +
- .../browser/omnibox/LocationBarMediator.java  | 13 ++++++++--
+ .../browser/omnibox/LocationBarMediator.java  | 14 ++++++++---
 .../chrome/browser/omnibox/UrlBar.java        | 24 +++++++++++++++++++
- 3 files changed, 36 insertions(+), 2 deletions(-)
+ 3 files changed, 36 insertions(+), 3 deletions(-)

 diff --git a/chrome/android/java/res/layout/url_bar.xml b/chrome/android/java/res/layout/url_bar.xml
 --- a/chrome/android/java/res/layout/url_bar.xml
 +++ b/chrome/android/java/res/layout/url_bar.xml
-@@ -15,5 +15,6 @@ found in the LICENSE file.
+@@ -16,6 +16,7 @@ found in the LICENSE file.
     android:singleLine="true"
     android:imeOptions="actionGo|flagNoExtractUi|flagNoFullscreen"
     android:textAppearance="@style/TextAppearance.SearchBoxText"
 +    android:inputType="textUri"
     android:hint="@string/omnibox_empty_hint"
-     android:importantForAutofill="no" />
+     android:textAlignment="viewStart"
+     android:importantForAutofill="no"
 diff --git a/chrome/browser/ui/android/omnibox/java/src/org/chromium/chrome/browser/omnibox/LocationBarMediator.java b/chrome/browser/ui/android/omnibox/java/src/org/chromium/chrome/browser/omnibox/LocationBarMediator.java
 --- a/chrome/browser/ui/android/omnibox/java/src/org/chromium/chrome/browser/omnibox/LocationBarMediator.java
 +++ b/chrome/browser/ui/android/omnibox/java/src/org/chromium/chrome/browser/omnibox/LocationBarMediator.java
-@@ -318,8 +318,17 @@ class LocationBarMediator
+@@ -409,8 +409,17 @@ class LocationBarMediator
             if (!mUrlFocusedWithPastedText
                     && !shouldRetainOmniboxOnFocus
                     && mLocationBarLayout.shouldClearTextOnFocus()) {
@@ -36,7 +37,7 @@ diff --git a/chrome/browser/ui/android/omnibox/java/src/org/chromium/chrome/brow
 +                UrlBarData data = mLocationBarDataProvider.getUrlBarData();
 +                @SelectionState int selectionState = SelectionState.SELECT_ALL;
 +                GURL url = mLocationBarDataProvider.getUrlBarData().url;
-+                if (url != null && mTemplateUrlServiceSupplier.hasValue()) {
+                if (url != null && mTemplateUrlServiceSupplier.get() != null) {
 +                    String searchParams =
 +                        mTemplateUrlServiceSupplier.get().getSearchQueryForUrl(url);
 +                    if (searchParams != null && !searchParams.isEmpty()) {
@@ -47,6 +48,14 @@ diff --git a/chrome/browser/ui/android/omnibox/java/src/org/chromium/chrome/brow
             } else if (shouldRetainOmniboxOnFocus) {
                 mUrlCoordinator.setSelectAllOnFocus(true);
             }
+@@ -1898,7 +1907,6 @@ class LocationBarMediator
+         mUrlCoordinator.setKeyboardVisibility(true, false);
+     }
+ 
+-
+     // UrlBarDelegate implementation.
+ 
+     @Override
 diff --git a/chrome/browser/ui/android/omnibox/java/src/org/chromium/chrome/browser/omnibox/UrlBar.java b/chrome/browser/ui/android/omnibox/java/src/org/chromium/chrome/browser/omnibox/UrlBar.java
 --- a/chrome/browser/ui/android/omnibox/java/src/org/chromium/chrome/browser/omnibox/UrlBar.java
 +++ b/chrome/browser/ui/android/omnibox/java/src/org/chromium/chrome/browser/omnibox/UrlBar.java
@@ -58,7 +67,7 @@ diff --git a/chrome/browser/ui/android/omnibox/java/src/org/chromium/chrome/brow
 import android.os.SystemClock;
 import android.text.Editable;
 import android.text.InputType;
-@@ -113,6 +114,7 @@ public class UrlBar extends AutocompleteEditText {
+@@ -116,6 +117,7 @@ public class UrlBar extends AutocompleteEditText {
     private boolean mAllowFocus = true;
     private boolean mShouldSendTypingStartedEvent;
 
@@ -66,7 +75,7 @@ diff --git a/chrome/browser/ui/android/omnibox/java/src/org/chromium/chrome/brow
     private boolean mPendingScroll;
     private boolean mIsInCct;
 
-@@ -339,6 +341,28 @@ public class UrlBar extends AutocompleteEditText {
+@@ -369,6 +371,28 @@ public class UrlBar extends AutocompleteEditText {
         fixupTextDirection();
 
         mShouldSendTypingStartedEvent = focused;
@@ -27,22 +27,22 @@ new file mode 100644
 diff --git a/components/browser_ui/accessibility/android/java/res/xml/accessibility_preferences.xml b/components/browser_ui/accessibility/android/java/res/xml/accessibility_preferences.xml
 --- a/components/browser_ui/accessibility/android/java/res/xml/accessibility_preferences.xml
 +++ b/components/browser_ui/accessibility/android/java/res/xml/accessibility_preferences.xml
-@@ -8,6 +8,11 @@ found in the LICENSE file.
- <PreferenceScreen xmlns:android="http://schemas.android.com/apk/res/android"
-                   xmlns:app="http://schemas.android.com/apk/res-auto">
+@@ -11,6 +11,11 @@ found in the LICENSE file.
+         android:key="zoom_info"
+         android:title="@string/zoom_info_preference_title"/>
 
 +    <org.chromium.components.browser_ui.settings.ChromeSwitchPreference
 +        android:key="enable_accessibility"
 +        android:summary="@string/enable_accessibility_summary"
 +        android:title="@string/enable_accessibility_title" />
 +
-     <org.chromium.components.browser_ui.accessibility.PageZoomPreference
-         android:key="page_zoom_default_zoom"
-         android:selectable="false" />
+     <org.chromium.components.browser_ui.settings.ChromeSwitchPreference
+         android:key="page_zoom_include_os_adjustment"
+         android:summary="@string/page_zoom_include_os_adjustment_summary"
 diff --git a/content/public/android/java/src/org/chromium/content/browser/accessibility/WebContentsAccessibilityImpl.java b/content/public/android/java/src/org/chromium/content/browser/accessibility/WebContentsAccessibilityImpl.java
 --- a/content/public/android/java/src/org/chromium/content/browser/accessibility/WebContentsAccessibilityImpl.java
 +++ b/content/public/android/java/src/org/chromium/content/browser/accessibility/WebContentsAccessibilityImpl.java
-@@ -1101,6 +1101,11 @@ public class WebContentsAccessibilityImpl extends AccessibilityNodeProviderCompa
+@@ -1142,6 +1142,11 @@ public class WebContentsAccessibilityImpl extends AccessibilityNodeProviderCompa
             structure.setChildCount(0);
             return;
         }
@@ -4,6 +4,7 @@ Subject: Disable Android AppRestrictions

 License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 ---
+ .../org/chromium/chrome/browser/AppHooks.java |  4 +-
 chrome/browser/enterprise/util/BUILD.gn       |  1 +
 .../enterprise/util/EnterpriseInfoImpl.java   |  5 +++
 chrome/browser/flags/BUILD.gn                 |  1 +
@@ -12,12 +13,26 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 .../DisableAndroidAppRestriction.inc          | 13 +++++++
 .../disable-android-app-restriction.inc       |  3 ++
 .../disable-android-app-restriction.inc       |  1 +
- 8 files changed, 75 insertions(+)
+ 9 files changed, 77 insertions(+), 2 deletions(-)
 create mode 100644 chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/cromite/sEnableAndroidAppRestriction.java
 create mode 100644 cromite_flags/chrome/browser/about_flags_cc/DisableAndroidAppRestriction.inc
 create mode 100644 cromite_flags/chrome/browser/flags/android/chrome_feature_list_cc/disable-android-app-restriction.inc
 create mode 100644 cromite_flags/chrome/browser/flags/android/chrome_feature_list_h/disable-android-app-restriction.inc

