#486 Autorebase for 119.0.6045.106

Autorebase for 119.0.6045.106
AUTOMATED - git apply results
2023-11-01 12:03:07 +03:00 · 2023-11-01 08:54:48 +00:00 · 2023-11-01 09:49:45 +01:00 · 2023-11-01 11:47:12 +03:00 · 2023-10-31 17:54:21 +01:00 · 2023-10-31 17:52:38 +01:00
427 changed files with 458721 additions and 62971 deletions
@@ -1,89 +0,0 @@
---
-name: Bug report
-about: Create a Bromite bug report
-
---
-
-<!-- Welcome! Thanks for taking time to submit a bug report.
-Have you read the README? https://github.com/bromite/bromite/blob/master/README.md
-Have you searched the issue tracker? https://github.com/bromite/bromite/issues
-Are you sure this is not a Chromium bug? You have to test with Chromium before submitting a bug.
-Are you using the latest version of Bromite?
-
-If instead of a bug report you want to ask a question then please use the GitHub Discussions: https://github.com/bromite/bromite/discussions
-->
-
-### Bromite version
-
-Version: `89.0...`
-Arch: `arm` or `arm64` or `x86`
-Android version: (example: `9.0`)
-Device model: (example: `SM-G960UZKABST`)
-
-### Flags
-
-These are the flags changed under `chrome://flags`:
-
-<!-- Report all the blue-highlighted flags here, those are the flags with non-default configuration -->
-
-### Is this bug about the SystemWebView?
-
-<!-- No support for SystemWebView installations is provided. -->
-
-Yes/No
-
-### Is the bug reproducible with latest version?
-
-<!-- Do not report bugs which are not reproducible with latest version. -->
-
-Yes/No
-
-### Can the bug be reproduced with corresponding Chromium version?
-
-<!--
-Please pick the same version of Chromium as Bromite from here: https://github.com/bromite/chromium/releases
-If the bug is reproducible then it might be a configuration issue or an upstream bug. Upstream bugs can be reported on the [Chromium issue tracker](https://bugs.chromium.org/p/chromium/issues/list) and do not forget to read [Chromium project bug reporting guidelines](https://www.chromium.org/for-testers/bug-reporting-guidelines) first.
-
-If the bug is related to functionality that does not exist in Chromium then answer "No".
-->
-
-Yes/No
-
-### Is this bug happening in an incognito tab?
-Yes/No
-
-### Allow ads for the site; is the bug caused by the adblocker?
-Yes/No
-
-### Is the bug a crash?
-
-No
-
-- or --
-
-Yes, this is the crash dump:
-```
-<paste here logcat dump individuated with 'adb logcat | grep chromium'>
-```
-
-### Describe the bug
-
-<!-- Write here a clear and concise description of the bug. -->
-
-### Steps to reproduce the bug
-
-Steps to reproduce the bug:
-1. Go to '...'
-2. Click on '...'
-3. Scroll down to '...'
-4. See error
-
-Do not write "any website", specify which URLs can be used to reproduce the issue.
-
-### Expected behavior
-
-<!-- A clear and concise description of what you expected to happen. -->
-
-### Screenshots
-
-<!-- If applicable, add screenshots to help explain your problem. Otherwise remove this section. -->
@@ -0,0 +1,215 @@
+name: Bug report
+description: Create a Cromite bug report
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Welcome! Thanks for taking the time to submit a bug report.
+
+        If this is not a bug about the Cromite browser, or you are looking for a place to ask a question to the community,
+        then please use the [GitHub Discussions](https://github.com/uazo/cromite/discussions) instead.
+
+        Make sure you have acknowledged and completed this template before submitting your issue.
+
+        Please read it carefully: incorrect issues will be automatically closed and ignored.
+
+  - type: checkboxes
+    id: preliminary_checklist
+    attributes:
+      label: Preliminary checklist
+      options:
+        - label: "I have read the [README](https://github.com/uazo/cromite/blob/master/README.md)."
+          required: true
+        - label: "I have searched the existing issues for my problem. This is a new ticket, NOT a duplicate or related to another open issue."
+          required: true
+        - label: "I have read the [FAQs](https://github.com/uazo/cromite/blob/master/FAQ.md)."
+          required: true
+        - label: "I have updated Cromite to the latest version. The bug is reproducible on this latest version."
+          required: true
+        - label: "This is a bug report about the Cromite browser; not the website nor F-Droid nor anything else."
+          required: true
+
+  - type: dropdown
+    id: is_chromium
+    attributes:
+      label: Can the bug be reproduced with corresponding Chromium version?
+      description: |
+          Please pick the same version of Chromium as Cromite
+          If the bug is reproducible then it might be a configuration issue or an upstream bug. Upstream bugs can be reported on the [Chromium issue tracker](https://bugs.chromium.org/p/chromium/issues/list) and
+          do not forget to read [Chromium project bug reporting guidelines](https://www.chromium.org/for-testers/bug-reporting-guidelines) first.
+
+          If the bug is related to functionality that does not exist in Chromium then answer "No".
+      multiple: false
+      options:
+        - "Yes"
+        - "No"
+    validations:
+      required: true
+
+  - type: input
+    id: cromite_version
+    attributes:
+      label: Cromite version
+      description: What version of Cromite are you using? Please specify a single version e.g. `96.0.4664.1` not `latest`. If this is not the latest version then please update and retry before submitting this bug report.
+    validations:
+      required: true
+
+  - type: dropdown
+    id: device_architecture
+    attributes:
+      label: Device architecture
+      multiple: false
+      options:
+        - arm
+        - arm64
+        - arm64-v8a
+        - armeabi-v7a
+        - x86
+        - x64
+        - windows
+        - all
+    validations:
+      required: true
+
+  - type: dropdown
+    id: platform_version
+    attributes:
+      label: Platform version
+      multiple: false
+      description: What version of Android are you running?
+      options:
+        - Android 14
+        - Android 13
+        - Android 12.1
+        - Android 12.0
+        - Android 11
+        - Android 10
+        - Android 9
+        - Android 8.1
+        - Android 8.0
+        - Android 7.1
+        - Android 7.0
+        - Android Emulator
+        - Windows 10
+        - Windows 11
+        - I prefer not to write it/No matter
+    validations:
+      required: true
+
+  - type: input
+    id: device_model
+    attributes:
+      label: Android Device model
+      description: What is your device model? This can usually be found in your device's settings in the "About" section.
+      placeholder: (e.g. `OnePlus 8 (IN2010)`, or `SM-G960UZKABST`, etc.)
+    validations:
+      required: true
+
+  - type: dropdown
+    id: is_android_rooted
+    attributes:
+      label: Is the device rooted?
+      description: |
+          The information is important but not essential; it allows additional checks to be made.
+      multiple: false
+      options:
+        - "Yes"
+        - "No"
+        - "I prefer not to write it"
+    validations:
+      required: true
+      
+  - type: textarea
+    id: changed_flags
+    attributes:
+      label: Changed flags
+      description: |
+        These are the flags changed under `chrome://flags`.
+        Report all the flags with non-default configuration (they will be blue-highlighted).
+
+        If no flags are changed then write 'no flags changed'.
+      placeholder: show-overdraw-feedback, enable-parallel-downloading
+    validations:
+      required: true
+
+  - type: dropdown
+    id: is_incognito
+    attributes:
+      label: Is this bug happening in an incognito tab?
+      multiple: false
+      options:
+        - "Yes"
+        - "No"
+        - "Always Incognito Mode"
+    validations:
+      required: true
+
+  - type: dropdown
+    id: adblock
+    attributes:
+      label: Is this bug caused by the adblocker?
+      description: You can test this by temporarily allowing ads for the site.
+      multiple: false
+      options:
+        - "Yes"
+        - "No"
+    validations:
+      required: true
+
+  - type: textarea
+    id: bug_crash
+    attributes:
+      label: Is this bug a crash?
+      description: |
+        1. No.
+        2. Yes, I have attached the crash report dump that I downloaded from `chrome://crashes`
+        3. Yes, I have copy/pasted the crash dump
+      placeholder: |
+        Drag the crash report dump here to attach it or paste the logcat dump individuated with `adb logcat | grep -E '( cr_|cromite|chromium)'`.
+    validations:
+      required: true
+
+  - type: textarea
+    id: bug_description
+    attributes:
+      label: Describe the bug
+      description: Write a clear and concise description of the bug.
+    validations:
+      required: true
+
+  - type: textarea
+    id: bug_steps
+    attributes:
+      label: Steps to reproduce the bug
+      description: |
+        Explain how to cause the bug as clearly as possible. Bugs that are not reproducible cannot be investigated.
+
+        Also, do not write "any website": please specify which URLs can be used to reproduce the issue.
+      placeholder: |
+        Steps to reproduce the bug (e.g.):
+        1. Go to '...'
+        2. Click on '...'
+        3. Scroll down to '...'
+        4. See error
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected_behavior
+    attributes:
+      label: Expected behavior
+      description: A clear and concise description of what you expected to happen.
+    validations:
+      required: true
+
+  - type: textarea
+    id: screenshots
+    attributes:
+      label: Screenshots
+      description: |
+        If applicable, add screenshots to help explain your problem.
+        Otherwise, ignore this section.
+      placeholder: |
+        Drag the screenshot files here to attach them.
+    validations:
+      required: false
@@ -1,35 +0,0 @@
---
-name: Feature request
-about: Suggest a privacy-related idea for this project
-
---
-
-<!-- Welcome! Thanks for taking time to submit a feature request.
-Have you searched the issue tracker? https://github.com/bromite/bromite/issues
-Have you read the F.A.Q.s? https://github.com/bromite/bromite/blob/master/FAQ.md
-Have you read the README? https://github.com/bromite/bromite/blob/master/README.md
-Have you read the Wiki? https://github.com/bromite/bromite/wiki
-
-If instead of a feature request you want to ask a question then please use the GitHub Discussions: https://github.com/bromite/bromite/discussions
-
-->
-
-<!-- Do not submit feature requests for extensions support or adding a search engine. -->
-
-### Is your feature request related to privacy?
-
-<!-- Features that are not related to privacy are not considered. -->
-
-### Is there a patch available for this feature somewhere?
-
-<!-- If yes then provide URL and license information. -->
-
-### Describe the solution you would like
-
-<!-- A clear and concise description of what you want to happen.
-
-Do not ask "I would like feature X which is available in browser Y"; such issues are closed immediately. -->
-
-### Describe alternatives you have considered
-
-<!-- A clear and concise description of any alternative solutions or features you have considered. -->
@@ -0,0 +1,70 @@
+name: Feature request
+description: Create a Cromite feature request
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Welcome! Thanks for taking time to submit a feature request.
+
+        If this is not a feature request about the Cromite browser, or you are looking for a place
+        to ask a question to the community then please use the [GitHub Discussions](https://github.com/uazo/cromite/discussions) instead.
+
+        Make sure you have acknowledged and completed this template before submitting your issue.
+
+        Please read it carefully: incorrect issues will be automatically closed and ignored.
+
+        Note:
+          - Features unrelated to privacy will not be considered.
+          - Do not ask "I would like feature X which is available in browser Y."
+
+  - type: checkboxes
+    id: preliminary_checklist
+    attributes:
+      label: Preliminary checklist
+      options:
+        - label: "I have read the [README](https://github.com/uazo/cromite/blob/master/README.md)"
+          required: true
+        - label: "I have read the [FAQs](https://github.com/uazo/cromite/blob/master/FAQ.md)."
+          required: true
+        - label: "I have searched [existing issues](https://github.com/uazo/cromite/issues) for my feature request. This is a new issue (NOT a duplicate) and is not related to another issue."
+          required: true
+        - label: "I have searched [wont fix issues](https://github.com/uazo/cromite/issues?q=label%3Awontfix) and this request is not among them"
+          required: true
+        - label: "This is a feature request for the Cromite browser; not the website nor F-Droid nor anything else."
+          required: true
+
+  - type: dropdown
+    id: is_privacy_related
+    attributes:
+      label: Is your feature request related to privacy?
+      description: Features that are not related to privacy are not considered.
+      multiple: false
+      options:
+        - "Yes"
+        - "No"
+    validations:
+      required: true
+
+  - type: textarea
+    id: is_patch_available
+    attributes:
+      label: Is there a patch available for this feature somewhere?
+      description: If yes please provide URL and related license information.
+    validations:
+      required: true
+
+  - type: textarea
+    id: solution_description
+    attributes:
+      label: Describe the solution you would like
+      description: A clear and concise description of what you want to happen.
+    validations:
+      required: true
+
+  - type: textarea
+    id: alternatives_considered
+    attributes:
+      label: Describe alternatives you have considered
+      description: A clear and concise description of any alternative solutions or features you have considered.
+    validations:
+      required: true
@@ -0,0 +1,15 @@
+## Description
+
+*Please explain here what feature or bugfix these changes are addressing and why they should be included*
+
+## All submissions
+
+* [ ] there are no other open [Pull Requests](../../../pulls) for the same update/change
+* [ ] Bromite can be built with these changes
+* [ ] I have tested that the new change works as intended (AVD or physical device will do)
+
+### Format
+
+* [ ] patch subject and filename match (e.g. `Subject: Alternative cache (NIK-based)` -> `Alternative-cache-NIK-based.patch`)
+* [ ] patch description contains explanation of changes
+* [ ] no unnecessary whitespace or unrelated changes
@@ -0,0 +1,127 @@
+permissions:
+  actions: none
+  checks: none
+  contents: none
+  deployments: none
+  issues: write
+  packages: none
+  pull-requests: none
+  repository-projects: none
+  security-events: none
+  statuses: none
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'chromium version'
+        required: false
+        default: ''
+      type:
+        description: 'runner?'
+        required: false
+        default: 'ubuntu-latest'
+  schedule:
+   - cron: '0 1 * * *'
+
+env:
+  CHR_VERSION: ${{ github.event.inputs.version }}
+  NEW_VERSION: ${{ null }}
+
+name: Builds and pushes tagged image to DockerHub
+jobs:
+  generate_build_deps:
+    name: Generate Build Deps
+    runs-on: ${{ fromJSON( format('["ubuntu-latest", "{0}"]', github.event.inputs.type) )[github.event.inputs.type != ''] }}
+    steps:
+      - name: Reclaiming disk space on / by removing dotnet/android/ghc
+        #if: ${{ github.event.inputs.type == '' }}
+        run: |
+          sudo rm -rf /usr/share/dotnet
+          sudo rm -rf /usr/local/lib/android
+          sudo rm -rf /opt/ghc
+          sudo rm -rf /opt/hostedtoolcache/CodeQL
+          sudo apt-get remove google-cloud-cli azure-cli google-chrome-stable \
+                       firefox mysql-server-core-8.0 mono-devel podman \
+                       powershell
+          sudo apt-get autoremove
+
+      - name: Enable proxy on container
+        shell: bash
+        if: ${{ github.event.inputs.type != 'ubuntu-latest' }}
+        run: |
+          if ! [[ -z "${HTTP_PROXY}" ]]; then
+            PROXY_ADDR=http://$(hostname -I | cut -d' ' -f1 | xargs):8118
+            echo "PROXY_ADDR=$PROXY_ADDR" >> $GITHUB_ENV
+            sudo iptables -D INPUT -p tcp -s localhost --dport 8118 -j ACCEPT
+            sudo iptables -D INPUT -p tcp --dport 8118 -j DROP
+          fi
+
+      - name: Checkout repo
+        uses: actions/checkout@v2
+        with:
+          path: cromite
+          fetch-depth: 1
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@v2
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Check versions
+        shell: bash
+        run: |
+          if [ -z $CHR_VERSION ]; then
+            CHR_VERSION=$(curl -s https://omahaproxy.appspot.com/all.json | jq '.[] | select(.os | contains("win64")) | .versions[] | select(.channel | contains("stable")) | .current_version' | xargs)
+            echo "CHR_VERSION=$CHR_VERSION" >> $GITHUB_ENV
+          fi
+
+      - name: Building build-deps container ${{ env.VERSION }}
+        shell: bash
+        run: |
+          IS_PRESENT=$(docker inspect --type=image uazo/build-deps:$CHR_VERSION > /dev/null ; echo $?)
+          if [ $IS_PRESENT -ne "0" ]; then
+            IS_PRESENT=$(docker manifest inspect uazo/build-deps:$CHR_VERSION > /dev/null ; echo $?)
+            if [ $IS_PRESENT -ne "0" ]; then
+              DOCKER_BUILDKIT=1 docker build -t uazo/build-deps:$CHR_VERSION \
+                --progress plain \
+                --build-arg VERSION=$CHR_VERSION \
+                --build-arg HTTP_PROXY="$PROXY_ADDR" \
+                --no-cache \
+                cromite/tools/images/build-deps/.
+
+              docker push uazo/build-deps:$CHR_VERSION
+              echo "NEW_VERSION=$CHR_VERSION" >> $GITHUB_ENV
+            fi
+          fi
+
+      - name: Building chromium container ${{ env.VERSION }}
+        shell: bash
+        run: |
+          IS_PRESENT=$(docker inspect --type=image uazo/chromium:$CHR_VERSION > /dev/null ; echo $?)
+          if [ $IS_PRESENT -ne "0" ]; then
+            IS_PRESENT=$(docker manifest inspect uazo/chromium:$CHR_VERSION > /dev/null ; echo $?)
+            if [ $IS_PRESENT -ne "0" ]; then
+              DOCKER_BUILDKIT=1 docker build -t uazo/chromium:$CHR_VERSION \
+                --progress plain \
+                --build-arg VERSION=$CHR_VERSION \
+                --build-arg HTTP_PROXY="$PROXY_ADDR" \
+                cromite/tools/images/chr-source/.
+
+              docker push uazo/chromium:$CHR_VERSION
+              echo "NEW_VERSION=$CHR_VERSION" >> $GITHUB_ENV
+            fi
+          fi
+
+      - name: Create issue ${{ env.VERSION }}
+        if: "${{ env.NEW_VERSION != '' }}"
+        shell: bash
+        run: |
+          GH=../../gh_2.18.1_linux_amd64/bin/gh
+          wget https://github.com/cli/cli/releases/download/v2.18.1/gh_2.18.1_linux_amd64.tar.gz
+          tar xfz gh_2.18.1_linux_amd64.tar.gz
+
+          cd cromite/tools
+          echo ${{ secrets.GITHUB_TOKEN }} | $GH auth login --with-token
+          $GH issue create -t "$CHR_VERSION: new chromium version" -b ""
@@ -0,0 +1,46 @@
+name: Build Sysbox
+permissions:
+  contents: write
+      
+on:
+  workflow_dispatch:
+    inputs:
+      sha:
+        description: 'Sysbox SHA'
+        required: true
+        default: ''
+        
+env:
+  SYSBOX_SHA: ${{ github.event.inputs.sha }}
+  
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v2
+        with:
+          path: cromite
+          fetch-depth: 1
+
+      - name: Build patched sysbox
+        run: |
+          git clone --recursive https://github.com/nestybox/sysbox.git
+          cd sysbox
+          git checkout $SYSBOX_SHA
+          git submodule update --recursive
+
+          cd sysbox-runc/
+          git apply --ignore-whitespace ../../cromite/tools/images/sysbox/add-x86-x32-arch.patch
+          git status
+          cd ..
+
+          make sysbox-static TARGET_ARCH=x64
+
+          zip -r build.zip build
+
+      - name: Publish
+        uses: actions/upload-artifact@v2
+        with:
+          name: build.zip
+          path: sysbox/build.zip
@@ -0,0 +1,385 @@
+name: Build Cromite
+permissions:
+  actions: none
+  checks: none
+  contents: none
+  deployments: none
+  issues: none
+  packages: none
+  pull-requests: none
+  repository-projects: none
+  security-events: none
+  statuses: none
+
+on:
+  workflow_dispatch:
+    inputs:
+      sha:
+        description: 'uazo/cromite SHA'
+        required: true
+        default: ''
+      target_os:
+        description: 'targetos [android/win/all]'
+        required: true
+        default: 'all'
+      build:
+        description: 'android arch [arm/arm64/x64/all]'
+        required: true
+        default: 'all'
+      type:
+        description: 'runner? [dev/ci]'
+        required: true
+        default: 'ci'
+      debug:
+        description: 'debug? [true/false]'
+        required: true
+        default: 'false'
+      clangd:
+        description: 'clangd? [true/false]'
+        required: true
+        default: 'false'
+
+env:
+  BROMITE_SHA: ${{ github.event.inputs.sha }}
+  REMOVEDOCKERSUPPORT: true
+  USELOCALIMAGE: true
+
+jobs:
+  check_images:
+    runs-on: ${{ github.event.inputs.type }}
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v2
+        with:
+          path: cromite
+          ref: ${{ github.event.inputs.sha }}
+          fetch-depth: 1
+
+      - name: Enable proxy on container
+        shell: bash
+        run: |
+          if ! [[ -z "${HTTP_PROXY}" ]]; then
+            PROXY_ADDR=http://$(hostname -I | cut -d' ' -f1 | xargs):8118
+            echo "PROXY_ADDR=$PROXY_ADDR" >> $GITHUB_ENV
+            sudo iptables -D INPUT -p tcp -s localhost --dport 8118 -j ACCEPT
+            sudo iptables -D INPUT -p tcp --dport 8118 -j DROP
+          fi
+
+      - name: Get current chromium version
+        shell: bash
+        run: |
+          export VERSION=$( cat ./cromite/build/RELEASE )
+          rm -rf bromite
+
+          echo Current version is $VERSION
+          echo "VERSION=$VERSION" >> $GITHUB_ENV
+
+          cd cromite/tools
+
+      - name: Building build-deps container ${{ env.VERSION }}
+        shell: bash
+        run: |
+          IS_PRESENT=$(docker inspect --type=image uazo/build-deps:$VERSION > /dev/null ; echo $?)
+          if [ $IS_PRESENT -ne "0" ]; then
+            IS_PRESENT=$(docker manifest inspect uazo/build-deps:$VERSION > /dev/null ; echo $?)
+            if [ $IS_PRESENT -ne "0" ]; then
+              DOCKER_BUILDKIT=1 docker build -t uazo/build-deps:$VERSION \
+                --progress plain \
+                --build-arg VERSION=$VERSION \
+                --build-arg HTTP_PROXY="$PROXY_ADDR" \
+                --no-cache \
+                cromite/tools/images/build-deps/.
+            fi
+          fi
+
+      - name: Building chromium container ${{ env.VERSION }}
+        shell: bash
+        run: |
+          IS_PRESENT=$(docker inspect --type=image uazo/chromium:$VERSION > /dev/null ; echo $?)
+          if [ $IS_PRESENT -ne "0" ]; then
+            IS_PRESENT=$(docker manifest inspect uazo/chromium:$VERSION > /dev/null ; echo $?)
+            if [ $IS_PRESENT -ne "0" ]; then
+              DOCKER_BUILDKIT=1 docker build -t uazo/chromium:$VERSION \
+                --progress plain \
+                --build-arg VERSION=$VERSION \
+                --build-arg HTTP_PROXY="$PROXY_ADDR" \
+                cromite/tools/images/chr-source/.
+            fi
+          fi
+
+      - name: Building cromite container ${{ env.VERSION }}-${{ env.BROMITE_SHA }}
+        shell: bash
+        run: |
+          IS_PRESENT=$(docker inspect --type=image uazo/cromite:$VERSION-$BROMITE_SHA > /dev/null ; echo $?)
+          if [ $IS_PRESENT -ne "0" ]; then
+            IS_PRESENT=$(docker manifest inspect uazo/cromite:$VERSION-$BROMITE_SHA > /dev/null ; echo $?)
+            if [ $IS_PRESENT -ne "0" ]; then
+              DOCKER_BUILDKIT=1 docker build -t uazo/cromite:$VERSION-$BROMITE_SHA --progress plain \
+                --build-arg BROMITE_SHA=$BROMITE_SHA \
+                --build-arg VERSION=$VERSION \
+                --build-arg HTTP_PROXY="$PROXY_ADDR" \
+                cromite/tools/images/bromite-source/.
+            fi
+          fi
+
+      - name: Building cromite-build container ${{ env.VERSION }}-${{ env.BROMITE_SHA }}
+        shell: bash
+        run: |
+          IS_PRESENT=$(docker inspect --type=image uazo/cromite-build:$VERSION-$BROMITE_SHA > /dev/null ; echo $?)
+          if [ $IS_PRESENT -ne "0" ]; then
+            IS_PRESENT=$(docker manifest inspect uazo/cromite-build:$VERSION-$BROMITE_SHA > /dev/null ; echo $?)
+            if [ $IS_PRESENT -ne "0" ]; then
+              DOCKER_BUILDKIT=1 docker build -t uazo/cromite-build:$VERSION-$BROMITE_SHA --progress plain \
+                --build-arg BROMITE_SHA=$BROMITE_SHA \
+                --build-arg VERSION=$VERSION \
+                --build-arg HTTP_PROXY="$PROXY_ADDR" \
+                --no-cache \
+                cromite/tools/images/bromite-build/.
+            fi
+          fi
+
+      - name: Mark image to build
+        shell: bash
+        run: |
+          IS_PRESENT=$(docker inspect --type=image uazo/cromite-build:build > /dev/null ; echo $?)
+          if [ $IS_PRESENT -eq "0" ]; then
+            docker rmi uazo/cromite-build:build
+          fi
+          docker tag uazo/cromite-build:$VERSION-$BROMITE_SHA uazo/cromite-build:build
+
+  build:
+    runs-on: ${{ github.event.inputs.type }}
+    needs: check_images
+    if: success()
+    timeout-minutes: 1200
+
+    container:
+      image: uazo/cromite-build:build
+      env:
+        REMOVEDOCKERSUPPORT: true # CUSTOM RUNNER: remove sharing of docker socket
+        USELOCALIMAGE: true       # CUSTOM RUNNER: permit use of local images
+        USEINTERNALNETWORK: true  # CUSTOM RUNNER: create the docker network as internal
+        WORKSPACE: /home/lg/working_dir
+        # kythe
+        KYTHE_CORPUS: chromium.googlesource.com/chromium/src
+        KYTHE_ROOT_DIRECTORY: /home/lg/working_dir/chromium/src
+        KYTHE_OUTPUT_DIRECTORY: /home/lg/working_dir/chromium/src/out/arm64/kythe
+        # cross build
+        DEPOT_TOOLS_WIN_TOOLCHAIN_BASE_URL: /win_sdk/10.0.22621.0/
+        WINDOWSSDKDIR: "/win_sdk/10.0.22621.0/Windows Kits/10/"
+        GYP_MSVS_OVERRIDE_PATH: /win_sdk/10.0.22621.0/
+        # compile in debug mode
+        TARGET_ISDEBUG: ${{ github.event.inputs.debug }}
+        TARGET_OS: ${{ github.event.inputs.target_os }}
+        USE_KEYSTORE: true
+        KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
+        CROMITE_PREF_HASH_SEED_BIN: ${{ secrets.CROMITE_PREF_HASH_SEED_BIN }}
+      volumes:
+        - /storage/images/${{ github.event.inputs.sha }}/android/${{ github.event.inputs.debug }}/arm:/home/lg/working_dir/chromium/src/out/arm
+        - /storage/images/${{ github.event.inputs.sha }}/android/${{ github.event.inputs.debug }}/arm64:/home/lg/working_dir/chromium/src/out/arm64
+        - /storage/images/${{ github.event.inputs.sha }}/android/${{ github.event.inputs.debug }}/x64:/home/lg/working_dir/chromium/src/out/x64
+        - /storage/images/${{ github.event.inputs.sha }}/win/x64:/home/lg/working_dir/chromium/src/out/win64
+        - /tmp/proxy:/tmp/proxy
+        - /win_sdk:/win_sdk
+
+    steps:
+      - name: Prepare Build Container
+        shell: bash
+        run: |
+          # set workspace paths
+          PATH=$WORKSPACE/chromium/src/third_party/llvm-build/Release+Asserts/bin:$WORKSPACE/depot_tools/:/usr/local/go/bin:$WORKSPACE/mtool/bin:$PATH
+          cd $WORKSPACE
+
+          # reset proxy env
+          HTTP_PROXY=
+          HTTPS_PROXY=
+          http_proxy=
+          https_proxy=
+
+          # set out folder permissions
+          test -d chromium/src/out/arm || sudo mkdir -p chromium/src/out/arm && \
+            sudo chown lg chromium/src/out &&
+            sudo chown lg chromium/src/out/arm
+
+          test -d chromium/src/out/arm64 || sudo mkdir -p chromium/src/out/arm64 && \
+            sudo chown lg chromium/src/out &&
+            sudo chown lg chromium/src/out/arm64
+
+          test -d chromium/src/out/win64 || sudo mkdir -p chromium/src/out/win64 && \
+            sudo chown lg chromium/src/out &&
+            sudo chown lg chromium/src/out/win64
+
+          test -d chromium/src/out/x64 || sudo mkdir -p chromium/src/out/x64 && \
+            sudo chown lg chromium/src/out &&
+            sudo chown lg chromium/src/out/x64
+
+          # make kythe output directory
+          test -d $KYTHE_OUTPUT_DIRECTORY || mkdir -p $KYTHE_OUTPUT_DIRECTORY
+
+          sudo mkdir -p /run/user/1000/
+          sudo chown lg /run/user/1000/
+          sudo chmod g-rxw /run/user/1000/
+          sudo chmod o-rxw /run/user/1000/
+
+          # prepare keystore
+          echo "::group::-------- prepare keystore"
+          cd $WORKSPACE
+          echo "${{ secrets.KEYSTORE }}" > cromite.keystore.asc
+          gpg --homedir ./ -d --passphrase "${{ secrets.KEYSTORE_PASSPHRASE }}" --batch cromite.keystore.asc > cromite.keystore
+          echo "::endgroup::"
+
+      - name: Build Bromite Android arm64
+        if: ${{ (github.event.inputs.target_os == 'android' || github.event.inputs.target_os == 'all') && (github.event.inputs.build == 'arm64' || github.event.inputs.build == 'all') }}
+        shell: bash
+        run: |
+          PATH=$WORKSPACE/chromium/src/third_party/llvm-build/Release+Asserts/bin:$WORKSPACE/depot_tools/:/usr/local/go/bin:$WORKSPACE/mtool/bin:$PATH
+          cd $WORKSPACE/chromium/src
+
+          echo "::group::-------- gn gen"
+          gn gen --args="import(\"/home/lg/working_dir/bromite/build/bromite.gn_args\") $(cat ../../build_args.gni) target_cpu = \"arm64\" " out/arm64
+          echo "::endgroup::"
+
+          echo "::group::-------- gn args"
+          gn args out/arm64/ --list --short
+          gn args out/arm64/ --list >out/arm64/gn_list
+          echo "::endgroup::"
+
+          ninja -C out/arm64 chrome_public_bundle
+          ninja -C out/arm64 chrome_public_apk
+
+          cp ../../bromite/build/RELEASE out/arm64
+
+      - name: Get ninja logs Android arm64
+        if: ${{ (github.event.inputs.target_os == 'android' || github.event.inputs.target_os == 'all') && (github.event.inputs.build == 'arm64' || github.event.inputs.build == 'all') }}
+        shell: bash
+        run: |
+          cd $WORKSPACE
+          $WORKSPACE/ninjatracing/ninjatracing -a $WORKSPACE/chromium/src/out/arm64/.ninja_log >$WORKSPACE/chromium/src/out/arm64/ninja_log_trace.json
+          python3 $WORKSPACE/chromium/src/third_party/catapult/tracing/bin/trace2html $WORKSPACE/chromium/src/out/arm64/ninja_log_trace.json
+
+      - name: Build Bromite Windows x64
+        if: ${{ github.event.inputs.target_os == 'win' || github.event.inputs.target_os == 'all' }}
+        shell: bash
+        run: |
+          PATH=$WORKSPACE/chromium/src/third_party/llvm-build/Release+Asserts/bin:$WORKSPACE/depot_tools/:/usr/local/go/bin:$WORKSPACE/mtool/bin:$PATH
+          cd $WORKSPACE/chromium/src
+
+          echo "::group::-------- gn gen"
+          gn gen --args="import(\"/home/lg/working_dir/bromite/build/bromite.gn_args\") target_os = \"win\" $(cat ../../build_args.gni) target_cpu = \"x64\" " out/win64
+          echo "::endgroup::"
+
+          echo "::group::-------- gn args"
+          gn args out/win64/ --list --short
+          gn args out/win64/ --list >out/win64/gn_list
+          echo "::endgroup::"
+
+          ninja -C out/win64 chrome
+
+          cp ../../bromite/build/RELEASE out/win64
+
+      - name: Get ninja logs Windows x64
+        if: ${{ github.event.inputs.target_os == 'win' || github.event.inputs.target_os == 'all' }}
+        shell: bash
+        run: |
+          cd $WORKSPACE
+          $WORKSPACE/ninjatracing/ninjatracing -a $WORKSPACE/chromium/src/out/win64/.ninja_log >$WORKSPACE/chromium/src/out/win64/ninja_log_trace.json
+          python3 $WORKSPACE/chromium/src/third_party/catapult/tracing/bin/trace2html $WORKSPACE/chromium/src/out/win64/ninja_log_trace.json
+
+      - name: Build Bromite Android x64
+        if: ${{ (github.event.inputs.target_os == 'android' || github.event.inputs.target_os == 'all') && (github.event.inputs.build == 'x64' || github.event.inputs.build == 'all') }}
+        shell: bash
+        run: |
+          PATH=$WORKSPACE/chromium/src/third_party/llvm-build/Release+Asserts/bin:$WORKSPACE/depot_tools/:/usr/local/go/bin:$WORKSPACE/mtool/bin:$PATH
+          cd $WORKSPACE/chromium/src
+
+          echo "::group::-------- gn gen"
+          gn gen --args="import(\"/home/lg/working_dir/bromite/build/bromite.gn_args\") $(cat ../../build_args.gni) target_cpu = \"x64\" " out/x64
+          echo "::endgroup::"
+
+          echo "::group::-------- gn args"
+          gn args out/x64/ --list --short
+          gn args out/x64/ --list >out/x64/gn_list
+          echo "::endgroup::"
+
+          ninja -C out/x64 chrome_public_bundle
+          ninja -C out/x64 chrome_public_apk
+
+          cp ../../bromite/build/RELEASE out/x64
+
+      - name: Get ninja logs Android x64
+        if: ${{ (github.event.inputs.target_os == 'android' || github.event.inputs.target_os == 'all') && (github.event.inputs.build == 'x64' || github.event.inputs.build == 'all') }}
+        shell: bash
+        run: |
+          cd $WORKSPACE
+          $WORKSPACE/ninjatracing/ninjatracing -a $WORKSPACE/chromium/src/out/x64/.ninja_log >$WORKSPACE/chromium/src/out/x64/ninja_log_trace.json
+          python3 $WORKSPACE/chromium/src/third_party/catapult/tracing/bin/trace2html $WORKSPACE/chromium/src/out/x64/ninja_log_trace.json
+
+      - name: Generate breakpad symbols for Android arm64
+        if: ${{ (github.event.inputs.target_os == 'android' || github.event.inputs.target_os == 'all') && (github.event.inputs.build == 'arm64' || github.event.inputs.build == 'all') }}
+        shell: bash
+        run: |
+          PATH=$WORKSPACE/chromium/src/third_party/llvm-build/Release+Asserts/bin:$WORKSPACE/depot_tools/:/usr/local/go/bin:$WORKSPACE/mtool/bin:$PATH
+          cd $WORKSPACE/chromium/src
+
+          echo "::group::-------- generating breakpad symbols"
+          ninja -C out/arm64 minidump_stackwalk dump_syms
+          components/crash/content/tools/generate_breakpad_symbols.py --build-dir=out/arm64 \
+             --symbols-dir=out/arm64/symbols/ --binary=out/arm64/lib.unstripped/libchrome.so \
+             --platform=android --clear --verbose
+          cp out/arm64/lib.unstripped/libchrome.so out/arm64/symbols/libchrome.lib.so
+          cp out/arm64/minidump_stackwalk out/arm64/symbols
+          cp out/arm64/dump_syms out/arm64/symbols
+          echo "::endgroup::"
+
+      - name: Generate Supersize data for Android arm64
+        if: ${{ github.event.inputs.debug == 'false' && (github.event.inputs.target_os == 'android' || github.event.inputs.target_os == 'all') && (github.event.inputs.build == 'arm64' || github.event.inputs.build == 'all') }}
+        shell: bash
+        run: |
+          PATH=$WORKSPACE/chromium/src/third_party/llvm-build/Release+Asserts/bin:$WORKSPACE/depot_tools/:/usr/local/go/bin:$WORKSPACE/mtool/bin:$PATH
+          cd $WORKSPACE/chromium/src
+
+          tools/binary_size/supersize archive out/arm64/chrome.size --apk-file out/arm64/apks/ChromePublic.apk -v
+
+      - name: Build Bromite Android arm
+        if: ${{ (github.event.inputs.target_os == 'android' || github.event.inputs.target_os == 'all') && (github.event.inputs.build == 'arm' || github.event.inputs.build == 'all') }}
+        shell: bash
+        run: |
+          PATH=$WORKSPACE/chromium/src/third_party/llvm-build/Release+Asserts/bin:$WORKSPACE/depot_tools/:/usr/local/go/bin:$WORKSPACE/mtool/bin:$PATH
+          cd $WORKSPACE/chromium/src
+
+          echo "::group::-------- gn gen"
+          gn gen --args="import(\"/home/lg/working_dir/bromite/build/bromite.gn_args\") $(cat ../../build_args.gni) target_cpu = \"arm\" " out/arm
+          echo "::endgroup::"
+
+          echo "::group::-------- gn args"
+          gn args out/arm/ --list --short
+          gn args out/arm/ --list >out/arm/gn_list
+          echo "::endgroup::"
+
+          ninja -C out/arm chrome_public_bundle
+          ninja -C out/arm chrome_public_apk
+
+          cp ../../bromite/build/RELEASE out/arm
+
+      - name: Get ninja logs Android arm
+        if: ${{ (github.event.inputs.target_os == 'android' || github.event.inputs.target_os == 'all') && (github.event.inputs.build == 'arm' || github.event.inputs.build == 'all') }}
+        shell: bash
+        run: |
+          cd $WORKSPACE
+          $WORKSPACE/ninjatracing/ninjatracing -a $WORKSPACE/chromium/src/out/arm/.ninja_log >$WORKSPACE/chromium/src/out/arm/ninja_log_trace.json
+          python3 $WORKSPACE/chromium/src/third_party/catapult/tracing/bin/trace2html $WORKSPACE/chromium/src/out/arm/ninja_log_trace.json
+
+      - name: Generate clangd index for Android arm64
+        if: ${{ github.event.inputs.clangd == 'true' }}
+        shell: bash
+        run: |
+          PATH=$WORKSPACE/chromium/src/third_party/llvm-build/Release+Asserts/bin:$WORKSPACE/depot_tools/:/usr/local/go/bin:$WORKSPACE/mtool/bin:$PATH
+          cd $WORKSPACE/chromium/src
+
+          test -f out/arm64/bromite.idx || \
