[AUTO][FILECONTROL] - version

Fix a Null Pointer Dereference crash in `GetInsecureTopLevelSite()`
affecting sites with heavy Service Worker usage (e.g., Discord, Reddit).
This rewrite also hardens our custom `Partition-blobs-by-top-frame-URL`
logic against upstream cross-partition token leak vectors.

In `public_url_manager.cc`, the custom helper was passing the result of
`worker_global_scope->top_level_frame_security_origin()` straight into the
`BlinkSchemefulSite` constructor. However, this property is intentionally
null for Service Workers, causing a fatal null pointer dereference crash.

Additionally, since Cromite's partition checks execute downstream from
vanilla Chromium's native mitigations, the browser-side fallback using
`agent_cluster_id` inside `IsSamePartition()` was redundant dead code.

Changes:
1. Blink: Fully rewrote `GetInsecureTopLevelSite()` using safe `DynamicTo`
   casts. For Service Workers, it now safely pulls the browser-validated
   partition directly via `service_worker->storage_key().top_level_site()`,
   eliminating the null pointer crash surface.
2. Blink / Hardening: Intentionally excluded Shared Workers from Blob URL
   support (`IsSharedWorkerGlobalScope()`) by returning `std::nullopt` to prevent
   unpartitioned fallback vectors in shared contexts.
3. Storage: Streamlined `IsSamePartition()` in `blob_url_store_impl.cc`
   by removing the obsolete `agent_cluster_id` fallback, leaving a clean,
   deterministic verification of the top-level site partition.

.github/workflows/release.yaml

@@ -178,8 +178,6 @@ jobs:
           cp $OUTPUTFILE_LIN/product_logo_48.png chrome-lin/
           cp $OUTPUTFILE_LIN/resources.pak chrome-lin/
           cp $OUTPUTFILE_LIN/snapshot_blob.bin chrome-lin/
-          cp $OUTPUTFILE_LIN/xdg-mime chrome-lin/
-          cp $OUTPUTFILE_LIN/xdg-settings chrome-lin/
           cp $OUTPUTFILE_LIN/chrome_sandbox chrome-lin/
 
           tar -czvf chrome-lin64.tar.gz chrome-lin/

build/patches/Partition-blobs-by-top-frame-URL.patch

@@ -2,8 +2,45 @@ From: uazo <uazo@users.noreply.github.com>
 Date: Tue, 20 Sep 2022 07:20:01 +0000
 Subject: Partition blobs by top frame URL
 
-Verifies that the blob was created with the same top frame URL
-or, if not defined, by the same agent cluster.
+Introduce a global site-isolation mechanism in Cromite that strictly
+partitions the registration, resolution, and token exchange of Blob
+URLs based on the top-level frame's site identity. This enforces
+robust W3C Storage Partitioning guarantees and neutralizes cross-
+partition data exfiltration vectors.
+
+Global Architecture
+
+By default, standard Chromium allows cross-site contexts and identical
+third-party iframes to share or guess Blob URL references. This patch
+seals these privacy leaks by modifying the entire public URL pipeline
+across Blink and the Browser Process:
+
+1. Renderer-Side Context Resolution (Blink): Restructures
+   PublicURLManager and introduces a centralized helper
+   (GetInsecureTopLevelSite) to safely compute and propagate the
+   caller's active top-level site partition. It cleanly differentiates
+   between graphical windows/iframes and asynchronous background
+   environments (Dedicated Workers and Service Workers). Service
+   Workers derive their boundary directly from their browser-validated
+   StorageKey to maintain first-party compliance while eliminating
+   historical null-pointer crash surfaces.
+
+2. Intentional Scope Restrictions: To guarantee absolute isolation,
+   Blob URL support is deliberately dropped for Shared Workers, cutting
+   off unpartitioned cross-context communication channels.
+
+3. Mojo IPC and Browser Validation (Storage): Extends the BlobURLStore
+   IPC interface (Register, ResolveAsURLLoaderFactory,
+   ResolveAsBlobURLToken) to mandate top-level site wire parameters.
+   The storage backend enforces a strict, deterministic
+   IsSamePartition() validation check, dropping unauthorized
+   cross-partition requests on the floor downstream of vanilla
+   Chromium's native defenses.
+
+This global framework ensures that a Blob URL remains rigidly confined
+and sandboxed within the specific top-level site partition that
+originally spawned it, drastically enhancing Cromite's privacy profile
+without impacting standard web platform compatibility.
 
 Original License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
 License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
@@ -12,12 +49,12 @@ License: GPL-3.0-only - https://spdx.org/licenses/GPL-3.0-only.html
  .../Partition-blobs-by-top-frame-URL.inc      |  1 +
  storage/browser/blob/blob_url_registry.cc     | 31 +++++++++-
  storage/browser/blob/blob_url_registry.h      | 11 +++-
- storage/browser/blob/blob_url_store_impl.cc   | 62 +++++++++++++++++--
+ storage/browser/blob/blob_url_store_impl.cc   | 58 +++++++++++++++++--
  storage/browser/blob/blob_url_store_impl.h    | 15 ++++-
  storage/browser/blob/features.cc              |  1 +
- .../public/mojom/blob/blob_url_store.mojom    | 13 +++-
- .../core/fileapi/public_url_manager.cc        | 37 ++++++++++-
- 9 files changed, 158 insertions(+), 15 deletions(-)
+ .../public/mojom/blob/blob_url_store.mojom    | 13 ++++-
+ .../core/fileapi/public_url_manager.cc        | 57 +++++++++++++++++-
+ 9 files changed, 174 insertions(+), 15 deletions(-)
  create mode 100644 cromite_flags/third_party/blink/common/features_cc/Partition-blobs-by-top-frame-URL.inc
 
 diff --git a/content/browser/renderer_host/render_frame_host_impl.cc b/content/browser/renderer_host/render_frame_host_impl.cc
@@ -137,7 +174,7 @@ diff --git a/storage/browser/blob/blob_url_registry.h b/storage/browser/blob/blo
 diff --git a/storage/browser/blob/blob_url_store_impl.cc b/storage/browser/blob/blob_url_store_impl.cc
 --- a/storage/browser/blob/blob_url_store_impl.cc
 +++ b/storage/browser/blob/blob_url_store_impl.cc
-@@ -115,9 +115,35 @@ BlobURLStoreImpl::~BlobURLStoreImpl() {
+@@ -115,9 +115,33 @@ BlobURLStoreImpl::~BlobURLStoreImpl() {
    }
  }
  
@@ -148,13 +185,11 @@ diff --git a/storage/browser/blob/blob_url_store_impl.cc b/storage/browser/blob/
 +  bool is_same_partition = false;
 +  const std::optional<net::SchemefulSite>& top_level_site =
 +    registry_->GetUnsafeTopLevelSite(blob_url);
-+  const std::optional<base::UnguessableToken> agent_cluster_id =
-+    registry_->GetUnsafeAgentClusterID(blob_url);
 +  if (top_level_site.has_value()) {
 +    is_same_partition = (top_level_site == unsafe_top_level_site);
-+  } else {
-+    is_same_partition = (agent_cluster_id == unsafe_agent_cluster_id);
 +  }
++  // const std::optional<base::UnguessableToken> agent_cluster_id =
++  //   registry_->GetUnsafeAgentClusterID(blob_url);
 +  // LOG(INFO) << "---BlobURLStoreImpl "
 +  //           << " is_same_partition=" << is_same_partition
 +  //           << " blob_url=" << blob_url
@@ -173,7 +208,7 @@ diff --git a/storage/browser/blob/blob_url_store_impl.cc b/storage/browser/blob/
      RegisterCallback callback) {
    // TODO(crbug.com/40061399): Generate blob URLs here, rather than
    // validating the URLs the renderer process generated.
-@@ -125,10 +151,18 @@ void BlobURLStoreImpl::Register(
+@@ -125,10 +149,18 @@ void BlobURLStoreImpl::Register(
      std::move(callback).Run();
      return;
    }
@@ -193,7 +228,7 @@ diff --git a/storage/browser/blob/blob_url_store_impl.cc b/storage/browser/blob/
    urls_.insert(url);
    std::move(callback).Run();
  }
-@@ -150,7 +184,7 @@ bool BlobURLStoreImpl::ShouldPartitionBlobUrlAccess(
+@@ -150,7 +182,7 @@ bool BlobURLStoreImpl::ShouldPartitionBlobUrlAccess(
            features::kBlockCrossPartitionBlobUrlFetching) &&
        !partitioning_disabled_by_policy_;
  
@@ -202,7 +237,7 @@ diff --git a/storage/browser/blob/blob_url_store_impl.cc b/storage/browser/blob/
        has_storage_access_handle &&
        mapping_status ==
            BlobUrlRegistry::MappingStatus::
-@@ -160,7 +194,9 @@ bool BlobURLStoreImpl::ShouldPartitionBlobUrlAccess(
+@@ -160,7 +192,9 @@ bool BlobURLStoreImpl::ShouldPartitionBlobUrlAccess(
  
  void BlobURLStoreImpl::ResolveAsURLLoaderFactory(
      const GURL& url,
@@ -213,7 +248,7 @@ diff --git a/storage/browser/blob/blob_url_store_impl.cc b/storage/browser/blob/
    if (!registry_) {
      BlobURLLoaderFactory::Create(mojo::NullRemote(), url, std::move(receiver));
      return;
-@@ -183,6 +219,7 @@ void BlobURLStoreImpl::ResolveAsURLLoaderFactory(
+@@ -183,6 +217,7 @@ void BlobURLStoreImpl::ResolveAsURLLoaderFactory(
      if (IsBlobUrlAccessCrossPartitionSameOrigin(mapping_status)) {
        if (ShouldPartitionBlobUrlAccess(has_storage_access_handle,
                                         mapping_status)) {
@@ -221,21 +256,20 @@ diff --git a/storage/browser/blob/blob_url_store_impl.cc b/storage/browser/blob/
          partitioning_blob_url_closure_.Run(
              url, blink::mojom::PartitioningBlobURLInfo::
                       kBlockedCrossPartitionFetching);
-@@ -194,6 +231,13 @@ void BlobURLStoreImpl::ResolveAsURLLoaderFactory(
+@@ -194,6 +229,12 @@ void BlobURLStoreImpl::ResolveAsURLLoaderFactory(
      }
    }
  
 +  if (!IsSamePartition(url, unsafe_agent_cluster_id, unsafe_top_level_site)) {
 +    // LOG(INFO) << "---ResolveAsURLLoaderFactory blocked by IsSamePartition" << url;
 +    BlobURLLoaderFactory::Create(mojo::NullRemote(), url, std::move(receiver));
-+    //std::move(callback).Run(std::nullopt, std::nullopt);
 +    return;
 +  }
 +  // LOG(INFO) << "---ResolveAsURLLoaderFactory allowed " << url;
    BlobURLLoaderFactory::Create(registry_->GetBlobFromUrl(url), url,
                                 std::move(receiver));
  }
-@@ -201,7 +245,9 @@ void BlobURLStoreImpl::ResolveAsURLLoaderFactory(
+@@ -201,7 +242,9 @@ void BlobURLStoreImpl::ResolveAsURLLoaderFactory(
  void BlobURLStoreImpl::ResolveAsBlobURLToken(
      const GURL& url,
      mojo::PendingReceiver<blink::mojom::BlobURLToken> token,
@@ -246,7 +280,7 @@ diff --git a/storage/browser/blob/blob_url_store_impl.cc b/storage/browser/blob/
    // This function is known to be heap allocation heavy and performance
    // critical. Extra memory safety checks can introduce regression
    // (https://crbug.com/414710225) and these are disabled here.
-@@ -218,6 +264,7 @@ void BlobURLStoreImpl::ResolveAsBlobURLToken(
+@@ -218,6 +261,7 @@ void BlobURLStoreImpl::ResolveAsBlobURLToken(
          registry_->IsUrlMapped(BlobUrlUtils::ClearUrlFragment(url),
                                 storage_key_);
      if (IsBlobUrlAccessCrossPartitionSameOrigin(mapping_status)) {
@@ -254,13 +288,12 @@ diff --git a/storage/browser/blob/blob_url_store_impl.cc b/storage/browser/blob/
        if (ShouldPartitionBlobUrlAccess(has_storage_access_handle,
                                         mapping_status)) {
          partitioning_blob_url_closure_.Run(
-@@ -228,12 +275,17 @@ void BlobURLStoreImpl::ResolveAsBlobURLToken(
+@@ -228,12 +272,16 @@ void BlobURLStoreImpl::ResolveAsBlobURLToken(
        partitioning_blob_url_closure_.Run(url, std::nullopt);
      }
    }
 +  if (!IsSamePartition(url, unsafe_agent_cluster_id, unsafe_top_level_site)) {
 +    // LOG(INFO) << "---ResolveAsBlobURLToken blocked by IsSamePartition" << url;
-+    //std::move(callback).Run(std::nullopt);
 +    return;
 +  }
  
@@ -371,68 +404,97 @@ diff --git a/third_party/blink/public/mojom/blob/blob_url_store.mojom b/third_pa
 diff --git a/third_party/blink/renderer/core/fileapi/public_url_manager.cc b/third_party/blink/renderer/core/fileapi/public_url_manager.cc
 --- a/third_party/blink/renderer/core/fileapi/public_url_manager.cc
 +++ b/third_party/blink/renderer/core/fileapi/public_url_manager.cc
-@@ -61,6 +61,25 @@ static void RemoveFromNullOriginMapIfNecessary(const KURL& blob_url) {
+@@ -39,8 +39,10 @@
+ #include "third_party/blink/renderer/core/execution_context/execution_context.h"
+ #include "third_party/blink/renderer/core/fileapi/url_registry.h"
+ #include "third_party/blink/renderer/core/frame/local_dom_window.h"
++#include "third_party/blink/renderer/core/workers/dedicated_worker_global_scope.h"
+ #include "third_party/blink/renderer/core/workers/worker_global_scope.h"
+ #include "third_party/blink/renderer/core/workers/worklet_global_scope.h"
++#include "third_party/blink/renderer/modules/service_worker/service_worker_global_scope.h"
+ #include "third_party/blink/renderer/platform/blob/blob_data.h"
+ #include "third_party/blink/renderer/platform/blob/blob_url.h"
+ #include "third_party/blink/renderer/platform/blob/blob_url_null_origin_map.h"
+@@ -61,6 +63,49 @@ static void RemoveFromNullOriginMapIfNecessary(const KURL& blob_url) {
      BlobURLNullOriginMap::GetInstance()->Remove(blob_url);
  }
  
 +static std::optional<BlinkSchemefulSite> GetInsecureTopLevelSite(
 +    ExecutionContext* execution_context) {
-+  std::optional<BlinkSchemefulSite> top_level_site;
-+  if (execution_context->IsWindow()) {
-+    auto* window = To<LocalDOMWindow>(execution_context);
-+    if (window->top() && window->top()->GetFrame()) {
-+      top_level_site = BlinkSchemefulSite(window->top()
-+                                              ->GetFrame()
-+                                              ->GetSecurityContext()
-+                                              ->GetSecurityOrigin());
-+    }
-+  } else if (auto* worker_global_scope =
-+                 DynamicTo<WorkerGlobalScope>(execution_context)) {
-+    top_level_site = BlinkSchemefulSite(
-+      worker_global_scope->top_level_frame_security_origin());
++  if (!execution_context) {
++    return std::nullopt;
 +  }
-+  return top_level_site;
++
++  // Window / Iframe (Secure and partitionable context)
++  if (auto* window = DynamicTo<LocalDOMWindow>(execution_context)) {
++    // LOG(INFO) << "--is window";
++    return window->GetStorageKey().GetTopLevelSite();
++  }
++
++  // Workers
++  if (auto* worker = DynamicTo<WorkerGlobalScope>(execution_context)) {
++    // We explicitly exclude Shared Workers from Blob support
++    if (execution_context->IsSharedWorkerGlobalScope()) {
++      // LOG(INFO) << "--is shared worker";
++      return std::nullopt;
++    }
++
++    // Service Workers and Dedicated Workers continue to use the 3PSP secure flow if set
++    if (worker->top_level_frame_security_origin()) {
++      // LOG(INFO) << "--is worker with top level frame";
++      return BlinkSchemefulSite(worker->top_level_frame_security_origin());
++    }
++
++    // Dedicated Workers are allowed to continue using their own origin.
++    if (auto* dedicated = DynamicTo<DedicatedWorkerGlobalScope>(worker)) {
++      // LOG(INFO) << "--is dedicated";
++      return BlinkSchemefulSite(dedicated->GetSecurityOrigin());
++    }
++
++    if (auto* service_worker = DynamicTo<ServiceWorkerGlobalScope>(worker)) {
++      // LOG(INFO) << "--is service worker";
++      const blink::StorageKey& storage_key = service_worker->storage_key();
++      return BlinkSchemefulSite(storage_key.top_level_site());
++    }
++  }
++
++  // LOG(INFO) << "--is other";
++  return std::nullopt;
 +}
 +
  }  // namespace
  
  PublicURLManager::PublicURLManager(ExecutionContext* execution_context)
-@@ -158,7 +177,17 @@ String PublicURLManager::RegisterURL(URLRegistrable* registrable) {
+@@ -158,7 +203,9 @@ String PublicURLManager::RegisterURL(URLRegistrable* registrable) {
      mojo::PendingReceiver<mojom::blink::Blob> blob_receiver =
          blob_remote.InitWithNewPipeAndPassReceiver();
  
 -    GetBlobURLStore().Register(std::move(blob_remote), url);
-+    std::optional<BlinkSchemefulSite> top_level_site;
-+    if (GetExecutionContext()->IsWindow()) {
-+      auto* window = To<LocalDOMWindow>(GetExecutionContext());
-+      if (window->top() && window->top()->GetFrame()) {
-+        top_level_site = BlinkSchemefulSite(window->top()
-+                                                ->GetFrame()
-+                                                ->GetSecurityContext()
-+                                                ->GetSecurityOrigin());
-+      }
-+    }
-+    GetBlobURLStore().Register(std::move(blob_remote), url, GetExecutionContext()->GetAgentClusterID(), top_level_site);
++    GetBlobURLStore().Register(std::move(blob_remote), url,
++      GetExecutionContext()->GetAgentClusterID(),
++      GetInsecureTopLevelSite(GetExecutionContext()));
  
      mojo_urls_.insert(url_string);
      registrable->CloneMojoBlob(std::move(blob_receiver));
-@@ -208,7 +237,8 @@ void PublicURLManager::Resolve(
+@@ -208,7 +255,9 @@ void PublicURLManager::Resolve(
  
    DCHECK(url.ProtocolIs("blob"));
  
 -  GetBlobURLStore().ResolveAsURLLoaderFactory(url, std::move(factory_receiver));
 +  GetBlobURLStore().ResolveAsURLLoaderFactory(url, std::move(factory_receiver),
-+    GetExecutionContext()->GetAgentClusterID(), GetInsecureTopLevelSite(GetExecutionContext()));
++    GetExecutionContext()->GetAgentClusterID(),
++    GetInsecureTopLevelSite(GetExecutionContext()));
  }
  
  void PublicURLManager::ResolveAsBlobURLToken(
-@@ -221,7 +251,8 @@ void PublicURLManager::ResolveAsBlobURLToken(
+@@ -221,7 +270,9 @@ void PublicURLManager::ResolveAsBlobURLToken(
    DCHECK(url.ProtocolIs("blob"));
  
    GetBlobURLStore().ResolveAsBlobURLToken(url, std::move(token_receiver),
 -                                          is_top_level_navigation);
 +                                          is_top_level_navigation,
-+                                          GetExecutionContext()->GetAgentClusterID(), GetInsecureTopLevelSite(GetExecutionContext()));
++                                          GetExecutionContext()->GetAgentClusterID(),
++                                          GetInsecureTopLevelSite(GetExecutionContext()));
  }
  
  void PublicURLManager::ContextDestroyed() {

tools/under-control/src/RELEASE

@@ -1 +1 @@
-149.0.7827.22
+148.0.7778.168

tools/under-control/src/android_webview/browser/aw_content_browser_client.cc

@@ -31,8 +31,6 @@
 #include "android_webview/browser/aw_speech_recognition_manager_delegate.h"
 #include "android_webview/browser/aw_web_contents_delegate.h"
 #include "android_webview/browser/aw_web_contents_view_delegate.h"
-#include "android_webview/browser/content_restriction/aw_content_restriction_manager_client.h"
-#include "android_webview/browser/content_restriction/aw_content_restriction_navigation_throttle.h"
 #include "android_webview/browser/content_restriction/aw_content_restriction_url_loader_throttle.h"
 #include "android_webview/browser/cookie_manager.h"
 #include "android_webview/browser/network_service/aw_browser_context_io_thread_handle.h"
@@ -735,7 +733,7 @@ void AwContentBrowserClient::CreateThrottlesForNavigation(
   if ((navigation_handle.GetNavigatingFrameType() ==
            FrameType::kPrimaryMainFrame ||
        navigation_handle.GetNavigatingFrameType() == FrameType::kSubframe) &&
-      registry.GetNavigationHandle().GetURL().SchemeIsHTTPOrHTTPS()) {
+      registry.IsHTTPOrHTTPS()) {
     AwSupervisedUserUrlClassifier* urlClassifier =
         AwSupervisedUserUrlClassifier::GetInstance();
     if (urlClassifier->ShouldCreateThrottle()) {
@@ -743,14 +741,6 @@ void AwContentBrowserClient::CreateThrottlesForNavigation(
           std::make_unique<AwSupervisedUserThrottle>(registry, urlClassifier));
     }
   }
-
-  if (base::FeatureList::IsEnabled(
-          android_webview::features::kWebViewContentRestrictionSupport)) {
-    registry.AddThrottle(
-        std::make_unique<AwContentRestrictionNavigationThrottle>(
-            registry,
-            context->GetContentRestrictionBlockedNavigationTracker()));
-  }
 }
 
 std::unique_ptr<content::PrefetchServiceDelegate>
@@ -808,12 +798,9 @@ AwContentBrowserClient::CreateURLLoaderThrottles(
   if (browser_context &&
       base::FeatureList::IsEnabled(
           android_webview::features::kWebViewContentRestrictionSupport)) {
-    AwBrowserContext* const aw_browser_context =
-        static_cast<AwBrowserContext*>(browser_context);
     result.push_back(std::make_unique<AwContentRestrictionURLLoaderThrottle>(
-        aw_browser_context->GetContentRestrictionManagerClient(),
-        aw_browser_context->GetContentRestrictionBlockedNavigationTracker(),
-        navigation_id));
+        static_cast<AwBrowserContext*>(browser_context)
+            ->GetContentRestrictionManagerClient()));
   }
 
   if (request.destination == network::mojom::RequestDestination::kDocument) {

tools/under-control/src/android_webview/browser/aw_field_trials.cc

@@ -32,6 +32,7 @@
 #include "third_party/blink/public/common/features.h"
 #include "third_party/blink/public/common/features_generated.h"
 #include "ui/android/ui_android_features.h"
+#include "ui/base/ui_base_features.h"
 #include "ui/gl/gl_features.h"
 #include "ui/gl/gl_switches.h"
 
@@ -70,13 +71,6 @@ void AwFieldTrials::RegisterFeatureOverrides(base::FeatureList* feature_list) {
   aw_feature_overrides.DisableFeature(
       input::features::kUpdateScrollPredictorInputMapping);
 
-  // InputVizard is disabled on WebView as it is a Chrome-only feature that
-  // moves input handling to the VizCompositor thread, which is out of scope
-  // for WebView's Synchronous Compositor architecture.
-  aw_feature_overrides.DisableFeature(input::features::kInputOnViz);
-  aw_feature_overrides.DisableFeature(
-      input::features::kInputVizardSpeculativeTransfer);
-
   // Disable enforcing `noopener` on Blob URL navigations on WebView.
   aw_feature_overrides.DisableFeature(
       blink::features::kEnforceNoopenerOnBlobURLNavigation);
@@ -118,6 +112,11 @@ void AwFieldTrials::RegisterFeatureOverrides(base::FeatureList* feature_list) {
   // Disable scrollbar-width on WebView.
   aw_feature_overrides.DisableFeature(blink::features::kScrollbarWidth);
 
+  // TODO(crbug.com/402144902): Remove this once webview experiment has
+  // concluded.
+  aw_feature_overrides.DisableFeature(
+      ::features::kSendEmptyGestureScrollUpdate);
+
   // Disable Populating the VisitedLinkDatabase on WebView.
   aw_feature_overrides.DisableFeature(history::kPopulateVisitedLinkDatabase);
 
@@ -329,14 +328,4 @@ void AwFieldTrials::RegisterFeatureOverrides(base::FeatureList* feature_list) {
   // its Viz thread is updated to handle IO.
   aw_feature_overrides.DisableFeature(
       ::features::kVizDirectCompositorThreadIpcFrameSinkManager);
-
-  // TODO(crbug.com/441800312): Enable this once WebView experiment has
-  // concluded.
-  aw_feature_overrides.DisableFeature(
-      blink::features::kUnthrottleAsyncTouchMoves);
-
-  // Disable `PrefetchRequestStatusListenerAsync` on WebView to run an
-  // experiment on WebView.
-  aw_feature_overrides.DisableFeature(
-      ::features::kPrefetchRequestStatusListenerAsync);
 }

tools/under-control/src/android_webview/test/data/web_tests/webexposed/global-interface-listing-expected.txt

@@ -556,7 +556,6 @@ interface CSSConditionRule : CSSGroupingRule
     method constructor
 interface CSSContainerRule : CSSConditionRule
     attribute @@toStringTag
-    getter conditions
     getter containerName
     getter containerQuery
     method constructor
@@ -1457,10 +1456,6 @@ interface ContactsManager
     method constructor
     method getProperties
     method select
-interface ContainerQueryList : EventTarget
-    attribute @@toStringTag
-    getter matches
-    method constructor
 interface ContentIndex
     attribute @@toStringTag
     method add
@@ -1963,7 +1958,6 @@ interface Document : Node
     getter onauxclick
     getter onbeforecopy
     getter onbeforecut
-    getter onbeforefilter
     getter onbeforeinput
     getter onbeforematch
     getter onbeforepaste
@@ -2193,7 +2187,6 @@ interface Document : Node
     setter onauxclick
     setter onbeforecopy
     setter onbeforecut
-    setter onbeforefilter
     setter onbeforeinput
     setter onbeforematch
     setter onbeforepaste
@@ -2530,7 +2523,6 @@ interface Element : Node
     method insertAdjacentElement
     method insertAdjacentHTML
     method insertAdjacentText
-    method matchContainer
     method matches
     method moveBefore
     method prepend
@@ -3458,10 +3450,6 @@ interface GeolocationCoordinates
     getter speed
     method constructor
     method toJSON
-interface GeolocationPermissionStatus : PermissionStatus
-    attribute @@toStringTag
-    getter accuracyMode
-    method constructor
 interface GeolocationPosition
     attribute @@toStringTag
     getter coords
@@ -3829,7 +3817,6 @@ interface HTMLElement : Element
     getter onanimationiteration
     getter onanimationstart
     getter onauxclick
-    getter onbeforefilter
     getter onbeforeinput
     getter onbeforematch
     getter onbeforetoggle
@@ -3935,8 +3922,6 @@ interface HTMLElement : Element
     getter onwebkittransitionend
     getter onwheel
     getter outerText
-    getter overscrollarea
-    getter overscrollcontainer
     getter popover
     getter scrollParent
     getter spellcheck
@@ -3975,7 +3960,6 @@ interface HTMLElement : Element
     setter onanimationiteration
     setter onanimationstart
     setter onauxclick
-    setter onbeforefilter
     setter onbeforeinput
     setter onbeforematch
     setter onbeforetoggle
@@ -4081,8 +4065,6 @@ interface HTMLElement : Element
     setter onwebkittransitionend
     setter onwheel
     setter outerText
-    setter overscrollarea
-    setter overscrollcontainer
     setter popover
     setter spellcheck
     setter style
@@ -4893,7 +4875,6 @@ interface HTMLScriptElement : HTMLElement
     getter async
     getter attributionSrc
     getter blocking
-    getter cacheHint
     getter charset
     getter crossOrigin
     getter defer
@@ -4913,7 +4894,6 @@ interface HTMLScriptElement : HTMLElement
     setter async
     setter attributionSrc
     setter blocking
-    setter cacheHint
     setter charset
     setter crossOrigin
     setter defer
@@ -5159,7 +5139,6 @@ interface HTMLTemplateElement : HTMLElement
     attribute @@toStringTag
     getter content
     getter htmlFor
-    getter shadowRootAdoptedStyleSheets
     getter shadowRootClonable
     getter shadowRootCustomElementRegistry
     getter shadowRootDelegatesFocus
@@ -5167,7 +5146,6 @@ interface HTMLTemplateElement : HTMLElement
     getter shadowRootSerializable
     method constructor
     setter htmlFor
-    setter shadowRootAdoptedStyleSheets
     setter shadowRootClonable
     setter shadowRootCustomElementRegistry
     setter shadowRootDelegatesFocus
@@ -5879,7 +5857,6 @@ interface MathMLElement : Element
     getter onanimationiteration
     getter onanimationstart
     getter onauxclick
-    getter onbeforefilter
     getter onbeforeinput
     getter onbeforematch
     getter onbeforetoggle
@@ -5998,7 +5975,6 @@ interface MathMLElement : Element
     setter onanimationiteration
     setter onanimationstart
     setter onauxclick
-    setter onbeforefilter
     setter onbeforeinput
     setter onbeforematch
     setter onbeforetoggle
@@ -6407,14 +6383,10 @@ interface MimeTypeArray
     method constructor
     method item
     method namedItem
-interface ModelContext : EventTarget
+interface ModelContext
     attribute @@toStringTag
-    getter ontoolchange
     method constructor
-    method executeTool
-    method getTools
     method registerTool
-    setter ontoolchange
 interface Mojo
     static method bindInterface
     static method createDataPipe
@@ -7192,7 +7164,6 @@ interface Performance : EventTarget
     method getEntries
     method getEntriesByName
     method getEntriesByType
-    method getSpeculations
     method mark
     method measure
     method now
@@ -7495,13 +7466,6 @@ interface PreferenceObject : EventTarget
     method constructor
     method requestOverride
     setter onchange
-interface PreloadData
-    attribute @@toStringTag
-    getter as
-    getter crossorigin
-    getter url
-    getter used
-    method constructor
 interface ProcessingInstruction : CharacterData
     attribute @@toStringTag
     getter sheet
@@ -7540,7 +7504,7 @@ interface QuotaExceededError : DOMException
     getter quota
     getter requested
     method constructor
-interface RTC
+interface RTC : EventTarget
     attribute @@toStringTag
     method cancelDiagnosticLogging
     method constructor
@@ -8232,7 +8196,6 @@ interface SVGElement : Element
     getter onanimationiteration
     getter onanimationstart
     getter onauxclick
-    getter onbeforefilter
     getter onbeforeinput
     getter onbeforematch
     getter onbeforetoggle
@@ -8353,7 +8316,6 @@ interface SVGElement : Element
     setter onanimationiteration
     setter onanimationstart
     setter onauxclick
-    setter onbeforefilter
     setter onbeforeinput
     setter onbeforematch
     setter onbeforetoggle
@@ -9248,12 +9210,10 @@ interface Sanitizer
     attribute @@toStringTag
     method allowAttribute
     method allowElement
-    method allowProcessingInstruction
     method constructor
     method get
     method removeAttribute
     method removeElement
-    method removeProcessingInstruction
     method removeUnsafe
     method replaceElementWithChildren
     method setComments
@@ -9576,10 +9536,6 @@ interface SourceBufferList : EventTarget
     method constructor
     setter onaddsourcebuffer
     setter onremovesourcebuffer
-interface SpeculationData
-    attribute @@toStringTag
-    getter preloads
-    method constructor
 interface SpeechGrammar
     attribute @@toStringTag
     getter src
@@ -11836,7 +11792,6 @@ interface WebSocketStream
 interface WebTransport
     attribute @@toStringTag
     getter closed
-    getter congestionControl
     getter datagrams
     getter incomingBidirectionalStreams
     getter incomingUnidirectionalStreams
@@ -11876,14 +11831,6 @@ interface WebTransportSendGroup
     attribute @@toStringTag
     method constructor
     method getStats
-interface WebTransportSendStream : WritableStream
-    attribute @@toStringTag
-    getter sendGroup
-    getter sendOrder
-    method constructor
-    method getStats
-    setter sendGroup
-    setter sendOrder
 interface WheelEvent : MouseEvent
     attribute @@toStringTag
     attribute DOM_DELTA_LINE
@@ -12447,7 +12394,6 @@ namespace console
     getter onanimationstart
     getter onappinstalled
     getter onauxclick
-    getter onbeforefilter
     getter onbeforeinput
     getter onbeforeinstallprompt
     getter onbeforematch
@@ -12678,7 +12624,6 @@ namespace console
     setter onanimationstart
     setter onappinstalled
     setter onauxclick
-    setter onbeforefilter
     setter onbeforeinput
     setter onbeforeinstallprompt
     setter onbeforematch

tools/under-control/src/chrome/android/java/AndroidManifest.xml

@@ -103,7 +103,6 @@ by a child template that "extends" this file.
       resizeTo, moveBy}|).
     -->
     <uses-permission android:name="android.permission.REPOSITION_SELF_WINDOWS"/>
-    <uses-permission android:name="android.permission.REQUEST_FULLSCREEN_MODE"/>
     <uses-permission android:name="android.permission.USE_CREDENTIALS"/>
     <uses-permission-sdk-23 android:name="android.permission.USE_BIOMETRIC"/>
     <uses-permission-sdk-23 android:name="android.permission.USE_FINGERPRINT"/>
@@ -390,37 +389,9 @@ by a child template that "extends" this file.
             <intent-filter tools:ignore="AppLinkUrlError">
                 <action android:name="android.intent.action.VIEW" />
                 <category android:name="android.intent.category.DEFAULT" />
-                <!-- TODO(crbug.com/501213257): Find a way to unify the declaration of codecs between here and the media stack -->
-                {% if enable_jxl_decoder == "true" %}
-                <data android:mimeType="image/jxl" />
-                {% endif %}
-                {% if enable_av1_decoder == "true" %}
-                <data android:mimeType="image/avif" />
-                {% endif %}
-                <data android:mimeType="image/webp" />
-                <data android:mimeType="image/apng" />
-                <data android:mimeType="image/svg+xml" />
-                <data android:mimeType="image/jpeg" />
-                <data android:mimeType="image/png" />
-                <data android:mimeType="image/gif" />
-                <data android:mimeType="image/x-icon" />
-                <data android:mimeType="image/bmp" />
-                <data android:mimeType="image/x-xbitmap" />
-                <data android:mimeType="image/vnd.microsoft.icon" />
-                <data android:mimeType="image/pjpeg" />
-                <data android:mimeType="image/jpg" />
-                <data android:mimeType="image/x-png" />
-
-                <data android:mimeType="video/webm" />
-                <data android:mimeType="video/ogg" />
-                <data android:mimeType="video/mp4" />
-                <data android:mimeType="video/matroska" />
-                <data android:mimeType="video/x-matroska" />
-                {% if use_proprietary_codecs == "true" %}
-                <data android:mimeType="video/x-m4v" />
-                <data android:mimeType="video/3gpp" />
-                {% endif %}
-
+                <!-- TODO(crbug.com/40557607): Limit these to supported MIME types. -->
+                <data android:mimeType="image/*" />
+                <data android:mimeType="video/*" />
                 <data android:scheme="file" />
                 <data android:scheme="content" />
             </intent-filter>
@@ -458,24 +429,8 @@ by a child template that "extends" this file.
             <intent-filter tools:ignore="AppLinkUrlError">
                 <action android:name="android.intent.action.VIEW" />
                 <category android:name="android.intent.category.DEFAULT" />
-                <!-- TODO(crbug.com/501213257): Find a way to unify the declaration of codecs between here and the media stack -->
-                <data android:mimeType="audio/wav" />
-                <data android:mimeType="audio/x-wav" />
-                <data android:mimeType="audio/webm" />
-                <data android:mimeType="audio/ogg" />
-                <data android:mimeType="audio/flac" />
-                <data android:mimeType="audio/mpeg" />
-                <data android:mimeType="audio/mp3" />
-                <data android:mimeType="audio/x-mp3" />
-                <data android:mimeType="audio/mp4" />
-                <data android:mimeType="audio/matroska" />
-                <data android:mimeType="audio/x-matroska" />
-                <data android:mimeType="application/ogg" />
-                {% if use_proprietary_codecs == "true" %}
-                <data android:mimeType="audio/aac" />
-                <data android:mimeType="audio/x-m4a" />
-                {% endif %}
-
+                <!-- TODO(crbug.com/40557607): Limit these to supported MIME types. -->
+                <data android:mimeType="audio/*" />
                 <data android:scheme="file" />
                 <data android:scheme="content" />
             </intent-filter>
@@ -775,6 +730,13 @@ by a child template that "extends" this file.
             android:configChanges="orientation|keyboardHidden|keyboard|screenSize|mcc|mnc|screenLayout|smallestScreenSize|uiMode">
         </activity>
 
+        <!-- Activities for creator. -->
+        <activity android:name="org.chromium.chrome.browser.app.creator.CreatorActivity"
+            android:theme="@style/Theme.Chromium.Activity.Fullscreen"
+            android:windowSoftInputMode="stateAlwaysHidden|adjustResize"
+            android:exported="false"
+            android:configChanges="orientation|keyboardHidden|keyboard|screenSize|mcc|mnc|screenLayout|smallestScreenSize|uiMode">
+        </activity>
 
         <!-- Activities for history. -->
         <activity android:name="org.chromium.chrome.browser.history.HistoryActivity"
@@ -1245,6 +1207,15 @@ by a child template that "extends" this file.
         <meta-data android:name="org.chromium.content.browser.SMART_CLIP_PROVIDER"
             android:value="org.chromium.content_public.browser.SmartClipProvider"/>
 
+        <activity
+            android:name="org.chromium.chrome.browser.test_dummy.TestDummyActivity"
+            android:excludeFromRecents="true"
+            android:exported="true"
+            android:noHistory="true"
+            android:theme="@style/Theme.Material3Expressive.DayNight"
+            android:configChanges="orientation|keyboardHidden|keyboard|screenSize|mcc|mnc|screenLayout|smallestScreenSize" >
+        </activity>
+
         <!-- This activity is Android P- only which is not supported by Chrome now. -->
         <activity
             android:name="androidx.biometric.internal.ui.FingerprintDialogActivity"
@@ -1327,9 +1298,7 @@ by a child template that "extends" this file.
           android:process=":sandboxed_process{{ i }}"
           android:permission="{{ manifest_package }}.permission.CHILD_SERVICE"
           android:isolatedProcess="true"
-          {% if (i == 0) %}
           android:useAppZygote="true"
-          {% endif %}
           android:exported="{{sandboxed_service_exported|default(false)}}"
           {% if (sandboxed_service_exported|default(false)) == 'true' %}
           android:externalService="true"
@@ -1437,7 +1406,7 @@ by a child template that "extends" this file.
           android:grantUriPermissions="true">
       </provider>
 
-      <!-- Disables at startup init of Emoji2. See http://crbug.com/40764422 -->
+      <!-- Disables at startup init of Emoji2. See http://crbug.com/1205141 -->
       <provider
           android:name="androidx.startup.InitializationProvider"
           tools:node="remove">
@@ -1474,14 +1443,6 @@ by a child template that "extends" this file.
             android:grantUriPermissions="true">
       </provider>
 
-      <!-- Provider for screenshot content. -->
-      <provider
-            android:name="org.chromium.chrome.browser.screenshotprovider.ScreenshotContentProvider"
-            android:authorities="{{ manifest_package }}.ScreenshotContentProvider"
-            android:exported="false"
-            android:grantUriPermissions="true">
-      </provider>
-
       <!-- Provider for querying the Autofill third party mode state. -->
       <provider android:name="org.chromium.chrome.browser.autofill.AutofillThirdPartyModeContentProvider"
           android:authorities="{{ manifest_package }}.AutofillThirdPartyModeContentProvider"

tools/under-control/src/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabIntentDataProvider.java

@@ -33,7 +33,7 @@ import static androidx.browser.trusted.LaunchHandlerClientMode.NAVIGATE_EXISTING
 import static androidx.browser.trusted.LaunchHandlerClientMode.NAVIGATE_NEW;
 
 import static org.chromium.build.NullUtil.assumeNonNull;
-import static org.chromium.chrome.browser.app.tab_activity_glue.PopupCreatorImpl.EXTRA_REQUESTED_WINDOW_FEATURES;
+import static org.chromium.chrome.browser.app.tab_activity_glue.PopupCreator.EXTRA_REQUESTED_WINDOW_FEATURES;
 
 import android.app.Activity;
 import android.app.ActivityOptions;
@@ -214,7 +214,7 @@ public class CustomTabIntentDataProvider extends BrowserServicesIntentDataProvid
     static final String EXTRA_CUSTOM_CONTENT_ACTIONS =
             "androidx.browser.customtabs.extra.CUSTOM_CONTENT_ACTIONS";
 
-    static final String EXTRA_TRANSLUCENT_BACKGROUND =
+    private static final String EXTRA_TRANSLUCENT_BACKGROUND =
             "androidx.browser.customtabs.extra.TRANSLUCENT_BACKGROUND";
 
     @IntDef({
@@ -509,7 +509,7 @@ public class CustomTabIntentDataProvider extends BrowserServicesIntentDataProvid
                 : roundedCornersPosition;
     }
 
-    static boolean hasTranslucentBackgroundColor(Intent intent) {
+    private static boolean hasTranslucentBackgroundColor(Intent intent) {
         try {
             return intent.hasExtra(EXTRA_TRANSLUCENT_BACKGROUND);
         } catch (Throwable t) {
@@ -1905,7 +1905,7 @@ public class CustomTabIntentDataProvider extends BrowserServicesIntentDataProvid
             return true;
         }
 
-        if (WebAppHeaderUtils.isWindowControlsOverlayEnabled()
+        if (WebAppHeaderUtils.isWindowControlsOverlayFlagEnabled()
                 && displayMode instanceof TrustedWebActivityDisplayMode.WindowControlsOverlayMode) {
             return isDisplayOverride;
         }
@@ -1949,7 +1949,7 @@ public class CustomTabIntentDataProvider extends BrowserServicesIntentDataProvid
             return DisplayMode.MINIMAL_UI;
         }
 
-        if (WebAppHeaderUtils.isWindowControlsOverlayEnabled()
+        if (WebAppHeaderUtils.isWindowControlsOverlayFlagEnabled()
                 && displayMode instanceof TrustedWebActivityDisplayMode.WindowControlsOverlayMode) {
             return DisplayMode.WINDOW_CONTROLS_OVERLAY;
         }

tools/under-control/src/chrome/browser/browsing_data/chrome_browsing_data_remover_delegate.cc

@@ -155,7 +155,6 @@
 #include "content/public/browser/prefetch_service_delegate.h"
 #include "content/public/browser/ssl_host_state_delegate.h"
 #include "content/public/browser/storage_partition.h"
-#include "device/fido/platform_credential_store.h"
 #include "google_apis/gaia/gaia_urls.h"
 #include "media/base/media_switches.h"
 #include "media/mojo/services/video_decode_perf_history.h"
@@ -175,10 +174,9 @@
 #include "chrome/browser/feed/feed_service_factory.h"
 #include "chrome/browser/offline_pages/offline_page_model_factory.h"
 #include "chrome/browser/profiles/profile.h"
-#include "chrome/browser/settings/jni_headers/RecentSearchQueue_jni.h"
 #include "chrome/browser/ui/android/tab_model/tab_model.h"
 #include "chrome/browser/ui/android/tab_model/tab_model_list.h"
-#include "components/cdm/browser/media_drm_storage_impl.h"  // nogncheck crbug.com/40147906
+#include "components/cdm/browser/media_drm_storage_impl.h"  // nogncheck crbug.com/1125897
 #include "components/feed/core/v2/public/feed_service.h"    // nogncheck
 #include "components/feed/feed_feature_list.h"
 #include "components/installedapp/android/jni_headers/PackageHash_jni.h"
@@ -690,7 +688,7 @@ void ChromeBrowsingDataRemoverDelegate::RemoveEmbedderData(
 
       profile_->GetDefaultStoragePartition()->ClearDataForOrigin(
           content::StoragePartition::REMOVE_DATA_MASK_LOCAL_STORAGE,
-          chrome::ChromeUINewTabPageURLAsGURL(), base::DoNothing());
+          GURL(chrome::kChromeUINewTabPageURL), base::DoNothing());
     }
 #endif  // !BUILDFLAG(IS_ANDROID)
 