+diff --git a/chrome/android/java/src/org/chromium/chrome/browser/AppHooks.java b/chrome/android/java/src/org/chromium/chrome/browser/AppHooks.java
+--- a/chrome/android/java/src/org/chromium/chrome/browser/AppHooks.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/AppHooks.java
+@@ -43,8 +43,8 @@ public class AppHooks {
+     }
+ 
+     public void registerPolicyProviders(CombinedPolicyProvider combinedProvider) {
+-        combinedProvider.registerProvider(
+-                new AppRestrictionsProvider(ContextUtils.getApplicationContext()));
+        // combinedProvider.registerProvider(
+        //         new AppRestrictionsProvider(ContextUtils.getApplicationContext()));
+     }
+ 
+     /** Async fetch the iterator of partner bookmarks (or null if not available). */
 diff --git a/chrome/browser/enterprise/util/BUILD.gn b/chrome/browser/enterprise/util/BUILD.gn
 --- a/chrome/browser/enterprise/util/BUILD.gn
 +++ b/chrome/browser/enterprise/util/BUILD.gn
@@ -32,15 +47,15 @@ diff --git a/chrome/browser/enterprise/util/BUILD.gn b/chrome/browser/enterprise
 diff --git a/chrome/browser/enterprise/util/android/java/src/org/chromium/chrome/browser/enterprise/util/EnterpriseInfoImpl.java b/chrome/browser/enterprise/util/android/java/src/org/chromium/chrome/browser/enterprise/util/EnterpriseInfoImpl.java
 --- a/chrome/browser/enterprise/util/android/java/src/org/chromium/chrome/browser/enterprise/util/EnterpriseInfoImpl.java
 +++ b/chrome/browser/enterprise/util/android/java/src/org/chromium/chrome/browser/enterprise/util/EnterpriseInfoImpl.java
-@@ -28,6 +28,7 @@ import org.chromium.build.annotations.MonotonicNonNull;
- import org.chromium.build.annotations.NullMarked;
+@@ -31,6 +31,7 @@ import org.chromium.build.annotations.NullMarked;
 import org.chromium.build.annotations.Nullable;
+ import org.chromium.chrome.browser.flags.ChromeFeatureList;
 import org.chromium.chrome.browser.flags.ChromeSwitches;
 +import org.chromium.components.policy.AppRestrictionsProvider;
 
- import java.util.LinkedList;
- import java.util.Queue;
-@@ -109,6 +110,10 @@ public class EnterpriseInfoImpl extends EnterpriseInfo {
+ import java.util.ArrayDeque;
+ import java.util.List;
+@@ -113,6 +114,10 @@ public class EnterpriseInfoImpl extends EnterpriseInfo {
             new AsyncTask<OwnedState>() {
                 // TODO: Unit test this function. https://crbug.com/1099262
                 private OwnedState calculateIsRunningOnManagedProfile(Context context) {
@@ -48,16 +63,16 @@ diff --git a/chrome/browser/enterprise/util/android/java/src/org/chromium/chrome
 +                        return new OwnedState(/*hasDeviceOwnerApp*/false,
 +                            /*hasProfileOwnerApp*/false);
 +                    }
+                     long startTime = SystemClock.elapsedRealtime();
                     boolean hasProfileOwnerApp = false;
                     boolean hasDeviceOwnerApp = false;
-                     PackageManager packageManager = context.getPackageManager();
 diff --git a/chrome/browser/flags/BUILD.gn b/chrome/browser/flags/BUILD.gn
 --- a/chrome/browser/flags/BUILD.gn
 +++ b/chrome/browser/flags/BUILD.gn
-@@ -26,6 +26,7 @@ android_library("java") {
-     "//build:chromeos_buildflags",
+@@ -28,6 +28,7 @@ android_library("java") {
     "//build/android:build_java",
     "//chrome/browser/preferences:java",
+     "//content/public/android:content_main_dex_java",
 +    "//components/policy/android:policy_java",
     "//third_party/android_deps:guava_android_java",
     "//third_party/androidx:androidx_annotation_annotation_java",
@@ -14,7 +14,7 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 diff --git a/chrome/android/java/res/xml/main_preferences.xml b/chrome/android/java/res/xml/main_preferences.xml
 --- a/chrome/android/java/res/xml/main_preferences.xml
 +++ b/chrome/android/java/res/xml/main_preferences.xml
-@@ -105,7 +105,8 @@ for the previous order (main_preferences_legacy). -->
+@@ -96,7 +96,8 @@ found in the LICENSE file.
         android:fragment="org.chromium.chrome.browser.tasks.tab_management.TabsSettings"
         android:key="tabs"
         android:order="18"
@@ -27,7 +27,7 @@ diff --git a/chrome/android/java/res/xml/main_preferences.xml b/chrome/android/j
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tab/TabArchiveSettings.java b/chrome/android/java/src/org/chromium/chrome/browser/tab/TabArchiveSettings.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/tab/TabArchiveSettings.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/tab/TabArchiveSettings.java
-@@ -104,11 +104,12 @@ public class TabArchiveSettings {
+@@ -105,11 +105,12 @@ public class TabArchiveSettings {
         // are created, and tabs disappearing from tests is very unexpected. For archive tests,
         // this will need to be turned on manually.
         return mPrefsManager.readBoolean(
@@ -16,7 +16,7 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 diff --git a/third_party/blink/renderer/core/css/parser/css_supports_parser.cc b/third_party/blink/renderer/core/css/parser/css_supports_parser.cc
 --- a/third_party/blink/renderer/core/css/parser/css_supports_parser.cc
 +++ b/third_party/blink/renderer/core/css/parser/css_supports_parser.cc
-@@ -393,7 +393,7 @@ bool CSSSupportsParser::ConsumeBlinkFeatureFn(CSSParserTokenStream& stream) {
+@@ -263,7 +263,7 @@ bool CSSSupportsParser::ConsumeBlinkFeatureFn(CSSParserTokenStream& stream) {
             feature_name.Value().Utf8()) &&
         guard.Release()) {
       stream.ConsumeWhitespace();
@@ -28,7 +28,7 @@ diff --git a/third_party/blink/renderer/core/css/parser/css_supports_parser.cc b
 diff --git a/third_party/blink/renderer/core/speculation_rules/document_rule_predicate.cc b/third_party/blink/renderer/core/speculation_rules/document_rule_predicate.cc
 --- a/third_party/blink/renderer/core/speculation_rules/document_rule_predicate.cc
 +++ b/third_party/blink/renderer/core/speculation_rules/document_rule_predicate.cc
-@@ -581,7 +581,7 @@ DocumentRulePredicate* DocumentRulePredicate::Parse(
+@@ -520,7 +520,7 @@ DocumentRulePredicate* DocumentRulePredicate::Parse(
     HeapVector<CSSSelector> arena;
     CSSPropertyValueSet* empty_properties =
         ImmutableCSSPropertyValueSet::Create(base::span<CSSPropertyValue>(),
@@ -15,7 +15,7 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 diff --git a/third_party/blink/renderer/platform/runtime_enabled_features.json5 b/third_party/blink/renderer/platform/runtime_enabled_features.json5
 --- a/third_party/blink/renderer/platform/runtime_enabled_features.json5
 +++ b/third_party/blink/renderer/platform/runtime_enabled_features.json5
-@@ -1250,7 +1250,7 @@
+@@ -1419,7 +1419,7 @@
     },
     {
       name: "CSSDynamicRangeLimit",
@@ -4,50 +4,27 @@ Subject: Disable Compose feature

 License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 ---
- chrome/browser/BUILD.gn                             | 9 +++++++--
- chrome/browser/ui/webui/settings/settings_ui.cc     | 2 +-
+ chrome/browser/ui/webui/settings/settings_ui.cc     | 6 ++++--
 components/compose/core/browser/compose_features.cc | 2 ++
 components/compose/features.gni                     | 2 +-
- 4 files changed, 11 insertions(+), 4 deletions(-)
+ 3 files changed, 7 insertions(+), 3 deletions(-)