+            cp -r out/arm64 out/clangd && \
+            gn gen --args="import(\"/home/lg/working_dir/bromite/build/bromite.gn_args\") $(cat ../../build_args.gni) skip_clangd_unsupported_options = true" out/clangd && \
+            $WORKSPACE/ninja/ninja -C $WORKSPACE/chromium/src/out/clangd -a chrome_public_apk \
+              -t compdb cc cxx objc objcxx >$WORKSPACE/chromium/src/out/clangd/compile_commands.json && \
+            /home/lg/working_dir/clangd_snapshot_20211205/bin/clangd-indexer --executor=all-TUs out/clangd/compile_commands.json >out/arm64/bromite.idx && \
+            rm -rf out/clangd
@@ -0,0 +1,154 @@
+name: Check git apply
+permissions:
+#  actions: none
+#  checks: none
+#  contents: write
+#  deployments: none
+#  issues: none
+#  packages: none
+   pull-requests: write
+#  repository-projects: none
+#  security-events: none
+#  statuses: none
+
+on:
+  push:
+    branches-ignore:
+      - 'ci'
+    paths:
+      - 'build/**'
+
+  workflow_dispatch:
+    inputs:
+      rtag:
+        description: 'uazo/cromite TAG or COMMIT'
+        required: true
+        default: ''
+
+env:
+  RTAG: ${{ github.event.inputs.rtag }}
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+
+      - name: "Get value from dispatch"
+        run: |
+          if [ -z "${RTAG}" ]; then
+            echo "RTAG=$GITHUB_SHA" >> $GITHUB_ENV
+            echo "RTAG=$RTAG"
+          fi
+
+      - name: Prepare container
+        run: |
+          sudo apt update
+          sudo apt install -y wget unzip tar sed dos2unix patchutils wiggle curl
+
+          wget https://github.com/uazo/superpatch/releases/latest/download/SuperPatchUtils.tar.gz
+          tar xfz SuperPatchUtils.tar.gz
+          rm SuperPatchUtils.tar.gz
+
+          wget https://github.com/ericchiang/pup/releases/download/v0.4.0/pup_v0.4.0_linux_amd64.zip
+          unzip pup_v0.4.0_linux_amd64.zip
+          rm pup_v0.4.0_linux_amd64.zip
+
+          BRANCH=$(curl https://github.com/uazo/cromite/branch_commits/$RTAG | ./pup -p li.branch:last-child a text{})
+          if [ -z "${BRANCH}" ]; then
+            BRANCH=$(curl https://github.com/uazo/cromite/branch_commits/$RTAG a | ./pup -p li.branch:first-child a text{})
+          fi
+          if [ -z "${BRANCH}" ]; then
+            echo "Can not recover the base commit"
+            exit 1
+          fi
+          echo "BRANCH=$BRANCH" >> $GITHUB_ENV
+
+      - name: Checkout 'uazo/cromite' ${{ env.BRANCH }}
+        uses: actions/checkout@v2
+        with:
+            repository: 'uazo/cromite'
+            ref: ${{ github.event.inputs.rtag }}
+            path: 'cromite'
+            fetch-depth: 1
+
+      - name: Check chromium version
+        run: |
+          export HOME=$GITHUB_WORKSPACE
+          VERSION=$(cat ~/cromite/build/RELEASE)
+          echo "VERSION=$VERSION" >> $GITHUB_ENV
+
+      - name: Cache chromium sources
+        uses: actions/cache@v3
+        with:
+          path: chromium-src
+          key: chrsource-${{ env.VERSION }}
+
+      - name: Download chromium ${{ env.VERSION }} sources
+        run: |
+          export HOME=$GITHUB_WORKSPACE
+          ./bin/SuperPatchUtils bromite $RTAG ~/chromium-src
+          mkdir -p ~/chromium/src && cp -rT ~/chromium-src ~/chromium/src
+          cd ~/chromium/src
+          git init
+          git config user.email "you@example.com"
+          git config user.name "Your Name"
+          git add .
+          git commit -m $VERSION
+          git tag -a $VERSION -m $VERSION
+
+          git add -f v8 && git commit -m ":NOEXPORT: v8" || true
+
+      - name: Apply patches ${{ github.event.inputs.rtag }}
+        run: |
+          export HOME=$GITHUB_WORKSPACE
+          cd ~/chromium/src
+
+          export SILENT=true
+          export SKIPAUTOGENERATED=true
+          bash ~/cromite/tools/apply-all-patch.sh || exit 1
+
+          rm -rf ~/cromite/build/patches-new/
+          rm ~/cromite/build/bromite_patches_list_new.txt
+
+      - name: Export patches
+        run: |
+          export HOME=$GITHUB_WORKSPACE
+          cd ~/chromium/src
+
+          bash ~/cromite/tools/export-all-patch.sh
+
+          cd ~/cromite
+          rm -rf build/patches/*
+          mv build/patches-new/* build/patches
+          rm -rf build/patches-new/
+
+      - name: Check differences CHANGES=${{ env.CHANGES }}
+        run: |
+          export HOME=$GITHUB_WORKSPACE
+
+          cd ~/cromite
+          CHANGES=0 && git diff --quiet || CHANGES=1
+          echo "CHANGES=$CHANGES" >> $GITHUB_ENV
+
+          if [[ CHANGES -eq 1 ]]; then
+              git add build/patches/*.patch
+              git diff --name-only --staged
+              # MESSAGE=$(git diff --name-only --staged)
+              # echo "MESSAGE='$MESSAGE'" >> $GITHUB_ENV
+          fi
+
+      - name: Create Pull Request
+        uses: peter-evans/create-pull-request@dcd5fd746d53dd8de555c0f10bca6c35628be47a #v3.12.0
+        if: env.CHANGES == '1'
+        with:
+          token: ${{ secrets.CROMITE_PULLS }}
+          path: cromite
+          base: ${{ env.BRANCH }}
+          #push-to-fork: uazo/cromite
+          add-paths: |
+            build/patches/*.patch
+          commit-message: 'AUTOMATED - git apply results'
+          title: Git apply result for ${{ env.BRANCH }} branch
+          body: ${{ env.MESSAGE }}
+          delete-branch: true
+          branch-suffix: short-commit-hash
@@ -0,0 +1,67 @@
+name: 'Check NIST database'
+
+on:
+  schedule:
+    - cron: '30 1 * * *'
+
+  workflow_dispatch:
+
+permissions:
+    issues: write
+    pull-requests: write
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout 'uazo/cromite' ${{ env.BRANCH }}
+        uses: actions/checkout@v2
+        with:
+            repository: 'uazo/cromite'
+            ref: ${{ github.event.inputs.rtag }}
+            path: 'cromite'
+            fetch-depth: 1
+
+      - name: Get data
+        run: |
+          sudo apt update
+          DEBIAN_FRONTEND=noninteractive sudo apt install -y sed
+
+          export HOME=$GITHUB_WORKSPACE
+          cd ~/cromite/tools
+          test -d cves || mkdir -p cves
+          cd cves
+
+          CY=$(date +%Y)
+          docker run --rm --name tapir stratosphereips/tapir:latest \
+             bash -c "python3 tapir.py -y 2020-$CY libjxl -s" >libjxl.ansi
+
+          sed -e 's/\x1b\[[0-9;]*m//g' <libjxl.ansi >libjxl.txt
+          rm libjxl.ansi
+
+      - name: Check differences
+        run: |
+          export HOME=$GITHUB_WORKSPACE
+          cd ~/cromite
+          CHANGES=0 && git diff --quiet || CHANGES=1
+          echo "CHANGES=$CHANGES" >> $GITHUB_ENV
+
+          if [[ CHANGES -eq 1 ]]; then
+              git add tools/cves/*.txt
+              git diff --name-only --staged
+          fi
+
+      - name: Create Pull Request
+        uses: peter-evans/create-pull-request@dcd5fd746d53dd8de555c0f10bca6c35628be47a #v3.12.0
+        if: env.CHANGES == '1'
+        with:
+          token: ${{ secrets.CROMITE_PULLS }}
+          path: cromite
+          base: ${{ env.BRANCH }}
+          #push-to-fork: uazo/cromite
+          add-paths: |
+            tools/cves/*.txt
+          commit-message: 'AUTOMATED - CVE results'
+          title: New CVE results
+          delete-branch: true
+          branch-suffix: short-commit-hash
@@ -0,0 +1,130 @@
+name: Execute Tests
+permissions:
+  actions: none
+  checks: none
+  contents: none
+  deployments: none
+  issues: none
+  packages: none
+  pull-requests: none
+  repository-projects: none
+  security-events: none
+  statuses: none
+
+on:
+  workflow_dispatch:
+    inputs:
+      sha:
+        description: 'uazo/bromite SHA'
+        required: true
+        default: 'ce2f07034a3d3b257e9bada65d8293a6786bb95f'
+
+env:
+  BROMITE_SHA: ${{ github.event.inputs.sha }}
+  REMOVEDOCKERSUPPORT: true
+  USELOCALIMAGE: true
+
+jobs:
+  get_image:
+    runs-on: self-hosted
+    steps:
+      - name: Mark image to test
+        shell: bash
+        run: |
+          docker tag uazo/bromite-build:$BROMITE_SHA uazo/bromite-build:test
+
+  exec-test:
+    runs-on: self-hosted
+    needs: get_image
+    if: success()
+
+    container:
+      image: uazo/bromite-build:test
+      env:
+        REMOVEDOCKERSUPPORT: true # CUSTOM RUNNER: remove sharing of docker socket
+        USELOCALIMAGE: true       # CUSTOM RUNNER: permit use of local images
+        USEINTERNALNETWORK: true  # CUSTOM RUNNER: create the docker network as internal
+        WORKSPACE: /home/lg/working_dir
+        ARTIFACS_DIR: /home/lg/working_dir/artifacs
+      volumes:
+        - /storage/images/${{ github.event.inputs.sha }}/out:/home/lg/working_dir/chromium/src/out/bromite:r
+        - /storage/images/${{ github.event.inputs.sha }}/out/tests:/home/lg/working_dir/chromium/src/out/tests
+      options: --device=/dev/kvm
+
+    steps:
+      - name: Prepare Test Container
+        shell: bash
+        run: |
+          # set workspace paths
+          PATH=$WORKSPACE/chromium/src/third_party/llvm-build/Release+Asserts/bin:$WORKSPACE/depot_tools/:/usr/local/go/bin:$WORKSPACE/mtool/bin:$PATH
+          cd $WORKSPACE
+
+          # copy artifacts
+          #cd chromium/src
+          #mkdir -p out/bromite
+          #cp -arp $ARTIFACS_DIR/out/* out/bromite
+
+          rm -rf out/tests/*
+          #mkdir -p out/tests
+
+          # reset proxy env
+          #HTTP_PROXY=
+          #HTTPS_PROXY=
+          #http_proxy=
+          #https_proxy=
+
+#      - name: Wait forever
+#        shell: bash
+#        run: |
+#          sleep infinity
+
+      - name: Execute chrome junit test
+        shell: bash
+        run: |
+          PATH=$WORKSPACE/chromium/src/third_party/llvm-build/Release+Asserts/bin:$WORKSPACE/depot_tools/:/usr/local/go/bin:$WORKSPACE/mtool/bin:$PATH
+          cd $WORKSPACE/chromium/src
+          out/bromite/bin/run_chrome_junit_tests --gtest_filter=*Bromite* || KO=1
+
+      - name: Start Android Emulator
+        shell: bash
+        run: |
+          PATH=$WORKSPACE/chromium/src/third_party/llvm-build/Release+Asserts/bin:$WORKSPACE/depot_tools/:/usr/local/go/bin:$WORKSPACE/mtool/bin:$PATH
+          cd $WORKSPACE/chromium/src
+
+          sudo mkdir -p /github/home/.android
+          sudo chmod 666 /github/home/.android/
+          tools/android/avd/avd.py install --avd-config ../../generic_android31.textpb -v
+          tools/android/avd/avd.py start --avd-config ../../generic_android31.textpb -v
+
+      - name: Execute unit tests
+        shell: bash
+        run: |
+          PATH=$WORKSPACE/chromium/src/third_party/llvm-build/Release+Asserts/bin:$WORKSPACE/depot_tools/:/usr/local/go/bin:$WORKSPACE/mtool/bin:$PATH
+          cd $WORKSPACE/chromium/src
+          out/bromite/unit_tests -v --fast-local-dev --gtest_filter=*Bromite* || KO=1
+
+      - name: Restart Android Emulator
+        shell: bash
+        run: |
+          PATH=$WORKSPACE/chromium/src/third_party/llvm-build/Release+Asserts/bin:$WORKSPACE/depot_tools/:/usr/local/go/bin:$WORKSPACE/mtool/bin:$PATH
+          cd $WORKSPACE/chromium/src
+          pkill -f qemu-system-x86
+          tools/android/avd/avd.py start --avd-config ../../generic_android31.textpb -v
+
+      - name: Execute instrumentation tests
+        shell: bash
+        run: |
+          PATH=$WORKSPACE/chromium/src/third_party/llvm-build/Release+Asserts/bin:$WORKSPACE/depot_tools/:/usr/local/go/bin:$WORKSPACE/mtool/bin:$PATH
+          cd $WORKSPACE/chromium/src
+          out/bromite/bin/run_chrome_public_test_apk -v --num-retries=1 --gtest_filter=*Bromite* || KO=1
+
+      #- name: Wait forever
+      #  shell: bash
+      #  run: |
+      #    sleep infinity
+
+      - name: Copy results
+        shell: bash
+        run: |
+          sudo cp -r $WORKSPACE/chromium/src/out/bromite/TEST_RESULTS* $WORKSPACE/chromium/src/out/tests/
+
@@ -0,0 +1,175 @@
+name: Release Cromite CI
+permissions:
+  contents: write
+
+on:
+  workflow_dispatch:
+    inputs:
+      sha:
+        description: 'uazo/cromite SHA'
+        required: true
+        default: ''
+      type:
+        description: 'runner? [dev/ci]'
+        required: true
+        default: 'ci'
+
+env:
+  BROMITE_SHA: ${{ github.event.inputs.sha }}
+  REMOVEDOCKERSUPPORT: true
+  USELOCALIMAGE: true
+
+jobs:
+  release:
+    runs-on: ${{ github.event.inputs.type }}
+    env:
+      OUTPUTFILE_ARM: /storage/images/${{ github.event.inputs.sha }}/android/false/arm/
+      OUTPUTFILE_ARM64: /storage/images/${{ github.event.inputs.sha }}/android/false/arm64/
+      OUTPUTFILE_X64: /storage/images/${{ github.event.inputs.sha }}/android/false/x64/
+      OUTPUTFILE_WIN: /storage/images/${{ github.event.inputs.sha }}/win/x64/
+
+    steps:
+      - name: Login to Docker Hub
+        uses: docker/login-action@v2
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Prepare container
+        run: |
+          wget https://github.com/ericchiang/pup/releases/download/v0.4.0/pup_v0.4.0_linux_amd64.zip
+          unzip pup_v0.4.0_linux_amd64.zip && rm pup_v0.4.0_linux_amd64.zip
+          BRANCH=$(curl https://github.com/uazo/cromite/branch_commits/$BROMITE_SHA | ./pup -p li.branch:last-child a text{} | xargs)
+          echo "BRANCH=$BRANCH" >> $GITHUB_ENV
+
+          wget https://github.com/cli/cli/releases/download/v2.18.1/gh_2.18.1_linux_amd64.tar.gz
+          tar xfz gh_2.18.1_linux_amd64.tar.gz
+
+      - name: Checkout 'uazo/cromite'
+        uses: actions/checkout@v2
+        with:
+            repository: 'uazo/cromite'
+            path: 'cromite'
+            fetch-depth: 1
+
+      - name: Create release
+        shell: bash
+        run: |          
+          VERSION=v$(cat ${{ env.OUTPUTFILE_ARM64 }}/RELEASE)
+
+          cd cromite/tools
+
+          GH=gh_2.21.1_linux_amd64/bin/gh
+          wget https://github.com/cli/cli/releases/download/v2.21.1/gh_2.21.1_linux_amd64.tar.gz
+          tar xfz gh_2.21.1_linux_amd64.tar.gz
+
+          echo ${{ secrets.GITHUB_TOKEN }} | $GH auth login --with-token
+
+          echo "\`\`\`" >note
+          # echo "this is not the official release of bromite but a test version." >>note
+          # echo "you can try it at your own risk." >>note
+          echo "\`\`\`" >>note
+
+          $GH release create $VERSION-$BROMITE_SHA --notes-file note -d
+
+          # android arm
+          echo "::group::-------- android arm"
+          sudo cp ${{ env.OUTPUTFILE_ARM }}/apks/ChromePublic.apk arm_ChromePublic.apk
+          sudo chown runner arm_ChromePublic.apk
+          echo Uploading arm_ChromePublic
+          $GH release upload $VERSION-$BROMITE_SHA arm_ChromePublic.apk
+          echo "::endgroup::"
+
+          # android arm64
+          echo "::group::-------- android arm64"
+          sudo cp ${{ env.OUTPUTFILE_ARM64 }}/apks/ChromePublic.apk arm64_ChromePublic.apk
+          sudo chown runner arm64_ChromePublic.apk
+          echo Uploading arm64_ChromePublic
+          $GH release upload $VERSION-$BROMITE_SHA arm64_ChromePublic.apk
+          echo "::endgroup::"
+
+          # android x64
+          echo "::group::-------- android x64"
+          sudo cp ${{ env.OUTPUTFILE_X64 }}/apks/ChromePublic.apk x64_ChromePublic.apk
+          sudo chown runner x64_ChromePublic.apk
+          echo Uploading x64_ChromePublic
+          $GH release upload $VERSION-$BROMITE_SHA x64_ChromePublic.apk
+          echo "::endgroup::"
+
+          echo "::group::-------- chrome.size"
+          test $VERSION-$BROMITE_SHA $OUTPUTFILE_ARM64/chrome.size && \
+            $GH release upload $VERSION-$BROMITE_SHA $OUTPUTFILE_ARM64/chrome.size
+          echo "::endgroup::"
+
+          echo "::group::-------- ChromePublic.apk.mapping"
+          sudo cp ${{ env.OUTPUTFILE_ARM64 }}/apks/ChromePublic.apk.mapping arm64_ChromePublic.apk.mapping
+          $GH release upload $VERSION-$BROMITE_SHA arm64_ChromePublic.apk.mapping
+          sudo cp ${{ env.OUTPUTFILE_X64 }}/apks/ChromePublic.apk.mapping x64_ChromePublic.apk.mapping
+          $GH release upload $VERSION-$BROMITE_SHA x64_ChromePublic.apk.mapping
+          echo "::endgroup::"
+
+          echo "::group::-------- Uploading arm64_ninja_log_trace.html"
+          test $OUTPUTFILE_ARM64/ninja_log_trace.html && \
+            cp $OUTPUTFILE_ARM64/ninja_log_trace.html arm64_ninja_log_trace.html && \
+            $GH release upload $VERSION-$BROMITE_SHA arm64_ninja_log_trace.html
+          echo "::endgroup::"
+
+          # windows x64
+          echo "::group::-------- windows x64"
+          mkdir chrome-win/
+          cp $OUTPUTFILE_WIN/*.manifest chrome-win/
+          cp $OUTPUTFILE_WIN/chrome.dll chrome-win/
+          cp $OUTPUTFILE_WIN/chrome.exe chrome-win/
+          cp $OUTPUTFILE_WIN/chrome_100_percent.pak chrome-win/
+          cp $OUTPUTFILE_WIN/chrome_200_percent.pak chrome-win/
+          cp $OUTPUTFILE_WIN/chrome_elf.dll chrome-win/
+          cp $OUTPUTFILE_WIN/chrome_proxy.exe chrome-win/
+          cp $OUTPUTFILE_WIN/chrome_pwa_launcher.exe chrome-win/
+          cp $OUTPUTFILE_WIN/chrome_wer.dll chrome-win/
+          cp "/win_sdk/10.0.22621.0/Windows Kits/10/Redist/D3D/x64/d3dcompiler_47.dll" chrome-win/
+          cp $OUTPUTFILE_WIN/elevation_service.exe chrome-win/
+          cp "$OUTPUTFILE_WIN/First Run" chrome-win/
+          cp $OUTPUTFILE_WIN/headless_lib_data.pak chrome-win/
+          cp $OUTPUTFILE_WIN/icudtl.dat chrome-win/
+          cp $OUTPUTFILE_WIN/libEGL.dll chrome-win/
+          cp $OUTPUTFILE_WIN/libGLESv2.dll chrome-win/
+          cp $OUTPUTFILE_WIN/Logo.png chrome-win/
+          cp $OUTPUTFILE_WIN/mojo_core.dll chrome-win/
+          cp $OUTPUTFILE_WIN/notification_helper.exe chrome-win/
+          cp $OUTPUTFILE_WIN/resources.pak chrome-win/
+          cp $OUTPUTFILE_WIN/SmallLogo.png chrome-win/
+          cp $OUTPUTFILE_WIN/snapshot_blob.bin chrome-win/
+          cp $OUTPUTFILE_WIN/VkICD_mock_icd.dll chrome-win/
+          cp $OUTPUTFILE_WIN/VkLayer_khronos_validation.dll chrome-win/
+          cp $OUTPUTFILE_WIN/vk_swiftshader.dll chrome-win/
+          cp $OUTPUTFILE_WIN/vulkan-1.dll chrome-win/
+          cp -r $OUTPUTFILE_WIN/locales chrome-win/locales
+
+          #test chrome-win.zip && rm chrome-win.zip
+          zip -r chrome-win.zip chrome-win/
+
+          echo Uploading chrome-win.zip
+          $GH release upload $VERSION-$BROMITE_SHA chrome-win.zip
+          echo "::endgroup::"
+
+          echo "::group::-------- arm64 symbols"
+          zip arm64_symbols.zip ${{ env.OUTPUTFILE_ARM64 }}/dump_syms \
+                                ${{ env.OUTPUTFILE_ARM64 }}/minidump_stackwalk \
+                                ${{ env.OUTPUTFILE_ARM64 }}/libchrome.so
+          $GH release upload $VERSION-$BROMITE_SHA arm64_symbols.zip
+          echo "::endgroup::"
+
+          # workaround for https://github.com/cli/cli/issues/6599
+          sleep 30s
+
+          TIMESTAMP=$(date +%s -r chrome-win.zip)
+          echo >updateurl.txt "browser=chromium;os=windows;architecture=64-bit;timestamp=$TIMESTAMP;editor=uazo;channel=stable;repository=https://github.com/uazo/cromite/releases;download=https://github.com/uazo/cromite/releases/latest/download/chrome-win.zip;version=$(cat $OUTPUTFILE_WIN/RELEASE);revision=1;commit=$BROMITE_SHA"
+          $GH release upload $VERSION-$BROMITE_SHA updateurl.txt
+
+          $GH release edit $VERSION-$BROMITE_SHA -t $VERSION-$BROMITE_SHA
+          $GH release edit $VERSION-$BROMITE_SHA --draft=false
+
+          VERSION=$(cat ${{ env.OUTPUTFILE_ARM64 }}/RELEASE)
+          docker push uazo/cromite:$VERSION-$BROMITE_SHA
+          docker push uazo/cromite-build:$VERSION-$BROMITE_SHA
+
@@ -0,0 +1,24 @@
+name: 'Close stale issues and PRs'
+
+on:
+  schedule:
+    - cron: '30 1 * * *'
+
+  workflow_dispatch:
+
+permissions:
+    issues: write
+    pull-requests: write
+
+jobs:
+    stale:
+        runs-on: ubuntu-latest
+        steps:
+          - uses: actions/stale@v6
+            with:
+                exempt-all-milestones: true
+                any-of-labels: 'awaiting info'
+                days-before-stale: 5
+                days-before-close: 7
+                stale-issue-message: "This issue has been automatically marked as stale as there has been no recent activity in response to our request for more information. Please respond so that we can proceed with this issue."
+                close-issue-message: "This issue has been automatically closed as sufficient information hasn't been provided on the issue for further actions to be taken. Feel free to add more information."
@@ -0,0 +1,66 @@
+name: Update fdroid repo
+
+on:
+  workflow_dispatch:
+
+env:
+  REMOVEDOCKERSUPPORT: true
+  USELOCALIMAGE: true
+  USEINTERNALNETWORK: true
+
+jobs:
+  update-fdroid:
+    runs-on: ci2
+
+    container:
+      image: uazo/fdroidserver:latest
+      volumes:
+        - /tmp/forward-proxy:/tmp/forward-proxy
+
+    steps:
+       - name: Update fdroid repo
+         shell: bash
+         run: |
+            export https_proxy=http://127.0.0.1:8118
+            socat TCP-LISTEN:8118,reuseaddr,fork UNIX-CLIENT:/tmp/forward-proxy/proxy.sock &
+            socat TCP-LISTEN:1080,reuseaddr,fork UNIX-CLIENT:/tmp/forward-proxy/ftp.sock &
+            touch /etc/apt/apt.conf.d/proxy.conf
+            echo "Acquire::http::Proxy \"$https_proxy\";" >/etc/apt/apt.conf.d/proxy.conf
+
+            apt update
+
+            DEBIAN_FRONTEND=noninteractive apt update && apt install -y wget
+            wget https://github.com/rclone/rclone/releases/download/v1.64.0/rclone-v1.64.0-linux-amd64.zip
+            unzip rclone-v1.64.0-linux-amd64.zip
+            export rclone=rclone-v1.64.0-linux-amd64/rclone
+
+            mkdir -p  ~/.config/rclone
+            echo "${{ secrets.RCLONE_CONF }}" > ~/.config/rclone/rclone.conf
+
+            $rclone sync ftp:www.cromite.org/fdroid fdroid --log-level INFO --ftp-socks-proxy 127.0.0.1:1080
+
+            test -d /usr/share/man/man1 || mkdir -p /usr/share/man/man1
+            DEBIAN_FRONTEND=noninteractive apt install -y fdroidserver
+
+            cd fdroid/repo/
+            wget https://github.com/uazo/cromite/releases/latest/download/arm_ChromePublic.apk
+            wget https://github.com/uazo/cromite/releases/latest/download/arm64_ChromePublic.apk
+            wget https://github.com/uazo/cromite/releases/latest/download/x64_ChromePublic.apk
+
+            test arm_ChromePublic.apk.1 && rm arm_ChromePublic.apk && mv arm_ChromePublic.apk.1 arm_ChromePublic.apk
+            test arm64_ChromePublic.apk.1 && rm arm64_ChromePublic.apk && mv arm64_ChromePublic.apk.1 arm64_ChromePublic.apk
+            test x64_ChromePublic.apk.1 && rm x64_ChromePublic.apk && mv x64_ChromePublic.apk.1 x64_ChromePublic.apk
+            cd ..
+
+            gpg -d --passphrase "${{ secrets.FDROID_PASSPHRASE }}" --batch config.yml.asc >config.yml
+            gpg -d --passphrase "${{ secrets.FDROID_PASSPHRASE }}" --batch keystore.p12.asc >keystore.p12
+
+            fdroid update -c; fdroid update
+            rm config.yml keystore.p12
+            cd ..
+
+            test -f fdroid/config.yml && exit 1
+            test -f fdroid/keystore.p12 && exit 1
+
+            $rclone sync fdroid ftp:www.cromite.org/fdroid --log-level INFO --ftp-socks-proxy 127.0.0.1:1080
+            $rclone sync fdroid ftp:www.cromite.org/fdroid --log-level INFO --ftp-socks-proxy 127.0.0.1:1080
@@ -0,0 +1,6 @@
+################################################################################
+# This .gitignore file was automatically created by Microsoft(R) Visual Studio.
+################################################################################
+
+/.vs
+/temp
@@ -1,7 +1,209 @@
+# 105.0.5195.41
+* revert by-pass for clipboard permissions for NTP doodles (fixes https://bugs.chromium.org/p/chromium/issues/detail?id=1334203)
+* prevent history detection via favicon (fixes https://github.com/bromite/bromite/issues/2269)
+* fix the lack of protection in canvas.convertToBlob()
+* improve incognito mode detection countermeasures (thanks to @uazo, fixes https://github.com/bromite/bromite/issues/1615)
+* fix toolbar gesture when using bottom navigation bar (thanks to @uazo, fixes https://github.com/bromite/bromite/issues/2253)
+
+# 104.0.5112.91
+* re-introduce modal flag to prompt when closing all tabs
+* sharing hub: always use visible URL (fixes https://github.com/bromite/bromite/issues/2204)
+* add SVG fingerprinting mitigation (thanks to @uazo)
+* updated zh_CN translactions (thanks to @zhmars)
+* dropped patch to open YouTube links in Bromite
+
+# 104.0.5112.63
+
+# 103.0.5060.140
+* fix timezone override not working correctly (thanks to @uazo, fixes https://github.com/bromite/bromite/issues/2133)
+* never provide navigator.connection info (thanks to @uazo)
+* fix management of custom User-Agent (thanks to @uazo)
+
+# 103.0.5060.126
+* fix malfunctioning sticky desktop mode (thanks to @uazo, fixes https://github.com/bromite/bromite/issues/2179)
+* fix non-working passwords manager (thanks to @uazo, fixes https://github.com/bromite/bromite/issues/2188)
+* fix crash when opening recent tabs (thanks to @uazo, fixes https://github.com/bromite/bromite/issues/2190)
+* fix autoplay not working correctly (thanks to @uazo, fixes https://github.com/bromite/bromite/issues/2096)
+* add GN flag for clangd builds (thanks to @uazo)
+
+# 103.0.5060.121
+* do not enable always use HTTPS by default
+* match system dark mode (thanks to @krlvm)
+* remove window name on cross origin navigation (thanks to @uazo)
+* remove preload of GMS fonts on stock Android (thanks to @uazo, fixes https://github.com/bromite/bromite/issues/2156)
+
+# 102.0.5005.96
+* fix history expiration bug (thanks to @uazo, fixes https://github.com/bromite/bromite/issues/2104)
+* fix category setting activation (thanks to @uazo, fixes https://github.com/bromite/bromite/issues/2091)
+* improve plain text rendering on mobile
+* rewritten certificate transparency patch (fixes https://github.com/bromite/bromite/issues/2101)
+
+# 102.0.5005.92
+* restore offline-indicator-v2 flag functionality (thanks to @Zelda189)
+
+# 102.0.5005.67
+* dropped patch to disable mobile identity consistency by default
+* fix text for blocked ads (fixes https://github.com/bromite/bromite/issues/2026)
+* fix OpenSeach visited site detection bug (fixes https://github.com/bromite/bromite/issues/1994)
+
+# 101.0.4951.69
+* flag to toggle site engagement (thanks to @uazo, fixes https://github.com/bromite/bromite/issues/2022)
+* site settings to enable webGL (thanks to @uazo)
+* removed flag to disable webGL
+* fix bottom navigation bar search/site suggestions behaviour (thanks to @uazo, fixes https://github.com/bromite/bromite/issues/2049)
+* enable process isolation for all iframes
+* add webRTC site settings (thanks to @uazo, fixes https://github.com/bromite/bromite/issues/1965)
+
+# 101.0.4951.53
+* move incognito settings to separate page (thanks to @uazo)
+* disable automatic offline pages saving by default (thanks to @uazo)
+* make history support and site settings in always incognito mode disabled by default (thanks to @uazo, fixes https://github.com/bromite/bromite/issues/1991)
+* move pop-up toolbar to the bottom when using bottom navigation bar (thanks to @uazo, fixes https://github.com/bromite/bromite/issues/2030)
+* menu does not show all entries (thanks to @uazo, fixes https://github.com/bromite/bromite/issues/2011)
+* stray shadow when using bottom toolbar (thanks to @uazo, fixes https://github.com/bromite/bromite/issues/1995)
+
+# 101.0.4951.39
+* save only ContentSettings in always-incognito mode (thanks to @uazo, fixes https://github.com/bromite/bromite/issues/1942)
+* fix a couple issues related to signin and metrics leftover code affecting debug builds (thanks to @uazo)
+* remove some more parameters from the English-version search engine (thanks to @uazo)
+* add welcome screen with mention of privacy statements (fixes https://github.com/bromite/bromite/issues/691)
+
+# 100.0.4896.135
+* remove mremap from seccomp baseline policy
+* add flag to move top toolbar to bottom (thanks to @uazo)
+
+# 100.0.4896.92
+* improve user script errors and visualized name (thanks to @uazo)
+* fix autofill password not working anymore (thanks to @uazo, fixes https://github.com/bromite/bromite/issues/1956)
+* mark sites as visited when they have an already-parsed OpenSearch descriptor
+* disable TLS resumption by default (thanks to @uazo)
+* partition DoH requests by top-frame NIK (thanks to @uazo)
+
+# 100.0.4896.83
+* update zh_CN translations (thanks to @zhmars)
+* fix custom UA reported via Javascript (thanks to @uazo, fixes https://github.com/bromite/bromite/issues/1936)
+* introduce session granularity for permissions (thanks to @uazo, fixes https://github.com/bromite/bromite/issues/1549)
+* disable crash reporting
+* avoid script injection on some sites
+* fix upstream OpenSearch bug with search engines prematurely discarded
+* fix upstream DNS bug with inconsistent Android system DNS configuration (fixes https://github.com/bromite/bromite/issues/1960)
+* use less invasive approach to protect local IP address when using webRTC (fixes https://github.com/bromite/bromite/issues/589)
+* add menu entry to select all bookmarks (fixes https://github.com/bromite/bromite/issues/1959)
+* fix Note 9 crash on startup (thanks to @uazo, fixes https://github.com/bromite/bromite/issues/1871)
+* remove passwords menu entry for leak check
+* remove privacy menu entry to use phone as a security key
+
+# 100.0.4896.57
+* allow OpenSearch search engine URLs with path
+* disable AsyncDNS by default
+* remove translate menu entries
+* fix patch to remove contextual search (thanks to @nikolowry)
+* add option to never expire history
+* improve description for JIT site settings (fixes https://github.com/bromite/bromite/issues/1931)
+* remove more signin integration (fixes https://github.com/bromite/bromite/issues/1902)
+* miscellaneous fixes for AMP and background video playback (fixes https://github.com/bromite/bromite/issues/1921)
+* update zh_CN translations (thanks to @zhmars)
+
+# 99.0.4844.77
+* fix missing adaptive icon for updates
+* do not close adblock filters editor when tapping reset button
+* change text for 'Never' in history days to keep setting
+* bring back dictionary hints in address bar
+
+# 99.0.4844.58
+* remove contextual search (fixes https://github.com/bromite/bromite/issues/1750)
+* remove global JIT settings
+* add privacy setting for how many number of days of history to keep (thanks to @uazo, fixes https://github.com/bromite/bromite/issues/1870)
+* disable UA full version (thanks to @uazo)
+* reintroduce patch for Save-Data header
+* updated zh_CN translations (thanks to @zhmars)
+* reintroduce Save-Data header flag
+
+# 99.0.4844.55
+* flag to enable Certificate Transparency (thanks to @uazo, fixes https://github.com/bromite/bromite/issues/1554)
+* allow adding search engines from incognito mode
+* disable all predictors code (thanks to @uazo)
+* revert allow block of view-source URLs
+* enable StrictOriginIsolation and SitePerProcess for all devices (thanks to @uazo)
+* JIT toggle site setting (thanks to @uazo, fixes https://github.com/bromite/bromite/issues/1720 and https://github.com/bromite/bromite/issues/1819)
+* move always incognito preference to native (thanks to @uazo, fixes https://github.com/bromite/bromite/issues/1496 and https://github.com/bromite/bromite/issues/1568)
+* remove Save-Data header flag
+* close a potential security issue with user scripts on native pages (thanks to @uazo)
+* disable safety checks and possible Omaha interactions
+* disable SegmentationPlatformFeature and Optimization Hints (thanks to @uazo, fixes https://github.com/bromite/bromite/issues/1632)
+* add notification for a major upstream version being released (fixes https://github.com/bromite/bromite/issues/1796)
+* fix screenshots in incognito allowed by default (fixes https://github.com/bromite/bromite/issues/1816)
+
+# 98.0.4758.116
+* disable minidumps upload
+* complete disabling of client hint headers (thanks to @uazo)
+* disable another way to activate origin trials (thanks to @uazo)
+* fix for gateway attacks via websockets blocking (thanks to @uazo, fixes https://github.com/bromite/bromite/issues/1693)
+
+# 98.0.4758.108
+* re-introduce flag for text fragments
+* re-introduce content feature flag to disable field trials
+* disable idle detection
+* disable critical client hints
+* disable supervised users
+* partial fix for incognito notification (thanks to @uazo, fixes https://github.com/bromite/bromite/issues/1503)
+* consider websockets 'unknown' address space as 'public' (thanks to @uazo, fixes https://github.com/bromite/bromite/issues/1693)
+* fix crash when accessing site settings of some sites (thanks to @uazo, fixes https://github.com/bromite/bromite/issues/1355)
+
+# 97.0.4692.106
+* disable url-keyed metrics reporting service (thanks to @uazo)
+* disable mobile identity consistency by default
+* disable appending variations header
+* use Google Chrome branding for client hints
+* make HTTPS-only mode enabled by default
+* enable trivial auto var init (thanks to @BayLee4, fixes https://github.com/bromite/bromite/issues/1749)
+* enable use_cfi_cast
+
+# 96.0.4664.183
+* updated zh_CN translations (thanks to @zhmars)
+
+# 96.0.4664.104
+* separate patches for package name
+
+# 96.0.4664.54
+* restored offline-indicator-v2 flag (fixes https://github.com/bromite/bromite/issues/1588)
+* re-introduced option to use home page as NTP (thanks to @uazo, fixes https://github.com/bromite/bromite/issues/1519)
+* ask user before closing all tabs (thanks to @uazo, fixes https://github.com/bromite/bromite/issues/1561)
+* fix crash on always incognito on tablet (thanks to @uazo, fixes https://github.com/bromite/bromite/issues/1611)
+* dropped patch to not upload crash data
+* fix autofill pop-up not appearing (thanks to @uazo, fixes https://github.com/bromite/bromite/issues/1534)
+
+# 95.0.4638.79
+* improvements for field trials disable patch (thanks to @uazo)
+* remove privacy sandbox UI leftover (thanks to @uazo, fixes https://github.com/bromite/bromite/issues/1560)
+* disable conversion measurement API (thanks to @uazo, fixes https://github.com/bromite/bromite/issues/1531)
+* remove all code related to FLoC (thanks to @uazo)
+* remove all code related to ENABLE_REPORTING (thanks to @uazo)
+* enable ad-tagging feature
+* SystemWebView: ignore StrictMode warning (thanks to @jylitalbit, https://github.com/bromite/bromite/pull/1567)
+* improvements for field trials fetch patch (thanks to @uazo)
+* disable accessibility service by default (thanks to @uazo, https://github.com/bromite/bromite/pull/1559)
+
+# 95.0.4638.78
+* disable third-party origin trials (fixes https://github.com/bromite/bromite/issues/1530)
+* dropped patch for async DNS flag
+* dropped duplicate patch for pull-to-refresh flag
+* fix application not closing on incognito tab (thanks to @uazo, fixes https://github.com/bromite/bromite/issues/1503)
+* fix external links in incognito not always opening (thanks to @uazo, fixes https://github.com/bromite/bromite/issues/1474)
+* fix incognito tab closing new tab under normal tab (thanks to @uazo, fixes https://github.com/bromite/bromite/issues/1030)
+* allow custom tab intents and opening external links in incognito (thanks to @uazo)
+* never use HTTP probes for connectivity check on Android < M
+* re-introduce option to use home page as NTP (thanks to @uazo, https://github.com/bromite/bromite/pull/1586)
+
+# 94.0.4606.109
+* experimental user scripts support (thanks to @uazo, fixes https://github.com/bromite/bromite/issues/792)
+* Bromite auto-update notifications enabled by default
+* enable Android native autofill (thanks to @uazo, fixes https://github.com/bromite/bromite/issues/547)
+
 # 94.0.4606.102
 * add flag to disable pull-to-refresh effect
 * add recents, offlinepage and send to home screen for always incognito (thanks to @uazo, fixes https://github.com/bromite/bromite/issues/1182 and https://github.com/bromite/bromite/issues/1362)
-* prompt to restart when always-incognito is enabled (thanks to @uazo, fixes https://github.com/bromite/bromite/issues/1474)
+* prompt to restart when always-incognito is enabled (thanks to @uazo, fixes https://github.com/bromite/bromite/issues/1459)
 * merge patches for custom tab intents

 # 94.0.4606.94
@@ -116,7 +318,7 @@
 * use 64-bit ABI for webview processes (fixes https://github.com/bromite/bromite/issues/997)
 * use dedicated folder for bookmark all tabs
 * fix Javascript and cookies permissions missing (thanks to @uazo, fixes https://github.com/bromite/bromite/issues/990)
-* fix missing enable save data header flag (fixes https://github.com/bromite/bromite/issues/989)
+* fix missing enable Save-Data header flag (fixes https://github.com/bromite/bromite/issues/989)
 * fix menu items not properly displayed with tab overflow menu regroup (thanks to @uazo, fixes https://github.com/bromite/bromite/issues/963)

 # 89.0.4389.78
@@ -20,7 +20,7 @@ Projects which follow a strict approach on this are [Iridium](https://iridiumbro

 Yes, in order to play protected/encrypted media content the browser will use Android's DRM media framework to automatically negotiate access (same as Chromium).
 This means for example that requests to Android license servers will be performed (`www.googleapis.com`), see https://w3c.github.io/encrypted-media/#direct-individualization
-To disable this functionality you should disable protected content playback from Site settings -> Multimedia.
+To disable this functionality you should disable protected content playback from Site settings -> Protected Content.