@@ -917,6 +915,8 @@ void ChromeBrowsingDataRemoverDelegate::RemoveEmbedderData(
         profile_, ServiceAccessType::EXPLICIT_ACCESS);
 
     if (password_store) {
+      // No sync completion callback is needed for profile passwords, since the
+      // login token is persisted and can be used after cookie deletion.
       password_store->RemoveLoginsCreatedBetween(
           FROM_HERE, delete_begin_, delete_end_,
           CreateTaskCompletionCallback(
@@ -970,10 +970,23 @@ void ChromeBrowsingDataRemoverDelegate::RemoveEmbedderData(
         profile_, ServiceAccessType::EXPLICIT_ACCESS);
 
     if (account_store) {
+      // Desktop must wait for DATA_TYPE_ACCOUNT_PASSWORDS deletions to be
+      // uploaded to the sync server before deleting any other types (because
+      // deleting DATA_TYPE_COOKIES first would revoke the account storage
+      // opt-in and prevent the upload).
+      // On Android, the account storage doesn't depend on cookies, so there's
+      // no need to wait.
+      base::OnceCallback<void(bool)> sync_completion;
+#if !BUILDFLAG(IS_ANDROID)
+      sync_completion =
+          CreateTaskCompletionCallback(TracingDataType::kAccountPasswordsSynced,
+                                       constants::DATA_TYPE_ACCOUNT_PASSWORDS);
+#endif
       account_store->RemoveLoginsCreatedBetween(
           FROM_HERE, delete_begin_, delete_end_,
           CreateTaskCompletionCallback(TracingDataType::kAccountPasswords,
-                                       constants::DATA_TYPE_ACCOUNT_PASSWORDS));
+                                       constants::DATA_TYPE_ACCOUNT_PASSWORDS),
+          std::move(sync_completion));
     }
 
     // Record that a password removal action happened for the account store.
@@ -1125,10 +1138,6 @@ void ChromeBrowsingDataRemoverDelegate::RemoveEmbedderData(
             filter,
             base::IgnoreArgs<offline_pages::OfflinePageModel::DeletePageResult>(
                 CreateTaskCompletionClosure(TracingDataType::kOfflinePages)));
-
-      // Deletes the recent search entries for Android Settings.
-      Java_RecentSearchQueue_deleteDiskData(
-          base::android::AttachCurrentThread());
     }
 #endif
 
@@ -1556,7 +1565,6 @@ void ChromeBrowsingDataRemoverDelegate::OnTaskComplete(
   std::move(callback_).Run(failed_data_types_);
 }
 
-// LINT.IfChange(TracingDataTypeHistogramSuffix)
 const char* ChromeBrowsingDataRemoverDelegate::GetHistogramSuffix(
     TracingDataType task) {
   switch (task) {
@@ -1604,6 +1612,8 @@ const char* ChromeBrowsingDataRemoverDelegate::GetHistogramSuffix(
       return "UserDataSnapshot";
     case TracingDataType::kAccountPasswords:
       return "AccountPasswords";
+    case TracingDataType::kAccountPasswordsSynced:
+      return "AccountPasswordsSynced";
     case TracingDataType::kFaviconCacheExpiration:
       return "FaviconCacheExpiration";
     case TracingDataType::kSecurePaymentConfirmationCredentials:
@@ -1618,7 +1628,6 @@ const char* ChromeBrowsingDataRemoverDelegate::GetHistogramSuffix(
       return "MediaDeviceSalts";
   }
 }
-// LINT.ThenChange(//tools/metrics/histograms/metadata/history/histograms.xml:History.ClearBrowsingData.Duration.ChromeTask.Task)
 
 void ChromeBrowsingDataRemoverDelegate::OnStartRemoving() {
   profile_keep_alive_ = std::make_unique<ScopedProfileKeepAlive>(
@@ -1741,5 +1750,4 @@ void ChromeBrowsingDataRemoverDelegate::DisablePasswordsAutoSignin(
 
 #if BUILDFLAG(IS_ANDROID)
 DEFINE_JNI(PackageHash)
-DEFINE_JNI(RecentSearchQueue)
 #endif

tools/under-control/src/chrome/browser/chrome_content_browser_client.cc

@@ -176,14 +176,13 @@
 #include "chrome/browser/translate/translate_service.h"
 #include "chrome/browser/ui/blocked_content/blocked_window_params.h"
 #include "chrome/browser/ui/blocked_content/chrome_popup_navigation_delegate.h"
+#include "chrome/browser/ui/browser_navigator.h"
+#include "chrome/browser/ui/browser_navigator_params.h"
 #include "chrome/browser/ui/color/chrome_color_id.h"
 #include "chrome/browser/ui/login/http_auth_coordinator.h"
-#include "chrome/browser/ui/navigator/browser_navigator.h"
-#include "chrome/browser/ui/navigator/browser_navigator_params.h"
 #include "chrome/browser/ui/prefs/pref_watcher.h"
 #include "chrome/browser/ui/select_file_policy/chrome_select_file_policy.h"
 #include "chrome/browser/ui/startup/google_chrome_scheme_util.h"
-#include "chrome/browser/ui/startup/url_util.h"
 #include "chrome/browser/ui/tab_contents/chrome_web_contents_view_delegate.h"
 #include "chrome/browser/ui/ui_features.h"
 #include "chrome/browser/ui/webid/identity_dialog_controller.h"
@@ -349,7 +348,6 @@
 #include "content/public/browser/render_process_host.h"
 #include "content/public/browser/security_principal.h"
 #include "content/public/browser/service_worker_context.h"
-#include "content/public/browser/site_instance.h"
 #include "content/public/browser/site_isolation_mode.h"
 #include "content/public/browser/site_isolation_policy.h"
 #include "content/public/browser/sms_fetcher.h"
@@ -363,14 +361,12 @@
 #include "content/public/browser/web_ui_url_loader_factory.h"
 #include "content/public/browser/webui_config_map.h"
 #include "content/public/common/buildflags.h"
-#include "content/public/common/child_process_id.h"
 #include "content/public/common/content_descriptors.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/origin_util.h"
 #include "content/public/common/url_utils.h"
 #include "content/public/common/window_container_type.mojom-shared.h"
-#include "device/fido/public/features.h"
 #include "device/vr/buildflags/buildflags.h"
 #include "extensions/browser/browser_frame_context_data.h"
 #include "extensions/buildflags/buildflags.h"
@@ -407,7 +403,6 @@
 #include "services/network/public/cpp/self_deleting_url_loader_factory.h"
 #include "services/network/public/cpp/web_sandbox_flags.h"
 #include "services/network/public/mojom/cert_verifier_service.mojom.h"
-#include "services/network/public/mojom/fetch_api.mojom.h"
 #include "services/network/public/mojom/network_service.mojom.h"
 #include "services/network/public/mojom/url_loader_factory.mojom.h"
 #include "services/network/public/mojom/web_transport.mojom.h"
@@ -514,7 +509,6 @@
 #include "chrome/browser/android/service_tab_launcher.h"
 #include "chrome/browser/android/tab_android.h"
 #include "chrome/browser/android/tab_web_contents_delegate_android.h"
-#include "chrome/browser/android/web_contents_theme_client.h"
 #include "chrome/browser/chrome_content_browser_client_android.h"
 #include "chrome/browser/digital_credentials/digital_identity_provider_android.h"
 #include "chrome/browser/flags/android/chrome_feature_list.h"
@@ -535,13 +529,13 @@
 #endif
 
 #if !BUILDFLAG(IS_ANDROID)
+#include "chrome/browser/actor/actor_features.h"
 #include "chrome/browser/actor/actor_keyed_service.h"
 #include "chrome/browser/actor/actor_keyed_service_factory.h"
 #include "chrome/browser/devtools/chrome_devtools_manager_delegate.h"
 #include "chrome/browser/devtools/devtools_window.h"
 #include "chrome/browser/digital_credentials/digital_identity_provider_desktop.h"
 #include "chrome/browser/direct_sockets/chrome_direct_sockets_delegate.h"
-#include "chrome/browser/indigo/onboarding/indigo_onboarding_dialog.h"
 #include "chrome/browser/metrics/usage_scenario/chrome_responsiveness_calculator_delegate.h"
 #include "chrome/browser/new_tab_page/new_tab_page_util.h"
 #include "chrome/browser/picture_in_picture/auto_picture_in_picture_tab_helper.h"
@@ -552,21 +546,22 @@
 #include "chrome/browser/themes/theme_service.h"
 #include "chrome/browser/themes/theme_service_factory.h"
 #include "chrome/browser/ui/browser.h"
+#include "chrome/browser/ui/browser_finder.h"
+#include "chrome/browser/ui/browser_list.h"
 #include "chrome/browser/ui/browser_window/public/browser_window_interface.h"
-#include "chrome/browser/ui/browser_window/public/global_browser_collection.h"
 #include "chrome/browser/ui/chrome_pages.h"
 #include "chrome/browser/ui/dialogs/browser_dialogs.h"
 #include "chrome/browser/ui/tabs/tab_strip_model.h"
 #include "chrome/browser/ui/waap/waap_utils.h"
 #include "chrome/browser/ui/webui/chrome_content_browser_client_webui_part.h"
-#include "chrome/browser/ui/webui/util/webui_util_desktop.h"
+#include "chrome/browser/ui/webui/webui_util_desktop.h"
 #include "chrome/browser/web_applications/isolated_web_apps/chrome_content_browser_client_isolated_web_apps_part.h"
 #include "chrome/browser/web_applications/isolated_web_apps/isolated_web_app_error_page.h"
 #include "chrome/browser/web_applications/isolated_web_apps/isolated_web_app_url_info.h"
 #include "chrome/browser/web_applications/isolated_web_apps/policy/isolated_web_app_policy_manager.h"
 #include "chrome/browser/web_applications/locks/app_lock.h"
 #include "chrome/browser/web_applications/policy/web_app_policy_manager.h"
-#include "chrome/browser/web_applications/proto/web_app_install_state.pb.h"  // nogncheck
+#include "chrome/browser/web_applications/proto/web_app_install_state.pb.h"
 #include "chrome/browser/web_applications/web_app_filter.h"
 #include "chrome/browser/web_applications/web_app_helpers.h"
 #include "chrome/browser/web_applications/web_app_provider.h"
@@ -575,8 +570,7 @@
 #include "chrome/browser/webauthn/authenticator_request_scheduler.h"
 #include "chrome/browser/webauthn/chrome_authenticator_request_delegate.h"
 #include "chrome/browser/webauthn/chrome_web_authentication_delegate.h"
-#include "chrome/grit/chrome_unscaled_resources.h"  // nogncheck crbug.com/40147906
-#include "components/actor/core/actor_features.h"
+#include "chrome/grit/chrome_unscaled_resources.h"  // nogncheck crbug.com/1125897
 #include "components/commerce/core/commerce_feature_list.h"
 #include "components/keep_alive_registry/keep_alive_registry.h"
 #include "components/password_manager/content/common/web_ui_constants.h"
@@ -756,7 +750,7 @@
 #endif  // BUILDFLAG(ENABLE_ON_DEVICE_TRANSLATION)
 
 #if BUILDFLAG(ENABLE_REQUEST_HEADER_INTEGRITY)
-#include "chrome/common/request_header_integrity/request_header_integrity_url_loader_throttle.h"  // nogncheck crbug.com/40147906
+#include "chrome/common/request_header_integrity/request_header_integrity_url_loader_throttle.h"  // nogncheck crbug.com/1125897
 #endif
 
 #include "base/win/windows_h_disallowed.h"
@@ -788,7 +782,7 @@ using plugins::ChromeContentBrowserClientPluginsPart;
 #endif
 
 #if !BUILDFLAG(IS_ANDROID)
-using web_app::ChromeContentBrowserClientIsolatedWebAppsPart;
+using web_apps::ChromeContentBrowserClientIsolatedWebAppsPart;
 #endif
 
 namespace {
@@ -1048,7 +1042,7 @@ void SetApplicationLocaleOnIOThread(const std::string& locale) {
 bool URLHasExtensionPermission(extensions::ProcessMap* process_map,
                                extensions::ExtensionRegistry* registry,
                                const GURL& url,
-                               content::ChildProcessId render_process_id,
+                               int render_process_id,
                                APIPermissionID permission) {
   // Includes web URLs that are part of an extension's web extent.
   const Extension* extension =
@@ -1057,6 +1051,22 @@ bool URLHasExtensionPermission(extensions::ProcessMap* process_map,
          extension->permissions_data()->HasAPIPermission(permission) &&
          process_map->Contains(extension->id(), render_process_id);
 }
+
+// Returns true if |extension_id| is allowed to run as an Isolated Context,
+// giving it access to additional APIs.
+bool IsExtensionIdAllowedToUseIsolatedContext(std::string_view extension_id) {
+  constexpr auto kAllowedIsolatedContextExtensionIds =
+      base::MakeFixedFlatSet<std::string_view>({
+          "algkcnfjnajfhgimadimbjhmpaeohhln",  // Secure Shell Extension (dev)
+          "iodihamcpbpeioajjeobimgagajmlibd",  // Secure Shell Extension
+                                               // (stable)
+          // Extension IDs used in tests.
+          "bbobefdodiifgmhhdijgpelmkdaebfpn",  // Controlled Frame Service
+                                               // Worker Test
+      });
+  return kAllowedIsolatedContextExtensionIds.contains(extension_id);
+}
+
 #endif  // BUILDFLAG(ENABLE_EXTENSIONS_CORE)
 
 mojo::PendingRemote<prerender::mojom::NoStatePrefetchCanceler>
@@ -1163,7 +1173,7 @@ void LaunchURL(
   // - 'allow-top-navigation-by-user-navigation' + user-activation
   // - 'allow-popups'
   //
-  // See https://crbug.com/40053861
+  // See https://crbug.com/1148777
   if (!is_primary_main_frame) {
     using SandboxFlags = network::mojom::WebSandboxFlags;
     auto allow = [&](SandboxFlags flag) {
@@ -1367,7 +1377,7 @@ CreatePopupNavigationDelegate(NavigateParams params) {
 ChromeContentBrowserClient::PopupNavigationDelegateFactory
     g_popup_navigation_delegate_factory = &CreatePopupNavigationDelegate;
 
-#if BUILDFLAG(ENABLE_DEVTOOLS_FRONTEND) && !BUILDFLAG(CHROME_FOR_TESTING)
+#if !BUILDFLAG(IS_ANDROID) && !BUILDFLAG(CHROME_FOR_TESTING)
 bool DetermineIfDevToolsUserForProcessPerSite() {
   bool is_devtools_user = false;
   // Only count uses of DevTools from within the last week.
@@ -1618,8 +1628,6 @@ void ChromeContentBrowserClient::RegisterProfilePrefs(
 
   registry->RegisterBooleanPref(prefs::kWebAudioOutputBufferingEnabled, false);
   registry->RegisterBooleanPref(prefs::kSharedWorkerBlobURLFixEnabled, true);
-  registry->RegisterBooleanPref(prefs::kDataUrlInWebWorkerOpaqueOriginEnabled,
-                                true);
   registry->RegisterBooleanPref(prefs::kSharedWorkerExtendedLifetimeEnabled,
                                 true);
   registry->RegisterBooleanPref(
@@ -1631,9 +1639,6 @@ void ChromeContentBrowserClient::RegisterProfilePrefs(
       prefs::kClearWindowNameForNewBrowsingContextGroup, true);
   registry->RegisterBooleanPref(prefs::kPrefetchWithServiceWorkerEnabled, true);
   registry->RegisterBooleanPref(prefs::kServiceWorkerAutoPreloadEnabled, true);
-
-  registry->RegisterIntegerPref(prefs::kCpuPerformanceTierPolicyOverride,
-                                prefs::kCpuPerformanceTierOverrideNone);
 }
 
 // static
@@ -1954,8 +1959,8 @@ bool ChromeContentBrowserClient::ShouldUseProcessPerSite(
 
   // NTP should use process-per-site.  This is a performance optimization to
   // reduce process count associated with NTP tabs.
-  if (site_url == chrome::ChromeUINewTabURLAsGURL() ||
-      site_url == chrome::ChromeUINewTabPageURLAsGURL()) {
+  if (site_url == GURL(chrome::kChromeUINewTabURL) ||
+      site_url == GURL(chrome::kChromeUINewTabPageURL)) {
     return true;
   }
 
@@ -1995,7 +2000,7 @@ bool ChromeContentBrowserClient::
 
 bool ChromeContentBrowserClient::ShouldAllowProcessPerSiteForMultipleMainFrames(
     content::BrowserContext* browser_context) {
-#if BUILDFLAG(ENABLE_DEVTOOLS_FRONTEND)
+#if !BUILDFLAG(IS_ANDROID)
 #if BUILDFLAG(CHROME_FOR_TESTING)
   static bool is_devtools_user = true;
 #else
@@ -2112,31 +2117,19 @@ bool ChromeContentBrowserClient::DoesWebUIUrlRequireProcessLock(
   return true;
 }
 
-bool ChromeContentBrowserClient::ShouldTreatAsFirstPartyWhenTopLevel(
-    const url::Origin& top_frame_origin,
+bool ChromeContentBrowserClient::ShouldTreatURLSchemeAsFirstPartyWhenTopLevel(
+    std::string_view scheme,
     bool is_embedded_origin_secure) {
   // This is needed to bypass the normal SameSite rules for any chrome:// page
   // embedding a secure origin, regardless of the registrable domains of any
   // intervening frames. For example, this is needed for browser UI to interact
   // with SameSite cookies on accounts.google.com, which is used for displaying
   // a list of available accounts on the NTP (chrome://new-tab-page), etc.
-  if (is_embedded_origin_secure &&
-      top_frame_origin.scheme() == content::kChromeUIScheme) {
+  if (is_embedded_origin_secure && scheme == content::kChromeUIScheme) {
     return true;
   }
-  // TODO(crbug.com/483614998): Granting Lens side panel is a temporary
-  // exception to use SameSite cookies while it migrates to a <webview>
-  // approach. This should not be done for other untrusted WebUI.
-#if !BUILDFLAG(IS_ANDROID)
-  if (is_embedded_origin_secure &&
-      top_frame_origin == url::Origin::Create(GURL(
-                              chrome::kChromeUILensUntrustedSidePanelURL))) {
-    return true;
-  }
-#endif
-
 #if BUILDFLAG(ENABLE_EXTENSIONS_CORE)
-  return top_frame_origin.scheme() == extensions::kExtensionScheme;
+  return scheme == extensions::kExtensionScheme;
 #else
   return false;
 #endif
@@ -2144,19 +2137,9 @@ bool ChromeContentBrowserClient::ShouldTreatAsFirstPartyWhenTopLevel(
 
 bool ChromeContentBrowserClient::
     ShouldIgnoreSameSiteCookieRestrictionsWhenTopLevel(
-        const url::Origin& top_frame_origin,
+        std::string_view scheme,
         bool is_embedded_origin_secure) {
-  // TODO(crbug.com/483614998): Granting Lens side panel is a temporary
-  // exception to use SameSite cookies while it migrates to a <webview>
-  // approach. This should not be done for other untrusted WebUI.
-  return is_embedded_origin_secure &&
-         (top_frame_origin.scheme() == content::kChromeUIScheme
-#if !BUILDFLAG(IS_ANDROID)
-          ||
-          (top_frame_origin == url::Origin::Create(GURL(
-                                   chrome::kChromeUILensUntrustedSidePanelURL)))
-#endif
-         );
+  return is_embedded_origin_secure && scheme == content::kChromeUIScheme;
 }
 
 // TODO(crbug.com/40694933): This is based on SubframeTask::GetTitle()
@@ -2279,10 +2262,10 @@ bool ChromeContentBrowserClient::HasWebRequestAPIProxy(
           browser_context);
   if (!web_request_api) {
     return false;
-  } else if (base::FeatureList::IsEnabled(
-          features::kOptimizeWebRequestProxyForServiceWorkerAutoPreload)) {
-    return web_request_api->HasWebRequestOrDeclarativeWebRequestExtension();
   } else {
+    // TODO(crbug.com/362539771): Check if the request is from guest view and
+    // use HasWebRequestOrDeclarativeWebRequestExtension() instead of using
+    // MayHaveProxies().
     return web_request_api->MayHaveProxies();
   }
 #else
@@ -2714,6 +2697,27 @@ bool ChromeContentBrowserClient::IsTopChromeWebUIURL(const GURL& url) {
   return ::IsTopChromeWebUIURL(url);
 }
 
+bool ChromeContentBrowserClient::IsIsolatedContextAllowedForUrl(
+    content::BrowserContext* browser_context,
+    const GURL& lock_url) {
+#if BUILDFLAG(ENABLE_EXTENSIONS_CORE)
+  if (ChromeContentBrowserClientExtensionsPart::AreExtensionsDisabledForProfile(
+          browser_context)) {
+    return false;
+  }
+
+  // Allow restricted context APIs in Chrome Apps.
+  auto* extension = extensions::ExtensionRegistry::Get(browser_context)
+                        ->enabled_extensions()
+                        .GetExtensionOrAppByURL(lock_url);
+  return extension &&
+         (extension->is_platform_app() ||
+          IsExtensionIdAllowedToUseIsolatedContext(extension->id()));
+#else
+  return false;
+#endif
+}
+
 bool ChromeContentBrowserClient::IsMultiCaptureAllowed(
     content::RenderFrameHost* render_frame_host) {
 #if BUILDFLAG(IS_CHROMEOS)
@@ -3195,17 +3199,6 @@ bool ChromeContentBrowserClient::IsDataSaverEnabled(
   return data_saver::IsDataSaverEnabled();
 }
 
-bool ChromeContentBrowserClient::IsPinchToZoomAllowed(
-    content::BrowserContext* context) {
-#if BUILDFLAG(IS_CHROMEOS)
-  if (IsRunningInAppMode()) {
-    return user_prefs::UserPrefs::Get(context)->GetBoolean(
-        ash::prefs::kKioskPinchToZoomAllowed);
-  }
-#endif
-  return true;
-}
-
 void ChromeContentBrowserClient::UpdateRendererPreferencesForWorker(
     content::BrowserContext* browser_context,
     blink::RendererPreferences* out_prefs) {
@@ -3345,14 +3338,6 @@ bool ChromeContentBrowserClient::AllowSharedWorkerBlobURLFix(
   return profile->GetPrefs()->GetBoolean(prefs::kSharedWorkerBlobURLFixEnabled);
 }
 
-bool ChromeContentBrowserClient::IsDataUrlInWebWorkerOpaqueOriginEnabled(
-    content::BrowserContext* browser_context) {
-  DCHECK_CURRENTLY_ON(BrowserThread::UI);
-  Profile* profile = Profile::FromBrowserContext(browser_context);
-  return profile->GetPrefs()->GetBoolean(
-      prefs::kDataUrlInWebWorkerOpaqueOriginEnabled);
-}
-
 bool ChromeContentBrowserClient::AllowSharedWorkerExtendedLifetime(
     content::BrowserContext* browser_context) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
@@ -4102,11 +4087,14 @@ GetPreferredColorScheme(const WebPreferences& web_prefs,
   preferred_root_scrollbar_color_scheme =
       web_prefs.preferred_root_scrollbar_color_scheme;
 
-  if (auto* theme_client = night_mode::WebContentsThemeClient::FromWebContents(web_contents)) {
-    preferred_color_scheme = theme_client->IsNightModeEnabled()
-            ? blink::mojom::PreferredColorScheme::kDark
-            : blink::mojom::PreferredColorScheme::kLight;
-    preferred_root_scrollbar_color_scheme = preferred_color_scheme;
+  if (TabAndroid::FromWebContents(web_contents)) {
+    if (auto* delegate = static_cast<android::TabWebContentsDelegateAndroid*>(
+            web_contents->GetDelegate())) {
+      preferred_color_scheme = delegate->IsNightModeEnabled()
+                                   ? blink::mojom::PreferredColorScheme::kDark
+                                   : blink::mojom::PreferredColorScheme::kLight;
+      preferred_root_scrollbar_color_scheme = preferred_color_scheme;
+    }
   }
 #else  // !BUILDFLAG(IS_ANDROID)
   if (Profile::FromBrowserContext(web_contents->GetBrowserContext())
@@ -4419,7 +4407,7 @@ bool ChromeContentBrowserClient::IsPopupBypassAllowed(
 
   // Allow if it is an authorized extension process.
   const extensions::Extension* extension =
-      process_map->GetEnabledExtensionByProcessID(process->GetID());
+      process_map->GetEnabledExtensionByProcessID(process->GetID().value());
   if (process_map->CanProcessHostContextType(
           extension, *process,
           extensions::mojom::ContextType::kPrivilegedExtension)) {
@@ -4489,18 +4477,12 @@ bool ChromeContentBrowserClient::CanCreateWindow(
         ui::PageTransition::PAGE_TRANSITION_AUTO_TOPLEVEL, true);
     content::WebContents* responsible_web_contents =
         web_contents->GetResponsibleWebContents();
-    bool is_from_embedded_page =
-        web_contents != responsible_web_contents ||
-        guest_view::GuestViewBase::FromRenderFrameHost(opener);
-    content::SiteInstance* site = opener->GetSiteInstance();
-    bool is_same_site_or_from_ui = site && site->IsSameSiteWithURL(target_url);
+    bool is_from_embedded_page = web_contents != responsible_web_contents;
     if (contextual_tasks_ui_service &&
         contextual_tasks_ui_service->HandleNavigation(
             std::move(url_params), responsible_web_contents,
             is_from_embedded_page,
-            /*from_can_create_window=*/true,
-            /*is_same_site_or_from_ui=*/true,
-            /*is_mobile_ua=*/is_same_site_or_from_ui)) {
+            /*is_to_new_tab=*/true)) {
       return false;
     }
   }
@@ -4512,7 +4494,7 @@ bool ChromeContentBrowserClient::CanCreateWindow(
     auto* process_map = extensions::ProcessMap::Get(profile);
     auto* registry = extensions::ExtensionRegistry::Get(profile);
     if (!URLHasExtensionPermission(process_map, registry, opener_url,
-                                   opener->GetProcess()->GetID(),
+                                   opener->GetProcess()->GetDeprecatedID(),
                                    APIPermissionID::kBackground)) {
       return false;
     }
@@ -4586,10 +4568,9 @@ ChromeContentBrowserClient::CreateModelBrokerClient(
 media::mojom::AvailabilityStatus
 ChromeContentBrowserClient::GetOnDeviceSpeechRecognitionAvailabilityStatus(
     content::BrowserContext* context,
-    const std::string& language,
-    media::mojom::SpeechRecognitionQuality quality) {
-  return speech::GetOnDeviceSpeechRecognitionAvailabilityStatus(
-      context, language, quality);
+    const std::string& language) {
+  return speech::GetOnDeviceSpeechRecognitionAvailabilityStatus(context,
+                                                                language);
 }
 
 #if BUILDFLAG(IS_CHROMEOS)
@@ -4705,8 +4686,6 @@ void ChromeContentBrowserClient::OverrideWebPreferences(
 
   web_prefs->allow_running_insecure_content =
       prefs->GetBoolean(prefs::kWebKitAllowRunningInsecureContent);
-  web_prefs->highlight_ads =
-      prefs->GetBoolean(prefs::kSubresourceFilterHighlightAds);
 #if BUILDFLAG(IS_ANDROID)
   web_prefs->font_scale_factor = static_cast<float>(
       prefs->GetDouble(browser_ui::prefs::kWebKitFontScaleFactor));
@@ -4790,14 +4769,14 @@ void ChromeContentBrowserClient::OverrideWebPreferences(
       web_prefs->picture_in_picture_enabled =
           delegate->IsPictureInPictureEnabled();
 
+      web_prefs->force_dark_mode_enabled =
+          delegate->IsForceDarkWebContentEnabled();
+
       web_prefs->modal_context_menu = delegate->IsModalContextMenu();
 
       web_prefs->dynamic_safe_area_insets_enabled =
           delegate->IsDynamicSafeAreaInsetsEnabled();
     }
-    if (auto* theme_client = night_mode::WebContentsThemeClient::FromWebContents(web_contents)) {
-      web_prefs->force_dark_mode_enabled = theme_client->IsForceDarkWebContentEnabled();
-    }
 #endif  // BUILDFLAG(IS_ANDROID)
 
     // web_app_scope value is platform specific.
@@ -4814,8 +4793,7 @@ void ChromeContentBrowserClient::OverrideWebPreferences(
       // want to use the scope of the app associated with the window, not the
       // WebContents.
       BrowserWindowInterface* browser =
-          GlobalBrowserCollection::GetInstance()->FindBrowserWithTab(
-              web_contents);
+          chrome::FindBrowserWithTab(web_contents);
       web_app::AppBrowserController* app_controller =
           browser ? web_app::AppBrowserController::From(browser) : nullptr;
       if (app_controller) {
@@ -4853,10 +4831,6 @@ void ChromeContentBrowserClient::OverrideWebPreferences(
     }
 #endif
 
-    web_prefs->is_initial_profile =
-        profile->GetOriginalProfile()->GetBaseName() ==
-        ProfileManager::GetInitialProfileDir();
-
     web_prefs->immersive_mode_enabled = vr::VrTabHelper::IsInVr(web_contents);
   }
 
@@ -4961,11 +4935,6 @@ void ChromeContentBrowserClient::OverrideWebPreferences(
       base::FeatureList::IsEnabled(::features::kDevToolsAiOriginTrialsApis)) {
     web_prefs->ai_ot_apis_enabled = true;
   }
-
-#if !BUILDFLAG(IS_ANDROID)
-  web_prefs->is_indigo_onboarding =
-      indigo::IndigoOnboardingDialog::IsOnboardingWebContents(web_contents);
-#endif
 }
 
 bool ChromeContentBrowserClientParts::OverrideWebPreferencesAfterNavigation(
@@ -5032,8 +5001,12 @@ bool ChromeContentBrowserClient::OverrideWebPreferencesAfterNavigation(
           old_preferred_root_scrollbar_color_scheme;
 
 #if BUILDFLAG(IS_ANDROID)
-  if (auto* theme_client = night_mode::WebContentsThemeClient::FromWebContents(web_contents)) {
-    bool force_dark_mode_new_state = theme_client->IsForceDarkWebContentEnabled();
+  auto* delegate = TabAndroid::FromWebContents(web_contents)
+                       ? static_cast<android::TabWebContentsDelegateAndroid*>(
+                             web_contents->GetDelegate())
+                       : nullptr;
+  if (delegate) {
+    bool force_dark_mode_new_state = delegate->IsForceDarkWebContentEnabled();
     prefs_changed |=
         (web_prefs->force_dark_mode_enabled != force_dark_mode_new_state);
     web_prefs->force_dark_mode_enabled = force_dark_mode_new_state;
@@ -5295,8 +5268,6 @@ std::wstring ChromeContentBrowserClient::GetAppContainerSidForSandboxType(
       return std::wstring();
     case sandbox::mojom::Sandbox::kOnDeviceModelExecution:
       return std::wstring();
-    case sandbox::mojom::Sandbox::kWebNNModelCompilation:
-      return std::wstring();
     case sandbox::mojom::Sandbox::kNoSandbox:
     case sandbox::mojom::Sandbox::kNoSandboxAndElevatedPrivileges:
     case sandbox::mojom::Sandbox::kXrCompositing:
@@ -5406,7 +5377,6 @@ bool ChromeContentBrowserClient::PreSpawnChild(
     case sandbox::mojom::Sandbox::kScreenAI:
     case sandbox::mojom::Sandbox::kAudio:
     case sandbox::mojom::Sandbox::kOnDeviceModelExecution:
-    case sandbox::mojom::Sandbox::kWebNNModelCompilation:
     case sandbox::mojom::Sandbox::kSpeechRecognition:
     case sandbox::mojom::Sandbox::kPdfConversion:
     case sandbox::mojom::Sandbox::kService:
@@ -5431,10 +5401,6 @@ bool ChromeContentBrowserClient::PreSpawnChild(
 
   sandbox::MitigationFlags mitigations = config->GetProcessMitigations();
   mitigations |= sandbox::MITIGATION_FORCE_MS_SIGNED_BINS;
-  if (base::FeatureList::IsEnabled(
-          sandbox::policy::features::kWinSboxModuleTamperingProtection)) {
-    mitigations |= sandbox::MITIGATION_MODULE_TAMPERING_PROTECTION;
-  }
   sandbox::ResultCode result = config->SetProcessMitigations(mitigations);
   if (result != sandbox::SBOX_ALL_OK) {
     return false;
@@ -5513,6 +5479,14 @@ void ChromeContentBrowserClient::
   RegisterChromeMojoBinderPoliciesForSameOriginPrerendering(policy_map);
 }
 
+void ChromeContentBrowserClient::RegisterMojoBinderPoliciesForPreview(
+    content::MojoBinderPolicyMap& policy_map) {
+  // Changes to `policy_map` should be made in
+  // RegisterChromeMojoBinderPoliciesForPreview() which requires security
+  // review.
+  RegisterChromeMojoBinderPoliciesForPreview(policy_map);
+}
+
 void ChromeContentBrowserClient::OpenURL(
     content::SiteInstance* site_instance,
     const content::OpenURLParams& params,
@@ -6138,8 +6112,7 @@ ChromeContentBrowserClient::CreateNonNetworkNavigationURLLoaderFactory(
     if (content::AreIsolatedWebAppsEnabled(browser_context) &&
         !browser_context->ShutdownStarted()) {
       return web_app::IsolatedWebAppURLLoaderFactory::CreateForFrame(
-          browser_context, /*app_origin=*/std::nullopt, frame_tree_node_id,
-          /*enforce_same_origin=*/true);
+          browser_context, /*app_origin=*/std::nullopt, frame_tree_node_id);
     }
 
     return {};
@@ -6155,8 +6128,6 @@ ChromeContentBrowserClient::CreateNonNetworkNavigationURLLoaderFactory(
 void ChromeContentBrowserClient::
     RegisterNonNetworkWorkerMainResourceURLLoaderFactories(
         content::BrowserContext* browser_context,
-        const std::optional<url::Origin>& request_initiator,
-        network::mojom::RequestDestination request_destination,
         NonNetworkURLLoaderFactoryMap* factories) {
   DCHECK(browser_context);
   DCHECK(factories);
@@ -6165,27 +6136,9 @@ void ChromeContentBrowserClient::
     BUILDFLAG(IS_CHROMEOS)
   if (content::AreIsolatedWebAppsEnabled(browser_context) &&
       !browser_context->ShutdownStarted()) {
-    std::optional<url::Origin> app_origin;
-    // The IsolatedWebAppURLLoaderFactory CHECKs that app_origin is an IWA
-    // origin if it is set. We only care about enforcing same-origin checks
-    // for IWA-to-IWA cross-origin requests (to prevent asset exfiltration),
-    // so we only set app_origin if the initiator is an IWA.
-    if (request_initiator &&
-        request_initiator->scheme() == webapps::kIsolatedAppScheme) {
-      app_origin = request_initiator;
-    }
-    bool enforce_same_origin = false;
-    if (request_destination == network::mojom::RequestDestination::kWorker) {
-      enforce_same_origin = base::FeatureList::IsEnabled(
-          features::kEnforceDedicatedWorkerSameOriginCheck);
-    } else if (request_destination ==
-               network::mojom::RequestDestination::kSharedWorker) {
-      enforce_same_origin = base::FeatureList::IsEnabled(
-          features::kEnforceSharedWorkerSameOriginCheck);
-    }
     factories->emplace(webapps::kIsolatedAppScheme,
                        web_app::IsolatedWebAppURLLoaderFactory::Create(
-                           browser_context, app_origin, enforce_same_origin));
+                           browser_context, /*app_origin=*/std::nullopt));
   }
 #endif  // BUILDFLAG(IS_WIN) || BUILDFLAG(IS_MAC) || BUILDFLAG(IS_LINUX) ||
         // BUILDFLAG(IS_CHROMEOS)
@@ -6197,7 +6150,7 @@ void ChromeContentBrowserClient::
   factories->emplace(
       extensions::kExtensionScheme,
       extensions::CreateExtensionWorkerMainResourceURLLoaderFactory(
-          browser_context, request_initiator));
+          browser_context));
 #endif  // BUILDFLAG(ENABLE_EXTENSIONS_CORE)
 }
 
@@ -6214,8 +6167,7 @@ void ChromeContentBrowserClient::
       !browser_context->ShutdownStarted()) {
     factories->emplace(webapps::kIsolatedAppScheme,
                        web_app::IsolatedWebAppURLLoaderFactory::Create(
-                           browser_context, /*app_origin=*/std::nullopt,
-                           /*enforce_same_origin=*/true));
+                           browser_context, /*app_origin=*/std::nullopt));
   }
 #endif  // BUILDFLAG(IS_WIN) || BUILDFLAG(IS_MAC) || BUILDFLAG(IS_LINUX) ||
         // BUILDFLAG(IS_CHROMEOS)
@@ -6498,13 +6450,11 @@ void ChromeContentBrowserClient::
             webapps::kIsolatedAppScheme,
             web_app::IsolatedWebAppURLLoaderFactory::CreateForFrame(
                 browser_context, request_initiator_origin,
-                frame_host->GetFrameTreeNodeId(),
-                /*enforce_same_origin=*/true));
+                frame_host->GetFrameTreeNodeId()));
       } else {
         factories->emplace(webapps::kIsolatedAppScheme,
                            web_app::IsolatedWebAppURLLoaderFactory::Create(
-                               browser_context, request_initiator_origin,
-                               /*enforce_same_origin=*/true));
+                               browser_context, request_initiator_origin));
       }
     }
   }
@@ -6933,14 +6883,6 @@ bool ChromeContentBrowserClient::IsSecurityLevelAcceptableForWebAuthn(
     return true;
   }
 #endif
-#if !BUILDFLAG(IS_ANDROID)
-  // For IWAs, WebAuthn is only enabled together with the remote
-  // desktop client override enterprise policy.
-  if (caller_origin.scheme() == webapps::kIsolatedAppScheme) {
-    return base::FeatureList::IsEnabled(
-        device::kWebAuthnIWARemoteDesktopAllowedOriginsPolicy);
-  }
-#endif  //! BUILDFLAG(IS_ANDROID)
   if (net::IsLocalhost(caller_origin.GetURL())) {
     return true;
   }
@@ -7105,7 +7047,7 @@ bool ChromeContentBrowserClient::HandleExternalProtocol(
   // This avoids launching a new browser instance via the OS handler.
   if (std::optional<GURL> new_url =
           startup::ExtractGoogleChromeSchemeInnerUrl(url)) {
-    if (startup::ValidateLaunchUrl(*new_url)) {
+    if (startup::ValidateUrl(*new_url)) {
       auto* web_contents = web_contents_getter.Run();
       if (web_contents) {
         content::OpenURLParams params(
@@ -7297,7 +7239,7 @@ bool ChromeContentBrowserClient::HandleWebUI(
         (url->DomainIs(chrome::kChromeUIBookmarksHost) ||
          url->DomainIs(chrome::kChromeUIHistoryHost))) {
       // Rewrite with new tab URL
-      *url = chrome::ChromeUINewTabURLAsGURL();
+      *url = GURL(chrome::kChromeUINewTabURL);
     }
   }
 
@@ -7590,17 +7532,17 @@ bool ChromeContentBrowserClient::IsBuiltinComponent(
 void ChromeContentBrowserClient::StartRtcDiagnosticLogging(
     content::RenderFrameHost& frame_host,
     bool should_upload_on_stop,
-    const base::flat_map<std::string, std::string>& metadata,
+    base::flat_map<std::string, std::string> metadata,
     base::OnceCallback<void(const std::string&)> callback) {
   rtc_diagnostic_logging::StartRtcDiagnosticLogging(
-      frame_host, should_upload_on_stop, metadata, std::move(callback));
+      frame_host, should_upload_on_stop, std::move(metadata),
+      std::move(callback));
 }
 
 void ChromeContentBrowserClient::FinishRtcDiagnosticLogging(
     content::RenderFrameHost& frame_host,
-    const base::flat_map<std::string, std::string>& metadata,
     base::OnceClosure callback) {
-  rtc_diagnostic_logging::FinishRtcDiagnosticLogging(frame_host, metadata,
+  rtc_diagnostic_logging::FinishRtcDiagnosticLogging(frame_host,
                                                      std::move(callback));
 }
 
@@ -7820,10 +7762,10 @@ bool ChromeContentBrowserClient::IsClipboardPasteAllowed(
       render_frame_host->GetMainFrame()->GetLastCommittedOrigin().GetURL();
   auto* registry = extensions::ExtensionRegistry::Get(profile);
   if (url.SchemeIs(extensions::kExtensionScheme)) {
-    return URLHasExtensionPermission(extensions::ProcessMap::Get(profile),
-                                     registry, url,
-                                     render_frame_host->GetProcess()->GetID(),
-                                     APIPermissionID::kClipboardRead);
+    return URLHasExtensionPermission(
+        extensions::ProcessMap::Get(profile), registry, url,
+        render_frame_host->GetProcess()->GetDeprecatedID(),
+        APIPermissionID::kClipboardRead);
   }
 
   // or (4) origination from a process that at least might be running a
@@ -8797,8 +8739,8 @@ bool ChromeContentBrowserClient::ShouldSuppressAXLoadComplete(
   WebContents* web_contents = WebContents::FromRenderFrameHost(rfh);
 
   const GURL& url = web_contents->GetVisibleURL();
-  return url == chrome::ChromeUINewTabURLAsGURL() ||
-         url == chrome::ChromeUINewTabPageURLAsGURL();
+  return url == GURL(chrome::kChromeUINewTabURL) ||
+         url == GURL(chrome::kChromeUINewTabPageURL);
 }
 
 void ChromeContentBrowserClient::BindAIManager(
@@ -8867,14 +8809,7 @@ void ChromeContentBrowserClient::QueryInstalledWebAppsByManifestId(
   web_app::WebAppProvider* const provider =
       web_app::WebAppProvider::GetForLocalAppsUnchecked(profile);
 
-  std::optional<webapps::ManifestId> valid_manifest_id =
-      webapps::ManifestId::Create(manifest_id);
-  if (!valid_manifest_id.has_value()) {
-    return std::move(callback).Run(std::nullopt);
-  }
-
-  webapps::AppId app_id =
-      web_app::GenerateAppIdFromManifestId(*valid_manifest_id);
+  webapps::AppId app_id = web_app::GenerateAppIdFromManifestId(manifest_id);
 
   if (app_id.empty()) {
     return std::move(callback).Run(std::nullopt);
@@ -8894,10 +8829,9 @@ void ChromeContentBrowserClient::QueryInstalledWebAppsByManifestId(
              GURL frame_url, web_app::AppLock& lock,
              base::DictValue& debug_value)
               -> std::optional<blink::mojom::RelatedApplication> {
-            debug_value.Set("input",
-                            base::DictValue()
-                                .Set("manifest_id", manifest_id.spec())
-                                .Set("frame_url", frame_url.spec()));
+            debug_value.Set("input", base::DictValue()
+                                         .Set("manifest_id", manifest_id.spec())
+                                         .Set("frame_url", frame_url.spec()));
 
             if (!lock.registrar().AppMatches(
                     app_id, web_app::WebAppFilter::InstalledInChrome())) {
@@ -8912,13 +8846,7 @@ void ChromeContentBrowserClient::QueryInstalledWebAppsByManifestId(
 
             blink::mojom::RelatedApplication application;
             application.platform = "webapp";
-            std::optional<webapps::ManifestId> app_manifest_id =
-                lock.registrar().GetAppManifestId(app_id);
-            if(!app_manifest_id.has_value()){
-              debug_value.Set("manifest_id", "invalid manifest id");
-              return std::nullopt;
-            }
-            application.id = app_manifest_id->spec();
+            application.id = lock.registrar().GetAppManifestId(app_id).spec();
             // Note: This url is the manifest_url for purely legacy reasons
             // where Android used to implement the unique identifier using the
             // manifest url.
@@ -8935,8 +8863,7 @@ void ChromeContentBrowserClient::QueryInstalledWebAppsByManifestId(
                     .Set("manifest_url", application.url.value_or("")));
             return application;
           },
-          std::move(app_id), *valid_manifest_id,
-          std::move(frame_url)),
+          std::move(app_id), std::move(manifest_id), std::move(frame_url)),
       std::move(callback), std::move(arg_for_shutdown));
 }
 #endif  // !BUILDFLAG(IS_ANDROID)
@@ -9124,19 +9051,6 @@ bool ChromeContentBrowserClient::ShouldSkipBeforeUnloadDialog(
 #endif
 }
 
-std::optional<int> ChromeContentBrowserClient::GetCpuPerformanceTierOverride(
-    content::BrowserContext* browser_context) {
-  if (browser_context) {
-    const PrefService* prefs =
-        Profile::FromBrowserContext(browser_context)->GetPrefs();
-    if (int value = prefs->GetInteger(prefs::kCpuPerformanceTierPolicyOverride);
-        value != prefs::kCpuPerformanceTierOverrideNone) {
-      return value;
-    }
-  }
-  return ContentBrowserClient::GetCpuPerformanceTierOverride(browser_context);
-}
-
 void ChromeContentBrowserClient::RecordAssistedLogin(
     content::ContentBrowserClient::AssistedLoginType login_type) {
   using AssistedLoginType = content::ContentBrowserClient::AssistedLoginType;

tools/under-control/src/chrome/browser/chrome_content_browser_client_navigation_throttles.cc