-diff --git a/chrome/browser/BUILD.gn b/chrome/browser/BUILD.gn
--- a/chrome/browser/BUILD.gn
-+++ b/chrome/browser/BUILD.gn
-@@ -8372,6 +8372,12 @@ static_library("browser") {
-     deps += [ "//components/segmentation_platform/internal:optimization_guide_segmentation_handler" ]
-   }
- 
-+  if (!is_android) {
-+    deps += [
-+      ":compose_optimization_guide_proto",
-+    ]
-+  }
-+
-   if (enable_compose) {
-     sources += [
-       "compose/chrome_compose_client.cc",
-@@ -8387,7 +8393,6 @@ static_library("browser") {
-     ]
- 
-     deps += [
-      ":compose_optimization_guide_proto",
-       "//chrome/common/compose",
-       "//chrome/common/compose:mojo_bindings",
-       "//components/autofill/content/browser:browser",
-@@ -8848,7 +8853,7 @@ source_set("font_pref") {
-   deps = [ "//chrome/common" ]
- }
- 
-if (enable_compose) {
-+if (!is_android) {
-   proto_library("compose_optimization_guide_proto") {
-     sources = [ "compose/proto/compose_optimization_guide.proto" ]
-     cc_generator_options = "lite=true:"
 diff --git a/chrome/browser/ui/webui/settings/settings_ui.cc b/chrome/browser/ui/webui/settings/settings_ui.cc
 --- a/chrome/browser/ui/webui/settings/settings_ui.cc
 +++ b/chrome/browser/ui/webui/settings/settings_ui.cc
-@@ -372,7 +372,7 @@ SettingsUI::SettingsUI(content::WebUI* web_ui)
-       base::FeatureList::IsEnabled(features::kLinkedServicesSetting));
+@@ -20,7 +20,9 @@
+ #include "chrome/browser/browser_features.h"
+ #include "chrome/browser/browser_process.h"
+ #include "chrome/browser/commerce/shopping_service_factory.h"
+-#include "chrome/browser/compose/compose_enabling.h"
+// #if BUILDFLAG(ENABLE_COMPOSE)
+// #include "chrome/browser/compose/compose_enabling.h"
+// #endif
+ #include "chrome/browser/history_embeddings/history_embeddings_utils.h"
+ #include "chrome/browser/optimization_guide/optimization_guide_keyed_service.h"
+ #include "chrome/browser/optimization_guide/optimization_guide_keyed_service_factory.h"
+@@ -359,7 +361,7 @@ SettingsUI::SettingsUI(content::WebUI* web_ui)
+       base::FeatureList::IsEnabled(permissions::features::kKeyboardLockPrompt));
 
 #if BUILDFLAG(ENABLE_COMPOSE)
 -  const bool compose_enabled = ComposeEnabling::IsEnabledForProfile(profile);
@@ -58,9 +35,9 @@ diff --git a/chrome/browser/ui/webui/settings/settings_ui.cc b/chrome/browser/ui
 diff --git a/components/compose/core/browser/compose_features.cc b/components/compose/core/browser/compose_features.cc
 --- a/components/compose/core/browser/compose_features.cc
 +++ b/components/compose/core/browser/compose_features.cc
-@@ -104,4 +104,6 @@ BASE_FEATURE(kComposeUpfrontInputModes,
-              "ComposeUpfrontInputModes",
-              base::FEATURE_ENABLED_BY_DEFAULT);
+@@ -73,4 +73,6 @@ BASE_FEATURE(kComposeAllowOnDeviceExecution, base::FEATURE_DISABLED_BY_DEFAULT);
+ 
+ BASE_FEATURE(kComposeUpfrontInputModes, base::FEATURE_ENABLED_BY_DEFAULT);
 
 +SET_CROMITE_FEATURE_DISABLED(kEnableCompose);
 +SET_CROMITE_FEATURE_DISABLED(kComposeEligible);
@@ -4,27 +4,28 @@ Subject: Disable Compression Dictionary Transport

 License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 ---
- .../blink/renderer/platform/runtime_enabled_features.json5  | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
+ chrome/browser/chrome_content_browser_client.cc                | 3 +--
+ .../features_cc/Disable-Compression-Dictionary-Transport.inc   | 1 +
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+ create mode 100644 cromite_flags/services/network/public/cpp/features_cc/Disable-Compression-Dictionary-Transport.inc

-diff --git a/third_party/blink/renderer/platform/runtime_enabled_features.json5 b/third_party/blink/renderer/platform/runtime_enabled_features.json5
--- a/third_party/blink/renderer/platform/runtime_enabled_features.json5
-+++ b/third_party/blink/renderer/platform/runtime_enabled_features.json5
-@@ -1007,12 +1007,14 @@
-       }
-     },
-     {
-      name: "CompressionDictionaryTransport",
-+      name: "CompressionDictionaryTransport", // need to be disabled
-+      status: "experimental",
-       base_feature: "none",
-       public: true,
-     },
-     {
-      name: "CompressionDictionaryTransportBackend",
-+      name: "CompressionDictionaryTransportBackend", // need to be disabled
-+      status: "experimental",
-       base_feature: "none",
-       public: true,
-     },
+diff --git a/chrome/browser/chrome_content_browser_client.cc b/chrome/browser/chrome_content_browser_client.cc
+--- a/chrome/browser/chrome_content_browser_client.cc
+++ b/chrome/browser/chrome_content_browser_client.cc
+@@ -1452,8 +1452,7 @@ void ChromeContentBrowserClient::RegisterProfilePrefs(
+   registry->RegisterBooleanPref(prefs::kSandboxExternalProtocolBlocked, true);
+   registry->RegisterBooleanPref(prefs::kSSLErrorOverrideAllowed, true);
+   registry->RegisterListPref(prefs::kSSLErrorOverrideAllowedForOrigins);
+-  registry->RegisterBooleanPref(prefs::kCompressionDictionaryTransportEnabled,
+-                                true);
+  registry->RegisterBooleanPref(prefs::kCompressionDictionaryTransportEnabled, false);
+ #if BUILDFLAG(ENABLE_ON_DEVICE_TRANSLATION)
+   registry->RegisterBooleanPref(prefs::kTranslatorAPIAllowed, true);
+ #endif
+diff --git a/cromite_flags/services/network/public/cpp/features_cc/Disable-Compression-Dictionary-Transport.inc b/cromite_flags/services/network/public/cpp/features_cc/Disable-Compression-Dictionary-Transport.inc
+new file mode 100644
+--- /dev/null
+++ b/cromite_flags/services/network/public/cpp/features_cc/Disable-Compression-Dictionary-Transport.inc
+@@ -0,0 +1 @@
+SET_CROMITE_FEATURE_DISABLED(kCompressionDictionaryTransport);
 --
@@ -0,0 +1,32 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Wed, 10 Sep 2025 07:46:17 +0000
+Subject: Disable Device Attributes API
+
+License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
+---
+ chrome/browser/device_api/device_service_impl.cc | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/chrome/browser/device_api/device_service_impl.cc b/chrome/browser/device_api/device_service_impl.cc
+--- a/chrome/browser/device_api/device_service_impl.cc
+++ b/chrome/browser/device_api/device_service_impl.cc
+@@ -155,6 +155,7 @@ bool IsPermissionsPolicyFeatureEnabled() {
+ 
+ bool IsTrustedContext(content::RenderFrameHost& host,
+                       const url::Origin& origin) {
+  if ((true)) return false;
+   // Do not create the service for the incognito mode.
+   if (GetProfile(host)->IsIncognitoProfile()) {
+     return false;
+@@ -350,6 +351,10 @@ void DeviceServiceImpl::GetAnnotatedLocation(
+ void DeviceServiceImpl::GetDeviceAttribute(
+     void (DeviceAttributeApi::*method)(DeviceAttributeCallback callback),
+     DeviceAttributeCallback callback) {
+  if ((true)) {
+    device_attribute_api_->ReportNotAllowedError(std::move(callback));
+    return;
+  }
+   if (!IsAffiliatedUser()) {
+     device_attribute_api_->ReportNotAffiliatedError(std::move(callback));
+     return;
+--
@@ -6,17 +6,19 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 ---
 .../content_settings/core/browser/content_settings_registry.cc  | 2 +-
 .../content/public/common/content_features_cc/Disable-FedCm.inc | 1 +
+ .../services/network/public/cpp/features_cc/Disable-FedCm.inc   | 1 +
 .../third_party/blink/common/features_cc/Disable-FedCm.inc      | 1 +
 .../blink/renderer/platform/runtime_enabled_features.json5      | 2 +-
- 4 files changed, 4 insertions(+), 2 deletions(-)
+ 5 files changed, 5 insertions(+), 2 deletions(-)
 create mode 100644 cromite_flags/content/public/common/content_features_cc/Disable-FedCm.inc
+ create mode 100644 cromite_flags/services/network/public/cpp/features_cc/Disable-FedCm.inc
 create mode 100644 cromite_flags/third_party/blink/common/features_cc/Disable-FedCm.inc

 diff --git a/components/content_settings/core/browser/content_settings_registry.cc b/components/content_settings/core/browser/content_settings_registry.cc
 --- a/components/content_settings/core/browser/content_settings_registry.cc
 +++ b/components/content_settings/core/browser/content_settings_registry.cc
-@@ -674,7 +674,7 @@ void ContentSettingsRegistry::Init() {
-            ContentSettingsInfo::EXCEPTIONS_ON_SECURE_ORIGINS_ONLY);
+@@ -640,7 +640,7 @@ void ContentSettingsRegistry::Init() {
+            PermissionSettingsInfo::EXCEPTIONS_ON_SECURE_ORIGINS_ONLY);
 