 ## What is the SystemWebView?
 It is the core component of Android for all web page visualizations. For example when you access a new wifi network and need to activate it, that is using the SystemWebView. If you do not know what it is then you do not need to install it.
@@ -31,14 +31,14 @@ Ad-blocking was present and always enabled in the SystemWebView from version `72

 ## How to enable DNS-over-HTTPS?

-See [this wiki page](https://github.com/bromite/bromite/wiki/Enabling-DNS-over-HTTPS).
+See [this page](https://www.bromite.org/doh).

 ## Can you add HTTPS everywhere?
 No.
 We cannot add add-ons to Bromite (merely some features).

 ## Is Bromite on Play Store?
-No, and this is unlikely to change. Many limitations apply for submissions there, including which ads are allowed to be blocked.
+No, and this is not going to change. Many limitations apply for submissions there, including which ads are allowed to be blocked.

 Bromite favors user freedom in software choice: the device is yours so you get to choose which software to run on it, end of the story.

@@ -48,9 +48,7 @@ It is not on the official F-Droid repository and there are no (more) plans to su
 You can use F-Droid client to install and receive updates via [the official Bromite F-Droid repository](https://www.bromite.org/fdroid).

 ## Does Bromite support WebRTC?
-Yes, since version 69. While the desktop version of Chromium has an option to disable it (video/audio site settings), the Android version cannot.
-
-The WebRTC functionality has always been using safe defaults to prevent leaks (disabled multiple routes and non-proxied UDP).
+Partially, see https://github.com/bromite/bromite/wiki/WebRTC

 ## Using Bromite will favour the monopoly of the Chromium/Blink engine, why do you develop and maintain Bromite?
 In short, to show what a Chromium-based engine could do **for the user** if the user experience and needs were the main focus of modern browser design.
@@ -74,9 +72,20 @@ PWAs are only supported as home shortcuts; WebAPKs will not work because they ar

 ## Does Bromite support the Android autofill framework?

-No; the only autofill available in Chromium browsers requires integration with the Play Store binary blobs.
-Some apps use accessibility services as a workaround.
+Yes, since version 94.0.4606.109 the native Android autofill can be used; this does not require accessibility services as a workaround.

 ## Does Bromite support casting media content?

-No; this would require Play Store binary blobs.
+No, this would require Play Store binary blobs.
+
+## Can you add this search engine as default?
+No.
+Bromite does not make any choice related to default search engines, the Chromium default is used.
+Various Android browsers get some fee to ship their apps with a specific default search engine, Bromite does not get any fee from anyone.
+Changing the default search engine would lead to an endless series of requests to change it based on personal preferences, thus no change is made to the default.
+See also: https://github.com/bromite/bromite/wiki/SearchEngines
+
+## Some sites show ads, how can I fix this?
+You can compare the blocked URLs with a desktop browser and Bromite (using [remote debugging](https://developer.chrome.com/docs/devtools/remote-debugging/)) and figure out some new filter rules to be added.
+If the ads are blocked via cosmetic filtering then blocking them is not possible with Bromite's engine and you might need something like an [user script](https://github.com/bromite/bromite/wiki/UserScripts) instead.
+See also: https://github.com/bromite/bromite/wiki/AdBlocking
@@ -1,14 +1,22 @@
-# Bromite - Take back your browser
+<a href="https://github.com/uazo/cromite/releases/latest">
+  <img src="https://img.shields.io/github/v/release/uazo/cromite" alt="current Cromite release" title="current Cromite release" />
+</a>
+<br>

-<img src="https://www.bromite.org/release.svg" alt="current Bromite release" title="current Bromite release" /> <img src="https://www.bromite.org/license.svg" alt="GNU GPL v3" title="GNU VPL v3" />
+[![Build Cromite](https://github.com/uazo/cromite/actions/workflows/build_cromite.yaml/badge.svg)](https://github.com/uazo/cromite/actions/workflows/build_cromite.yaml)

-<img title="Bromite - take back your browser!" src="https://www.bromite.org/android-icon-192x192.png" width="96" alt="Bromite" />
+# Cromite (a Bromite fork) - Take back your browser

-Bromite is a [Chromium](https://www.chromium.org/Home) fork with support for ad blocking and enhanced privacy.
+<a href="https://www.cromite.org">
+  <img title="Cromite - take back your browser!" src="https://www.cromite.org/app_icon.png" width="96" alt="Bromite" />
+</a>
+<br>

-Bromite is only available for Android Lollipop (v5.0, API level 21) and above.
+### **** the documentation is a Work in progress (not the browser :) ****

-<img src="https://fdroid.bromite.org/fdroid/bromite_bromite_gh_downloads.svg" alt="Downloads on Github" title="Downloads on Github" />
+Cromite is a [Chromium](https://www.chromium.org/Home) fork based on [Bromite](https://github.com/bromite/bromite) with built-in support for ad blocking and an eye for privacy.
+
+Cromite is available for Android arm64-v8a, arm32-v7a and x86_64, Nougat and above (Minimum v7.0, API level 24) and Windows.

 For the Frequently Asked Questions see [F.A.Q.](./FAQ.md).

@@ -16,44 +24,39 @@ For documentation see the [wiki](https://github.com/bromite/bromite/wiki).

 # Goals

-Bromite aims at providing a no-clutter browsing experience without privacy-invasive features and with the addition of a fast ad-blocking engine.
-Minimal UI changes are applied to help curbing the idea of "browser as an advertisement platform".
+Cromite's goal is to
+- limit the features built into the browser that can be used as a platform for tracking users' habits, and, if it is not technically possible, disable them and leave it up to the user to choose whether to re-enable them
+- limit the close integration between the browser and its manufacturer
+- not let the excellent research work done by csagan5 with Bromite be lost

-# Donate
-
-Please donate to support development of Bromite and the costs for the build system.
-
-[&rarr; Support development with a donation](https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=JP3XTQPVRNET2): [![paypal](https://www.bromite.org/assets/img/btn_donate_LG.gif)](https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=JP3XTQPVRNET2)
-
-<a href="bitcoin:bc1qmpyuqsvs3tz3uaysplmwjr33gg4rzu6cqweaq834ehc25vduxppqkrszel">BTC donations address</a>: `bc1qmpyuqsvs3tz3uaysplmwjr33gg4rzu6cqweaq834ehc25vduxppqkrszel`
-
-ETH donations address: `0xf47ff39223d828f99fec5ab53bd068c5c0522042`
+In addition, Cromite would like to promote greater integration with other non-profit, open source browsers, encouraging closer collaboration with others, and attempt to integrate them directly into Chromium once they have reached an appropriate level of maturity.

 # Features

-* customizable adblock filters via user-provided URL (see https://www.bromite.org/custom-filters)
+#### Derived from Bromite
+* customizable adblock filters via user-provided URL (see https://www.bromite.org/custom-filters) (deprecated, replaced by adblock plus)
+* automatically updated adblock filters
 * remove click-tracking and AMP from search results
 * DNS-over-HTTPS support with any valid IETF DoH endpoint
 * always-incognito mode
 * disable all field trials permanently
 * disable smart search by default, allow web search from incognito mode
-* always-visible cookies, javascript and ads site settings
+* always-visible cookies, javascript and ads site settings from address bar popup
 * remove Play integration binary blobs
-* use [CFI](https://en.wikipedia.org/wiki/Control-flow_integrity) on all architectures except x86
+* ~use [CFI](https://en.wikipedia.org/wiki/Control-flow_integrity) on all architectures except x86 and Windows~ dropped from v117 see https://github.com/uazo/cromite/discussions/292
+* enable trivial auto var init
 * disable media router and remoting by default
 * disable dynamic module loading
 * show warnings for TLSv1.0/TLSv1.1 pages
 * enable site-per-process isolation for all devices with memory > 1GB
-* completely remove safe browsing and other privacy-unfriendly features
 * [proxy configuration page](https://github.com/bromite/bromite/wiki/ProxyConfiguration) with PAC and custom proxy lists support
 * settings to disable custom intents and clear session on exit
 * flags to toggle anti-fingerprinting mitigations for canvas, audio, client rects, webGL and sensor APIs (see full list below for all the new flags)
 * use frozen User-Agent to conceal real model and browser version
 * privacy enhancement patches from [Iridium](https://iridiumbrowser.de/), [Inox patchset](https://github.com/gcarq/inox-patchset), [Brave](https://brave.com/) and [ungoogled-chromium](https://github.com/Eloston/ungoogled-chromium) projects
 * security enhancement patches from [GrapheneOS](https://github.com/GrapheneOS) project
-* disable scroll-to-text-fragment
 * reduced referer granularity
-* block gateway attacks via websockets
+* block gateway attacks via websockets (partial fix, see [this upstream issue](https://bugs.chromium.org/p/chromium/issues/detail?id=590714))
 * use 64-bit ABI for webview processes
 * make all favicon requests on-demand ([supercookie](https://supercookie.me/) mitigation)
 * enable all network isolation features (`PartitionConnectionsByNetworkIsolationKey`, `PartitionHttpServerPropertiesByNetworkIsolationKey`, `SplitHostCacheByNetworkIsolationKey`, `AppendFrameOriginToNetworkIsolationKey`, `SplitCacheByNetworkIsolationKey`, `UseRegistrableDomainInNetworkIsolationKey`, `PartitionSSLSessionsByNetworkIsolationKey`, `PartitionExpectCTStateByNetworkIsolationKey`, `PartitionDomainReliabilityByNetworkIsolationKey`)
@@ -61,19 +64,114 @@ ETH donations address: `0xf47ff39223d828f99fec5ab53bd068c5c0522042`
 * ask permission to play protected media
 * disable the DIAL repeating discovery
 * disable RTCGetCurrentBrowsingContextMedia by default
-* disable FLoC by default
+* disable FLoC and privacy sandbox by default
 * disable feeds
 * disable reporting of certificate errors
 * use pre-defined phone model for client hints and Javascript
-* site settings to disable images
 * allow forcing external links to open in incognito
 * disable AGSA by default
-* allow disabling JIT
+* flag to enable Certificate Transparency
+* allow adding search engines from incognito mode
+* disable predictors
+* disable supervised users
+* disable safety check
+* disable capability to block `view-source:` URLs
+* disable `SegmentationPlatformFeature`, `OptimizationHints`, client hint headers
+* disable `AsyncDNS` by default
+* customize history expiration threshold
+* disable idle detection
+* HTTPS-only mode enabled by default
+* disable TLS resumption by default
+* strict site isolation and strict origin isolation
+* partition blobs by top frame URL
+
+#### Cromite-specific features
+
+* Built-in Adblock Plus [patch](https://github.com/uazo/bromite/blob/master/build/patches/00Eyeo-Adblock-Remove-Privacy-Issues.patch) (issue [84](https://github.com/uazo/bromite-buildtools/issues/84))
+* policy browser patch for the use of enterprise policy [patch](https://github.com/uazo/bromite/blob/master/build/patches/00add-browser-policy.patch) (issue [191](https://github.com/uazo/bromite-buildtools/issues/191))
+  - deactivate safe browsing and extended reporting
+  - disabled scroll-to-text-fragment
+  - disabled contextual search
+  - disabled media router
+  - disabled url keyed anonymized data collection
+  - disabled translate
+  - disabled network prediction
+  - disabled sign-in
+  - disabled google search side panel
+  - disabled automatic https upgrades
+* internal firewall to block all unauthorised calls made from the browser [patch](https://github.com/uazo/bromite/blob/master/build/patches/00Internal-firewall.patch) (issue [147](https://github.com/uazo/bromite-buildtools/issues/147))
+* show warnings on downloads over HTTP [patch](https://github.com/uazo/bromite/blob/master/build/patches/00Show-warnings-on-downloads-over-HTTP.patch)
+* lock profile cookie database [patch](https://github.com/uazo/bromite/blob/master/build/patches/00Lock-Profile-Cookie-Database.patch)
+* remove support for device memory and cpu recovery [patch](https://github.com/uazo/bromite/blob/master/build/patches/00Remove-support-for-device-memory-and-cpu-recovery.patch)
+* disable speechSynthesis getVoices API [patch](https://github.com/uazo/bromite/blob/master/build/patches/00Disable-speechSynthesis-getVoices-API.patch)
+* viewport Protection patch [patch](https://github.com/uazo/bromite/blob/master/build/patches/Viewport-Protection-flag.patch)
+* deprecate Data URL in SVGUseElement [patch](https://github.com/uazo/bromite/blob/master/build/patches/00Deprecate-Data-URL-in-SVGUseElement.patch)
+* disallow Android App Scheme as referrer [patch](https://github.com/uazo/bromite/blob/master/build/patches/00Disallow-Android-App-Scheme-as-referrer.patch)
+* disable Compression Dictionary Transport [patch](https://github.com/uazo/bromite/blob/master/build/patches/00Disable-Compression-Dictionary-Transport.patch)
+* disable PrivateStateTokens API [patch](https://github.com/uazo/bromite/blob/master/build/patches/00Disable-PrivateStateTokens-API.patch)
+* disable GSA by default [patch](https://github.com/uazo/bromite/blob/master/build/patches/00Disable-GSA-by-default.patch)
+* disable GetInstalledRelatedApps API [patch](https://github.com/uazo/bromite/blob/master/build/patches/00Disable-GetInstalledRelatedApps-API.patch)
+* disable FirstPartySets and StorageAccessAPI [patch](https://github.com/uazo/bromite/blob/master/build/patches/00Disable-FirstPartySets-and-StorageAccessAPI.patch)
+* disable WebGPU [patch](https://github.com/uazo/bromite/blob/master/build/patches/00Disable-WebGPU.patch)
+* disable GamePad API [patch](https://github.com/uazo/bromite/blob/master/build/patches/00Add-a-flag-to-disable-GamePad-API.patch)
+* remove external https connection from chrome://discards [patch](https://github.com/uazo/bromite/blob/master/build/patches/00Remove-https-connection-from-chrome-discards.patch)
+* links the use of screen.isExtended to WINDOW_MANAGEMENT permission granted by user [patch](https://github.com/uazo/bromite/blob/master/build/patches/00Multi-Screen-Window-Placement-API-fix.patch)
+* clear CORS Preflight Cache on clearing data [patch](https://github.com/uazo/bromite/blob/master/build/patches/00Clear-CORS-Preflight-Cache-on-clearing-data.patch)
+* remove auth header upon cross origin redirect [patch](https://github.com/uazo/bromite/blob/master/build/patches/00Remove-auth-header-upon-cross-origin-redirect.patch)
+* disable SHA1 Server Signature [patch](https://github.com/uazo/bromite/blob/master/build/patches/00Disable-SHA1-Server-Signature.patch)
+* remove detection of captive portals [patch](https://github.com/uazo/bromite/blob/master/build/patches/00Remove-detection-of-captive-portals.patch)
+* disable devtools remote and custom protocols [patch](https://github.com/uazo/bromite/blob/master/build/patches/00Disable-devtools-remote-and-custom-protocols.patch)
+* enable Document Open Inheritance Removal [patch](https://github.com/uazo/bromite/blob/master/build/patches/00Enable-Document-Open-Inheritance-Removal.patch)
+* warning message for unsupported hardware aes [patch](https://github.com/uazo/bromite/blob/master/build/patches/00Warning-message-for-unsupported-hardware-aes.patch)
+* partition HSTS cache by NAK [patch](https://github.com/uazo/bromite/blob/master/build/patches/00Partition-HSTS-cache-by-NAK.patch)
+* disable password leak detector [patch](https://github.com/uazo/bromite/blob/master/build/patches/00Disable-privacy-issues-in-password-manager.patch)
+* keyboard protection flag [patch](https://github.com/uazo/bromite/blob/master/build/patches/00Keyboard-protection-flag.patch)
+* disable csp reports [patch](https://github.com/uazo/bromite/blob/master/build/patches/00Disable-csp-reports.patch)
+* add setting to clear data on exit [patch](https://github.com/uazo/bromite/blob/master/build/patches/00Add-setting-to-clear-data-on-exit.patch)
+* disable visited pseudo class [patch](https://github.com/uazo/bromite/blob/master/build/patches/00Disable-visited-pseudo-class.patch)
+* disable BackForwardCache [patch](https://github.com/uazo/bromite/blob/master/build/patches/00Disable-BackForwardCache.patch)
+* disable FedCm [patch](https://github.com/uazo/bromite/blob/master/build/patches/00Disable-FedCm.patch)
+* partitioning all cookies by top frame domain [patch](https://github.com/uazo/bromite/blob/master/build/patches/00Partitioning-all-cookies-by-top-frame-domain.patch)
+* fingerprint mitigation for AudioBuffer and AnalyserNode [patch](https://github.com/uazo/bromite/blob/master/build/patches/AudioBuffer-AnalyserNode-fp-mitigations.patch)
+
+##### from [116.0.5845.111](https://github.com/uazo/cromite/issues/205#issuecomment-1690216310)
+* Disable PartnerCustomizations [patch](https://github.com/uazo/cromite/blob/master/build/patches/00Disable-PartnerCustomizations.patch) [#202](https://github.com/uazo/cromite/issues/202)
+* Add option to disable snapshots [patch](https://github.com/uazo/cromite/blob/master/build/patches/00Add-option-to-disable-snapshots.patch) [#201](https://github.com/uazo/cromite/issues/201)
+* Enable Android Dynamic Performance Framework on renderer [patch](https://github.com/uazo/cromite/blob/master/build/patches/00Enable-Android-Dynamic-Performance-Framework.patch) 
+
+##### from [117.0.5938.63](https://github.com/uazo/cromite/issues/293)
+* Added support for blocking in service workers in AdblockPlus #254 [patch](https://github.com/uazo/cromite/blob/master/build/patches/00AdblockPlus-add-blocking-in-service-workers.patch)
+* Drop CFI support (see https://github.com/uazo/cromite/discussions/292)
+* Enabled Improved Bookmarks UI by default [patch](https://github.com/uazo/cromite/blob/master/build/patches/00Enable-ImprovedBookmarks-by-default.patch)
+* Removed Google private API from accounts.google.com [patch](https://github.com/uazo/cromite/blob/master/build/patches/00Remove-GoogleAccountsPrivateApiHost.patch)
+
+##### from [117.0.5938.140](https://github.com/uazo/cromite/issues/349#issuecomment-1740388786)
+* Partition MediaDeviceId by default [patch](https://github.com/uazo/cromite/blob/master/build/patches/00Partition-MediaDeviceId-by-default.patch)
+
+##### from [118.0.5993.118](https://github.com/uazo/cromite/issues/458#issuecomment-1780511486)
+* Add support for jpeg xl [patch](https://github.com/uazo/cromite/blob/master/build/patches/00Add-support-to-jxl.patch) https://github.com/uazo/cromite/issues/351
+* Disable prefers-reduced-transparency media query [patch](https://github.com/uazo/cromite/blob/master/build/patches/00Disable-prefers-reduced-transparency-media-query.patch) https://github.com/uazo/cromite/issues/437
+* Show full urls for bookmark [patch](https://github.com/uazo/cromite/blob/master/build/patches/00Show-full-urls-for-bookmark.patch) https://github.com/uazo/cromite/issues/434
+
+#### Windows Cromite-specific features
+
+* enable Network Service Sandbox by default
+* disable sharing hub
+* disable search for image
+* simpler logging to file
+* disable TabHoverCard images
+* enable File System Access blocklist
+* enable HighEfficiencyMode by default
+* disable annotates on downloads
+* enabled pdf plugin by default

 ## Features not related to privacy
+
+#### Derived da Bromite
+* browser automatic updates, enabled by default
+* native Android autofill support
 * import/export bookmarks
 * bookmark all tabs from tabs regroup menu
-* flag to allow screenshots of incognito tabs
 * allow playing videos in background tabs and disable pause on switching tabs
 * all codecs included (proprietary, open H.264 etc.)
 * [AV1 codec support](https://github.com/bromite/bromite/wiki/AV1-support)
@@ -86,17 +184,24 @@ ETH donations address: `0xf47ff39223d828f99fec5ab53bd068c5c0522042`
 * adding an URL as bookmark will clear its blocked status for the NTP tiles
 * history support in incognito mode
 * view source of pages
-* timezone customization
 * sticky desktop mode setting
-* disable video autoplay by default, reintroduce site settings
 * mobile/desktop user agent customization
 * accessibility preference to force tablet UI
 * use Alt+D to focus address bar
 * allow sharing to Bromite
-* browser automatic updates
 * UI for crash information collection
+* allow OpenSearch search engine detection in incognito
+* allow OpenSearch search engine detection with paths
+* keyboard dictionary hints in address bar
+* always allow `view-source:` URLs
+* allow moving navigation bar to bottom
+* add option to use home page as NTP

-You can inspect all functionality/privacy changes by reading the [patches](https://github.com/bromite/bromite/tree/master/build/patches) and/or the [CHANGELOG](./CHANGELOG.md).
+#### Cromite-specific features
+
+* add setting in android to invert tap and long tap [patch](https://github.com/uazo/bromite/blob/master/build/patches/00Add-setting-to-invert-tap-and-long-tap.patch)
+
+(TODO) You can inspect all functionality/privacy changes by reading the [patches](https://github.com/bromite/bromite/tree/master/build/patches) and/or the [CHANGELOG](./CHANGELOG.md).

 ### Flags

@@ -110,15 +215,16 @@ Flags which have been retired from upstream Chromium but are still available in
 * `#num-raster-threads`
 * `#enable-image-reader`, enabled by default
 * `#enable-tab-groups` and `#enable-tab-groups-ui-improvements`
+* `#offline-indicator-v2`
+* `#enable-jxl`

 New flags:

 * `#fingerprinting-canvas-image-data-noise`, `#fingerprinting-client-rects-noise` and `#fingerprinting-canvas-measuretext-noise`, enabled by default
-* `#enable-incognito-snapshots-in-android-recents`, disabled by default
+* `#incognito-screenshot`, disabled by default
 * `#max-connections-per-host`
 * `#resume-background-video`
 * `#ipv6-probing`
-* `#disable-webgl`
 * `#enable-device-motion` and `#enable-device-orientation`
 * `#show-legacy-tls-warnings`
 * `#save-data-header`, disabled by default
@@ -126,26 +232,76 @@ New flags:
 * `#allow-user-certificates`, disabled by default
 * `#cleartext-permitted`, enabled by default, can be used to disable all cleartext-HTTP traffic
 * `#omnibox-autocomplete-filtering`, can be used to restrict omnibox autocomplete results
-* `#disable-external-intent-requests`
+* `#disable-external-intent-requests`, can be used to disable opening any external app for any URL
+* `#enable-userscripts-log`, see https://github.com/bromite/bromite/wiki/UserScripts#flags
+* `#certificate-transparency-enabled`, enabled by default; see https://chromium.googlesource.com/chromium/src/+/master/net/docs/certificate-transparency.md
+* `#move-top-toolbar-to-bottom`, disabled by default
+* `#site-engagement`, enabled by default, can be used to disable the automatically-generated icons for most visited sites on the NTP
+
+### Site settings
+
+* webGL, disabled by default
+* images, enabled by default
+* Javascript JIT, disabled by default
+* timezone customization override
+* autoplay, disabled by default
+* webRTC, disabled by default
+* viewport protection, enabled by default

 # Privacy limitations

-Bromite's privacy features, including anti-fingerprinting mitigations (which are not comprehensive), **are not to be considered useful for journalists and people living in countries with freedom limitations**, please look at [Tor Browser](https://www.torproject.org/download/) in such cases.
+Cromite's privacy features, including anti-fingerprinting mitigations (which are not comprehensive), **are not to be considered useful for journalists and people living in countries with freedom limitations**, please look at [Tor Browser](https://www.torproject.org/download/) in such cases.
+Please note that this project is not free of bugs and that changing the behaviour of a browser can be risky and not without problems.

 # Releases

-All built versions are available as [releases](https://github.com/bromite/bromite/releases); the [official website](https://www.bromite.org/) points to those releases and - when browsing via Android - it will automatically highlight the one apt for your device (or none otherwise).
+All built versions are available as [releases](https://github.com/uazo/cromite/releases).

-Each tag corresponds to a Chromium Stable release tag.
+Cromite is currently built for ARM64, x86 (Android SDK version 23+) and Windows x64.

-Bromite is currently built for ARM, ARM64 and x86 and for the Android SDK versions 19 and 21; [Bromite SystemWebView](https://www.bromite.org/system_web_view) is provided as well (SDK21+).
-For every Bromite build you can always find a matching [vanilla Chromium](https://www.bromite.org/chromium) build which is used for example to verify which issues are specific to Bromite or not.
+You will automatically receive notifications about new updates (and be able to install them) via the auto updater functionality (enabled by default), see [related wiki page](https://github.com/bromite/bromite/wiki/AutomaticUpdates).

-You can automatically receive notifications about new updates (and install them) by enabling the auto updater functionality, see [related wiki page](https://github.com/bromite/bromite/wiki/AutomaticUpdates).
+### F-droid

-All official releases are also available through the [official third-party F-Droid repository](https://www.bromite.org/fdroid).
+Official F-droid repo url:
+https://www.cromite.org/fdroid/repo/?fingerprint=49F37E74DEE483DCA2B991334FB5A0200787430D0B5F9A783DD5F13695E9517B

-## Integrity and authenticity
+### Auto-update setup for windows
+
+1. Download https://github.com/henrypp/chrlauncher/releases
+2. Create a `chrlauncher.ini`
+
+```
+[chrlauncher]
+
+# Custom Chromium update URL (string):
+ChromiumUpdateUrl=https://github.com/uazo/cromite/releases/latest/download/updateurl.txt
+
+# Command line for Chromium (string):
+# note --user-data-dir= works better if path is absolute
+# See here: http://peter.sh/experiments/chromium-command-line-switches/
+ChromiumCommandLine=--user-data-dir=".\User Data" --no-default-browser-check
+
+# to enable full logging in c:\temp\log.txt (daily rotate, no automatic deletion)
+# ChromiumCommandLine=--enable-logging --v=0 --log-file=C:\temp\log.txt --user-data-dir=".\User Data" --no-default-browser-check
+
+# Chromium executable file name (string):
+ChromiumBinary=chrome.exe
+
+# Chromium binaries directory (string):
+# Relative (to chrlauncher directory) or full path (env. variables supported).
+ChromiumDirectory=.\bin
+```
+
+### Enable network process sandbox in windows
+I don't include any setups because I don't like the experience of not knowing what they do, so you must manually run this command on first installation:
+```
+cd <where_is_the_exe>
+icacls . /grant "*S-1-15-2-2:(OI)(CI)(RX)"
+```
+see https://github.com/uazo/bromite-buildtools/issues/51
+
+## (TODO) Integrity and authenticity