@@ -21,7 +21,6 @@
 #include "chrome/browser/history/history_service_factory.h"
 #include "chrome/browser/interstitials/enterprise_util.h"
 #include "chrome/browser/lookalikes/lookalike_url_navigation_throttle.h"
-#include "chrome/browser/omnibox/geolocation_navigation_throttle.h"
 #include "chrome/browser/plugins/pdf_iframe_navigation_throttle.h"
 #include "chrome/browser/policy/chrome_policy_blocklist_service_factory.h"
 #include "chrome/browser/policy/policy_util.h"
@@ -93,7 +92,9 @@
 #else  // BUILDFLAG(IS_ANDROID)
 #include "chrome/browser/apps/link_capturing/link_capturing_navigation_throttle.h"
 #include "chrome/browser/apps/link_capturing/web_app_link_capturing_delegate.h"
+#include "chrome/browser/devtools/devtools_window.h"
 #include "chrome/browser/page_info/web_view_side_panel_throttle.h"
+#include "chrome/browser/preloading/preview/preview_navigation_throttle.h"
 #include "chrome/browser/themes/theme_service_factory.h"
 #include "chrome/browser/ui/lens/lens_overlay_side_panel_navigation_throttle.h"
 #include "chrome/browser/ui/read_anything/read_anything_side_panel_navigation_throttle.h"
@@ -121,20 +122,14 @@
 #include "chrome/browser/apps/platform_apps/platform_app_navigation_redirector.h"
 #endif  // BUILDFLAG(ENABLE_PLATFORM_APPS)
 
-#if !BUILDFLAG(IS_ANDROID)
+#if BUILDFLAG(ENABLE_EXTENSIONS)
 #include "chrome/browser/ui/browser_finder.h"
 #include "chrome/browser/ui/web_applications/app_browser_controller.h"
-#endif  // !BUILDFLAG(IS_ANDROID)
+#endif  // BUILDFLAG(ENABLE_EXTENSIONS)
 
-#if BUILDFLAG(ENABLE_DEVTOOLS_FRONTEND)
-#include "chrome/browser/devtools/devtools_window.h"
-#endif  // BUILDFLAG(ENABLE_DEVTOOLS_FRONTEND)
-
-#if BUILDFLAG(ENABLE_GUEST_VIEW)
-#if BUILDFLAG(ENABLE_EXTENSIONS_CORE)
+#if BUILDFLAG(ENABLE_GUEST_VIEW) && BUILDFLAG(ENABLE_EXTENSIONS_CORE)
 #include "extensions/browser/guest_view/web_view/web_view_guest.h"
-#endif  // BUILDFLAG(ENABLE_EXTENSIONS_CORE)
-#endif  // BUILDFLAG(ENABLE_GUEST_VIEW)
+#endif  // BUILDFLAG(ENABLE_GUEST_VIEW) && BUILDFLAG(ENABLE_EXTENSIONS_CORE)
 
 #if BUILDFLAG(ENABLE_PDF)
 #include "chrome/browser/pdf/chrome_pdf_stream_delegate.h"
@@ -223,10 +218,9 @@ void HandleSSLErrorWrapper(
       is_ssl_error_override_allowed_for_origin);
 }
 
-// Returns whether `web_contents` is within a web app.
-// TODO(crbug.com/505461569): Support Android.
-bool IsInWebApp(content::WebContents* web_contents) {
-#if !BUILDFLAG(IS_ANDROID)
+// Returns whether `web_contents` is within a hosted app.
+bool IsInHostedApp(content::WebContents* web_contents) {
+#if BUILDFLAG(ENABLE_EXTENSIONS)
   tabs::TabInterface* tab =
       tabs::TabInterface::MaybeGetFromContents(web_contents);
   return tab && web_app::AppBrowserController::IsWebApp(
@@ -292,12 +286,6 @@ void CreateAndAddChromeThrottlesForNavigation(
     // should be cared by adding an attribute flag to
     // NavigationThrottleRegistry::AddThrottle().
     page_load_metrics::MetricsNavigationThrottle::CreateAndAdd(registry);
-
-    // Appends the X-Geo header to the navigation request if needed.
-    if (auto throttle =
-            GeolocationNavigationThrottle::MaybeCreateThrottleFor(registry)) {
-      registry.AddThrottle(std::move(throttle));
-    }
   }
 
   DSEPrewarmNavigationThrottle::MaybeCreateAndAdd(registry);
@@ -335,7 +323,7 @@ void CreateAndAddChromeThrottlesForNavigation(
     // we are attempting to load a google property.
     if (ash::merge_session_throttling_utils::ShouldAttachNavigationThrottle() &&
         !ash::merge_session_throttling_utils::AreAllSessionMergedAlready() &&
-        registry.GetNavigationHandle().GetURL().SchemeIsHTTPOrHTTPS()) {
+        registry.IsHTTPOrHTTPS()) {
       ash::MergeSessionNavigationThrottle::CreateAndAdd(registry);
     }
   }
@@ -439,7 +427,7 @@ void CreateAndAddChromeThrottlesForNavigation(
       base::BindRepeating(&MaybeTriggerSecurityInterstitialShownEvent));
   registry.AddThrottle(std::make_unique<SSLErrorNavigationThrottle>(
       registry, base::BindOnce(&HandleSSLErrorWrapper),
-      base::BindOnce(&IsInWebApp),
+      base::BindOnce(&IsInHostedApp),
       base::BindOnce(
           &ShouldIgnoreSslInterstitialBecauseNavigationDefaultedToHttps)));
 
@@ -485,11 +473,9 @@ void CreateAndAddChromeThrottlesForNavigation(
         registry);
   }
 
-#if BUILDFLAG(ENABLE_DEVTOOLS_FRONTEND)
-  DevToolsWindow::MaybeCreateAndAddNavigationThrottle(registry);
-#endif  // BUILDFLAG(ENABLE_DEVTOOLS_FRONTEND)
-
 #if !BUILDFLAG(IS_ANDROID)
+  DevToolsWindow::MaybeCreateAndAddNavigationThrottle(registry);
+
   if (base::FeatureList::IsEnabled(features::kInstantUsesSpareRenderer)) {
     ChromeSearchNavigationThrottle::MaybeCreateAndAdd(registry);
   }
@@ -614,6 +600,9 @@ void CreateAndAddChromeThrottlesForNavigation(
   }
 #endif  // BUILDFLAG(ENABLE_EXTENSIONS_CORE)
 
+#if !BUILDFLAG(IS_ANDROID)
+  PreviewNavigationThrottle::MaybeCreateAndAdd(registry);
+#endif  // !BUILDFLAG(IS_ANDROID)
 
   MaybeCreateAndAddVisitedLinkNavigationThrottle(registry);
 

tools/under-control/src/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureList.java

@@ -164,6 +164,8 @@ public abstract class ChromeFeatureList {
             "AccountForSuppressedKeyboardInsets";
     public static final String ADAPTIVE_BUTTON_IN_TOP_TOOLBAR_CUSTOMIZATION_V2 =
             "AdaptiveButtonInTopToolbarCustomizationV2";
+    public static final String ADAPTIVE_BUTTON_IN_TOP_TOOLBAR_PAGE_SUMMARY =
+            "AdaptiveButtonInTopToolbarPageSummary";
     // Don't clean up this flag yet, BCIV is launched, so this needs to be enabled by
     // default, but some render tests need to disable this so that the hairline isn't
     // included in the screenshot. See https://crbug.com/394842006 for more details.
@@ -183,7 +185,8 @@ public abstract class ChromeFeatureList {
     public static final String ANDROID_BOOKMARK_BAR_FAST_FOLLOW = "AndroidBookmarkBarFastFollow";
     public static final String ANDROID_BOTTOM_BAR = "AndroidBottomBar";
     public static final String ANDROID_BOTTOM_TOOLBAR_V2 = "AndroidBottomToolbarV2";
-    public static final String ANDROID_CONTEXT_MENU_NEW_ACTIONS = "AndroidContextMenuNewActions";
+    public static final String ANDROID_CONTEXT_MENU_DUPLICATE_TABS =
+            "AndroidContextMenuDuplicateTabs";
     public static final String ANDROID_DATA_IMPORTER_SERVICE = "AndroidDataImporterService";
     public static final String ANDROID_DESKTOP_DENSITY = "AndroidDesktopDensity";
     public static final String ANDROID_ELEGANT_TEXT_HEIGHT = "AndroidElegantTextHeight";
@@ -200,10 +203,9 @@ public abstract class ChromeFeatureList {
             "AndroidProgressBarVisualUpdate";
     public static final String ANDROID_SAVE_CARD_NON_BLOCKING_DIALOG =
             "AndroidSaveCardNonBlockingDialog";
+    public static final String ANDROID_SELF_OCCLUSION_TRACKING = "AndroidSelfOcclusionTracking";
     public static final String ANDROID_SETTINGS_CONTAINMENT = "AndroidSettingsContainment";
-    public static final String ANDROID_SETTINGS_URL = "AndroidSettingsUrl";
     public static final String ANDROID_SETUP_LIST = "AndroidSetupList";
-    public static final String ANDROID_SHARE_FULL_LINK = "AndroidShareFullLink";
     public static final String ANDROID_SURFACE_COLOR_UPDATE = "AndroidSurfaceColorUpdate";
     public static final String ANDROID_TAB_DECLUTTER_DEDUPE_TAB_IDS_KILL_SWITCH =
             "AndroidTabDeclutterDedupeTabIdsKillSwitch";
@@ -213,8 +215,10 @@ public abstract class ChromeFeatureList {
     public static final String ANDROID_THEME_RESOURCE_PROVIDER = "AndroidThemeResourceProvider";
     public static final String ANDROID_TIPS_NOTIFICATIONS = "AndroidTipsNotifications";
     public static final String ANDROID_TIPS_NOTIFICATIONS_V2 = "AndroidTipsNotificationsV2";
+    public static final String ANDROID_TWA_ORIGIN_DISPLAY = "AndroidTWAOriginDisplay";
     public static final String ANDROID_USE_ADMINS_FOR_ENTERPRISE_INFO =
             "AndroidUseAdminsForEnterpriseInfo";
+    public static final String ANDROID_WINDOW_CONTROLS_OVERLAY = "AndroidWindowControlsOverlay";
     public static final String ANDROID_WINDOW_MANAGEMENT_WEB_API = "AndroidWindowManagementWebApi";
     public static final String ANDROID_WINDOW_POPUP_CUSTOM_TAB_UI = "AndroidWindowPopupCustomTabUi";
     public static final String ANDROID_WINDOW_POPUP_LARGE_SCREEN = "AndroidWindowPopupLargeScreen";
@@ -249,8 +253,6 @@ public abstract class ChromeFeatureList {
     public static final String AUTOFILL_AI_REAUTH_REQUIRED = "AutofillAiReauthRequired";
     public static final String AUTOFILL_AI_SHOW_WALLET_DISABLED_BANNER =
             "AutofillAiShowWalletDisabledBanner";
-    public static final String AUTOFILL_AI_WALLET_PRIVATE_PASSES_DEEP_LINK =
-            "AutofillAiWalletPrivatePassesDeepLink";
     public static final String AUTOFILL_AI_WITH_DATA_SCHEMA = "AutofillAiWithDataSchema";
     public static final String AUTOFILL_ALLOW_NON_HTTP_ACTIVATION =
             "AutofillAllowNonHttpActivation";
@@ -260,12 +262,21 @@ public abstract class ChromeFeatureList {
             "AutofillAndroidDesktopSuppressAccessoryOnEmpty";
     public static final String AUTOFILL_ANDROID_KEYBOARD_ACCESSORY_DYNAMIC_POSITIONING =
             "AutofillAndroidKeyboardAccessoryDynamicPositioning";
-    public static final String AUTOFILL_AT_MEMORY = "AutofillAtMemory";
     public static final String AUTOFILL_DEEP_LINK_AUTOFILL_OPTIONS =
             "AutofillDeepLinkAutofillOptions";
     public static final String AUTOFILL_ENABLE_AI_BASED_AMOUNT_EXTRACTION =
             "AutofillEnableAiBasedAmountExtraction";
     public static final String AUTOFILL_ENABLE_BUY_NOW_PAY_LATER = "AutofillEnableBuyNowPayLater";
+    public static final String AUTOFILL_ENABLE_CARD_BENEFITS_FOR_AMERICAN_EXPRESS =
+            "AutofillEnableCardBenefitsForAmericanExpress";
+    public static final String AUTOFILL_ENABLE_CARD_BENEFITS_FOR_BMO =
+            "AutofillEnableCardBenefitsForBmo";
+    public static final String AUTOFILL_ENABLE_FLAT_RATE_CARD_BENEFITS_FROM_CURINOS =
+            "AutofillEnableFlatRateCardBenefitsFromCurinos";
+    public static final String AUTOFILL_ENABLE_KEYBOARD_ACCESSORY_CHIP_REDESIGN =
+            "AutofillEnableKeyboardAccessoryChipRedesign";
+    public static final String AUTOFILL_ENABLE_KEYBOARD_ACCESSORY_CHIP_WIDTH_ADJUSTMENT =
+            "AutofillEnableKeyboardAccessoryChipWidthAdjustment";
     public static final String AUTOFILL_ENABLE_LOCAL_IBAN = "AutofillEnableLocalIban";
     public static final String AUTOFILL_ENABLE_NEW_CARD_BENEFITS_TOGGLE_TEXT =
             "AutofillEnableNewCardBenefitsToggleText";
@@ -302,7 +313,6 @@ public abstract class ChromeFeatureList {
             "BackgroundThreadPoolFieldTrial";
     public static final String BACK_FORWARD_CACHE = "BackForwardCache";
     public static final String BLOCK_INTENTS_WHILE_LOCKED = "BlockIntentsWhileLocked";
-    public static final String BOOKMARKS_BAR_NTP = "BookmarksBarNTP";
     public static final String BOOKMARK_PANE_ANDROID = "BookmarkPaneAndroid";
     public static final String BOTTOM_SHEET_AS_BROWSER_CONTROLS = "BottomSheetAsBrowserControls";
     public static final String BROWSER_CONTROLS_DEBUGGING = "BrowserControlsDebugging";
@@ -331,6 +341,7 @@ public abstract class ChromeFeatureList {
     public static final String CCT_DESTROY_TAB_WHEN_MODEL_IS_EMPTY =
             "CCTDestroyTabWhenModelIsEmpty";
     public static final String CCT_EXTEND_TRUSTED_CDN_PUBLISHER = "CCTExtendTrustedCdnPublisher";
+    public static final String CCT_FIX_WARMUP = "CCTFixWarmup";
     public static final String CCT_FRE_IN_SAME_TASK = "CCTFreInSameTask";
     public static final String CCT_GOOGLE_BOTTOM_BAR = "CCTGoogleBottomBar";
     public static final String CCT_GOOGLE_BOTTOM_BAR_VARIANT_LAYOUTS =
@@ -338,6 +349,7 @@ public abstract class ChromeFeatureList {
     public static final String CCT_INCOGNITO_AVAILABLE_TO_THIRD_PARTY =
             "CCTIncognitoAvailableToThirdParty";
     public static final String CCT_MINIMIZED_ENABLED_BY_DEFAULT = "CCTMinimizedEnabledByDefault";
+    public static final String CCT_MULTIPLE_PARALLEL_REQUESTS = "CCTMultipleParallelRequests";
     public static final String CCT_NAVIGATIONAL_PREFETCH = "CCTNavigationalPrefetch";
     public static final String CCT_NAVIGATION_METRICS = "CCTNavigationMetrics";
     public static final String CCT_NESTED_SECURITY_ICON = "CCTNestedSecurityIcon";
@@ -355,6 +367,7 @@ public abstract class ChromeFeatureList {
     public static final String CCT_RESET_TIMEOUT_ALLOWED = "CCTResetTimeoutAllowed";
     public static final String CCT_RESET_TIMEOUT_ENABLED = "CCTResetTimeoutEnabled";
     public static final String CCT_RESIZABLE_FOR_THIRD_PARTIES = "CCTResizableForThirdParties";
+    public static final String CCT_SHOW_TAB_FIX = "CCTShowTabFix";
     public static final String CCT_TAB_MODAL_DIALOG = "CCTTabModalDialog";
     public static final String CCT_TOOLBAR_REFACTOR = "CCTToolbarRefactor";
     public static final String CHANGE_UNFOCUSED_PRIORITY = "ChangeUnfocusedPriority";
@@ -397,7 +410,6 @@ public abstract class ChromeFeatureList {
     public static final String CROSS_DEVICE_TASK_HANDOFF = "CrossDeviceTaskHandoff";
     public static final String DARKEN_WEBSITES_CHECKBOX_IN_THEMES_SETTING =
             "DarkenWebsitesCheckboxInThemesSetting";
-    public static final String DATA_CONTROLS_SEARCH_WITH = "DataControlsSearchWith";
     public static final String DATA_SHARING = "DataSharing";
     public static final String DATA_SHARING_ENABLE_UPDATE_CHROME_UI =
             "DataSharingEnableUpdateChromeUI";
@@ -407,11 +419,9 @@ public abstract class ChromeFeatureList {
     public static final String DEFAULT_BROWSER_PROMO_ANDROID2 = "DefaultBrowserPromoAndroid2";
     public static final String DEFAULT_BROWSER_PROMO_ENTRY_POINT = "DefaultBrowserPromoEntryPoint";
     public static final String DEFAULT_BROWSER_PROMO_FRE = "DefaultBrowserPromoFre";
-    public static final String DEFER_NAVIGATION_STATE_CHANGED = "DeferNavigationStateChanged";
     public static final String DESKTOP_ANDROID_LINK_CAPTURING = "DesktopAndroidLinkCapturing";
     public static final String DESKTOP_UA_ON_CONNECTED_DISPLAY = "DesktopUAOnConnectedDisplay";
     public static final String DETAILED_LANGUAGE_SETTINGS = "DetailedLanguageSettings";
-    public static final String DISABLE_PARTNER_HOMEPAGE_ANDROID = "DisablePartnerHomepageAndroid";
     public static final String DISCO_FEED_ENDPOINT = "DiscoFeedEndpoint";
     public static final String DISPLAY_EDGE_TO_EDGE_FULLSCREEN = "DisplayEdgeToEdgeFullscreen";
     public static final String DISPLAY_WILDCARD_CONTENT_SETTINGS =
@@ -434,7 +444,6 @@ public abstract class ChromeFeatureList {
     public static final String ENABLE_ANDROID_SIDE_PANEL = "EnableAndroidSidePanel";
     public static final String ENABLE_ANDROID_SIDE_PANEL_DEV_FEATURE =
             "EnableAndroidSidePanelDevFeature";
-    public static final String ENABLE_ANDROID_SIDE_PANEL_LOGS = "EnableAndroidSidePanelLogs";
     public static final String ENABLE_BROWSER_WINDOW_INTERFACE_FOR_CUSTOM_TAB_ACTIVITY =
             "EnableBrowserWindowInterfaceForCustomTabActivity";
     public static final String ENABLE_CLIPBOARD_DATA_CONTROLS_ANDROID =
@@ -452,14 +461,16 @@ public abstract class ChromeFeatureList {
     public static final String ENABLE_SWIPE_TO_SWITCH_PANE = "EnableSwipeToSwitchPane";
     public static final String ENABLE_TOOLBAR_POSITIONING_IN_RESIZE_MODE =
             "EnableToolbarPositioningInResizeMode";
+    public static final String ENABLE_TOOLBAR_SWIPE_ON_NON_DESKTOP_LFF =
+            "EnableToolbarSwipeOnNonDesktopLff";
     public static final String ENABLE_X_AXIS_ACTIVITY_TRANSITION = "EnableXAxisActivityTransition";
     public static final String ENFORCE_INCOGNITO_ISOLATION = "EnforceIncognitoIsolation";
     public static final String ESC_CANCEL_DRAG = "EscCancelDrag";
     public static final String FACILITATED_PAYMENTS_ENABLE_A2A_PAYMENT =
             "FacilitatedPaymentsEnableA2APayment";
-    public static final String FAVICON_DISABLE_HOST_FALLBACK = "FaviconDisableHostFallback";
     public static final String FEED_AUDIO_OVERVIEWS = "FeedAudioOverviews";
     public static final String FEED_CONTAINMENT = "FeedContainment";
+    public static final String FEED_FOLLOW_UI_UPDATE = "FeedFollowUiUpdate";
     public static final String FEED_IMAGE_MEMORY_CACHE_SIZE_PERCENTAGE =
             "FeedImageMemoryCacheSizePercentage";
     public static final String FEED_LOADING_PLACEHOLDER = "FeedLoadingPlaceholder";
@@ -476,7 +487,6 @@ public abstract class ChromeFeatureList {
             "FullscreenVideoPictureInPicture";
     public static final String GESTURE_USER_EDUCATION_BACK_SWIPE = "GestureUserEducationBackSwipe";
     public static final String GLIC = "Glic";
-    public static final String GMSCORE_BIND_SERVICE_OPTIMIZATION = "GmsCoreBindServiceOptimization";
     public static final String GRID_TAB_SWITCHER_SURFACE_COLOR_UPDATE =
             "GridTabSwitcherSurfaceColorUpdate";
     public static final String GROUP_NEW_TAB_WITH_PARENT = "GroupNewTabWithParent";
@@ -487,7 +497,6 @@ public abstract class ChromeFeatureList {
     public static final String HISTORY_PANE_ANDROID = "HistoryPaneAndroid";
     public static final String HOME_MODULE_PREF_REFACTOR = "HomeModulePrefRefactor";
     public static final String HTTPS_FIRST_BALANCED_MODE = "HttpsFirstBalancedMode";
-    public static final String HTTPS_FIRST_DIALOG_UI = "HttpsFirstDialogUi";
     public static final String INCOGNITO_NTP_SMALL_ICON = "IncognitoNtpSmallIcon";
     public static final String INCOGNITO_SCREENSHOT = "IncognitoScreenshot";
     public static final String INCOGNITO_THEME_OVERLAY_TESTING = "IncognitoThemeOverlayTesting";
@@ -495,8 +504,6 @@ public abstract class ChromeFeatureList {
     public static final String KEYBOARD_ESC_BACK_NAVIGATION = "KeyboardEscBackNavigation";
     public static final String LAUNCH_CAUSE_SCREEN_OFF_FIX = "LaunchCauseScreenOffFix";
     public static final String LENS_ON_QUICK_ACTION_SEARCH_WIDGET = "LensOnQuickActionSearchWidget";
-    public static final String LENS_OVERLAY_ANDROID = "LensOverlayAndroid";
-    public static final String LENS_SEND_RAW_FILE_MEDIA_TYPES = "LensSendRawFileMediaTypes";
     public static final String LINK_HOVER_STATUS_BAR = "LinkHoverStatusBar";
     public static final String LOADING_PREDICTOR_LIMIT_PRECONNECT_SOCKET_COUNT =
             "LoadingPredictorLimitPreconnectSocketCount";
@@ -525,7 +532,7 @@ public abstract class ChromeFeatureList {
             "MultiInstanceSharedPrefsMigration";
     public static final String MVC_UPDATE_VIEW_WHEN_MODEL_CHANGED = "MvcUpdateViewWhenModelChanged";
     public static final String NAV_BAR_COLOR_ANIMATION = "NavBarColorAnimation";
-    // Enabled by syncer::kNewTabPageCustomizationThemeSync on C++ side.
+    public static final String NEW_TAB_PAGE_CUSTOMIZATION_FOR_MVT = "NewTabPageCustomizationForMvt";
     public static final String NEW_TAB_PAGE_CUSTOMIZATION_THEME_SYNC =
             "NewTabPageCustomizationThemeSync";
     public static final String NEW_TAB_PAGE_CUSTOMIZATION_V2 = "NewTabPageCustomizationV2";
@@ -542,8 +549,6 @@ public abstract class ChromeFeatureList {
             "OmniboxCacheSuggestionResources";
     public static final String ON_DEMAND_BACKGROUND_TAB_CONTEXT_CAPTURE =
             "OnDemandBackgroundTabContextCapture";
-    public static final String OPEN_DOWNLOAD_IN_FILES_APP_IF_NO_HANDLER_FOUND =
-            "OpenDownloadInFilesAppIfNoHandlerFound";
     public static final String PAGE_CONTENT_PROVIDER = "PageContentProvider";
     public static final String PAGE_INFO_ABOUT_THIS_SITE_MORE_LANGS =
             "PageInfoAboutThisSiteMoreLangs";
@@ -567,8 +572,12 @@ public abstract class ChromeFeatureList {
     public static final String PRERENDER2 = "Prerender2";
     public static final String PRICE_ANNOTATIONS = "PriceAnnotations";
     public static final String PRICE_CHANGE_MODULE = "PriceChangeModule";
+    public static final String PRIVACY_SANDBOX_ADS_API_UX_ENHANCEMENTS =
+            "PrivacySandboxAdsApiUxEnhancements";
     public static final String PRIVACY_SANDBOX_AD_PRIVACY_UX_DEPRECATION =
             "PrivacySandboxAdPrivacyUxDeprecation";
+    public static final String PRIVACY_SANDBOX_AD_TOPICS_CONTENT_PARITY =
+            "PrivacySandboxAdTopicsContentParity";
     public static final String PRIVACY_SANDBOX_SETTINGS_4 = "PrivacySandboxSettings4";
     public static final String PROCESS_RANK_POLICY_ANDROID = "ProcessRankPolicyAndroid";
     public static final String PROTECT_RECENTLY_VISIBLE_TAB = "ProtectRecentlyVisibleTab";
@@ -594,6 +603,8 @@ public abstract class ChromeFeatureList {
     public static final String RENAME_JOURNEYS = "RenameJourneys";
     public static final String REPORT_NOTIFICATION_CONTENT_DETECTION_DATA =
             "ReportNotificationContentDetectionData";
+    public static final String RESTRICT_LEGACY_SEARCH_ENGINE_PROMO_ON_FORM_FACTORS =
+            "RestrictLegacySearchEnginePromoOnFormFactors";
     public static final String RIGHT_EDGE_GOES_FORWARD_GESTURE_NAV =
             "RightEdgeGoesForwardGestureNav";
     public static final String ROBUST_WINDOW_MANAGEMENT_EXPERIMENTAL =
@@ -625,15 +636,11 @@ public abstract class ChromeFeatureList {
             "SegmentationPlatformAndroidHomeModuleRankerV2";
     public static final String SEGMENTATION_PLATFORM_EPHEMERAL_CARD_RANKER =
             "SegmentationPlatformEphemeralCardRanker";
-    public static final String SEND_TAB_TO_SELF_EXTRA_ENTRY_POINTS =
-            "SendTabToSelfExtraEntryPoints";
-    public static final String SEND_TAB_TO_SELF_POST_SEND_TOAST = "SendTabToSelfPostSendToast";
     public static final String SEND_TAB_TO_SELF_PROPAGATE_SCROLL_POSITION =
             "SendTabToSelfPropagateScrollPosition";
     public static final String SENSITIVE_CONTENT = "SensitiveContent";
     public static final String SENSITIVE_CONTENT_WHILE_SWITCHING_TABS =
             "SensitiveContentWhileSwitchingTabs";
-    public static final String SESSION_RESTORE_AFTER_CRASH = "SessionRestoreAfterCrash";
     public static final String SETTINGS_MULTI_COLUMN = "SettingsMultiColumn";
     public static final String SETTINGS_SINGLE_ACTIVITY = "SettingsSingleActivity";
     public static final String SHARED_DATA_TYPES_KILL_SWITCH = "SharedDataTypesKillSwitch";
@@ -655,6 +662,8 @@ public abstract class ChromeFeatureList {
     public static final String START_SURFACE_RETURN_TIME = "StartSurfaceReturnTime";
     public static final String STOP_APP_INDEXING_REPORT = "StopAppIndexingReport";
     public static final String SUBMENUS_IN_APP_MENU = "SubmenusInAppMenu";
+    public static final String SUBMENUS_TAB_CONTEXT_MENU_LFF_TAB_STRIP =
+            "SubmenusTabContextMenuLffTabStrip";
     public static final String SUGGESTION_ANSWERS_COLOR_REVERSE = "SuggestionAnswersColorReverse";
     public static final String SUPPRESS_TOOLBAR_CAPTURES_AT_GESTURE_END =
             "SuppressToolbarCapturesAtGestureEnd";
@@ -669,6 +678,7 @@ public abstract class ChromeFeatureList {
     public static final String TAB_STORAGE_SQLITE_PROTOTYPE = "TabStorageSqlitePrototype";
     public static final String TAB_STRIP_AUTO_SELECT_ON_CLOSE_CHANGE =
             "TabStripAutoSelectOnCloseChange";
+    public static final String TAB_STRIP_CLOSE_REFACTOR_ANDROID = "TabStripCloseRefactorAndroid";
     public static final String TAB_STRIP_DENSITY_CHANGE_ANDROID = "TabStripDensityChangeAndroid";
     public static final String TAB_STRIP_EMPTY_SPACE_CONTEXT_MENU_ANDROID =
             "TabStripEmptySpaceContextMenuAndroid";
@@ -683,7 +693,6 @@ public abstract class ChromeFeatureList {
     public static final String TEST_DEFAULT_DISABLED = "TestDefaultDisabled";
     public static final String TEST_DEFAULT_ENABLED = "TestDefaultEnabled";
     public static final String THREE_DOT_MENU_BACK_BUTTON = "ThreeDotMenuBackButton";
-    public static final String TOOLBAR_CAPTURE_FIX_FOR_SPAS = "ToolbarCaptureFixForSPAs";
     public static final String TOOLBAR_PHONE_ANIMATION_REFACTOR = "ToolbarPhoneAnimationRefactor";
     public static final String TOOLBAR_SCROLL_ABLATION = "AndroidToolbarScrollAblation";
     public static final String TOOLBAR_SNAPSHOT_REFACTOR = "ToolbarSnapshotRefactor";
@@ -704,22 +713,20 @@ public abstract class ChromeFeatureList {
             "UseActivityManagerForTabActivation";
     public static final String USE_ALTERNATE_HISTORY_SYNC_ILLUSTRATION =
             "UseAlternateHistorySyncIllustration";
-    public static final String USE_APP_TASK_FOR_CUSTOM_TAB_ACTIVATION =
-            "UseAppTaskForCustomTabActivation";
     public static final String USE_CHIME_ANDROID_SDK = "UseChimeAndroidSdk";
     public static final String USE_INITIAL_NETWORK_STATE_AT_STARTUP =
             "UseInitialNetworkStateAtStartup";
     public static final String USE_LIBUNWINDSTACK_NATIVE_UNWINDER_ANDROID =
             "UseLibunwindstackNativeUnwinderAndroid";
     public static final String VERIFY_QWACS = "VerifyQWACs";
-    public static final String VIRTUAL_KEYBOARD_TRANSIENT_INNER_HEIGHT_FIX =
-            "VirtualKeyboardTransientInnerHeightFix";
     public static final String VISITED_URL_RANKING_SERVICE = "VisitedURLRankingService";
     public static final String WEB_APK_BACKUP_AND_RESTORE_BACKEND = "WebApkBackupAndRestoreBackend";
     public static final String WEB_APK_INSTALL_FAILURE_NOTIFICATION =
             "WebApkInstallFailureNotification";
     public static final String WEB_APK_MIN_SHELL_APK_VERSION = "WebApkMinShellVersion";
+    public static final String WEB_FEED_AWARENESS = "WebFeedAwareness";
     public static final String WEB_FEED_ONBOARDING = "WebFeedOnboarding";
+    public static final String WEB_FEED_SORT = "WebFeedSort";
     public static final String WEB_OTP_CROSS_DEVICE_SIMPLE_STRING = "WebOtpCrossDeviceSimpleString";
     public static final String XPLAT_SYNCED_SETUP = "XplatSyncedSetup";
     public static final String XSURFACE_METRICS_REPORTING = "XsurfaceMetricsReporting";
@@ -733,10 +740,7 @@ public abstract class ChromeFeatureList {
     public static final CachedFlag sAccountForSuppressedKeyboardInsets =
             newCachedFlag(ACCOUNT_FOR_SUPPRESSED_KEYBOARD_INSETS, /* defaultValue= */ true);
     public static final CachedFlag sAndroidAnimatedProgressBarInBrowser =
-            newCachedFlag(
-                    ANDROID_ANIMATED_PROGRESS_BAR_IN_BROWSER,
-                    /* defaultValue= */ false,
-                    /* defaultValueInTests= */ true);
+            newCachedFlag(ANDROID_ANIMATED_PROGRESS_BAR_IN_BROWSER, true);
     public static final CachedFlag sAndroidApb144Patch1 = newCachedFlag(APB144_PATCH1, true);
     public static final CachedFlag sAndroidApb144Patch2 = newCachedFlag(APB144_PATCH2, true);
     public static final CachedFlag sAndroidApb144Patch3 = newCachedFlag(APB144_PATCH3, true);
@@ -772,12 +776,14 @@ public abstract class ChromeFeatureList {
     public static final CachedFlag sAndroidOpenIncognitoAsWindow =
             newCachedFlag(ANDROID_OPEN_INCOGNITO_AS_WINDOW, BuildConfig.IS_DESKTOP_ANDROID, true);
     public static final CachedFlag sAndroidPageInfoAsAppMenuItem =
-            newCachedFlag(ANDROID_PAGE_INFO_AS_APP_MENU_ITEM, false, true);
+            newCachedFlag(ANDROID_PAGE_INFO_AS_APP_MENU_ITEM, false);
     public static final CachedFlag sAndroidProgressBarVisualUpdate =
             newCachedFlag(
                     ANDROID_PROGRESS_BAR_VISUAL_UPDATE,
                     /* defaultValue= */ false,
                     /* defaultValueInTests= */ false);
+    public static final CachedFlag sAndroidSelfOcclusionTracking =
+            newCachedFlag(ANDROID_SELF_OCCLUSION_TRACKING, false);
     public static final CachedFlag sAndroidSettingsContainment =
             newCachedFlag(
                     ANDROID_SETTINGS_CONTAINMENT,
@@ -798,8 +804,12 @@ public abstract class ChromeFeatureList {
     public static final CachedFlag sAndroidThemeModule = newCachedFlag(ANDROID_THEME_MODULE, true);
     public static final CachedFlag sAndroidThemeResourceProvider =
             newCachedFlag(ANDROID_THEME_RESOURCE_PROVIDER, false, /* defaultValueInTests= */ false);
+    public static final CachedFlag sAndroidTwaOriginDisplay =
+            newCachedFlag(ANDROID_TWA_ORIGIN_DISPLAY, true);
     public static final CachedFlag sAndroidUseAdminsForEnterpriseInfo =
             newCachedFlag(ANDROID_USE_ADMINS_FOR_ENTERPRISE_INFO, true);
+    public static final CachedFlag sAndroidWindowControlsOverlay =
+            newCachedFlag(ANDROID_WINDOW_CONTROLS_OVERLAY, true);
     public static final CachedFlag sAndroidWindowManagementWebApi =
             newCachedFlag(
                     ANDROID_WINDOW_MANAGEMENT_WEB_API,
@@ -823,8 +833,7 @@ public abstract class ChromeFeatureList {
     public static final CachedFlag sAsyncNotificationManagerForDownload =
             newCachedFlag(ASYNC_NOTIFICATION_MANAGER_FOR_DOWNLOAD, true);
     public static final CachedFlag sAutoDocPipPermissionPromptAndroid =
-            newCachedFlag(
-                    AUTO_DOC_PIP_PERMISSION_PROMPT_ANDROID, false, /* defaultValueInTests= */ true);
+            newCachedFlag(AUTO_DOC_PIP_PERMISSION_PROMPT_ANDROID, false);
     public static final CachedFlag sAutomotiveBackButtonBarStreamline =
             newCachedFlag(AUTOMOTIVE_BACK_BUTTON_BAR_STREAMLINE, /* defaultValue= */ true);
     public static final CachedFlag sBackgroundThreadPoolFieldTrial =
@@ -857,6 +866,8 @@ public abstract class ChromeFeatureList {
             newCachedFlag(CCT_CONTEXTUAL_MENU_ITEMS, true);
     public static final CachedFlag sCctDestroyTabWhenModelIsEmpty =
             newCachedFlag(CCT_DESTROY_TAB_WHEN_MODEL_IS_EMPTY, true);
+    public static final CachedFlag sCctFixWarmup =
+            newCachedFlag(CCT_FIX_WARMUP, /* defaultValue= */ true);
     public static final CachedFlag sCctFreInSameTask = newCachedFlag(CCT_FRE_IN_SAME_TASK, true);
     public static final CachedFlag sCctGoogleBottomBar =
             newCachedFlag(
@@ -887,10 +898,7 @@ public abstract class ChromeFeatureList {
     public static final CachedFlag sCctResetTimeoutAllowed =
             newCachedFlag(CCT_RESET_TIMEOUT_ALLOWED, true);
     public static final CachedFlag sCctResetTimeoutEnabled =
-            newCachedFlag(
-                    CCT_RESET_TIMEOUT_ENABLED,
-                    /* defaultValue= */ false,
-                    /* defaultValueInTests= */ true);
+            newCachedFlag(CCT_RESET_TIMEOUT_ENABLED, false);
     public static final CachedFlag sCctResizableForThirdParties =
             newCachedFlag(CCT_RESIZABLE_FOR_THIRD_PARTIES, true);
     public static final CachedFlag sCctTabModalDialog = newCachedFlag(CCT_TAB_MODAL_DIALOG, true);
@@ -909,7 +917,6 @@ public abstract class ChromeFeatureList {
             newCachedFlag(COMMAND_LINE_ON_NON_ROOTED, false);
     public static final CachedFlag sCompositorViewRemeasureFix =
             newCachedFlag(COMPOSITOR_VIEW_REMEASURE_FIX, true);
-    public static final CachedFlag sContextualTasks = newCachedFlag(CONTEXTUAL_TASKS, false);
     public static final CachedFlag sCpaTabGroupingButton =
             newCachedFlag(
                     CONTEXTUAL_PAGE_ACTION_TAB_GROUPING,
@@ -923,19 +930,14 @@ public abstract class ChromeFeatureList {
                     /* defaultValue= */ false,
                     /* defaultValueInTests= */ true);
     public static final CachedFlag sDesktopAndroidLinkCapturing =
-            newCachedFlag(DESKTOP_ANDROID_LINK_CAPTURING, true);
+            newCachedFlag(DESKTOP_ANDROID_LINK_CAPTURING, false);
     public static final CachedFlag sDesktopUAOnConnectedDisplay =
             newCachedFlag(
                     DESKTOP_UA_ON_CONNECTED_DISPLAY,
                     /* defaultValue= */ false,
                     /* defaultValueInTests= */ true);
-    public static final CachedFlag sDisablePartnerHomepageAndroid =
-            newCachedFlag(
-                    DISABLE_PARTNER_HOMEPAGE_ANDROID,
-                    /* defaultValue= */ false,
-                    /* defaultValueInTests= */ true);
     public static final CachedFlag sDocumentPictureInPictureAPI =
-            newCachedFlag(DOCUMENT_PICTURE_IN_PICTURE_API, false, /* defaultValueInTests= */ true);
+            newCachedFlag(DOCUMENT_PICTURE_IN_PICTURE_API, false, /* defaultValueInTests= */ false);
     public static final CachedFlag sDrawChromePagesEdgeToEdge =
             newCachedFlag(DRAW_CHROME_PAGES_EDGE_TO_EDGE, /* defaultValue= */ true);
     public static final CachedFlag sEdgeToEdgeBottomChin =
@@ -973,8 +975,6 @@ public abstract class ChromeFeatureList {
                     /* defaultValueInTests= */ BuildConfig.IS_FOR_TEST);
     public static final CachedFlag sEnableAndroidSidePanelDevFeature =
             newCachedFlag(ENABLE_ANDROID_SIDE_PANEL_DEV_FEATURE, false);
-    public static final CachedFlag sEnableAndroidSidePanelLogs =
-            newCachedFlag(ENABLE_ANDROID_SIDE_PANEL_LOGS, false);
     public static final CachedFlag sEnableBrowserWindowInterfaceForCustomTabActivity =
             newCachedFlag(
                     ENABLE_BROWSER_WINDOW_INTERFACE_FOR_CUSTOM_TAB_ACTIVITY,
@@ -985,11 +985,6 @@ public abstract class ChromeFeatureList {
             newCachedFlag(ENABLE_FULLSCREEN_TO_ANY_SCREEN_ANDROID, false, true);
     public static final CachedFlag sEnableXAxisActivityTransition =
             newCachedFlag(ENABLE_X_AXIS_ACTIVITY_TRANSITION, false);
-    public static final CachedFlag sFaviconDisableHostFallback =
-            newCachedFlag(
-                    FAVICON_DISABLE_HOST_FALLBACK,
-                    /* defaultValue= */ false,
-                    /* defaultValueInTests= */ true);
     public static final CachedFlag sFluidResize =
             newCachedFlag(FLUID_RESIZE, /* defaultValue= */ true, /* defaultValueInTests= */ true);
     public static final CachedFlag sForceTranslucentNotificationTrampoline =
@@ -1004,10 +999,8 @@ public abstract class ChromeFeatureList {
             newCachedFlag(
                     GESTURE_USER_EDUCATION_BACK_SWIPE,
                     /* defaultValue= */ false,
-                    /* defaultValueInTests= */ true);
+                    /* defaultValueInTests= */ false);
     public static final CachedFlag sGlic = newCachedFlag(GLIC, false);
-    public static final CachedFlag sGmscoreBindServiceOptimization =
-            newCachedFlag(GMSCORE_BIND_SERVICE_OPTIMIZATION, false);
     public static final CachedFlag sGridTabSwitcherSurfaceColorUpdate =
             newCachedFlag(
                     GRID_TAB_SWITCHER_SURFACE_COLOR_UPDATE,
@@ -1027,11 +1020,6 @@ public abstract class ChromeFeatureList {
                     LAUNCH_CAUSE_SCREEN_OFF_FIX,
                     /* defaultValue= */ false,
                     /* defaultValueInTests= */ true);
-    public static final CachedFlag sLensSendRawFileMediaTypes =
-            newCachedFlag(
-                    LENS_SEND_RAW_FILE_MEDIA_TYPES,
-                    /* defaultValue= */ false,
-                    /* defaultValueInTests= */ true);
     public static final CachedFlag sLoadAllTabsAtStartup =
             newCachedFlag(
                     LOAD_ALL_TABS_AT_STARTUP,
@@ -1050,9 +1038,6 @@ public abstract class ChromeFeatureList {
                     LOCK_TOP_CONTROLS_ON_LARGE_TABLETS_V2,
                     /* defaultValue= */ false,
                     /* defaultValueInTests= */ true);
-    public static final CachedFlag sLogoViewRefactor =
-            newCachedFlag(
-                    LOGO_VIEW_REFACTOR, /* defaultValue= */ false, /* defaultValueInTests= */ true);
     public static final CachedFlag sMaliciousApkDownloadCheck =
             newCachedFlag(
                     MALICIOUS_APK_DOWNLOAD_CHECK,
@@ -1079,6 +1064,8 @@ public abstract class ChromeFeatureList {
                     /* defaultValueInTests= */ true);
     public static final CachedFlag sNavBarColorAnimation =
             newCachedFlag(NAV_BAR_COLOR_ANIMATION, /* defaultValue= */ true);
+    public static final CachedFlag sNewTabPageCustomizationForMvt =
+            newCachedFlag(NEW_TAB_PAGE_CUSTOMIZATION_FOR_MVT, true);
     public static final CachedFlag sNewTabPageCustomizationThemeSync =
             newCachedFlag(NEW_TAB_PAGE_CUSTOMIZATION_THEME_SYNC, /* defaultValue= */ false);
     public static final CachedFlag sNewTabPageCustomizationV2 =
@@ -1128,10 +1115,6 @@ public abstract class ChromeFeatureList {
     public static final CachedFlag sSearchInSettings =
             newCachedFlag(
                     SEARCH_IN_SETTINGS, /* defaultValue= */ false, /* defaultValueInTests= */ true);
-    public static final CachedFlag sSendTabToSelfExtraEntryPoints =
-            newCachedFlag(SEND_TAB_TO_SELF_EXTRA_ENTRY_POINTS, /* defaultValue= */ false);
-    public static final CachedFlag sSessionRestoreAfterCrash =
-            newCachedFlag(SESSION_RESTORE_AFTER_CRASH, false);
     public static final CachedFlag sSettingsMultiColumn =
             newCachedFlag(
                     SETTINGS_MULTI_COLUMN,
@@ -1142,11 +1125,6 @@ public abstract class ChromeFeatureList {
                     SETTINGS_SINGLE_ACTIVITY,
                     /* defaultValue= */ false,
                     /* defaultValueInTests= */ true);
-    public static final CachedFlag sShutdownPreNativeThreadPoolAfterStartup =
-            newCachedFlag(
-                    BaseFeatures.SHUTDOWN_PRE_NATIVE_THREAD_POOL_AFTER_STARTUP,
-                    /* defaultValue= */ false,
-                    /* defaultValueInTests= */ true);
     public static final CachedFlag sSmallerTabStripTitleLimit =
             newCachedFlag(SMALLER_TAB_STRIP_TITLE_LIMIT, true);
     public static final CachedFlag sStartSurfaceReturnTime =
@@ -1174,9 +1152,7 @@ public abstract class ChromeFeatureList {
             newCachedFlag(
                     THREE_DOT_MENU_BACK_BUTTON,
                     /* defaultValue= */ false,
-                    /* defaultValueInTests= */ true);
-    public static final CachedFlag sToolbarCaptureFixForSPAs =
-            newCachedFlag(TOOLBAR_CAPTURE_FIX_FOR_SPAS, /* defaultValue= */ false);
+                    /* defaultValueInTests= */ false);
     public static final CachedFlag sToolbarPhoneAnimationRefactor =
             newCachedFlag(
                     TOOLBAR_PHONE_ANIMATION_REFACTOR,
@@ -1213,19 +1189,12 @@ public abstract class ChromeFeatureList {
             newCachedFlag(UNPARCEL_INTENT_FILE_DESCRIPTORS, /* defaultValue= */ true);
     public static final CachedFlag sUseActivityManagerForTabActivation =
             newCachedFlag(USE_ACTIVITY_MANAGER_FOR_TAB_ACTIVATION, true);
-    public static final CachedFlag sUseAppTaskForCustomTabActivation =
-            newCachedFlag(
-                    USE_APP_TASK_FOR_CUSTOM_TAB_ACTIVATION,
-                    /* defaultValue= */ false,
-                    /* defaultValueInTests= */ true);
     public static final CachedFlag sUseChimeAndroidSdk =
             newCachedFlag(USE_CHIME_ANDROID_SDK, false);
     public static final CachedFlag sUseInitialNetworkStateAtStartup =
             newCachedFlag(USE_INITIAL_NETWORK_STATE_AT_STARTUP, true);
     public static final CachedFlag sUseLibunwindstackNativeUnwinderAndroid =
             newCachedFlag(USE_LIBUNWINDSTACK_NATIVE_UNWINDER_ANDROID, true);
-    public static final CachedFlag sVirtualKeyboardTransientInnerHeightFix =
-            newCachedFlag(VIRTUAL_KEYBOARD_TRANSIENT_INNER_HEIGHT_FIX, true);
     public static final CachedFlag sWebApkMinShellApkVersion =
             newCachedFlag(WEB_APK_MIN_SHELL_APK_VERSION, true);
     // keep-sorted end
@@ -1257,6 +1226,7 @@ public abstract class ChromeFeatureList {
                     sAndroidOpenIncognitoAsWindow,
                     sAndroidPageInfoAsAppMenuItem,
                     sAndroidProgressBarVisualUpdate,
+                    sAndroidSelfOcclusionTracking,
                     sAndroidSettingsContainment,
                     sAndroidSetupList,
                     sAndroidSurfaceColorUpdate,
@@ -1264,7 +1234,9 @@ public abstract class ChromeFeatureList {
                     sAndroidTabSkipSaveTabsKillswitch,
                     sAndroidThemeModule,
                     sAndroidThemeResourceProvider,
+                    sAndroidTwaOriginDisplay,
                     sAndroidUseAdminsForEnterpriseInfo,
+                    sAndroidWindowControlsOverlay,
                     sAndroidWindowManagementWebApi,
                     sAndroidWindowPopupCustomTabUi,
                     sAndroidWindowPopupLargeScreen,
@@ -1290,6 +1262,7 @@ public abstract class ChromeFeatureList {
                     sCctBlockTouchesDuringEnterAnimation,
                     sCctContextualMenuItems,
                     sCctDestroyTabWhenModelIsEmpty,
+                    sCctFixWarmup,
                     sCctFreInSameTask,
                     sCctGoogleBottomBar,
                     sCctGoogleBottomBarVariantLayouts,
@@ -1313,13 +1286,11 @@ public abstract class ChromeFeatureList {
                     sClearIntentWhenRecreated,
                     sCommandLineOnNonRooted,
                     sCompositorViewRemeasureFix,
-                    sContextualTasks,
                     sCpaTabGroupingButton,
                     sCrossDeviceTabPaneAndroid,
                     sDefaultBrowserPromoEntryPoint,
                     sDesktopAndroidLinkCapturing,
                     sDesktopUAOnConnectedDisplay,
-                    sDisablePartnerHomepageAndroid,
                     sDocumentPictureInPictureAPI,
                     sDrawChromePagesEdgeToEdge,
                     sEdgeToEdgeBottomChin,
@@ -1331,12 +1302,10 @@ public abstract class ChromeFeatureList {
                     sEducationalTipDefaultBrowserPromoCard,
                     sEnableAndroidSidePanel,
                     sEnableAndroidSidePanelDevFeature,
-                    sEnableAndroidSidePanelLogs,
                     sEnableBrowserWindowInterfaceForCustomTabActivity,
                     sEnableExclusiveAccessManager,
                     sEnableFullscreenToAnyScreenAndroid,
                     sEnableXAxisActivityTransition,
-                    sFaviconDisableHostFallback,
                     sFluidResize,
                     sForceTranslucentNotificationTrampoline,
                     sFullscreenInsetsApiMigration,
@@ -1344,18 +1313,15 @@ public abstract class ChromeFeatureList {
                     sFullscreenVideoPictureInPicture,
                     sGestureUserEducationBackSwipe,
                     sGlic,
-                    sGmscoreBindServiceOptimization,
                     sGridTabSwitcherSurfaceColorUpdate,
                     sHistoryPaneAndroid,
                     sIncognitoThemeOverlayTesting,
                     sKeyboardEscBackNavigation,
                     sLaunchCauseScreenOffFix,
-                    sLensSendRawFileMediaTypes,
                     sLoadAllTabsAtStartup,
                     sLoadNativeEarly,
                     sLockBackPressHandlerAtStart,
                     sLockTopControlsOnLargeTabletsV2,
-                    sLogoViewRefactor,
                     sMaliciousApkDownloadCheck,
                     sMostVisitedTilesCustomization,
                     sMostVisitedTilesReselect,
@@ -1363,6 +1329,7 @@ public abstract class ChromeFeatureList {
                     sMultiInstanceSharedPrefsMigration,
                     sMvcUpdateViewWhenModelChanged,
                     sNavBarColorAnimation,
+                    sNewTabPageCustomizationForMvt,
                     sNewTabPageCustomizationThemeSync,
                     sNewTabPageCustomizationV2,
                     sNotificationTrampoline,
@@ -1385,11 +1352,8 @@ public abstract class ChromeFeatureList {
                     sSearchInCCTAlternateTapHandlingIfEnabledByEmbedder,
                     sSearchInCCTIfEnabledByEmbedder,
                     sSearchInSettings,
-                    sSendTabToSelfExtraEntryPoints,
-                    sSessionRestoreAfterCrash,
                     sSettingsMultiColumn,
                     sSettingsSingleActivity,
-                    sShutdownPreNativeThreadPoolAfterStartup,
                     sSmallerTabStripTitleLimit,
                     sStartSurfaceReturnTime,
                     sTabClosureMethodRefactor,
@@ -1398,7 +1362,6 @@ public abstract class ChromeFeatureList {
                     sTabStripDensityChangeAndroid,
                     sTabWindowManagerReportIndicesMismatch,
                     sThreeDotMenuBackButton,
-                    sToolbarCaptureFixForSPAs,
                     sToolbarPhoneAnimationRefactor,
                     sToolbarSnapshotRefactor,
                     sToolbarStaleCaptureBugFix,
@@ -1408,11 +1371,9 @@ public abstract class ChromeFeatureList {
                     sTouchToSearchCallout,
                     sUnparcelIntentFileDescriptors,
                     sUseActivityManagerForTabActivation,
-                    sUseAppTaskForCustomTabActivation,
                     sUseChimeAndroidSdk,
                     sUseInitialNetworkStateAtStartup,
                     sUseLibunwindstackNativeUnwinderAndroid,
-                    sVirtualKeyboardTransientInnerHeightFix,
                     sWebApkMinShellApkVersion
                     // keep-sorted end
                     );
@@ -1442,16 +1403,14 @@ public abstract class ChromeFeatureList {
             newMutableFlagWithSafeDefault(ANDROID_BOOKMARK_BAR, true);
     public static final MutableFlagWithSafeDefault sAndroidBookmarkBarFastFollow =
             newMutableFlagWithSafeDefault(ANDROID_BOOKMARK_BAR_FAST_FOLLOW, true);
-    public static final MutableFlagWithSafeDefault sAndroidContextMenuNewActions =
-            newMutableFlagWithSafeDefault(ANDROID_CONTEXT_MENU_NEW_ACTIONS, false);
+    public static final MutableFlagWithSafeDefault sAndroidContextMenuDuplicateTabs =
+            newMutableFlagWithSafeDefault(ANDROID_CONTEXT_MENU_DUPLICATE_TABS, false);
     public static final MutableFlagWithSafeDefault sAndroidTipsNotifications =
             newMutableFlagWithSafeDefault(ANDROID_TIPS_NOTIFICATIONS, false);
     public static final MutableFlagWithSafeDefault sAndroidTipsNotificationsV2 =
             newMutableFlagWithSafeDefault(ANDROID_TIPS_NOTIFICATIONS_V2, false);
     public static final MutableFlagWithSafeDefault sAndroidZoomImmersive =
             newMutableFlagWithSafeDefault(ANDROID_ZOOM_IMMERSIVE, false);
-    public static final MutableFlagWithSafeDefault sBookmarksBarNTP =
-            newMutableFlagWithSafeDefault(BOOKMARKS_BAR_NTP, false);
     public static final MutableFlagWithSafeDefault sBrowserControlsEarlyResize =
             newMutableFlagWithSafeDefault(BROWSER_CONTROLS_EARLY_RESIZE, false);
     public static final MutableFlagWithSafeDefault sBrowserControlsPersistsOnCvh =
@@ -1462,7 +1421,7 @@ public abstract class ChromeFeatureList {
     public static final MutableFlagWithSafeDefault sBrowserWindowInterfaceMobile =
             newMutableFlagWithSafeDefault(BROWSER_WINDOW_INTERFACE_MOBILE, true);
     public static final MutableFlagWithSafeDefault sCompositorViewHolderObscuring =
-            newMutableFlagWithSafeDefault(COMPOSITOR_VIEW_HOLDER_OBSCURING, true);
+            newMutableFlagWithSafeDefault(COMPOSITOR_VIEW_HOLDER_OBSCURING, false);
     public static final MutableFlagWithSafeDefault sControlsVisibilityFromNavigations =
             newMutableFlagWithSafeDefault(CONTROLS_VISIBILITY_FROM_NAVIGATIONS, true);
     // Defaulted to true in native, but since it is being used as a kill switch set the default
@@ -1486,7 +1445,7 @@ public abstract class ChromeFeatureList {
     public static final MutableFlagWithSafeDefault sLockTopControlsOnLargeTablets =
             newMutableFlagWithSafeDefault(LOCK_TOP_CONTROLS_ON_LARGE_TABLETS, false);
     public static final MutableFlagWithSafeDefault sMediaIndicatorsAndroid =
-            newMutableFlagWithSafeDefault(MEDIA_INDICATORS_ANDROID, true);
+            newMutableFlagWithSafeDefault(MEDIA_INDICATORS_ANDROID, false);
     public static final MutableFlagWithSafeDefault sNoVisibleHintForDifferentTLD =
             newMutableFlagWithSafeDefault(ANDROID_NO_VISIBLE_HINT_FOR_DIFFERENT_TLD, true);
     public static final MutableFlagWithSafeDefault sOmniboxAutofocusOnIncognitoNtp =
@@ -1518,14 +1477,6 @@ public abstract class ChromeFeatureList {
     /* Alphabetical order by feature name, arbitrary order by param name: */
     public static final IntCachedFeatureParam sAndroidAnimatedProgressBarFpsCap =
             newIntCachedFeatureParam(ANDROID_ANIMATED_PROGRESS_BAR_IN_BROWSER, "fps_cap", 0);
-    public static final BooleanCachedFeatureParam sAndroidApbJumpToCompletionWithFade =
-            newBooleanCachedFeatureParam(
-                    ANDROID_ANIMATED_PROGRESS_BAR_IN_BROWSER,
-                    "jump_to_completion_with_fade",
-                    false);
-    public static final BooleanCachedFeatureParam sAndroidApbJumpToCompletionNoFade =
-            newBooleanCachedFeatureParam(
-                    ANDROID_ANIMATED_PROGRESS_BAR_IN_BROWSER, "jump_to_completion_no_fade", false);
     public static final BooleanCachedFeatureParam sAndroidThemeModuleForceDependencies =
             newBooleanCachedFeatureParam(
                     ANDROID_THEME_MODULE, "force_theme_module_dependencies", false);
@@ -1571,8 +1522,6 @@ public abstract class ChromeFeatureList {
     public static final BooleanCachedFeatureParam sAndroidBookmarkBarShowBookmarkBar =
             newBooleanCachedFeatureParam(ANDROID_BOOKMARK_BAR, "show_bookmark_bar", false);
 