   Register(ContentSettingsType::FEDERATED_IDENTITY_AUTO_REAUTHN_PERMISSION,
 -           "webid-auto-reauthn", CONTENT_SETTING_ALLOW,
@@ -30,6 +32,12 @@ new file mode 100644
 +++ b/cromite_flags/content/public/common/content_features_cc/Disable-FedCm.inc
@@ -0,0 +1 @@
 +SET_CROMITE_FEATURE_DISABLED(kFedCm);
+diff --git a/cromite_flags/services/network/public/cpp/features_cc/Disable-FedCm.inc b/cromite_flags/services/network/public/cpp/features_cc/Disable-FedCm.inc
+new file mode 100644
+--- /dev/null
+++ b/cromite_flags/services/network/public/cpp/features_cc/Disable-FedCm.inc
+@@ -0,0 +1 @@
+SET_CROMITE_FEATURE_ENABLED(kSendSameSiteLaxForFedCM);
 diff --git a/cromite_flags/third_party/blink/common/features_cc/Disable-FedCm.inc b/cromite_flags/third_party/blink/common/features_cc/Disable-FedCm.inc
 new file mode 100644
 --- /dev/null
@@ -39,7 +47,7 @@ new file mode 100644
 diff --git a/third_party/blink/renderer/platform/runtime_enabled_features.json5 b/third_party/blink/renderer/platform/runtime_enabled_features.json5
 --- a/third_party/blink/renderer/platform/runtime_enabled_features.json5
 +++ b/third_party/blink/renderer/platform/runtime_enabled_features.json5
-@@ -2075,7 +2075,7 @@
+@@ -2286,7 +2286,7 @@
     {
       name: "FedCm",
       public: true,
@@ -5,19 +5,19 @@ Subject: Disable GSA by default
 License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 ---
 .../src/org/chromium/base/PackageUtils.java   |  1 +
- .../chrome/browser/IntentHandler.java         |  6 ----
- .../chrome/browser/share/LensUtils.java       | 14 ++-------
- .../chromium/chrome/browser/gsa/GSAUtils.java | 29 ++++---------------
- .../GoogleBottomBarActionsHandler.java        | 19 ++----------
+ .../chrome/browser/IntentHandler.java         |  7 ----
+ .../chrome/browser/share/LensUtils.java       | 14 ++------
+ .../chromium/chrome/browser/gsa/GSAUtils.java | 34 +++----------------
+ .../GoogleBottomBarActionsHandler.java        | 19 ++---------
 .../chrome/browser/pdf/PdfCoordinator.java    |  2 +-
 .../Disable-GSA-by-default.inc                |  1 +
- 7 files changed, 12 insertions(+), 60 deletions(-)
+ 7 files changed, 12 insertions(+), 66 deletions(-)
 create mode 100644 cromite_flags/chrome/browser/flags/android/chrome_feature_list_cc/Disable-GSA-by-default.inc

 diff --git a/base/android/java/src/org/chromium/base/PackageUtils.java b/base/android/java/src/org/chromium/base/PackageUtils.java
 --- a/base/android/java/src/org/chromium/base/PackageUtils.java
 +++ b/base/android/java/src/org/chromium/base/PackageUtils.java
-@@ -165,6 +165,7 @@ public class PackageUtils {
+@@ -185,6 +185,7 @@ public class PackageUtils {
      * @return Package name of assistant app, or null if unable to get.
      */
     public static @Nullable String getDefaultAssistantPackageName(Context context) {
@@ -28,45 +28,53 @@ diff --git a/base/android/java/src/org/chromium/base/PackageUtils.java b/base/an
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/IntentHandler.java b/chrome/android/java/src/org/chromium/chrome/browser/IntentHandler.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/IntentHandler.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/IntentHandler.java
-@@ -47,7 +47,6 @@ import org.chromium.chrome.browser.document.ChromeLauncherActivity;
+@@ -49,7 +49,6 @@ import org.chromium.chrome.browser.document.ChromeLauncherActivity;
 import org.chromium.chrome.browser.externalnav.IntentWithRequestMetadataHandler;
 import org.chromium.chrome.browser.externalnav.IntentWithRequestMetadataHandler.RequestMetadata;
 import org.chromium.chrome.browser.flags.ChromeFeatureList;
 -import org.chromium.chrome.browser.gsa.GSAUtils;
 import org.chromium.chrome.browser.omnibox.suggestions.AutocompleteCoordinator;
+ import org.chromium.chrome.browser.pdf.PdfUtils;
 import org.chromium.chrome.browser.profiles.Profile;
- import org.chromium.chrome.browser.profiles.ProfileManager;
-@@ -279,9 +278,6 @@ public class IntentHandler {
- 
-     public static final String EXTRA_CCT_EARLY_NAV = "org.chromium.chrome.browser.cct_early_nav";
+@@ -303,9 +302,6 @@ public class IntentHandler {
+     public static final String EXTRA_TIPS_NOTIFICATION_FEATURE_TYPE =
+             "org.chromium.chrome.browser.tips_notification_feature_type";
 
 -    /** The package name for the Google Search App. */
 -    public static final String PACKAGE_GSA = GSAUtils.GSA_PACKAGE_NAME;
 -
-     private static Pair<Integer, String> sPendingReferrer;
-     private static int sReferrerId;
-     private static String sPendingIncognitoUrl;
-@@ -557,8 +553,6 @@ public class IntentHandler {
+     /** Action to launch the Chrome Item Picker UI, e.g.: tabs. */
+     public static final String EXTRA_OPEN_CHROME_ITEM_PICKER =
+             "org.chromium.chrome.browser.actions.open_chrome_item_picker";
+@@ -313,7 +309,6 @@ public class IntentHandler {
+     /** Optional extra for the maximum number of items the user can select. */
+     public static final String EXTRA_ITEM_PICKER_MAX_SELECTABLE_ITEMS =
+             "org.chromium.chrome.browser.extras.item_picker_max_selectable_items";
+-
+     public static final String EXTRA_ITEM_PICKER_ERROR =
+             "org.chromium.chrome.browser.chrome_item_picker.EXTRA_ITEM_PICKER_ERROR";
+ 
+@@ -569,8 +564,6 @@ public class IntentHandler {
             return ExternalAppId.LINE;
-         } else if (packageName.equals(PACKAGE_WHATSAPP)) {
+         } else if (PACKAGE_WHATSAPP.equals(packageName)) {
             return ExternalAppId.WHATSAPP;
-        } else if (packageName.equals(PACKAGE_GSA)) {
+-        } else if (PACKAGE_GSA.equals(packageName)) {
 -            return ExternalAppId.GSA;
-         } else if (packageName.equals(ContextUtils.getApplicationContext().getPackageName())) {
+         } else if (ContextUtils.getApplicationContext().getPackageName().equals(packageName)) {
             return ExternalAppId.CHROME;
-         } else if (packageName.startsWith(WEBAPK_PACKAGE_PREFIX)) {
+         } else if (assumeNonNull(packageName).startsWith(WEBAPK_PACKAGE_PREFIX)) {
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/share/LensUtils.java b/chrome/android/java/src/org/chromium/chrome/browser/share/LensUtils.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/share/LensUtils.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/share/LensUtils.java
-@@ -10,7 +10,6 @@ import android.os.Build;
- import org.chromium.base.ResettersForTesting;
+@@ -10,7 +10,6 @@ import org.chromium.base.ResettersForTesting;
+ import org.chromium.build.annotations.NullMarked;
 import org.chromium.chrome.browser.IntentHandler;
 import org.chromium.chrome.browser.flags.ChromeFeatureList;
 -import org.chromium.chrome.browser.gsa.GSAUtils;
 import org.chromium.components.externalauth.ExternalAuthUtils;
 