 You can verify the integrity of a downloaded APK file from this project with any `sha256sum`-compatible tool by downloading the corresponding `brm_X.Y.Z.sha256.txt` or `chr_X.Y.Z.sha256.txt` file, where X.Y.Z is the release version number. Example:
 ```
@@ -165,50 +321,36 @@ gpg: Good signature from "csagan5 <32685696+csagan5@users.noreply.github.com>"

 You can download csagan5's public GnuPG key from here: [csagan5.asc](./csagan5.asc).

-# How to build
+# (TODO) How to build

 The [Bromite main repository](https://github.com/bromite/bromite) contains tags for each corresponding Chromium release (see https://chromium.googlesource.com/chromium/src.git).

 Please refer to [official Chromium build documentation](https://www.chromium.org/developers/how-tos/get-the-code) to get started on how to build Chromium; if you can build Chromium for Android, you can build Bromite.

 The Chromium version tag used as base for the patches is available here: [RELEASE](./build/RELEASE); this is always corresponding to the git tag for every release.
-The GN args used to build Bromite are available here: [GN_ARGS](./build/GN_ARGS).
+The GN args used to build Bromite are available here: [bromite.gn_args](./build/bromite.gn_args).
 The patches are to be applied second the order specified in the `bromite_patches_list.txt` file (you can use `git am`).

-## How to build the filters
-
-See upstream documentation: https://github.com/chromium/chromium/blob/master/components/subresource_filter/FILTER_LIST_GENERATION.md
-
-Bromite uses an unindexed filter file, which is periodically published at https://github.com/bromite/filters
-
-# Contributing
+# (TODO) Contributing

 Please submit issues following the issue template; beware that GitHub does not display the templates from mobile.

 Patches are welcome and accepted if they match the project goals.

-For any usage or development discussion please use GitHub Discussions: https://github.com/bromite/bromite/discussions
+For any usage or development discussion please use GitHub Discussions: https://github.com/uazo/cromite/discussions

 # Credits

 * [Chromium project](https://www.chromium.org/Home) and developers
-* [Iridium project](https://github.com/iridium-browser) for some patches
-* [ungoogled-chromium](https://github.com/Eloston/ungoogled-chromium) for some patches
-* [ungoogled-chromium-android](https://github.com/ungoogled-software/ungoogled-chromium-android) for some patches
-* [GrapheneOS](https://github.com/GrapheneOS) for some security patches
-* [Inox patchset](https://github.com/gcarq/inox-patchset) for some patches (via ungoogled-chromium)
-* [Brave Browser](https://github.com/brave/brave-core) for some patches
-* [Vadim Pleshkov](http://vadimpleshkov.me/) for Bromite's logo
+* [Bromite](https://github.com/bromite/bromite)
+  * [Iridium project](https://github.com/iridium-browser) for some patches
+  * [ungoogled-chromium](https://github.com/Eloston/ungoogled-chromium) for some patches
+  * [ungoogled-chromium-android](https://github.com/ungoogled-software/ungoogled-chromium-android) for some patches
+  * [GrapheneOS](https://github.com/GrapheneOS) for some security patches
+  * [Inox patchset](https://github.com/gcarq/inox-patchset) for some patches (via ungoogled-chromium)
+  * [Brave Browser](https://github.com/brave/brave-core) for some patches

-# Filters credits
-* [EasyList](https://easylist.to/#easylist)
-* [EasyPrivacy](https://easylist.to/#easyprivacy)
-* [uBlock Origin](https://github.com/uBlockOrigin)
-* [Peter Lowe's Ad and tracking server list](https://pgl.yoyo.org/adservers/)
-
-The URLs of the lists used are available at: https://github.com/bromite/filters/blob/master/lists.txt
-
-# License
+# (TODO) License

 The patches published as part of the Bromite project are released under [GNU GPL v3](./LICENSE).

@@ -0,0 +1 @@
+e3a3a1fe718bf559be801d14660fb6f9dc9bf603-
@@ -1 +1 @@
-94.0.4606.102
+119.0.6045.106
@@ -0,0 +1 @@
+5923fa90d4e3587c130983442b9cf90f4c76e851
@@ -0,0 +1,58 @@
+android_channel="stable"
+blink_symbol_level=1
+build_contextual_search=false
+build_with_tflite_lib=false
+chrome_pgo_phase=0
+dcheck_always_on=false
+debuggable_apks=false
+dfmify_dev_ui=false
+disable_android_lint=true
+disable_autofill_assistant_dfm=true
+disable_fieldtrial_testing_config=true
+disable_tab_ui_dfm=true
+enable_av1_decoder=true
+enable_dav1d_decoder=true
+enable_gvr_services=false
+enable_hangout_services_extension=false
+enable_iterator_debugging=false
+enable_mdns=false
+enable_mse_mpeg2ts_stream_parser=true
+enable_nacl=false
+enable_platform_dolby_vision=true
+enable_platform_hevc=true
+enable_remoting=false
+enable_reporting=false
+enable_vr=false
+exclude_unwind_tables=false
+ffmpeg_branding="Chrome"
+icu_use_data_file=true
+is_component_build=false
+is_debug=false
+is_official_build=true
+proprietary_codecs=true
+rtc_build_examples=false
+symbol_level=1
+system_webview_package_name="org.bromite.webview"
+target_os="android"
+treat_warnings_as_errors=true
+use_debug_fission=true
+use_errorprone_java_compiler=false
+use_gnome_keyring=false
+use_official_google_api_keys=false
+use_rtti=false
+use_sysroot=false
+webview_includes_weblayer=false
+enable_arcore=false
+enable_openxr=false
+enable_gvr_services=false
+enable_feed_v2=false
+enable_cardboard=false
+is_high_end_android=true
+
+# Do not compile libmonochrome.so with RELR relocations
+# since supported only on API 28+
+use_relr_relocations=false
+
+# disabled the use of the context snapshot
+# see https://github.com/uazo/cromite/pull/317 for context
+use_v8_context_snapshot = false
@@ -1,164 +1,290 @@
-Disable-third-party-cookies-by-default.patch
-AV1-codec-support.patch
+eyeo-beta-118.0.5993.48-base.patch
+eyeo-beta-118.0.5993.48-chrome_integration.patch
+eyeo-beta-118.0.5993.48-android_api.patch
+eyeo-beta-118.0.5993.48-android_settings.patch
+eyeo-beta-118.0.5993.48-extension_api.patch
+00Eyeo-Adblock-Remove-Privacy-Issues.patch
+00AdblockPlus-add-blocking-in-service-workers.patch
+
+bromite-build-utils.patch
+Remove-EV-certificates.patch
+do-not-hide-.orig-files.patch
+Do-not-link-with-libatomic.patch
+do-not-add-suffix-to-package-name.patch
+exit-on-failure-of-inclusion.patch
+Move-some-account-settings-back-to-privacy-settings.patch
+kill-Vision.patch
+kill-Location-fall-back-to-system.patch
+kill-Auth.patch
+Remove-binary-blob-integrations.patch
+Remove-SMS-integration.patch
+Remove-voice-recognition-integration.patch
+Do-not-compile-QR-code-sharing.patch
+Add-support-for-ISupportHelpAndFeedback.patch
 Switch-to-fstack-protector-strong.patch
 Enable-fwrapv-in-Clang-for-non-UBSan-builds.patch
+Bromite-package-name.patch
 Restore-classic-new-tab-page.patch
 Always-use-new-tab-page-for-default-home-page.patch
-Always-allow-partner-customisation.patch
-battery_status_service-disable-more-privacy-nightmares.patch
+disable-battery-status-updater.patch
 Battery-API-return-nothing.patch
 updater-disable-updater-pings.patch
-Remove-EV-certificates.patch
-promo-disable-Google-promotion-fetching.patch
 Disable-omission-of-URL-elements-in-Omnibox.patch
 Modify-default-preferences.patch
 Do-not-hide-component-extensions.patch
 Do-not-store-passwords-by-default.patch
 Disable-NTP-remote-suggestions-by-default.patch
 Disable-references-to-fonts.googleapis.com.patch
-Change-default-webRTC-policy-to-not-use-any-address.patch
-Never-send-any-crash-upload-data.patch
-Hide-send-reports-checkbox.patch
+webRTC-do-not-expose-local-IP-addresses.patch
 Never-fetch-popular-sites.patch
 ungoogled-chromium-Disable-webRTC-log-uploader.patch
 ungoogled-chromium-Disable-untraceable-URLs.patch
 ungoogled-chromium-Disable-translate-integration.patch
 ungoogled-chromium-Disable-profile-avatar.patch
-ungoogled-chromium-Disable-intranet-redirect-detector.patch
-ungoogled-chromium-Disable-Google-host-detection.patch
+ungoogled-chromium-Disable-intranet-detector.patch
+ungoogled-chromium-no-special-hosts-domains.patch
 ungoogled-chromium-Disable-Gaia.patch
-ungoogled-chromium-Disable-domain-reliability.patch
 ungoogled-chromium-Disable-Network-Time-Tracker.patch
-Disable-safe-browsing.patch
-Skip-the-first-run-and-metrics.patch
 Disable-all-promo-dialogs.patch
-Remove-signin-and-data-saver-integrations.patch
-Hide-passwords-manager-link.patch
 Disable-update-scheduler.patch
-Add-English-only-search-engine.patch
-Add-DuckDuckGo-Lite-search-engine.patch
+Add-search-engine.patch
 openH264-enable-ARM-ARM64-optimizations.patch
 build-remove-calling-untrusted-hooks.patch
 Inject-scripts-for-AMP-tracking-ads-and-video.patch
 Allow-playing-audio-in-background.patch
 Add-flag-to-control-video-playback-resume-feature.patch
-Open-YouTube-links-in-Bromite.patch
 Add-exit-menu-item.patch
 Remove-help-menu-item.patch
-AudioBuffer-AnalyserNode-fp-mitigations.patch
 Multiple-fingerprinting-mitigations.patch
-Disable-metrics-on-all-I-O-threads.patch
-Always-respect-async-dns-flag-regardless-of-SDK-version.patch
 Add-flag-to-configure-maximum-connections-per-host.patch
 Do-not-ignore-download-location-prompt-setting.patch
+Add-support-for-writing-URIs.patch
 Add-bookmark-import-export-actions.patch
+Bookmarks-select-all-menu-entry.patch
 Add-an-always-incognito-mode.patch
+Keep-flag-to-allow-screenshots-in-Incognito-mode.patch
 Add-option-to-not-persist-tabs-across-sessions.patch
-Disable-fetching-of-all-field-trials.patch
-Disable-seed-based-field-trials.patch
-Disable-plugins-enumeration.patch
-net-cert-increase-default-key-length-for-newly-generated-RSA-keys.patch
-dns-send-IPv6-connectivity-probes-to-RIPE-DNS.patch
-profile-resetter-do-not-tick-send-settings-by-default.patch
-Do-not-build-API-keys-infobar.patch
-autofill-disable-autofill-download-manager.patch
-first_run-deactivate-autoupdate-globally.patch
-translate-disable-fetching-of-translate-languages-from-server.patch
-kill-TOS-and-metrics-opt-out.patch
-kill-Vision.patch
-kill-Location-fall-back-to-system.patch
-kill-Auth.patch
-Remove-binary-blob-integrations.patch
-Remove-SMS-integration.patch
-Do-not-compile-QR-code-sharing.patch
-Allow-website-sign-in-without-account-sign-in.patch
-Offer-builtin-autocomplete-for-chrome-flags.patch
-Disable-search-engine-DSE-automatic-permission.patch
-Add-flag-to-disable-IPv6-probes.patch
 Add-a-proxy-configuration-page.patch
+Add-custom-tab-intents-privacy-option.patch
+Disable-FLoC-and-privacy-sandbox.patch
+History-number-of-days-privacy-setting.patch
+Disable-fetching-of-all-field-trials.patch
+Disable-plugins-enumeration.patch
+net-cert-increase-default-key-length.patch
+dns-send-IPv6-connectivity-probes-to-RIPE-DNS.patch
+Add-flag-to-disable-IPv6-probes.patch
+profile-resetter-disable-send-settings.patch
+Do-not-build-API-keys-infobar.patch
+autofill-miscellaneous.patch
+Enable-native-Android-autofill.patch
+first_run-deactivate-autoupdate-globally.patch
+translate-disable-fetching-of-languages-from-server.patch
+Offer-builtin-autocomplete-for-chrome-flags.patch
 Use-4-tile-rows-never-show-logo.patch
-Disable-metrics-collection-for-NTP-tiles.patch
-Enable-SPPI-for-devices-with-enough-memory.patch
+Disable-various-metrics.patch
+Enable-StrictOriginIsolation-and-SitePerProcess.patch
 Use-64-bit-WebView-processes.patch
-prefs-disable-signinallowed-by-default.patch
-prefs-always-prompt-for-download-directory-by-default.patch
-Disable-offline-pages-in-the-downloads-home-to-be-opened-in-CCT-by-default.patch
-disable-payment-support-by-default.patch
-disable-background-sync-by-default.patch
-disable-sensors-access-site-setting-by-default.patch
+prefs-always-prompt-for-download-directory.patch
+Disable-offline-pages-in-CCT.patch
 Disable-media-router-and-remoting-by-default.patch
 Restore-Search-Ready-Omnibox-flag.patch
 disable-AdsBlockedInfoBar.patch
-Bromite-AdBlockUpdaterService.patch
+Bromite-subresource-adblocker.patch
+Bromite-auto-updater.patch
 Replace-DoH-probe-domain-with-RIPE-domain.patch
-Increase-number-of-autocomplete-matches-from-5-to-10.patch
-Disable-HEAD-requests-for-single-word-Omnibar-searches.patch
+Increase-number-of-autocomplete-matches-to-10.patch
+Disable-requests-for-single-word-Omnibar-searches.patch
 Disable-some-signed-exchange-features.patch
-Add-flag-to-disable-WebGL.patch
-DoH-secure-mode-by-default.patch
+DoH-improvements.patch
 Reduce-HTTP-headers-in-DoH-requests-to-bare-minimum.patch
 Revert-flags-remove-disable-pull-to-refresh-effect.patch
 Use-dummy-DFM-installer.patch
 Disable-feeds-support-by-default.patch
-Disable-autofill-assistant-by-default.patch
-Show-site-settings-for-cookies-javascript-and-ads.patch
 Disable-DRM-media-origin-IDs-preprovisioning.patch
 Disable-smart-selection-by-default.patch
-Enable-user-agent-freeze-by-default.patch
-disable-browser-autologin-by-default.patch
+Guard-for-user-agent-reduction.patch
 AImageReader-CFI-crash-mitigations.patch
-Update-i18n-zh_CN-support.patch
-Add-a-flag-to-allow-screenshots-in-Incognito-mode.patch
 Add-menu-item-to-view-source.patch
+Revert-removal-of-execution-context-address-space.patch
 Block-gateway-attacks-via-websockets.patch
 Enable-prefetch-privacy-changes-by-default.patch
 Disable-support-for-RAR-files-inspection.patch
-Add-history-support-in-incognito-mode.patch
 Enable-darken-websites-checkbox-in-themes.patch
 Remove-blocklisted-URLs-upon-bookmark-creation.patch
 Disable-the-DIAL-repeating-discovery.patch
 Block-qjz9zk-or-trk-requests.patch
 Hardening-against-incognito-mode-detection.patch
-Remove-weblayer-dependency-on-Play-Services.patch
-Timezone-customization.patch
-Move-some-account-settings-back-to-privacy-settings.patch
 Restore-Simplified-NTP-launch.patch
-Revert-the-removal-of-an-option-to-block-autoplay.patch
+Add-option-to-use-home-page-as-NTP.patch
 Disable-text-fragments-by-default.patch
 disable-WebView-variations-support.patch
-disable-autofill-server-communication-by-default.patch
-ask-permission-to-play-protected-media-by-default.patch
 Enable-network-isolation-features.patch
-Disable-unified-autoplay-feature.patch
 Revert-flags-remove-num-raster-threads.patch
 webview-Hard-no-to-persistent-histograms.patch
 Ignore-enterprise-policies-for-secure-DNS.patch
 Add-menu-item-to-bookmark-all-tabs.patch
-Add-flag-for-save-data-header.patch
+Re-introduce-modal-dialog-flag-to-close-all-tabs.patch
 Add-option-to-force-tablet-UI.patch
-Make-all-favicon-requests-on-demand.patch
 Add-Alt-D-hotkey-to-focus-address-bar.patch
-Remove-offline-measurement-background-task.patch
 User-agent-customization.patch
 Add-AllowUserCertificates-flag.patch
 Add-IsCleartextPermitted-flag.patch
-Unexpire-tab-groups-flags.patch
 Add-flag-for-omnibox-autocomplete-filtering.patch
-Enable-IntentBlockExternalFormRedirectsNoGesture-by-default.patch
+Revert-Delete-block-external-form-redirects.patch
 Add-flag-to-disable-external-intent-requests.patch
+Enable-share-intent.patch
 Logcat-crash-reports-UI.patch
-Add-support-for-ISupportHelpAndFeedback.patch
-JIT-less-toggle.patch
-API-level-21-prevent-crash-on-download.patch
 Add-flag-to-disable-vibration.patch
 mime_util-force-text-x-suse-ymp-to-be-downloaded.patch
-Override-UA-client-hint-for-model.patch
-Disable-AGSA-by-default.patch
+Client-hints-overrides.patch
 Allow-building-without-enable_reporting.patch
 Disable-lock-icon-in-address-bar-by-default.patch
-Add-custom-tab-intents-privacy-option.patch
-Enable-share-intent.patch
+Experimental-user-scripts-support.patch
+Keep-empty-tabs-between-sessions.patch
+Disable-third-party-origin-trials.patch
+Never-use-HTTP-probes-for-connection-detection.patch
+Disable-Accessibility-service-by-default.patch
+Disable-conversion-measurement-api.patch
+Restore-offline-indicator-v2-flag.patch
+Re-introduce-override_build_timestamp.patch
+enable-ftrivial-auto-var-init-zero.patch
+disable-appending-variations-header.patch
+Disable-idle-detection.patch
+Allow-building-without-supervised-users.patch
+Disable-minidump-upload-scheduling.patch
+Revert-Permit-blocking-of-view-source.patch
+Disable-safety-check.patch
+Disable-all-predictors-code.patch
+OpenSearch-miscellaneous.patch
+Add-flag-for-save-data-header.patch
+Disable-UA-full-version.patch
+Dictionary-suggestions-for-the-Omnibox.patch
+Disable-AsyncDNS-by-default.patch
+00Restore-LastTabStandingTracker.patch
+Add-lifetime-options-for-permissions.patch
+Disable-crash-reporting.patch
+Samsung-Note-9-SDK27-crazylinker-workaround.patch
+Disable-TLS-resumption.patch
+Move-navigation-bar-to-bottom.patch
+Welcome-screen.patch
+Add-site-engagement-flag.patch
+Enable-Certificate-Transparency.patch
+Invalidate-components-public-key.patch
+Improve-plain-text-rendering-on-mobile.patch
+Remove-segmentation-platform.patch
+Follow-only-system-dark-mode.patch
+Remove-window-name-on-cross-origin-navigation.patch
+Remove-preload-of-com.google.android.gms.fonts.patch
+Partition-Blink-memory-cache.patch
+Remove-navigator.connection-info.patch
+Disable-PrivacyGuide.patch
+sharing-hub-always-use-visible-URL.patch
+Enable-HEVC-by-default.patch
+Partition-blobs-by-top-frame-URL.patch
+Override-Navigator-Language.patch
+Disable-add-to-home-screen-prompt.patch
+Remove-HTTP-referrals-in-cross-origin-navigation.patch
+Enable-ECH-by-default.patch
+Disable-StartSurface-feature.patch
+Enable-PermuteTLSExtensions-by-default.patch
+Enable-third-party-storage-partitioning.patch
+Restore-adaptive-button-in-top-toolbar-customization.patch
+Add-kill-switch-for-unsupported-clangd-flags.patch
+
+00WIN-enable-pdf-plugin.patch
+00WIN-disable-annotate-downloads.patch
+00WIN-enable-HighEfficiencyMode-by-default.patch
+00WIN-enable-file-system-access-blocklist.patch
+00WIN-Disable-TabHoverCard-images.patch
+00WIN-Fix-log-to-file.patch
+00WIN-minimum-data-to-enable-install-extensions.patch
+00WIN-Disable-updater.patch
+00WIN-Disable-first-run.patch
+00WIN-Add-some-prefs-to-secure-preferences.patch
+00WIN-Disable-search-for-image.patch
+
+AudioBuffer-AnalyserNode-fp-mitigations.patch
+00Disable-Component-Updates.patch
+00add-browser-policy.patch
+00Always-open-browser-controls-in-new-tab.patch
+00Partitioning-all-cookies-by-top-frame-domain.patch
+00Disable-FedCm.patch
+00Disable-BackForwardCache.patch
+00Evict-the-entire-FrameTree-like-desktop.patch
+00Disable-visited-pseudo-class.patch
+00Add-setting-to-clear-data-on-exit.patch
+00WIN-Disable-sharing-hub.patch
+00WIN-Enable-Network-Service-Sandbox-and-CIG.patch
+00Disable-csp-reports.patch
+00Fonts-fingerprinting-mitigation.patch
+00Keyboard-protection-flag.patch
+00Disable-privacy-issues-in-password-manager.patch
+00Partition-HSTS-cache-by-NAK.patch
+00Warning-message-for-unsupported-hardware-aes.patch
+00Enable-Document-Open-Inheritance-Removal.patch
+00Add-setting-to-invert-tap-and-long-tap.patch
+00Remove-ChromiumNetworkAdapter.patch
+00Internal-firewall.patch
+00Disable-devtools-remote-and-custom-protocols.patch
+00Remove-detection-of-captive-portals.patch
+00Disable-SHA1-Server-Signature.patch
+00Remove-auth-header-upon-cross-origin-redirect.patch
+00Clear-CORS-Preflight-Cache-on-clearing-data.patch
+00Multi-Screen-Window-Placement-API-fix.patch
+00Remove-https-connection-from-chrome-discards.patch
+00Add-a-flag-to-disable-GamePad-API.patch
+00Disable-WebGPU.patch
+00Disable-FirstPartySets-and-StorageAccessAPI.patch
+00Disable-GetInstalledRelatedApps-API.patch
+00Disable-GSA-by-default.patch
+00Disable-PrivateStateTokens-API.patch
+00Disallowing-MIDI-permission-by-default.patch
+00Disable-Compression-Dictionary-Transport.patch
+00Disallow-Android-App-Scheme-as-referrer.patch
+00Deprecate-Data-URL-in-SVGUseElement.patch
+Content-settings-infrastructure.patch
+Add-autoplay-site-setting.patch
 Site-setting-for-images.patch
-Bromite-auto-updater.patch
-Add-flag-to-disable-pull-to-refresh-effect.patch
-Automated-domain-substitution.patch
+JIT-site-settings.patch
+Add-webGL-site-setting.patch
+Add-webRTC-site-settings.patch
+Show-site-settings-for-cookies-javascript-and-ads.patch
+Viewport-Protection-flag.patch
+Viewport-Protection-Site-Setting.patch
+Timezone-customization.patch
+00Disable-speechSynthesis-getVoices-API.patch
+00Remove-support-for-device-memory-and-cpu-recovery.patch
+00Log-dangling-attributes-in-some-html-elements.patch
+00Keep-Side-Panel-Companion-disabled.patch
+00Lock-Profile-Cookie-Database.patch
+00Show-warnings-on-downloads-over-HTTP.patch
+00Compress-libchrome-to-free-up-some-space.patch
+00Cromite-Branding.patch
+00Disable-Feeback-Collector.patch
+00Disable-remote-altsvc-for-h3-connections.patch
+00do-not-block-build-incompatible-profiles.patch
+00Allow-DocumentPiP-if-PopupsAndRedirects-are-active.patch
+00allow-the-download-of-clang-for-windows-crossbuild.patch
+00Add-option-to-disable-snapshots.patch
+00Enable-Android-Dynamic-Performance-Framework.patch
+00Remove-GoogleAccountsPrivateApiHost.patch
+00Fix-crash-on-customize-profile-ui.patch
+00Enable-ImprovedBookmarks-by-default.patch
+00Partition-MediaDeviceId-by-default.patch
+00Keep-disabled-FetchLaterAPI.patch
+00Disable-ranker-url-fetcher.patch
+00Show-full-urls-for-bookmark.patch
+00Disable-prefers-reduced-transparency-media-query.patch
+00libjxl-0-8-2.patch
+00Add-support-to-jxl.patch
+00Block-Intents-While-Locked.patch
+00Keep-Manta-Service-Disabled.patch
+
+00Temp-PerformanceNavigationTiming-privacy-fix.patch
+00Temp-remove-support-for-shared-workers.patch
+
+00Temp-Disable-kAutomaticLazyFrameLoadingToEmbeds.patch
+00Temp-disable-predictive-back-gesture.patch
+00TEMP-Add-a-log-to-track-strange-behavior.patch
+00Temp-guard-FileSystemAccessPersistentPermissions.patch
+00Fix-chromium-build-bugs.patch
@@ -0,0 +1,48 @@
+android_channel="stable"
+blink_symbol_level=1
+build_contextual_search=false
+build_with_tflite_lib=false
+chrome_pgo_phase=0
+dcheck_always_on=false
+debuggable_apks=false
+dfmify_dev_ui=false
+disable_android_lint=true
+disable_autofill_assistant_dfm=true
+disable_fieldtrial_testing_config=true
+disable_tab_ui_dfm=true
+enable_av1_decoder=true
+enable_dav1d_decoder=true
+enable_gvr_services=false
+enable_hangout_services_extension=false
+enable_iterator_debugging=false
+enable_mdns=false
+enable_mse_mpeg2ts_stream_parser=true
+enable_nacl=false
+enable_platform_dolby_vision=true
+enable_platform_hevc=true
+enable_remoting=false
+enable_reporting=true
+enable_supervised_users=false
+enable_vr=false
+exclude_unwind_tables=false
+ffmpeg_branding="Chrome"
+icu_use_data_file=true
+is_cfi=true
+is_component_build=false
+is_debug=false
+is_official_build=true
+proprietary_codecs=true
+rtc_build_examples=false
+safe_browsing_mode=2
+symbol_level=1
+system_webview_package_name="com.android.webview"
+target_os="android"
+treat_warnings_as_errors=true
+use_cfi_cast=true
+use_debug_fission=true
+use_errorprone_java_compiler=false
+use_gnome_keyring=false
+use_official_google_api_keys=false
+use_rtti=false
+use_sysroot=false
+webview_includes_weblayer=false
@@ -1,4 +1,11 @@
 AV1-codec-support.patch
+exit-on-failure-of-inclusion.patch
+Reintroduce-override_build_timestamp.patch
+do-not-hide-.orig-files.patch
+Do-not-link-with-libatomic.patch
+do-not-add-suffix-to-package-name.patch
 Switch-to-fstack-protector-strong.patch
 Enable-fwrapv-in-Clang-for-non-UBSan-builds.patch
+enable-ftrivial-auto-var-init-zero.patch
 Disable-feeds-support-by-default.patch
+Chromium-package-name.patch
@@ -0,0 +1,732 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Thu, 7 Sep 2023 07:25:25 +0000
+Subject: AdblockPlus add blocking in service workers
+
+License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
+---
+ .../adblock/adblock_content_browser_client.cc | 184 ++++++++++++------
+ .../adblock/adblock_content_browser_client.h  |  27 ++-
+ .../browser/chrome_content_browser_client.cc  |   6 +-
+ .../browser/chrome_content_browser_client.h   |   6 +-
+ .../browser/adblock_url_loader_factory.cc     |  10 +-
+ .../browser/adblock_url_loader_factory.h      |   3 +
+ .../browser/frame_hierarchy_builder.cc        |   3 +-
+ .../browser/resource_classification_runner.h  |   8 +
+ .../resource_classification_runner_impl.cc    |  30 ++-
+ .../resource_classification_runner_impl.h     |   8 +
+ .../websockets/websocket_connector_impl.cc    |   6 +-
+ .../public/browser/content_browser_client.cc  |   4 +-
+ .../public/browser/content_browser_client.h   |   4 +-
+ 13 files changed, 216 insertions(+), 83 deletions(-)
+
+diff --git a/chrome/browser/adblock/adblock_content_browser_client.cc b/chrome/browser/adblock/adblock_content_browser_client.cc
+--- a/chrome/browser/adblock/adblock_content_browser_client.cc
+++ b/chrome/browser/adblock/adblock_content_browser_client.cc
+@@ -43,6 +43,7 @@
+ #include "content/public/browser/web_contents.h"
+ #include "mojo/public/cpp/bindings/self_owned_receiver.h"
+ #include "services/network/public/mojom/websocket.mojom.h"
+#include "services/network/public/mojom/web_transport.mojom.h"
+ #include "services/service_manager/public/cpp/binder_registry.h"
+ #include "third_party/blink/public/common/loader/url_loader_throttle.h"
+ 
+@@ -56,6 +57,29 @@
+ 
+ namespace {
+ 
+bool IsFilteringNeeded(Profile* profile, const GURL& embedder_url) {
+  DCHECK(profile);
+
+  if(embedder_url.is_empty()) {
+    // in android can be empty because it was created by
+    // RenderFrameHostImpl::CreateSubresourceLoaderFactoriesForInitialEmptyDocument
+    return true;
+  }
+
+  HostContentSettingsMap* settings_map = HostContentSettingsMapFactory::GetForProfile(profile);
+  if (settings_map && settings_map->GetContentSetting(embedder_url, GURL(), ContentSettingsType::ADS)
+        == CONTENT_SETTING_ALLOW) {
+      return false;
+  }
+  // Filtering may be needed if there's at least one enabled
+  // FilteringConfiguration.
+  bool ret = base::ranges::any_of(
+      adblock::SubscriptionServiceFactory::GetForBrowserContext(profile)
+          ->GetInstalledFilteringConfigurations(),
+      &adblock::FilteringConfiguration::IsEnabled);
+  return ret;
+}
+
+ bool IsFilteringNeeded(content::RenderFrameHost* frame) {
+   if (frame) {
+     auto* profile =
+@@ -63,17 +87,7 @@ bool IsFilteringNeeded(content::RenderFrameHost* frame) {
+     if (profile) {
+       content::RenderFrameHost* embedder = frame->GetOutermostMainFrameOrEmbedder();
+       const auto& embedder_url = embedder->GetLastCommittedURL();
+-      HostContentSettingsMap* settings_map = HostContentSettingsMapFactory::GetForProfile(profile);
+-      if (settings_map && settings_map->GetContentSetting(embedder_url, GURL(), ContentSettingsType::ADS)
+-            == CONTENT_SETTING_ALLOW) {
+-          return false;
+-      }
+-      // Filtering may be needed if there's at least one enabled
+-      // FilteringConfiguration.
+-      return base::ranges::any_of(
+-          adblock::SubscriptionServiceFactory::GetForBrowserContext(profile)
+-              ->GetInstalledFilteringConfigurations(),
+-          &adblock::FilteringConfiguration::IsEnabled);
+      return IsFilteringNeeded(profile, embedder_url);
+     }
+   }
+   return false;
+@@ -88,6 +102,8 @@ class AdblockContextData : public base::SupportsUserData::Data {
+ 
+   static void StartProxying(
+       Profile* profile,
+      content::BrowserContext* browser_context,
+      const url::Origin& request_initiator,
+       content::RenderFrameHost* frame,
+       int render_process_id,
+       mojo::PendingReceiver<network::mojom::URLLoaderFactory> receiver,
+@@ -100,8 +116,6 @@ class AdblockContextData : public base::SupportsUserData::Data {
+       self = new AdblockContextData();
+       profile->SetUserData(kAdblockContextUserDataKey, base::WrapUnique(self));
+     }
+-    auto* browser_context =
+-        content::WebContents::FromRenderFrameHost(frame)->GetBrowserContext();
+     adblock::AdblockURLLoaderFactoryConfig config{
+         adblock::SubscriptionServiceFactory::GetForBrowserContext(
+             browser_context),
+@@ -113,8 +127,9 @@ class AdblockContextData : public base::SupportsUserData::Data {
+             browser_context)};
+     auto proxy = std::make_unique<adblock::AdblockURLLoaderFactory>(
+         std::move(config),
+        request_initiator.GetURL(),
+         content::GlobalRenderFrameHostId(render_process_id,
+-                                         frame->GetRoutingID()),
+              frame ? frame->GetRoutingID() : MSG_ROUTING_NONE),
+         std::move(receiver), std::move(target_factory),
+         embedder_support::GetUserAgent(),
+         base::BindOnce(&AdblockContextData::RemoveProxy,
+@@ -155,47 +170,50 @@ void AdblockContentBrowserClient::ForceAdblockProxyForTesting() {
+ #endif
+ 
+ bool AdblockContentBrowserClient::WillInterceptWebSocket(
+-    content::RenderFrameHost* frame) {
+    content::RenderFrameHost* frame,
+    content::RenderProcessHost* process,
+    const url::Origin& origin) {
+   if (IsFilteringNeeded(frame)) {
+     return true;
+  } else {
+    auto* browser_context = process->GetBrowserContext();
+    auto* profile = Profile::FromBrowserContext(browser_context);
+    if (IsFilteringNeeded(profile, origin.GetURL().GetAsReferrer())) {
+      return true;
+    }
+   }
+ 
+-  return ChromeContentBrowserClient::WillInterceptWebSocket(frame);
+  return ChromeContentBrowserClient::WillInterceptWebSocket(frame, process, origin);
+ }
+ 
+ void AdblockContentBrowserClient::CreateWebSocket(
+    content::RenderProcessHost* process,
+     content::RenderFrameHost* frame,
+     WebSocketFactory factory,
+     const GURL& url,
+    const url::Origin& initiator_origin,
+     const net::SiteForCookies& site_for_cookies,
+     const absl::optional<std::string>& user_agent,
+     mojo::PendingRemote<network::mojom::WebSocketHandshakeClient>
+         handshake_client) {
+-  if (IsFilteringNeeded(frame)) {
+-    CreateWebSocketInternal(frame->GetGlobalId(), std::move(factory), url,
+-                            site_for_cookies, user_agent,
+-                            std::move(handshake_client));
+-  } else {
+-    DCHECK(ChromeContentBrowserClient::WillInterceptWebSocket(frame));
+-    ChromeContentBrowserClient::CreateWebSocket(frame, std::move(factory), url,
+-                                                site_for_cookies, user_agent,
+-                                                std::move(handshake_client));
+-  }
+  CreateWebSocketInternal(process,
+                          frame ? frame->GetGlobalId() : content::GlobalRenderFrameHostId(),
+                          std::move(factory), url, initiator_origin,
+                          site_for_cookies, user_agent,
+                          std::move(handshake_client));
+ }
+ 
+ void AdblockContentBrowserClient::CreateWebSocketInternal(
+    content::RenderProcessHost* process,
+     content::GlobalRenderFrameHostId render_frame_host_id,
+     WebSocketFactory factory,
+     const GURL& url,
+    const url::Origin& initiator_origin,
+     const net::SiteForCookies& site_for_cookies,
+     const absl::optional<std::string>& user_agent,
+     mojo::PendingRemote<network::mojom::WebSocketHandshakeClient>
+         handshake_client) {
+-  auto* frame = content::RenderFrameHost::FromID(render_frame_host_id);
+-  if (!frame) {
+-    return;
+-  }
+-  auto* browser_context = frame->GetProcess()->GetBrowserContext();
+  auto* browser_context = process->GetBrowserContext();
+   auto* subscription_service =
+       adblock::SubscriptionServiceFactory::GetForBrowserContext(
+           browser_context);
+@@ -203,33 +221,33 @@ void AdblockContentBrowserClient::CreateWebSocketInternal(
+       adblock::ResourceClassificationRunnerFactory::GetForBrowserContext(
+           browser_context);
+   classification_runner->CheckRequestFilterMatchForWebSocket(
+-      subscription_service->GetCurrentSnapshot(), url, render_frame_host_id,
+      subscription_service->GetCurrentSnapshot(), url,
+      std::move(initiator_origin.GetURL().GetAsReferrer()), render_frame_host_id,
+       base::BindOnce(
+           &AdblockContentBrowserClient::OnWebSocketFilterCheckCompleted,
+-          weak_factory_.GetWeakPtr(), render_frame_host_id, std::move(factory),
+-          url, site_for_cookies, user_agent, std::move(handshake_client)));
+          weak_factory_.GetWeakPtr(), process, render_frame_host_id, std::move(factory),
+          url, initiator_origin, site_for_cookies, user_agent, std::move(handshake_client)));
+ }
+ 
+ void AdblockContentBrowserClient::OnWebSocketFilterCheckCompleted(
+    content::RenderProcessHost* process,
+     content::GlobalRenderFrameHostId render_frame_host_id,
+     ChromeContentBrowserClient::WebSocketFactory factory,
+     const GURL& url,
+    const url::Origin& initiator_origin,
+     const net::SiteForCookies& site_for_cookies,
+     const absl::optional<std::string>& user_agent,
+     mojo::PendingRemote<network::mojom::WebSocketHandshakeClient>
+         handshake_client,
+     adblock::FilterMatchResult result) {
+   auto* frame = content::RenderFrameHost::FromID(render_frame_host_id);
+-  if (!frame) {
+-    return;
+-  }
+   const bool has_blocking_filter =
+       result == adblock::FilterMatchResult::kBlockRule;
+   if (!has_blocking_filter) {
+     VLOG(1) << "[eyeo] Web socket allowed for " << url;
+-    if (ChromeContentBrowserClient::WillInterceptWebSocket(frame)) {
+    if (ChromeContentBrowserClient::WillInterceptWebSocket(frame, process, initiator_origin)) {
+       ChromeContentBrowserClient::CreateWebSocket(
+-          frame, std::move(factory), url, site_for_cookies, user_agent,
+          process, frame, std::move(factory), url, initiator_origin, site_for_cookies, user_agent,
+           std::move(handshake_client));
+       return;
+     }
+@@ -246,6 +264,72 @@ void AdblockContentBrowserClient::OnWebSocketFilterCheckCompleted(
+   VLOG(1) << "[eyeo] Web socket blocked for " << url;
+ }
+ 
+void AdblockContentBrowserClient::WillCreateWebTransport(
+    int process_id,
+    int frame_routing_id,
+    const GURL& url,
+    const url::Origin& initiator_origin,
+    mojo::PendingRemote<network::mojom::WebTransportHandshakeClient>
+        handshake_client,
+    WillCreateWebTransportCallback callback) {
+  auto* process = content::RenderProcessHost::FromID(process_id);
+  DCHECK(process);
+
+  auto* browser_context = process->GetBrowserContext();
+  auto* profile = Profile::FromBrowserContext(browser_context);
+  if (IsFilteringNeeded(profile, initiator_origin.GetURL().GetAsReferrer())) {
+    auto* subscription_service =
+        adblock::SubscriptionServiceFactory::GetForBrowserContext(
+            browser_context);
+    auto* classification_runner =
+        adblock::ResourceClassificationRunnerFactory::GetForBrowserContext(
+            browser_context);
+
+    classification_runner->CheckRequestFilterMatchForWebTransport(
+        subscription_service->GetCurrentSnapshot(), url,
+        std::move(initiator_origin.GetURL().GetAsReferrer()),
+        content::GlobalRenderFrameHostId(),
+        base::BindOnce(
+            &AdblockContentBrowserClient::OnWebTransportFilterCheckCompleted,
+            weak_factory_.GetWeakPtr(),
+            process_id, frame_routing_id, url,
+            std::move(initiator_origin), std::move(handshake_client),
+            std::move(callback)));
+    return;
+  }
+
+  ChromeContentBrowserClient::WillCreateWebTransport(
+      process_id, frame_routing_id,
+      url, std::move(initiator_origin),
+      std::move(handshake_client), std::move(callback));
+}
+
+void AdblockContentBrowserClient::OnWebTransportFilterCheckCompleted(
+    int process_id,
+    int frame_routing_id,
+    const GURL& url,
+    const url::Origin& initiator_origin,
+    mojo::PendingRemote<network::mojom::WebTransportHandshakeClient>
+        handshake_client,
+    WillCreateWebTransportCallback callback,
+    adblock::FilterMatchResult result) {
+  const bool has_blocking_filter =
+      result == adblock::FilterMatchResult::kBlockRule;
+  if (!has_blocking_filter) {
+    VLOG(1) << "[eyeo] Web transport allowed for " << url;
+    ChromeContentBrowserClient::WillCreateWebTransport(
+        process_id, frame_routing_id,
+        url, std::move(initiator_origin),
+        std::move(handshake_client), std::move(callback));
+    return;
+  }
+  VLOG(1) << "[eyeo] Web transport blocked for " << url;
+  std::move(callback).Run(std::move(handshake_client),
+                            network::mojom::WebTransportError::New(
+                                net::ERR_BLOCKED_BY_ADMINISTRATOR, quic::QUIC_INTERNAL_ERROR,
+                                "Blocked", false));
+}
+
+ bool AdblockContentBrowserClient::WillCreateURLLoaderFactory(
+     content::BrowserContext* browser_context,
+     content::RenderFrameHost* frame,
+@@ -269,24 +353,12 @@ bool AdblockContentBrowserClient::WillCreateURLLoaderFactory(
+           navigation_id, ukm_source_id, factory_receiver, header_client,
+           bypass_redirect_checks, disable_secure_dns, factory_override,
+           navigation_response_task_runner);