-    public static final BooleanCachedFeatureParam sAndroidBottomBarDisableOnNtp =
-            newBooleanCachedFeatureParam(ANDROID_BOTTOM_BAR, "disable_on_ntp", true);
     public static final BooleanCachedFeatureParam sAndroidBottomBarKeepAppMenuInToolbar =
             newBooleanCachedFeatureParam(ANDROID_BOTTOM_BAR, "keep_app_menu_in_toolbar", false);
     public static final BooleanCachedFeatureParam sAndroidBottomBarKeepHomeButtonInToolbar =
@@ -1589,6 +1538,17 @@ public abstract class ChromeFeatureList {
                     newBooleanCachedFeatureParam(
                             ANDROID_BOTTOM_TOOLBAR_V2, "reverse_order_suggestions_list", false);
 
+    public static final BooleanCachedFeatureParam sAndroidSelfOcclusionTrackingForwarding =
+            newBooleanCachedFeatureParam(
+                    ANDROID_SELF_OCCLUSION_TRACKING, "occlusion_state_forwarding", false);
+
+    public static final IntCachedFeatureParam
+            sAndroidSelfOcclusionTrackingMinimumVisibilitySizeThreshold =
+                    newIntCachedFeatureParam(
+                            ANDROID_SELF_OCCLUSION_TRACKING,
+                            "minimum_visibility_size_threshold",
+                            0);
+
     public static final IntCachedFeatureParam sBackgroundThreadPoolFieldTrialConfig =
             newIntCachedFeatureParam(BACKGROUND_THREAD_POOL_FIELD_TRIAL, "config", 4);
 
@@ -1619,7 +1579,7 @@ public abstract class ChromeFeatureList {
 
     // Devices from this OEM--and potentially others--sometimes crash when we call
     // `Activity#enterPictureInPictureMode` on Android R. So, we disable the feature on those
-    // devices. See: https://crbug.com/41492145.
+    // devices. See: https://crbug.com/1519164.
     public static final StringCachedFeatureParam
             sCctMinimizedEnabledByDefaultManufacturerExcludeList =
                     newStringCachedFeatureParam(
@@ -1631,12 +1591,6 @@ public abstract class ChromeFeatureList {
             newStringCachedFeatureParam(
                     DESKTOP_UA_ON_CONNECTED_DISPLAY, "ext_display_desktop_ua_oem_allowlist", "");
 
-    public static final BooleanCachedFeatureParam sDisablePartnerHomepageAndroidForZeroTabs =
-            newBooleanCachedFeatureParam(
-                    DISABLE_PARTNER_HOMEPAGE_ANDROID,
-                    "disable_partner_homepage_android_for_zero_tabs",
-                    false);
-
     /**
      * A cached parameter used for specifying the height of the Google Bottom Bar in DP, when its
      * variant is NO_VARIANT.
@@ -1780,13 +1734,6 @@ public abstract class ChromeFeatureList {
     public static final IntCachedFeatureParam sEdgeToEdgeTabletMinWidthThreshold =
             newIntCachedFeatureParam(EDGE_TO_EDGE_TABLET, "e2e_tablet_width_threshold", -1);
 
-    public static final BooleanCachedFeatureParam sEnableAndroidSidePanelDisableAnimations =
-            newBooleanCachedFeatureParam(ENABLE_ANDROID_SIDE_PANEL, "disable_animations", false);
-
-    public static final IntCachedFeatureParam sGestureUserEducationPageDelay =
-            newIntCachedFeatureParam(
-                    GESTURE_USER_EDUCATION_BACK_SWIPE, "gesture-user-education-page-delay", 4000);
-
     public static final BooleanCachedFeatureParam sInitFeatureListEarly =
             newBooleanCachedFeatureParam(LOAD_NATIVE_EARLY, "init_feature_list_early", true);
 
@@ -1894,20 +1841,19 @@ public abstract class ChromeFeatureList {
             List.of(
                     // keep-sorted start
                     sAndroidAnimatedProgressBarFpsCap,
-                    sAndroidApbJumpToCompletionNoFade,
-                    sAndroidApbJumpToCompletionWithFade,
                     sAndroidAppIntegrationModuleForceCardShow,
                     sAndroidAppIntegrationModuleShowThirdPartyCard,
                     sAndroidAppIntegrationMultiDataSourceSkipDeviceCheck,
                     sAndroidAppIntegrationMultiDataSourceSkipSchemaCheck,
                     sAndroidAppRatingPromptBypassChecks,
                     sAndroidBookmarkBarShowBookmarkBar,
-                    sAndroidBottomBarDisableOnNtp,
                     sAndroidBottomBarKeepAppMenuInToolbar,
                     sAndroidBottomBarKeepHomeButtonInToolbar,
                     sAndroidBottomBarShowBottomBarOnGts,
                     sAndroidBottomToolbarV2ForceBottomForFocusedOmnibox,
                     sAndroidBottomToolbarV2ReverseOrderSuggestionsList,
+                    sAndroidSelfOcclusionTrackingForwarding,
+                    sAndroidSelfOcclusionTrackingMinimumVisibilitySizeThreshold,
                     sAndroidThemeModuleForceDependencies,
                     sAndroidThemeResourceProviderForceLight,
                     sAndroidTipsNotificationsAlwaysShowOptInPromo,
@@ -1934,7 +1880,6 @@ public abstract class ChromeFeatureList {
                     sClankStartupLatencyInjectionAmountMs,
                     sDefaultBrowserPromoEntryPointShowAppMenu,
                     sDesktopUAAllowedOnExternalDisplayForOem,
-                    sDisablePartnerHomepageAndroidForZeroTabs,
                     sEdgeToEdgeEverywhereOemList,
                     sEdgeToEdgeEverywhereOemMinVersions,
                     sEdgeToEdgeTabletInvisibleBottomChinMinWidth,
@@ -1942,8 +1887,6 @@ public abstract class ChromeFeatureList {
                     sEdgeToEdgeUseBackupNavbarInsetsOemList,
                     sEdgeToEdgeUseBackupNavbarInsetsOemMinVersions,
                     sEdgeToEdgeUseBackupNavbarInsetsUseGestures,
-                    sEnableAndroidSidePanelDisableAnimations,
-                    sGestureUserEducationPageDelay,
                     sInitFeatureListEarly,
                     sLockTopControlsForceAdjustHeightOnStartup,
                     sLowMemoryDeviceThresholdMb,
@@ -2001,9 +1944,8 @@ public abstract class ChromeFeatureList {
             sOmniboxAutofocusOnIncognitoNtpNoZeroSuggest =
                     sOmniboxAutofocusOnIncognitoNtp.newBooleanParam("disable_zero_suggest", false);
 
+    public static final MutableBooleanParamWithSafeDefault sTabBottomSheetDontShowFusebox =
+            sTabBottomSheet.newBooleanParam("dont_show_fusebox", false);
     public static final MutableBooleanParamWithSafeDefault sTabBottomSheetResizeWebview =
             sTabBottomSheet.newBooleanParam("resize_webview", false);
-    public static final MutableBooleanParamWithSafeDefault
-            sTabBottomSheetSuppressBottomToolbarWhileOpen =
-                    sTabBottomSheet.newBooleanParam("suppress_bottom_toolbar_while_open", false);
 }

tools/under-control/src/chrome/browser/prefs/browser_prefs.cc

@@ -40,7 +40,6 @@
 #include "chrome/browser/media/media_engagement_service.h"
 #include "chrome/browser/media/media_storage_id_salt.h"
 #include "chrome/browser/media/prefs/capture_device_ranking.h"
-#include "chrome/browser/media/unified_autoplay_config.h"
 #include "chrome/browser/media/webrtc/capture_policy_utils.h"
 #include "chrome/browser/media/webrtc/media_capture_devices_dispatcher.h"
 #include "chrome/browser/media/webrtc/permission_bubble_media_access_handler.h"
@@ -50,7 +49,6 @@
 #include "chrome/browser/net/net_error_tab_helper.h"
 #include "chrome/browser/net/profile_network_context_service.h"
 #include "chrome/browser/net/system_network_context_manager.h"
-#include "chrome/browser/new_tab_page/ntp_pref_names.h"
 #include "chrome/browser/notifications/notification_display_service_impl.h"
 #include "chrome/browser/notifications/notifier_state_tracker.h"
 #include "chrome/browser/notifications/platform_notification_service_impl.h"
@@ -80,6 +78,7 @@
 #include "chrome/browser/signin/chrome_signin_client.h"
 #include "chrome/browser/signin/signin_promo_util.h"
 #include "chrome/browser/ssl/ssl_config_service_manager.h"
+#include "chrome/browser/subscription_eligibility/subscription_eligibility_prefs.h"
 #include "chrome/browser/themes/theme_service.h"
 #include "chrome/browser/tracing/chrome_tracing_delegate.h"
 #include "chrome/browser/ui/browser_ui_prefs.h"
@@ -87,6 +86,7 @@
 #include "chrome/browser/ui/performance_controls/performance_controls_metrics.h"
 #include "chrome/browser/ui/prefs/prefs_tab_helper.h"
 #include "chrome/browser/ui/safety_hub/safety_hub_prefs.h"
+#include "chrome/browser/ui/search_engines/keyword_editor_controller.h"
 #include "chrome/browser/ui/tabs/projects/projects_prefs.h"
 #include "chrome/browser/ui/tabs/tab_strip_prefs.h"
 #include "chrome/browser/ui/toolbar/chrome_labs/chrome_labs_prefs.h"
@@ -103,7 +103,6 @@
 #include "chrome/common/buildflags.h"
 #include "chrome/common/pref_names.h"
 #include "chrome/common/secure_origin_allowlist.h"
-#include "components/accessibility_annotator/core/prefs.h"
 #include "components/autofill/core/common/autofill_prefs.h"
 #include "components/blocked_content/safe_browsing_triggered_popup_blocker.h"
 #include "components/breadcrumbs/core/breadcrumbs_status.h"
@@ -118,7 +117,6 @@
 #include "components/dom_distiller/core/distilled_page_prefs.h"
 #include "components/domain_reliability/domain_reliability_prefs.h"
 #include "components/embedder_support/origin_trials/origin_trial_prefs.h"
-#include "components/enterprise/browser/groups/groups_prefs.h"
 #include "components/enterprise/browser/identifiers/identifiers_prefs.h"
 #include "components/enterprise/browser/promotion/promotion_prefs.h"
 #include "components/enterprise/buildflags/buildflags.h"
@@ -135,7 +133,6 @@
 #include "components/media_device_salt/media_device_id_salt.h"
 #include "components/metrics/demographics/user_demographics.h"
 #include "components/metrics/metrics_pref_names.h"
-#include "components/metrics/metrics_reporting_choice_service.h"
 #include "components/network_time/network_time_tracker.h"
 #include "components/ntp_tiles/custom_links_manager_impl.h"
 #include "components/ntp_tiles/enterprise/enterprise_shortcuts_manager_impl.h"
@@ -156,6 +153,7 @@
 #include "components/performance_manager/public/user_tuning/prefs.h"
 #include "components/permissions/permission_hats_trigger_helper.h"
 #include "components/permissions/pref_names.h"
+#include "components/plus_addresses/core/common/plus_address_prefs.h"
 #include "components/policy/core/browser/browser_policy_connector.h"
 #include "components/policy/core/browser/url_list/url_blocklist_manager.h"
 #include "components/policy/core/common/local_test_policy_provider.h"
@@ -188,7 +186,6 @@
 #include "components/site_engagement/content/site_engagement_service.h"
 #include "components/subresource_filter/content/browser/ruleset_service.h"
 #include "components/subresource_filter/core/common/constants.h"
-#include "components/subscription_eligibility/subscription_eligibility_prefs.h"
 #include "components/supervised_user/core/browser/supervised_user_preferences.h"
 #include "components/sync/base/pref_names.h"
 #include "components/sync/service/device_statistics_scheduler.h"
@@ -198,6 +195,7 @@
 #include "components/sync_preferences/cross_device_pref_tracker/prefs/cross_device_pref_registry.h"
 #include "components/sync_preferences/pref_service_syncable.h"
 #include "components/sync_sessions/session_sync_prefs.h"
+#include "components/tpcd/metadata/browser/prefs.h"
 #include "components/tracing/common/pref_names.h"
 #include "components/translate/core/browser/translate_prefs.h"
 #include "components/update_client/update_client.h"
@@ -213,15 +211,6 @@
 #include "pdf/buildflags.h"
 #include "printing/buildflags/buildflags.h"
 #include "rlz/buildflags/buildflags.h"
-#include "ui/webui/buildflags.h"
-
-#if BUILDFLAG(ENABLE_WEBUI_NTP)
-#include "chrome/browser/ui/webui/new_tab_page/new_tab_page_handler.h"
-#include "chrome/browser/ui/webui/new_tab_page/new_tab_page_ui.h"
-#if !BUILDFLAG(IS_ANDROID)
-#include "chrome/browser/ui/webui/new_tab_footer/new_tab_footer_ui.h"
-#endif  // !BUILDFLAG(IS_ANDROID)
-#endif  // BUILDFLAG(ENABLE_WEBUI_NTP)
 
 #if BUILDFLAG(ENABLE_BACKGROUND_MODE)
 #include "chrome/browser/background/extensions/background_mode_manager.h"
@@ -251,6 +240,8 @@
 #include "chrome/browser/pdf/pdf_pref_names.h"
 #endif  // BUILDFLAG(ENABLE_PDF)
 
+#include "chrome/browser/media/unified_autoplay_config.h"
+
 #if !BUILDFLAG(IS_ANDROID) || BUILDFLAG(ENABLE_EXTENSIONS_CORE)
 #include "chrome/browser/ui/webui/management/management_ui.h"
 #endif
@@ -270,18 +261,16 @@
 #include "chrome/browser/partnerbookmarks/partner_bookmarks_shim.h"
 #include "chrome/browser/readaloud/android/prefs.h"
 #include "chrome/browser/ssl/known_interception_disclosure_infobar_delegate.h"
-#include "components/cdm/browser/media_drm_storage_impl.h"  // nogncheck crbug.com/40147906
+#include "components/cdm/browser/media_drm_storage_impl.h"  // nogncheck crbug.com/1125897
 #include "components/feed/core/common/pref_names.h"        // nogncheck
 #include "components/feed/core/shared_prefs/pref_names.h"  // nogncheck
 #include "components/feed/core/v2/ios_shared_prefs.h"      // nogncheck
 #include "components/ntp_tiles/popular_sites_impl.h"
 #include "components/permissions/contexts/geolocation_permission_context_android.h"
 #include "components/webapps/browser/android/install_prompt_prefs.h"
-#endif  // BUILDFLAG(IS_ANDROID)
-
-#if !BUILDFLAG(IS_ANDROID)
+#else  // BUILDFLAG(IS_ANDROID)
 #include "chrome/browser/actor/ui/actor_ui_state_manager_prefs.h"
-#include "chrome/browser/desktop_to_mobile_promos/promos_utils.h"  // nogncheck crbug.com/40147906
+#include "chrome/browser/desktop_to_mobile_promos/promos_utils.h"  // nogncheck crbug.com/1125897
 #include "chrome/browser/gcm/gcm_product_util.h"
 #include "chrome/browser/hid/hid_policy_allowed_devices.h"
 #include "chrome/browser/intranet_redirect_detector.h"
@@ -313,16 +302,20 @@
 #include "chrome/browser/ui/webui/certificate_manager/certificate_manager_handler.h"
 #include "chrome/browser/ui/webui/cr_components/theme_color_picker/theme_color_picker_handler.h"
 #include "chrome/browser/ui/webui/history/foreign_session_handler.h"
+#include "chrome/browser/ui/webui/new_tab_footer/new_tab_footer_ui.h"
+#include "chrome/browser/ui/webui/new_tab_page/new_tab_page_handler.h"
+#include "chrome/browser/ui/webui/new_tab_page/new_tab_page_ui.h"
+#include "chrome/browser/ui/webui/new_tab_page/ntp_pref_names.h"
 #include "chrome/browser/ui/webui/settings/settings_ui.h"
 #include "chrome/browser/ui/webui/tab_search/tab_search_prefs.h"
 #include "chrome/browser/upgrade_detector/upgrade_detector.h"
 #include "chrome/browser/user_education/browser_user_education_storage_service.h"
 #include "chrome/browser/webauthn/chrome_authenticator_request_delegate.h"
-#include "components/headless/policy/headless_mode_prefs.h"  // nogncheck crbug.com/40147906
+#include "components/headless/policy/headless_mode_prefs.h"
 #include "components/lens/lens_overlay_permission_utils.h"
 #include "components/live_caption/live_caption_controller.h"
 #include "components/live_caption/live_translate_controller.h"
-#endif  // !BUILDFLAG(IS_ANDROID)
+#endif  // BUILDFLAG(IS_ANDROID)
 
 #if BUILDFLAG(ENABLE_DEVTOOLS_FRONTEND)
 #include "chrome/browser/devtools/devtools_window.h"
@@ -428,6 +421,7 @@
 #include "chrome/browser/ash/settings/stats_reporting_controller.h"
 #include "chrome/browser/ash/system/automatic_reboot_manager.h"
 #include "chrome/browser/ash/system/input_device_settings.h"
+#include "chrome/browser/ash/system_web_apps/apps/help_app/help_app_notification_controller.h"
 #include "chrome/browser/ash/system_web_apps/apps/media_app/media_app_guest_ui_config.h"
 #include "chrome/browser/ash/wallpaper_handlers/wallpaper_prefs.h"
 #include "chrome/browser/chromeos/enterprise/cloud_storage/pref_utils.h"
@@ -505,17 +499,19 @@
 #include "chrome/browser/media/media_foundation_service_monitor.h"
 #include "chrome/browser/os_crypt/app_bound_encryption_provider_win.h"
 #include "chrome/browser/webnn/webnn_prefs.h"
-#include "components/os_crypt/async/browser/dpapi_key_provider.h"
-#include "components/os_crypt/async/browser/os_crypt_win.h"
 #endif  // BUILDFLAG(IS_WIN)
 
 #if BUILDFLAG(IS_WIN) || BUILDFLAG(IS_MAC) || BUILDFLAG(IS_ANDROID)
 #include "chrome/browser/enterprise/platform_auth/platform_auth_policy_observer.h"
 #endif  // BUILDFLAG(IS_WIN) || BUILDFLAG(IS_MAC) || BUILDFLAG(IS_ANDROID)
 
+#if BUILDFLAG(IS_WIN) || BUILDFLAG(IS_MAC)
+#include "components/os_crypt/sync/os_crypt.h"  // nogncheck
+#endif  // BUILDFLAG(IS_WIN) || BUILDFLAG(IS_MAC)
+
 #if BUILDFLAG(IS_WIN) || BUILDFLAG(IS_MAC) || BUILDFLAG(IS_LINUX) || \
     BUILDFLAG(IS_CHROMEOS)
-#include "components/device_signals/core/browser/pref_names.h"  // nogncheck due to crbug.com/40147906
+#include "components/device_signals/core/browser/pref_names.h"  // nogncheck due to crbug.com/1125897
 #endif
 
 #if BUILDFLAG(IS_WIN) || BUILDFLAG(IS_MAC) || BUILDFLAG(IS_LINUX)
@@ -562,10 +558,6 @@
 #include "components/safe_browsing/content/common/file_type_policies_prefs.h"
 #endif
 
-#if BUILDFLAG(CHROME_FOR_TESTING)
-#include "chrome/browser/chrome_for_testing/prefs.h"
-#endif
-
 namespace {
 
 // Please keep the list of deprecated prefs in chronological order. i.e. Add to
@@ -984,32 +976,6 @@ constexpr char kSafeBrowsingModuleLastCooldownStartAt[] =
 constexpr char kSafeBrowsingModuleOpened[] =
     "safebrowsing.ntp.user_opened_module";
 
-// Deprecated 04/2026.
-constexpr char kTpcdMetadataCohorts[] = "tpcd.metadata.cohorts";
-
-#if BUILDFLAG(IS_ANDROID)
-// Deprecated 04/2026.
-constexpr char kHasSeenWebFeed[] = "webfeed.has_seen_feed";
-constexpr char kLastBadgeAnimationTime[] = "webfeed.last_badge_animation_time";
-#endif  // BUILDFLAG(IS_ANDROID)
-
-// Deprecated 04/2026.
-inline constexpr char kPreallocatedAddressesVersion[] =
-    "plus_addresses.preallocation.version";
-inline constexpr char kPreallocatedAddresses[] =
-    "plus_addresses.preallocation.addresses";
-inline constexpr char kPreallocatedAddressesNext[] =
-    "plus_addresses.preallocation.next";
-inline constexpr char kFirstPlusAddressCreationTime[] =
-    "plus_addresses.creation.first.time";
-inline constexpr char kLastPlusAddressFillingTime[] =
-    "plus_addresses.last.filling.time";
-
-#if BUILDFLAG(IS_ANDROID)
-// Deprecated 05/2026.
-constexpr char kWebFeedContentOrder[] = "webfeed.content_order";
-#endif  // BUILDFLAG(IS_ANDROID)
-
 // Register local state used only for migration (clearing or moving to a new
 // key).
 void RegisterLocalStatePrefsForMigration(PrefRegistrySimple* registry) {
@@ -1117,15 +1083,6 @@ void RegisterLocalStatePrefsForMigration(PrefRegistrySimple* registry) {
 
   // Deprecated 02/2026.
   registry->RegisterListPref(kProfilesDeletedOld);
-
-  // Deprecated 04/2026.
-  registry->RegisterDictionaryPref(kTpcdMetadataCohorts);
-
-#if BUILDFLAG(IS_ANDROID)
-  // Deprecated 04/2026.
-  registry->RegisterBooleanPref(kHasSeenWebFeed, false);
-  registry->RegisterTimePref(kLastBadgeAnimationTime, base::Time());
-#endif  // BUILDFLAG(IS_ANDROID)
 }
 
 // Register prefs used only for migration (clearing or moving to a new key).
@@ -1261,10 +1218,10 @@ void RegisterProfilePrefsForMigration(
       kObsoleteAutofillableCredentialsAccountStoreLoginDatabase, false);
 #endif  // !BUILDFLAG(IS_ANDROID)
 
-#if !BUILDFLAG(IS_ANDROID) || BUILDFLAG(ENABLE_WEBUI_NTP)
+#if !BUILDFLAG(IS_ANDROID)
   // Deprecated 08/2025.
   registry->RegisterBooleanPref(ntp_prefs::kNtpUseMostVisitedTiles, false);
-#endif  // !BUILDFLAG(IS_ANDROID) || BUILDFLAG(ENABLE_WEBUI_NTP)
+#endif  // !BUILDFLAG(IS_ANDROID)
 
 #if BUILDFLAG(IS_CHROMEOS)
   // Deprecated 08/2025.
@@ -1297,10 +1254,10 @@ void RegisterProfilePrefsForMigration(
   // Deprecated 10/2025.
   registry->RegisterBooleanPref(kSessionRestorePrefChanged, false);
 
-#if !BUILDFLAG(IS_ANDROID) || BUILDFLAG(ENABLE_WEBUI_NTP)
+#if !BUILDFLAG(IS_ANDROID)
   // Deprecated 10/2025.
   registry->RegisterIntegerPref(ntp_prefs::kNtpShortcutsType, 0);
-#endif  // !BUILDFLAG(IS_ANDROID) || BUILDFLAG(ENABLE_WEBUI_NTP)
+#endif  // !BUILDFLAG(IS_ANDROID)
 
   // Deprecated 10/2025.
   registry->RegisterStringPref(kLegacySyncSessionsGUID, std::string());
@@ -1381,18 +1338,6 @@ void RegisterProfilePrefsForMigration(
   registry->RegisterIntegerPref(kSafeBrowsingModuleShownCount, 0);
   registry->RegisterInt64Pref(kSafeBrowsingModuleLastCooldownStartAt, 0);
   registry->RegisterBooleanPref(kSafeBrowsingModuleOpened, false);
-
-  // Deprecated 04/2026.
-  registry->RegisterIntegerPref(kPreallocatedAddressesVersion, 1);
-  registry->RegisterListPref(kPreallocatedAddresses);
-  registry->RegisterIntegerPref(kPreallocatedAddressesNext, 0);
-  registry->RegisterTimePref(kFirstPlusAddressCreationTime, base::Time());
-  registry->RegisterTimePref(kLastPlusAddressFillingTime, base::Time());
-
-#if BUILDFLAG(IS_ANDROID)
-  // Deprecated 05/2026.
-  registry->RegisterIntegerPref(kWebFeedContentOrder, 0);
-#endif  // BUILDFLAG(IS_ANDROID)
 }
 
 }  // namespace
@@ -1420,14 +1365,10 @@ void RegisterLocalState(PrefRegistrySimple* registry) {
   browser_shutdown::RegisterPrefs(registry);
   BrowserProcessImpl::RegisterPrefs(registry);
   ChromeContentBrowserClient::RegisterLocalStatePrefs(registry);
-#if BUILDFLAG(CHROME_FOR_TESTING)
-  chrome_for_testing::RegisterPrefs(registry);
-#endif
   chrome_labs_prefs::RegisterLocalStatePrefs(registry);
   chrome_urls::RegisterPrefs(registry);
   ChromeMetricsServiceClient::RegisterPrefs(registry);
   enterprise_connectors::RegisterLocalStatePrefs(registry);
-  enterprise_groups::RegisterLocalStatePrefs(registry);
   enterprise_util::RegisterLocalStatePrefs(registry);
   component_updater::RegisterPrefs(registry);
   domain_reliability::RegisterPrefs(registry);
@@ -1442,7 +1383,6 @@ void RegisterLocalState(PrefRegistrySimple* registry) {
   language::UlpLanguageCodeLocator::RegisterLocalStatePrefs(registry);
   memory::EnterpriseMemoryLimitPrefObserver::RegisterPrefs(registry);
   metrics::RegisterDemographicsLocalStatePrefs(registry);
-  metrics::MetricsReportingChoiceService::RegisterPrefs(registry);
   metrics::TabStatsTracker::RegisterPrefs(registry);
   network_time::NetworkTimeTracker::RegisterPrefs(registry);
   omnibox::RegisterLocalStatePrefs(registry);
@@ -1479,6 +1419,7 @@ void RegisterLocalState(PrefRegistrySimple* registry) {
   subresource_filter::IndexedRulesetVersion::RegisterPrefs(
       registry, subresource_filter::kSafeBrowsingRulesetConfig.filter_tag);
   SystemNetworkContextManager::RegisterPrefs(registry);
+  tpcd::metadata::RegisterLocalStatePrefs(registry);
   tracing::RegisterPrefs(registry);
   update_client::RegisterPrefs(registry);
   variations::VariationsService::RegisterPrefs(registry);
@@ -1634,7 +1575,7 @@ void RegisterLocalState(PrefRegistrySimple* registry) {
 #endif
 
 #if BUILDFLAG(IS_WIN)
-  os_crypt_async::RegisterLocalPrefs(registry);
+  OSCrypt::RegisterLocalPrefs(registry);
   registry->RegisterBooleanPref(prefs::kRendererAppContainerEnabled, true);
   registry->RegisterBooleanPref(prefs::kBlockBrowserLegacyExtensionPoints,
                                 true);
@@ -1733,7 +1674,6 @@ void RegisterProfilePrefs(user_prefs::PrefRegistrySyncable* registry,
   // User prefs. Please keep this list alphabetized.
   AccessibilityLabelsService::RegisterProfilePrefs(registry);
   AccessibilityUIMessageHandler::RegisterProfilePrefs(registry);
-  accessibility_annotator::prefs::RegisterProfilePrefs(registry);
   AimEligibilityService::RegisterProfilePrefs(registry);
   AnnouncementNotificationService::RegisterProfilePrefs(registry);
   autofill::prefs::RegisterProfilePrefs(registry);
@@ -1786,15 +1726,14 @@ void RegisterProfilePrefs(user_prefs::PrefRegistrySyncable* registry,
 #endif  // BUILDFLAG(ENABLE_ON_DEVICE_TRANSLATION)
   optimization_guide::prefs::RegisterProfilePrefs(registry);
   optimization_guide::model_execution::prefs::RegisterProfilePrefs(registry);
-#if !BUILDFLAG(IS_ANDROID)
   PageColorsController::RegisterProfilePrefs(registry);
-#endif
   password_manager::PasswordManager::RegisterProfilePrefs(registry);
   payments::RegisterProfilePrefs(registry);
   performance_manager::user_tuning::prefs::RegisterProfilePrefs(registry);
   permissions::RegisterProfilePrefs(registry);
   PermissionBubbleMediaAccessHandler::RegisterProfilePrefs(registry);
   PlatformNotificationServiceImpl::RegisterProfilePrefs(registry);
+  plus_addresses::prefs::RegisterProfilePrefs(registry);
   policy::URLBlocklistManager::RegisterProfilePrefs(registry);
   PolicyUI::RegisterProfilePrefs(registry);
   PrefProxyConfigTrackerImpl::RegisterProfilePrefs(registry);
@@ -1907,14 +1846,6 @@ void RegisterProfilePrefs(user_prefs::PrefRegistrySyncable* registry,
 #endif
 
   UnifiedAutoplayConfig::RegisterProfilePrefs(registry);
-#if BUILDFLAG(ENABLE_WEBUI_NTP)
-// TODO(b/502297163): Implement for Android.
-#if !BUILDFLAG(IS_ANDROID)
-  NewTabFooterUI::RegisterProfilePrefs(registry);
-#endif  // !BUILDFLAG(IS_ANDROID)
-  NewTabPageHandler::RegisterProfilePrefs(registry);
-  NewTabPageUI::RegisterProfilePrefs(registry);
-#endif  // BUILDFLAG(ENABLE_WEBUI_NTP)
 
 #if BUILDFLAG(IS_ANDROID)
   AuxiliarySearchDonationService::RegisterProfilePrefs(registry);
@@ -1952,6 +1883,9 @@ void RegisterProfilePrefs(user_prefs::PrefRegistrySyncable* registry,
   media_router::RegisterProfilePrefs(registry);
   MicrosoftAuthPageHandler::RegisterProfilePrefs(registry);
   MicrosoftFilesPageHandler::RegisterProfilePrefs(registry);
+  NewTabFooterUI::RegisterProfilePrefs(registry);
+  NewTabPageHandler::RegisterProfilePrefs(registry);
+  NewTabPageUI::RegisterProfilePrefs(registry);
   OutlookCalendarPageHandler::RegisterProfilePrefs(registry);
   PinnedTabCodec::RegisterProfilePrefs(registry);
   promos_utils::RegisterProfilePrefs(registry);
@@ -2046,6 +1980,7 @@ void RegisterProfilePrefs(user_prefs::PrefRegistrySyncable* registry,
       registry);
   ash::NetworkMetadataStore::RegisterPrefs(registry);
   ash::ReleaseNotesStorage::RegisterProfilePrefs(registry);
+  ash::HelpAppNotificationController::RegisterProfilePrefs(registry);
   ash::quick_unlock::FingerprintStorage::RegisterProfilePrefs(registry);
   ash::quick_unlock::PinStoragePrefs::RegisterProfilePrefs(registry);
   ash::Preferences::RegisterProfilePrefs(
@@ -2408,20 +2343,6 @@ void MigrateObsoleteLocalStatePrefs(PrefService* local_state) {
   // Added 03/2026.
   local_state->ClearPref(kGlicMultiInstanceEnabledBySubscriptionTier);
 
-  // Added 04/2026.
-  local_state->ClearPref(kTpcdMetadataCohorts);
-
-#if !BUILDFLAG(IS_ANDROID)
-  // Added 04/2026.
-  tabs::MigrateHoverCardMemoryPref(local_state);
-#endif  // BUILDFLAG(IS_ANDROID)
-
-#if BUILDFLAG(IS_ANDROID)
-  // Added 04/2026.
-  local_state->ClearPref(kHasSeenWebFeed);
-  local_state->ClearPref(kLastBadgeAnimationTime);
-#endif  // BUILDFLAG(IS_ANDROID)
-
   // Please don't delete the following line. It is used by PRESUBMIT.py.
   // END_MIGRATE_OBSOLETE_LOCAL_STATE_PREFS
 
@@ -2590,10 +2511,10 @@ void MigrateObsoleteProfilePrefs(PrefService* profile_prefs,
       kObsoleteAutofillableCredentialsAccountStoreLoginDatabase);
 #endif  // !BUILDFLAG(IS_ANDROID)
 