 /** This class provides utilities for intenting into Google Lens. */
-@@ -49,12 +48,7 @@ public class LensUtils {
+@@ -50,12 +49,7 @@ public class LensUtils {
             if (context == null) {
                 return "";
             }
@@ -79,7 +87,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/share/LensUtils
         }
     }
 
-@@ -92,15 +86,11 @@ public class LensUtils {
+@@ -78,15 +72,11 @@ public class LensUtils {
      * @return Whether the package is valid.
      */
     public static boolean isValidAgsaPackage() {
@@ -100,7 +108,7 @@ diff --git a/chrome/android/java/src/org/chromium/chrome/browser/share/LensUtils
 diff --git a/chrome/browser/gsa/java/src/org/chromium/chrome/browser/gsa/GSAUtils.java b/chrome/browser/gsa/java/src/org/chromium/chrome/browser/gsa/GSAUtils.java
 --- a/chrome/browser/gsa/java/src/org/chromium/chrome/browser/gsa/GSAUtils.java
 +++ b/chrome/browser/gsa/java/src/org/chromium/chrome/browser/gsa/GSAUtils.java
-@@ -14,19 +14,12 @@ import org.chromium.build.annotations.Nullable;
+@@ -15,19 +15,12 @@ import org.chromium.build.annotations.Nullable;
 /** This class provides utilities for the state of Google Search App. */
 @NullMarked
 public class GSAUtils {
@@ -121,7 +129,7 @@ diff --git a/chrome/browser/gsa/java/src/org/chromium/chrome/browser/gsa/GSAUtil
     }
 
     /**
-@@ -38,6 +31,7 @@ public class GSAUtils {
+@@ -39,6 +32,7 @@ public class GSAUtils {
      */
     public static boolean isAgsaVersionBelowMinimum(
             @Nullable String installedVersionName, @Nullable String minimumVersionName) {
@@ -129,7 +137,7 @@ diff --git a/chrome/browser/gsa/java/src/org/chromium/chrome/browser/gsa/GSAUtil
         if (TextUtils.isEmpty(installedVersionName) || TextUtils.isEmpty(minimumVersionName)) {
             return true;
         }
-@@ -68,8 +62,8 @@ public class GSAUtils {
+@@ -69,8 +63,8 @@ public class GSAUtils {
      * @return The version name of the Agsa package or null if it can't be found.
      */
     public static @Nullable String getAgsaVersionName() {
@@ -140,7 +148,7 @@ diff --git a/chrome/browser/gsa/java/src/org/chromium/chrome/browser/gsa/GSAUtil
     }
 
     /**
-@@ -78,19 +72,6 @@ public class GSAUtils {
+@@ -79,20 +73,7 @@ public class GSAUtils {
      * @return Whether the AGSA is enabled
      */
     public static boolean isAgsaEnabled() {
@@ -160,6 +168,18 @@ diff --git a/chrome/browser/gsa/java/src/org/chromium/chrome/browser/gsa/GSAUtil
 -        return sPackageInfo;
 +        return false;
     }
+ 
+     /**
+@@ -101,10 +82,5 @@ public class GSAUtils {
+      * @param packageInfo The package info to set for AGSA.
+      */
+     public static void setAgsaPackageInfoForTesting(@Nullable PackageInfo packageInfo) {
+-        sPackageInfo = packageInfo;
+-        ResettersForTesting.register(
+-                () -> {
+-                    sPackageInfo = null;
+-                });
+     }
 }
 diff --git a/chrome/browser/ui/android/google_bottom_bar/java/src/org/chromium/chrome/browser/ui/google_bottom_bar/GoogleBottomBarActionsHandler.java b/chrome/browser/ui/android/google_bottom_bar/java/src/org/chromium/chrome/browser/ui/google_bottom_bar/GoogleBottomBarActionsHandler.java
 --- a/chrome/browser/ui/android/google_bottom_bar/java/src/org/chromium/chrome/browser/ui/google_bottom_bar/GoogleBottomBarActionsHandler.java
@@ -174,7 +194,7 @@ diff --git a/chrome/browser/ui/android/google_bottom_bar/java/src/org/chromium/c
 import static org.chromium.chrome.browser.ui.google_bottom_bar.GoogleBottomBarLogger.GoogleBottomBarButtonEvent.SEARCHBOX_HOME;
 import static org.chromium.chrome.browser.ui.google_bottom_bar.GoogleBottomBarLogger.GoogleBottomBarButtonEvent.SEARCHBOX_LENS;
 import static org.chromium.chrome.browser.ui.google_bottom_bar.GoogleBottomBarLogger.GoogleBottomBarButtonEvent.SEARCHBOX_SEARCH;
-@@ -105,11 +102,6 @@ class GoogleBottomBarActionsHandler {
+@@ -106,11 +103,6 @@ class GoogleBottomBarActionsHandler {
     }
 
     void onSearchboxMicTap() {
@@ -186,7 +206,7 @@ diff --git a/chrome/browser/ui/android/google_bottom_bar/java/src/org/chromium/c
     }
 
     void onSearchboxLensTap(View buttonView) {
-@@ -148,21 +140,13 @@ class GoogleBottomBarActionsHandler {
+@@ -149,21 +141,13 @@ class GoogleBottomBarActionsHandler {
     }
 
     private void openGoogleAppSearch() {
@@ -209,7 +229,7 @@ diff --git a/chrome/browser/ui/android/google_bottom_bar/java/src/org/chromium/c
         intent.putExtra(EXTRA_IS_LAUNCHED_FROM_CHROME_SEARCH_ENTRYPOINT, true);
 
         if (PackageManagerUtils.canResolveActivity(intent)) {
-@@ -274,6 +258,7 @@ class GoogleBottomBarActionsHandler {
+@@ -275,6 +259,7 @@ class GoogleBottomBarActionsHandler {
     }
 
     private void sendPendingIntentWithUrl(PendingIntent pendingIntent) {
@@ -220,7 +240,7 @@ diff --git a/chrome/browser/ui/android/google_bottom_bar/java/src/org/chromium/c
 diff --git a/chrome/browser/ui/android/pdf/java/src/org/chromium/chrome/browser/pdf/PdfCoordinator.java b/chrome/browser/ui/android/pdf/java/src/org/chromium/chrome/browser/pdf/PdfCoordinator.java
 --- a/chrome/browser/ui/android/pdf/java/src/org/chromium/chrome/browser/pdf/PdfCoordinator.java
 +++ b/chrome/browser/ui/android/pdf/java/src/org/chromium/chrome/browser/pdf/PdfCoordinator.java
-@@ -265,7 +265,7 @@ public class PdfCoordinator {
+@@ -276,7 +276,7 @@ public class PdfCoordinator {
     }
 
     @Nullable String requestAssistContent(String filename, boolean isWorkProfile) {
@@ -58,7 +58,7 @@ new file mode 100644
 diff --git a/third_party/blink/renderer/platform/runtime_enabled_features.json5 b/third_party/blink/renderer/platform/runtime_enabled_features.json5
 --- a/third_party/blink/renderer/platform/runtime_enabled_features.json5
 +++ b/third_party/blink/renderer/platform/runtime_enabled_features.json5
-@@ -2766,9 +2766,8 @@
+@@ -3037,9 +3037,8 @@
       status: "stable",
     },
     {
@@ -10,7 +10,7 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 diff --git a/chrome/android/java/src/org/chromium/chrome/browser/paint_preview/StartupPaintPreviewHelper.java b/chrome/android/java/src/org/chromium/chrome/browser/paint_preview/StartupPaintPreviewHelper.java
 --- a/chrome/android/java/src/org/chromium/chrome/browser/paint_preview/StartupPaintPreviewHelper.java
 +++ b/chrome/android/java/src/org/chromium/chrome/browser/paint_preview/StartupPaintPreviewHelper.java
-@@ -114,7 +114,7 @@ public class StartupPaintPreviewHelper implements Destroyable {
+@@ -119,7 +119,7 @@ public class StartupPaintPreviewHelper implements Destroyable {
 