+-  auto* profile = frame ? Profile::FromBrowserContext(
+-                              frame->GetProcess()->GetBrowserContext())
+-                        : nullptr;
+-
+-#if BUILDFLAG(ENABLE_EXTENSIONS)
+-  if (!force_adblock_proxy_for_testing_ &&
+-      request_initiator.scheme() == extensions::kExtensionScheme) {
+-    VLOG(1) << "[eyeo] Do not use adblock proxy for extensions requests "
+-               "[extension id:"
+-            << request_initiator.host() << "].";
+-    return use_chrome_proxy;
+-  }
+-#endif
+  auto* profile = Profile::FromBrowserContext(browser_context);
+ 
+   bool use_adblock_proxy =
+-      (type == URLLoaderFactoryType::kDocumentSubResource ||
+-       type == URLLoaderFactoryType::kNavigation) &&
+-      IsFilteringNeeded(frame);
+      type != URLLoaderFactoryType::kDownload &&
+      (frame ? IsFilteringNeeded(frame)
+             : IsFilteringNeeded(profile, request_initiator.GetURL().GetAsReferrer()));
+ 
+   bool use_test_loader = false;
+ #ifdef EYEO_INTERCEPT_DEBUG_URL
+@@ -305,7 +377,7 @@ bool AdblockContentBrowserClient::WillCreateURLLoaderFactory(
+     mojo::PendingRemote<network::mojom::URLLoaderFactory> target_factory_remote;
+     *factory_receiver = target_factory_remote.InitWithNewPipeAndPassReceiver();
+     AdblockContextData::StartProxying(
+-        profile, frame, render_process_id, std::move(proxied_receiver),
+        profile, browser_context, request_initiator, frame, render_process_id, std::move(proxied_receiver),
+         std::move(target_factory_remote), use_test_loader);
+   }
+   return use_adblock_proxy || use_chrome_proxy;
+diff --git a/chrome/browser/adblock/adblock_content_browser_client.h b/chrome/browser/adblock/adblock_content_browser_client.h
+--- a/chrome/browser/adblock/adblock_content_browser_client.h
+++ b/chrome/browser/adblock/adblock_content_browser_client.h
+@@ -44,16 +44,27 @@ class AdblockContentBrowserClient : public ChromeContentBrowserClient {
+   static void ForceAdblockProxyForTesting();
+ #endif
+ 
+-  bool WillInterceptWebSocket(content::RenderFrameHost* frame) override;
+  bool WillInterceptWebSocket(content::RenderFrameHost* frame, content::RenderProcessHost* process, const url::Origin& origin) override;
+   void CreateWebSocket(
+      content::RenderProcessHost* process,
+       content::RenderFrameHost* frame,
+       WebSocketFactory factory,
+       const GURL& url,
+      const url::Origin& initiator_origin,
+       const net::SiteForCookies& site_for_cookies,
+       const absl::optional<std::string>& user_agent,
+       mojo::PendingRemote<network::mojom::WebSocketHandshakeClient>
+           handshake_client) override;
+ 
+  void WillCreateWebTransport(
+      int process_id,
+      int frame_routing_id,
+      const GURL& url,
+      const url::Origin& initiator_origin,
+      mojo::PendingRemote<network::mojom::WebTransportHandshakeClient>
+          handshake_client,
+      WillCreateWebTransportCallback callback) override;
+
+   bool WillCreateURLLoaderFactory(
+       content::BrowserContext* browser_context,
+       content::RenderFrameHost* frame,
+@@ -73,23 +84,35 @@ class AdblockContentBrowserClient : public ChromeContentBrowserClient {
+ 
+  private:
+   void CreateWebSocketInternal(
+      content::RenderProcessHost* process,
+       content::GlobalRenderFrameHostId render_frame_host_id,
+       WebSocketFactory factory,
+       const GURL& url,
+      const url::Origin& initiator_origin,
+       const net::SiteForCookies& site_for_cookies,
+       const absl::optional<std::string>& user_agent,
+       mojo::PendingRemote<network::mojom::WebSocketHandshakeClient>
+           handshake_client);
+   void OnWebSocketFilterCheckCompleted(
+      content::RenderProcessHost* process,
+       content::GlobalRenderFrameHostId render_frame_host_id,
+       ChromeContentBrowserClient::WebSocketFactory factory,
+       const GURL& url,
+      const url::Origin& initiator_origin,
+       const net::SiteForCookies& site_for_cookies,
+       const absl::optional<std::string>& user_agent,
+       mojo::PendingRemote<network::mojom::WebSocketHandshakeClient>
+           handshake_client,
+       adblock::FilterMatchResult result);
+-
+  void OnWebTransportFilterCheckCompleted(
+      int process_id,
+      int frame_routing_id,
+      const GURL& url,
+      const url::Origin& initiator_origin,
+      mojo::PendingRemote<network::mojom::WebTransportHandshakeClient>
+          handshake_client,
+      WillCreateWebTransportCallback callback,
+      adblock::FilterMatchResult result);
+   base::WeakPtrFactory<AdblockContentBrowserClient> weak_factory_{this};
+ 
+ #if BUILDFLAG(ENABLE_EXTENSIONS)
+diff --git a/chrome/browser/chrome_content_browser_client.cc b/chrome/browser/chrome_content_browser_client.cc
+--- a/chrome/browser/chrome_content_browser_client.cc
+++ b/chrome/browser/chrome_content_browser_client.cc
+@@ -6330,7 +6330,9 @@ ChromeContentBrowserClient::
+ }
+ 
+ bool ChromeContentBrowserClient::WillInterceptWebSocket(
+-    content::RenderFrameHost* frame) {
+    content::RenderFrameHost* frame,
+    content::RenderProcessHost* process,
+    const url::Origin& origin) {
+ #if BUILDFLAG(ENABLE_EXTENSIONS)
+   if (!frame) {
+     return false;
+@@ -6351,9 +6353,11 @@ bool ChromeContentBrowserClient::WillInterceptWebSocket(
+ }
+ 
+ void ChromeContentBrowserClient::CreateWebSocket(
+    content::RenderProcessHost* process,
+     content::RenderFrameHost* frame,
+     WebSocketFactory factory,
+     const GURL& url,
+    const url::Origin& initiator_origin,
+     const net::SiteForCookies& site_for_cookies,
+     const absl::optional<std::string>& user_agent,
+     mojo::PendingRemote<network::mojom::WebSocketHandshakeClient>
+diff --git a/chrome/browser/chrome_content_browser_client.h b/chrome/browser/chrome_content_browser_client.h
+--- a/chrome/browser/chrome_content_browser_client.h
+++ b/chrome/browser/chrome_content_browser_client.h
+@@ -624,11 +624,15 @@ class ChromeContentBrowserClient : public content::ContentBrowserClient {
+   CreateURLLoaderHandlerForServiceWorkerNavigationPreload(
+       int frame_tree_node_id,
+       const network::ResourceRequest& resource_request) override;
+-  bool WillInterceptWebSocket(content::RenderFrameHost* frame) override;
+  bool WillInterceptWebSocket(content::RenderFrameHost* frame,
+                              content::RenderProcessHost* process,
+                              const url::Origin& origin) override;
+   void CreateWebSocket(
+      content::RenderProcessHost* process,
+       content::RenderFrameHost* frame,
+       WebSocketFactory factory,
+       const GURL& url,
+      const url::Origin& initiator_origin,
+       const net::SiteForCookies& site_for_cookies,
+       const absl::optional<std::string>& user_agent,
+       mojo::PendingRemote<network::mojom::WebSocketHandshakeClient>
+diff --git a/components/adblock/content/browser/adblock_url_loader_factory.cc b/components/adblock/content/browser/adblock_url_loader_factory.cc
+--- a/components/adblock/content/browser/adblock_url_loader_factory.cc
+++ b/components/adblock/content/browser/adblock_url_loader_factory.cc
+@@ -342,12 +342,6 @@ void AdblockURLLoaderFactory::InProgressRequest::OnRequestError(
+ 
+ void AdblockURLLoaderFactory::InProgressRequest::CheckFilterMatch(
+     CheckFilterMatchCallback callback) {
+-  if (!factory_->CheckHostValid()) {
+-    PostFilterMatchCallbackToUI(std::move(callback),
+-                                FilterMatchResult::kNoRule);
+-    return;
+-  }
+-
+   auto subscription_service = factory_->config_.subscription_service;
+   if (is_document_request_) {
+     auto* host = content::RenderFrameHost::FromID(factory_->host_id_);
+@@ -386,7 +380,7 @@ void AdblockURLLoaderFactory::InProgressRequest::CheckFilterMatch(
+   } else {
+     factory_->config_.resource_classifier->CheckRequestFilterMatch(
+         subscription_service->GetCurrentSnapshot(), request_url_,
+-        adblock_resource_type_, factory_->host_id_,
+        factory_->request_initiator_, adblock_resource_type_, factory_->host_id_,
+         base::BindOnce(
+             &AdblockURLLoaderFactory::InProgressRequest::OnRequestUrlClassified,
+             weak_factory_.GetWeakPtr(),
+@@ -675,12 +669,14 @@ void AdblockURLLoaderFactory::InProgressRequest::OnRequestFilterMatchResult(
+ 
+ AdblockURLLoaderFactory::AdblockURLLoaderFactory(
+     AdblockURLLoaderFactoryConfig config,
+    GURL request_initiator,
+     content::GlobalRenderFrameHostId host_id,
+     mojo::PendingReceiver<network::mojom::URLLoaderFactory> receiver,
+     mojo::PendingRemote<network::mojom::URLLoaderFactory> target_factory,
+     std::string user_agent_string,
+     DisconnectCallback on_disconnect)
+     : config_(std::move(config)),
+      request_initiator_(std::move(request_initiator)),
+       host_id_(host_id),
+       user_agent_string_(std::move(user_agent_string)),
+       on_disconnect_(std::move(on_disconnect)) {
+diff --git a/components/adblock/content/browser/adblock_url_loader_factory.h b/components/adblock/content/browser/adblock_url_loader_factory.h
+--- a/components/adblock/content/browser/adblock_url_loader_factory.h
+++ b/components/adblock/content/browser/adblock_url_loader_factory.h
+@@ -25,6 +25,7 @@
+ #include "mojo/public/cpp/bindings/receiver_set.h"
+ #include "mojo/public/cpp/bindings/remote.h"
+ #include "services/network/public/mojom/url_loader_factory.mojom.h"
+#include "url/gurl.h"
+ 
+ namespace adblock {
+ 
+@@ -57,6 +58,7 @@ class AdblockURLLoaderFactory : public network::mojom::URLLoaderFactory {
+ 
+   AdblockURLLoaderFactory(
+       AdblockURLLoaderFactoryConfig config,
+      GURL request_initiator,
+       content::GlobalRenderFrameHostId host_id,
+       mojo::PendingReceiver<network::mojom::URLLoaderFactory> receiver,
+       mojo::PendingRemote<network::mojom::URLLoaderFactory> target_factory,
+@@ -86,6 +88,7 @@ class AdblockURLLoaderFactory : public network::mojom::URLLoaderFactory {
+   void MaybeDestroySelf();
+ 
+   AdblockURLLoaderFactoryConfig config_;
+  const GURL request_initiator_;
+   content::GlobalRenderFrameHostId host_id_;
+   mojo::ReceiverSet<network::mojom::URLLoaderFactory> proxy_receivers_;
+   std::set<std::unique_ptr<InProgressRequest>, base::UniquePtrComparator>
+diff --git a/components/adblock/content/browser/frame_hierarchy_builder.cc b/components/adblock/content/browser/frame_hierarchy_builder.cc
+--- a/components/adblock/content/browser/frame_hierarchy_builder.cc
+++ b/components/adblock/content/browser/frame_hierarchy_builder.cc
+@@ -76,9 +76,8 @@ std::vector<GURL> FrameHierarchyBuilder::BuildFrameHierarchy(
+     content::RenderFrameHost* host) const {
+   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+ 
+-  DCHECK(host) << "RenderFrameHost is needed to build frame hierarchy";
+-
+   std::vector<GURL> referrers_chain;
+  if (!host) return referrers_chain;
+   for (auto* iter = host; iter; iter = iter->GetParent()) {
+     auto last_commited_referrer = GetUrlAsReferrer(iter);
+     if (IsValidForFrameHierarchy(last_commited_referrer)) {
+diff --git a/components/adblock/content/browser/resource_classification_runner.h b/components/adblock/content/browser/resource_classification_runner.h
+--- a/components/adblock/content/browser/resource_classification_runner.h
+++ b/components/adblock/content/browser/resource_classification_runner.h
+@@ -81,14 +81,22 @@ class ResourceClassificationRunner : public KeyedService {
+   virtual void CheckRequestFilterMatch(
+       SubscriptionService::Snapshot subscription_collections,
+       const GURL& request_url,
+      const GURL& request_initiator,
+       ContentType adblock_resource_type,
+       content::GlobalRenderFrameHostId render_frame_host_id,
+       CheckFilterMatchCallback callback) = 0;
+   virtual void CheckRequestFilterMatchForWebSocket(
+       SubscriptionService::Snapshot subscription_collections,
+       const GURL& request_url,
+      const GURL& request_initiator,
+       content::GlobalRenderFrameHostId render_frame_host_id,
+       CheckFilterMatchCallback callback) = 0;
+  virtual void CheckRequestFilterMatchForWebTransport(
+      SubscriptionService::Snapshot subscription_collections,
+      const GURL& request_url,
+      const GURL& request_initiator,
+      content::GlobalRenderFrameHostId render_frame_host_id,
+      CheckFilterMatchCallback callback);
+   // No callback, just notify observers
+   virtual void CheckDocumentAllowlisted(
+       SubscriptionService::Snapshot subscription_collection,
+diff --git a/components/adblock/content/browser/resource_classification_runner_impl.cc b/components/adblock/content/browser/resource_classification_runner_impl.cc
+--- a/components/adblock/content/browser/resource_classification_runner_impl.cc
+++ b/components/adblock/content/browser/resource_classification_runner_impl.cc
+@@ -169,15 +169,28 @@ void ResourceClassificationRunnerImpl::CheckPopupFilterMatch(
+ void ResourceClassificationRunnerImpl::CheckRequestFilterMatchForWebSocket(
+     SubscriptionService::Snapshot subscription_collections,
+     const GURL& request_url,
+    const GURL& request_initiator,
+     content::GlobalRenderFrameHostId render_frame_host_id,
+     CheckFilterMatchCallback callback) {
+   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+   DCHECK(request_url.SchemeIsWSOrWSS());
+-  CheckRequestFilterMatch(std::move(subscription_collections), request_url,
+  CheckRequestFilterMatch(std::move(subscription_collections), request_url, request_initiator,
+                           ContentType::Websocket, render_frame_host_id,
+                           std::move(callback));
+ }
+ 
+void ResourceClassificationRunnerImpl::CheckRequestFilterMatchForWebTransport(
+    SubscriptionService::Snapshot subscription_collections,
+    const GURL& request_url,
+    const GURL& request_initiator,
+    content::GlobalRenderFrameHostId render_frame_host_id,
+    CheckFilterMatchCallback callback) {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+  CheckRequestFilterMatch(std::move(subscription_collections), request_url, request_initiator,
+                          ContentType::Other, render_frame_host_id,
+                          std::move(callback));
+}
+
+ void ResourceClassificationRunnerImpl::CheckDocumentAllowlisted(
+     SubscriptionService::Snapshot subscription_collections,
+     const GURL& request_url,
+@@ -212,6 +225,7 @@ void ResourceClassificationRunnerImpl::ProcessDocumentAllowlistedResponse(
+ void ResourceClassificationRunnerImpl::CheckRequestFilterMatch(
+     SubscriptionService::Snapshot subscription_collections,
+     const GURL& request_url,
+    const GURL& request_initiator,
+     ContentType adblock_resource_type,
+     content::GlobalRenderFrameHostId frame_host_id,
+     CheckFilterMatchCallback callback) {
+@@ -220,14 +234,10 @@ void ResourceClassificationRunnerImpl::CheckRequestFilterMatch(
+   DVLOG(1) << "[eyeo] CheckRequestFilterMatchImpl for " << request_url.spec();
+ 
+   auto* host = content::RenderFrameHost::FromID(frame_host_id);
+-  if (!host) {
+-    // Host has died, likely because this is a deferred execution. It does not
+-    // matter anymore whether the resource is blocked, the page is gone.
+-    std::move(callback).Run(FilterMatchResult::kNoRule);
+-    return;
+-  }
+-  const std::vector<GURL> frame_hierarchy_chain =
+  std::vector<GURL> frame_hierarchy_chain =
+       frame_hierarchy_builder_->BuildFrameHierarchy(host);
+  if (!host && frame_hierarchy_chain.size() == 0)
+    frame_hierarchy_chain.emplace_back(request_initiator.GetAsReferrer());
+ 
+   DVLOG(1) << "[eyeo] Got " << frame_hierarchy_chain.size()
+            << " frame_hierarchy for " << request_url.spec();
+@@ -275,7 +285,8 @@ ResourceClassificationRunnerImpl::CheckRequestFilterMatchInternal(
+       adblock_resource_type, sitekey);
+ 
+   if (classification_result.decision == ClassificationDecision::Allowed) {
+-    VLOG(1) << "[eyeo] Document allowed due to allowing filter " << request_url;
+    VLOG(1) << "[eyeo] Document allowed due to allowing filter " << request_url
+            << " " << classification_result.decisive_subscription.spec();
+     return CheckResourceFilterMatchResult{
+         FilterMatchResult::kAllowRule,
+         classification_result.decisive_subscription,
+@@ -290,6 +301,7 @@ ResourceClassificationRunnerImpl::CheckRequestFilterMatchInternal(
+         classification_result.decisive_configuration_name};
+   }
+ 
+  VLOG(1) << "[eyeo] No Rule for " << request_url;
+   return CheckResourceFilterMatchResult{FilterMatchResult::kNoRule, {}, {}};
+ }
+ 
+diff --git a/components/adblock/content/browser/resource_classification_runner_impl.h b/components/adblock/content/browser/resource_classification_runner_impl.h
+--- a/components/adblock/content/browser/resource_classification_runner_impl.h
+++ b/components/adblock/content/browser/resource_classification_runner_impl.h
+@@ -55,12 +55,14 @@ class ResourceClassificationRunnerImpl final
+   void CheckRequestFilterMatch(
+       SubscriptionService::Snapshot subscription_collections,
+       const GURL& request_url,
+      const GURL& request_initiator,
+       ContentType adblock_resource_type,
+       content::GlobalRenderFrameHostId render_frame_host_id,
+       CheckFilterMatchCallback callback) final;
+   void CheckRequestFilterMatchForWebSocket(
+       SubscriptionService::Snapshot subscription_collections,
+       const GURL& request_url,
+      const GURL& request_initiator,
+       content::GlobalRenderFrameHostId render_frame_host_id,
+       CheckFilterMatchCallback callback) final;
+   // No callback, just notify observers
+@@ -68,6 +70,12 @@ class ResourceClassificationRunnerImpl final
+       SubscriptionService::Snapshot subscription_collections,
+       const GURL& request_url,
+       content::GlobalRenderFrameHostId render_frame_host_id) final;
+  void CheckRequestFilterMatchForWebTransport(
+      SubscriptionService::Snapshot subscription_collections,
+      const GURL& request_url,
+      const GURL& request_initiator,
+      content::GlobalRenderFrameHostId render_frame_host_id,
+      CheckFilterMatchCallback callback) final;
+   void CheckResponseFilterMatch(
+       SubscriptionService::Snapshot subscription_collections,
+       const GURL& response_url,
+diff --git a/content/browser/websockets/websocket_connector_impl.cc b/content/browser/websockets/websocket_connector_impl.cc
+--- a/content/browser/websockets/websocket_connector_impl.cc
+++ b/content/browser/websockets/websocket_connector_impl.cc
+@@ -87,14 +87,14 @@ void WebSocketConnectorImpl::Connect(
+   const uint32_t options =
+       GetContentClient()->browser()->GetWebSocketOptions(frame);
+ 
+-  if (GetContentClient()->browser()->WillInterceptWebSocket(frame)) {
+  if (GetContentClient()->browser()->WillInterceptWebSocket(frame, process, origin_)) {
+     GetContentClient()->browser()->CreateWebSocket(
+-        frame,
+        process, frame,
+         base::BindOnce(ConnectCalledByContentBrowserClient, requested_protocols,
+                        site_for_cookies, isolation_info_, process_id_,
+                        frame_id_, origin_, options,
+                        std::move(throttling_profile_id)),
+-        url, site_for_cookies, user_agent, std::move(handshake_client));
+        url, origin_, site_for_cookies, user_agent, std::move(handshake_client));
+     return;
+   }
+   std::vector<network::mojom::HttpHeaderPtr> headers;
+diff --git a/content/public/browser/content_browser_client.cc b/content/public/browser/content_browser_client.cc
+--- a/content/public/browser/content_browser_client.cc
+++ b/content/public/browser/content_browser_client.cc
+@@ -998,7 +998,7 @@ bool ContentBrowserClient::WillCreateURLLoaderFactory(
+   return false;
+ }
+ 
+-bool ContentBrowserClient::WillInterceptWebSocket(RenderFrameHost*) {
+bool ContentBrowserClient::WillInterceptWebSocket(RenderFrameHost*, RenderProcessHost*, const url::Origin& origin) {
+   return false;
+ }
+ 
+@@ -1007,9 +1007,11 @@ uint32_t ContentBrowserClient::GetWebSocketOptions(RenderFrameHost* frame) {
+ }
+ 
+ void ContentBrowserClient::CreateWebSocket(
+    RenderProcessHost* process,
+     RenderFrameHost* frame,
+     WebSocketFactory factory,
+     const GURL& url,
+    const url::Origin& initiator_origin,
+     const net::SiteForCookies& site_for_cookies,
+     const absl::optional<std::string>& user_agent,
+     mojo::PendingRemote<network::mojom::WebSocketHandshakeClient>
+diff --git a/content/public/browser/content_browser_client.h b/content/public/browser/content_browser_client.h
+--- a/content/public/browser/content_browser_client.h
+++ b/content/public/browser/content_browser_client.h
+@@ -1791,7 +1791,7 @@ class CONTENT_EXPORT ContentBrowserClient {
+       scoped_refptr<base::SequencedTaskRunner> navigation_response_task_runner);
+ 
+   // Returns true when the embedder wants to intercept a websocket connection.
+-  virtual bool WillInterceptWebSocket(RenderFrameHost* frame);
+  virtual bool WillInterceptWebSocket(RenderFrameHost* frame, RenderProcessHost* process, const url::Origin& origin);
+ 
+   // Returns the WebSocket creation options.
+   virtual uint32_t GetWebSocketOptions(RenderFrameHost* frame);
+@@ -1813,9 +1813,11 @@ class CONTENT_EXPORT ContentBrowserClient {
+   // Always called on the UI thread and only when the Network Service is
+   // enabled.
+   virtual void CreateWebSocket(
+      RenderProcessHost* process,
+       RenderFrameHost* frame,
+       WebSocketFactory factory,
+       const GURL& url,
+      const url::Origin& initiator_origin,
+       const net::SiteForCookies& site_for_cookies,
+       const absl::optional<std::string>& user_agent,
+       mojo::PendingRemote<network::mojom::WebSocketHandshakeClient>
+--
+2.25.1
@@ -0,0 +1,79 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Fri, 21 Apr 2023 13:10:20 +0000
+Subject: Add a flag to disable GamePad API
+
+Adds restrict-gamepad-access flag (default active) to disable GamePad API.
+License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
+---
+ chrome/browser/flag-metadata.json                           | 4 ++--
+ chrome/browser/flag_descriptions.cc                         | 2 +-
+ device/gamepad/public/cpp/gamepad_features.cc               | 4 ++--
+ .../blink/renderer/modules/gamepad/navigator_gamepad.cc     | 6 ++++++
+ 4 files changed, 11 insertions(+), 5 deletions(-)
+
+diff --git a/chrome/browser/flag-metadata.json b/chrome/browser/flag-metadata.json
+--- a/chrome/browser/flag-metadata.json
+++ b/chrome/browser/flag-metadata.json
+@@ -7336,9 +7336,9 @@
+     "expiry_milestone": 121
+   },
+   {
+-    "name": "restrict-gamepad-access",
+    "name": "restrict-gamepad-access", // restrict-gamepad-access"
+     "owners": [ "//device/gamepad/OWNERS", "jameshollyer@chromium.org" ],
+-    "expiry_milestone": 96
+    "expiry_milestone": -1
+   },
+   {
+     "name": "rounded-display",
+diff --git a/chrome/browser/flag_descriptions.cc b/chrome/browser/flag_descriptions.cc
+--- a/chrome/browser/flag_descriptions.cc
+++ b/chrome/browser/flag_descriptions.cc
+@@ -3076,7 +3076,7 @@ const char kReduceAcceptLanguageDescription[] =
+ 
+ const char kRestrictGamepadAccessName[] = "Restrict gamepad access";
+ const char kRestrictGamepadAccessDescription[] =
+-    "Enables Permissions Policy and Secure Context restrictions on the Gamepad "
+    "Disable the Gamepad "
+     "API";
+ 
+ const char kRoundedDisplay[] = "Rounded display";
+diff --git a/device/gamepad/public/cpp/gamepad_features.cc b/device/gamepad/public/cpp/gamepad_features.cc
+--- a/device/gamepad/public/cpp/gamepad_features.cc
+++ b/device/gamepad/public/cpp/gamepad_features.cc
+@@ -27,8 +27,8 @@ BASE_FEATURE(kEnableWindowsGamingInputDataFetcher,
+              base::FEATURE_ENABLED_BY_DEFAULT);
+ 
+ BASE_FEATURE(kRestrictGamepadAccess,
+-             "RestrictGamepadAccess",
+-             base::FEATURE_DISABLED_BY_DEFAULT);
+             "RestrictGamepadAccess",             // enabled
+             base::FEATURE_ENABLED_BY_DEFAULT);   // in bromite
+ 
+ // Enables gamepad multitouch
+ BASE_FEATURE(kEnableGamepadMultitouch,
+diff --git a/third_party/blink/renderer/modules/gamepad/navigator_gamepad.cc b/third_party/blink/renderer/modules/gamepad/navigator_gamepad.cc
+--- a/third_party/blink/renderer/modules/gamepad/navigator_gamepad.cc
+++ b/third_party/blink/renderer/modules/gamepad/navigator_gamepad.cc
+@@ -113,6 +113,10 @@ void RecordGamepadsForIdentifiabilityStudy(
+ HeapVector<Member<Gamepad>> NavigatorGamepad::getGamepads(
+     Navigator& navigator,
+     ExceptionState& exception_state) {
+  if (base::FeatureList::IsEnabled(::features::kRestrictGamepadAccess)) {
+    exception_state.ThrowSecurityError("Access to the feature \"gamepad\" is denied");
+    return HeapVector<Member<Gamepad>>();
+  }
+   if (!navigator.DomWindow()) {
+     // Using an existing NavigatorGamepad if one exists, but don't create one
+     // for a detached window, as its subclasses depend on a non-null window.
+@@ -435,6 +439,8 @@ void NavigatorGamepad::SampleAndCompareGamepadState() {
+ 
+ void NavigatorGamepad::DispatchGamepadEvent(const AtomicString& event_name,
+                                             Gamepad* gamepad) {
+  if (base::FeatureList::IsEnabled(::features::kRestrictGamepadAccess))
+    return;
+   // Ensure that we're blocking re-entrancy.
+   DCHECK(processing_events_);
+   DCHECK(has_connection_event_listener_);
+--
+2.25.1
@@ -0,0 +1,226 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Mon, 21 Aug 2023 14:03:25 +0000
+Subject: Add option to disable snapshots
+
+License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
+---
+ .../tab_management/TabGridViewBinder.java     |  9 +++-
+ .../tasks/tab_management/TabProperties.java   |  5 +++
+ .../java/res/xml/privacy_preferences.xml      |  5 +++
+ .../chrome/browser/app/ChromeActivity.java    |  3 +-
+ .../layouts/content/TabContentManager.java    |  7 +++-
+ .../privacy/settings/PrivacySettings.java     | 42 ++++++++++++++++++-
+ .../strings/android_chrome_strings.grd        |  8 ++++
+ 7 files changed, 73 insertions(+), 6 deletions(-)
+
+diff --git a/chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser/tasks/tab_management/TabGridViewBinder.java b/chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser/tasks/tab_management/TabGridViewBinder.java
+--- a/chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser/tasks/tab_management/TabGridViewBinder.java
+++ b/chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser/tasks/tab_management/TabGridViewBinder.java
+@@ -288,8 +288,12 @@ class TabGridViewBinder {
+                 // Adjust bitmap to thumbnail.
+                 TabUtils.setBitmapAndUpdateImageMatrix(thumbnail, result, thumbnailSize);
+             } else if (isMostRecentRequest) {
+-                // If the most recent request is a null bitmap ensure a placeholder is visible.
+-                thumbnail.setImageDrawable(null);
+                TabListFaviconProvider.TabFavicon tabFavicon = model.get(TabProperties.FAVICON);
+                if (tabFavicon != null) {
+                    thumbnail.setScaleType(ImageView.ScaleType.CENTER);
+                    thumbnail.setImageDrawable(
+                            isSelected ? tabFavicon.getSelectedDrawable() : tabFavicon.getDefaultDrawable());
+                }
+             }
+         };
+         if (sThumbnailFetcherForTesting != null) {
+@@ -325,6 +329,7 @@ class TabGridViewBinder {
+      */
+     private static void setFavicon(ViewLookupCachingFrameLayout rootView, PropertyModel model,
+             TabListFaviconProvider.TabFavicon favicon) {
+        model.set(TabProperties.FAVICON, favicon);
+         ImageView faviconView = (ImageView) rootView.fastFindViewById(R.id.tab_favicon);
+         if (favicon == null) {
+             faviconView.setImageDrawable(null);
+diff --git a/chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser/tasks/tab_management/TabProperties.java b/chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser/tasks/tab_management/TabProperties.java
+--- a/chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser/tasks/tab_management/TabProperties.java
+++ b/chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser/tasks/tab_management/TabProperties.java
+@@ -56,6 +56,9 @@ public class TabProperties {
+     public static final WritableBooleanPropertyKey FAVICON_FETCHED =
+             new WritableBooleanPropertyKey();
+ 
+    public static final WritableObjectPropertyKey<TabListFaviconProvider.TabFavicon> FAVICON =
+            new WritableObjectPropertyKey<>();
+
+     /**
+      * Property for lazily fetching favicons when required by an item in a UI.
+      */
+@@ -134,9 +137,11 @@ public class TabProperties {
+             SELECTABLE_TAB_ACTION_BUTTON_BACKGROUND,
+             SELECTABLE_TAB_ACTION_BUTTON_SELECTED_BACKGROUND, URL_DOMAIN, ACCESSIBILITY_DELEGATE,
+             CARD_TYPE, CONTENT_DESCRIPTION_STRING, CLOSE_BUTTON_DESCRIPTION_STRING,
+            FAVICON,
+             SHOPPING_PERSISTED_TAB_DATA_FETCHER, SHOULD_SHOW_PRICE_DROP_TOOLTIP};
+ 
+     public static final PropertyKey[] ALL_KEYS_TAB_STRIP = new PropertyKey[] {TAB_ID,
+             TAB_SELECTED_LISTENER, TAB_CLOSED_LISTENER, FAVICON_FETCHED, FAVICON_FETCHER,
+            FAVICON,
+             IS_SELECTED, TITLE, TABSTRIP_FAVICON_BACKGROUND_COLOR_ID, IS_INCOGNITO};
+ }
+diff --git a/chrome/android/java/res/xml/privacy_preferences.xml b/chrome/android/java/res/xml/privacy_preferences.xml
+--- a/chrome/android/java/res/xml/privacy_preferences.xml
+++ b/chrome/android/java/res/xml/privacy_preferences.xml
+@@ -94,6 +94,11 @@ found in the LICENSE file.
+         android:title="@string/open_external_links_incognito_title"
+         android:summary="@string/open_external_links_incognito_summary"
+         android:defaultValue="false" />
+    <org.chromium.components.browser_ui.settings.ChromeSwitchPreference
+        android:key="tabgrid_use_icons"
+        android:title="@string/tabgrid_use_icons_title"
+        android:summary="@string/tabgrid_use_icons_summary"
+        android:defaultValue="false" />
+     <Preference
+         android:key="privacy_sandbox"
+         android:title="@string/prefs_privacy_sandbox"
+diff --git a/chrome/android/java/src/org/chromium/chrome/browser/app/ChromeActivity.java b/chrome/android/java/src/org/chromium/chrome/browser/app/ChromeActivity.java
+--- a/chrome/android/java/src/org/chromium/chrome/browser/app/ChromeActivity.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/app/ChromeActivity.java
+@@ -142,6 +142,7 @@ import org.chromium.chrome.browser.preferences.ChromePreferenceKeys;
+ import org.chromium.chrome.browser.preferences.Pref;
+ import org.chromium.chrome.browser.preferences.SharedPreferencesManager;
+ import org.chromium.chrome.browser.printing.TabPrinter;
+import org.chromium.chrome.browser.privacy.settings.PrivacySettings;
+ import org.chromium.chrome.browser.profiles.Profile;
+ import org.chromium.chrome.browser.readaloud.ReadAloudController;
+ import org.chromium.chrome.browser.selection.SelectionPopupBackPressHandler;
+@@ -658,7 +659,7 @@ public abstract class ChromeActivity<C extends ChromeActivityComponent>
+ 
+             TabModelSelector tabModelSelector = mTabModelOrchestrator.getTabModelSelector();
+             setTabContentManager(new TabContentManager(this, mBrowserControlsManagerSupplier.get(),
+-                    !SysUtils.isLowEndDevice(),
+                    !ContextUtils.getAppSharedPreferences().getBoolean(PrivacySettings.PREF_TABGRID_USE_ICONS, false),
+                     tabModelSelector != null ? tabModelSelector::getTabById : null));
+ 
+             getBrowserControlsManager().initialize(
+diff --git a/chrome/android/java/src/org/chromium/chrome/browser/compositor/layouts/content/TabContentManager.java b/chrome/android/java/src/org/chromium/chrome/browser/compositor/layouts/content/TabContentManager.java
+--- a/chrome/android/java/src/org/chromium/chrome/browser/compositor/layouts/content/TabContentManager.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/compositor/layouts/content/TabContentManager.java
+@@ -344,9 +344,12 @@ public class TabContentManager {
+      * @param forceUpdate Whether to obtain the thumbnail from the live content.
+      * @param writeBack When {@code forceUpdate}, whether to write the thumbnail to cache.
+      */
+-    public void getTabThumbnailWithCallback(@NonNull int tabId, @NonNull Size thumbnailSize,
+    public void getTabThumbnailWithCallback(@NonNull int tabId, @NonNull Size thumbnailSize, //
+             @NonNull Callback<Bitmap> callback, boolean forceUpdate, boolean writeBack) {
+-        if (!mSnapshotsEnabled) return;
+        if (!mSnapshotsEnabled) {
+            callback.onResult(null);
+            return;
+        }
+ 
+         // TODO(crbug/1444782): Remove forceUpdate and writeBack params once the following features
+         // launch:
+diff --git a/chrome/android/java/src/org/chromium/chrome/browser/privacy/settings/PrivacySettings.java b/chrome/android/java/src/org/chromium/chrome/browser/privacy/settings/PrivacySettings.java
+--- a/chrome/android/java/src/org/chromium/chrome/browser/privacy/settings/PrivacySettings.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/privacy/settings/PrivacySettings.java
+@@ -65,6 +65,11 @@ import org.chromium.chrome.browser.preferences.SharedPreferencesManager;
+ import org.chromium.components.browser_ui.settings.ChromeSwitchPreference;
+ import org.chromium.components.browser_ui.settings.ManagedPreferenceDelegate;
+ 
+import org.chromium.chrome.browser.ui.messages.snackbar.SnackbarManager;
+import org.chromium.chrome.browser.ui.messages.snackbar.INeedSnackbarManager;
+import org.chromium.chrome.browser.ui.messages.snackbar.Snackbar;
+import org.chromium.chrome.browser.ApplicationLifetime;
+
+ import java.util.ArrayList;
+ import java.util.List;
+ 
+@@ -72,7 +77,15 @@ import java.util.List;
+  * Fragment to keep track of the all the privacy related preferences.
+  */
+ public class PrivacySettings
+-        extends ChromeBaseSettingsFragment implements Preference.OnPreferenceChangeListener {
+        extends ChromeBaseSettingsFragment implements Preference.OnPreferenceChangeListener, INeedSnackbarManager {
+    private SnackbarManager mSnackbarManager;
+    private Snackbar mSnackbar;
+
+    @Override
+    public void setSnackbarManager(SnackbarManager manager) {
+        mSnackbarManager = manager;
+    }
+
+     private static final String PREF_CAN_MAKE_PAYMENT = "can_make_payment";
+     private static final String PREF_PRELOAD_PAGES = "preload_pages";
+     private static final String PREF_HTTPS_FIRST_MODE = "https_first_mode";
+@@ -139,6 +152,21 @@ public class PrivacySettings
+             }
+         }
+ 
+        mSnackbar = Snackbar.make(getActivity().getString(R.string.ui_relaunch_notice),
+                new SnackbarManager.SnackbarController() {
+                        @Override
+                        public void onDismissNoAction(Object actionData) { }
+
+                        @Override
+                        public void onAction(Object actionData) {
+                                ApplicationLifetime.terminate(true);
+                        }
+                }, Snackbar.TYPE_NOTIFICATION, Snackbar.UMA_UNKNOWN)
+                .setSingleLine(false)
+                .setAction(getActivity().getString(R.string.relaunch),
+                        /*actionData*/null)
+                .setDuration(/*durationMs*/70000);
+
+         Preference privacyGuidePreference = findPreference(PREF_PRIVACY_GUIDE);
+         // Record the launch of PG from the S&P link-row entry point
+         privacyGuidePreference.setOnPreferenceClickListener(preference -> {
+@@ -294,6 +322,7 @@ public class PrivacySettings
+ 
+     public static final String PREF_ALLOW_CUSTOM_TAB_INTENTS = "allow_custom_tab_intents";
+     public static final String PREF_OPEN_EXTERNAL_LINKS_INCOGNITO = "open_external_links_incognito";
+    public static final String PREF_TABGRID_USE_ICONS = "tabgrid_use_icons";
+ 
+     @Override
+     public boolean onPreferenceChange(Preference preference, Object newValue) {
+@@ -319,6 +348,13 @@ public class PrivacySettings
+             SharedPreferences.Editor sharedPreferencesEditor = ContextUtils.getAppSharedPreferences().edit();
+             sharedPreferencesEditor.putBoolean(PREF_OPEN_EXTERNAL_LINKS_INCOGNITO, (boolean)newValue);
+             sharedPreferencesEditor.apply();
+        } else if (PREF_TABGRID_USE_ICONS.equals(key)) {
+            SharedPreferences.Editor sharedPreferencesEditor = ContextUtils.getAppSharedPreferences().edit();