-#if BUILDFLAG(ENABLE_WEBUI_NTP)
+#if !BUILDFLAG(IS_ANDROID)
   // Added 08/2025.
   NewTabPageUI::MigrateDeprecatedUseMostVisitedTilesPref(profile_prefs);
-#endif  // BUILDFLAG(ENABLE_WEBUI_NTP)
+#endif  // !BUILDFLAG(IS_ANDROID)
 
 #if BUILDFLAG(IS_CHROMEOS)
   // Added 08/2025.
@@ -2616,9 +2537,7 @@ void MigrateObsoleteProfilePrefs(PrefService* profile_prefs,
 #endif  // BUILDFLAG(IS_ANDROID)
 
   // Added 09/2025.
-#if !BUILDFLAG(IS_ANDROID)
   PageColorsController::MigrateObsoleteProfilePrefs(profile_prefs);
-#endif
   profile_prefs->ClearPref(kGaiaCookieLastListAccountsData);
 
   // Added 09/2025.
@@ -2626,10 +2545,10 @@ void MigrateObsoleteProfilePrefs(PrefService* profile_prefs,
 
   SigninPrefs(*profile_prefs).MigrateObsoleteSigninPrefs();
 
-#if BUILDFLAG(ENABLE_WEBUI_NTP)
+#if !BUILDFLAG(IS_ANDROID)
   // Added 10/2025
   NewTabPageUI::MigrateDeprecatedShortcutsTypePref(profile_prefs);
-#endif  // BUILDFLAG(ENABLE_WEBUI_NTP)
+#endif  // !BUILDFLAG(IS_ANDROID)
 
   // Added 10/2025.
   profile_prefs->ClearPref(kLegacySyncSessionsGUID);
@@ -2708,18 +2627,6 @@ void MigrateObsoleteProfilePrefs(PrefService* profile_prefs,
   // Added 03/2026.
   profile_prefs->ClearPref(kNtpPromoPrefLastSnoozed);
 
-  // Added 04/2026.
-  profile_prefs->ClearPref(kPreallocatedAddressesVersion);
-  profile_prefs->ClearPref(kPreallocatedAddresses);
-  profile_prefs->ClearPref(kPreallocatedAddressesNext);
-  profile_prefs->ClearPref(kFirstPlusAddressCreationTime);
-  profile_prefs->ClearPref(kLastPlusAddressFillingTime);
-
-#if BUILDFLAG(IS_ANDROID)
-  // Added 05/2026.
-  profile_prefs->ClearPref(kWebFeedContentOrder);
-#endif  // BUILDFLAG(IS_ANDROID)
-
   // Please don't delete the following line. It is used by PRESUBMIT.py.
   // END_MIGRATE_OBSOLETE_PROFILE_PREFS
 

tools/under-control/src/chrome/browser/ui/tab_helpers.cc

@@ -129,7 +129,6 @@
 #include "components/offline_pages/buildflags/buildflags.h"
 #include "components/omnibox/common/omnibox_feature_configs.h"
 #include "components/optimization_guide/core/optimization_guide_features.h"
-#include "components/page_content_annotations/content/annotate_page_content_request.h"
 #include "components/page_content_annotations/content/page_content_annotations_web_contents_observer.h"
 #include "components/page_content_annotations/core/page_content_extraction_types.h"
 #include "components/page_info/core/features.h"
@@ -215,6 +214,7 @@
 #include "chrome/browser/chromeos/cros_apps/cros_apps_tab_helper.h"
 #include "chrome/browser/chromeos/gemini_app/gemini_app_tab_helper.h"
 #include "chrome/browser/chromeos/policy/dlp/dlp_content_tab_helper.h"
+#include "chrome/browser/chromeos/printing/print_preview/printing_init_cros.h"
 #include "chrome/browser/ui/ash/google_one/google_one_offer_iph_tab_helper.h"
 #include "chromeos/ash/experiences/isolated_web_app/cros_isolated_web_app_enabler.h"
 #endif
@@ -454,7 +454,7 @@ void TabHelpers::AttachTabHelpers(WebContents* web_contents) {
       download::NavigationMonitorFactory::GetForKey(profile->GetProfileKey()));
   history::WebContentsTopSitesObserver::CreateForWebContents(
       web_contents, TopSitesFactory::GetForProfile(profile).get());
-  if (!profile->IsOffTheRecord()) {
+  {
     auto* history_tab_helper =
         HistoryTabHelper::GetOrCreateForWebContents(web_contents);
     HistoryClustersTabHelper::CreateForWebContents(web_contents,
@@ -497,19 +497,12 @@ void TabHelpers::AttachTabHelpers(WebContents* web_contents) {
           PageContentAnnotationsServiceFactory::GetForProfile(profile);
   if (page_content_annotations_service) {
     page_content_annotations::PageContentAnnotationsWebContentsObserver::
-        CreateForWebContents(web_contents, *page_content_annotations_service);
-
-    // TODO(b/478883979): Consider decoupling this from
-    // PageContentAnnotationsService.
-    auto* page_content_extraction_service = page_content_annotations::
-        PageContentExtractionServiceFactory::GetForProfile(profile);
-    if (page_content_extraction_service) {
-      page_content_annotations::AnnotatedPageContentRequest::
-          CreateForWebContents(
-              web_contents, *page_content_extraction_service,
-              base::BindRepeating(&page_content_annotations::FetchPageContext),
-              base::BindRepeating(&GetPageContentAnnotationsTabId));
-    }
+        CreateForWebContents(
+            web_contents, *page_content_annotations_service,
+            page_content_annotations::PageContentExtractionServiceFactory::
+                GetForProfile(profile),
+            base::BindRepeating(&page_content_annotations::FetchPageContext),
+            base::BindRepeating(&GetPageContentAnnotationsTabId));
 
 #if BUILDFLAG(IS_ANDROID)
     // If enabled, save sensitivity data for each non-incognito android tab.
@@ -559,7 +552,7 @@ void TabHelpers::AttachTabHelpers(WebContents* web_contents) {
       web_contents);
 #endif  // BUILDFLAG(IS_ANDROID)
   // TODO(siggi): Remove this once the Resource Coordinator refactoring is done.
-  //     See https://crbug.com/40604438.
+  //     See https://crbug.com/910288.
   resource_coordinator::ResourceCoordinatorTabHelper::CreateForWebContents(
       web_contents);
 #if BUILDFLAG(SAFE_BROWSING_AVAILABLE)
@@ -649,7 +642,7 @@ void TabHelpers::AttachTabHelpers(WebContents* web_contents) {
 #if BUILDFLAG(IS_ANDROID)
   webapps::MLInstallabilityPromoter::CreateForWebContents(web_contents);
   {
-    // Remove after fixing https://crbug.com/41426655
+    // Remove after fixing https://crbug/905919
     TRACE_EVENT0("browser", "AppBannerManagerAndroid::CreateForWebContents");
     webapps::AppBannerManagerAndroid::CreateForWebContents(
         web_contents, std::make_unique<webapps::ChromeAppBannerManagerAndroid>(
@@ -716,7 +709,8 @@ void TabHelpers::AttachTabHelpers(WebContents* web_contents) {
   }
   SearchTabHelper::CreateForWebContents(web_contents);
   TabDialogs::CreateForWebContents(web_contents);
-  if (base::FeatureList::IsEnabled(features::kTabHoverCardImages)) {
+  if (base::FeatureList::IsEnabled(features::kTabHoverCardImages) ||
+      base::FeatureList::IsEnabled(features::kWebUITabStrip)) {
     ThumbnailTabHelper::CreateForWebContents(web_contents);
   }
   UMABrowsingActivityObserver::TabHelper::CreateForWebContents(web_contents);
@@ -819,7 +813,15 @@ void TabHelpers::AttachTabHelpers(WebContents* web_contents) {
   PluginObserver::CreateForWebContents(web_contents);
 #endif
 
-#if BUILDFLAG(ENABLE_PRINTING)
+// Only enable ChromeOS print preview if `kPrintPreviewCrosPrimary` is enabled
+// and is a ChromeOS build. Otherwise instantiate browser print preview.
+#if BUILDFLAG(ENABLE_PRINTING) && BUILDFLAG(IS_CHROMEOS)
+  if (base::FeatureList::IsEnabled(::features::kPrintPreviewCrosPrimary)) {
+    chromeos::printing::InitializePrintingForWebContents(web_contents);
+  } else {
+    printing::InitializePrintingForWebContents(web_contents);
+  }
+#elif BUILDFLAG(ENABLE_PRINTING)
   printing::InitializePrintingForWebContents(web_contents);
 #endif
 

tools/under-control/src/chrome/browser/ui/webui/chrome_content_browser_client_webui_part.cc

@@ -73,6 +73,15 @@ void ChromeContentBrowserClientWebUiPart::OverrideWebPreferences(
   blink::web_pref::WebPreferences default_prefs;
   CopyFontPrefs(/*source=*/default_prefs, /*destination=*/web_prefs);
 
+#if BUILDFLAG(ENABLE_WEBUI_TAB_STRIP)
+  // Set some non-font prefs for webui tabstrip. The tabstrip renderer is never
+  // navigated to or from, so we don't need to replicate this logic in
+  // OverrideWebPreferencesAfterNavigation.
+  if (url.host() == chrome::kChromeUITabStripHost) {
+    web_prefs->touch_drag_drop_enabled = true;
+    web_prefs->touch_dragend_context_menu = true;
+  }
+#endif
 }
 
 bool ChromeContentBrowserClientWebUiPart::OverrideWebPreferencesAfterNavigation(

tools/under-control/src/chrome/common/extensions/api/autofill_private.idl

@@ -185,15 +185,6 @@ namespace autofillPrivate {
     STRING
   };
 
-  // Entity types that have an equivalent in Wallet are referred to as "passes".
-  // This enum represents what kind of pass (if any) an entity type represents.
-  // Note that having a pass type doesn't imply that the entity is stored in
-  // Wallet. Local passes are supported by AutofillAi as well.
-  enum EntityPassType {
-    PUBLIC_PASS,
-    PRIVATE_PASS
-  };
-
   // Metadata about an autofill entry (address or credit card) which is used to
   // render a summary list of all entries.
   dictionary AutofillMetadata {
@@ -392,9 +383,6 @@ namespace autofillPrivate {
     // Note that an entity type might support Wallet and local storage
     // as well. (e.g. Vehicle).
     boolean supportsWalletStorage;
-    // What kind of pass the entity type represents, if any. This field is not
-    // set for non-pass entities.
-    EntityPassType? passType;
   };
 
   // Contains date information: month, day and year.
@@ -435,8 +423,6 @@ namespace autofillPrivate {
     boolean? shouldAuthenticateToView;
     // Whether the entity is (or should be) stored in Google Wallet servers.
     boolean? storedInWallet;
-    // Whether the entity is read only.
-    boolean? isReadOnly;
   };
 
   // Contains the minimum amount of information needed to display an entity
@@ -457,8 +443,6 @@ namespace autofillPrivate {
     // If the entity is `storedInWallet`, this string contains the URL to the
     // management page of the pass on the Wallet website.
     DOMString? walletEntityUrl;
-    // Whether the entity is read only.
-    boolean? isReadOnly;
   };
 
   // A Pay Over Time Issuer entry which can be displayed in the autofill

tools/under-control/src/chrome/common/extensions/api/enterprise_reporting_private.idl

@@ -0,0 +1,431 @@
+// Copyright 2018 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Private API for reporting Chrome browser status to admin console.
+namespace enterprise.reportingPrivate {
+
+  // Invoked by <code>UploadChromeDesktopReport</code> when the upload is
+  // finished.
+  // Also Invoked by <code>setDeviceData</code> when data is stored.
+  callback DoneCallback = void();
+
+  // Invoked by <code>getDeviceId</code> to return the ID.
+  callback GetDeviceIdCallback = void(DOMString id);
+
+  // Invoked by <code>getPersistentSecret</code> to return the secret.
+  callback GetPersistentSecretCallback = void(ArrayBuffer secret);
+
+  // Invoked by <code>getDeviceDataCallback</code> to return the device data.
+  callback GetDeviceDataCallback = void(ArrayBuffer data);
+
+  // Possible states a particular device setting can be in.
+  enum SettingValue { UNKNOWN, DISABLED, ENABLED };
+
+  // Device info fields returned by the getDeviceInfo API.
+  dictionary DeviceInfo {
+    DOMString osName;
+    DOMString osVersion;
+    DOMString deviceHostName;
+    DOMString deviceModel;
+    DOMString serialNumber;
+    SettingValue screenLockSecured;
+    SettingValue diskEncrypted;
+    DOMString[] macAddresses;
+    DOMString? windowsMachineDomain;
+    DOMString? windowsUserDomain;
+    DOMString securityPatchLevel;
+
+    // This value is only returned on Windows for now.
+    SettingValue? secureBootEnabled;
+  };
+
+  // Invoked by <code>getDeviceInfo</code> to return device information.
+  callback GetDeviceInfoCallback = void(DeviceInfo deviceInfo);
+
+  // Possible states for the EnterpriseRealTimeUrlCheckMode policy.
+  enum RealtimeUrlCheckMode { DISABLED, ENABLED_MAIN_FRAME };
+
+  // Possible states for the SafeBrowsingProtectionLevel policy.
+  enum SafeBrowsingLevel { DISABLED, STANDARD, ENHANCED };
+
+  // Possible states for the PasswordProtectionWarningTrigger policy
+  enum PasswordProtectionTrigger {
+    PASSWORD_PROTECTION_OFF,
+    PASSWORD_REUSE,
+    PHISHING_REUSE,
+    POLICY_UNSET
+  };
+
+  // Context info fields returned by the getContextInfo API.
+  dictionary ContextInfo {
+    DOMString[] browserAffiliationIds;
+    DOMString[] profileAffiliationIds;
+    DOMString[] onFileAttachedProviders;
+    DOMString[] onFileDownloadedProviders;
+    DOMString[] onBulkDataEntryProviders;
+    DOMString[] onPrintProviders;
+    RealtimeUrlCheckMode realtimeUrlCheckMode;
+    DOMString[] onSecurityEventProviders;
+    DOMString browserVersion;
+    SafeBrowsingLevel safeBrowsingProtectionLevel;
+    boolean siteIsolationEnabled;
+    boolean builtInDnsClientEnabled;
+    PasswordProtectionTrigger passwordProtectionWarningTrigger;
+    boolean chromeRemoteDesktopAppBlocked;
+    SettingValue osFirewall;
+    DOMString[] systemDnsServers;
+    DOMString? enterpriseProfileId;
+  };
+
+  // Invoked by <code>getContextInfo</code> to return context information.
+  callback GetContextInfoCallback = void(ContextInfo contextInfo);
+
+  // The status passed to the callback of <code>getCertificate</code> to
+  // indicate if the required policy is set.
+  enum CertificateStatus { OK, POLICY_UNSET };
+
+  // The certificate, if one meets the requirements, returned by the
+  // $(ref:getCertificate) API. <code>encodedCertificate</code> will be
+  // the DER encoding (binary encoding following X.690 Distinguished Encoding
+  // Rules) of the X.509 certificate.
+  dictionary Certificate {
+    CertificateStatus status;
+    ArrayBuffer? encodedCertificate;
+  };
+
+  // Invoked by <code>getCertificate</code> to return the selected certificate.
+  callback CertificateCallback = void(Certificate certificate);
+
+  // Captures the type of event so it can be associated with user or device in
+  // Chrome for reporting purposes
+  enum EventType { DEVICE, USER };
+
+  // Composite object that captures the information we need to report events.
+  // Some fields like the record and priority are serialized to avoid any
+  // dependency on proto definitions here, given the fact that they will likely
+  // change in the future. These will be deserialized and validated in Chrome.
+  dictionary EnqueueRecordRequest {
+    // Serialized record data binary based on the proto definition in
+    // //components/reporting/proto/synced/record.proto.
+    [instanceOf=Uint8Array] ArrayBufferView recordData;
+    // Serialized priority based on the proto definition in
+    // //components/reporting/proto/synced/record_constants.proto. Used to
+    // determine which records are shed first.
+    long priority;
+    EventType eventType;
+  };
+
+  // Context object containing the content-area user's ID for whom the signals
+  // collection request is for. This will be used to identify the organization
+  // in which the user is, and can then be used to determine their affiliation
+  // with the current browser management state.
+  dictionary UserContext {
+    DOMString userId;
+  };
+
+  // Enumeration of the various states an AntiVirus software product can be in.
+  enum AntiVirusProductState { ON, OFF, SNOOZED, EXPIRED };
+
+  // Metadata about a specific AntiVirus software product.
+  dictionary AntiVirusSignal {
+    DOMString displayName;
+    DOMString productId;
+    AntiVirusProductState state;
+  };
+
+  // Invoked by <code>getAvInfo</code> to return information about installed
+  // AntiVirus software.
+  callback AvInfoCallback = void(AntiVirusSignal[] avSignals);
+
+  // ID of an installed hotfix system update.
+  dictionary HotfixSignal {
+    DOMString hotfixId;
+  };
+
+  // Invoked by <code>getHotfixes</code> to return the IDs of installed hotfix
+  // system updates.
+  callback HotfixesCallback = void(HotfixSignal[] hotfixSignals);
+
+  // Used to indicate whether a given signal was correctly found or not, or
+  // indicate a reason for not being able to find it.
+  enum PresenceValue {
+    // Was unable to determine whether the signal source exists or not. This
+    // typically indicates that a failure occurred before even trying to assess
+    // its presence.
+    UNSPECIFIED,
+
+    // Current user does not have access to the signal's source.
+    ACCESS_DENIED,
+
+    // The resource was not found.
+    NOT_FOUND,
+
+    // The resource was found.
+    FOUND
+  };
+
+  // Parameter used to collect information about a specific file system
+  // resource.
+  dictionary GetFileSystemInfoOptions {
+    DOMString path;
+    boolean computeSha256;
+    boolean computeExecutableMetadata;
+  };
+
+  dictionary GetFileSystemInfoRequest {
+    // Information about the for whom the signal collection request is for.
+    UserContext userContext;
+
+    // Collection of parameters used to conduct signals collection about
+    // specific file system resources.
+    GetFileSystemInfoOptions[] options;
+  };
+
+  dictionary GetFileSystemInfoResponse {
+    // Path to the file system object for whom those signals were collected.
+    DOMString path;
+
+    // Value indicating whether the specific resource could be found or not.
+    PresenceValue presence;
+
+    // Sha256 hash of a file's bytes. Ignored when path points to a
+    // directory. Collected only when computeSha256 is set to true in the
+    // given signals collection parameters.
+    DOMString? sha256Hash;
+
+    // Set of properties only relevant for executable files. Will only be
+    // collected if computeExecutableMetadata is set to true in the given
+    // signals collection parameters and if path points to an executable file.
+
+    // Is true if a currently running process was spawned from this file.
+    boolean? isRunning;
+
+    // SHA-256 hashes of the public keys of the certificates used to sign the
+    // executable. A hash is computed over the DER-encoded SubjectPublicKeyInfo
+    // representation of the key.
+    DOMString[]? publicKeysHashes;
+
+    // Product name of this executable.
+    DOMString? productName;
+
+    // Version of this executable.
+    DOMString? version;
+  };
+
+  callback FileSystemInfoCallback =
+      void(GetFileSystemInfoResponse[] fileSystemSignals);
+
+  enum RegistryHive {
+    HKEY_CLASSES_ROOT,
+    HKEY_LOCAL_MACHINE,
+    HKEY_CURRENT_USER
+  };
+
+  dictionary GetSettingsOptions {
+    // Path to a collection of settings.
+    // On Windows it would be the path to the reg key inside the hive.
+    // On Mac it would be the path to the plist file.
+    DOMString path;
+
+    // Key specifying the setting entry we're looking for.
+    // On Windows, that will be the registry key itself.
+    // On Mac, this is a key path used to retrieve a value from
+    // valueForKeyPath:.
+    DOMString key;
+
+    // When set to true, the retrieved signal will also include the setting's
+    // value. When false, the signal will only contain the setting's
+    // presence.
+    // Supported setting types on Windows:
+    // - REG_SZ
+    // - REG_DWORD
+    // - REG_QWORD
+    // Supported setting types on Mac:
+    // - NSString
+    // - NSNumber
+    boolean getValue;
+
+    // Windows registry hive containing the desired value.
+    // Required value on Windows, will be ignored on other platforms.
+    RegistryHive? hive;
+  };
+
+  dictionary GetSettingsRequest {
+    // Information about the for whom the signal collection request is for.
+    UserContext userContext;
+
+    // Collection of parameters used to conduct signals collection about
+    // specific settings of the system.
+    GetSettingsOptions[] options;
+  };
+
+  dictionary GetSettingsResponse {
+    // Path as given in the corresponding <code>GetSettingsOptions</code>
+    // request.
+    DOMString path;
+
+    // Key as given in the corresponding <code>GetSettingsOptions</code>
+    // request.
+    DOMString key;
+
+    // Hive as given in the corresponding <code>GetSettingsOptions</code>
+    // request.
+    // Present on Windows only.
+    RegistryHive? hive;
+
+    // Value indicating whether the specific resource could be found or not.
+    PresenceValue presence;
+
+    // JSON-stringified value of the setting. Only set if <code>getValue</code>
+    // was true in the corresponding request, and if the setting value was
+    // retrievable.
+    DOMString? value;
+  };
+
+  callback SettingsCallback =
+      void(GetSettingsResponse[] settings);
+
+  // Indicates what resulted from an event sent through a `DataMaskingEvent`.
+  enum EventResult { EVENT_RESULT_DATA_MASKED, EVENT_RESULT_DATA_UNMASKED };
+
+  // Indicates the type of detector that was used match against data by the data
+  // masking extension.
+  enum DetectorType { PREDEFINED_DLP, USER_DEFINED };
+
+  // Information for a data detector used to apply data masking functionality.
+  // The fields of this dictionary correspond to the proto fields of
+  // `MatchedUrlNavigationRule::DataMaskingAction`.
+  dictionary MatchedDetector {
+    DOMString detectorId;
+    DOMString displayName;
+    DOMString? maskType;
+    DOMString? pattern;
+    DetectorType? detectorType;
+    DOMString? maskText;
+  };
+
+  // Information for a data leak prevention rule that was used to mask data.
+  dictionary TriggeredRuleInfo {
+    DOMString ruleId;
+    DOMString ruleName;
+    MatchedDetector[] matchedDetectors;
+  };
+
+  // Event representing that something happened in the data masking extension.
+  dictionary DataMaskingEvent {
+    DOMString url;
+    EventResult eventResult;
+    TriggeredRuleInfo[] triggeredRuleInfo;
+  };
+
+  interface Functions {
+    // Gets the identity of device that Chrome browser is running on. The ID is
+    // retrieved from the local device and used by the Google admin console.
+    [platforms = ("win", "mac", "linux")]
+    static void getDeviceId(optional GetDeviceIdCallback callback);
+
+    // Gets a randomly generated persistent secret (symmetric key) that
+    // can be used to encrypt the data stored with |setDeviceData|. If the
+    // optional parameter |forceCreation| is set to true the secret is recreated
+    // in case of any failure to retrieve the currently stored one. Sets
+    // $(ref:runtime.lastError) on failure.
+    [platforms = ("win", "mac")]
+    static void getPersistentSecret(
+        optional boolean resetSecret,
+        GetPersistentSecretCallback callback);
+
+    // Gets the device data for |id|. Sets $(ref:runtime.lastError) on failure.
+    [platforms = ("win", "mac", "linux")]
+    static void getDeviceData(DOMString id, GetDeviceDataCallback callback);
+
+    // Sets the device data for |id|. Sets $(ref:runtime.lastError) on failure.
+    // If the |data| parameter is undefined and there is already data
+    // associated with |id| it will be cleared.
+    [platforms = ("win", "mac", "linux")]
+    static void setDeviceData(
+        DOMString id,
+        optional ArrayBuffer data,
+        optional DoneCallback callback);
+
+    // Gets the device information (including disk encryption status,
+    // screen lock status, serial number, model).
+    [platforms = ("win", "mac", "linux")]
+    static void getDeviceInfo(GetDeviceInfoCallback callback);
+
+    // Gets the context information (including management status of the browser,
+    // state of key security policies, browser version).
+    static void getContextInfo(
+        GetContextInfoCallback callback);
+
+    // Returns the certificate that would be selected by the filters in the
+    // AutoSelectCertificateForUrls policy for <code>url</code>.
+    static void getCertificate(
+        DOMString url,
+        CertificateCallback callback);
+
+    // Enqueues a record for upload to the reporting service
+    // |request|: Composite object that captures everything
+    // we need for uploading records.
+    // |callback|: Callback that is triggered upon completion
+    [platforms = ("chromeos")]
+    static void enqueueRecord(
+        EnqueueRecordRequest request,
+        optional DoneCallback callback);
+
+    // Gets information about file system resources, specified by the contents
+    // of <code>request</code>, on the current device. <code>request</code> must
+    // hold a user context to be used to verify the affiliation between the
+    // user's organization and the organization managing the browser. If the
+    // management or affiliation states are not suitable, no results will be
+    // returned.
+    [platforms = ("win", "mac", "linux")]
+    static void getFileSystemInfo(
+        GetFileSystemInfoRequest request,
+        FileSystemInfoCallback callback);
+
+    // Gets information about system settings specified by the contents of
+    // <code>request</code>. <code>request</code> must hold a user context to be
+    // used to verify the affiliation between the user's organization and the
+    // organization managing the browser. If the management or affiliation
+    // states are not suitable, no results will be returned.
+    [platforms = ("win", "mac")]
+    static void getSettings(
+        GetSettingsRequest request,
+        SettingsCallback callback);
+
+    // Gets information about AntiVirus software installed on the current
+    // device. <code>userContext</code> is used to verify the affiliation
+    // between the user's organization and the organization managing the
+    // browser. If the management, or affiliation, state is not suitable, no
+    // results will be returned.
+    [platforms = ("win")]
+    static void getAvInfo(UserContext userContext, AvInfoCallback callback);
+
+    // Gets information about hotfix system updates installed on the current
+    // device. <code>userContext</code> is used to verify the affiliation
+    // between the user's organization and the organization managing the
+    // browser. If the management, or affiliation, state is not suitable, no
+    // results will be returned.
+    [platforms = ("win")]
+    static void getHotfixes(UserContext userContext, HotfixesCallback callback);
+
+    // Sends the passed `event` to the reporting service if the browser or
+    // profile is managed and the "OnSecurityEventEnterpriseConnector" policy is
+    // enabled.
+    static void reportDataMaskingEvent(DataMaskingEvent event,
+                                       DoneCallback callback);
+  };
+
+  dictionary DataMaskingRules {
+    // The URL being navigated to that triggered the rules.
+    DOMString url;
+
+    TriggeredRuleInfo[] triggeredRuleInfo;
+  };
+
+  interface Events {
+    static void onDataMaskingRulesTriggered(DataMaskingRules rules);
+  };
+
+};

tools/under-control/src/chrome/common/extensions/api/pdf_viewer_private.idl

@@ -123,35 +123,11 @@ namespace pdfViewerPrivate {
     boolean allowJavascript;
   };
 
-  // Represents SkTypeface.
-  dictionary Typeface {
-    // From SkTypeface::uniqueID()
-    long uniqueId;
-    // Serialized SkTypeface
-    ArrayBuffer serializedTypeface;
-  };
-
-  dictionary GetTextInfoResult {
-    Typeface[] typefaces;
-    // Serialized pdf::mojom::InkTextInfo
-    ArrayBuffer mojoTextInfo;
-  };
-
-  callback GetTextInfoCallback = void(GetTextInfoResult result);
   callback GetStreamInfoCallback = void(StreamInfo streamInfo);
   callback IsAllowedLocalFileAccessCallback = void(boolean result);
   callback VoidCallback = void();
 
   interface Functions {
-    // Calls blink::WebFormControlElement::GetTextInfo() on the `textarea` and
-    // returns the results. Additionally, skip serializing typefaces if their ID
-    // appears in `knownFontIds` in order to avoid the overhead of repeating the
-    // same typeface data.
-    [nocompile] static void getTextInfo(
-        [instanceOf=HTMLTextAreaElement] object textarea,
-        long[] knownFontIds,
-        GetTextInfoCallback callback);
-
     // Returns the StreamInfo for the stream for this context if there is one.
     static void getStreamInfo(
         GetStreamInfoCallback callback);

tools/under-control/src/chrome/common/extensions/api/platform_keys.idl

@@ -133,7 +133,7 @@ namespace platformKeys {
     // <p>Currently, this method only supports the "RSASSA-PKCS1-v1_5" and
     // "ECDSA" algorithms.</p>
     [nocompile, doesNotSupportPromises=
-        "Multi-parameter callback crbug.com/40221043"]
+        "Multi-parameter callback crbug.com/1313625"]
     static void getKeyPair(ArrayBuffer certificate,
                            object parameters,
                            GetKeyPairCallback callback);
@@ -158,7 +158,7 @@ namespace platformKeys {
     // hashing algorithms "none", "SHA-1", "SHA-256", "SHA-384", and
     // "SHA-512".</p>
     [nocompile, doesNotSupportPromises=
-        "Multi-parameter callback crbug.com/40221043"]
+        "Multi-parameter callback crbug.com/1313625"]
     static void getKeyPairBySpki(ArrayBuffer publicKeySpkiDer,
                                  object parameters,
                                  GetKeyPairCallback callback);

tools/under-control/src/chrome/common/extensions/api/platform_keys_internal.idl

@@ -37,7 +37,7 @@ namespace platformKeysInternal {
     //     If instead the algorithm name "none" is provided, no hashing will be
     //     applied, the data is PKCS#1 v1.5 padded but not hashed.
     //     TODO(pneubeck): use an enum once supported:
-    //         http://www.crbug.com/41115161 .
+    //         http://www.crbug.com/385539 .
     // |data| The data to sign.
     // |callback| Called back with the signature of |data|.
     // TODO: Instead of ArrayBuffer should be (ArrayBuffer or ArrayBufferView),
@@ -55,7 +55,7 @@ namespace platformKeysInternal {
     // <code>KeyAlgorithm</code> dictionary describing the key's algorithm. The
     // <code>name</code> property will equal <code>algorithmName</code>.
     // Otherwise, calls back with an error.
-    [doesNotSupportPromises="Multi-parameter callback crbug.com/40221043"]
+    [doesNotSupportPromises="Multi-parameter callback crbug.com/1313625"]
     static void getPublicKey(ArrayBuffer certificate,
                              DOMString algorithmName,
                              GetPublicKeyCallback callback);
@@ -67,7 +67,7 @@ namespace platformKeysInternal {
     // <code>KeyAlgorithm</code> dictionary describing the key's algorithm. The
     // <code>name</code> property will equal <code>algorithmName</code>.
     // Otherwise, calls back with an error.
-    [doesNotSupportPromises="Multi-parameter callback crbug.com/40221043"]
+    [doesNotSupportPromises="Multi-parameter callback crbug.com/1313625"]
     static void getPublicKeyBySpki(ArrayBuffer publicKeySpkiDer,
                                    DOMString algorithmName,
                                    GetPublicKeyCallback callback);

tools/under-control/src/chrome/common/extensions/api/scripting.idl

@@ -59,7 +59,7 @@ namespace scripting {
 
     // We used to call the injected function `function`, but this is
     // incompatible with JavaScript's object declaration shorthand (see
-    // https://crbug.com/40742098). We leave this silently in for backwards
+    // https://crbug.com/1166438). We leave this silently in for backwards
     // compatibility.
     // TODO(devlin): Remove this in M95.
     [nodoc, serializableFunction]InjectedFunction? function;

tools/under-control/src/chrome/common/extensions/api/tab_capture.idl

@@ -91,7 +91,7 @@ namespace tabCapture {
     //   <code>null</code>.  <code>null</code> indicates an error has occurred
     //   and the client may query $(ref:runtime.lastError) to access the error
     //   details.
-    [doesNotSupportPromises="Custom hook sets lastError crbug.com/40944873"]
+    [doesNotSupportPromises="Custom hook sets lastError crbug.com/1504349"]
     static void capture(CaptureOptions options,
                         GetTabMediaCallback callback);
 

tools/under-control/src/chrome/common/extensions/api/webrtc_audio_private.idl

@@ -0,0 +1,65 @@
+// Copyright 2013 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// The <code>chrome.webrtcAudioPrivate</code> API allows enumeration
+// of audio output (sink) devices.
+//
+// Note that device IDs as used in this API are opaque (i.e. they are
+// not the hardware identifier of the device) and while they are
+// unique and persistent across sessions, they are valid only to the
+// extension calling this API (i.e. they cannot be shared between
+// extensions).
+//
+// See this document for further details of this API:
+// https://docs.google.com/document/d/1un8aJoUvyt5jMUkK_hoeEJ4HRw-Nf8bA25hYUOpg_Oo/
+
+namespace webrtcAudioPrivate {
+
+  dictionary SinkInfo {
+    // The opaque identifier of the audio sink device, which is unique
+    // and static for the extension calling the API but invalid for
+    // others.
+    DOMString sinkId;
+    // The user-friendly name (e.g. "Bose Amplifier").
+    DOMString sinkLabel;
+    // Current sample rate of the device, in Hz. Useful e.g. to know
+    // if the remote side should be asked to send a lower sampling
+    // rate.
+    long sampleRate;
+    // True if the device is ready to play out audio. E.g. if it is a
+    // device that takes an audio jack, whether a jack is plugged in.
+    //
+    // TODO(joi): Do unplugged devices even get included in enumeration?
+    boolean isReady;
+    // True if this device is the default audio sink device on the
+    // machine.
+    boolean isDefault;
+  };
+
+  callback GetSinksCallback = void(SinkInfo[] sinkInfo);
+  callback SinkIdCallback = void(DOMString sinkId);
+
+  interface Functions {
+    // Retrieves a list of available audio sink devices.
+    static void getSinks(GetSinksCallback callback);
+
+    // Given a security origin and an input device ID valid for that
+    // security origin, retrieve an audio sink ID valid for the
+    // extension, or the empty string if there is no associated audio
+    // sink.
+    //
+    // The associated sink ID can be used as a sink ID for
+    // setActiveSink. It is valid irrespective of which process you are
+    // setting the active sink for.
+    static void getAssociatedSink(
+        DOMString securityOrigin,
+        DOMString sourceIdInOrigin,
+        SinkIdCallback callback);
+  };
+
+  interface Events {
+    // Fired when audio sink devices are added or removed.
+    static void onSinksChanged();
+  };
+};

tools/under-control/src/chrome/common/extensions/api/webrtc_desktop_capture_private.idl

@@ -23,7 +23,7 @@ namespace webrtcDesktopCapturePrivate {
 
   interface Functions {
     // Shows desktop media picker UI with the specified set of sources.
-    [doesNotSupportPromises="Synchronous return and callback crbug.com/40154924"]
+    [doesNotSupportPromises="Synchronous return and callback crbug.com/1143032"]
     static long chooseDesktopMedia(DesktopCaptureSourceType[] sources,
                                    RequestInfo request,
                                    chooseDesktopMediaCallback callback);

tools/under-control/src/chrome/common/extensions/api/webrtc_logging_private.idl

@@ -172,7 +172,7 @@ namespace webrtcLoggingPrivate {
     // Returns the directory entry for the "WebRTC Logs" directory. If the
     // directory doesn't exist yet, this will create it. If the directory
     // cannot be created, this call will fail with a runtime error.
-    [doesNotSupportPromises="Custom hook sets lastError crbug.com/40944873"]
+    [doesNotSupportPromises="Custom hook sets lastError crbug.com/1504349"]
     static void getLogsDirectory(GetLogsDirectoryCallback callback);
   };
 };

tools/under-control/src/chrome/renderer/chrome_content_renderer_client.cc

@@ -69,6 +69,7 @@
 #include "chrome/renderer/trusted_vault_encryption_keys_extension.h"
 #include "chrome/renderer/url_loader_throttle_provider_impl.h"
 #include "chrome/renderer/v8_unwinder.h"
+#include "chrome/renderer/web_link_preview_triggerer_impl.h"
 #include "chrome/renderer/websocket_handshake_throttle_provider_impl.h"
 #include "chrome/renderer/webui_browser/webui_browser_renderer_extension.h"
 #include "chrome/renderer/worker_content_settings_client.h"
@@ -118,8 +119,7 @@
 #include "components/subresource_filter/content/renderer/subresource_filter_agent.h"
 #include "components/subresource_filter/content/renderer/unverified_ruleset_dealer.h"
 #include "components/subresource_filter/core/common/common_features.h"
-#include "components/surface_embed/common/features.h"
-#include "components/surface_embed/renderer/create_plugin.h"
+#include "components/surface_embed/buildflags/buildflags.h"
 #include "components/variations/net/variations_http_headers.h"
 #include "components/variations/variations_switches.h"
 #include "components/version_info/version_info.h"
@@ -137,7 +137,6 @@
 #include "content/public/common/webplugininfo.h"
 #include "content/public/renderer/render_frame.h"
 #include "content/public/renderer/render_frame_visitor.h"
-#include "content/public/renderer/worker_thread.h"
 #include "extensions/buildflags/buildflags.h"
 #include "extensions/renderer/extensions_renderer_api_provider.h"
 #include "media/base/media_switches.h"
@@ -197,12 +196,11 @@
 #include "components/feed/content/renderer/rss_link_reader.h"
 #include "components/feed/feed_feature_list.h"
 #else
+#include "chrome/common/record_replay/record_replay_features.h"
 #include "chrome/renderer/indigo/indigo_agent.h"
-#include "chrome/renderer/indigo/onboarding_agent.h"
+#include "chrome/renderer/record_replay/record_replay_agent.h"
 #include "chrome/renderer/searchbox/searchbox.h"
 #include "chrome/renderer/searchbox/searchbox_extension.h"
-#include "components/record_replay/content/renderer/record_replay_agent.h"
-#include "components/record_replay/core/common/record_replay_features.h"
 #include "components/search/ntp_features.h"  // nogncheck
 #endif
 
@@ -262,6 +260,11 @@
 #endif  // BUILDFLAG(HAS_SPELLCHECK_PANEL)
 #endif  // BUILDFLAG(ENABLE_SPELLCHECK)
 
+#if BUILDFLAG(ENABLE_SURFACE_EMBED)
+#include "components/surface_embed/common/features.h"
+#include "components/surface_embed/renderer/create_plugin.h"
+#endif  // BUILDFLAG(ENABLE_SURFACE_EMBED)
+
 #if BUILDFLAG(ENABLE_LIBRARY_CDMS) || BUILDFLAG(IS_WIN) || BUILDFLAG(IS_ANDROID)
 #include "chrome/renderer/media/chrome_key_systems.h"
 #endif
@@ -476,16 +479,6 @@ void ChromeContentRendererClient::RenderThreadStarted() {
   WebSecurityPolicy::RegisterURLSchemeAsFirstPartyWhenTopLevelEmbeddingSecure(
       chrome_scheme);
 
-#if !BUILDFLAG(IS_ANDROID)
-  // TODO(crbug.com/483614998): Granting Lens side panel is a temporary
-  // exception to use SameSite cookies while it migrates to a <webview>
-  // approach. This should not be done for other untrusted WebUI.
-  blink::WebURL chrome_lens_url =
-      GURL(chrome::kChromeUILensUntrustedSidePanelURL);
-  WebSecurityPolicy::RegisterURLAsFirstPartyWhenTopLevelEmbeddingSecure(
-      chrome_lens_url);
-#endif
-
   // chrome-native: is a scheme used for placeholder navigations that allow
   // UIs to be drawn with platform native widgets instead of HTML.  These pages
   // should not be accessible.  No code should be runnable in these pages,
@@ -560,7 +553,7 @@ void ChromeContentRendererClient::RenderThreadStarted() {
 
 #if BUILDFLAG(IS_ANDROID)
   WebSecurityPolicy::RegisterURLSchemeAsAllowedForReferrer(
-      WebString::FromUtf8(content::kAndroidAppScheme));
+      WebString::FromUTF8(content::kAndroidAppScheme));
 #endif
 
   // chrome-search: pages should not be accessible by bookmarklets
@@ -714,7 +707,6 @@ void ChromeContentRendererClient::RenderFrameCreated(
     new record_replay::RecordReplayAgent(render_frame, associated_interfaces);
   }
   indigo::IndigoAgent::MaybeCreate(render_frame, associated_interfaces);
-  indigo::OnboardingAgent::MaybeCreate(render_frame, associated_interfaces);
 #endif
 
   if (content_capture::features::IsContentCaptureEnabled()) {
@@ -836,7 +828,9 @@ bool ChromeContentRendererClient::IsPluginHandledExternally(
   // not supported. Here it suffices to return false but there should perhaps be
   // a more unified approach to avoid sending the IPC twice.
   chrome::mojom::PluginInfoPtr plugin_info = chrome::mojom::PluginInfo::New();
-  plugin_info_host->GetPluginInfo(original_url, mime_type, &plugin_info);
+  plugin_info_host->GetPluginInfo(
+      original_url, render_frame->GetWebFrame()->Top()->GetSecurityOrigin(),
+      mime_type, &plugin_info);
   // TODO(ekaramad): Not continuing here due to a disallowed status should take
   // us to CreatePlugin. See if more in depths investigation of |status| is
   // necessary here (see https://crbug.com/41460326). For now, returning false
@@ -902,7 +896,7 @@ bool ChromeContentRendererClient::OverrideCreatePlugin(
     WebPlugin** plugin) {
   std::string orig_mime_type = params.mime_type.Utf8();
 
-#if !BUILDFLAG(IS_ANDROID)
+#if BUILDFLAG(ENABLE_SURFACE_EMBED)
   if (base::FeatureList::IsEnabled(surface_embed::features::kSurfaceEmbed)) {
     GURL url = render_frame->GetWebFrame()->GetDocument().Url();
     if (url.SchemeIs(content::kChromeUIScheme) &&
@@ -912,7 +906,7 @@ bool ChromeContentRendererClient::OverrideCreatePlugin(
       }
     }
   }
-#endif  // !BUILDFLAG(IS_ANDROID)
+#endif  // BUILDFLAG(ENABLE_SURFACE_EMBED)
 
 #if BUILDFLAG(ENABLE_EXTENSIONS)
   // Used for plugins.
@@ -929,7 +923,9 @@ bool ChromeContentRendererClient::OverrideCreatePlugin(
       &plugin_info_host);
 
   chrome::mojom::PluginInfoPtr plugin_info = chrome::mojom::PluginInfo::New();
-  plugin_info_host->GetPluginInfo(url, orig_mime_type, &plugin_info);
+  plugin_info_host->GetPluginInfo(
+      url, render_frame->GetWebFrame()->Top()->GetSecurityOrigin(),
+      orig_mime_type, &plugin_info);
   *plugin = CreatePlugin(render_frame, params, *plugin_info);
 #else  // !BUILDFLAG(ENABLE_PLUGINS)
   if (orig_mime_type == pdf::kPDFMimeType) {
@@ -1005,7 +1001,7 @@ WebPlugin* ChromeContentRendererClient::CreatePlugin(
       // actual mime type via ChromeViewHostMsg_GetPluginInfo. In that case
       // we should use what we know since WebpluginDelegateProxy does some
       // specific initializations based on this information.
-      params.mime_type = WebString::FromUtf8(actual_mime_type);
+      params.mime_type = WebString::FromUTF8(actual_mime_type);
     }
 
     auto* content_settings_agent =
@@ -1630,15 +1626,18 @@ void ChromeContentRendererClient::AppendContentSecurityPolicy(
 
   // Append a minimum CSP to ensure the extension can't relax the default
   // applied CSP through means like Service Worker.
-  const std::string* default_csp = extensions::CSPInfo::GetMinimumCSPToAppend(
-      *extension, gurl.GetPath(),
-      /*is_service_worker=*/content::WorkerThread::GetCurrentId() != 0);
+  const std::string* default_csp =
+      extensions::CSPInfo::GetMinimumCSPToAppend(*extension, gurl.GetPath());
   if (!default_csp)
     return;
 
-  csp->push_back({blink::WebString::FromUtf8(*default_csp),
+  csp->push_back({blink::WebString::FromUTF8(*default_csp),
                   network::mojom::ContentSecurityPolicyType::kEnforce,
                   network::mojom::ContentSecurityPolicySource::kHTTP});
 #endif
 }
 
+std::unique_ptr<blink::WebLinkPreviewTriggerer>
+ChromeContentRendererClient::CreateLinkPreviewTriggerer() {
+  return ::CreateWebLinkPreviewTriggerer();
+}

tools/under-control/src/components/policy/resources/templates/policies.yaml

@@ -1438,13 +1438,6 @@ policies:
   1437: KrispNoiseCancellationEnabled
   1438: AndroidEntraSsoEnabled
   1439: FindsSettings
-  1440: MetricsReportingLevel
-  1441: DeviceMetricsReportingLevel
-  1442: CpuPerformanceTierOverride
-  1443: ForceForegroundPriorityForUrls
-  1444: DataUrlInWebWorkerOpaqueOriginEnabled
-  1445: KioskPinchToZoomAllowed
-  1446: SecuritySignalsClientCertificatesSelectors
 
 atomic_groups:
   1: Homepage
@@ -1509,4 +1502,3 @@ atomic_groups:
   60: ProtectedContent
   61: LegacyCookieScopeSettings
   62: GeolocationSettings
-  63: SocketPoolSizeSettings

tools/under-control/src/components/policy/resources/templates/policy_definitions/CloudReporting/SecuritySignalsClientCertificatesSelectors.yaml

@@ -1,58 +0,0 @@
-caption: Automatically select client certificates matching filters for <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> security signal reports.
-desc: |-
-  Configures filters to select which client certificates are included in <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> security signal reports. These reports send browser and device posture information to <ph name="GOOGLE_WORKSPACE_PRODUCT_NAME">Google Workspace</ph>, which administrators can use to configure <ph name="GOOGLE_CONTEXT_AWARE_ACCESS">Context-Aware Access (CAA)</ph> rules.
-
-  This policy allows you to define filters based on client certificate attributes, such as the ISSUER and/or SUBJECT distinguished names. <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> will only include certificates in the signal reports if they match at least one of the filters specified.
-
-       Examples for the usage of the <ph name="SELECTOR_PLACEHOLDER">$SELECTOR</ph> section:
-
-        * When <ph name="SELECTOR_PLACEHOLDER">$SELECTOR</ph> is set to <ph name="SECURITY_SIGNALS_CLIENT_CERTIFICATE_SELECTORS_FILTER_EXAMPLE">{ "ISSUER": { "CN": "$ISSUER_CN" } }</ph>, only client certificates issued by a certificate with the CommonName <ph name="ISSUER_CN_PLACEHOLDER">$ISSUER_CN</ph> are selected.
-
-        * When <ph name="SELECTOR_PLACEHOLDER">$SELECTOR</ph> contains both the <ph name="ISSUER_STRING_VALUE">"ISSUER"</ph> and the <ph name="SUBJECT_STRING_VALUE">"SUBJECT"</ph> sections, only client certificates that satisfy both conditions are selected.
-
-        * When <ph name="SELECTOR_PLACEHOLDER">$SELECTOR</ph> contains a <ph name="SUBJECT_STRING_VALUE">"SUBJECT"</ph> section with the <ph name="FILTER_STRING_ORGANIZATION">"O"</ph> value, a certificate needs at least one organization matching the specified value to be selected.
-
-        * When <ph name="SELECTOR_PLACEHOLDER">$SELECTOR</ph> contains a <ph name="SUBJECT_STRING_VALUE">"SUBJECT"</ph> section with a <ph name="FILTER_STRING_ORGANIZATIONAL_UNIT">"OU"</ph> value, a certificate needs at least one organizational unit matching the specified value to be selected.
-
-        * When <ph name="SELECTOR_PLACEHOLDER">$SELECTOR</ph> is set to <ph name="EMPTY_DICTIONARY">{}</ph>, empty details are ignored for this policy.
-
-        Leaving the policy unset means there's no selection of client certificates during signal reporting.
-
-  *Important:* This policy only takes effect if the <ph name="USER_SECURITY_SIGNALS_REPORTING_POLICY_NAME">UserSecuritySignalsReporting</ph> policy is enabled, which controls the overall feature for sending security signals from Chrome.
-example_value:
-- ISSUER:
-    CN: "certificate issuer name"
-    L: "certificate issuer location"
-    O: "certificate issuer org"
-    OU: "certificate issuer org unit"
-  SUBJECT:
-    CN: "certificate subject name"
-    L: "certificate subject location"
-    O: "certificate subject org"
-    OU: "certificate subject org unit"
-- ISSUER:
-    CN: "another issuer name"
-features:
-  cloud_only: true
-  dynamic_refresh: true
-  per_profile: true
-  user_only: true
-
-future_on:
-- chrome.*
-owners:
-- hmare@google.com
-- file://components/enterprise/browser/reporting/OWNERS
-schema:
-  items:
-    properties:
-      ISSUER:
-        $ref: CertPrincipalFields
-      SUBJECT:
-        $ref: CertPrincipalFields
-    type: object
-  type: array
-tags:
-- admin-sharing
-- google-sharing
-type: dict

tools/under-control/src/components/policy/resources/templates/policy_definitions/GenerativeAI/GeminiSettings.yaml

@@ -15,6 +15,7 @@ owners:
 - file://components/policy/OWNERS
 example_value: 1
 future_on:
+- android
 - chrome.linux
 features:
   dynamic_refresh: true
@@ -38,5 +39,4 @@ supported_on:
 - chrome.mac:137-
 - ios:139-
 - chrome_os:144-
-- android:149-
 tags: []

tools/under-control/src/components/policy/resources/templates/policy_definitions/GenerativeAI/GenAILocalFoundationalModelSettings.yaml

@@ -7,13 +7,15 @@ desc: |-
 
   When the policy is set to Disabled (1), the model will not be downloaded, and the existing model (if already downloaded) will be deleted.
 