     /** Enables Paint Preview show attempt on restoration of a tab. */
     public static void enableShowOnRestore() {
@@ -22,7 +22,7 @@ diff --git a/chrome/android/java/res/xml/privacy_preferences.xml b/chrome/androi
 diff --git a/chrome/browser/ui/webui/settings/settings_ui.cc b/chrome/browser/ui/webui/settings/settings_ui.cc
 --- a/chrome/browser/ui/webui/settings/settings_ui.cc
 +++ b/chrome/browser/ui/webui/settings/settings_ui.cc
-@@ -346,8 +346,7 @@ SettingsUI::SettingsUI(content::WebUI* web_ui)
+@@ -336,8 +336,7 @@ SettingsUI::SettingsUI(content::WebUI* web_ui)
 #endif  // BUILDFLAG(IS_CHROMEOS)
 
   bool show_privacy_guide =
@@ -31,5 +31,5 @@ diff --git a/chrome/browser/ui/webui/settings/settings_ui.cc b/chrome/browser/ui
 +      false;
   html_source->AddBoolean("showPrivacyGuide", show_privacy_guide);
 
-   html_source->AddBoolean("enableHandTrackingContentSetting",
+   html_source->AddBoolean(
 --
@@ -4,16 +4,16 @@ Subject: Disable Real Box

 Real-box is search box in ntp
 ---
- chrome/browser/prefs/browser_prefs.cc                  |  2 +-
- chrome/browser/resources/new_tab_page/app.html         | 10 ----------
- chrome/browser/ui/webui/searchbox/searchbox_handler.cc |  1 +
- components/search/ntp_features.cc                      |  6 +++---
- 4 files changed, 5 insertions(+), 14 deletions(-)
+ chrome/browser/prefs/browser_prefs.cc         |  2 +-
+ .../browser/resources/new_tab_page/app.html   | 19 -------------------
+ .../searchbox/searchbox_handler.cc            |  1 +
+ components/search/ntp_features.cc             |  4 ++--
+ 4 files changed, 4 insertions(+), 22 deletions(-)

 diff --git a/chrome/browser/prefs/browser_prefs.cc b/chrome/browser/prefs/browser_prefs.cc
 --- a/chrome/browser/prefs/browser_prefs.cc
 +++ b/chrome/browser/prefs/browser_prefs.cc
-@@ -2276,7 +2276,7 @@ void RegisterProfilePrefs(user_prefs::PrefRegistrySyncable* registry,
+@@ -1987,7 +1987,7 @@ void RegisterProfilePrefs(user_prefs::PrefRegistrySyncable* registry,
   registry->RegisterBooleanPref(
       prefs::kLensRegionSearchEnabled, true,
       user_prefs::PrefRegistrySyncable::SYNCABLE_PREF);
@@ -21,59 +21,66 @@ diff --git a/chrome/browser/prefs/browser_prefs.cc b/chrome/browser/prefs/browse
 +  registry->RegisterBooleanPref(prefs::kLensDesktopNTPSearchEnabled, false);
 #endif
 
-   registry->RegisterListPref(
+   registry->RegisterBooleanPref(prefs::kDisableScreenshots, false);
 diff --git a/chrome/browser/resources/new_tab_page/app.html b/chrome/browser/resources/new_tab_page/app.html
 --- a/chrome/browser/resources/new_tab_page/app.html
 +++ b/chrome/browser/resources/new_tab_page/app.html
-@@ -19,16 +19,6 @@
-       ?hidden="${!this.logoEnabled_}">
-   </ntp-logo>
+@@ -40,25 +40,6 @@ import {nothing} from '//resources/lit/v3_0/lit.rollup.js';
+         ?hidden="${!this.showScrim_}"></div>
+   ` : ''}
   <div id="searchboxContainer">
 -    <cr-searchbox id="searchbox" ?is-dark="${this.isThemeDark_()}"
+-        placeholder-text="$i18n{searchBoxPlaceholder}"
 -        ?color-source-is-baseline="${this.colorSourceIsBaseline}"
+-        @open-composebox="${this.openComposebox_}"
 -        @open-lens-search="${this.onOpenLensSearch_}"
 -        @open-voice-search="${this.onOpenVoiceSearch_}" ?shown="${this.realboxShown_}"
 -        ?had-secondary-side="${this.realboxHadSecondarySide}"
 -        @had-secondary-side-changed="${this.onRealboxHadSecondarySideChanged_}"
+-        @context-menu-entrypoint-click="${this.onContextMenuEntrypointClick_}"
 -        ?can-show-secondary-side="${this.realboxCanShowSecondarySide}"
 -        ?compose-button-enabled="${this.composeButtonEnabled}"
-        ?composebox-enabled="${this.composeboxEnabled}">
+-        ?composebox-enabled="${this.composeboxEnabled}"
+-        searchbox-layout-mode="${this.realboxLayoutMode_}"
+-        ?ntp-realbox-next-enabled="${this.ntpRealboxNextEnabled_}"
+-        ?cycling-placeholders="${this.searchboxCyclingPlaceholders_}"
+-        @searchbox-input-focus-changed="${this.onInputFocusChanged_}"
+-        context-menu-glif-animation-state="${this.contextMenuGlifAnimationState_}"
+-        ?multi-line-enabled="${this.multiLineEnabled_}">
 -    </cr-searchbox>
-     ${this.showLensUploadDialog_ ? html`
-       <ntp-lens-upload-dialog id="lensUploadDialog"
-           @close-lens-search="${this.onCloseLensSearch_}">
-diff --git a/chrome/browser/ui/webui/searchbox/searchbox_handler.cc b/chrome/browser/ui/webui/searchbox/searchbox_handler.cc
--- a/chrome/browser/ui/webui/searchbox/searchbox_handler.cc
-+++ b/chrome/browser/ui/webui/searchbox/searchbox_handler.cc
-@@ -438,6 +438,7 @@ void SearchboxHandler::SetupWebUIDataSource(content::WebUIDataSource* source,
+     ${this.showComposebox_ ? html`
+       ${this.enableModalComposebox_ ? html`
+         <div id="dialogAnchor"></div>
+diff --git a/chrome/browser/ui/webui/cr_components/searchbox/searchbox_handler.cc b/chrome/browser/ui/webui/cr_components/searchbox/searchbox_handler.cc
+--- a/chrome/browser/ui/webui/cr_components/searchbox/searchbox_handler.cc
+++ b/chrome/browser/ui/webui/cr_components/searchbox/searchbox_handler.cc
+@@ -299,6 +299,7 @@ void SearchboxHandler::SetupWebUIDataSource(content::WebUIDataSource* source,
                                             Profile* profile,
                                             bool enable_voice_search,
                                             bool enable_lens_search) {
 +  enable_lens_search = false;
-   // Embedders which are served from chrome-untrusted:// URLs should override
-   // this to false. The chrome.timeTicks capability that the metrics reporter
-   // depends on is not defined in chrome-untrusted environments and attempting
+   // The WebUI Omnibox code will override this to `true` to adjust various
+   // color and layout options.
+   source->AddBoolean("isTopChromeSearchbox", false);
 diff --git a/components/search/ntp_features.cc b/components/search/ntp_features.cc
 --- a/components/search/ntp_features.cc
 +++ b/components/search/ntp_features.cc
-@@ -138,7 +138,7 @@ BASE_FEATURE(kNtpDriveModuleShowSixFiles,
+@@ -114,7 +114,7 @@ BASE_FEATURE(kNtpDriveModuleShowSixFiles, base::FEATURE_ENABLED_BY_DEFAULT);
 
 // If enabled, logo will be shown.
 // This is a kill switch. Keep indefinitely.
-BASE_FEATURE(kNtpLogo, "NtpLogo", base::FEATURE_ENABLED_BY_DEFAULT);
-+BASE_FEATURE(kNtpLogo, "NtpLogo", base::FEATURE_DISABLED_BY_DEFAULT);
+-BASE_FEATURE(kNtpLogo, base::FEATURE_ENABLED_BY_DEFAULT);
+BASE_FEATURE(kNtpLogo, base::FEATURE_DISABLED_BY_DEFAULT);
 
 // If enabled, middle slot promo will be shown.
 // This is a kill switch. Keep indefinitely.
-@@ -191,8 +191,8 @@ BASE_FEATURE(kNtpModulesLoad,
+@@ -156,7 +156,7 @@ BASE_FEATURE(kNtpModuleSignInRequirement, base::FEATURE_ENABLED_BY_DEFAULT);
+ 
 // If enabled, OneGoogleBar will be shown.
 // This is a kill switch. Keep indefinitely.
- BASE_FEATURE(kNtpOneGoogleBar,
-             "NtpOneGoogleBar",
-             base::FEATURE_ENABLED_BY_DEFAULT);
-+             "NtpOneGoogleBar",                   // disabled
-+             base::FEATURE_DISABLED_BY_DEFAULT);  // by default
+-BASE_FEATURE(kNtpOneGoogleBar, base::FEATURE_ENABLED_BY_DEFAULT);
+BASE_FEATURE(kNtpOneGoogleBar, base::FEATURE_DISABLED_BY_DEFAULT);
 