+            sharedPreferencesEditor.putBoolean(PREF_TABGRID_USE_ICONS, (boolean)newValue);
+            sharedPreferencesEditor.apply();
+            if (!mSnackbarManager.isShowing()) {
+                mSnackbarManager.showSnackbar(mSnackbar);
+            }
+         }
+         return true;
+     }
+@@ -361,6 +397,10 @@ public class PrivacySettings
+                             : R.string.text_off);
+         }
+ 
+        Preference tabGridUseIcons =
+                (ChromeSwitchPreference) findPreference(PREF_TABGRID_USE_ICONS);
+        tabGridUseIcons.setOnPreferenceChangeListener(this);
+
+         Preference refererPolicyPref = findPreference(PREF_REFERER_POLICY);
+         refererPolicyPref.setSummary(
+                 RefererSettingsFragment.getRefererSummaryString(getContext()));
+diff --git a/chrome/browser/ui/android/strings/android_chrome_strings.grd b/chrome/browser/ui/android/strings/android_chrome_strings.grd
+--- a/chrome/browser/ui/android/strings/android_chrome_strings.grd
+++ b/chrome/browser/ui/android/strings/android_chrome_strings.grd
+@@ -5463,6 +5463,14 @@ To change this setting, <ph name="BEGIN_LINK">&lt;resetlink&gt;</ph>reset sync<p
+         Your <ph name="FQDN">%1$s<ex>www.amazon.com</ex></ph> timer ran out. It'll start again tomorrow.
+       </message>
+ 
+      <!-- Tab Broup Disable Thumbnail -->
+      <message name="IDS_TABGRID_USE_ICONS_TITLE" desc="Text for 'Use icons in the tab grid' settings-privacy option.">
+        Use only icons in the tab grid
+      </message>
+      <message name="IDS_TABGRID_USE_ICONS_SUMMARY" desc="Summary text for 'Use icons in the tab grid' settings-privacy option.">
+        Disable the saving of snapshots to disk
+      </message>
+
+       <!-- Tab Group Tab Switcher strings -->
+       <message name="IDS_TAB_MANAGEMENT_MODULE_TITLE" desc="Text shown when the Tab Management module is referenced in install start, success, failure UI (e.g. in IDS_MODULE_INSTALL_START_TEXT, which will expand to 'Installing Tab management for Chrome…').">
+         Tab management
+--
+2.25.1
@@ -0,0 +1,696 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Thu, 16 Feb 2023 15:28:16 +0000
+Subject: Add setting to clear data on exit
+
+License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
+---
+ chrome/android/chrome_java_sources.gni        |  1 +
+ .../chrome/browser/ChromeTabbedActivity.java  |  7 +-
+ .../ClearBrowsingDataFragment.java            |  6 ++
+ .../ClearBrowsingDataFragmentAtStart.java     | 74 +++++++++++++++++++
+ .../ClearBrowsingDataTabsFragment.java        |  7 +-
+ chrome/app/settings_strings.grdp              | 10 +++
+ .../browsing_data/browsing_data_bridge.cc     |  2 +-
+ .../chrome_browsing_data_lifetime_manager.cc  | 22 +++++-
+ .../chrome_browsing_data_remover_delegate.cc  | 11 +++
+ .../api/settings_private/prefs_util.cc        | 17 +++++
+ .../browser/profiles/ProfileManagerUtils.java |  5 ++
+ .../profiles/android/profile_manager_utils.cc |  5 ++
+ chrome/browser/profiles/profile_manager.cc    | 13 ++++
+ chrome/browser/profiles/profile_manager.h     |  2 +
+ .../clear_browsing_data_dialog.html           | 44 +++++++++++
+ .../clear_browsing_data_dialog.ts             |  1 +
+ .../strings/android_chrome_strings.grd        |  3 +
+ .../settings_localized_strings_provider.cc    |  1 +
+ .../core/browsing_data_policies_utils.cc      | 20 ++---
+ .../core/browsing_data_policies_utils.h       | 11 +++
+ .../browsing_data/core/browsing_data_utils.cc | 34 +++++++++
+ .../core/clear_browsing_data_tab.h            |  2 +-
+ components/browsing_data/core/pref_names.cc   | 27 +++++++
+ components/browsing_data/core/pref_names.h    |  9 +++
+ content/browser/storage_partition_impl.cc     |  1 +
+ 25 files changed, 319 insertions(+), 16 deletions(-)
+ create mode 100644 chrome/android/java/src/org/chromium/chrome/browser/browsing_data/ClearBrowsingDataFragmentAtStart.java
+
+diff --git a/chrome/android/chrome_java_sources.gni b/chrome/android/chrome_java_sources.gni
+--- a/chrome/android/chrome_java_sources.gni
+++ b/chrome/android/chrome_java_sources.gni
+@@ -303,6 +303,7 @@ chrome_java_sources = [
+   "java/src/org/chromium/chrome/browser/browsing_data/ClearBrowsingDataFragmentAdvanced.java",
+   "java/src/org/chromium/chrome/browser/browsing_data/ClearBrowsingDataFragmentBasic.java",
+   "java/src/org/chromium/chrome/browser/browsing_data/ClearBrowsingDataTabsFragment.java",
+  "java/src/org/chromium/chrome/browser/browsing_data/ClearBrowsingDataFragmentAtStart.java",
+   "java/src/org/chromium/chrome/browser/browsing_data/ConfirmImportantSitesDialogFragment.java",
+   "java/src/org/chromium/chrome/browser/browsing_data/OtherFormsOfHistoryDialogFragment.java",
+   "java/src/org/chromium/chrome/browser/browsing_data/UrlFilter.java",
+diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java b/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java
+--- a/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/ChromeTabbedActivity.java
+@@ -146,6 +146,7 @@ import org.chromium.chrome.browser.profiles.ProfileManager;
+ import org.chromium.chrome.browser.quick_delete.QuickDeleteController;
+ import org.chromium.chrome.browser.quick_delete.QuickDeleteDelegateImpl;
+ import org.chromium.chrome.browser.quick_delete.QuickDeleteMetricsDelegate;
+import org.chromium.chrome.browser.profiles.ProfileManagerUtils;
+ import org.chromium.chrome.browser.read_later.ReadingListBackPressHandler;
+ import org.chromium.chrome.browser.read_later.ReadingListUtils;
+ import org.chromium.chrome.browser.reengagement.ReengagementNotificationController;
+@@ -1307,7 +1308,11 @@ public class ChromeTabbedActivity extends ChromeActivity<ChromeActivityComponent
+             Intent intent = getIntent();
+ 
+             boolean hadCipherData =
+-                    CipherFactory.getInstance().restoreFromBundle(getSavedInstanceState());
+                    CipherFactory.getInstance().restoreFromBundle(getSavedInstanceState()); //
+            if (!hadCipherData) {
+                Log.i(TAG, "Removing browsing data");
+                ProfileManagerUtils.removeBrowsingDataAtStart();
+            }
+ 
+             String PREF_CLOSE_TABS_ON_EXIT = "close_tabs_on_exit";
+             boolean noRestoreState =
+diff --git a/chrome/android/java/src/org/chromium/chrome/browser/browsing_data/ClearBrowsingDataFragment.java b/chrome/android/java/src/org/chromium/chrome/browser/browsing_data/ClearBrowsingDataFragment.java
+--- a/chrome/android/java/src/org/chromium/chrome/browser/browsing_data/ClearBrowsingDataFragment.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/browsing_data/ClearBrowsingDataFragment.java
+@@ -412,6 +412,10 @@ public abstract class ClearBrowsingDataFragment extends PreferenceFragmentCompat
+      */
+     protected abstract @ClearBrowsingDataTab int getClearBrowsingDataTabType();
+ 
+    protected boolean shouldClearBrowsingData() {
+        return true;
+    }
+
+     /**
+      * Decides whether a given dialog option should be selected when the dialog is initialized.
+      *
+@@ -489,6 +493,7 @@ public abstract class ClearBrowsingDataFragment extends PreferenceFragmentCompat
+      * options.
+      */
+     private void onClearButtonClicked() {
+        if (!shouldClearBrowsingData()) return;
+         if (shouldShowImportantSitesDialog()) {
+             showImportantDialogThenClear();
+             return;
+@@ -522,6 +527,7 @@ public abstract class ClearBrowsingDataFragment extends PreferenceFragmentCompat
+         Button clearButton = (Button) getView().findViewById(R.id.clear_button);
+         boolean isEnabled = !getSelectedOptions().isEmpty();
+         clearButton.setEnabled(isEnabled);
+        clearButton.setVisibility(shouldClearBrowsingData() ? View.VISIBLE : View.INVISIBLE);
+     }
+ 
+     private int getSpinnerIndex(
+diff --git a/chrome/android/java/src/org/chromium/chrome/browser/browsing_data/ClearBrowsingDataFragmentAtStart.java b/chrome/android/java/src/org/chromium/chrome/browser/browsing_data/ClearBrowsingDataFragmentAtStart.java
+new file mode 100644
+--- /dev/null
+++ b/chrome/android/java/src/org/chromium/chrome/browser/browsing_data/ClearBrowsingDataFragmentAtStart.java
+@@ -0,0 +1,74 @@
+/*
+    This file is part of Bromite.
+
+    Bromite is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    Bromite is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with Bromite. If not, see <https://www.gnu.org/licenses/>.
+*/
+
+package org.chromium.chrome.browser.browsing_data;
+
+import android.content.Context;
+import android.os.Bundle;
+import android.view.View;
+
+import androidx.annotation.IntDef;
+import androidx.preference.Preference;
+
+import org.chromium.base.Callback;
+import org.chromium.chrome.R;
+import org.chromium.chrome.browser.profiles.Profile;
+import org.chromium.components.browser_ui.settings.SpinnerPreference;
+
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.util.Arrays;
+import java.util.List;
+
+public class ClearBrowsingDataFragmentAtStart extends ClearBrowsingDataFragment {
+    static final String PREF_TIME_RANGE = "time_period_spinner";
+
+    @Override
+    public void onCreatePreferences(Bundle savedInstanceState, String rootKey) {
+        super.onCreatePreferences(savedInstanceState, rootKey);
+
+        SpinnerPreference spinner = (SpinnerPreference) findPreference(PREF_TIME_RANGE);
+        if (spinner != null) {
+            getPreferenceScreen().removePreference(spinner);
+        }
+    }
+
+    private boolean isHistorySyncEnabled() {
+        return false;
+    }
+
+    @Override
+    protected int getClearBrowsingDataTabType() {
+        return ClearBrowsingDataTab.AT_START;
+    }
+
+    @Override
+    protected List<Integer> getDialogOptions() {
+        return Arrays.asList(DialogOption.CLEAR_HISTORY, DialogOption.CLEAR_COOKIES_AND_SITE_DATA,
+                DialogOption.CLEAR_CACHE, DialogOption.CLEAR_PASSWORDS,
+                DialogOption.CLEAR_FORM_DATA, DialogOption.CLEAR_SITE_SETTINGS);
+    }
+
+    @Override
+    protected void onClearBrowsingData() {
+    }
+
+    @Override
+    protected boolean shouldClearBrowsingData() {
+        return false;
+    }
+}
+diff --git a/chrome/android/java/src/org/chromium/chrome/browser/browsing_data/ClearBrowsingDataTabsFragment.java b/chrome/android/java/src/org/chromium/chrome/browser/browsing_data/ClearBrowsingDataTabsFragment.java
+--- a/chrome/android/java/src/org/chromium/chrome/browser/browsing_data/ClearBrowsingDataTabsFragment.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/browsing_data/ClearBrowsingDataTabsFragment.java
+@@ -27,7 +27,7 @@ import org.chromium.chrome.browser.settings.SettingsActivity;
+  * Fragment with a {@link TabLayout} containing a basic and an advanced version of the CBD dialog.
+  */
+ public class ClearBrowsingDataTabsFragment extends Fragment {
+-    public static final int CBD_TAB_COUNT = 2;
+    public static final int CBD_TAB_COUNT = 3;
+ 
+     private ClearBrowsingDataFetcher mFetcher;
+ 
+@@ -84,6 +84,8 @@ public class ClearBrowsingDataTabsFragment extends Fragment {
+                 return getActivity().getString(R.string.clear_browsing_data_basic_tab_title);
+             case 1:
+                 return getActivity().getString(R.string.prefs_section_advanced);
+            case 2:
+                return getActivity().getString(R.string.clear_browsing_data_atstart_tab_title);
+             default:
+                 throw new RuntimeException("invalid position: " + position);
+         }
+@@ -121,6 +123,9 @@ public class ClearBrowsingDataTabsFragment extends Fragment {
+                 case 1:
+                     fragment = new ClearBrowsingDataFragmentAdvanced();
+                     break;
+                case 2:
+                    fragment = new ClearBrowsingDataFragmentAtStart();
+                    break;
+                 default:
+                     throw new RuntimeException("invalid position: " + position);
+             }
+diff --git a/chrome/app/settings_strings.grdp b/chrome/app/settings_strings.grdp
+--- a/chrome/app/settings_strings.grdp
+++ b/chrome/app/settings_strings.grdp
+@@ -2333,6 +2333,16 @@
+   <message name="IDS_SETTINGS_CLEAR_BROWSING_DATA" desc="Text for clear browsing data button in Privacy options">
+     Clear browsing data
+   </message>
+  <if expr="is_win or is_linux">
+    <message name="IDS_CLEAR_BROWSING_DATA_ATSTART_TAB_TITLE" desc="The title of the tab showing the at start clear browsing data options.">
+      At Close
+    </message>
+  </if>
+  <if expr="is_android">
+    <message name="IDS_CLEAR_BROWSING_DATA_ATSTART_TAB_TITLE" desc="The title of the tab showing the at start clear browsing data options.">
+      At Startup
+    </message>
+  </if>
+   <message name="IDS_SETTINGS_CLEAR_DATA_DESCRIPTION" desc="Description for clear browsing data button in Privacy options. 'History' refers to browsing history. 'Cookies' refers to the technical meaning of a cookie, i.e. data saved by a website on the user's computer, as in when a website saves your preferences.">
+     Clear history, cookies, cache, and more
+   </message>
+diff --git a/chrome/browser/android/browsing_data/browsing_data_bridge.cc b/chrome/browser/android/browsing_data/browsing_data_bridge.cc
+--- a/chrome/browser/android/browsing_data/browsing_data_bridge.cc
+++ b/chrome/browser/android/browsing_data/browsing_data_bridge.cc
+@@ -326,7 +326,7 @@ static void JNI_BrowsingDataBridge_SetLastClearBrowsingDataTab(
+     const JavaParamRef<jobject>& obj,
+     jint tab_index) {
+   DCHECK_GE(tab_index, 0);
+-  DCHECK_LT(tab_index, 2);
+  DCHECK_LT(tab_index, 3);
+   GetPrefService()->SetInteger(browsing_data::prefs::kLastClearBrowsingDataTab,
+                                tab_index);
+ }
+diff --git a/chrome/browser/browsing_data/chrome_browsing_data_lifetime_manager.cc b/chrome/browser/browsing_data/chrome_browsing_data_lifetime_manager.cc
+--- a/chrome/browser/browsing_data/chrome_browsing_data_lifetime_manager.cc
+++ b/chrome/browser/browsing_data/chrome_browsing_data_lifetime_manager.cc
+@@ -312,8 +312,25 @@ void ChromeBrowsingDataLifetimeManager::Shutdown() {
+ 
+ void ChromeBrowsingDataLifetimeManager::ClearBrowsingDataForOnExitPolicy(
+     bool keep_browser_alive) {
+-  const base::Value::List& data_types = profile_->GetPrefs()->GetList(
+-      browsing_data::prefs::kClearBrowsingDataOnExitList);
+  base::Value::List data_types = profile_->GetPrefs()->GetList(
+      browsing_data::prefs::kClearBrowsingDataOnExitList).Clone();
+
+  if (profile_->GetPrefs()->GetBoolean(browsing_data::prefs::kDeleteBrowsingHistoryAtStart))
+    data_types.Append(browsing_data::policy_data_types::kBrowsingHistoryName);
+  if (profile_->GetPrefs()->GetBoolean(browsing_data::prefs::kDeletePasswordsAtStart))
+    data_types.Append(browsing_data::policy_data_types::kPasswordSigninName);
+  if (profile_->GetPrefs()->GetBoolean(browsing_data::prefs::kDeleteFormDataAtStart))
+    data_types.Append(browsing_data::policy_data_types::kAutofillName);
+  if (profile_->GetPrefs()->GetBoolean(browsing_data::prefs::kDeleteSiteSettingsAtStart))
+    data_types.Append(browsing_data::policy_data_types::kSiteSettingsName);
+  if (profile_->GetPrefs()->GetBoolean(browsing_data::prefs::kDeleteHostedAppsDataAtStart))
+    data_types.Append(browsing_data::policy_data_types::kHostedAppDataName);
+  if (profile_->GetPrefs()->GetBoolean(browsing_data::prefs::kDeleteDownloadHistoryAtStart))
+    data_types.Append(browsing_data::policy_data_types::kDownloadHistoryName);
+  if (profile_->GetPrefs()->GetBoolean(browsing_data::prefs::kDeleteCookiesAtStart))
+    data_types.Append(browsing_data::policy_data_types::kCookiesAndOtherSiteDataName);
+  if (profile_->GetPrefs()->GetBoolean(browsing_data::prefs::kDeleteCacheAtStart))
+    data_types.Append(browsing_data::policy_data_types::kCachedImagesAndFilesName);
+ 
+   if (!data_types.empty() &&
+       IsConditionSatisfiedForBrowsingDataRemoval(GetSyncTypesForPolicyPref(
+@@ -422,6 +439,7 @@ void ChromeBrowsingDataLifetimeManager::StartScheduledBrowsingDataRemoval() {
+ bool ChromeBrowsingDataLifetimeManager::
+     IsConditionSatisfiedForBrowsingDataRemoval(
+         const syncer::UserSelectableTypeSet sync_types) {
+  if ((true)) return true;
+   bool sync_disabled = !SyncServiceFactory::IsSyncAllowed(profile_);
+   // Return the state of sync if
+   // `features::kDataRetentionPoliciesDisableSyncTypesNeeded` is disabled or if
+diff --git a/chrome/browser/browsing_data/chrome_browsing_data_remover_delegate.cc b/chrome/browser/browsing_data/chrome_browsing_data_remover_delegate.cc
+--- a/chrome/browser/browsing_data/chrome_browsing_data_remover_delegate.cc
+++ b/chrome/browser/browsing_data/chrome_browsing_data_remover_delegate.cc
+@@ -427,6 +427,9 @@ void ChromeBrowsingDataRemoverDelegate::RemoveEmbedderData(
+           delete_end_, CreateTaskCompletionClosure(TracingDataType::kHistory),
+           &history_task_tracker_);
+     }
+  }
+
+  if (remove_mask & content::BrowsingDataRemover::DATA_TYPE_CACHE) {
+     if (ClipboardRecentContent::GetInstance())
+       ClipboardRecentContent::GetInstance()->SuppressClipboardContent();
+ 
+@@ -477,7 +480,9 @@ void ChromeBrowsingDataRemoverDelegate::RemoveEmbedderData(
+           prerender::NoStatePrefetchManager::CLEAR_PRERENDER_CONTENTS |
+           prerender::NoStatePrefetchManager::CLEAR_PRERENDER_HISTORY);
+     }
+  }
+ 
+  if ((remove_mask & constants::DATA_TYPE_HISTORY) && may_delete_history) {
+     // The saved Autofill profiles and credit cards can include the origin from
+     // which these profiles and credit cards were learned.  These are a form of
+     // history, so clear them as well.
+@@ -498,7 +503,9 @@ void ChromeBrowsingDataRemoverDelegate::RemoveEmbedderData(
+       if (data_manager)
+         data_manager->Refresh();
+     }
+  }
+ 
+  if (remove_mask & content::BrowsingDataRemover::DATA_TYPE_CACHE) {
+     base::ThreadPool::PostTaskAndReply(
+         FROM_HERE, {base::TaskPriority::USER_VISIBLE, base::MayBlock()},
+         base::BindOnce(
+@@ -573,9 +580,13 @@ void ChromeBrowsingDataRemoverDelegate::RemoveEmbedderData(
+     }
+ 
+     device_event_log::Clear(delete_begin_, delete_end_);
+  }
+ 
+  if ((remove_mask & constants::DATA_TYPE_HISTORY) && may_delete_history) {
+     CreateCrashUploadList()->Clear(delete_begin_, delete_end_);
+  }
+ 
+  if (remove_mask & content::BrowsingDataRemover::DATA_TYPE_CACHE) {
+     content::BackgroundTracingManager::GetInstance().DeleteTracesInDateRange(
+         delete_begin_, delete_end_);
+ 
+diff --git a/chrome/browser/extensions/api/settings_private/prefs_util.cc b/chrome/browser/extensions/api/settings_private/prefs_util.cc
+--- a/chrome/browser/extensions/api/settings_private/prefs_util.cc
+++ b/chrome/browser/extensions/api/settings_private/prefs_util.cc
+@@ -517,6 +517,23 @@ const PrefsUtil::TypedPrefMap& PrefsUtil::GetAllowlistedKeys() {
+   (*s_allowlist)[browsing_data::prefs::kLastClearBrowsingDataTab] =
+       settings_api::PrefType::PREF_TYPE_NUMBER;
+ 
+  (*s_allowlist)[browsing_data::prefs::kDeleteBrowsingHistoryAtStart] =
+      settings_api::PrefType::PREF_TYPE_BOOLEAN;
+  (*s_allowlist)[browsing_data::prefs::kDeleteDownloadHistoryAtStart] =
+      settings_api::PrefType::PREF_TYPE_BOOLEAN;
+  (*s_allowlist)[browsing_data::prefs::kDeleteCacheAtStart] =
+      settings_api::PrefType::PREF_TYPE_BOOLEAN;
+  (*s_allowlist)[browsing_data::prefs::kDeleteCookiesAtStart] =
+      settings_api::PrefType::PREF_TYPE_BOOLEAN;
+  (*s_allowlist)[browsing_data::prefs::kDeletePasswordsAtStart] =
+      settings_api::PrefType::PREF_TYPE_BOOLEAN;
+  (*s_allowlist)[browsing_data::prefs::kDeleteFormDataAtStart] =
+      settings_api::PrefType::PREF_TYPE_BOOLEAN;
+  (*s_allowlist)[browsing_data::prefs::kDeleteSiteSettingsAtStart] =
+      settings_api::PrefType::PREF_TYPE_BOOLEAN;
+  (*s_allowlist)[browsing_data::prefs::kDeleteHostedAppsDataAtStart] =
+      settings_api::PrefType::PREF_TYPE_BOOLEAN;
+
+   // Accessibility.
+   (*s_allowlist)[::prefs::kAccessibilityImageLabelsEnabled] =
+       settings_api::PrefType::PREF_TYPE_BOOLEAN;
+diff --git a/chrome/browser/profiles/android/java/src/org/chromium/chrome/browser/profiles/ProfileManagerUtils.java b/chrome/browser/profiles/android/java/src/org/chromium/chrome/browser/profiles/ProfileManagerUtils.java
+--- a/chrome/browser/profiles/android/java/src/org/chromium/chrome/browser/profiles/ProfileManagerUtils.java
+++ b/chrome/browser/profiles/android/java/src/org/chromium/chrome/browser/profiles/ProfileManagerUtils.java
+@@ -52,9 +52,14 @@ public class ProfileManagerUtils {
+         }
+     }
+ 
+    public static void removeBrowsingDataAtStart() {
+        ProfileManagerUtilsJni.get().removeBrowsingDataAtStart();
+    }
+
+     @NativeMethods
+     interface Natives {
+         void flushPersistentDataForAllProfiles();
+         void removeSessionCookiesForAllProfiles();
+        void removeBrowsingDataAtStart();
+     }
+ }
+diff --git a/chrome/browser/profiles/android/profile_manager_utils.cc b/chrome/browser/profiles/android/profile_manager_utils.cc
+--- a/chrome/browser/profiles/android/profile_manager_utils.cc
+++ b/chrome/browser/profiles/android/profile_manager_utils.cc
+@@ -67,3 +67,8 @@ static void JNI_ProfileManagerUtils_RemoveSessionCookiesForAllProfiles(
+       g_browser_process->profile_manager()->GetLoadedProfiles(),
+       RemoveSessionCookiesForProfile);
+ }
+
+static void JNI_ProfileManagerUtils_RemoveBrowsingDataAtStart(
+    JNIEnv* env) {
+  g_browser_process->profile_manager()->RemoveBrowsingDataAtStart();
+}
+diff --git a/chrome/browser/profiles/profile_manager.cc b/chrome/browser/profiles/profile_manager.cc
+--- a/chrome/browser/profiles/profile_manager.cc
+++ b/chrome/browser/profiles/profile_manager.cc
+@@ -1492,6 +1492,19 @@ void ProfileManager::DoFinalInit(ProfileInfo* profile_info,
+   }
+ }
+ 
+void ProfileManager::RemoveBrowsingDataAtStart() {
+  base::ranges::for_each(
+      GetLoadedProfiles(),
+      [](Profile* profile) {
+        auto* browsing_data_lifetime_manager =
+            ChromeBrowsingDataLifetimeManagerFactory::GetForProfile(profile);
+        if (browsing_data_lifetime_manager && !profile->IsOffTheRecord()) {
+          browsing_data_lifetime_manager->ClearBrowsingDataForOnExitPolicy(
+              /*keep_browser_alive=*/false);
+        }
+      });
+}
+
+ void ProfileManager::DoFinalInitForServices(Profile* profile,
+                                             bool go_off_the_record) {
+   if (!do_final_services_init_ ||
+diff --git a/chrome/browser/profiles/profile_manager.h b/chrome/browser/profiles/profile_manager.h
+--- a/chrome/browser/profiles/profile_manager.h
+++ b/chrome/browser/profiles/profile_manager.h
+@@ -202,6 +202,8 @@ class ProfileManager : public Profile::Delegate {
+   //   profiles.
+   std::vector<Profile*> GetLoadedProfiles() const;
+ 
+  void RemoveBrowsingDataAtStart();
+
+   // If a profile with the given path is currently managed by this object and
+   // fully initialized, return a pointer to the corresponding Profile object;
+   // otherwise return null.
+diff --git a/chrome/browser/resources/settings/clear_browsing_data_dialog/clear_browsing_data_dialog.html b/chrome/browser/resources/settings/clear_browsing_data_dialog/clear_browsing_data_dialog.html
+--- a/chrome/browser/resources/settings/clear_browsing_data_dialog/clear_browsing_data_dialog.html
+++ b/chrome/browser/resources/settings/clear_browsing_data_dialog/clear_browsing_data_dialog.html
+@@ -284,6 +284,50 @@
+                 disabled="[[clearingInProgress_]]" no-set-pref>
+             </settings-checkbox>
+           </div>
+          <div id="atstart-tab">
+           <settings-checkbox
+                pref="{{prefs.browser.clear_data.browsing_history_at_start}}"
+                label="$i18n{clearBrowsingHistory}"
+                sub-label="[[counters_.browsing_history]]">
+            </settings-checkbox>
+            <settings-checkbox
+                pref="{{prefs.browser.clear_data.download_history_at_start}}"
+                label="$i18n{clearDownloadHistory}"
+                sub-label="[[counters_.download_history]]">
+            </settings-checkbox>
+            <settings-checkbox
+                class="cookies-checkbox"
+                pref="{{prefs.browser.clear_data.cookies_at_start}}"
+                label="$i18n{clearCookies}"
+                sub-label="[[counters_.cookies]]">
+            </settings-checkbox>
+            <settings-checkbox
+                class="cache-checkbox"
+                pref="{{prefs.browser.clear_data.cache_at_start}}"
+                label="$i18n{clearCache}"
+                sub-label="[[counters_.cache]]">
+            </settings-checkbox>
+            <settings-checkbox
+                pref="{{prefs.browser.clear_data.passwords_at_start}}"
+                label="$i18n{clearPasswords}"
+                sub-label="[[counters_.passwords]]">
+            </settings-checkbox>
+            <settings-checkbox
+                pref="{{prefs.browser.clear_data.form_data_at_start}}"
+                label="$i18n{clearFormData}"
+                sub-label="[[counters_.form_data]]">
+            </settings-checkbox>
+            <settings-checkbox
+                pref="{{prefs.browser.clear_data.site_settings_at_start}}"
+                label="$i18nPolymer{siteSettings}"
+                sub-label="[[counters_.site_settings]]">
+            </settings-checkbox>
+            <settings-checkbox
+                pref="{{prefs.browser.clear_data.hosted_apps_data_at_start}}"
+                label="$i18n{clearHostedAppData}"
+                sub-label="[[counters_.hosted_apps_data]]">
+            </settings-checkbox>
+          </div>
+         </iron-pages>
+       </div>
+       <div slot="button-container">
+diff --git a/chrome/browser/resources/settings/clear_browsing_data_dialog/clear_browsing_data_dialog.ts b/chrome/browser/resources/settings/clear_browsing_data_dialog/clear_browsing_data_dialog.ts
+--- a/chrome/browser/resources/settings/clear_browsing_data_dialog/clear_browsing_data_dialog.ts
+++ b/chrome/browser/resources/settings/clear_browsing_data_dialog/clear_browsing_data_dialog.ts
+@@ -194,6 +194,7 @@ export class SettingsClearBrowsingDataDialogElement extends
+         value: () =>
+             [loadTimeData.getString('basicPageTitle'),
+              loadTimeData.getString('advancedPageTitle'),
+             loadTimeData.getString('atStartPageTitle'),
+     ],
+       },
+ 
+diff --git a/chrome/browser/ui/android/strings/android_chrome_strings.grd b/chrome/browser/ui/android/strings/android_chrome_strings.grd
+--- a/chrome/browser/ui/android/strings/android_chrome_strings.grd
+++ b/chrome/browser/ui/android/strings/android_chrome_strings.grd
+@@ -1635,6 +1635,9 @@ Your Google account may have other forms of browsing history like searches and a
+       <message name="IDS_CLEAR_BROWSING_DATA_BASIC_TAB_TITLE" desc="The title of the tab showing the basic clear browsing data options.">
+         Basic
+       </message>
+      <message name="IDS_CLEAR_BROWSING_DATA_ATSTART_TAB_TITLE" desc="The title of the tab showing the at start clear browsing data options.">
+        At Startup
+      </message>
+       <message name="IDS_ANDROID_HISTORY_OTHER_FORMS_OF_HISTORY" desc="The notification at the top of the history page indicating that deleting Chrome browsing history will not delete other forms of history stored at Google My Activity.">
+         Your Google Account may have other forms of browsing history at <ph name="BEGIN_LINK">&lt;link&gt;</ph>myactivity.google.com<ph name="END_LINK">&lt;/link&gt;</ph>.
+       </message>
+diff --git a/chrome/browser/ui/webui/settings/settings_localized_strings_provider.cc b/chrome/browser/ui/webui/settings/settings_localized_strings_provider.cc
+--- a/chrome/browser/ui/webui/settings/settings_localized_strings_provider.cc
+++ b/chrome/browser/ui/webui/settings/settings_localized_strings_provider.cc
+@@ -1584,6 +1584,7 @@ void AddPrivacyStrings(content::WebUIDataSource* html_source,
+     {"clearedData", IDS_SETTINGS_CLEARED_DATA},
+     {"clearBrowsingData", IDS_SETTINGS_CLEAR_BROWSING_DATA},
+     {"clearBrowsingDataDescription", IDS_SETTINGS_CLEAR_DATA_DESCRIPTION},
+    {"atStartPageTitle", IDS_CLEAR_BROWSING_DATA_ATSTART_TAB_TITLE},
+     {"titleAndCount", IDS_SETTINGS_TITLE_AND_COUNT},
+     {"safeBrowsingEnableExtendedReportingDesc",
+      IDS_SETTINGS_SAFEBROWSING_ENABLE_REPORTING_DESC},
+diff --git a/components/browsing_data/core/browsing_data_policies_utils.cc b/components/browsing_data/core/browsing_data_policies_utils.cc
+--- a/components/browsing_data/core/browsing_data_policies_utils.cc
+++ b/components/browsing_data/core/browsing_data_policies_utils.cc
+@@ -17,21 +17,21 @@
+ 
+ namespace browsing_data {
+ 
+-namespace {
+-
+ namespace policy_data_types {
+ // Data retention policy types that require sync to be disabled.
+-constexpr char kBrowsingHistoryName[] = "browsing_history";
+-constexpr char kPasswordSigninName[] = "password_signin";
+-constexpr char kAutofillName[] = "autofill";
+-constexpr char kSiteSettingsName[] = "site_settings";
+extern constexpr char kBrowsingHistoryName[] = "browsing_history";
+extern constexpr char kPasswordSigninName[] = "password_signin";
+extern constexpr char kAutofillName[] = "autofill";
+extern constexpr char kSiteSettingsName[] = "site_settings";
+ // Data retention policy types that do not require sync to be disabled.
+-constexpr char kHostedAppDataName[] = "hosted_app_data";
+-constexpr char kDownloadHistoryName[] = "download_history";
+-constexpr char kCookiesAndOtherSiteDataName[] = "cookies_and_other_site_data";
+-constexpr char kCachedImagesAndFilesName[] = "cached_images_and_files";
+extern constexpr char kHostedAppDataName[] = "hosted_app_data";
+extern constexpr char kDownloadHistoryName[] = "download_history";
+extern constexpr char kCookiesAndOtherSiteDataName[] = "cookies_and_other_site_data";
+extern constexpr char kCachedImagesAndFilesName[] = "cached_images_and_files";
+ }  // namespace policy_data_types
+ 
+namespace {
+
+ // The format of the log message shown in chrome://policy/logs when sync types
+ // are automatically disabled.
+ constexpr char kDisabledSyncTypesLogFormat[] =
+diff --git a/components/browsing_data/core/browsing_data_policies_utils.h b/components/browsing_data/core/browsing_data_policies_utils.h
+--- a/components/browsing_data/core/browsing_data_policies_utils.h
+++ b/components/browsing_data/core/browsing_data_policies_utils.h
+@@ -12,6 +12,17 @@
+ 
+ namespace browsing_data {
+ 
+namespace policy_data_types {
+extern const char kBrowsingHistoryName[];
+extern const char kDownloadHistoryName[];
+extern const char kCookiesAndOtherSiteDataName[];
+extern const char kCachedImagesAndFilesName[];
+extern const char kPasswordSigninName[];
+extern const char kAutofillName[];
+extern const char kSiteSettingsName[];
+extern const char kHostedAppDataName[];
+}  // namespace policy_data_types
+
+ // The data types of the BrowsingDataSettings policy.
+ enum class PolicyDataType {
+   kBrowsingHistory = 0,
+diff --git a/components/browsing_data/core/browsing_data_utils.cc b/components/browsing_data/core/browsing_data_utils.cc
+--- a/components/browsing_data/core/browsing_data_utils.cc
+++ b/components/browsing_data/core/browsing_data_utils.cc
+@@ -318,6 +318,40 @@ bool GetDeletionPreferenceFromDataType(
+     BrowsingDataType data_type,
+     ClearBrowsingDataTab clear_browsing_data_tab,
+     std::string* out_pref) {
+  if (clear_browsing_data_tab == ClearBrowsingDataTab::AT_START) {
+    switch (data_type) {
+      case BrowsingDataType::HISTORY:
+        *out_pref = prefs::kDeleteBrowsingHistoryAtStart;
+        return true;
+      case BrowsingDataType::CACHE:
+        *out_pref = prefs::kDeleteCacheAtStart;
+        return true;
+      case BrowsingDataType::COOKIES:
+        *out_pref = prefs::kDeleteCookiesAtStart;
+        return true;
+      case BrowsingDataType::PASSWORDS:
+        *out_pref = prefs::kDeletePasswordsAtStart;
+        return true;
+      case BrowsingDataType::FORM_DATA:
+        *out_pref = prefs::kDeleteFormDataAtStart;
+        return true;
+      case BrowsingDataType::BOOKMARKS:
+        return false;
+      case BrowsingDataType::SITE_SETTINGS:
+        *out_pref = prefs::kDeleteSiteSettingsAtStart;
+        return true;
+      case BrowsingDataType::DOWNLOADS:
+        *out_pref = prefs::kDeleteDownloadHistoryAtStart;
+        return true;
+      case BrowsingDataType::HOSTED_APPS_DATA:
+        *out_pref = prefs::kDeleteHostedAppsDataAtStart;
+        return true;
+      case BrowsingDataType::NUM_TYPES:
+        NOTREACHED();  // This is not an actual type.
+        return false;
+    }
+  }
+
+   if (clear_browsing_data_tab == ClearBrowsingDataTab::BASIC) {
+     switch (data_type) {
+       case BrowsingDataType::HISTORY:
+diff --git a/components/browsing_data/core/clear_browsing_data_tab.h b/components/browsing_data/core/clear_browsing_data_tab.h
+--- a/components/browsing_data/core/clear_browsing_data_tab.h
+++ b/components/browsing_data/core/clear_browsing_data_tab.h
+@@ -18,7 +18,7 @@ namespace browsing_data {
+ //
+ // A Java counterpart will be generated for this enum.
+ // GENERATED_JAVA_ENUM_PACKAGE: org.chromium.chrome.browser.browsing_data
+-enum class ClearBrowsingDataTab { BASIC, ADVANCED, NUM_TYPES };
+enum class ClearBrowsingDataTab { BASIC, ADVANCED, AT_START, NUM_TYPES };
+ 
+ }  // namespace browsing_data
+ 
+diff --git a/components/browsing_data/core/pref_names.cc b/components/browsing_data/core/pref_names.cc
+--- a/components/browsing_data/core/pref_names.cc
+++ b/components/browsing_data/core/pref_names.cc
+@@ -26,6 +26,16 @@ const char kClearBrowsingDataOnExitDeletionPending[] =
+ // delete just before browser shutdown.
+ const char kClearBrowsingDataOnExitList[] = "browser.clear_data.clear_on_exit";
+ 
+// Clear Browsing Data dialog datatype preferences.
+const char kDeleteBrowsingHistoryAtStart[] = "browser.clear_data.browsing_history_at_start";
+const char kDeleteDownloadHistoryAtStart[] = "browser.clear_data.download_history_at_start";
+const char kDeleteCacheAtStart[] = "browser.clear_data.cache_at_start";
+const char kDeleteCookiesAtStart[] = "browser.clear_data.cookies_at_start";
+const char kDeletePasswordsAtStart[] = "browser.clear_data.passwords_at_start";
+const char kDeleteFormDataAtStart[] = "browser.clear_data.form_data_at_start";
+const char kDeleteHostedAppsDataAtStart[] = "browser.clear_data.hosted_apps_data_at_start";
+const char kDeleteSiteSettingsAtStart[] = "browser.clear_data.site_settings_at_start";
+
+ // Clear browsing data deletion time period.
+ const char kDeleteTimePeriod[] = "browser.clear_data.time_period";
+ const char kDeleteTimePeriodBasic[] = "browser.clear_data.time_period_basic";
+@@ -85,6 +95,23 @@ void RegisterBrowserUserPrefs(user_prefs::PrefRegistrySyncable* registry) {
+   registry->RegisterIntegerPref(
+       kClearBrowsingDataHistoryNoticeShownTimes, 0);
+ 
+  registry->RegisterBooleanPref(
+      kDeleteBrowsingHistoryAtStart, false);
+  registry->RegisterBooleanPref(
+      kDeleteDownloadHistoryAtStart, false);
+  registry->RegisterBooleanPref(
+      kDeleteCacheAtStart, false);
+  registry->RegisterBooleanPref(
+      kDeleteCookiesAtStart, false);
+  registry->RegisterBooleanPref(
+      kDeletePasswordsAtStart, false);
+  registry->RegisterBooleanPref(
+      kDeleteFormDataAtStart, false);
+  registry->RegisterBooleanPref(
+      kDeleteHostedAppsDataAtStart, false);
+  registry->RegisterBooleanPref(
+      kDeleteSiteSettingsAtStart, false);
+
+ #if !BUILDFLAG(IS_IOS)
+   registry->RegisterBooleanPref(
+       kDeleteDownloadHistory, true,
+diff --git a/components/browsing_data/core/pref_names.h b/components/browsing_data/core/pref_names.h
+--- a/components/browsing_data/core/pref_names.h
+++ b/components/browsing_data/core/pref_names.h
+@@ -17,6 +17,15 @@ extern const char kBrowsingDataLifetime[];
+ extern const char kClearBrowsingDataOnExitDeletionPending[];
+ extern const char kClearBrowsingDataOnExitList[];
+ 
+extern const char kDeleteBrowsingHistoryAtStart[];
+extern const char kDeleteDownloadHistoryAtStart[];
+extern const char kDeleteCacheAtStart[];
+extern const char kDeleteCookiesAtStart[];
+extern const char kDeletePasswordsAtStart[];
+extern const char kDeleteFormDataAtStart[];
+extern const char kDeleteHostedAppsDataAtStart[];
+extern const char kDeleteSiteSettingsAtStart[];
+
+ extern const char kDeleteTimePeriod[];
+ extern const char kDeleteTimePeriodBasic[];
+ 