-  On desktop platforms, model downloading can also be disabled by setting <ph name="COMPONENT_UPDATES_ENABLED_POLICY_NAME">ComponentUpdatesEnabled</ph> to false.
+  On desktop platforms, model downloading can also be disabled by <ph name="COMPONENT_UPDATES_ENABLED_POLICY_NAME">ComponentUpdatesEnabled</ph>.
 
 default: 0
 example_value: 1
 features:
   dynamic_refresh: true
   per_profile: false
+future_on:
+- chrome_os
 items:
 - caption: Downloads model automatically
   name: Allowed
@@ -32,5 +34,4 @@ tags: []
 supported_on:
 - android:142-
 - chrome.*:124-
-- chrome_os:149-
 type: int-enum

tools/under-control/src/components/policy/resources/templates/policy_definitions/HTTPAuthentication/AllHttpAuthSchemesAllowedForOrigins.yaml

@@ -3,12 +3,9 @@ desc: |-
   Setting the policy specifies for which origins to allow all the HTTP authentication schemes <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> supports regardless of the <ph name="AUTH_SCHEMES_POLICY_NAME">AuthSchemes</ph> policy.
 
         Format the origin pattern according to this format (<ph name="URL_SCHEME_FORMAT_LINK">https://support.google.com/chrome/a?p=url_blocklist_filter_format</ph>). Up to 1,000 exceptions can be defined in <ph name="ALL_HTTP_AUTH_ALLOWED_FOR_ORIGINS_POLICY_NAME">AllHttpAuthSchemesAllowedForOrigins</ph>.
-        Wildcards are allowed for the host component (e.g., '*:8000' matches all hosts on port 8000). To match all schemes or all ports, omit the component entirely (e.g., 'example.com' matches any scheme and any port). A hostname (e.g., 'example.com') also matches its subdomains. To match a host exactly and exclude its subdomains, prepend it with a dot (e.g., '.example.com'). To match all origins, use a single asterisk ('*').
+        Wildcards are allowed for the whole origin or parts of the origin, either the scheme, host, port.
 example_value:
-- 'https://example.com'
-- 'example.com'
-- '*:8000'
-- '*'
+- '*.example.com'
 features:
   dynamic_refresh: true
   per_profile: false

tools/under-control/src/components/policy/resources/templates/policy_definitions/Kiosk/KioskPinchToZoomAllowed.yaml

@@ -1,24 +0,0 @@
-caption: Allow pinch-to-zoom in Kiosk mode
-default: true
-desc: |-
-  Setting the policy to Enabled or leaving it unset means pinch-to-zoom is allowed in a Kiosk session.
-
-  Setting the policy to Disabled means pinch-to-zoom is not allowed in a Kiosk session.
-example_value: false
-features:
-  dynamic_refresh: true
-  per_profile: true
-items:
-- caption: Allow pinch-to-zoom in Kiosk mode
-  value: true
-- caption: Disable pinch-to-zoom in Kiosk mode
-  value: false
-owners:
-- poromov@google.com
-- file://chromeos/components/kiosk/OWNERS
-schema:
-  type: boolean
-supported_on:
-- chrome_os:149-
-tags: []
-type: main

tools/under-control/src/components/policy/resources/templates/policy_definitions/Miscellaneous/AdsSettingForIntrusiveAdsSites.yaml

@@ -28,6 +28,5 @@ schema:
 supported_on:
 - chrome.*:65-
 - chrome_os:65-
-- android:149-
 tags: []
 type: int-enum

tools/under-control/src/components/policy/resources/templates/policy_definitions/Miscellaneous/CpuPerformanceTierOverride.yaml

@@ -1,37 +0,0 @@
-caption: Override for the CPU performance tier
-desc: |-
-  Setting this policy allows enterprises to override the value returned by the
-  <ph name="CPU_PERFORMANCE_API_NAME">CPU Performance API</ph> (i.e.,
-  <ph name="CPU_PERFORMANCE_GETTER_NAME">navigator.cpuPerformance</ph>,
-  please see https://github.com/WICG/cpu-performance for details).
-
-  If this policy is set, the value of
-  <ph name="CPU_PERFORMANCE_GETTER_NAME">navigator.cpuPerformance</ph>
-  will be overridden to the specified value. If the policy is not set, then
-  the default performance tier calculation is used.
-
-  The possible values for this policy are 0 to 4.
-
-example_value: 4
-
-features:
-  dynamic_refresh: true
-  per_profile: true
-
-owners:
-- nikolaos@chromium.org
-- file://content/browser/cpu_performance/OWNERS
-
-schema:
-  maximum: 4
-  minimum: 0
-  type: integer
-
-supported_on:
-- chrome.*:149-
-- chrome_os:149-
-- android:149-
-- webview_android:149-
-
-tags: []
-type: int

tools/under-control/src/components/policy/resources/templates/policy_definitions/Miscellaneous/DataUrlInWebWorkerOpaqueOriginEnabled.yaml

@@ -1,33 +0,0 @@
-caption: 'Enable opaque origins for data URLs in Web Workers'
-desc: |-
-  Controls whether Web Workers created from data URLs are assigned a unique opaque origin.
-
-  Web Workers can be created using a data URL containing the worker's script. Previously, these workers inherited the origin of the page that created them, allowing them to access the same local storage, cookies, and other origin-bound data. To improve security and align with the HTML specification, Chrome is changing its default behavior in milestone 149 so that workers created from data URLs will now have a unique, opaque origin. This isolates them from the creator page's data.
-
-  If this policy is set to Enabled or left unset, the new default (more secure) behavior is used, and Web Workers created from data URLs will have a unique opaque origin.
-
-  If this policy is set to Disabled, Chrome reverts to the legacy behavior, and Web Workers created from data URLs will inherit the origin of their creator. This allows administrators to temporarily resolve compatibility issues if internal applications break due to the security change.
-
-  This policy is intended to be temporary and will be removed in milestone 157.
-default: true
-example_value: false
-features:
-  dynamic_refresh: true
-  per_profile: true
-items:
-- caption: 'Opaque origins for data URLs in Web Workers are enabled (new default behavior)'
-  value: true
-- caption: 'Opaque origins for data URLs in Web Workers are disabled (deprecated legacy behavior)'
-  value: false
-owners:
-- yyanagisawa@chromium.org
-- file://content/browser/worker_host/OWNERS
-schema:
-  type: boolean
-supported_on:
-- android:149-
-- chrome.*:149-
-- chrome_os:149-
-- fuchsia:149-
-tags: []
-type: main

tools/under-control/src/components/policy/resources/templates/policy_definitions/Miscellaneous/DeviceSwitchFunctionKeysBehaviorEnabled.yaml

@@ -29,7 +29,7 @@ items:
     launcher/search key to change the behavior of function keys".
   value: null
 owners:
-- longbowei@google.com
+- cambickel@google.com
 - cros-device-enablement@google.com
 schema:
   type: boolean

tools/under-control/src/components/policy/resources/templates/policy_definitions/Miscellaneous/ForceForegroundPriorityForUrls.yaml

@@ -1,32 +0,0 @@
-caption: Force foreground priority for specific URLs
-desc: |-
-  This policy allows you to specify a list of URL patterns. Background web content matching these patterns will be forced to run at foreground priority.
-
-  If the <ph name="FORCE_FOREGROUND_PRIORITY_FOR_ALL_TABS_POLICY_NAME">ForceForegroundPriorityForAllTabs</ph> policy is enabled, this list is ignored as all tabs will be forced to foreground priority.
-
-  If <ph name="FORCE_FOREGROUND_PRIORITY_FOR_ALL_TABS_POLICY_NAME">ForceForegroundPriorityForAllTabs</ph> is disabled or unset, only content matching the patterns in this list will be forced.
-
-  For detailed information on valid <ph name="URL_LABEL">URL</ph> patterns, please see https://support.google.com/chrome/a?p=url_blocklist_filter_format.
-
-  If this list is empty or not set, no background content is forced to foreground priority.
-example_value:
-- https://www.example.com/path?query=val
-- 'example.edu'
-- https://example.com:8080
-- '*://example.org:*/'
-features:
-  dynamic_refresh: true
-  per_profile: true
-owners:
-- pmonette@chromium.org
-- zmin@chromium.org
-- file://components/performance_manager/OWNERS
-schema:
-  items:
-    type: string
-  type: array
-supported_on:
-- chrome.*:149-
-- chrome_os:149-
-tags: []
-type: list

tools/under-control/src/components/policy/resources/templates/policy_definitions/Miscellaneous/MaxConnectionsPerProxy.yaml

@@ -1,23 +1,23 @@
 caption: Maximal number of concurrent connections per proxy server for non-WebSocket requests
-default: 128
+default: 32
 desc: |-
   Setting the policy specifies the maximal number of simultaneous connections per proxy server for non-WebSocket requests.
 
   To modify WebSocket request limits, see <ph name="MAX_CONNECTIONS_PER_PROXY_FOR_WEBSOCKET_POLICY_NAME">MaxConnectionsPerProxyForWebSocket</ph>.
 
-  Leaving the policy unset means a default of 128 is used.
+  Leaving the policy unset means a default of 32 is used.
 
-  Some web apps are known to consume many connections with hanging GETs, so setting a value below 128 may lead to browser networking hangs if there are too many web apps with hanging connections open.
+  Some web apps are known to consume many connections with hanging GETs, so setting a value below 32 may lead to browser networking hangs if there are too many web apps with hanging connections open.
   Some proxy servers can't handle a high number of concurrent connections per client, which is solved by setting this policy to a lower value.
 
   The value should be equal to or higher than 6.
   Setting a value below that limit will cause 6 to be used.
-  Lower below the default (128) at your own risk.
+  Lower below the default (32) at your own risk.
 
   The value should be equal to or lower than 256 (99 in <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> 147 and earlier).
   Setting a value above that limit will cause 256 (99 in <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> 147 and earlier) to be used.
-  Raise above the default (128) at your own risk.
-example_value: 128
+  Raise above the default (32) at your own risk.
+example_value: 32
 features:
   dynamic_refresh: false
   per_profile: false

tools/under-control/src/components/policy/resources/templates/policy_definitions/Miscellaneous/MaxConnectionsPerProxyForWebSocket.yaml

@@ -1,23 +1,23 @@
 caption: Maximal number of concurrent connections per proxy server for WebSocket requests
-default: 128
+default: 32
 desc: |-
   Setting the policy specifies the maximal number of simultaneous connections per proxy server for WebSocket requests.
 
   To modify non-WebSocket request limits, see <ph name="MAX_CONNECTIONS_PER_PROXY_POLICY_NAME">MaxConnectionsPerProxy</ph>.
 
-  Leaving the policy unset means a default of 128 is used.
+  Leaving the policy unset means a default of 32 is used.
 
-  Some web apps are known to consume many connections with hanging GETs, so setting a value below 128 may lead to browser networking hangs if there are too many web apps with hanging connections open.
+  Some web apps are known to consume many connections with hanging GETs, so setting a value below 32 may lead to browser networking hangs if there are too many web apps with hanging connections open.
   Some proxy servers can't handle a high number of concurrent connections per client, which is solved by setting this policy to a lower value.
 
   The value should be equal to or higher than 6.
   Setting a value below that limit will cause 6 to be used.
-  Lower below the default (128) at your own risk.
+  Lower below the default (32) at your own risk.
 
   The value should be equal to or lower than 256.
   Setting a value above that limit will cause 256 to be used.
-  Raise above the default (128) at your own risk.
-example_value: 128
+  Raise above the default (32) at your own risk.
+example_value: 32
 features:
   dynamic_refresh: false
   per_profile: false

tools/under-control/src/components/policy/resources/templates/policy_definitions/Miscellaneous/MetricsReportingEnabled.yaml

@@ -8,8 +8,6 @@ desc: |-
   When this policy is not set, users can choose the anonymous reporting behavior at installation or first run, and can change this setting later.
 
   (For <ph name="PRODUCT_OS_NAME">$2<ex>Google ChromeOS</ex></ph>, see <ph name="DEVICE_METRICS_REPORTING_ENABLED_POLICY_NAME">DeviceMetricsReportingEnabled</ph>.)
-
-  If the <ph name="RESTRUCTURE_METRICS_CONSENT_SETTINGS_EXPERIMENT_NAME">RestructureMetricsConsentSettings</ph> experiment is active on the device and both this policy and the <ph name="METRICS_REPORTING_LEVEL_POLICY_NAME">MetricsReportingLevel</ph> policy are set, the <ph name="METRICS_REPORTING_LEVEL_POLICY_NAME">MetricsReportingLevel</ph> policy takes precedence.
 example_value: true
 features:
   can_be_recommended: true

tools/under-control/src/components/policy/resources/templates/policy_definitions/Miscellaneous/MetricsReportingLevel.yaml

@@ -1,47 +0,0 @@
-caption: Metrics reporting level
-default: null
-desc: |-
-  Specifies the level of metrics reporting for <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph>.
-
-  When this policy is set, it determines how much usage and crash-related data is reported to Google:
-  * 0 = Disable reporting: No usage or crash-related data is sent to Google.
-  * 1 = Basic reporting: A limited set of usage and crash-related data is sent to Google.
-  * 2 = Advanced reporting: A comprehensive set of usage and crash-related data is sent to Google.
-
-  If this policy is left not set, the user can choose the metrics reporting behavior at installation or first run, and can change this setting later.
-
-  This policy is only evaluated if the <ph name="RESTRUCTURE_METRICS_CONSENT_SETTINGS_EXPERIMENT_NAME">RestructureMetricsConsentSettings</ph> experiment is active on the device.
-
-  If the <ph name="RESTRUCTURE_METRICS_CONSENT_SETTINGS_EXPERIMENT_NAME">RestructureMetricsConsentSettings</ph> experiment is active on the device and both this policy and the <ph name="METRICS_REPORTING_ENABLED_POLICY_NAME">MetricsReportingEnabled</ph> policy are set, this policy takes precedence.
-example_value: 1
-features:
-  can_be_recommended: true
-  dynamic_refresh: true
-  per_profile: false
-future_on:
-- chrome.*
-- android
-- ios
-items:
-- caption: Disable reporting
-  name: None
-  value: 0
-- caption: Basic reporting
-  name: Basic
-  value: 1
-- caption: Advanced reporting
-  name: Advanced
-  value: 2
-owners:
-- file://components/policy/OWNERS
-- heychirag@google.com
-schema:
-  enum:
-  - 0
-  - 1
-  - 2
-  type: integer
-sensitive: false
-tags:
-- google-sharing
-type: int-enum

tools/under-control/src/components/policy/resources/templates/policy_definitions/Miscellaneous/policy_atomic_groups.yaml

@@ -1,5 +0,0 @@
-SocketPoolSizeSettings:
-  caption: Socket pool size settings
-  policies:
-  - MaxConnectionsPerProxy
-  - MaxConnectionsPerProxyForWebSocket

tools/under-control/src/components/policy/resources/templates/policy_definitions/PrivacySandbox/PrivacySandboxAdMeasurementEnabled.yaml

@@ -7,6 +7,8 @@ desc: |-
   If you set this policy to Disabled, then the Ad measurement setting will be turned off for your users.
   If you set this policy to Enabled or keep it unset, your users will be able to turn on or off the <ph name="PRIVACY_SANDBOX_NAME">Privacy Sandbox</ph> Ad measurement setting on their device.
 
+  Setting this policy requires setting the <ph name="PRIVACY_SANDBOX_PROMPT_ENABLED_POLICY_NAME">PrivacySandboxPromptEnabled</ph> policy to Disabled.
+
   This policy is deprecated as of <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> version 144 with the deprecation of the Attribution Reporting API.
 example_value: false
 features:

tools/under-control/src/components/policy/resources/templates/policy_definitions/PrivacySandbox/PrivacySandboxAdTopicsEnabled.yaml

@@ -7,6 +7,8 @@ desc: |-
   If you set this policy to Disabled, then the Ad topics setting will be turned off for your users.
   If you set this policy to Enabled or keep it unset, your users will be able to turn on or off the <ph name="PRIVACY_SANDBOX_NAME">Privacy Sandbox</ph> Ad topics setting on their device.
 
+  Setting this policy requires setting the <ph name="PRIVACY_SANDBOX_PROMPT_ENABLED_POLICY_NAME">PrivacySandboxPromptEnabled</ph> policy to Disabled.
+
   This policy is deprecated as of <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> version 144 with the deprecation of Topics API.
 example_value: false
 features:

tools/under-control/src/components/policy/resources/templates/policy_definitions/PrivacySandbox/PrivacySandboxPromptEnabled.yaml

@@ -1,9 +1,6 @@
 caption: Choose whether the <ph name="PRIVACY_SANDBOX_NAME">Privacy Sandbox</ph> prompt can be shown to your users
 default: true
-deprecated: true
 desc: |-
-  This policy is deprecated because the <ph name="PRIVACY_SANDBOX_NAME">Privacy Sandbox</ph> prompt configuration is no longer supported.
-
   A policy to control whether your users see the <ph name="PRIVACY_SANDBOX_NAME">Privacy Sandbox</ph> prompt.
   The prompt is a user-blocking flow which informs your users of the <ph name="PRIVACY_SANDBOX_NAME">Privacy Sandbox</ph> settings. See <ph name="PRIVACY_SANDBOX_URL">https://privacysandbox.com</ph> for details about Chrome’s effort to deprecate third-party cookies.
 
@@ -30,7 +27,6 @@ owners:
 - file://components/privacy_sandbox/OWNERS
 schema:
   type: boolean
-# TODO(crbug.com/474716334): Remove support after M149 branches.
 supported_on:
  - chrome.*:111-
  - chrome_os:111-

tools/under-control/src/components/policy/resources/templates/policy_definitions/PrivacySandbox/PrivacySandboxSiteEnabledAdsEnabled.yaml

@@ -7,6 +7,8 @@ desc: |-
   If you set this policy to Disabled, then the Site-suggested ads setting will be turned off for your users.
   If you set this policy to Enabled or keep it unset, your users will be able to turn on or off the <ph name="PRIVACY_SANDBOX_NAME">Privacy Sandbox</ph> Site-suggested ads setting on their device.
 
+  Setting this policy requires setting the <ph name="PRIVACY_SANDBOX_PROMPT_ENABLED_POLICY_NAME">PrivacySandboxPromptEnabled</ph> policy to Disabled.
+
   This policy is deprecated as of <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> version 144 with the deprecation of the Protected Audience API.
 example_value: false
 features:

tools/under-control/src/components/policy/resources/templates/policy_definitions/PrivacySandbox/policy_atomic_groups.yaml

@@ -1,6 +1,7 @@
 PrivacySandbox:
   caption: Privacy sandbox settings controls
   policies:
+  - PrivacySandboxPromptEnabled
   - PrivacySandboxAdTopicsEnabled
   - PrivacySandboxSiteEnabledAdsEnabled
   - PrivacySandboxAdMeasurementEnabled

tools/under-control/src/components/policy/resources/templates/policy_definitions/Signin/AndroidEntraSsoEnabled.yaml

@@ -13,8 +13,8 @@ example_value: 1
 features:
   dynamic_refresh: true
   per_profile: false
-supported_on:
-- android:149-
+future_on:
+  - android
 items:
 - caption: Disable Microsoft® cloud authentication
   name: Disabled

tools/under-control/src/components/policy/resources/templates/policy_definitions/UserAndDeviceReporting/DeviceMetricsReportingEnabled.yaml

@@ -6,8 +6,6 @@ desc: |-
   For managed devices, this policy is enabled by default and sends metrics to Google.
 
   For unmanaged devices, the user can make the decision to send the metrics when the policy is unset.
-
-  If the <ph name="RESTRUCTURE_METRICS_CONSENT_SETTINGS_EXPERIMENT_NAME">RestructureMetricsConsentSettings</ph> experiment is active on the device and both this policy and the <ph name="DEVICE_METRICS_REPORTING_LEVEL_POLICY_NAME">DeviceMetricsReportingLevel</ph> policy are set, the <ph name="DEVICE_METRICS_REPORTING_LEVEL_POLICY_NAME">DeviceMetricsReportingLevel</ph> policy takes precedence.
 default: null
 device_only: true
 example_value: true

tools/under-control/src/components/policy/resources/templates/policy_definitions/UserAndDeviceReporting/DeviceMetricsReportingLevel.yaml

@@ -1,46 +0,0 @@
-arc_support: This policy also controls Android usage and diagnostic data collection.
-caption: Device metrics reporting level
-default: null
-desc: |-
-  Specifies the level of metrics reporting for <ph name="PRODUCT_OS_NAME">$2<ex>Google ChromeOS</ex></ph>.
-
-  When this policy is set, it determines how much usage and crash-related data is reported to Google:
-  * 0 = Disable reporting: No usage or crash-related data is sent to Google.
-  * 1 = Basic reporting: A limited set of usage and crash-related data is sent to Google.
-  * 2 = Advanced reporting: A comprehensive set of usage and crash-related data is sent to Google.
-
-  If this policy is left not set, the user can choose the metrics reporting behavior at installation or first run, and can change this setting later.
-
-  This policy is only evaluated if the <ph name="RESTRUCTURE_METRICS_CONSENT_SETTINGS_EXPERIMENT_NAME">RestructureMetricsConsentSettings</ph> experiment is active on the device.
-
-  If the <ph name="RESTRUCTURE_METRICS_CONSENT_SETTINGS_EXPERIMENT_NAME">RestructureMetricsConsentSettings</ph> experiment is active on the device and both this policy and the <ph name="DEVICE_METRICS_REPORTING_ENABLED_POLICY_NAME">DeviceMetricsReportingEnabled</ph> policy are set, this policy takes precedence.
-device_only: true
-example_value: 1
-features:
-  dynamic_refresh: true
-future_on:
-- chrome_os
-items:
-- caption: Disable reporting
-  name: None
-  value: 0
-- caption: Basic reporting
-  name: Basic
-  value: 1
-- caption: Advanced reporting
-  name: Advanced
-  value: 2
-owners:
-- file://components/policy/OWNERS
-- heychirag@google.com
-schema:
-  enum:
-  - 0
-  - 1
-  - 2
-  type: integer
-tags:
-- admin-sharing
-- google-sharing
-type: int-enum
-generate_device_proto: true

tools/under-control/src/content/browser/web_contents/web_contents_impl.cc

@@ -128,7 +128,6 @@
 #include "content/browser/screen_orientation/screen_orientation_provider.h"
 #include "content/browser/shared_storage/shared_storage_budget_charger.h"
 #include "content/browser/site_instance_impl.h"
-#include "content/browser/surface_embed/surface_embed_connector_impl.h"
 #include "content/browser/wake_lock/wake_lock_context_host.h"
 #include "content/browser/web_contents/file_chooser_impl.h"
 #include "content/browser/web_contents/java_script_dialog_commit_deferring_condition.h"
@@ -162,6 +161,7 @@
 #include "content/public/browser/permission_descriptor_util.h"
 #include "content/public/browser/picture_in_picture_window_controller.h"
 #include "content/public/browser/preload_pipeline_info.h"
+#include "content/public/browser/preview_cancel_reason.h"
 #include "content/public/browser/render_widget_host_iterator.h"
 #include "content/public/browser/render_widget_host_observer.h"
 #include "content/public/browser/restore_type.h"
@@ -172,8 +172,6 @@
 #include "content/public/browser/web_contents_delegate.h"
 #include "content/public/browser/web_contents_view_delegate.h"
 #include "content/public/browser/web_ui_controller.h"
-#include "content/public/browser/webid/federated_embedder_login_request.h"
-#include "content/public/browser/webid/identity_credential_source.h"
 #include "content/public/browser/webui_config.h"
 #include "content/public/browser/webui_config_map.h"
 #include "content/public/common/content_client.h"
@@ -281,6 +279,10 @@
 #include "content/browser/ios/nfc_host.h"
 #endif
 
+#if BUILDFLAG(ENABLE_SURFACE_EMBED)
+#include "content/browser/surface_embed/surface_embed_connector_impl.h"
+#endif  // BUILDFLAG(ENABLE_SURFACE_EMBED)
+
 namespace content {
 
 namespace {
@@ -467,6 +469,27 @@ base::flat_set<raw_ptr<WebContentsImpl>> GetAllOpeningWebContents(
   return result;
 }
 
+#if BUILDFLAG(IS_ANDROID)
+float GetDeviceScaleAdjustment(int min_width) {
+  static const float kMinFSM = 1.05f;
+  static const int kWidthForMinFSM = 320;
+  static const float kMaxFSM = 1.3f;
+  static const int kWidthForMaxFSM = 800;
+
+  if (min_width <= kWidthForMinFSM) {
+    return kMinFSM;
+  }
+  if (min_width >= kWidthForMaxFSM) {
+    return kMaxFSM;
+  }
+
+  // The font scale multiplier varies linearly between kMinFSM and kMaxFSM.
+  float ratio = static_cast<float>(min_width - kWidthForMinFSM) /
+                (kWidthForMaxFSM - kWidthForMinFSM);
+  return ratio * (kMaxFSM - kMinFSM) + kMinFSM;
+}
+#endif
+
 // Store a set of fullscreen WebContents and metadata for the browser context.
 // Storing this information on the browser context is done for two reasons. One,
 // related WebContentses must necessarily share a browser context, so this saves
@@ -1120,14 +1143,6 @@ void WebContentsImpl::WebContentsTreeNode::OnFrameTreeNodeDestroyed(
   }
 }
 
-void WebContentsImpl::NotifySwappedRWHVChildFrameFromRenderManager(
-    RenderWidgetHostViewChildFrame* new_view,
-    bool allow_paint_holding) {
-  if (surface_embed_connector_) {
-    surface_embed_connector_->SetView(new_view, allow_paint_holding);
-  }
-}
-
 FrameTree* WebContentsImpl::WebContentsTreeNode::focused_frame_tree() {
   CHECK(focused_frame_tree_);
   return focused_frame_tree_;
@@ -1335,7 +1350,8 @@ WebContentsImpl::WebContentsImpl(BrowserContext* browser_context)
       showing_context_menu_(false),
       prerender_host_registry_(std::make_unique<PrerenderHostRegistry>(*this)),
       compositor_frame_sink_grouping_id_(base::UnguessableToken::Create()),
-      tracing_track_(content::GetWebContentsTracingTrack(web_contents_token_)) {
+      fenced_frame_viewport_observer_(
+          std::make_unique<FencedFrameViewportObserver>(this)) {
   TRACE_EVENT0("content", "WebContentsImpl::WebContentsImpl");
   WebContentsOfBrowserContext::Attach(*this);
   node_.SetFocusedFrameTree(&primary_frame_tree_);
@@ -1407,9 +1423,11 @@ WebContentsImpl::~WebContentsImpl() {
     GetOuterWebContents()->DetachUnownedInnerWebContents(this);
   }
 
+#if BUILDFLAG(ENABLE_SURFACE_EMBED)
   if (surface_embed_connector_) {
     ClearSurfaceEmbedConnector();
   }
+#endif  // BUILDFLAG(ENABLE_SURFACE_EMBED)
 
   if (pointer_lock_widget_) {
     pointer_lock_widget_->RejectPointerLockOrUnlockIfNecessary(
@@ -1676,14 +1694,6 @@ base::WeakPtr<WebContents> WebContentsImpl::GetWeakPtr() {
   return weak_factory_.GetWeakPtr();
 }
 
-const WebContents::UniqueToken& WebContentsImpl::GetUniqueToken() const {
-  return web_contents_token_;
-}
-
-const perfetto::NamedTrack& WebContentsImpl::GetTracingTrack() const {
-  return *tracing_track_;
-}
-
 const GURL& WebContentsImpl::GetURL() {
   return GetVisibleURL();
 }
@@ -2192,24 +2202,6 @@ void WebContentsImpl::DidCapturedSurfaceControl() {
   observers_.NotifyObservers(&WebContentsObserver::OnCapturedSurfaceControl);
 }
 
-void WebContentsImpl::OnFedCmFederatedLogin(
-    webid::FederatedLoginResult result) {
-  observers_.NotifyObservers(&WebContentsObserver::OnFedCmFederatedLogin,
-                             result == webid::FederatedLoginResult::kSuccess);
-
-  // OnFedCmFederatedLogin() may be invoked while the WebContents is being
-  // destroyed, so be careful when trying to access the Page.
-  if (IsBeingDestroyed()) {
-    return;
-  }
-
-  webid::FederatedEmbedderLoginRequest* embedder_login_request =
-      webid::FederatedEmbedderLoginRequest::Get(this);
-  if (embedder_login_request) {
-    embedder_login_request->OnFederatedResultReceived(result);
-  }
-}
-
 void WebContentsImpl::ResetAccessibility() {
   // Reset accessibility for all frames in this tree and inner trees, including
   // speculative frame hosts and those in the back-forward cache. See comment in
@@ -2709,6 +2701,12 @@ base::ScopedClosureRunner WebContentsImpl::IncrementCapturerCount(
       stay_hidden, stay_awake, is_activity));
 }
 
+const blink::mojom::CaptureHandleConfig&
+WebContentsImpl::GetCaptureHandleConfig() {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+  return capture_handle_config_;
+}
+
 bool WebContentsImpl::IsBeingCaptured() {
   return visible_capturer_count_ + hidden_capturer_count_ > 0;
 }
@@ -3465,6 +3463,7 @@ void WebContentsImpl::DetachUnownedInnerWebContents(
   inner_main_frame->UpdateAXTreeData();
 }
 
+#if BUILDFLAG(ENABLE_SURFACE_EMBED)
 SurfaceEmbedConnector* WebContentsImpl::GetSurfaceEmbedConnector() const {
   return surface_embed_connector_.get();
 }
@@ -3523,20 +3522,11 @@ void WebContentsImpl::SetSurfaceEmbedConnector(
   }
 
   RecursivelyRegisterRenderWidgetHostViews();
-
-  surface_embed_connector_->UpdateViewForCurrentRenderFrameHost();
 }
 
 void WebContentsImpl::ClearSurfaceEmbedConnector() {
   CHECK(surface_embed_connector_);
 
-  // Because there may be child frames, we need to unregister all RWHVs before
-  // destroying main frames views which could prevent child frames from finding
-  // the root view for unregistering observer from
-  // TouchSelectionControllerClient, and before clearing the connector, which
-  // will change the TextInputManager and InputEventRouter for this WebContents.
-  RecursivelyUnregisterRenderWidgetHostViews();
-
   // RenderWidgetHostView of main frames that are of type
   // RenderWidgetHostViewChildFrame should be re-created with appropriate
   // platform views.
@@ -3558,6 +3548,11 @@ void WebContentsImpl::ClearSurfaceEmbedConnector() {
     view_ = nullptr;
   }
 
+  // Because there may be child frames, we need to unregister all RWHVs before
+  // clearing the connector, which will change the TextInputManager and
+  // InputEventRouter for this WebContents.
+  RecursivelyUnregisterRenderWidgetHostViews();
+
   surface_embed_connector_.reset();
 
   // Recreate and register RenderWidgetHostView.
@@ -3574,6 +3569,7 @@ void WebContentsImpl::ClearSurfaceEmbedConnector() {
     RecursivelyRegisterRenderWidgetHostViews();
   }
 }
+#endif  // BUILDFLAG(ENABLE_SURFACE_EMBED)
 
 void WebContentsImpl::AttachGuestPage(
     std::unique_ptr<GuestPageHolder> guest_page,
@@ -3731,6 +3727,15 @@ void WebContentsImpl::ReattachToOuterWebContentsFrame() {
   GetPrimaryMainFrame()->UpdateAXTreeData();
 }
 
+void WebContentsImpl::DidActivatePreviewedPage(
+    base::TimeTicks activation_time) {
+  TRACE_EVENT1("content", "WebContentsImpl::DidActivatePreviewedPage",
+               "activation_time", activation_time);
+  observers_.NotifyObservers(&WebContentsObserver::DidActivatePreviewedPage,
+                             activation_time);
+  GetDelegate()->DidActivatePreviewedPage();
+}
+
 void WebContentsImpl::DidChangeVisibleSecurityState() {
   OPTIONAL_TRACE_EVENT0("content",
                         "WebContentsImpl::DidChangeVisibleSecurityState");
@@ -3937,6 +3942,10 @@ const blink::web_pref::WebPreferences WebContentsImpl::ComputeWebPreferences(
     prefs.media_controls_enabled = false;
   }
 
+#if BUILDFLAG(IS_ANDROID)
+  prefs.device_scale_adjustment = GetDeviceScaleAdjustment(min_width_in_dp);
+#endif  // BUILDFLAG(IS_ANDROID)
+
   // GuestViews in the same StoragePartition need to find each other's frames.
   prefs.renderer_wide_named_frame_lookup =
       IsGuest() || main_frame->frame_tree()->is_guest();
@@ -3999,6 +4008,8 @@ const blink::web_pref::WebPreferences WebContentsImpl::ComputeWebPreferences(
 
       // Ensure no further viewport scaling
       prefs.shrinks_viewport_contents_to_fit = false;
+      // Not needed for larger form factors
+      prefs.text_autosizing_enabled = false;
     }
   }
 
@@ -4241,7 +4252,7 @@ void WebContentsImpl::Init(const WebContents::CreateParams& params,
       params.initially_use_platform_autofill;
 
   is_never_composited_ = params.is_never_composited;
-
+  is_in_preview_mode_ = params.preview_mode;
   creator_location_ = params.creator_location;
 #if BUILDFLAG(IS_ANDROID)
   java_creator_location_ = params.java_creator_location;
@@ -4687,9 +4698,11 @@ WebContentsImpl::GetInputEventRouter() {
       return GetOuterWebContents()->GetInputEventRouter();
     }
 
+#if BUILDFLAG(ENABLE_SURFACE_EMBED)
     if (surface_embed_connector_) {
       return surface_embed_connector_->GetInputEventRouter();
     }
+#endif  // BUILDFLAG(ENABLE_SURFACE_EMBED)
 
     if (!rwh_input_event_router_.get()) {
       rwh_input_event_router_ =
@@ -4960,7 +4973,8 @@ ui::mojom::WindowShowState WebContentsImpl::GetWindowShowState() {
                        : ui::mojom::WindowShowState::kDefault;
 }
 
-DevicePostureProviderImpl* WebContentsImpl::GetDevicePostureProvider() {
+blink::mojom::DevicePostureProvider*
+WebContentsImpl::GetDevicePostureProvider() {
   return DevicePostureProviderImpl::GetOrCreate(this);
 }
 
@@ -5276,24 +5290,6 @@ void WebContentsImpl::LostPointerLock(
   }
 }
 
-bool WebContentsImpl::IsPointerLockSandboxedForWidget(
-    RenderWidgetHostImpl* render_widget_host) {
-  // Check the sandbox flags of the frame that owns the requesting widget.
-  // It is ok to only check the top-most frame of the widget, because any
-  // subframes within the widget will be at least as restrictive as it. Any
-  // additional restrictions imposed on subframes of the widget cannot be
-  // enforced by the browser process, because they share a renderer process
-  // with the top-most frame of the widget.
-  // Note: crbug.com/492211919
-  for (FrameTreeNode* node : GetPrimaryFrameTree().Nodes()) {
-    RenderFrameHostImpl* rfh = node->current_frame_host();
-    if (rfh && rfh->GetRenderWidgetHost() == render_widget_host) {
-      return rfh->IsSandboxed(network::mojom::WebSandboxFlags::kPointerLock);
-    }
-  }
-  return false;
-}
-
 bool WebContentsImpl::HasPointerLock(RenderWidgetHostImpl* render_widget_host) {
   // To verify if the mouse is locked, the mouse_lock_widget_ needs to be
   // assigned to the widget that requested the mouse lock, and the top-level
@@ -5410,15 +5406,6 @@ FrameTree* WebContentsImpl::CreateNewWindow(
                "opener", opener, "params", params);
   DCHECK(opener);
 
-  // Block Document Picture-in-Picture window creation if the delegate reports
-  // that the OS currently prevents it (e.g., Android in app fullscreen).
-  // `NEW_PICTURE_IN_PICTURE` is specific to Document PiP and does not affect
-  // traditional video PiP or regular popups.
-  if (params.disposition == WindowOpenDisposition::NEW_PICTURE_IN_PICTURE &&
-      delegate_ && delegate_->IsDocumentPictureInPictureBlockedBySystem()) {
-    return nullptr;
-  }
-
   if (active_file_chooser_) {
     // Do not allow opening a new window or tab while a file select is active
     // file chooser to avoid user confusion over which tab triggered the file
@@ -6075,24 +6062,21 @@ bool WebContentsImpl::CheckMediaAccessPermission(
                           render_frame_host, security_origin, type);
 }
 
-void WebContentsImpl::OnCaptureHandleConfigUpdate(Page& page) {
+void WebContentsImpl::SetCaptureHandleConfig(
+    blink::mojom::CaptureHandleConfigPtr config) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
-  // Only broadcast to tab-level observers if the update comes from the primary
-  // page.
-  if (!page.IsPrimary()) {
-    return;
+
+  if (capture_handle_config_ == *config) {
+    return;  // Avoid unnecessary notifications.
   }
 
-  const auto& config = page.GetCaptureHandleConfig();
-  const url::Origin& origin = page.GetMainDocument().GetLastCommittedOrigin();
-  if (config != last_notified_capture_handle_config_ ||
-      (origin != last_notified_capture_handle_origin_ &&
-       config.expose_origin)) {
-    last_notified_capture_handle_config_ = config;
-    last_notified_capture_handle_origin_ = origin;
-    observers_.NotifyObservers(
-        &WebContentsObserver::OnCaptureHandleConfigUpdate, config);
-  }
+  capture_handle_config_ = std::move(*config);
+
+  // Propagates the capture-handle-config inside of the browser process.
+  // Only render processes which are eligible based on |permittedOrigins|
+  // will get this.
+  observers_.NotifyObservers(&WebContentsObserver::OnCaptureHandleConfigUpdate,
+                             capture_handle_config_);
 }
 
 bool WebContentsImpl::IsJavaScriptDialogShowing() const {
@@ -6341,9 +6325,11 @@ TextInputManager* WebContentsImpl::GetTextInputManager() {
     return GetOuterWebContents()->GetTextInputManager();
   }
 
+#if BUILDFLAG(ENABLE_SURFACE_EMBED)
   if (surface_embed_connector_) {
     return surface_embed_connector_->GetTextInputManager();
   }
+#endif  // BUILDFLAG(ENABLE_SURFACE_EMBED)
 
   if (!text_input_manager_ && !browser_plugin_guest_) {
     text_input_manager_ = std::make_unique<TextInputManager>();
@@ -6432,9 +6418,7 @@ void WebContentsImpl::MoveCaret(const gfx::Point& extent) {
 
 base::UnguessableToken WebContentsImpl::GetCompositorFrameSinkGroupingId()
     const {
-  const WebContentsImpl* root =
-      const_cast<WebContentsImpl*>(this)->GetOutermostWebContents();
-  return root->compositor_frame_sink_grouping_id_;
+  return compositor_frame_sink_grouping_id_;
 }
 
 void WebContentsImpl::AdjustSelectionByCharacterOffset(
@@ -6465,7 +6449,8 @@ const std::optional<gfx::Rect> WebContentsImpl::GetTextSelectionBounds(
     if (view && root_view) {
       const auto* region = text_input_manager_->GetSelectionRegion(view);
       if (region) {
-        gfx::Rect bounds = region->bounding_box;
+        gfx::Rect bounds =
+            gfx::RectBetweenSelectionBounds(region->anchor, region->focus);
         if (!bounds.IsEmpty()) {
           gfx::Point origin = bounds.origin();
           origin += root_view->GetViewBounds().OffsetFromOrigin();
@@ -7597,6 +7582,13 @@ void WebContentsImpl::ReadyToCommitNavigation(
                "navigation_handle", navigation_handle);
   CHECK(!navigation_handle->IsSameDocument());
 
+  // Cross-document navigation of the top-level frame resets the capture
+  // handle config. Using IsInPrimaryMainFrame is valid here since the browser
+  // caches this state for the active main frame only.
+  if (navigation_handle->IsInPrimaryMainFrame()) {
+    SetCaptureHandleConfig(blink::mojom::CaptureHandleConfig::New());
+  }
+
   // Notify the OS that the workload is about to increase for main frame
   // navigations only. This a trade off between latency and power - we don't
   // want to do it for every navigation.
@@ -7691,10 +7683,6 @@ void WebContentsImpl::DidFinishNavigation(NavigationHandle* navigation_handle) {
       was_ever_audible_ = false;
     }
 