 // If enabled, outlook calendar module will be shown.
- BASE_FEATURE(kNtpOutlookCalendarModule,
+ BASE_FEATURE(kNtpOutlookCalendarModule, base::FEATURE_ENABLED_BY_DEFAULT);
 --
@@ -0,0 +1,28 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Wed, 29 Oct 2025 13:01:41 +0000
+Subject: Disable Sticky User Activation Across Same Origin Navigation
+
+Do not retains the user activation status after navigating
+from one page to another page of the same origin.
+It is currently not possible to remove activation once it has been granted.
+
+License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
+---
+ .../blink/renderer/platform/runtime_enabled_features.json5    | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/third_party/blink/renderer/platform/runtime_enabled_features.json5 b/third_party/blink/renderer/platform/runtime_enabled_features.json5
+--- a/third_party/blink/renderer/platform/runtime_enabled_features.json5
+++ b/third_party/blink/renderer/platform/runtime_enabled_features.json5
+@@ -4951,8 +4951,8 @@
+     {
+       // Preserves the sticky user activation state after a page navigates to
+       // another same-origin page. https://crbug.com/433729626
+-      name: "StickyUserActivationAcrossSameOriginNavigation",
+-      status: "stable",
+      name: "StickyUserActivationAcrossSameOriginNavigation", status: "experimental", // disabled by default
+
+     },
+     {
+       name: "StorageBuckets",
+--
@@ -29,10 +29,10 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 .../features_cc/Disable-TLS-resumption.inc    |  7 +++
 .../features_h/Disable-TLS-resumption.inc     |  5 ++
 net/http/http_network_session.cc              |  1 +
- net/quic/quic_session_pool.cc                 | 35 ++++++++++-
+ net/quic/quic_session_pool.cc                 | 34 ++++++++++-
 net/socket/ssl_client_socket_impl.cc          | 59 +++++++++++++++++++
 net/socket/ssl_client_socket_impl.h           |  2 +
- 7 files changed, 120 insertions(+), 1 deletion(-)
+ 7 files changed, 119 insertions(+), 1 deletion(-)
 create mode 100644 cromite_flags/chrome/browser/about_flags_cc/Disable-TLS-resumption.inc
 create mode 100644 cromite_flags/net/base/features_cc/Disable-TLS-resumption.inc
 create mode 100644 cromite_flags/net/base/features_h/Disable-TLS-resumption.inc
@@ -79,7 +79,7 @@ new file mode 100644
 diff --git a/net/http/http_network_session.cc b/net/http/http_network_session.cc
 --- a/net/http/http_network_session.cc
 +++ b/net/http/http_network_session.cc
-@@ -222,6 +222,7 @@ HttpNetworkSession::HttpNetworkSession(const HttpNetworkSessionParams& params,
+@@ -218,6 +218,7 @@ HttpNetworkSession::HttpNetworkSession(const HttpNetworkSessionParams& params,
 
   next_protos_.push_back(NextProto::kProtoHTTP11);
 
@@ -90,15 +90,7 @@ diff --git a/net/http/http_network_session.cc b/net/http/http_network_session.cc
 diff --git a/net/quic/quic_session_pool.cc b/net/quic/quic_session_pool.cc
 --- a/net/quic/quic_session_pool.cc
 +++ b/net/quic/quic_session_pool.cc
-@@ -85,6 +85,7 @@
- #include "net/third_party/quiche/src/quiche/quic/platform/api/quic_flags.h"
- #include "net/traffic_annotation/network_traffic_annotation.h"
- #include "third_party/boringssl/src/include/openssl/aead.h"
-+#include "third_party/boringssl/src/include/openssl/ssl.h"
- #include "url/gurl.h"
- #include "url/scheme_host_port.h"
- #include "url/url_constants.h"
-@@ -371,6 +372,38 @@ void LogSessionKeyMismatch(QuicSessionKeyPartialMatchResult result,
+@@ -380,6 +380,38 @@ base::TimeDelta GetAdditionalDelayForMainJob() {
 
 }  // namespace
 
@@ -137,9 +129,9 @@ diff --git a/net/quic/quic_session_pool.cc b/net/quic/quic_session_pool.cc
 QuicSessionRequest::QuicSessionRequest(QuicSessionPool* pool) : pool_(pool) {}
 
 QuicSessionRequest::~QuicSessionRequest() {
-@@ -2365,7 +2398,7 @@ QuicSessionPool::CreateCryptoConfigHandle(QuicCryptoClientConfigKey key) {
+@@ -2422,7 +2454,7 @@ QuicSessionPool::CreateCryptoConfigHandle(QuicCryptoClientConfigKey key) {
               cert_verifier_, transport_security_state_, sct_auditing_delegate_,
-               HostsFromOrigins(params_.origins_to_force_quic_on),
+               std::move(hostnames_to_allow_unknown_roots),
               key.network_anonymization_key),
 -          std::make_unique<quic::QuicClientSessionCache>(), this);
 +          std::make_unique<BromiteSessionCache>(), this);
@@ -149,7 +141,7 @@ diff --git a/net/quic/quic_session_pool.cc b/net/quic/quic_session_pool.cc
 diff --git a/net/socket/ssl_client_socket_impl.cc b/net/socket/ssl_client_socket_impl.cc
 --- a/net/socket/ssl_client_socket_impl.cc
 +++ b/net/socket/ssl_client_socket_impl.cc
-@@ -290,7 +290,33 @@ SSLClientSocketImpl::SSLClientSocketImpl(
+@@ -292,7 +292,33 @@ SSLClientSocketImpl::SSLClientSocketImpl(
   CHECK(context_);
 }
 
@@ -183,7 +175,7 @@ diff --git a/net/socket/ssl_client_socket_impl.cc b/net/socket/ssl_client_socket
   Disconnect();
 }
 
-@@ -681,6 +707,8 @@ int SSLClientSocketImpl::Init() {
+@@ -709,6 +735,8 @@ int SSLClientSocketImpl::Init() {
     }
     if (session)
       SSL_set_session(ssl_.get(), session.get());
@@ -192,7 +184,7 @@ diff --git a/net/socket/ssl_client_socket_impl.cc b/net/socket/ssl_client_socket
   }
 
   transport_adapter_ = std::make_unique<SocketBIOAdapter>(
-@@ -966,6 +994,35 @@ int SSLClientSocketImpl::DoHandshakeComplete(int result) {
+@@ -986,6 +1014,35 @@ int SSLClientSocketImpl::DoHandshakeComplete(int result) {
                     : SSLHandshakeDetails::kTLS13Full;
     }
   }
@@ -228,7 +220,7 @@ diff --git a/net/socket/ssl_client_socket_impl.cc b/net/socket/ssl_client_socket
   UMA_HISTOGRAM_ENUMERATION("Net.SSLHandshakeDetails", details);
 
   // Measure TLS connections that implement the renegotiation_info and EMS
-@@ -1582,6 +1639,8 @@ bool SSLClientSocketImpl::IsRenegotiationAllowed() const {
+@@ -1625,6 +1682,8 @@ bool SSLClientSocketImpl::IsRenegotiationAllowed() const {
 }
 
 bool SSLClientSocketImpl::IsCachingEnabled() const {
@@ -240,9 +232,9 @@ diff --git a/net/socket/ssl_client_socket_impl.cc b/net/socket/ssl_client_socket
 diff --git a/net/socket/ssl_client_socket_impl.h b/net/socket/ssl_client_socket_impl.h
 --- a/net/socket/ssl_client_socket_impl.h
 +++ b/net/socket/ssl_client_socket_impl.h
-@@ -123,6 +123,8 @@ class SSLClientSocketImpl : public SSLClientSocket,
-   friend class SSLClientSocket;
+@@ -127,6 +127,8 @@ class NET_EXPORT_PRIVATE SSLClientSocketImpl
   friend class SSLContext;
+   FRIEND_TEST_ALL_PREFIXES(SSLClientSocketTest, ParseServerTrustAnchorIDs);
 