+diff --git a/content/browser/storage_partition_impl.cc b/content/browser/storage_partition_impl.cc
+--- a/content/browser/storage_partition_impl.cc
+++ b/content/browser/storage_partition_impl.cc
+@@ -1542,6 +1542,7 @@ void StoragePartitionImpl::Initialize(
+                             .AppendASCII("Code Cache");
+     }
+     DCHECK_GE(settings.size_in_bytes(), 0);
+    base::DeletePathRecursively(code_cache_path);
+     GetGeneratedCodeCacheContext()->Initialize(code_cache_path,
+                                                settings.size_in_bytes());
+   }
+--
+2.25.1
@@ -0,0 +1,616 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Wed, 12 Apr 2023 08:22:00 +0000
+Subject: Add setting to invert tap and long tap
+
+Reverses single tap to long tap in android for accessibility reasons.
+The feature can be activated from the accessibility settings.
+
+Need: bromite-build-utils.patch
+License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
+---
+ chrome/android/java/res/values/ids.xml        |  1 +
+ .../ChromeAccessibilitySettingsDelegate.java  | 18 ++++++++++
+ .../contextmenu/ChromeContextMenuItem.java    |  5 ++-
+ .../ChromeContextMenuPopulator.java           |  5 +++
+ .../tab/TabContextMenuItemDelegate.java       |  8 +++++
+ chrome/browser/about_flags.cc                 |  5 +++
+ .../contextmenu/ContextMenuItemDelegate.java  |  2 ++
+ chrome/browser/flag_descriptions.cc           |  4 +++
+ chrome/browser/flag_descriptions.h            |  3 ++
+ .../flags/android/chrome_feature_list.cc      |  1 +
+ .../browser/flags/ChromeFeatureList.java      |  5 +++
+ .../strings/android_chrome_strings.grd        |  9 +++++
+ .../res/xml/accessibility_preferences.xml     |  5 +++
+ .../accessibility/AccessibilitySettings.java  | 11 ++++++
+ .../AccessibilitySettingsDelegate.java        |  2 ++
+ third_party/blink/common/features.cc          |  4 +++
+ third_party/blink/public/common/features.h    |  2 ++
+ .../renderer/core/html/html_anchor_element.cc | 35 +++++++++++++++----
+ .../renderer/core/html/html_anchor_element.h  |  9 +++--
+ .../renderer/core/html/html_image_element.cc  | 17 +++++++++
+ .../renderer/core/html/html_image_element.h   |  2 ++
+ .../core/page/context_menu_controller.cc      | 32 ++++++++++++-----
+ .../core/page/context_menu_controller.h       |  5 +--
+ 23 files changed, 170 insertions(+), 20 deletions(-)
+
+diff --git a/chrome/android/java/res/values/ids.xml b/chrome/android/java/res/values/ids.xml
+--- a/chrome/android/java/res/values/ids.xml
+++ b/chrome/android/java/res/values/ids.xml
+@@ -91,6 +91,7 @@ found in the LICENSE file.
+ 
+     <!-- Menu item IDs for FullscreenActivities -->
+     <item type="id" name="contextmenu_open_in_chrome" />
+    <item type="id" name="contextmenu_open_in_tab" />
+ 
+     <!-- Tags -->
+     <item type="id" name="highlight_color" />
+diff --git a/chrome/android/java/src/org/chromium/chrome/browser/accessibility/settings/ChromeAccessibilitySettingsDelegate.java b/chrome/android/java/src/org/chromium/chrome/browser/accessibility/settings/ChromeAccessibilitySettingsDelegate.java
+--- a/chrome/android/java/src/org/chromium/chrome/browser/accessibility/settings/ChromeAccessibilitySettingsDelegate.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/accessibility/settings/ChromeAccessibilitySettingsDelegate.java
+@@ -163,6 +163,24 @@ public class ChromeAccessibilitySettingsDelegate implements AccessibilitySetting
+             mSnackbarManager.showSnackbar(mSnackbar);
+     }
+ 
+    private static class ShowAlwaysContextMenuOnLinksDelegate implements BooleanPreferenceDelegate {
+        @Override
+        public boolean isEnabled() {
+            return ChromeFeatureList.sShowAlwaysContextMenuOnLinks.isEnabled();
+        }
+
+        @Override
+        public void setEnabled(boolean value) {
+            CromiteNativeUtils.setFlagEnabled(ChromeFeatureList.SHOW_ALWAYS_CONTEXT_MENU_ON_LINKS,
+                    "show-always-context-menu-on-links", value);
+        }
+    }
+
+    @Override
+    public BooleanPreferenceDelegate getShowAlwaysContextMenuOnLinksDelegate() {
+        return new ShowAlwaysContextMenuOnLinksDelegate();
+    }
+
+     @Override
+     public void addExtraPreferences(PreferenceFragmentCompat fragment) {
+         if (ImageDescriptionsController.getInstance().shouldShowImageDescriptionsMenuItem()) {
+diff --git a/chrome/android/java/src/org/chromium/chrome/browser/contextmenu/ChromeContextMenuItem.java b/chrome/android/java/src/org/chromium/chrome/browser/contextmenu/ChromeContextMenuItem.java
+--- a/chrome/android/java/src/org/chromium/chrome/browser/contextmenu/ChromeContextMenuItem.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/contextmenu/ChromeContextMenuItem.java
+@@ -88,8 +88,9 @@ class ChromeContextMenuItem {
+         int SHARE_HIGHLIGHT = 32;
+         int REMOVE_HIGHLIGHT = 33;
+         int LEARN_MORE = 34;
+        int FOLLOW_LINK = 35;
+         // ALWAYS UPDATE!
+-        int NUM_ENTRIES = 35;
+        int NUM_ENTRIES = 36;
+     }
+ 
+     /**
+@@ -131,6 +132,7 @@ class ChromeContextMenuItem {
+             R.id.contextmenu_share_highlight, // Item.SHARE_HIGHLIGHT
+             R.id.contextmenu_remove_highlight, // Item.REMOVE_HIGHLIGHT
+             R.id.contextmenu_learn_more, // Item.LEARN_MORE
+            R.id.contextmenu_open_in_tab, // Item.OPEN_IN_NEW_CHROME_TAB
+     };
+ 
+     /**
+@@ -172,6 +174,7 @@ class ChromeContextMenuItem {
+             R.string.contextmenu_share_highlight, // Item.SHARE_HIGHLIGHT
+             R.string.contextmenu_remove_highlight, // Item.REMOVE_HIGHLIGHT
+             R.string.contextmenu_learn_more, // Item.LEARN_MORE
+            R.string.contextmenu_open_in_tab, // Item.OPEN_IN_NEW_CHROME_TAB:
+     };
+ 
+     /**
+diff --git a/chrome/android/java/src/org/chromium/chrome/browser/contextmenu/ChromeContextMenuPopulator.java b/chrome/android/java/src/org/chromium/chrome/browser/contextmenu/ChromeContextMenuPopulator.java
+--- a/chrome/android/java/src/org/chromium/chrome/browser/contextmenu/ChromeContextMenuPopulator.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/contextmenu/ChromeContextMenuPopulator.java
+@@ -239,6 +239,9 @@ public class ChromeContextMenuPopulator implements ContextMenuPopulator {
+ 
+         if (mParams.isAnchor()) {
+             ModelList linkGroup = new ModelList();
+            if (ChromeFeatureList.sShowAlwaysContextMenuOnLinks.isEnabled()) {
+                linkGroup.add(createListItem(Item.FOLLOW_LINK));
+            }
+             if (FirstRunStatus.getFirstRunFlowComplete() && !isEmptyUrl(mParams.getUrl())
+                     && UrlUtilities.isAcceptedScheme(mParams.getUrl())) {
+                 if (mMode == ContextMenuMode.NORMAL) {
+@@ -588,6 +591,8 @@ public class ChromeContextMenuPopulator implements ContextMenuPopulator {
+                 ShareHelper.shareDirectly(
+                         params, ShareHelper.getLastShareComponentName(), getProfile(), false);
+             });
+        } else if (itemId == R.id.contextmenu_open_in_tab) {
+            mItemDelegate.onOpenUrl(mParams.getUrl(), mParams.getReferrer());
+         } else if (itemId == R.id.contextmenu_open_in_chrome) {
+             recordContextMenuSelection(ContextMenuUma.Action.OPEN_IN_CHROME);
+             mItemDelegate.onOpenInChrome(mParams.getUrl(), mParams.getPageUrl());
+diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tab/TabContextMenuItemDelegate.java b/chrome/android/java/src/org/chromium/chrome/browser/tab/TabContextMenuItemDelegate.java
+--- a/chrome/android/java/src/org/chromium/chrome/browser/tab/TabContextMenuItemDelegate.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/tab/TabContextMenuItemDelegate.java
+@@ -247,6 +247,14 @@ public class TabContextMenuItemDelegate implements ContextMenuItemDelegate {
+         mTab.loadUrl(loadUrlParams);
+     }
+ 
+    @Override
+    public void onOpenUrl(GURL url, Referrer referrer) {
+        LoadUrlParams loadUrlParams = new LoadUrlParams(url.getSpec());
+        loadUrlParams.setTransitionType(PageTransition.LINK);
+        loadUrlParams.setReferrer(referrer);
+        mTab.loadUrl(loadUrlParams);
+    }
+
+     @Override
+     public void onOpenImageInNewTab(GURL url, Referrer referrer) {
+         LoadUrlParams loadUrlParams = new LoadUrlParams(url.getSpec());
+diff --git a/chrome/browser/about_flags.cc b/chrome/browser/about_flags.cc
+--- a/chrome/browser/about_flags.cc
+++ b/chrome/browser/about_flags.cc
+@@ -8404,6 +8404,11 @@ const FeatureEntry kFeatureEntries[] = {
+      FEATURE_VALUE_TYPE(features::kElasticOverscroll)},
+ #endif
+ 
+    {"show-always-context-menu-on-links",
+     flag_descriptions::kShowAlwaysContextMenuOnLinksName,
+     flag_descriptions::kShowAlwaysContextMenuOnLinksDescription, kOsAndroid,
+     FEATURE_VALUE_TYPE(blink::features::kShowAlwaysContextMenuOnLinks)},
+
+     {"device-posture", flag_descriptions::kDevicePostureName,
+      flag_descriptions::kDevicePostureDescription, kOsAll,
+      FEATURE_VALUE_TYPE(features::kDevicePosture)},
+diff --git a/chrome/browser/contextmenu/java/src/org/chromium/chrome/browser/contextmenu/ContextMenuItemDelegate.java b/chrome/browser/contextmenu/java/src/org/chromium/chrome/browser/contextmenu/ContextMenuItemDelegate.java
+--- a/chrome/browser/contextmenu/java/src/org/chromium/chrome/browser/contextmenu/ContextMenuItemDelegate.java
+++ b/chrome/browser/contextmenu/java/src/org/chromium/chrome/browser/contextmenu/ContextMenuItemDelegate.java
+@@ -111,6 +111,8 @@ public interface ContextMenuItemDelegate {
+      */
+     void onOpenImageUrl(GURL url, Referrer referrer);
+ 
+    void onOpenUrl(GURL url, Referrer referrer);
+
+     /**
+      * Called when the {@code url} is of an image and should be opened in a new tab.
+      * @param url The image URL to open.
+diff --git a/chrome/browser/flag_descriptions.cc b/chrome/browser/flag_descriptions.cc
+--- a/chrome/browser/flag_descriptions.cc
+++ b/chrome/browser/flag_descriptions.cc
+@@ -2056,6 +2056,10 @@ const char kMoveTopToolbarToBottomName[] = "Move top toolbar to bottom";
+ const char kMoveTopToolbarToBottomDescription[] =
+     "Move the top toolbar to the bottom.";
+ 
+const char kShowAlwaysContextMenuOnLinksName[] = "Always show contextmenu on links";
+const char kShowAlwaysContextMenuOnLinksDescription[] =
+    "Use accessibility settings to set it.";
+
+ const char kIncognitoDownloadsWarningName[] =
+     "Enable Incognito downloads warning";
+ const char kIncognitoDownloadsWarningDescription[] =
+diff --git a/chrome/browser/flag_descriptions.h b/chrome/browser/flag_descriptions.h
+--- a/chrome/browser/flag_descriptions.h
+++ b/chrome/browser/flag_descriptions.h
+@@ -1165,6 +1165,9 @@ extern const char kImprovedKeyboardShortcutsDescription[];
+ extern const char kMoveTopToolbarToBottomName[];
+ extern const char kMoveTopToolbarToBottomDescription[];
+ 
+extern const char kShowAlwaysContextMenuOnLinksName[];
+extern const char kShowAlwaysContextMenuOnLinksDescription[];
+
+ extern const char kIncognitoReauthenticationForAndroidName[];
+ extern const char kIncognitoReauthenticationForAndroidDescription[];
+ 
+diff --git a/chrome/browser/flags/android/chrome_feature_list.cc b/chrome/browser/flags/android/chrome_feature_list.cc
+--- a/chrome/browser/flags/android/chrome_feature_list.cc
+++ b/chrome/browser/flags/android/chrome_feature_list.cc
+@@ -331,6 +331,7 @@ const base::Feature* const kFeaturesExposedToJava[] = {
+     &kTabDragDropAndroid,
+     &kTabAndLinkDragDropAndroid,
+     &kTabEngagementReportingAndroid,
+    &blink::features::kShowAlwaysContextMenuOnLinks,
+     &kTabStripRedesign,
+     &kTabletToolbarReordering,
+     &kTabStripStartupRefactoring,
+diff --git a/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureList.java b/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureList.java
+--- a/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureList.java
+++ b/chrome/browser/flags/android/java/src/org/chromium/chrome/browser/flags/ChromeFeatureList.java
+@@ -330,6 +330,8 @@ public abstract class ChromeFeatureList {
+     public static final String NEW_TAB_SEARCH_ENGINE_URL_ANDROID = "NewTabSearchEngineUrlAndroid";
+     public static final String MOVE_TOP_TOOLBAR_TO_BOTTOM =
+             "MoveTopToolbarToBottom";
+    public static final String SHOW_ALWAYS_CONTEXT_MENU_ON_LINKS =
+            "ShowAlwaysContextMenuOnLinks";
+     public static final String NOTIFICATION_PERMISSION_VARIANT = "NotificationPermissionVariant";
+     public static final String NOTIFICATION_PERMISSION_BOTTOM_SHEET =
+             "NotificationPermissionBottomSheet";
+@@ -600,6 +602,8 @@ public abstract class ChromeFeatureList {
+             new CachedFlag(OMNIBOX_MATCH_TOOLBAR_AND_STATUS_BAR_COLOR, false);
+     public static final CachedFlag sMoveTopToolbarToBottom =
+             new CachedFlag(MOVE_TOP_TOOLBAR_TO_BOTTOM, false);
+    public static final CachedFlag sShowAlwaysContextMenuOnLinks =
+            new CachedFlag(SHOW_ALWAYS_CONTEXT_MENU_ON_LINKS, false);
+     public static final CachedFlag sOmniboxModernizeVisualUpdate =
+             new CachedFlag(OMNIBOX_MODERNIZE_VISUAL_UPDATE, true);
+     public static final CachedFlag sOptimizationGuidePushNotifications =
+@@ -723,6 +727,7 @@ public abstract class ChromeFeatureList {
+         sTabStripRedesign,
+         sTabStripStartupRefactoring,
+         sTabletToolbarReordering,
+        sShowAlwaysContextMenuOnLinks,
+         sTabToGTSAnimation,
+         sToolbarUseHardwareBitmapDraw,
+         sUseChimeAndroidSdk,
+diff --git a/chrome/browser/ui/android/strings/android_chrome_strings.grd b/chrome/browser/ui/android/strings/android_chrome_strings.grd
+--- a/chrome/browser/ui/android/strings/android_chrome_strings.grd
+++ b/chrome/browser/ui/android/strings/android_chrome_strings.grd
+@@ -1839,6 +1839,12 @@ Your Google account may have other forms of browsing history like searches and a
+       <message name="IDS_MOVE_TOOLBAR_BOTTOM_SUMMARY" desc="Summary of the preference that allows the user to move toolbar on bottom.">
+         Move toolbar to bottom
+       </message>
+      <message name="IDS_ALWAYS_SHOW_CONTEXTMENU_ON_LINKS_TITLE" desc="Title of the preference that open the context menu in links.">
+        Always open the context menu in the links
+      </message>
+      <message name="IDS_ALWAYS_SHOW_CONTEXTMENU_ON_LINKS_SUMMARY" desc="Summary of the preference that open the context menu in links.">
+        Allows the context menu to be opened with a tap and follow the link with long press
+      </message>
+ 
+       <!-- Safety check -->
+       <message name="IDS_PREFS_SAFETY_CHECK" desc="Title of the Safety check element in settings, allowing the user to check multiple areas of browser safety. [CHAR_LIMIT=32]">
+@@ -2891,6 +2897,9 @@ To change this setting, <ph name="BEGIN_LINK">&lt;resetlink&gt;</ph>reset sync<p
+       <message name="IDS_CONTEXTMENU_OPEN_IN_NEW_CHROME_TAB" desc="Context sensitive menu item to open the selected link in a new Chrome tab from Chrome Custom Tab. [CHAR_LIMIT=30]">
+         Open in new Chrome tab
+       </message>
+      <message name="IDS_CONTEXTMENU_OPEN_IN_TAB" desc="Context sensitive menu item to open the selected link in tab. [CHAR_LIMIT=30]">
+        Open in current tab
+      </message>
+       <message name="IDS_CONTEXTMENU_OPEN_IN_CHROME_INCOGNITO_TAB" desc="Context sensitive menu item to open the selected link in a Chrome Incognito tab from Chrome Custom Tab. [CHAR_LIMIT=30]">
+         Open in Incognito tab
+       </message>
+diff --git a/components/browser_ui/accessibility/android/java/res/xml/accessibility_preferences.xml b/components/browser_ui/accessibility/android/java/res/xml/accessibility_preferences.xml
+--- a/components/browser_ui/accessibility/android/java/res/xml/accessibility_preferences.xml
+++ b/components/browser_ui/accessibility/android/java/res/xml/accessibility_preferences.xml
+@@ -30,6 +30,11 @@ found in the LICENSE file.
+         android:summary="@string/page_zoom_always_show_preference_summary"
+         android:title="@string/page_zoom_always_show_preference_title" />
+ 
+    <org.chromium.components.browser_ui.settings.ChromeSwitchPreference
+        android:key="always_show_contextmenu_on_links"
+        android:summary="@string/always_show_contextmenu_on_links_summary"
+        android:title="@string/always_show_contextmenu_on_links_title" />
+
+     <org.chromium.components.browser_ui.settings.ChromeSwitchPreference
+         android:key="force_enable_zoom"
+         android:summary="@string/force_enable_zoom_summary"
+diff --git a/components/browser_ui/accessibility/android/java/src/org/chromium/components/browser_ui/accessibility/AccessibilitySettings.java b/components/browser_ui/accessibility/android/java/src/org/chromium/components/browser_ui/accessibility/AccessibilitySettings.java
+--- a/components/browser_ui/accessibility/android/java/src/org/chromium/components/browser_ui/accessibility/AccessibilitySettings.java
+++ b/components/browser_ui/accessibility/android/java/src/org/chromium/components/browser_ui/accessibility/AccessibilitySettings.java
+@@ -39,6 +39,7 @@ public class AccessibilitySettings extends PreferenceFragmentCompat
+     private BooleanPreferenceDelegate mForceTabletUIDelegate;
+     static final String PREF_FORCE_TABLET_UI = "force_tablet_ui";
+     static final String PREF_MOVE_TOOLBAR_TO_BOTTOM = "move_toolbar_bottom";
+    static final String PREF_ALWAYS_SHOW_CONTEXTMENU_ON_LINKS = "always_show_contextmenu_on_links";
+     private TextScalePreference mTextScalePref;
+     private PageZoomPreference mPageZoomDefaultZoomPref;
+     private ChromeSwitchPreference mPageZoomAlwaysShowPref;
+@@ -48,6 +49,7 @@ public class AccessibilitySettings extends PreferenceFragmentCompat
+     private BooleanPreferenceDelegate mReaderForAccessibilityDelegate;
+     private double mPageZoomLatestDefaultZoomPrefValue;
+     private BooleanPreferenceDelegate mMoveTopToolbarToBottomDelegate;
+    private BooleanPreferenceDelegate mShowAlwaysContextMenuOnLinksDelegate;
+ 
+     private FontSizePrefs mFontSizePrefs;
+     private FontSizePrefsObserver mFontSizePrefsObserver = new FontSizePrefsObserver() {
+@@ -140,6 +142,12 @@ public class AccessibilitySettings extends PreferenceFragmentCompat
+         mMoveToolbarToBottomPref.setChecked(mMoveTopToolbarToBottomDelegate.isEnabled());
+         mMoveToolbarToBottomPref.setOnPreferenceChangeListener(this);
+ 
+        ChromeSwitchPreference mShowAlwaysContextMenuOnLinksPref =
+                (ChromeSwitchPreference) findPreference(PREF_ALWAYS_SHOW_CONTEXTMENU_ON_LINKS);
+        mShowAlwaysContextMenuOnLinksDelegate = mDelegate.getShowAlwaysContextMenuOnLinksDelegate();
+        mShowAlwaysContextMenuOnLinksPref.setChecked(mShowAlwaysContextMenuOnLinksDelegate.isEnabled());
+        mShowAlwaysContextMenuOnLinksPref.setOnPreferenceChangeListener(this);
+
+         Preference captions = findPreference(PREF_CAPTIONS);
+         captions.setOnPreferenceClickListener(preference -> {
+             Intent intent = new Intent(Settings.ACTION_CAPTIONING_SETTINGS);
+@@ -213,6 +221,9 @@ public class AccessibilitySettings extends PreferenceFragmentCompat
+         } else if (PREF_MOVE_TOOLBAR_TO_BOTTOM.equals(preference.getKey())) {
+             mMoveTopToolbarToBottomDelegate.setEnabled((Boolean) newValue);
+             mDelegate.requestRestart(getActivity());
+        } else if (PREF_ALWAYS_SHOW_CONTEXTMENU_ON_LINKS.equals(preference.getKey())) {
+            mShowAlwaysContextMenuOnLinksDelegate.setEnabled((Boolean) newValue);
+            mDelegate.requestRestart(getActivity());
+         }
+ 
+         return true;
+diff --git a/components/browser_ui/accessibility/android/java/src/org/chromium/components/browser_ui/accessibility/AccessibilitySettingsDelegate.java b/components/browser_ui/accessibility/android/java/src/org/chromium/components/browser_ui/accessibility/AccessibilitySettingsDelegate.java
+--- a/components/browser_ui/accessibility/android/java/src/org/chromium/components/browser_ui/accessibility/AccessibilitySettingsDelegate.java
+++ b/components/browser_ui/accessibility/android/java/src/org/chromium/components/browser_ui/accessibility/AccessibilitySettingsDelegate.java
+@@ -49,6 +49,8 @@ public interface AccessibilitySettingsDelegate {
+ 
+     BooleanPreferenceDelegate getMoveTopToolbarToBottomDelegate();
+ 
+    BooleanPreferenceDelegate getShowAlwaysContextMenuOnLinksDelegate();
+
+     /**
+      * @return The BrowserContextHandle that should be used to read and update settings.
+      */
+diff --git a/third_party/blink/common/features.cc b/third_party/blink/common/features.cc
+--- a/third_party/blink/common/features.cc
+++ b/third_party/blink/common/features.cc
+@@ -241,6 +241,10 @@ BASE_FEATURE(kBackgroundResourceFetch,
+              "BackgroundResourceFetch",
+              base::FEATURE_DISABLED_BY_DEFAULT);
+ 
+BASE_FEATURE(kShowAlwaysContextMenuOnLinks,
+             "ShowAlwaysContextMenuOnLinks",
+             base::FEATURE_DISABLED_BY_DEFAULT);
+
+ // Used to configure a per-origin allowlist of performance.mark events that are
+ // permitted to be included in slow reports traces. See crbug.com/1181774.
+ BASE_FEATURE(kBackgroundTracingPerformanceMark,
+diff --git a/third_party/blink/public/common/features.h b/third_party/blink/public/common/features.h
+--- a/third_party/blink/public/common/features.h
+++ b/third_party/blink/public/common/features.h
+@@ -143,6 +143,8 @@ BLINK_COMMON_EXPORT BASE_DECLARE_FEATURE(kBackForwardCacheWithKeepaliveRequest);
+ 
+ BLINK_COMMON_EXPORT BASE_DECLARE_FEATURE(kBackgroundResourceFetch);
+ 
+BLINK_COMMON_EXPORT BASE_DECLARE_FEATURE(kShowAlwaysContextMenuOnLinks);
+
+ // Used to configure a per-origin allowlist of performance.mark events that are
+ // permitted to be included in slow reports traces. See crbug.com/1181774.
+ BLINK_COMMON_EXPORT BASE_DECLARE_FEATURE(kBackgroundTracingPerformanceMark);
+diff --git a/third_party/blink/renderer/core/html/html_anchor_element.cc b/third_party/blink/renderer/core/html/html_anchor_element.cc
+--- a/third_party/blink/renderer/core/html/html_anchor_element.cc
+++ b/third_party/blink/renderer/core/html/html_anchor_element.cc
+@@ -59,6 +59,7 @@
+ #include "third_party/blink/renderer/core/loader/ping_loader.h"
+ #include "third_party/blink/renderer/core/navigation_api/navigation_api.h"
+ #include "third_party/blink/renderer/core/page/chrome_client.h"
+#include "third_party/blink/renderer/core/page/context_menu_controller.h"
+ #include "third_party/blink/renderer/core/page/page.h"
+ #include "third_party/blink/renderer/core/speculation_rules/document_speculation_rules.h"
+ #include "third_party/blink/renderer/platform/heap/garbage_collected.h"
+@@ -456,6 +457,17 @@ void HTMLAnchorElement::NavigateToHyperlink(ResourceRequest request,
+                                             bool is_trusted,
+                                             base::TimeTicks platform_time_stamp,
+                                             KURL completed_url) {
+  UIEvent& event = *UIEvent::Create();
+  NavigateToHyperlink2(std::move(request), navigation_policy, is_trusted, platform_time_stamp,
+    std::move(completed_url), event, true);
+}
+
+void HTMLAnchorElement::NavigateToHyperlink2(ResourceRequest request,
+                                            NavigationPolicy navigation_policy,
+                                            bool is_trusted,
+                                            base::TimeTicks platform_time_stamp,
+                                            KURL completed_url,
+                                            Event& event, bool do_not_show_context_menu) {
+   LocalDOMWindow* window = GetDocument().domWindow();
+   if (!window) {
+     return;
+@@ -510,6 +522,15 @@ void HTMLAnchorElement::NavigateToHyperlink(ResourceRequest request,
+             /*element=*/this, request.HasUserGesture()));
+   }
+ 
+  if (!do_not_show_context_menu &&
+      base::FeatureList::IsEnabled(features::kShowAlwaysContextMenuOnLinks)) {
+    if (Page* page = GetDocument().GetPage()) {
+      page->GetContextMenuController().HandleContextMenuEvent(
+          To<MouseEvent>(&event), /*do_not_show_context_menu*/true);
+      return;
+    }
+  }
+
+   Frame* target_frame =
+       frame->Tree().FindOrCreateFrameForNavigation(frame_request, target).frame;
+ 
+@@ -553,7 +574,7 @@ void HTMLAnchorElement::SetHovered(bool hovered) {
+   }
+ }
+ 
+-void HTMLAnchorElement::HandleClick(Event& event) {
+void HTMLAnchorElement::HandleClick(Event& event, bool do_not_show_context_menu) {
+   event.SetDefaultHandled();
+ 
+   LocalDOMWindow* window = GetDocument().domWindow();
+@@ -652,12 +673,12 @@ void HTMLAnchorElement::HandleClick(Event& event) {
+   }
+ 
+   NavigationPolicy navigation_policy = NavigationPolicyFromEvent(&event);
+-  base::OnceClosure navigate_closure = WTF::BindOnce(
+-      &HTMLAnchorElement::NavigateToHyperlink, WrapWeakPersistent(this),
+-      std::move(request), navigation_policy, event.isTrusted(),
+-      event.PlatformTimeStamp(), std::move(completed_url));
+ 
+   if (navigation_policy == kNavigationPolicyDownload) {
+    base::OnceClosure navigate_closure = WTF::BindOnce(
+        &HTMLAnchorElement::NavigateToHyperlink, WrapWeakPersistent(this),
+        std::move(request), navigation_policy, event.isTrusted(),
+        event.PlatformTimeStamp(), std::move(completed_url));
+     // If Alt is held down it will force a download, however, wait to see if
+     // this is an alt-double-click which should instead select the text of the
+     // link.
+@@ -669,7 +690,9 @@ void HTMLAnchorElement::HandleClick(Event& event) {
+     frame->GetEventHandler().SetDownloadModifierTaskHandle(
+         std::move(task_handle));
+   } else {
+-    std::move(navigate_closure).Run();
+    HTMLAnchorElement::NavigateToHyperlink2(std::move(request), navigation_policy,
+      event.isTrusted(), event.PlatformTimeStamp(), std::move(completed_url),
+      event, do_not_show_context_menu);
+   }
+ }
+ 
+diff --git a/third_party/blink/renderer/core/html/html_anchor_element.h b/third_party/blink/renderer/core/html/html_anchor_element.h
+--- a/third_party/blink/renderer/core/html/html_anchor_element.h
+++ b/third_party/blink/renderer/core/html/html_anchor_element.h
+@@ -106,6 +106,7 @@ class CORE_EXPORT HTMLAnchorElement : public HTMLElement, public DOMURLUtils {
+   void SetHovered(bool hovered) override;
+ 
+   void Trace(Visitor*) const override;
+  void HandleClick(Event&, bool do_not_show_context_menu = false);
+ 
+  protected:
+   void ParseAttribute(const AttributeModificationParams&) override;
+@@ -127,12 +128,16 @@ class CORE_EXPORT HTMLAnchorElement : public HTMLElement, public DOMURLUtils {
+   bool IsInteractiveContent() const final;
+   InsertionNotificationRequest InsertedInto(ContainerNode&) override;
+   void RemovedFrom(ContainerNode&) override;
+  void NavigateToHyperlink2(ResourceRequest,
+                           NavigationPolicy,
+                           bool is_trusted,
+                           base::TimeTicks platform_time_stamp,
+                           KURL, Event&, bool do_not_show_context_menu);
+   void NavigateToHyperlink(ResourceRequest,
+                            NavigationPolicy,
+                            bool is_trusted,
+                            base::TimeTicks platform_time_stamp,
+-                           KURL);
+-  void HandleClick(Event&);
+                           KURL completed_url);
+ 
+   unsigned link_relations_ : 31;
+   mutable LinkHash cached_visited_link_hash_;
+diff --git a/third_party/blink/renderer/core/html/html_image_element.cc b/third_party/blink/renderer/core/html/html_image_element.cc
+--- a/third_party/blink/renderer/core/html/html_image_element.cc
+++ b/third_party/blink/renderer/core/html/html_image_element.cc
+@@ -36,6 +36,7 @@
+ #include "third_party/blink/renderer/core/dom/events/event_dispatch_forbidden_scope.h"
+ #include "third_party/blink/renderer/core/dom/node_traversal.h"
+ #include "third_party/blink/renderer/core/dom/shadow_root.h"
+#include "third_party/blink/renderer/core/events/mouse_event.h"
+ #include "third_party/blink/renderer/core/frame/attribution_src_loader.h"
+ #include "third_party/blink/renderer/core/frame/deprecation/deprecation.h"
+ #include "third_party/blink/renderer/core/frame/local_dom_window.h"
+@@ -63,6 +64,7 @@
+ #include "third_party/blink/renderer/core/media_type_names.h"
+ #include "third_party/blink/renderer/core/page/chrome_client.h"
+ #include "third_party/blink/renderer/core/page/page.h"
+#include "third_party/blink/renderer/core/page/context_menu_controller.h"
+ #include "third_party/blink/renderer/core/paint/timing/paint_timing.h"
+ #include "third_party/blink/renderer/core/probe/core_probes.h"
+ #include "third_party/blink/renderer/core/style/content_data.h"
+@@ -753,6 +755,21 @@ void HTMLImageElement::DidFinishLifecycleUpdate(
+   }
+ }
+ 
+void HTMLImageElement::DefaultEventHandler(Event& event) {
+  if (base::FeatureList::IsEnabled(features::kShowAlwaysContextMenuOnLinks)) {
+    auto* mouse_event = DynamicTo<MouseEvent>(&event);
+    if (mouse_event && mouse_event->type() == event_type_names::kClick) {
+      if (Page* page = GetDocument().GetPage()) {
+        page->GetContextMenuController().HandleContextMenuEvent(
+            mouse_event, /*do_not_show_context_menu*/true);
+        return;
+      }
+    }
+  }
+
+  HTMLElement::DefaultEventHandler(event);
+}
+
+ bool HTMLImageElement::draggable() const {
+   // Image elements are draggable by default.
+   return !EqualIgnoringASCIICase(FastGetAttribute(html_names::kDraggableAttr),
+diff --git a/third_party/blink/renderer/core/html/html_image_element.h b/third_party/blink/renderer/core/html/html_image_element.h
+--- a/third_party/blink/renderer/core/html/html_image_element.h
+++ b/third_party/blink/renderer/core/html/html_image_element.h
+@@ -220,6 +220,8 @@ class CORE_EXPORT HTMLImageElement final
+   void DidAddUserAgentShadowRoot(ShadowRoot&) override;
+   void AdjustStyle(ComputedStyleBuilder&) override;
+ 
+  void DefaultEventHandler(Event&) override;
+
+  private:
+   bool AreAuthorShadowsAllowed() const override { return false; }
+ 
+diff --git a/third_party/blink/renderer/core/page/context_menu_controller.cc b/third_party/blink/renderer/core/page/context_menu_controller.cc
+--- a/third_party/blink/renderer/core/page/context_menu_controller.cc
+++ b/third_party/blink/renderer/core/page/context_menu_controller.cc
+@@ -236,14 +236,16 @@ void ContextMenuController::DocumentDetached(Document* document) {
+   }
+ }
+ 
+-void ContextMenuController::HandleContextMenuEvent(MouseEvent* mouse_event) {
+-  DCHECK(mouse_event->type() == event_type_names::kContextmenu);
+void ContextMenuController::HandleContextMenuEvent(MouseEvent* mouse_event, bool do_not_show_context_menu) {
+  if (!base::FeatureList::IsEnabled(features::kShowAlwaysContextMenuOnLinks)) {
+    DCHECK(mouse_event->type() == event_type_names::kContextmenu);
+  }
+   LocalFrame* frame = mouse_event->target()->ToNode()->GetDocument().GetFrame();
+   PhysicalOffset location =
+       PhysicalOffset::FromPointFRound(mouse_event->AbsoluteLocation());
+ 
+   if (ShowContextMenu(frame, location, mouse_event->GetMenuSourceType(),
+-                      mouse_event))
+                      mouse_event, do_not_show_context_menu))
+     mouse_event->SetDefaultHandled();
+ }
+ 
+@@ -461,7 +463,8 @@ bool ContextMenuController::ShouldShowContextMenuFromTouch(
+ bool ContextMenuController::ShowContextMenu(LocalFrame* frame,
+                                             const PhysicalOffset& point,
+                                             WebMenuSourceType source_type,
+-                                            const MouseEvent* mouse_event) {
+                                            const MouseEvent* mouse_event,
+                                            bool do_not_show_context_menu) {
+   // Displaying the context menu in this function is a big hack as we don't
+   // have context, i.e. whether this is being invoked via a script or in
+   // response to user input (Mouse event WM_RBUTTONDOWN,
+@@ -484,6 +487,15 @@ bool ContextMenuController::ShowContextMenu(LocalFrame* frame,
+   if (!result.InnerNodeOrImageMapImage())
+     return false;
+ 
+  if (!do_not_show_context_menu &&
+        base::FeatureList::IsEnabled(features::kShowAlwaysContextMenuOnLinks)) {
+    if (auto* anchor_element = DynamicTo<HTMLAnchorElement>(result.URLElement())) {
+      Event event;
+      anchor_element->HandleClick(event, /*do_not_show_context_menu*/true);
+      return true;
+    }
+  }
+
+   // Clear any previously set cached results if we are resetting the hit test
+   // result.
+   image_selection_cached_result_ = nullptr;
+@@ -837,11 +849,13 @@ bool ContextMenuController::ShowContextMenu(LocalFrame* frame,
+   data.form_renderer_id = GetFormRendererId(result);
+   data.field_renderer_id = GetFieldRendererId(result);
+ 
+-  const bool from_touch = source_type == kMenuSourceTouch ||
+-                          source_type == kMenuSourceLongPress ||
+-                          source_type == kMenuSourceLongTap;
+-  if (from_touch && !ShouldShowContextMenuFromTouch(data))
+-    return false;
+  if (!base::FeatureList::IsEnabled(features::kShowAlwaysContextMenuOnLinks)) {
+    const bool from_touch = source_type == kMenuSourceTouch ||
+                            source_type == kMenuSourceLongPress ||
+                            source_type == kMenuSourceLongTap;
+    if (from_touch && !ShouldShowContextMenuFromTouch(data))
+      return false;
+  }
+ 
+   WebLocalFrameImpl* selected_web_frame =
+       WebLocalFrameImpl::FromFrame(selected_frame);
+diff --git a/third_party/blink/renderer/core/page/context_menu_controller.h b/third_party/blink/renderer/core/page/context_menu_controller.h
+--- a/third_party/blink/renderer/core/page/context_menu_controller.h
+++ b/third_party/blink/renderer/core/page/context_menu_controller.h
+@@ -57,7 +57,7 @@ class CORE_EXPORT ContextMenuController final
+ 
+   void DocumentDetached(Document*);
+ 
+-  void HandleContextMenuEvent(MouseEvent*);
+  void HandleContextMenuEvent(MouseEvent*, bool do_not_show_context_menu = false);
+   void ShowContextMenuAtPoint(LocalFrame*,
+                               float x,
+                               float y,
+@@ -123,7 +123,8 @@ class CORE_EXPORT ContextMenuController final
+   bool ShowContextMenu(LocalFrame*,
+                        const PhysicalOffset&,
+                        WebMenuSourceType,
+-                       const MouseEvent* mouse_event = nullptr);
+                       const MouseEvent* mouse_event = nullptr,
+                       bool do_not_show_context_menu = false);
+ 
+   bool ShouldShowContextMenuFromTouch(const ContextMenuData&);
+ 
+--
+2.25.1
@@ -0,0 +1,30 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Mon, 7 Aug 2023 11:02:18 +0000
+Subject: Allow DocumentPiP if PopupsAndRedirects are active
+
+Allow documentPiP api use only with content setting popup allowed
+
+License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
+---
+ .../picture_in_picture_controller_impl.cc                  | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/third_party/blink/renderer/modules/document_picture_in_picture/picture_in_picture_controller_impl.cc b/third_party/blink/renderer/modules/document_picture_in_picture/picture_in_picture_controller_impl.cc
+--- a/third_party/blink/renderer/modules/document_picture_in_picture/picture_in_picture_controller_impl.cc
+++ b/third_party/blink/renderer/modules/document_picture_in_picture/picture_in_picture_controller_impl.cc
+@@ -370,6 +370,13 @@ void PictureInPictureControllerImpl::CreateDocumentPictureInPictureWindow(
+     return;
+   }
+ 
+  if (!opener.GetFrame()->GetContentSettingsClient()->AllowPopupsAndRedirects(false)) {
+    exception_state.ThrowDOMException(DOMExceptionCode::kNotAllowedError,
+                                      "Document PiP requires user popup permission");
+    resolver->Reject(exception_state);
+    return;
+  }
+
+   WebPictureInPictureWindowOptions web_options;
+   web_options.width = options->width();
+   web_options.height = options->height();
+--
+2.25.1
@@ -0,0 +1,45 @@
+From: Your Name <you@example.com>
+Date: Wed, 28 Dec 2022 07:19:58 +0000
+Subject: Always open browser controls in new tab
+
+---
+ .../chrome/browser/tab/TabContextMenuItemDelegate.java        | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tab/TabContextMenuItemDelegate.java b/chrome/android/java/src/org/chromium/chrome/browser/tab/TabContextMenuItemDelegate.java