-    if (navigation_handle->IsInPrimaryMainFrame()) {
-      OnCaptureHandleConfigUpdate(GetPrimaryPage());
-    }
-
     if (!navigation_handle->IsSameDocument()) {
       last_screen_orientation_change_time_ = base::TimeTicks();
     }
@@ -10848,6 +10836,19 @@ bool WebContentsImpl::CreateRenderViewForRenderManager(
     return false;
   }
 
+  // Set the TextAutosizer state from the main frame's renderer on the new view,
+  // but only if it's not for the main frame. Main frame renderers should create
+  // this state themselves from up-to-date values, so we shouldn't override it
+  // with the cached values.
+  if (!rvh_impl->GetMainRenderFrameHost() && proxy_host) {
+    proxy_host->GetAssociatedRemoteMainFrame()->UpdateTextAutosizerPageInfo(
+        proxy_host->frame_tree_node()
+            ->current_frame_host()
+            ->GetPage()
+            .text_autosizer_page_info()
+            .Clone());
+  }
+
   // If `render_view_host` is for an inner WebContents, ensure that its
   // RenderWidgetHostView is properly reattached to the outer WebContents. Note
   // that this should only be done when `render_view_host` is already the
@@ -12159,7 +12160,17 @@ void WebContentsImpl::NotifyPageBecamePrimary(PageImpl& page) {
   observers_.NotifyObservers(&WebContentsObserver::PrimaryPageChanged, page);
 }
 
+bool WebContentsImpl::IsPageInPreviewMode() const {
+  return IsInPreviewMode();
+}
 
+void WebContentsImpl::CancelPreviewByMojoBinderPolicy(
+    const std::string& interface_name) {
+  if (delegate_) {
+    delegate_->CancelPreview(
+        PreviewCancelReason::BlockedByMojoBinderPolicy(interface_name));
+  }
+}
 
 FrameTreeNodeId WebContentsImpl::GetOuterDelegateFrameTreeNodeId() {
   return node_.outer_contents_frame_tree_node_id();
@@ -12289,13 +12300,39 @@ void WebContentsImpl::SetV8CompileHints(base::ReadOnlySharedMemoryRegion data) {
 }
 
 void WebContentsImpl::SetTabSwitchStartTime(base::TimeTicks start_time,
-                                            bool destination_is_loaded,
-                                            bool had_saved_frame_at_start) {
+                                            bool destination_is_loaded) {
   GetVisibleTimeRequestTrigger().UpdateRequest(blink::VisibleTimeEvent{
       .event_start_time = start_time,
-      .reason = blink::VisibleTimeEvent::TabSwitchReason{
-          .destination_is_loaded = destination_is_loaded,
-          .had_saved_frame_at_start = had_saved_frame_at_start}});
+      .reason =
+          blink::VisibleTimeEvent::TabSwitchReason(destination_is_loaded)});
+}
+
+bool WebContentsImpl::IsInPreviewMode() const {
+  return is_in_preview_mode_;
+}
+
+void WebContentsImpl::WillActivatePreviewPage() {
+  CHECK(is_in_preview_mode_);
+  is_in_preview_mode_ = false;
+}
+
+void WebContentsImpl::ActivatePreviewPage() {
+  TRACE_EVENT0("content", "WebContentsImpl::ActivatePreviewPage");
+
+  // WillActivatePreviewPage() should be called to reset it beforehand.
+  CHECK(!is_in_preview_mode_);
+
+  PageImpl& preview_page = GetPrimaryPage();
+  preview_page.SetActivationStartTime(base::TimeTicks::Now());
+
+  // TODO(b:299240273): Gather all relevant RVHs.
+  StoredPage::RenderViewHostImplSafeRefSet render_view_hosts;
+  render_view_hosts.insert(GetRenderViewHost()->GetSafeRef());
+
+  preview_page.Activate(
+      PageImpl::ActivationType::kPreview, render_view_hosts, std::nullopt,
+      base::BindOnce(&WebContentsImpl::DidActivatePreviewedPage,
+                     weak_factory_.GetWeakPtr()));
 }
 
 VisibleTimeRequestTrigger& WebContentsImpl::GetVisibleTimeRequestTrigger() {
@@ -12312,8 +12349,9 @@ gfx::mojom::DelegatedInkPointRenderer* WebContentsImpl::GetDelegatedInkRenderer(
       return nullptr;
     }
 
-    TRACE_EVENT_INSTANT("delegated_ink_trails",
-                        "Binding mojo interface for delegated ink points.");
+    TRACE_EVENT_INSTANT0("delegated_ink_trails",
+                         "Binding mojo interface for delegated ink points.",
+                         TRACE_EVENT_SCOPE_THREAD);
     compositor->SetDelegatedInkPointRenderer(
         delegated_ink_point_renderer_.BindNewPipeAndPassReceiver());
     delegated_ink_point_renderer_.reset_on_disconnect();

tools/under-control/src/content/child/runtime_features.cc

@@ -259,7 +259,7 @@ void SetRuntimeFeaturesFromChromiumFeatures() {
           {wf::EnableWebAuthenticationAmbient,
            raw_ref(device::kWebAuthnAmbientSignin)},
           {wf::EnableWebAuthenticationImmediateGet,
-           raw_ref(device::kWebAuthnImmediateGet), kDefault},
+           raw_ref(device::kWebAuthnImmediateGet), kSetOnlyIfOverridden},
           {wf::EnableWebBluetooth, raw_ref(features::kWebBluetooth),
            kSetOnlyIfOverridden},
           {wf::EnableWebBluetoothGetDevices,
@@ -353,10 +353,7 @@ void SetRuntimeFeaturesFromChromiumFeatures() {
            kSetOnlyIfOverridden},
           {"FledgeBiddingAndAuctionServerAPI",
            raw_ref(blink::features::kFledgeBiddingAndAuctionServer), kDefault},
-#if BUILDFLAG(IS_WIN)
-          {"FontDataService",
-           raw_ref(features::kFontDataServiceAllWebContents)},
-#endif
+          {"FontSrcLocalMatching", raw_ref(features::kFontSrcLocalMatching)},
           {"HstsTopLevelNavigationsOnly",
            raw_ref(net::features::kHstsTopLevelNavigationsOnly)},
           {"MachineLearningNeuralNetwork",
@@ -368,7 +365,6 @@ void SetRuntimeFeaturesFromChromiumFeatures() {
           {"RelatedWebsitePartitionAPI",
            raw_ref(net::features::kRelatedWebsitePartitionAPI)},
           {"SerialPortConnected", raw_ref(features::kSerialPortConnected)},
-          {"SplitViewLinkOpen", raw_ref(features::kSplitViewLinkOpen)},
 #if BUILDFLAG(IS_MAC)
           {"SystemDefaultAccentColors",
            raw_ref(features::kUseSystemDefaultAccentColors)},

tools/under-control/src/content/public/browser/content_browser_client.cc

@@ -28,6 +28,7 @@
 #include "components/language_detection/content/common/language_detection.mojom.h"
 #include "components/language_detection/core/browser/language_detection_model_provider.h"
 #include "content/browser/ai/echo_ai_manager_impl.h"
+#include "content/browser/cpu_performance/cpu_performance.h"
 #include "content/browser/renderer_host/render_frame_host_impl.h"
 #include "content/browser/webauth/default_authenticator_request_client_delegate.h"
 #include "content/public/browser/anchor_element_preconnect_delegate.h"
@@ -231,14 +232,14 @@ bool ContentBrowserClient::DoesWebUIUrlRequireProcessLock(const GURL& url) {
   return true;
 }
 
-bool ContentBrowserClient::ShouldTreatAsFirstPartyWhenTopLevel(
-    const url::Origin& top_frame_origin,
+bool ContentBrowserClient::ShouldTreatURLSchemeAsFirstPartyWhenTopLevel(
+    std::string_view scheme,
     bool is_embedded_origin_secure) {
   return false;
 }
 
 bool ContentBrowserClient::ShouldIgnoreSameSiteCookieRestrictionsWhenTopLevel(
-    const url::Origin& top_frame_origin,
+    std::string_view scheme,
     bool is_embedded_origin_secure) {
   return false;
 }
@@ -423,6 +424,12 @@ bool ContentBrowserClient::IsTopChromeWebUIURL(const GURL& url) {
   return false;
 }
 
+bool ContentBrowserClient::IsIsolatedContextAllowedForUrl(
+    BrowserContext* browser_context,
+    const GURL& lock_url) {
+  return false;
+}
+
 bool ContentBrowserClient::IsMultiCaptureAllowed(
     content::RenderFrameHost* render_frame_host) {
   return false;
@@ -535,12 +542,6 @@ bool ContentBrowserClient::AllowSharedWorkerBlobURLFix(
   return true;
 }
 
-bool ContentBrowserClient::IsDataUrlInWebWorkerOpaqueOriginEnabled(
-    BrowserContext* context) {
-  return base::FeatureList::IsEnabled(
-      blink::features::kDataUrlWorkerOpaqueOrigin);
-}
-
 bool ContentBrowserClient::AllowSharedWorkerExtendedLifetime(
     BrowserContext* context) {
   return true;
@@ -564,11 +565,6 @@ bool ContentBrowserClient::IsDataSaverEnabled(BrowserContext* context) {
   return false;
 }
 
-bool ContentBrowserClient::IsPinchToZoomAllowed(BrowserContext* context) {
-  DCHECK(context);
-  return true;
-}
-
 void ContentBrowserClient::UpdateRendererPreferencesForWorker(
     BrowserContext* browser_context,
     blink::RendererPreferences* out_prefs) {
@@ -718,7 +714,7 @@ bool ContentBrowserClient::IsFullCookieAccessAllowed(
     const GURL& url,
     const blink::StorageKey& storage_key,
     net::CookieSettingOverrides overrides) {
-  return !storage_key.ForbidsUnpartitionedStorageAccess();
+  return true;
 }
 
 bool ContentBrowserClient::IsPrefetchWithServiceWorkerAllowed(
@@ -878,8 +874,7 @@ ContentBrowserClient::CreateModelBrokerClient(BrowserContext* browser_context) {
 media::mojom::AvailabilityStatus
 ContentBrowserClient::GetOnDeviceSpeechRecognitionAvailabilityStatus(
     BrowserContext* context,
-    const std::string& language,
-    media::mojom::SpeechRecognitionQuality quality) {
+    const std::string& language) {
   return media::mojom::AvailabilityStatus::kUnavailable;
 }
 
@@ -1106,8 +1101,6 @@ ContentBrowserClient::CreateNonNetworkNavigationURLLoaderFactory(
 void ContentBrowserClient::
     RegisterNonNetworkWorkerMainResourceURLLoaderFactories(
         BrowserContext* browser_context,
-        const std::optional<url::Origin>& request_initiator,
-        network::mojom::RequestDestination request_destination,
         NonNetworkURLLoaderFactoryMap* factories) {}
 
 void ContentBrowserClient::
@@ -1450,14 +1443,13 @@ bool ContentBrowserClient::IsBuiltinComponent(BrowserContext* browser_context,
 void ContentBrowserClient::StartRtcDiagnosticLogging(
     RenderFrameHost& frame_host,
     bool should_upload_on_stop,
-    const base::flat_map<std::string, std::string>& metadata,
+    base::flat_map<std::string, std::string> metadata,
     base::OnceCallback<void(const std::string&)> callback) {
   std::move(callback).Run(base::Uuid::GenerateRandomV4().AsLowercaseString());
 }
 
 void ContentBrowserClient::FinishRtcDiagnosticLogging(
     RenderFrameHost& frame_host,
-    const base::flat_map<std::string, std::string>& metadata,
     base::OnceClosure callback) {
   std::move(callback).Run();
 }
@@ -2005,9 +1997,8 @@ bool ContentBrowserClient::ShouldAnimateBackForwardTransitions() {
 #endif
 }
 
-std::optional<int> ContentBrowserClient::GetCpuPerformanceTierOverride(
-    BrowserContext* browser_context) {
-  return std::nullopt;
+blink::mojom::PerformanceTier ContentBrowserClient::GetCpuPerformanceTier() {
+  return content::cpu_performance::GetTier();
 }
 
 void ContentBrowserClient::RecordAssistedLogin(AssistedLoginType login_type) {}

tools/under-control/src/gin/v8_initializer.cc

@@ -229,7 +229,7 @@ class V8FeatureVisitor : public base::FeatureVisitor {
  public:
   void Visit(const std::string& feature_name,
              base::FeatureList::OverrideState override_state,
-             const base::FieldTrialParams& params,
+             const std::map<std::string, std::string>& params,
              const std::string& trial_name,
              const std::string& group_name) override {
     std::string_view feature_name_view(feature_name);

tools/under-control/src/services/network/network_context.cc

@@ -60,7 +60,6 @@
 #include "components/url_matcher/url_matcher.h"
 #include "components/url_matcher/url_util.h"
 #include "components/url_pattern/simple_url_pattern_matcher.h"
-#include "components/variations/net/variations_http_headers.h"
 #include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "net/base/features.h"
 #include "net/base/isolation_info.h"
@@ -631,14 +630,6 @@ void RecordHSTSPreconnectUpgradeReason(HSTSRedirectUpgradeReason reason) {
   }
 }
 
-bool IsIncognitoFromParams(const mojom::NetworkContextParams& params) {
-  // Checking both to see if there are any file paths at all, and if there is
-  // specifically an http_cache_directory filepath in order to avoid a
-  // potential nullptr dereference if we just checked that
-  // `params_->file_paths->http_cache_directory' existed.
-  return !params.file_paths || !params.file_paths->http_cache_directory;
-}
-
 }  // namespace
 
 constexpr uint32_t NetworkContext::kMaxOutstandingRequestsPerProcess;
@@ -713,8 +704,7 @@ NetworkContext::NetworkContext(
       cors_non_wildcard_request_headers_support_(base::FeatureList::IsEnabled(
           features::kCorsNonWildcardRequestHeadersSupport)),
       prefetch_cache_(prefetch_enabled_ ? std::make_unique<PrefetchCache>()
-                                        : nullptr),
-      variations_headers_(std::move(params_->initial_variations_headers)) {
+                                        : nullptr) {
 
   if (features::ShouldBindNetworkContextDirectReceiver()) {
     receiver_.emplace<DirectReceiver>(mojo::DirectReceiverKey{}, this);
@@ -795,7 +785,8 @@ NetworkContext::NetworkContext(
   cookie_manager_ = std::make_unique<CookieManager>(
       url_request_context_, &first_party_sets_access_delegate_,
       std::move(session_cleanup_cookie_store),
-      std::move(params_->cookie_manager_params));
+      std::move(params_->cookie_manager_params),
+      network_service_->tpcd_metadata_manager());
 
   cookie_manager_->AddSettingsWillChangeCallback(
       base::BindRepeating(&NetworkContext::OnCookieManagerSettingsChanged,
@@ -897,7 +888,8 @@ NetworkContext::NetworkContext(
           url_request_context,
           nullptr,
           /*first_party_sets_access_delegate=*/nullptr,
-          /*params=*/nullptr)),
+          /*params=*/nullptr,
+          /*tpcd_metadata_manager=*/nullptr)),
       socket_factory_(
           std::make_unique<SocketFactory>(url_request_context_->net_log(),
                                           url_request_context)),
@@ -1678,6 +1670,14 @@ void NetworkContext::QueueReportInternal(
     return;
   }
 
+  // Reporting is disallowed if network access is disabled for the nonce.
+  if (network_anonymization_key.GetNonce().has_value() &&
+      !IsNetworkForNonceAndUrlAllowed(
+          network_anonymization_key.GetNonce().value(), url,
+          network_anonymization_key)) {
+    return;
+  }
+
   std::string reported_user_agent = "";
   if (request_context->http_user_agent_settings() != nullptr) {
     reported_user_agent =
@@ -1720,6 +1720,14 @@ void NetworkContext::QueueSignedExchangeReport(
     return;
   }
 
+  // Reporting is disallowed if network access is disabled for the nonce.
+  if (network_anonymization_key.GetNonce().has_value() &&
+      !IsNetworkForNonceAndUrlAllowed(
+          network_anonymization_key.GetNonce().value(), report->outer_url,
+          network_anonymization_key)) {
+    return;
+  }
+
   std::string user_agent;
   if (url_request_context_->http_user_agent_settings() != nullptr) {
     user_agent =
@@ -1803,16 +1811,6 @@ void NetworkContext::OnReportingObserverDisconnect(
     is_observing_reporting_service_ = false;
   }
 }
-
-void NetworkContext::AddVariationsHeadersToReportingRequest(
-    net::URLRequest* request) {
-  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-  variations::AppendVariationsHeaderWithCustomValue(
-      request->url(),
-      IsIncognitoFromParams(*params_) ? variations::InIncognito::kYes
-                                      : variations::InIncognito::kNo,
-      variations_headers_.get(), request);
-}
 #endif  // BUILDFLAG(ENABLE_REPORTING)
 
 void NetworkContext::ClearDomainReliability(
@@ -1860,7 +1858,6 @@ void NetworkContext::CloseIdleConnections(
 
 void NetworkContext::SetNetworkConditions(
     const base::UnguessableToken& throttling_profile_id,
-    const base::UnguessableToken& throttling_client_id,
     std::vector<mojom::MatchedNetworkConditionsPtr> conditions) {
   std::vector<MatchedNetworkConditions> network_conditions;
   for (auto& condition : conditions) {
@@ -1876,7 +1873,6 @@ void NetworkContext::SetNetworkConditions(
                           condition->conditions->rule_id});
   }
   ThrottlingController::SetConditions(throttling_profile_id,
-                                      throttling_client_id,
                                       std::move(network_conditions));
 }
 
@@ -2081,15 +2077,22 @@ void NetworkContext::CreateWebTransport(
     const net::NetworkAnonymizationKey& key,
     std::vector<mojom::WebTransportCertificateFingerprintPtr> fingerprints,
     const std::vector<std::string>& application_protocols,
-    mojom::WebTransportCongestionControl congestion_control,
     mojo::PendingRemote<mojom::WebTransportHandshakeClient>
         pending_handshake_client,
     mojo::PendingRemote<mojom::URLLoaderNetworkServiceObserver>
         url_loader_network_observer,
     mojom::ClientSecurityStatePtr client_security_state) {
+  if (!IsNetworkForNonceAndUrlAllowed(
+          key.GetNonce().value_or(base::UnguessableToken::Null()), url, key)) {
+    mojo::Remote<mojom::WebTransportHandshakeClient> remote_handshake_client(
+        std::move(pending_handshake_client));
+    remote_handshake_client->OnHandshakeFailed(
+        net::WebTransportError(net::ERR_NETWORK_ACCESS_REVOKED));
+    return;
+  }
   web_transports_.insert(std::make_unique<WebTransport>(
-      url, origin, key, fingerprints, application_protocols, congestion_control,
-      this, std::move(pending_handshake_client),
+      url, origin, key, fingerprints, application_protocols, this,
+      std::move(pending_handshake_client),
       std::move(url_loader_network_observer),
       std::move(client_security_state)));
 }
@@ -2115,13 +2118,19 @@ void NetworkContext::ResolveHost(
                                        host->get_host_port_pair().port())
                        .GetURL()
                  : host->get_scheme_host_port().GetURL();
+  bool is_network_disallowed_for_nonce =
+      network_anonymization_key.GetNonce().has_value() &&
+      !IsNetworkForNonceAndUrlAllowed(
+          network_anonymization_key.GetNonce().value(), url,
+          network_anonymization_key);
   bool is_network_disallowed_for_restrictions_id =
       (optional_parameters &&
        optional_parameters->network_restrictions_id.has_value() &&
        !IsHostResolutionForNonceAndHostAllowed(
            optional_parameters->network_restrictions_id.value(), *host,
            network_anonymization_key));
-  if (is_network_disallowed_for_restrictions_id) {
+  if (is_network_disallowed_for_nonce ||
+      is_network_disallowed_for_restrictions_id) {
     mojo::Remote<mojom::ResolveHostClient> remote_response_client(
         std::move(response_client));
     remote_response_client->OnComplete(
@@ -2182,7 +2191,7 @@ void NetworkContext::CreateHostResolver(
 void NetworkContext::VerifyCertInternal(
     const scoped_refptr<net::X509Certificate>& certificate,
     const net::HostPortPair& host_port,
-    const std::string& ocsp_response,
+    const std::string& ocsp_result,
     const std::string& sct_list,
     CTVerificationMode ct_verification_mode,
     VerifyCertCallback callback) {
@@ -2206,7 +2215,7 @@ void NetworkContext::VerifyCertInternal(
   }
   int result = cert_verifier->Verify(
       net::CertVerifier::RequestParams(certificate, host_port.host(), flags,
-                                       ocsp_response, sct_list),
+                                       ocsp_result, sct_list),
       pending_cert_verify->result.get(),
       base::BindOnce(&NetworkContext::OnVerifyCertComplete,
                      base::Unretained(this), cert_verify_id),
@@ -2223,20 +2232,20 @@ void NetworkContext::VerifyCertInternal(
 void NetworkContext::VerifyCert(
     const scoped_refptr<net::X509Certificate>& certificate,
     const net::HostPortPair& host_port,
-    const std::string& ocsp_response,
+    const std::string& ocsp_result,
     const std::string& sct_list,
     VerifyCertCallback callback) {
-  VerifyCertInternal(certificate, host_port, ocsp_response, sct_list,
+  VerifyCertInternal(certificate, host_port, ocsp_result, sct_list,
                      CTVerificationMode::kTlsCertificate, std::move(callback));
 }
 
 void NetworkContext::VerifyCertForSignedExchange(
     const scoped_refptr<net::X509Certificate>& certificate,
     const net::HostPortPair& host_port,
-    const std::string& ocsp_response,
+    const std::string& ocsp_result,
     const std::string& sct_list,
     VerifyCertCallback callback) {
-  VerifyCertInternal(certificate, host_port, ocsp_response, sct_list,
+  VerifyCertInternal(certificate, host_port, ocsp_result, sct_list,
                      CTVerificationMode::kSignedExchange, std::move(callback));
 }
 
@@ -2458,8 +2467,13 @@ void NetworkContext::PreconnectSockets(
     return;
   }
 
-  // Preconnect is disallowed if network access is disabled for the
-  // network_restrictions_id.
+  // Preconnect is disallowed if network access is disabled for the nonce.
+  if (network_anonymization_key.GetNonce().has_value() &&
+      !IsNetworkForNonceAndUrlAllowed(
+          network_anonymization_key.GetNonce().value(), url,
+          network_anonymization_key)) {
+    return;
+  }
   if (network_restrictions_id.has_value() &&
       !IsNetworkForNonceAndUrlAllowed(*network_restrictions_id, url,
                                       network_anonymization_key)) {
@@ -2883,7 +2897,11 @@ URLRequestContextOwner NetworkContext::MakeURLRequestContext(
   } else {
     net::URLRequestContextBuilder::HttpCacheParams cache_params;
     cache_params.max_size = params_->http_cache_max_size;
-    if (IsIncognitoFromParams(*params_)) {
+    // Checking both to see if there are any file paths at all, and if there is
+    // specifically an http_cache_directory filepath in order to avoid a
+    // potential nullptr dereference if we just checked that
+    // `params_->file_paths->http_cache_directory' existed.
+    if (!params_->file_paths || !params_->file_paths->http_cache_directory) {
       cache_params.type =
           net::URLRequestContextBuilder::HttpCacheParams::IN_MEMORY;
     } else {
@@ -3094,17 +3112,6 @@ URLRequestContextOwner NetworkContext::MakeURLRequestContext(
     builder.set_enable_shared_zstd(true);
   }
 
-#if BUILDFLAG(ENABLE_REPORTING)
-  if (base::FeatureList::IsEnabled(
-          features::kReportingApiEnableVariationsHeaders)) {
-    builder.set_prepare_upload_request_callback(base::BindRepeating(
-        &NetworkContext::AddVariationsHeadersToReportingRequest,
-        // `this` outlives the URLRequestContext that owns the ReportingService,
-        // which owns the ReportingUploader that calls this callback.
-        base::Unretained(this)));
-  }
-#endif
-
   builder.SetWrapHttpNetworkLayerCallback(
       base::BindOnce([](std::unique_ptr<net::HttpNetworkLayer> network_layer)
                          -> std::unique_ptr<net::HttpTransactionFactory> {
@@ -3263,12 +3270,12 @@ NetworkContext::MakeSessionCleanupCookieStore() const {
       crypto_delegate = std::make_unique<CookieOSCryptAsyncDelegate>(
           std::move(params_->cookie_encryption_provider));
     } else {
-#if !BUILDFLAG(IS_ANDROID) && !BUILDFLAG(IS_IOS)
-      // A cookie crypto delegate should not be created on Android or iOS
-      // to match the behavior of cookie_config::GetCookieCryptoDelegate().
+#if !BUILDFLAG(IS_ANDROID)
+      // A cookie crypto delegate should not be created on Android to
+      // match the behavior of cookie_config::GetCookieCryptoDelegate().
       // See https://crbug.com/449652881
       NOTREACHED();
-#endif  // !BUILDFLAG(IS_ANDROID) && !BUILDFLAG(IS_IOS)
+#endif
     }
   }
 
@@ -3640,6 +3647,28 @@ void NetworkContext::RevokeNetworkForNonces(
                     restriction.report_only_reporting_endpoint,
                     restriction.report_only_allowlisted_patterns,
                     restriction.report_only_redirect_behavior);
+
+    // CancelRequestsIfNonceMatchesAndUrlNotExempted is not needed for
+    // connection allowlist since there should not be any ongoing
+    // requests.
+    const std::set<GURL>& exemptions = network_revocation_exemptions_[nonce];
+    // Destroying all of a factory's URLLoaders may delete the factory,
+    // invalidating the iterator, so have to advance the iterator before calling
+    // CancelRequestsIfNonceMatchesAndUrlNotExempted().
+    for (auto factory_it = url_loader_factories_.begin();
+         factory_it != url_loader_factories_.end();) {
+      auto* factory = factory_it->get();
+      ++factory_it;
+      factory->CancelRequestsIfNonceMatchesAndUrlNotExempted(nonce, exemptions);
+    }
+#if BUILDFLAG(ENABLE_WEBSOCKETS)
+    if (websocket_factory_) {
+      websocket_factory_->RemoveIfNonceMatches(nonce);
+    }
+#endif  // BUILDFLAG(ENABLE_WEBSOCKETS)
+    for (const auto& transport : web_transports_) {
+      transport->CloseIfNonceMatches(nonce);
+    }
   }
 
   if (callback) {
@@ -3651,9 +3680,23 @@ void NetworkContext::ClearNonces(
     const std::vector<base::UnguessableToken>& nonces) {
   for (const auto& nonce : nonces) {
     network_revocation_nonces_.erase(nonce);
+    network_revocation_exemptions_.erase(nonce);
   }
 }
 
+void NetworkContext::ExemptUrlFromNetworkRevocationForNonce(
+    const GURL& exempted_url,
+    const base::UnguessableToken& nonce,
+    ExemptUrlFromNetworkRevocationForNonceCallback callback) {
+  GURL url_without_filename = exempted_url.GetWithoutFilename();
+
+  if (url_without_filename.is_valid()) {
+    network_revocation_exemptions_[nonce].insert(url_without_filename);
+  }
+
+  std::move(callback).Run();
+}
+
 void NetworkContext::Prefetch(
     int32_t request_id,
     uint32_t options,
@@ -3722,20 +3765,39 @@ bool NetworkContext::IsNetworkForNonceAndUrlAllowed(
     const GURL& url,
     const net::NetworkAnonymizationKey& network_anonymization_key,
     bool is_redirect) {
-  // If network hasn't been revoked for the nonce, it's allowed. Likewise, local
-  // schemes that reach this point should be excluded as they don't generate
-  // network requests.
+  // If network hasn't been revoked for the nonce, it's allowed.
   auto it = network_revocation_nonces_.find(nonce);
-  if (it == network_revocation_nonces_.end() || url.SchemeIsLocal()) {
+  if (it == network_revocation_nonces_.end()) {
+    return true;
+  }
+
+  // Note: network_revocation_exemptions_ is only used for fenced frames and the
+  // disableUntrustedNetwork API for testing scenarios.
+  if (auto it_exempt = network_revocation_exemptions_.find(nonce);
+      it_exempt != network_revocation_exemptions_.end() &&
+      it_exempt->second.contains(url.GetWithoutFilename())) {
     return true;
   }
 
   const NetworkRestriction& restriction = it->second;
 
+  // Temporary disgusting hack: if we have a NetworkRestriction but we've not
+  // actually specified anything to be restricted, then this restriction must
+  // be for a fenced frame. Given that there were no fenced frames exemptions
+  // detected above, we can just return false here. The fenced frame portion of
+  // this function is slated for removal, so this will be cleaned up within
+  // 1-2 milestones. TODO(crbug.com/499191497): Remove this check.
+  if (!restriction.enforced_allowlisted_patterns.has_value() &&
+      !restriction.report_only_allowlisted_patterns.has_value()) {
+    return false;
+  }
+
   // For connection allowlist feature, network_revocation_nonces_ map contains
   // the allowed URL Patterns.
+  // Note that the network_revocation_exemptions_ check above which was added
+  // to enable fenced frames testing is orthogonal to this feature.
   // If there are no allowlisted URLs then it is assumed that all network URLs
-  // are restricted.
+  // are restricted (unless exempted for FF testing).
   if (base::FeatureList::IsEnabled(network::features::kConnectionAllowlists)) {
     auto restriction_allowed = [&](const NetworkRestriction& r, bool enforced) {
       const auto& patterns = enforced ? r.enforced_allowlisted_patterns
@@ -3779,7 +3841,7 @@ bool NetworkContext::IsNetworkForNonceAndUrlAllowed(
     }
 
     return true;
-  } /* kConnectionAllowlists */
+  }
 
   return false;
 }
@@ -3869,10 +3931,4 @@ GURL NetworkContext::GetNetworkRestrictionResponseUrlForTesting(
   return it->second.response_url;
 }
 
-void NetworkContext::SetVariationsHeaders(
-    variations::mojom::VariationsHeadersPtr variations_headers) {
-  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-  variations_headers_ = std::move(variations_headers);
-}
-
 }  // namespace network

tools/under-control/src/third_party/blink/public/mojom/use_counter/metrics/web_feature.mojom

@@ -4268,7 +4268,7 @@ enum WebFeature {
   kMaximumHTMLParserDOMTreeDepthHit = 4972,
   // The items above roughly this point are available in the M126 branch.
   kV8ModelGenericSession_Destroy_Method = 4973,
-  kOBSOLETE_UsedDeviceScaleAdjustment = 4974,
+  kUsedDeviceScaleAdjustment = 4974,
   kOBSOLETE_DisableThirdPartyStoragePartitioning2 = 4975,
   kLinkRelFacilitatedPayment = 4976,
   kOBSOLETE_V8GPUAdapter_RequestAdapterInfo_Method = 4977,
@@ -4684,7 +4684,7 @@ enum WebFeature {
   kAriaLabeledByAlternativeSpelling = 5375,
   kOBSOLETE_CanvasTextNg = 5376,
   kDOMWindowOpenPopup = 5377,
-  kOBSOLETE_FencedFrameDisableUntrustedNetwork = 5378,
+  kFencedFrameDisableUntrustedNetwork = 5378,
   kFencedFrameNotifyEvent = 5379,
   kOBSOLETE_SharedStorageGetInFencedFrame = 5380,
   kOBSOLETE_Translator_MeasureInputUsage_Method = 5381,
@@ -4942,7 +4942,7 @@ enum WebFeature {
   kLocalNetworkAccessWithinDedicatedWorker = 5628,
   // The items above roughly this point are available in the M140 branch.
   kCSSPseudoParentInScope = 5629,
-  kInterestButtonPseudoElement = 5630,
+  kInterestHintPseudoElement = 5630,
   kCookieStoreEmptyPath = 5631,
   kV8CookieListItem_Domain_AttributeGetter = 5632,
   kV8CookieListItem_Path_AttributeGetter = 5633,
@@ -4990,22 +4990,22 @@ enum WebFeature {
   kSmartCardConnect = 5674,
   kNavigatorCPUPerformance = 5675,
   kOBSOLETE_SelectionRemoveRangeNotFoundWouldThrow = 5676,
-  kOBSOLETE_NestedSvgCssSizingProperties = 5677,
+  kNestedSvgCssSizingProperties = 5677,
   kCryptoAlgorithmChaCha20Poly1305 = 5678,
   kCryptoAlgorithmMlDsa44 = 5679,
   kCryptoAlgorithmMlDsa65 = 5680,
   kCryptoAlgorithmMlDsa87 = 5681,
   kCryptoAlgorithmMlKem768 = 5682,
   kCryptoAlgorithmMlKem1024 = 5683,
-  kOBSOLETE_ClipboardChangedBetweenReadAndGetType = 5684,
-  kOBSOLETE_ClipboardChangedBetweenGetTypes = 5685,
-  kOBSOLETE_ClipboardReadAndGetTypeTimeDiffIsBetween5SecAnd1Min = 5686,
-  kOBSOLETE_ClipboardReadAndGetTypeTimeDiffIsBetween1MinAnd10Min = 5687,
-  kOBSOLETE_ClipboardReadAndGetTypeTimeDiffIsMoreThan10Min = 5688,
-  kOBSOLETE_ClipboardGetTypeTimeDiffOfSameTypeIsBetween5SecAnd1Min = 5689,
-  kOBSOLETE_ClipboardGetTypeTimeDiffOfSameTypeIsBetween1MinAnd10Min = 5690,
-  kOBSOLETE_ClipboardGetTypeTimeDiffOfSameTypeIsMoreThan10Min = 5691,
-  kOBSOLETE_ClipboardGetTypeWindowNotInFocus = 5692,
+  kClipboardChangedBetweenReadAndGetType = 5684,
+  kClipboardChangedBetweenGetTypes = 5685,
+  kClipboardReadAndGetTypeTimeDiffIsBetween5SecAnd1Min = 5686,
+  kClipboardReadAndGetTypeTimeDiffIsBetween1MinAnd10Min = 5687,
+  kClipboardReadAndGetTypeTimeDiffIsMoreThan10Min = 5688,
+  kClipboardGetTypeTimeDiffOfSameTypeIsBetween5SecAnd1Min = 5689,
+  kClipboardGetTypeTimeDiffOfSameTypeIsBetween1MinAnd10Min = 5690,
+  kClipboardGetTypeTimeDiffOfSameTypeIsMoreThan10Min = 5691,
+  kClipboardGetTypeWindowNotInFocus = 5692,
   kReportBodyToJSON = 5693,
   kCSPViolationReportBodyToJSON = 5694,
   kDeprecationReportBodyToJSON = 5695,
@@ -5184,31 +5184,6 @@ enum WebFeature {
   kConnectionAllowlist = 5867,
   kStyleTypeModule = 5868,
   kShadowRootAdoptedStyleSheets = 5869,
-  kWebAuthnConditionalCreate = 5870,
-  kWebAuthnConditionalCreateSuccess = 5871,
-  kAdScriptMainFrameNavigationWithoutUserGesture = 5872,
-  kFocusWithoutUserActivationAllowedByPolicy = 5873,
-  kFocusWithoutUserActivationAllowedByDescendant = 5874,
-  kFocusWithoutUserActivationBlocked = 5875,
-  kFocusWithoutUserActivationPolicySet = 5876,
-  kCacheHintAttributeOnScript = 5877,
-  kElementInternalsWithBehaviors = 5878,
-  kHTMLSubmitButtonBehaviorUsage = 5879,
-  kElementInternalsBehaviorsAccess = 5880,
-  kCSSURLRequestModifierCrossOrigin = 5881,
-  kCSSURLRequestModifierIntegrity = 5882,
-  kCSSURLRequestModifierReferrerPolicy = 5883,
-  kPreventSvgFilterPaint = 5884,
-  kLanguageModel_Prompt_ResponseConstraint = 5885,
-  kLanguageModel_Prompt_Prefix = 5886,
-  kCapabilityElementIsValid = 5887,
-  kCapabilityElementInvalidReason = 5888,
-  kCapabilityElementInitialPermissionStatus = 5889,
-  kCapabilityElementPermissionStatus = 5890,
-  kCapabilityElementOnPromptAction = 5891,
-  kCapabilityElementOnPromptDismiss = 5892,
-  kCapabilityElementOnValidationStatusChange = 5893,
-  kInputParsedParentSelectNoOptions = 5894,
 
   // Add new features immediately above this line. Don't change the existing
   // numbers of any item, and don't reuse removed slots. Also don't add extra

tools/under-control/src/third_party/blink/public/mojom/webpreferences/web_preferences.mojom

@@ -179,7 +179,6 @@ struct WebPreferences {
   // Disallow user opt-in for blockable mixed content.
   bool strictly_block_blockable_mixed_content;
   bool block_mixed_plugin_content;
-  bool highlight_ads;
   bool password_echo_enabled_physical;
   bool password_echo_enabled_touch;
   bool should_clear_document_background;
@@ -270,21 +269,15 @@ struct WebPreferences {
 
   bool immersive_mode_enabled;
 
-  bool immersive_video_playback_enabled;
-
   bool double_tap_to_zoom_enabled;
 
   bool fullscreen_supported;
 
-  bool text_size_adjust_enabled;
+  bool text_autosizing_enabled;
 
   // Representation of the Web App Manifest scope if any.
   url.mojom.Url web_app_scope;
 
-  // Whether this renderer is associated with the browser's initial ("Default")
-  // profile.
-  bool is_initial_profile;
-
   [EnableIf=is_android]
   float font_scale_factor;
 
@@ -294,6 +287,9 @@ struct WebPreferences {
   [EnableIf=is_android]
   int32 text_size_contrast_factor;
 
+  [EnableIf=is_android]
+  float device_scale_adjustment;
+
   [EnableIf=is_android]
   bool force_enable_zoom;
 
@@ -542,9 +538,4 @@ struct WebPreferences {
   // Chrome-rendered popups instead.
   [EnableIf=is_mac]
   bool should_disable_external_popups = false;
-
-  // Set if this is in a WebView for chrome/browser/indigo/onboarding/ and
-  // should be able to set the onboarding result. Note that this is separately
-  // verified when it sets the result.
-  bool is_indigo_onboarding = false;
 };

tools/under-control/src/third_party/blink/renderer/core/css/container_query_list.idl

@@ -1,13 +0,0 @@
-// Copyright 2026 The Chromium Authors
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// TODO(seokho): Update spec link
-
-[
-    ActiveScriptWrappable,
-    RuntimeEnabled=ElementMatchContainer,
-    Exposed=Window
-] interface ContainerQueryList : EventTarget {
-    readonly attribute boolean matches;
-};

tools/under-control/src/third_party/blink/renderer/core/css/css_container_condition.idl

@@ -1,9 +0,0 @@
-// Copyright 2026 The Chromium Authors
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// https://drafts.csswg.org/css-conditional-5/#dictdef-csscontainercondition
-dictionary CSSContainerCondition {
-  required CSSOMString name;
-  required CSSOMString query;
-};

tools/under-control/src/third_party/blink/renderer/core/css/css_container_rule.idl

@@ -5,7 +5,7 @@
 [
     Exposed=Window
 ] interface CSSContainerRule : CSSConditionRule {
+    // TODO(crbug.com/1145970): Spec and implement.
   readonly attribute DOMString containerName;
   readonly attribute DOMString containerQuery;
-  [RuntimeEnabled=CommaSeparatedContainerQueries] readonly attribute FrozenArray<CSSContainerCondition> conditions;
 };

tools/under-control/src/third_party/blink/renderer/core/dom/element.idl

@@ -144,8 +144,6 @@ dictionary SetHTMLUnsafeOptions {
     [Measure] DOMRectList getClientRects();
     [Affects=Nothing, Measure, RuntimeCallStatsCounter=ElementGetBoundingClientRect, ImplementedAs=GetBoundingClientRectForBinding] DOMRect getBoundingClientRect();
 
-    [RuntimeEnabled=ElementMatchContainer, NewObject] ContainerQueryList matchContainer(DOMString query);
-
     // https://drafts.csswg.org/cssom-view/#dom-element-checkvisibility
     [MeasureAs=ElementCheckVisibility] boolean checkVisibility(optional CheckVisibilityOptions options = {});
 

tools/under-control/src/third_party/blink/renderer/core/dom/global_event_handlers.idl

@@ -30,7 +30,6 @@
 // https://html.spec.whatwg.org/C/#globaleventhandlers
 interface mixin GlobalEventHandlers {
   attribute EventHandler onabort;
-  [RuntimeEnabled=FilteringPrimitives] attribute EventHandler onbeforefilter;
   attribute EventHandler onbeforeinput;
   attribute EventHandler onbeforematch;
   attribute EventHandler onbeforetoggle;
@@ -61,6 +60,7 @@ interface mixin GlobalEventHandlers {
   attribute EventHandler onemptied;
   attribute EventHandler onended;
   attribute OnErrorEventHandler onerror;
+  [RuntimeEnabled=FencedFramesLocalUnpartitionedDataAccess] attribute EventHandler onfencedtreeclick;
   attribute EventHandler onfocus;
   attribute EventHandler onformdata;
   attribute EventHandler oninput;

tools/under-control/src/third_party/blink/renderer/core/dom/interest_invoker_element.idl

@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+[RuntimeEnabled=HTMLInterestForAttribute]
 interface mixin InterestInvokerElement {
   [CEReactions,Reflect=interestfor] attribute Element? interestForElement;
 };

tools/under-control/src/third_party/blink/renderer/core/events/event_type_names.json5

@@ -42,7 +42,6 @@
     "beforecopy",
     "beforecreatepolicy",
     "beforecut",
-    "beforefilter",
     "beforeinput",
     "beforeinstallprompt",
     "beforematch",
@@ -131,6 +130,7 @@
     "error",
     "eventtimingbufferfull",
     "exit",
+    "fencedtreeclick",
     "fetch",
     "finish",
     "focus",

tools/under-control/src/third_party/blink/renderer/core/events/interest_event.idl

@@ -2,8 +2,10 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-[Exposed=Window]
-interface InterestEvent : Event {
+[
+    RuntimeEnabled=HTMLInterestForAttribute,
+    Exposed=Window
+] interface InterestEvent : Event {
     constructor(DOMString type, optional InterestEventInit eventInitDict = {});
     readonly attribute Element? source;
 };

tools/under-control/src/third_party/blink/renderer/core/exported/web_view_impl.cc

@@ -141,6 +141,7 @@
 #include "third_party/blink/renderer/core/inspector/dev_tools_emulator.h"
 #include "third_party/blink/renderer/core/layout/layout_embedded_content.h"
 #include "third_party/blink/renderer/core/layout/layout_view.h"
+#include "third_party/blink/renderer/core/layout/text_autosizer.h"
 #include "third_party/blink/renderer/core/loader/document_loader.h"
 #include "third_party/blink/renderer/core/loader/frame_load_request.h"
 #include "third_party/blink/renderer/core/loader/frame_loader.h"
@@ -237,6 +238,11 @@ static const float minScaleChangeToTriggerZoom = 1.5f;
 static const float leftBoxRatio = 0.3f;
 static const int caretPadding = 10;
 
+#if !BUILDFLAG(IS_ANDROID) && !BUILDFLAG(IS_IOS)
+static constexpr base::TimeDelta kWindowingControlsChangeTimeout =
+    base::Seconds(5);
+#endif
+
 namespace blink {
 
 using mojom::blink::EffectiveConnectionType;
@@ -356,25 +362,26 @@ void ApplyCommandLineToSettings(WebSettings* settings) {
         WebSettings::SelectionStrategyType::kDirection);
   }
 
-  String network_quiet_timeout(
+  WebString network_quiet_timeout = WebString::FromUTF8(
       command_line.GetSwitchValueASCII(switches::kNetworkQuietTimeout));
-  if (!network_quiet_timeout.empty()) {
-    auto network_quiet_timeout_seconds = StringToDouble(network_quiet_timeout);
+  if (!network_quiet_timeout.IsEmpty()) {
+    auto network_quiet_timeout_seconds =
+        StringToDouble(String(network_quiet_timeout));
     if (network_quiet_timeout_seconds) {
       settings->SetNetworkQuietTimeout(*network_quiet_timeout_seconds);
     }
   }
 
   if (command_line.HasSwitch(switches::kBlinkSettings)) {
-    String command_line_settings(
-        command_line.GetSwitchValueASCII(switches::kBlinkSettings));
+    String command_line_settings =
+        command_line.GetSwitchValueASCII(switches::kBlinkSettings).c_str();
     Vector<StringView> blink_settings =
         StringView(command_line_settings).SplitSkippingEmpty(',');
     for (const StringView& setting : blink_settings) {
       wtf_size_t pos = setting.find('=');
       settings->SetFromStrings(
           WebString(setting.substr(0, pos).ToString()),
-          WebString(pos == kNotFound ? g_empty_string
+          WebString(pos == kNotFound ? ""
                                      : setting.substr(pos + 1).ToString()));
     }
   }
@@ -761,7 +768,7 @@ float WebViewImpl::MaximumLegiblePageScale() const {
   // Allow the user to always zoom more on Chrome Android.. Allow on WebView if
   // the Java developer has enabled autosizing.
   const bool is_webview = settings.GetWideViewportQuirkEnabled();
-  if (!is_webview) {
+  if (!is_webview || settings.GetTextAutosizingEnabled()) {
     return maximum_legible_scale_ * settings.GetAccessibilityFontScaleFactor();
   }
 