 +  void Log_ssl_session_data(const std::string& tag, SSL_SESSION* session);
 +
@@ -7,25 +7,28 @@ getHighEntropyValues will return only the major version
 Original License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
 ---
- .../renderer/core/frame/navigator_ua_data.cc     | 16 ++++++++++++++--
- 1 file changed, 14 insertions(+), 2 deletions(-)
+ .../renderer/core/frame/navigator_ua_data.cc  | 21 +++++++++++++++++--
+ 1 file changed, 19 insertions(+), 2 deletions(-)

 diff --git a/third_party/blink/renderer/core/frame/navigator_ua_data.cc b/third_party/blink/renderer/core/frame/navigator_ua_data.cc
 --- a/third_party/blink/renderer/core/frame/navigator_ua_data.cc
 +++ b/third_party/blink/renderer/core/frame/navigator_ua_data.cc
-@@ -7,6 +7,8 @@
+@@ -7,6 +7,9 @@
 #include "base/compiler_specific.h"
 #include "base/task/single_thread_task_runner.h"
 #include "third_party/blink/public/common/features.h"
 +#include "base/version.h"
 +#include "base/strings/strcat.h"
- #include "third_party/blink/public/common/privacy_budget/identifiability_metric_builder.h"
- #include "third_party/blink/public/common/privacy_budget/identifiability_study_settings.h"
- #include "third_party/blink/public/common/privacy_budget/identifiable_surface.h"
-@@ -65,6 +67,16 @@ void MaybeRecordMetric(bool record_identifiability,
-                     execution_context);
- }
+#include "base/strings/string_number_conversions.h"
+ #include "third_party/blink/public/mojom/use_counter/metrics/web_feature.mojom-blink.h"
+ #include "third_party/blink/renderer/bindings/core/v8/script_promise_resolver.h"
+ #include "third_party/blink/renderer/bindings/core/v8/v8_ua_data_values.h"
+@@ -17,6 +20,20 @@
 
+ namespace blink {
+ 
+namespace {
+
 +const String GetReducedVersionNumber(const std::string& fullVersion) {
 +  base::Version version(fullVersion);
 +  std::string version_str;
@@ -36,10 +39,12 @@ diff --git a/third_party/blink/renderer/core/frame/navigator_ua_data.cc b/third_
 +  return String::FromUTF8(version_str);
 +}
 +
- }  // namespace
- 
+}
+
 NavigatorUAData::NavigatorUAData(ExecutionContext* context)
-@@ -103,7 +115,7 @@ void NavigatorUAData::SetFullVersionList(
+     : ExecutionContextClient(context) {
+   NavigatorUABrandVersion* dict = NavigatorUABrandVersion::Create();
+@@ -53,7 +70,7 @@ void NavigatorUAData::SetFullVersionList(
     const UserAgentBrandList& full_version_list) {
   for (const auto& brand_version : full_version_list) {
     AddBrandFullVersion(String::FromUTF8(brand_version.brand),
@@ -48,7 +53,7 @@ diff --git a/third_party/blink/renderer/core/frame/navigator_ua_data.cc b/third_
   }
 }
 
-@@ -125,7 +137,7 @@ void NavigatorUAData::SetModel(const String& model) {
+@@ -75,7 +92,7 @@ void NavigatorUAData::SetModel(const String& model) {
 }
 
 void NavigatorUAData::SetUAFullVersion(const String& ua_full_version) {
@@ -21,7 +21,7 @@ new file mode 100644
 diff --git a/third_party/blink/renderer/platform/runtime_enabled_features.json5 b/third_party/blink/renderer/platform/runtime_enabled_features.json5
 --- a/third_party/blink/renderer/platform/runtime_enabled_features.json5
 +++ b/third_party/blink/renderer/platform/runtime_enabled_features.json5
-@@ -5200,8 +5200,7 @@
+@@ -5592,8 +5592,7 @@
       status: "stable",
     },
     {
@@ -30,5 +30,5 @@ diff --git a/third_party/blink/renderer/platform/runtime_enabled_features.json5
 +      name: "ViewportSegments", status: "test", public: true
     },
     {
-       name: "ViewTransitionLongCallbackTimeoutForTesting",
+       name: "ViewTransitionAsyncFinished",
 --
@@ -14,9 +14,9 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 diff --git a/components/content_settings/core/browser/content_settings_registry.cc b/components/content_settings/core/browser/content_settings_registry.cc
 --- a/components/content_settings/core/browser/content_settings_registry.cc
 +++ b/components/content_settings/core/browser/content_settings_registry.cc
-@@ -372,8 +372,13 @@ void ContentSettingsRegistry::Init() {
+@@ -347,8 +347,13 @@ void ContentSettingsRegistry::Init() {
            ContentSettingsInfo::INHERIT_IF_LESS_PERMISSIVE,
-            ContentSettingsInfo::EXCEPTIONS_ON_SECURE_AND_INSECURE_ORIGINS);
+            PermissionSettingsInfo::EXCEPTIONS_ON_SECURE_AND_INSECURE_ORIGINS);
 
 +#if BUILDFLAG(IS_ANDROID)
   Register(ContentSettingsType::BLUETOOTH_GUARD, "bluetooth-guard",
@@ -12,7 +12,7 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 diff --git a/content/child/runtime_features.cc b/content/child/runtime_features.cc
 --- a/content/child/runtime_features.cc
 +++ b/content/child/runtime_features.cc
-@@ -555,6 +555,8 @@ void SetCustomizedRuntimeFeaturesFromCombinedArgs(
+@@ -552,6 +552,8 @@ void SetCustomizedRuntimeFeaturesFromCombinedArgs(
 
   WebRuntimeFeatures::EnableRemotePlayback(false);
 
@@ -20,14 +20,14 @@ diff --git a/content/child/runtime_features.cc b/content/child/runtime_features.
 +
   WebRuntimeFeatures::EnableBackForwardCache(
       content::IsBackForwardCacheEnabled());
- }
+ 
 diff --git a/gpu/config/gpu_finch_features.cc b/gpu/config/gpu_finch_features.cc
 --- a/gpu/config/gpu_finch_features.cc
 +++ b/gpu/config/gpu_finch_features.cc
-@@ -235,7 +235,7 @@ BASE_FEATURE(kEnableDrDc,
+@@ -196,7 +196,7 @@ BASE_FEATURE(kEnableDrDc,
 // enabled by default on supported platforms.
 #if BUILDFLAG(IS_APPLE) || BUILDFLAG(IS_WIN) || BUILDFLAG(IS_CHROMEOS) || \
-     BUILDFLAG(IS_ANDROID)
+     BUILDFLAG(IS_ANDROID) || BUILDFLAG(USE_WEBGPU_ON_VULKAN_VIA_GL_INTEROP)
 -#define WEBGPU_ENABLED base::FEATURE_ENABLED_BY_DEFAULT
 +#define WEBGPU_ENABLED base::FEATURE_DISABLED_BY_DEFAULT
 #else
@@ -36,7 +36,7 @@ diff --git a/gpu/config/gpu_finch_features.cc b/gpu/config/gpu_finch_features.cc
 diff --git a/third_party/blink/renderer/modules/webgpu/gpu.cc b/third_party/blink/renderer/modules/webgpu/gpu.cc
 --- a/third_party/blink/renderer/modules/webgpu/gpu.cc
 +++ b/third_party/blink/renderer/modules/webgpu/gpu.cc
-@@ -157,6 +157,8 @@ GPU::GPU(NavigatorBase& navigator)
+@@ -153,6 +153,8 @@ GPU::GPU(NavigatorBase& navigator)
 GPU::~GPU() = default;
 
 WGSLLanguageFeatures* GPU::wgslLanguageFeatures() const {
@@ -45,7 +45,7 @@ diff --git a/third_party/blink/renderer/modules/webgpu/gpu.cc b/third_party/blin
   return wgsl_language_features_.Get();
 }
 
-@@ -427,6 +429,7 @@ ScriptPromise<IDLNullable<GPUAdapter>> GPU::requestAdapter(
+@@ -404,6 +406,7 @@ ScriptPromise<IDLNullable<GPUAdapter>> GPU::requestAdapter(
         "WebGPU is experimental on this platform. See "
         "https://github.com/gpuweb/gpuweb/wiki/"
         "Implementation-Status#implementation-status"));
--- a/Show More
+++ b/Show More