@@ -1323,29 +1330,28 @@ void WebViewImpl::ResizeViewWhileAnchored(
     const gfx::Size& visible_viewport_size) {
   DCHECK(MainFrameImpl());
 
-  const bool old_viewport_shrink = GetBrowserControls().ShrinkViewport();
-  const float old_controls_height = GetBrowserControls().TotalHeight();
+  bool old_viewport_shrink = GetBrowserControls().ShrinkViewport();
 
   GetBrowserControls().SetParams(params);
 
-  if (old_viewport_shrink != GetBrowserControls().ShrinkViewport()) {
+  if (old_viewport_shrink != GetBrowserControls().ShrinkViewport())
     MainFrameImpl()->GetFrameView()->DynamicViewportUnitsChanged();
-  }
-  if (!GetBrowserControls().ShrinkViewport() &&
-      old_controls_height != GetBrowserControls().TotalHeight()) {
-    MainFrameImpl()->GetFrameView()->LargeViewportUnitsChanged();
-  }
 
   if (GetPage()->GetSettings().GetDynamicSafeAreaInsetsEnabled()) {
     GetPage()->UpdateSafeAreaInsetWithBrowserControls(GetBrowserControls(),
                                                       /* force_update= */ true);
   }
 
-  LocalFrameView* frame_view = MainFrameImpl()->GetFrameView();
-  gfx::Size old_size = frame_view->Size();
-  UpdateICBAndResizeViewport(visible_viewport_size);
-  if (old_size != frame_view->Size()) {
-    frame_view->InvalidateLayoutForViewportConstrainedObjects();
+  {
+    // Avoids unnecessary invalidations while various bits of state in
+    // TextAutosizer are updated.
+    TextAutosizer::DeferUpdatePageInfo defer_update_page_info(GetPage());
+    LocalFrameView* frame_view = MainFrameImpl()->GetFrameView();
+    gfx::Size old_size = frame_view->Size();
+    UpdateICBAndResizeViewport(visible_viewport_size);
+    if (old_size != frame_view->Size()) {
+      frame_view->InvalidateLayoutForViewportConstrainedObjects();
+    }
   }
 
   fullscreen_controller_->UpdateSize();
@@ -1725,7 +1731,7 @@ void WebView::ApplyWebPreferences(const web_pref::WebPreferences& prefs,
                                       prefs.default_maximum_page_scale_factor);
 
   settings->SetFullscreenSupported(prefs.fullscreen_supported);
-  settings->SetTextSizeAdjustEnabled(prefs.text_size_adjust_enabled);
+  settings->SetTextAutosizingEnabled(prefs.text_autosizing_enabled);
   settings->SetDoubleTapToZoomEnabled(prefs.double_tap_to_zoom_enabled);
   blink::WebNetworkStateNotifier::SetNetworkQualityWebHoldback(
       static_cast<blink::WebEffectiveConnectionType>(
@@ -1734,7 +1740,6 @@ void WebView::ApplyWebPreferences(const web_pref::WebPreferences& prefs,
   settings->SetDontSendKeyEventsToJavascript(
       prefs.dont_send_key_events_to_javascript);
   settings->SetWebAppScope(WebString::FromAscii(prefs.web_app_scope.spec()));
-  settings->SetIsInitialProfile(prefs.is_initial_profile);
 
 #if BUILDFLAG(IS_ANDROID)
   settings->SetAllowCustomScrollbarInMainFrame(false);
@@ -1742,6 +1747,7 @@ void WebView::ApplyWebPreferences(const web_pref::WebPreferences& prefs,
   settings->SetAccessibilityFontWeightAdjustment(prefs.font_weight_adjustment);
   settings->SetAccessibilityTextSizeContrastFactor(
       prefs.text_size_contrast_factor);
+  settings->SetDeviceScaleAdjustment(prefs.device_scale_adjustment);
   web_view_impl->SetIgnoreViewportTagScaleLimits(prefs.force_enable_zoom);
   settings->SetDefaultVideoPosterURL(
       WebString::FromAscii(prefs.default_video_poster_url.spec()));
@@ -1823,8 +1829,6 @@ void WebView::ApplyWebPreferences(const web_pref::WebPreferences& prefs,
 
   settings->SetMediaControlsEnabled(prefs.media_controls_enabled);
 
-  settings->SetHighlightAds(prefs.highlight_ads);
-
   settings->SetLowPriorityIframesThreshold(
       static_cast<blink::WebEffectiveConnectionType>(
           prefs.low_priority_iframes_threshold));
@@ -1832,10 +1836,6 @@ void WebView::ApplyWebPreferences(const web_pref::WebPreferences& prefs,
   settings->SetPictureInPictureEnabled(prefs.picture_in_picture_enabled &&
                                        ::features::UseSurfaceLayerForVideo());
 
-  settings->SetImmersiveVideoPlaybackEnabled(
-      prefs.immersive_video_playback_enabled &&
-      ::features::UseSurfaceLayerForVideo());
-
   settings->SetRootScrollbarThemeColor(prefs.root_scrollbar_theme_color);
   settings->SetLazyLoadEnabled(prefs.lazy_load_enabled);
   settings->SetInForcedColors(prefs.in_forced_colors);
@@ -2267,10 +2267,8 @@ void WebViewImpl::ComputeScaleAndScrollForEditableElementRects(
       MainFrameImpl()->GetFrame()->View()->GetScrollableArea();
 
   // If the caret is offscreen, then animate.
-  if (!root_viewport->VisibleContentRect(kExcludeScrollbars)
-           .Contains(caret_bounds_in_content)) {
+  if (!root_viewport->VisibleContentRect().Contains(caret_bounds_in_content))
     need_animation = true;
-  }
 
   // If the box is partially offscreen and it's possible to bring it fully
   // onscreen, then animate.
@@ -2278,10 +2276,8 @@ void WebViewImpl::ComputeScaleAndScrollForEditableElementRects(
           element_bounds_in_content.width() &&
       visual_viewport.VisibleRect().height() >=
           element_bounds_in_content.height() &&
-      !root_viewport->VisibleContentRect(kExcludeScrollbars)
-           .Contains(element_bounds_in_content)) {
+      !root_viewport->VisibleContentRect().Contains(element_bounds_in_content))
     need_animation = true;
-  }
 
   if (!need_animation)
     return;
@@ -2765,6 +2761,11 @@ void WebViewImpl::DispatchPersistedPageshow(base::TimeTicks navigation_start) {
         performance->AddBackForwardCacheRestoration(
             navigation_start, pageshow_start_time, pageshow_end_time);
       }
+      if (frame->IsOutermostMainFrame()) {
+        UMA_HISTOGRAM_BOOLEAN(
+            "BackForwardCache.MainFrameHasPageshowListenersOnRestore",
+            window->HasEventListeners(event_type_names::kPageshow));
+      }
     }
   }
 }
@@ -2998,6 +2999,8 @@ void WebViewImpl::UpdatePageDefinedViewportConstraints(
   }
 
   UpdateMainFrameLayoutSize();
+
+  TextAutosizer::UpdatePageInfoInAllFrames(GetPage()->MainFrame());
 }
 
 void WebViewImpl::UpdateMainFrameLayoutSize() {
@@ -3140,40 +3143,178 @@ void WebViewImpl::DidChangeBackgroundColor(SkColor4f background_color,
 }
 
 #if !BUILDFLAG(IS_ANDROID) && !BUILDFLAG(IS_IOS)
+// TODO(https://crbug.com/40946306): Add timeouts to the callbacks and consider
+// queuing requests instead of rejecting them.
 void WebViewImpl::Minimize(WindowingControlsChangeCallback callback) {
   DCHECK(local_main_frame_host_remote_);
-  CHECK(MainFrameImpl()->IsOutermostMainFrame());
-  if (MainFrameViewWidget()->MinimizeRequested(std::move(callback))) {
+  if (window_show_state_change_callback_.has_value()) {
+    std::move(callback).Run(/*succeeded=*/false);
+  } else {
+    uint64_t id = base::RandUint64();
+    window_show_state_change_callback_.emplace(
+        id, WindowShowStateChangeType::kMinimize, std::move(callback));
     local_main_frame_host_remote_->Minimize();
+    PostDelayedRejectionForAWCPromise(id);
   }
 }
 
 void WebViewImpl::Maximize(WindowingControlsChangeCallback callback) {
   DCHECK(local_main_frame_host_remote_);
-  CHECK(MainFrameImpl()->IsOutermostMainFrame());
-  if (MainFrameViewWidget()->MaximizeRequested(std::move(callback))) {
+  if (window_show_state_change_callback_.has_value()) {
+    std::move(callback).Run(/*succeeded=*/false);
+  } else {
+    uint64_t id = base::RandUint64();
+    window_show_state_change_callback_.emplace(
+        id, WindowShowStateChangeType::kMaximize, std::move(callback));
     local_main_frame_host_remote_->Maximize();
+    PostDelayedRejectionForAWCPromise(id);
   }
 }
 
 void WebViewImpl::Restore(WindowingControlsChangeCallback callback) {
   DCHECK(local_main_frame_host_remote_);
-  CHECK(MainFrameImpl()->IsOutermostMainFrame());
-  if (MainFrameViewWidget()->RestoreRequested(std::move(callback))) {
+  if (window_show_state_change_callback_.has_value()) {
+    std::move(callback).Run(/*succeeded=*/false);
+  } else {
+    uint64_t id = base::RandUint64();
+    window_show_state_change_callback_.emplace(
+        id, WindowShowStateChangeType::kRestore, std::move(callback));
     local_main_frame_host_remote_->Restore();
+    PostDelayedRejectionForAWCPromise(id);
   }
 }
 
 void WebViewImpl::SetResizable(bool resizable,
                                WindowingControlsChangeCallback callback) {
   DCHECK(local_main_frame_host_remote_);
-  CHECK(MainFrameImpl()->IsOutermostMainFrame());
-  if (MainFrameViewWidget()->SetResizableRequested(resizable,
-                                                   std::move(callback))) {
-    local_main_frame_host_remote_->SetResizable(resizable);
+  if (set_resizable_change_callback_.has_value()) {
+    // Reject the current request if there's already a pending request.
+    std::move(callback).Run(/*succeeded=*/false);
+  } else {
+    if (web_widget_->Resizable() == resizable) {
+      // The desired resizable property is already set. We still need to mark
+      // what resizable value has been requested by the page.
+      local_main_frame_host_remote_->SetResizable(resizable);
+      std::move(callback).Run(/*succeeded=*/true);
+    } else {
+      // We need to wait for the window resizable property to be changed by the
+      // operating system.
+      uint64_t id = base::RandUint64();
+      set_resizable_change_callback_.emplace(id, resizable,
+                                             std::move(callback));
+      local_main_frame_host_remote_->SetResizable(resizable);
+      PostDelayedRejectionForAWCPromise(id);
+    }
   }
 }
 
+void WebViewImpl::OnWindowShowStateChanged(
+    ui::mojom::blink::WindowShowState old_state,
+    ui::mojom::blink::WindowShowState new_state) {
+  if (!RuntimeEnabledFeatures::
+          DesktopPWAsAdditionalWindowingControlsEnabled()) {
+    return;
+  }
+
+  CHECK_NE(old_state, new_state);
+  using ui::mojom::blink::WindowShowState;
+  switch (new_state) {
+    case WindowShowState::kDefault:
+    case WindowShowState::kNormal:
+      WasRestored();
+      break;
+    case WindowShowState::kMinimized:
+      WasMinimized();
+      break;
+    case WindowShowState::kMaximized:
+      WasMaximized();
+      if (old_state == WindowShowState::kMinimized ||
+          old_state == WindowShowState::kFullscreen) {
+        WasRestored();
+      }
+      break;
+    case WindowShowState::kInactive:
+    case WindowShowState::kFullscreen:
+    case WindowShowState::kEnd:
+      break;
+  }
+}
+
+void WebViewImpl::OnResizableChanged(bool new_resizable) {
+  if (!RuntimeEnabledFeatures::
+          DesktopPWAsAdditionalWindowingControlsEnabled()) {
+    return;
+  }
+
+  if (set_resizable_change_callback_.has_value() &&
+      set_resizable_change_callback_->requested_resizable == new_resizable) {
+    std::move(set_resizable_change_callback_->callback).Run(/*succeeded=*/true);
+    set_resizable_change_callback_.reset();
+  }
+}
+
+void WebViewImpl::WasMaximized() {
+  HandleWindowShowStateChangeCallbackWith(WindowShowStateChangeType::kMaximize);
+}
+
+void WebViewImpl::WasMinimized() {
+  if (MainFrameWidget()) {
+    // Ensure the display-state CSS property is set correctly
+    MainFrameWidget()->UpdateLifecycle(WebLifecycleUpdate::kLayout,
+                                       DocumentUpdateReason::kComputedStyle);
+  }
+  for (Frame* frame = GetPage()->MainFrame(); frame;
+       frame = frame->Tree().TraverseNext()) {
+    if (auto* local_frame = DynamicTo<LocalFrame>(frame)) {
+      if (Document* document = local_frame->GetDocument()) {
+        // If the window is minimized, the MediaQueryList change events will be
+        // throttled. To ensure the listeners for `(display-state: minimized)`
+        // change will get executed, we need to dispatch them instead of
+        // enqueuing.
+        document->DispatchMediaQueryListEvents();
+      }
+    }
+  }
+  HandleWindowShowStateChangeCallbackWith(WindowShowStateChangeType::kMinimize);
+}
+
+void WebViewImpl::WasRestored() {
+  HandleWindowShowStateChangeCallbackWith(WindowShowStateChangeType::kRestore);
+}
+
+void WebViewImpl::HandleWindowShowStateChangeCallbackWith(
+    WindowShowStateChangeType type) {
+  if (window_show_state_change_callback_.has_value() &&
+      window_show_state_change_callback_->requested_action == type) {
+    std::move(window_show_state_change_callback_->callback)
+        .Run(/*succeeded=*/true);
+    window_show_state_change_callback_.reset();
+  }
+}
+
+void WebViewImpl::PostDelayedRejectionForAWCPromise(uint64_t id) {
+  GetPage()
+      ->GetAgentGroupScheduler()
+      .DefaultTaskRunner()
+      ->PostNonNestableDelayedTask(
+          FROM_HERE,
+          BindOnce(&WebViewImpl::RejectAWCPromise, Unretained(this), id),
+          kWindowingControlsChangeTimeout);
+}
+
+void WebViewImpl::RejectAWCPromise(uint64_t id) {
+  if (window_show_state_change_callback_.has_value() &&
+      window_show_state_change_callback_->id == id) {
+    std::move(window_show_state_change_callback_->callback)
+        .Run(/*succeeded=*/false);
+    window_show_state_change_callback_.reset();
+  } else if (set_resizable_change_callback_.has_value() &&
+             set_resizable_change_callback_->id == id) {
+    std::move(set_resizable_change_callback_->callback)
+        .Run(/*succeeded=*/false);
+    set_resizable_change_callback_.reset();
+  }
+}
 #endif  // !BUILDFLAG(IS_ANDROID) && !BUILDFLAG(IS_IOS)
 
 void WebViewImpl::UpdateTargetURL(const WebURL& url,
@@ -3474,12 +3615,12 @@ void WebViewImpl::UpdateFontRenderingFromRendererPrefs() {
       gfx::FontRenderParams::SUBPIXEL_RENDERING_NONE);
   WebFontRenderStyle::SetSubpixelPositioning(
       renderer_preferences_.use_subpixel_positioning);
-#if BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_CHROMEOS)
+#if BUILDFLAG(IS_LINUX)
   if (!renderer_preferences_.system_font_family_name.empty()) {
-    WebFontRenderStyle::SetSystemFontFamily(blink::WebString::FromUtf8(
+    WebFontRenderStyle::SetSystemFontFamily(blink::WebString::FromUTF8(
         renderer_preferences_.system_font_family_name));
   }
-#endif  // BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_CHROMEOS)
+#endif  // BUILDFLAG(IS_LINUX)
 #endif  // BUILDFLAG(IS_WIN)
 #endif  // !BUILDFLAG(IS_MAC)
 }
@@ -3550,12 +3691,6 @@ void WebViewImpl::ActivatePrerenderedPage(
   std::move(callback).Run();
 }
 
-void WebViewImpl::UpgradePrerenderUntilScriptToFullPrerender() {
-  TRACE_EVENT0("navigation",
-               "WebViewImpl::UpgradePrerenderUntilScriptToFullPrerender");
-  GetPage()->UpgradePrerenderUntilScriptToFullPrerender();
-}
-
 void WebViewImpl::RegisterRendererPreferenceWatcher(
     CrossVariantMojoRemote<mojom::RendererPreferenceWatcherInterfaceBase>
         watcher) {
@@ -3583,6 +3718,7 @@ void WebViewImpl::UpdateRendererPreferences(
     observer.OnRendererPreferencesUpdated(preferences);
   }
 
+  WebThemeEngineHelper::DidUpdateRendererPreferences(preferences);
   UpdateFontRenderingFromRendererPrefs();
 
   blink::SetCaretBlinkInterval(
@@ -3709,7 +3845,7 @@ void WebViewImpl::UpdateWebPreferences(
     web_preferences_.default_maximum_page_scale_factor = 1.f;
     web_preferences_.shrinks_viewport_contents_to_fit = false;
     web_preferences_.main_frame_resizes_are_orientation_changes = false;
-    web_preferences_.text_size_adjust_enabled = false;
+    web_preferences_.text_autosizing_enabled = false;
 
     // Insecure content should not be allowed in a fenced frame.
     web_preferences_.allow_running_insecure_content = false;
@@ -3871,6 +4007,12 @@ void WebViewImpl::OutermostMainFrameScrollOffsetChanged() {
   }
 }
 
+void WebViewImpl::TextAutosizerPageInfoChanged(
+    const mojom::blink::TextAutosizerPageInfo& page_info) {
+  DCHECK(MainFrameImpl());
+  local_main_frame_host_remote_->TextAutosizerPageInfoChanged(
+      page_info.Clone());
+}
 
 void WebViewImpl::SetBackgroundColorOverrideForFullscreenController(
     std::optional<SkColor> optional_color) {

tools/under-control/src/third_party/blink/renderer/core/frame/scroll_result.idl

@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+// TODO(crbug.com/41406914): Update this interface when spec'd.
+
 dictionary ScrollResult {
-    boolean interrupted = false;
 };

tools/under-control/src/third_party/blink/renderer/core/frame/settings.json5

@@ -177,14 +177,6 @@
       name: "shouldClearDocumentBackground",
       initial: true,
     },
-    // Toggled via DevTools. Final highlighting is active if either this
-    // or the global `HighlightAds` (toggled via the internals page) is true.
-    // Both share the "HighlightAds" invalidation type for convenience.
-    {
-      name: "InspectorHighlightAds",
-      initial: false,
-      invalidate: ["HighlightAds"],
-    },
     {
       name: "HighlightAds",
       initial: false,
@@ -280,11 +272,6 @@
       type: "String",
     },
 
-    {
-      name: "isInitialProfile",
-      initial: false,
-    },
-
     {
       name: "presentationRequiresUserGesture",
       initial: true,
@@ -302,12 +289,6 @@
       initial: false,
     },
 
-    // Whether immersive video playback is enabled (eg, on Android XR).
-    {
-      name: "immersiveVideoPlaybackEnabled",
-      initial: false,
-    },
-
     // Only affects main thread scrolling
     {
       name: "scrollAnimatorEnabled",
@@ -550,7 +531,7 @@
     {
       name: "accessibilityFontScaleFactor",
       initial: "1.0",
-      invalidate: ["FontScaleFactor"],
+      invalidate: ["TextAutosizing", "FontScaleFactor"],
       type: "double",
     },
 
@@ -712,6 +693,16 @@
       initial: false,
     },
 
+    // Compensates for poor text legibility on mobile devices. This value is
+    // multiplied by the font scale factor when performing text autosizing of
+    // websites that do not set an explicit viewport description.
+    {
+      name: "deviceScaleAdjustment",
+      initial: "1.0",
+      invalidate: ["TextAutosizing"],
+      type: "double",
+    },
+
     // This value is set to false if the platform does not support fullscreen.
     // When set to false all the requests to enter fullscreen will return an error
     // (fullscreenerror or webkitfullscreenerror) as specified in the standard:
@@ -870,47 +861,38 @@
     {
       name: "textTrackBackgroundColor",
       type: "String",
-      invalidate: ["TextTrackStyle"],
     },
     {
       name: "textTrackFontFamily",
       type: "String",
-      invalidate: ["TextTrackStyle"],
     },
     {
       name: "textTrackFontStyle",
       type: "String",
-      invalidate: ["TextTrackStyle"],
     },
     {
       name: "textTrackFontVariant",
       type: "String",
-      invalidate: ["TextTrackStyle"],
     },
     {
       name: "textTrackTextColor",
       type: "String",
-      invalidate: ["TextTrackStyle"],
     },
     {
       name: "textTrackTextShadow",
       type: "String",
-      invalidate: ["TextTrackStyle"],
     },
     {
       name: "textTrackTextSize",
       type: "String",
-      invalidate: ["TextTrackStyle"],
     },
     {
       name: "textTrackWindowColor",
       type: "String",
-      invalidate: ["TextTrackStyle"],
     },
     {
       name: "textTrackWindowRadius",
       type: "String",
-      invalidate: ["TextTrackStyle"],
     },
 
     // Margin for title-safe placement of cues with overscan, gives top and bottom margin size as
@@ -1258,11 +1240,19 @@
       name: "bypassCSP",
       initial: false,
     },
-    // Enables the text-size-adjust CSS property.
+    // Enables automatic adjustments of text size on mobile. This enables the
+    // text autosizer, and controls whether text-size-adjust can apply.
     {
-      name: "textSizeAdjustEnabled",
+      name: "textAutosizingEnabled",
       initial: false,
-      invalidate: ["Style"],
+      invalidate: ["TextAutosizing"],
+    },
+    // Only set by web tests, and only used if textAutosizingEnabled is true.
+    {
+      name: "textAutosizingWindowSizeOverride",
+      invalidate: ["TextAutosizing"],
+      type: "gfx::Size",
+      include_paths: ["ui/gfx/geometry/size.h"],
     },
     {
       name: "WebXRImmersiveArAllowed",

tools/under-control/src/third_party/blink/renderer/core/frame/window_event_handlers.idl

@@ -37,7 +37,7 @@ interface mixin WindowEventHandlers {
   attribute EventHandler onlanguagechange;
   attribute EventHandler onmessage;
   attribute EventHandler onmessageerror;
-  [RuntimeEnabled=DesktopPWAsAdditionalWindowingControlsOnMove] attribute EventHandler onmove;
+  [RuntimeEnabled=DesktopPWAsAdditionalWindowingControls] attribute EventHandler onmove;
   attribute EventHandler onoffline;
   attribute EventHandler ononline;
   attribute EventHandler onpagehide;

tools/under-control/src/third_party/blink/renderer/core/geolocation/geolocation_position.idl

@@ -31,5 +31,6 @@
 ] interface GeolocationPosition {
     readonly attribute GeolocationCoordinates coords;
     readonly attribute EpochTimeStamp timestamp;
+    [RuntimeEnabled=ApproximateGeolocationWebVisibleAPI] readonly attribute AccuracyMode accuracyMode;
     [CallWith=ScriptState] object toJSON();
 };

tools/under-control/src/third_party/blink/renderer/core/html/custom/element_internals.idl

@@ -39,6 +39,6 @@ interface ElementInternals {
 
   // Platform-provided behaviors.
   // https://github.com/MicrosoftEdge/MSEdgeExplainers/blob/main/PlatformProvidedBehaviors/explainer.md
-  [RuntimeEnabled=ElementInternalsBehaviors, MeasureAs=ElementInternalsBehaviorsAccess] readonly attribute FrozenArray<ElementBehavior> behaviors;
+  [RuntimeEnabled=ElementInternalsBehaviors] readonly attribute FrozenArray<ElementBehavior> behaviors;
 };
 

tools/under-control/src/third_party/blink/renderer/core/html/fenced_frame/fence.idl

@@ -11,4 +11,6 @@ interface Fence {
     [RaisesException] void reportEvent(ReportEventType event);
     [RaisesException] void setReportEventDataForAutomaticBeacons(FenceEvent event);
     [RaisesException] sequence<FencedFrameConfig> getNestedConfigs();
+    [CallWith=ScriptState, RaisesException, RuntimeEnabled=FencedFramesLocalUnpartitionedDataAccess, MeasureAs=FencedFrameDisableUntrustedNetwork] Promise<undefined> disableUntrustedNetwork();
+    [RaisesException, RuntimeEnabled=FencedFramesLocalUnpartitionedDataAccess, MeasureAs=FencedFrameNotifyEvent] void notifyEvent(Event triggering_event);
 };

tools/under-control/src/third_party/blink/renderer/core/html/forms/html_submit_button_behavior.idl

@@ -10,7 +10,7 @@
   RuntimeEnabled=ElementInternalsBehaviors
 ]
 interface HTMLSubmitButtonBehavior : ElementBehavior {
-  [MeasureAs=HTMLSubmitButtonBehaviorUsage] constructor();
+  [CallWith=ExecutionContext] constructor();
 
   attribute boolean disabled;
   [RaisesException] readonly attribute HTMLFormElement? form;

tools/under-control/src/third_party/blink/renderer/core/html/html_element.idl

@@ -73,10 +73,6 @@
     [MeasureAs=ElementHidePopover,RaisesException] void hidePopover();
     [CEReactions,Reflect,ReflectOnly=("auto","hint","manual"),ReflectEmpty="auto",ReflectInvalid="manual"] attribute DOMString? popover;
 
-    // Overscroll API
-    [RuntimeEnabled=OverscrollGestures,CEReactions,Reflect,ReflectOnly=("auto", "overlay"),ReflectEmpty="auto",ReflectInvalid="auto"] attribute DOMString? overscrollcontainer;
-    [RuntimeEnabled=OverscrollGestures,CEReactions,Reflect,ReflectOnly=("auto"),ReflectEmpty="auto",ReflectInvalid="auto"] attribute DOMString? overscrollarea;
-
     // Non-standard APIs
     [CEReactions, RaisesException=Setter, MeasureAs=HTMLElementInnerText, ImplementedAs=innerTextForBinding] attribute ([LegacyNullToEmptyString] DOMString or TrustedScript) innerText;
     [CEReactions, RaisesException=Setter, MeasureAs=HTMLElementOuterText] attribute [LegacyNullToEmptyString] DOMString outerText;
@@ -86,5 +82,5 @@
 
 HTMLElement includes GlobalEventHandlers;
 HTMLElement includes DocumentAndElementEventHandlers;
-HTMLElement includes HTMLOrSVGOrMathMLElement;
+HTMLElement includes HTMLOrForeignElement;
 HTMLElement includes ElementCSSInlineStyle;

tools/under-control/src/third_party/blink/renderer/core/html/html_geolocation_element.idl

@@ -14,17 +14,17 @@ enum PermissionState {
 // 
 // https://wicg.github.io/PEPC/permission-elements.html#permission-mixin
 interface mixin InPagePermissionMixin {
-  [MeasureAs=CapabilityElementIsValid] readonly attribute boolean isValid;
+  readonly attribute boolean isValid;
   // TODO(https://crbug.com/461543463): This should be
   // `InPagePermissionMixinBlockerReason`, but that will require changing
   // `HTMLPermissionElement` too.
-  [MeasureAs=CapabilityElementInvalidReason] readonly attribute DOMString invalidReason;
-  [MeasureAs=CapabilityElementInitialPermissionStatus] readonly attribute PermissionState initialPermissionStatus;
-  [MeasureAs=CapabilityElementPermissionStatus] readonly attribute PermissionState permissionStatus;
+  readonly attribute DOMString invalidReason;
+  readonly attribute PermissionState initialPermissionStatus;
+  readonly attribute PermissionState permissionStatus;
 
-  [MeasureAs=CapabilityElementOnPromptAction] attribute EventHandler onpromptaction;
-  [MeasureAs=CapabilityElementOnPromptDismiss] attribute EventHandler onpromptdismiss;
-  [MeasureAs=CapabilityElementOnValidationStatusChange] attribute EventHandler onvalidationstatuschange;
+  attribute EventHandler onpromptaction;
+  attribute EventHandler onpromptdismiss;
+  attribute EventHandler onvalidationstatuschange;
 };
 
 // https://wicg.github.io/PEPC/permission-elements.html#geolocation-element

tools/under-control/src/third_party/blink/renderer/core/html/html_or_foreign_element.idl

@@ -3,7 +3,9 @@
 // found in the LICENSE file.
 
 // https://html.spec.whatwg.org/multipage/dom.html#htmlorsvgelement
-interface mixin HTMLOrSVGOrMathMLElement {
+// TODO(rwlbuis): update link after HTMLOrSVGElement to HTMLOrForeignElement renaming:
+// https://github.com/whatwg/html/issues/4702
+interface mixin HTMLOrForeignElement {
   [SameObject, PerWorldBindings] readonly attribute DOMStringMap dataset;
   [CEReactions] attribute DOMString nonce;
 

tools/under-control/src/third_party/blink/renderer/core/html/html_script_element.idl

@@ -32,7 +32,6 @@
     [CEReactions, RaisesException=Setter, GetterCallWith=ScriptState] attribute (TrustedScript or DOMString) text;
     [CEReactions, Reflect, ReflectOnly=("", "no-referrer", "no-referrer-when-downgrade", "same-origin", "origin", "strict-origin", "origin-when-cross-origin", "strict-origin-when-cross-origin", "unsafe-url"), ReflectMissing="", ReflectInvalid=""] attribute DOMString? referrerPolicy;
     [CEReactions, MeasureAs=PriorityHints, Reflect, ReflectOnly=("low", "auto", "high"), ReflectMissing="auto", ReflectInvalid="auto"] attribute DOMString fetchPriority;
-    [CEReactions, MeasureAs=CacheHintAttributeOnScript, Reflect, ReflectOnly=("eager", "default", "never"), ReflectMissing="default", ReflectInvalid="default", RuntimeEnabled=InlineScriptCacheHint] attribute DOMString cacheHint;
 
     // obsolete members
     // https://html.spec.whatwg.org/C/#HTMLScriptElement-partial

tools/under-control/src/third_party/blink/renderer/core/html/html_template_element.idl

@@ -45,7 +45,6 @@
     [CEReactions,Reflect] attribute boolean shadowRootDelegatesFocus;
     [CEReactions,Reflect] attribute boolean shadowRootClonable;
     [Reflect] attribute boolean shadowRootSerializable;
-    [CEReactions, Reflect, RuntimeEnabled=ShadowRootAdoptedStyleSheet] attribute DOMString shadowRootAdoptedStyleSheets;
 
     // Used by Scoped Element Registries
     [CEReactions, Reflect, RuntimeEnabled=ScopedCustomElementRegistry] attribute DOMString shadowRootCustomElementRegistry;

tools/under-control/src/third_party/blink/renderer/core/mathml/mathml_element.idl

@@ -8,5 +8,5 @@ interface MathMLElement : Element { };
 
 MathMLElement includes GlobalEventHandlers;
 MathMLElement includes DocumentAndElementEventHandlers;
-MathMLElement includes HTMLOrSVGOrMathMLElement;
+MathMLElement includes HTMLOrForeignElement;
 MathMLElement includes ElementCSSInlineStyle;

tools/under-control/src/third_party/blink/renderer/core/origin_trials/origin_trial_context.cc

@@ -87,7 +87,7 @@ String ExtractTokenOrQuotedString(const String& header_value, unsigned& pos) {
     while (pos < len && !IsWhitespace(header_value[pos]) &&
            header_value[pos] != ',')
       pos++;
-    result = header_value.substr(start_pos, pos - start_pos);
+    result = header_value.Substring(start_pos, pos - start_pos);
   }
   SkipWhiteSpace(header_value, pos);
   return result;
@@ -564,10 +564,6 @@ bool OriginTrialContext::CanEnableTrialFromName(const StringView& trial_name) {
   if (trial_name == "InstallElement") {
     return base::FeatureList::IsEnabled(blink::features::kInstallElement);
   }
-
-  if (trial_name == "WebMCP") {
-    return base::FeatureList::IsEnabled(blink::features::kWebMCP);
-  }
   return true;
 }
 

tools/under-control/src/third_party/blink/renderer/core/overscroll/overscroll_event.idl

@@ -8,6 +8,6 @@
 ] interface OverscrollEvent : Event {
   constructor(DOMString type, optional OverscrollEventInit eventInitDict = {});
   readonly attribute Element overscrollTarget;
-  readonly attribute boolean overscrolling;
+  readonly attribute boolean? overscrolling;
 };
 

tools/under-control/src/third_party/blink/renderer/core/overscroll/overscroll_event_init.idl

@@ -4,5 +4,5 @@
 
 dictionary OverscrollEventInit : EventInit {
   Element? overscrollTarget = null;
-  boolean overscrolling;
+  boolean? overscrolling;
 };

tools/under-control/src/third_party/blink/renderer/core/sanitizer/sanitizer_api.idl

@@ -20,8 +20,6 @@ interface Sanitizer {
   boolean allowElement(SanitizerElementWithAttributes element);
   boolean removeElement(SanitizerElement element);
   boolean replaceElementWithChildren(SanitizerElement element);
-  [RuntimeEnabled=HTMLProcessingInstruction] boolean allowProcessingInstruction(SanitizerPI pi);
-  [RuntimeEnabled=HTMLProcessingInstruction] boolean removeProcessingInstruction(SanitizerPI pi);
   boolean allowAttribute(SanitizerAttribute attribute);
   boolean removeAttribute(SanitizerAttribute attribute);
   undefined setComments(boolean allow);
@@ -46,11 +44,6 @@ dictionary SanitizerElementNamespaceWithAttributes : SanitizerElementNamespace {
 typedef (DOMString or SanitizerElementNamespace) SanitizerElement;
 typedef (DOMString or SanitizerElementNamespaceWithAttributes) SanitizerElementWithAttributes;
 
-dictionary SanitizerProcessingInstruction {
-  required DOMString target;
-};
-typedef (DOMString or SanitizerProcessingInstruction) SanitizerPI;
-
 dictionary SanitizerAttributeNamespace {
   required DOMString name;
   [ImplementedAs=namespaceURI] DOMString? _namespace = null;
@@ -62,9 +55,6 @@ dictionary SanitizerConfig {
   sequence<SanitizerElement> removeElements;
   sequence<SanitizerElement> replaceWithChildrenElements;
 
-  sequence<SanitizerPI> processingInstructions;
-  sequence<SanitizerPI> removeProcessingInstructions;
-
   sequence<SanitizerAttribute> attributes;
   sequence<SanitizerAttribute> removeAttributes;
 

tools/under-control/src/third_party/blink/renderer/core/script_tools/model_context.idl

@@ -6,38 +6,12 @@
 
 dictionary ModelContextRegisterToolOptions {
   AbortSignal signal;
-
-  // A list of origins, controlling which document in the frame tree can
-  // see/invoke this tool. See
-  // https://docs.google.com/document/d/1ycdzuXA-VE8lRDFSArh0Um3PChHV0Hq6Om1MSMG8qPE/edit
-  // for more details.
-  //
-  // In short:
-  //   1. When this array is empty or omitted, the tool is only exposed to
-  //      documents that are same-origin with the one that registered the tool.
-  //   2. When it is provided and non-empty, the tool is exposed to all
-  //      documents whose origin matches the one in the list. Additionally, it
-  //      is exposed to all same-origin documents, like (1) above.
-  sequence<USVString> exposedTo;
-};
-
-dictionary RegisteredTool : RegisteredToolDeprecated {
-  required Window window;
-  required USVString origin;
-  ToolAnnotations annotations;
 };
 
 [
     Exposed=Window,
     SecureContext,
     RuntimeEnabled=WebMCP
-] interface ModelContext : EventTarget {
+] interface ModelContext {
   [CallWith=ScriptState, RaisesException, MeasureAs=ModelContextRegisterTool] undefined registerTool(ModelContextTool tool, optional ModelContextRegisterToolOptions options = {});
-  [CallWith=ScriptState] Promise<sequence<RegisteredTool>> getTools();
-  [CallWith=ScriptState] Promise<DOMString?> executeTool(
-      RegisteredTool tool,
-      DOMString input_arguments,
-      optional ExecuteToolOptions options = {}
-  );
-  attribute EventHandler ontoolchange;
 };

tools/under-control/src/third_party/blink/renderer/core/script_tools/model_context_testing.idl

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-dictionary RegisteredToolDeprecated {
+dictionary RegisteredTool {
   required DOMString name;
   required DOMString description;
   DOMString inputSchema;
@@ -15,7 +15,7 @@ dictionary ExecuteToolOptions {
 [
     RuntimeEnabled=WebMCPTesting
 ] interface ModelContextTesting : EventTarget {
-  sequence<RegisteredToolDeprecated> listTools();
+  sequence<RegisteredTool> listTools();
   // Returns null when a navigation is triggered.
   [CallWith=ScriptState] Promise<DOMString?> executeTool(DOMString tool_name, DOMString input_arguments, optional ExecuteToolOptions options = {});
   [CallWith=ScriptState] Promise<DOMString> getCrossDocumentScriptToolResult();

tools/under-control/src/third_party/blink/renderer/core/script_tools/model_context_tool.idl

@@ -14,7 +14,6 @@ dictionary ModelContextTool {
 
 dictionary ToolAnnotations {
   boolean readOnlyHint = false;
-  boolean untrustedContentHint = false;
 };
 
 // The structure of `input` is expected to match the structure described in

tools/under-control/src/third_party/blink/renderer/core/svg/svg_element.idl

@@ -32,5 +32,5 @@ interface SVGElement : Element {
 
 SVGElement includes GlobalEventHandlers;
 SVGElement includes DocumentAndElementEventHandlers;
-SVGElement includes HTMLOrSVGOrMathMLElement;
+SVGElement includes HTMLOrForeignElement;
 SVGElement includes ElementCSSInlineStyle;

tools/under-control/src/third_party/blink/renderer/core/testing/internal_settings.idl

@@ -39,6 +39,7 @@ interface InternalSettings : InternalSettingsGenerated {
     void setCursiveFontFamily(DOMString family, DOMString script);
     void setFantasyFontFamily(DOMString family, DOMString script);
     void setMathFontFamily(DOMString family, DOMString script);
+    void setTextAutosizingWindowSizeOverride(long width, long height);
     [RaisesException] void setTextTrackKindUserPreference(DOMString preference);
     [RaisesException] void setDisplayModeOverride(DOMString displayModeOverride);
     [RaisesException] void setEditingBehavior(DOMString behavior);

tools/under-control/src/third_party/blink/renderer/core/testing/internals.idl

@@ -462,6 +462,11 @@ interface Internals {
     // failed. Returns element_locator format string.
     [CallWith=ScriptState] Promise<DOMString> LCPPrediction(Document document);
 
+    // Exempt `url` from fenced frames network revocation for the current
+    // NetworkContext. Intended to be used to allow remote context executors to
+    // continue functioning in fenced frame WPTs after network is revoked.
+    [CallWith=ScriptState] Promise<undefined> exemptUrlFromNetworkRevocation(USVString url);
+
     DOMString lastCompiledScriptFileName(Document document);
     boolean lastCompiledScriptUsedCodeCache(Document document);
 };

tools/under-control/src/third_party/blink/renderer/core/timing/performance.idl

@@ -76,9 +76,5 @@ interface Performance : EventTarget {
 
     [Exposed=Window, RuntimeEnabled=UserDefinedEntryPointTiming] Function bind(Function innerFunction, optional any thisArg, any... args);
 
-    // Speculation Measurement
-    // https://github.com/yoavweiss/speculative_load_measurement
-    [Exposed=Window, RuntimeEnabled=SpeculationMeasurement] SpeculationData getSpeculations();
-
     [CallWith=ScriptState, ImplementedAs=toJSONForBinding] object toJSON();
 };

tools/under-control/src/third_party/blink/renderer/core/timing/preload_data.idl

@@ -1,24 +0,0 @@
-// Copyright 2026 The Chromium Authors
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// https://github.com/yoavweiss/speculative_load_measurement
-
-// Represents the crossorigin attribute state for preloads.
-// "none" means no crossorigin attribute was set (no-cors mode).
-// "anonymous" means crossorigin="" or crossorigin="anonymous" (CORS with
-// same-origin credentials).
-// "use-credentials" means crossorigin="use-credentials" (CORS with included
-// credentials).
-enum CrossOriginMode { "none", "anonymous", "use-credentials" };
-
-[
-    RuntimeEnabled=SpeculationMeasurement,
-    Exposed=Window
-]
-interface PreloadData {
-    readonly attribute USVString url;
-    readonly attribute DOMString as;
-    readonly attribute CrossOriginMode crossorigin;
-    [CallWith=ScriptState] readonly attribute DOMHighResTimeStamp? used;
-};

tools/under-control/src/third_party/blink/renderer/core/timing/speculation_data.idl

@@ -1,13 +0,0 @@
-// Copyright 2026 The Chromium Authors
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// https://github.com/yoavweiss/speculative_load_measurement
-
-[
-    RuntimeEnabled=SpeculationMeasurement,
-    Exposed=Window
-]
-interface SpeculationData {
-    readonly attribute FrozenArray<PreloadData> preloads;
-};

tools/under-control/src/third_party/blink/renderer/modules/ai/language_model.idl

@@ -141,9 +141,6 @@ interface LanguageModel : EventTarget {
   ]
   readonly attribute float temperature;
 
-  [RuntimeEnabled=AIPromptAPIParams]
-  readonly attribute LanguageModelSamplingMode? samplingMode;
-
   // **DEPRECATED**: This legacy alias for oncontextoverflow will be removed.
   [
     RuntimeEnabled=AIPromptAPILegacyIdentifiers,

tools/under-control/src/third_party/blink/renderer/modules/ai/language_model_create_options.idl

@@ -37,8 +37,6 @@ enum LanguageModelMessageRole { "system", "user", "assistant" };
 enum LanguageModelMessageType { "text", "image", "audio", "tool-call", "tool-response" };
 // LINT.ThenChange(//third_party/blink/renderer/modules/ai/ai_metrics.h:LanguageModelInputType)
 
-enum LanguageModelSamplingMode { "most-predictable", "predictable", "balanced", "creative", "most-creative" };
-
 typedef (
   ImageBitmapSource
   or AudioBuffer
@@ -141,8 +139,6 @@ dictionary LanguageModelCreateCoreOptions {
   [RuntimeEnabled=AIPromptAPILegacyParams] unrestricted double topK;
   [RuntimeEnabled=AIPromptAPILegacyParams] unrestricted double temperature;
 
-  [RuntimeEnabled=AIPromptAPIParams] LanguageModelSamplingMode samplingMode;
-
   // The expected types and languages for the session.
   sequence<LanguageModelExpected> expectedInputs;
   sequence<LanguageModelExpected> expectedOutputs;

tools/under-control/src/third_party/blink/renderer/modules/clipboard/clipboard.idl

@@ -44,5 +44,5 @@ dictionary ClipboardReadOptions {
      RaisesException
     ] Promise<undefined> writeText(DOMString data);
 
-    attribute EventHandler onclipboardchange;
+    [RuntimeEnabled=ClipboardChangeEvent] attribute EventHandler onclipboardchange;
 };

tools/under-control/src/third_party/blink/renderer/modules/clipboard/clipboard_change_event.idl

@@ -4,7 +4,8 @@
 
 [
     Exposed=Window,
-    SecureContext
+    SecureContext,
+    RuntimeEnabled=ClipboardChangeEvent
 ] interface ClipboardChangeEvent : Event {
     constructor(optional ClipboardChangeEventInit eventInitDict = {});
     [MeasureAs=ClipboardChangeEventTypesAttribute] readonly attribute FrozenArray<DOMString> types;

tools/under-control/src/third_party/blink/renderer/modules/credentialmanagement/authentication_extensions_client_outputs.idl

@@ -28,7 +28,7 @@ dictionary AuthenticationExtensionsClientOutputs {
   [RuntimeEnabled=WebAuthenticationSupplementalPubKeys] AuthenticationExtensionsSupplementalPubKeysOutputs supplementalPubKeys;
 
   // Payment extension outputs support.
-  AuthenticationExtensionsPaymentOutputs payment;
+  [RuntimeEnabled=SecurePaymentConfirmationBrowserBoundKeys] AuthenticationExtensionsPaymentOutputs payment;
 
   // Pseudo-random function support.
   // https://w3c.github.io/webauthn/#prf-extension

tools/under-control/src/third_party/blink/renderer/modules/credentialmanagement/authentication_extensions_payment_inputs.idl

@@ -8,6 +8,6 @@ dictionary AuthenticationExtensionsPaymentInputs {
   boolean isPayment;
 
   // A sequence of public key credential creation parameters for the browser bound key.
-  sequence<PublicKeyCredentialParameters> browserBoundPubKeyCredParams;
+  [RuntimeEnabled=SecurePaymentConfirmationBrowserBoundKeys] sequence<PublicKeyCredentialParameters> browserBoundPubKeyCredParams;
 };