+--- a/chrome/android/java/src/org/chromium/chrome/browser/tab/TabContextMenuItemDelegate.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/tab/TabContextMenuItemDelegate.java
+@@ -20,6 +20,7 @@ import org.chromium.base.IntentUtils;
+ import org.chromium.base.PackageManagerUtils;
+ import org.chromium.base.metrics.RecordUserAction;
+ import org.chromium.base.supplier.Supplier;
+import org.chromium.cc.input.BrowserControlsState;
+ import org.chromium.chrome.browser.DefaultBrowserInfo;
+ import org.chromium.chrome.browser.IntentHandler;
+ import org.chromium.chrome.browser.bookmarks.BookmarkModel;
+@@ -34,6 +35,7 @@ import org.chromium.chrome.browser.multiwindow.MultiWindowUtils;
+ import org.chromium.chrome.browser.offlinepages.OfflinePageBridge;
+ import org.chromium.chrome.browser.offlinepages.RequestCoordinatorBridge;
+ import org.chromium.chrome.browser.profiles.Profile;
+import org.chromium.chrome.browser.tab.TabBrowserControlsConstraintsHelper;
+ import org.chromium.chrome.browser.tabmodel.TabModelSelector;
+ import org.chromium.chrome.browser.tabmodel.document.TabDelegate;
+ import org.chromium.chrome.browser.ui.messages.snackbar.SnackbarManager;
+@@ -202,6 +204,7 @@ public class TabContextMenuItemDelegate implements ContextMenuItemDelegate {
+     @Override
+     public void onOpenInNewTab(GURL url, Referrer referrer, boolean navigateToTab,
+             @Nullable AdditionalNavigationParams additionalNavigationParams) {
+        TabBrowserControlsConstraintsHelper.get(mTab).update(BrowserControlsState.SHOWN, true);
+         RecordUserAction.record("MobileNewTabOpened");
+         RecordUserAction.record("LinkOpenedInNewTab");
+         LoadUrlParams loadUrlParams = new LoadUrlParams(url.getSpec());
+@@ -215,6 +218,7 @@ public class TabContextMenuItemDelegate implements ContextMenuItemDelegate {
+ 
+     @Override
+     public void onOpenInNewTabInGroup(GURL url, Referrer referrer) {
+        TabBrowserControlsConstraintsHelper.get(mTab).update(BrowserControlsState.SHOWN, true);
+         RecordUserAction.record("MobileNewTabOpened");
+         RecordUserAction.record("LinkOpenedInNewTab");
+         LoadUrlParams loadUrlParams = new LoadUrlParams(url.getSpec());
+--
+2.25.1
@@ -0,0 +1,25 @@
+From: Your Name <you@example.com>
+Date: Tue, 31 Oct 2023 16:16:08 +0000
+Subject: Block Intents While Locked
+
+see  https://source.chromium.org/chromium/chromium/src/+/c5b50f4c2d42e7b808fd3e6fb3545cdb3f4d82c9
+---
+ chrome/browser/flags/android/chrome_feature_list.cc | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/chrome/browser/flags/android/chrome_feature_list.cc b/chrome/browser/flags/android/chrome_feature_list.cc
+--- a/chrome/browser/flags/android/chrome_feature_list.cc
+++ b/chrome/browser/flags/android/chrome_feature_list.cc
+@@ -540,8 +540,8 @@ BASE_FEATURE(kBaselineGM3SurfaceColors,
+              base::FEATURE_ENABLED_BY_DEFAULT);
+ 
+ BASE_FEATURE(kBlockIntentsWhileLocked,
+-             "BlockIntentsWhileLocked",
+-             base::FEATURE_DISABLED_BY_DEFAULT);
+             "BlockIntentsWhileLocked",         // enabled
+             base::FEATURE_ENABLED_BY_DEFAULT); // by default
+ 
+ BASE_FEATURE(kCacheActivityTaskID,
+              "CacheActivityTaskID",
+--
+2.25.1
@@ -0,0 +1,92 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Wed, 19 Apr 2023 09:59:18 +0000
+Subject: Clear CORS Preflight Cache on clearing data
+
+License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
+---
+ services/network/cors/preflight_cache.cc      | 4 ++++
+ services/network/cors/preflight_cache.h       | 2 ++
+ services/network/cors/preflight_controller.cc | 4 ++++
+ services/network/cors/preflight_controller.h  | 2 ++
+ services/network/cors/preflight_result.cc     | 2 +-
+ services/network/network_context.cc           | 2 ++
+ 6 files changed, 15 insertions(+), 1 deletion(-)
+
+diff --git a/services/network/cors/preflight_cache.cc b/services/network/cors/preflight_cache.cc
+--- a/services/network/cors/preflight_cache.cc
+++ b/services/network/cors/preflight_cache.cc
+@@ -200,6 +200,10 @@ void PreflightCache::MayPurgeForTesting(size_t max_entries, size_t purge_unit) {
+   MayPurge(max_entries, purge_unit);
+ }
+ 
+void PreflightCache::ClearAll() {
+  cache_.clear();
+}
+
+ void PreflightCache::MayPurge(size_t max_entries, size_t purge_unit) {
+   if (cache_.size() <= max_entries) {
+     return;
+diff --git a/services/network/cors/preflight_cache.h b/services/network/cors/preflight_cache.h
+--- a/services/network/cors/preflight_cache.h
+++ b/services/network/cors/preflight_cache.h
+@@ -78,6 +78,8 @@ class COMPONENT_EXPORT(NETWORK_SERVICE) PreflightCache final {
+   // `max_entries` for testing.
+   void MayPurgeForTesting(size_t max_entries, size_t purge_unit);
+ 
+  void ClearAll();
+
+  private:
+   void MayPurge(size_t max_entries, size_t purge_unit);
+ 
+diff --git a/services/network/cors/preflight_controller.cc b/services/network/cors/preflight_controller.cc
+--- a/services/network/cors/preflight_controller.cc
+++ b/services/network/cors/preflight_controller.cc
+@@ -804,6 +804,10 @@ void PreflightController::ClearCorsPreflightCache(
+   cache_.ClearCache(std::move(url_filter));
+ }
+ 
+void PreflightController::ClearCache() {
+  cache_.ClearAll();
+}
+
+ void PreflightController::RemoveLoader(PreflightLoader* loader) {
+   auto it = loaders_.find(loader);
+   DCHECK(it != loaders_.end());
+diff --git a/services/network/cors/preflight_controller.h b/services/network/cors/preflight_controller.h
+--- a/services/network/cors/preflight_controller.h
+++ b/services/network/cors/preflight_controller.h
+@@ -141,6 +141,8 @@ class COMPONENT_EXPORT(NETWORK_SERVICE) PreflightController final {
+       mojo::PendingRemote<mojom::URLLoaderNetworkServiceObserver>
+           url_loader_network_service_observer);
+ 
+  void ClearCache();
+
+   // Clears the CORS preflight cache. The time range is always "all time" as
+   // the preflight cache max age is capped to 2hrs. in Chrome.
+   // It clears origins selectively when the url filter is not null, otherwise
+diff --git a/services/network/cors/preflight_result.cc b/services/network/cors/preflight_result.cc
+--- a/services/network/cors/preflight_result.cc
+++ b/services/network/cors/preflight_result.cc
+@@ -37,7 +37,7 @@ constexpr base::TimeDelta kDefaultTimeout = base::Seconds(5);
+ // Maximum cache expiry time. Even if a CORS-preflight response contains
+ // Access-Control-Max-Age header that specifies a longer expiry time, this
+ // maximum time is applied.
+-constexpr base::TimeDelta kMaxTimeout = base::Hours(2);
+constexpr base::TimeDelta kMaxTimeout = base::Seconds(600);
+ 
+ // Holds TickClock instance to overwrite TimeTicks::Now() for testing.
+ const base::TickClock* tick_clock_for_testing = nullptr;
+diff --git a/services/network/network_context.cc b/services/network/network_context.cc
+--- a/services/network/network_context.cc
+++ b/services/network/network_context.cc
+@@ -1126,6 +1126,8 @@ void NetworkContext::ClearHttpCache(base::Time start_time,
+       base::BindOnce(&NetworkContext::OnHttpCacheCleared,
+                      base::Unretained(this), std::move(callback))));
+ 
+  cors_preflight_controller_.ClearCache();
+
+   NetworkServiceMemoryCache* memory_cache = GetMemoryCache();
+   if (memory_cache)
+     memory_cache->Clear();
+--
+2.25.1
@@ -0,0 +1,25 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Wed, 19 Jul 2023 09:32:36 +0000
+Subject: Compress libchrome to free up some space
+
+upstream removed ModernLinker support for developer build (apk releases).
+see https://bugs.chromium.org/p/chromium/issues/detail?id=1383210
+
+License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
+---
+ chrome/android/chrome_public_apk_tmpl.gni | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/chrome/android/chrome_public_apk_tmpl.gni b/chrome/android/chrome_public_apk_tmpl.gni
+--- a/chrome/android/chrome_public_apk_tmpl.gni
+++ b/chrome/android/chrome_public_apk_tmpl.gni
+@@ -635,6 +635,7 @@ template("chrome_common_apk_or_module_tmpl") {
+           [ "//components/crash/core/app:chrome_crashpad_handler_named_as_so" ]
+       loadable_modules += [ "$root_out_dir/libchrome_crashpad_handler.so" ]
+       library_always_compress += [ "libchrome_crashpad_handler.so" ]
+      library_always_compress += [ "libchrome.so" ]
+     } else if (!_is_trichrome) {
+       # Crashpad trampoline lives in TrichromeLibrary.apk.
+       # https://chromium.googlesource.com/chromium/src/+/main/docs/android_native_libraries.md#Crashpad-Packaging
+--
+2.25.1
@@ -0,0 +1,25 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Mon, 5 Jun 2023 17:02:33 +0000
+Subject: Deprecate Data URL in SVGUseElement
+
+License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
+---
+ .../blink/renderer/platform/runtime_enabled_features.json5    | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/third_party/blink/renderer/platform/runtime_enabled_features.json5 b/third_party/blink/renderer/platform/runtime_enabled_features.json5
+--- a/third_party/blink/renderer/platform/runtime_enabled_features.json5
+++ b/third_party/blink/renderer/platform/runtime_enabled_features.json5
+@@ -3159,8 +3159,8 @@
+       status: "stable",
+     },
+     {
+-      name: "RemoveDataUrlInSvgUse",
+-      status: "experimental",
+      name: "RemoveDataUrlInSvgUse",  // enabled
+      status: "stable",               // by default
+     },
+     {
+       name: "RemoveMobileViewportDoubleTap",
+--
+2.25.1
@@ -0,0 +1,27 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Tue, 14 Feb 2023 16:29:12 +0000
+Subject: Disable BackForwardCache
+
+License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
+---
+ content/public/common/content_features.cc | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/content/public/common/content_features.cc b/content/public/common/content_features.cc
+--- a/content/public/common/content_features.cc
+++ b/content/public/common/content_features.cc
+@@ -65,9 +65,9 @@ BASE_FEATURE(kBackgroundFetch,
+              base::FEATURE_ENABLED_BY_DEFAULT);
+ 
+ // Enable using the BackForwardCache.
+-BASE_FEATURE(kBackForwardCache,
+-             "BackForwardCache",
+-             base::FEATURE_ENABLED_BY_DEFAULT);
+BASE_FEATURE(kBackForwardCache,                   // ****
+             "BackForwardCache",                  // always disabled
+             base::FEATURE_DISABLED_BY_DEFAULT);  // in bromite
+ 
+ // Enable showing a page preview during back/forward navigations.
+ BASE_FEATURE(kBackForwardTransitions,
+--
+2.25.1
@@ -0,0 +1,47 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Tue, 8 Nov 2022 12:41:22 +0000
+Subject: Disable Component Updates
+
+License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
+---
+ chrome/browser/component_updater/registration.cc          | 1 +
+ components/component_updater/component_installer.cc       | 1 +
+ components/component_updater/component_updater_service.cc | 2 +-
+ 3 files changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/chrome/browser/component_updater/registration.cc b/chrome/browser/component_updater/registration.cc
+--- a/chrome/browser/component_updater/registration.cc
+++ b/chrome/browser/component_updater/registration.cc
+@@ -98,6 +98,7 @@
+ namespace component_updater {
+ 
+ void RegisterComponentsForUpdate() {
+  if ((true)) return;
+   auto* const cus = g_browser_process->component_updater();
+ 
+ #if BUILDFLAG(IS_WIN)
+diff --git a/components/component_updater/component_installer.cc b/components/component_updater/component_installer.cc
+--- a/components/component_updater/component_installer.cc
+++ b/components/component_updater/component_installer.cc
+@@ -88,6 +88,7 @@ void ComponentInstaller::Register(RegisterCallback register_callback,
+                                   base::OnceClosure callback,
+                                   base::TaskPriority task_priority,
+                                   const base::Version& registered_version) {
+  if ((true)) return;
+   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+ 
+   task_runner_ = base::ThreadPool::CreateSequencedTaskRunner(
+diff --git a/components/component_updater/component_updater_service.cc b/components/component_updater/component_updater_service.cc
+--- a/components/component_updater/component_updater_service.cc
+++ b/components/component_updater/component_updater_service.cc
+@@ -520,7 +520,7 @@ std::unique_ptr<ComponentUpdateService> ComponentUpdateServiceFactory(
+ // Register prefs required by the component update service.
+ void RegisterComponentUpdateServicePrefs(PrefRegistrySimple* registry) {
+   // The component updates are enabled by default, if the preference is not set.
+-  registry->RegisterBooleanPref(prefs::kComponentUpdatesEnabled, true);
+  registry->RegisterBooleanPref(prefs::kComponentUpdatesEnabled, false);
+ }
+ 
+ }  // namespace component_updater
+--
+2.25.1
@@ -0,0 +1,35 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Sat, 3 Jun 2023 15:04:55 +0000
+Subject: Disable Compression Dictionary Transport
+
+License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
+---
+ .../blink/renderer/platform/runtime_enabled_features.json5  | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/third_party/blink/renderer/platform/runtime_enabled_features.json5 b/third_party/blink/renderer/platform/runtime_enabled_features.json5
+--- a/third_party/blink/renderer/platform/runtime_enabled_features.json5
+++ b/third_party/blink/renderer/platform/runtime_enabled_features.json5
+@@ -685,16 +685,18 @@
+       status: "stable",
+     },
+     {
+-      name: "CompressionDictionaryTransport",
+      name: "CompressionDictionaryTransport", // need to be disabled
+       base_feature: "none",
+       origin_trial_feature_name: "CompressionDictionaryTransport",
+       origin_trial_allows_third_party: true,
+       public: true,
+      status: "experimental",
+     },
+     {
+-      name: "CompressionDictionaryTransportBackend",
+      name: "CompressionDictionaryTransportBackend", // need to be disabled
+       base_feature: "none",
+       public: true,
+      status: "experimental",
+     },
+     {
+       name: "ComputedAccessibilityInfo",
+--
+2.25.1
@@ -0,0 +1,48 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Tue, 14 Feb 2023 16:26:17 +0000
+Subject: Disable FedCm
+
+License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
+---
+ content/public/common/content_features.cc                   | 6 +++---
+ .../blink/renderer/platform/runtime_enabled_features.json5  | 2 +-
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/content/public/common/content_features.cc b/content/public/common/content_features.cc
+--- a/content/public/common/content_features.cc
+++ b/content/public/common/content_features.cc
+@@ -337,7 +337,7 @@ BASE_FEATURE(kEnableServiceWorkersForChromeScheme,
+ // by the flag in RuntimeEnabledFeatures on the blink side. See also
+ // the use of kSetOnlyIfOverridden in content/child/runtime_features.cc.
+ // We enable it here by default to support use in origin trials.
+-BASE_FEATURE(kFedCm, "FedCm", base::FEATURE_ENABLED_BY_DEFAULT);
+BASE_FEATURE(kFedCm, "FedCm", base::FEATURE_DISABLED_BY_DEFAULT);
+ 
+ // Field trial boolean parameter which indicates whether FedCM IDP sign-out
+ // is enabled.
+@@ -385,9 +385,9 @@ BASE_FEATURE(kFedCmSelectiveDisclosure,
+ 
+ // Enables the IDP signin status API for use with FedCM, including avoiding
+ // network requests when not signed in and mismatch handling.
+-BASE_FEATURE(kFedCmIdpSigninStatusEnabled,          // disabled
+BASE_FEATURE(kFedCmIdpSigninStatusEnabled,          // enabled
+              "FedCmIdpSigninStatusEnabled",         // by default
+-             base::FEATURE_DISABLED_BY_DEFAULT);    // on bromite
+             base::FEATURE_ENABLED_BY_DEFAULT);     // on bromite
+ 
+ // Enables bypassing the well-known file enforcement.
+ BASE_FEATURE(kFedCmWithoutWellKnownEnforcement,
+diff --git a/third_party/blink/renderer/platform/runtime_enabled_features.json5 b/third_party/blink/renderer/platform/runtime_enabled_features.json5
+--- a/third_party/blink/renderer/platform/runtime_enabled_features.json5
+++ b/third_party/blink/renderer/platform/runtime_enabled_features.json5
+@@ -1603,7 +1603,7 @@
+     {
+       name: "FedCm",
+       public: true,
+-      status: "stable",
+      status: "test",
+       base_feature: "none",
+     },
+     {
+--
+2.25.1
@@ -0,0 +1,55 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Sat, 22 Jul 2023 13:58:40 +0000
+Subject: Disable Feeback Collector
+
+License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
+---
+ .../browser/feedback/FeedbackCollector.java   | 27 +++----------------
+ 1 file changed, 3 insertions(+), 24 deletions(-)
+
+diff --git a/chrome/browser/feedback/android/java/src/org/chromium/chrome/browser/feedback/FeedbackCollector.java b/chrome/browser/feedback/android/java/src/org/chromium/chrome/browser/feedback/FeedbackCollector.java
+--- a/chrome/browser/feedback/android/java/src/org/chromium/chrome/browser/feedback/FeedbackCollector.java
+++ b/chrome/browser/feedback/android/java/src/org/chromium/chrome/browser/feedback/FeedbackCollector.java
+@@ -28,6 +28,7 @@ import org.chromium.components.signin.identitymanager.ConsentLevel;
+ import org.chromium.components.signin.identitymanager.IdentityManager;
+ 
+ import java.util.HashMap;
+import java.util.ArrayList;
+ import java.util.List;
+ import java.util.Map;
+ 
+@@ -64,30 +65,8 @@ public abstract class FeedbackCollector<T> implements Runnable {
+     // Subclasses must invoke init() at construction time.
+     protected void init(Activity activity, @Nullable ScreenshotSource screenshotTask, T initParams,
+             Profile profile) {
+-        // 1. Build all synchronous and asynchronous sources and determine the currently signed in
+-        //    account.
+-        mSynchronousSources = buildSynchronousFeedbackSources(activity, initParams);
+-        mAsynchronousSources = buildAsynchronousFeedbackSources(initParams);
+-        IdentityManager identityManager =
+-                IdentityServicesProvider.get().getIdentityManager(profile);
+-        if (identityManager != null) {
+-            mAccountInUse = CoreAccountInfo.getEmailFrom(
+-                    identityManager.getPrimaryAccountInfo(ConsentLevel.SIGNIN));
+-        }
+-
+-        // Validation check in case a source is added to the wrong list.
+-        for (FeedbackSource source : mSynchronousSources) {
+-            assert !(source instanceof AsyncFeedbackSource);
+-        }
+-
+-        // 2. Set |mScreenshotTask| if not null.
+-        if (screenshotTask != null) mScreenshotTask = screenshotTask;
+-
+-        // 3. Start all asynchronous sources and the screenshot task.
+-        for (var source : mAsynchronousSources) {
+-            source.start(this);
+-        }
+-        if (mScreenshotTask != null) mScreenshotTask.capture(this);
+        mSynchronousSources = new ArrayList<>();
+        mAsynchronousSources = new ArrayList<>();
+ 
+         // 4. Kick off a task to timeout the async sources.
+         ThreadUtils.postOnUiThreadDelayed(this, TIMEOUT_MS);
+--
+2.25.1
@@ -0,0 +1,60 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Tue, 2 May 2023 15:26:46 +0000
+Subject: Disable FirstPartySets and StorageAccessAPI
+
+License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
+---
+ components/privacy_sandbox/privacy_sandbox_prefs.cc     | 2 +-
+ components/privacy_sandbox/tracking_protection_prefs.cc | 4 ++--
+ content/public/common/content_features.cc               | 6 +++---
+ 3 files changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/components/privacy_sandbox/privacy_sandbox_prefs.cc b/components/privacy_sandbox/privacy_sandbox_prefs.cc
+--- a/components/privacy_sandbox/privacy_sandbox_prefs.cc
+++ b/components/privacy_sandbox/privacy_sandbox_prefs.cc
+@@ -55,7 +55,7 @@ void RegisterProfilePrefs(PrefRegistrySimple* registry) {
+   registry->RegisterBooleanPref(
+       prefs::kPrivacySandboxFirstPartySetsDataAccessAllowedInitialized, false);
+   registry->RegisterBooleanPref(
+-      prefs::kPrivacySandboxRelatedWebsiteSetsEnabled, true,
+      prefs::kPrivacySandboxRelatedWebsiteSetsEnabled, false,
+       user_prefs::PrefRegistrySyncable::SYNCABLE_PREF);
+ 
+   registry->RegisterBooleanPref(prefs::kPrivacySandboxTopicsConsentGiven,
+diff --git a/components/privacy_sandbox/tracking_protection_prefs.cc b/components/privacy_sandbox/tracking_protection_prefs.cc
+--- a/components/privacy_sandbox/tracking_protection_prefs.cc
+++ b/components/privacy_sandbox/tracking_protection_prefs.cc
+@@ -27,13 +27,13 @@ void RegisterProfilePrefs(PrefRegistrySimple* registry) {
+ 
+   // Tracking Protection Settings Prefs
+   registry->RegisterBooleanPref(
+-      prefs::kBlockAll3pcToggleEnabled, false,
+      prefs::kBlockAll3pcToggleEnabled, false, // with true enables FPS
+       user_prefs::PrefRegistrySyncable::SYNCABLE_PREF);
+   registry->RegisterIntegerPref(
+       prefs::kTrackingProtectionLevel,
+       static_cast<int>(TrackingProtectionLevel::kStandard),
+       user_prefs::PrefRegistrySyncable::SYNCABLE_PREF);
+-  registry->RegisterBooleanPref(prefs::kTrackingProtection3pcdEnabled, false);
+  registry->RegisterBooleanPref(prefs::kTrackingProtection3pcdEnabled, false); // with true enables FPS
+   registry->RegisterBooleanPref(
+       prefs::kEnableDoNotTrack, false,
+       user_prefs::PrefRegistrySyncable::SYNCABLE_PREF);
+diff --git a/content/public/common/content_features.cc b/content/public/common/content_features.cc
+--- a/content/public/common/content_features.cc
+++ b/content/public/common/content_features.cc
+@@ -405,9 +405,9 @@ BASE_FEATURE(kWebIdentityMDocs,
+              base::FEATURE_DISABLED_BY_DEFAULT);
+ 
+ // Enables usage of First Party Sets to determine cookie availability.
+-BASE_FEATURE(kFirstPartySets,
+-             "FirstPartySets",
+-             base::FEATURE_ENABLED_BY_DEFAULT);
+BASE_FEATURE(kFirstPartySets,                       // always
+             "FirstPartySets",                      // disabled
+             base::FEATURE_DISABLED_BY_DEFAULT);    // in bromite
+ 
+ // Controls whether to clear sites data on FPS transitions.
+ const base::FeatureParam<bool> kFirstPartySetsClearSiteDataOnChangedSets{
+--
+2.25.1
@@ -0,0 +1,161 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Sun, 7 May 2023 14:01:56 +0000
+Subject: Disable GSA by default
+
+License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
+---
+ .../org/chromium/chrome/browser/IntentHandler.java   |  5 -----
+ .../org/chromium/chrome/browser/share/LensUtils.java | 12 +-----------
+ chrome/browser/flags/android/chrome_feature_list.cc  |  8 ++++----
+ .../org/chromium/chrome/browser/gsa/GSAState.java    | 11 +++++------
+ 4 files changed, 10 insertions(+), 26 deletions(-)
+
+diff --git a/chrome/android/java/src/org/chromium/chrome/browser/IntentHandler.java b/chrome/android/java/src/org/chromium/chrome/browser/IntentHandler.java
+--- a/chrome/android/java/src/org/chromium/chrome/browser/IntentHandler.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/IntentHandler.java
+@@ -38,7 +38,6 @@ import org.chromium.chrome.browser.document.ChromeLauncherActivity;
+ import org.chromium.chrome.browser.externalnav.IntentWithRequestMetadataHandler;
+ import org.chromium.chrome.browser.externalnav.IntentWithRequestMetadataHandler.RequestMetadata;
+ import org.chromium.chrome.browser.flags.ChromeFeatureList;
+-import org.chromium.chrome.browser.gsa.GSAState;
+ import org.chromium.chrome.browser.omnibox.suggestions.AutocompleteControllerProvider;
+ import org.chromium.chrome.browser.profiles.Profile;
+ import org.chromium.chrome.browser.renderer_host.ChromeNavigationUIData;
+@@ -264,8 +263,6 @@ public class IntentHandler {
+     private static int sReferrerId;
+     private static String sPendingIncognitoUrl;
+ 
+-    public static final String PACKAGE_GSA = GSAState.PACKAGE_NAME;
+-
+     private static final String PACKAGE_GMAIL = "com.google.android.gm";
+     private static final String PACKAGE_PLUS = "com.google.android.apps.plus";
+     private static final String PACKAGE_HANGOUTS = "com.google.android.talk";
+@@ -456,8 +453,6 @@ public class IntentHandler {
+             return ExternalAppId.LINE;
+         } else if (packageName.equals(PACKAGE_WHATSAPP)) {
+             return ExternalAppId.WHATSAPP;
+-        } else if (packageName.equals(PACKAGE_GSA)) {
+-            return ExternalAppId.GSA;
+         } else if (packageName.equals(ContextUtils.getApplicationContext().getPackageName())) {
+             return ExternalAppId.CHROME;
+         } else if (packageName.startsWith(WEBAPK_PACKAGE_PREFIX)) {
+diff --git a/chrome/android/java/src/org/chromium/chrome/browser/share/LensUtils.java b/chrome/android/java/src/org/chromium/chrome/browser/share/LensUtils.java
+--- a/chrome/android/java/src/org/chromium/chrome/browser/share/LensUtils.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/share/LensUtils.java
+@@ -12,7 +12,6 @@ import org.chromium.base.ResettersForTesting;
+ import org.chromium.chrome.R;
+ import org.chromium.chrome.browser.IntentHandler;
+ import org.chromium.chrome.browser.flags.ChromeFeatureList;
+-import org.chromium.chrome.browser.gsa.GSAState;
+ import org.chromium.components.externalauth.ExternalAuthUtils;
+ 
+ /**
+@@ -64,12 +63,7 @@ public class LensUtils {
+             if (context == null) {
+                 return "";
+             }
+-            String agsaVersion = GSAState.getInstance().getAgsaVersionName();
+-            if (agsaVersion == null) {
+                 return "";
+-            } else {
+-                return agsaVersion;
+-            }
+         }
+     }
+ 
+@@ -121,11 +115,7 @@ public class LensUtils {
+      * @return Whether the package is valid.
+      */
+     public static boolean isValidAgsaPackage(final ExternalAuthUtils externalAuthUtils) {
+-        if (sFakePassableLensEnvironmentForTesting) {
+-            return true;
+-        }
+-
+-        return externalAuthUtils.isGoogleSigned(IntentHandler.PACKAGE_GSA);
+        return false;
+     }
+ 
+     public static boolean isGoogleLensFeatureEnabled(boolean isIncognito) {
+diff --git a/chrome/browser/flags/android/chrome_feature_list.cc b/chrome/browser/flags/android/chrome_feature_list.cc
+--- a/chrome/browser/flags/android/chrome_feature_list.cc
+++ b/chrome/browser/flags/android/chrome_feature_list.cc
+@@ -725,8 +725,8 @@ BASE_FEATURE(kContextMenuGoogleLensSearchOptimizations,
+              base::FEATURE_DISABLED_BY_DEFAULT);
+ 
+ BASE_FEATURE(kContextMenuSearchWithGoogleLens,
+-             "ContextMenuSearchWithGoogleLens",
+-             base::FEATURE_ENABLED_BY_DEFAULT);
+             "ContextMenuSearchWithGoogleLens",   // always disabled
+             base::FEATURE_DISABLED_BY_DEFAULT);  // in bromite
+ 
+ BASE_FEATURE(kContextMenuShopWithGoogleLens,
+              "ContextMenuShopWithGoogleLens",
+@@ -827,8 +827,8 @@ BASE_FEATURE(kOfflineIndicatorV2,
+              base::FEATURE_ENABLED_BY_DEFAULT);
+ 
+ BASE_FEATURE(kExperimentsForAgsa,
+-             "ExperimentsForAgsa",
+-             base::FEATURE_ENABLED_BY_DEFAULT);
+             "ExperimentsForAgsa",                 // disabled by default
+             base::FEATURE_DISABLED_BY_DEFAULT);   // in Bromite
+ 
+ BASE_FEATURE(kExploreSites, "ExploreSites", base::FEATURE_DISABLED_BY_DEFAULT);
+ 
+diff --git a/chrome/browser/gsa/java/src/org/chromium/chrome/browser/gsa/GSAState.java b/chrome/browser/gsa/java/src/org/chromium/chrome/browser/gsa/GSAState.java
+--- a/chrome/browser/gsa/java/src/org/chromium/chrome/browser/gsa/GSAState.java
+++ b/chrome/browser/gsa/java/src/org/chromium/chrome/browser/gsa/GSAState.java
+@@ -34,8 +34,6 @@ import java.util.regex.Pattern;
+  * A class responsible for representing the current state of Chrome's integration with GSA.
+  */
+ public class GSAState {
+-    public static final String PACKAGE_NAME = "com.google.android.googlequicksearchbox";
+-
+     /** Used to observe state changes in the class. */
+     public interface Observer {
+         /** Called when the GSA account name is set. */
+@@ -75,7 +73,7 @@ public class GSAState {
+     /**
+      * Caches the result of a computation on whether GSA is available.
+      */
+-    private Boolean mGsaAvailable;
+    private Boolean mGsaAvailable = false;
+ 
+     /**
+      * The Google account email address being used by GSA according to the latest update we have
+@@ -156,7 +154,7 @@ public class GSAState {
+ 
+     /** Returns whether the GSA package is installed on device. */
+     public boolean isGsaInstalled() {
+-        return PackageUtils.isPackageInstalled(PACKAGE_NAME);
+        return false;
+     }
+ 
+     /**
+@@ -179,6 +177,7 @@ public class GSAState {
+      */
+     public boolean isAgsaVersionBelowMinimum(
+             String installedVersionName, String minimumVersionName) {
+        if ((true)) return true;
+         if (TextUtils.isEmpty(installedVersionName) || TextUtils.isEmpty(minimumVersionName)) {
+             return true;
+         }
+@@ -210,7 +209,7 @@ public class GSAState {
+      * @return Whether the given intent can be handled by Agsa.
+      */
+     public boolean canAgsaHandleIntent(@NonNull Intent intent) {
+-        if (!intent.getPackage().equals(PACKAGE_NAME)) return false;
+        if ((true)) return false;
+ 
+         ComponentName activity =
+                 intent.resolveActivity(ContextUtils.getApplicationContext().getPackageManager());
+@@ -224,7 +223,7 @@ public class GSAState {
+      * @return The version name of the Agsa package or null if it can't be found.
+      */
+     public @Nullable String getAgsaVersionName() {
+-        PackageInfo packageInfo = PackageUtils.getPackageInfo(PACKAGE_NAME, 0);
+        PackageInfo packageInfo = null;
+         return packageInfo == null ? null : packageInfo.versionName;
+     }
+ 
+--
+2.25.1
@@ -0,0 +1,68 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Sun, 7 May 2023 13:13:47 +0000
+Subject: Disable GetInstalledRelatedApps API
+
+License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
+---
+ .../components/installedapp/InstalledAppProviderImpl.java     | 1 +
+ .../browser/installedapp/installed_app_provider_impl_win.cc   | 1 +
+ content/public/common/content_features.cc                     | 4 ++--
+ .../blink/renderer/platform/runtime_enabled_features.json5    | 2 +-
+ 4 files changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/components/installedapp/android/java/src/org/chromium/components/installedapp/InstalledAppProviderImpl.java b/components/installedapp/android/java/src/org/chromium/components/installedapp/InstalledAppProviderImpl.java
+--- a/components/installedapp/android/java/src/org/chromium/components/installedapp/InstalledAppProviderImpl.java
+++ b/components/installedapp/android/java/src/org/chromium/components/installedapp/InstalledAppProviderImpl.java
+@@ -155,6 +155,7 @@ public class InstalledAppProviderImpl implements InstalledAppProvider {
+     @UiThread
+     public void filterInstalledApps(final RelatedApplication[] relatedApps, final Url manifestUrl,
+             final FilterInstalledApps_Response callback) {
+        assert false;
+         GURL url = mRenderFrameHost.getLastCommittedURL();
+         final GURL frameUrl = url == null ? GURL.emptyGURL() : url;
+         int delayMillis = 0;
+diff --git a/content/browser/installedapp/installed_app_provider_impl_win.cc b/content/browser/installedapp/installed_app_provider_impl_win.cc
+--- a/content/browser/installedapp/installed_app_provider_impl_win.cc
+++ b/content/browser/installedapp/installed_app_provider_impl_win.cc
+@@ -112,6 +112,7 @@ void FilterInstalledAppsForWin(
+     std::vector<blink::mojom::RelatedApplicationPtr> related_apps,
+     blink::mojom::InstalledAppProvider::FilterInstalledAppsCallback callback,
+     const GURL frame_url) {
+  CHECK(true);
+   ComPtr<ILauncherStatics4> launcher_statics;
+   HRESULT hr = base::win::RoActivateInstance(
+       base::win::ScopedHString::Create(RuntimeClass_Windows_System_Launcher)
+diff --git a/content/public/common/content_features.cc b/content/public/common/content_features.cc
+--- a/content/public/common/content_features.cc
+++ b/content/public/common/content_features.cc
+@@ -451,12 +451,12 @@ BASE_FEATURE(kGreaseUACH, "GreaseUACH", base::FEATURE_ENABLED_BY_DEFAULT);
+ BASE_FEATURE(kIdleDetection, "IdleDetection", base::FEATURE_DISABLED_BY_DEFAULT);
+ 
+ // Kill switch for the GetInstalledRelatedApps API.
+-BASE_FEATURE(kInstalledApp, "InstalledApp", base::FEATURE_ENABLED_BY_DEFAULT);
+BASE_FEATURE(kInstalledApp, "InstalledApp", base::FEATURE_DISABLED_BY_DEFAULT);
+ 
+ // Allow Windows specific implementation for the GetInstalledRelatedApps API.
+ BASE_FEATURE(kInstalledAppProvider,
+              "InstalledAppProvider",
+-             base::FEATURE_ENABLED_BY_DEFAULT);
+             base::FEATURE_DISABLED_BY_DEFAULT);
+ 
+ // Enable support for isolated web apps. This will guard features like serving
+ // isolated web apps via the isolated-app:// scheme, and other advanced isolated
+diff --git a/third_party/blink/renderer/platform/runtime_enabled_features.json5 b/third_party/blink/renderer/platform/runtime_enabled_features.json5
+--- a/third_party/blink/renderer/platform/runtime_enabled_features.json5
+++ b/third_party/blink/renderer/platform/runtime_enabled_features.json5
+@@ -2139,9 +2139,9 @@
+       status: {"Android": "test", "default": "stable"},
+     },
+     {
+      // disable GetInstalledRelatedApps
+       name: "InstalledApp",
+       public: true,
+-      status: "stable",
+       base_feature: "none",
+     },
+     {
+--
+2.25.1
@@ -0,0 +1,30 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Mon, 15 May 2023 12:33:18 +0000
+Subject: Disable PrivateStateTokens API
+
+License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
+---
+ services/network/public/cpp/features.cc | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/services/network/public/cpp/features.cc b/services/network/public/cpp/features.cc
+--- a/services/network/public/cpp/features.cc
+++ b/services/network/public/cpp/features.cc
+@@ -168,12 +168,12 @@ BASE_FEATURE(kAttributionReportingCrossAppWeb,    // in bromite
+ // set, and handling their responses, according to the protocol.
+ // (See https://github.com/WICG/trust-token-api.)
+ BASE_FEATURE(kPrivateStateTokens,
+-             "PrivateStateTokens",
+-             base::FEATURE_ENABLED_BY_DEFAULT);
+             "PrivateStateTokens",                // must be disabled
+             base::FEATURE_DISABLED_BY_DEFAULT);  // in bromite
+ 
+ // Secondary flag used by the FLEDGE ads experiment in the interim before
+ // PSTs are fully rolled out to stable.
+-BASE_FEATURE(kFledgePst, "TrustTokens", base::FEATURE_ENABLED_BY_DEFAULT);
+BASE_FEATURE(kFledgePst, "TrustTokens", base::FEATURE_DISABLED_BY_DEFAULT); // must be disabled
+ 
+ // Determines which Trust Tokens operations require the TrustTokens origin trial
+ // active in order to be used. This is runtime-configurable so that the Trust
+--
+2.25.1
@@ -0,0 +1,25 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Tue, 18 Apr 2023 14:17:19 +0000
+Subject: Disable SHA1 Server Signature
+
+License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
+---
+ net/base/features.cc | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/base/features.cc b/net/base/features.cc
+--- a/net/base/features.cc
+++ b/net/base/features.cc
+@@ -88,8 +88,8 @@ BASE_FEATURE(kUseAlternativePortForGloballyReachableCheck,
+              base::FEATURE_DISABLED_BY_DEFAULT);
+ 
+ BASE_FEATURE(kSHA1ServerSignature,
+-             "SHA1ServerSignature",
+-             base::FEATURE_DISABLED_BY_DEFAULT);
+             "SHA1ServerSignature",                  // disabled
+             base::FEATURE_DISABLED_BY_DEFAULT);     // in bromite
+ 
+ BASE_FEATURE(kEnableTLS13EarlyData,
+              "EnableTLS13EarlyData",
+--
+2.25.1
@@ -0,0 +1,35 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Mon, 1 May 2023 12:07:49 +0000
+Subject: Disable WebGPU
+
+License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
+---
+ gpu/config/gpu_finch_features.cc                 | 2 +-
+ third_party/blink/renderer/modules/webgpu/gpu.cc | 1 +
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/gpu/config/gpu_finch_features.cc b/gpu/config/gpu_finch_features.cc
+--- a/gpu/config/gpu_finch_features.cc
+++ b/gpu/config/gpu_finch_features.cc
+@@ -283,7 +283,7 @@ BASE_FEATURE(kForceGpuMainThreadToNormalPriorityDrDc,
+ // Enable WebGPU on gpu service side only. This is used with origin trial and
+ // enabled by default on supported platforms.
+ #if BUILDFLAG(IS_MAC) || BUILDFLAG(IS_WIN) || BUILDFLAG(IS_CHROMEOS_ASH)
+-#define WEBGPU_ENABLED base::FEATURE_ENABLED_BY_DEFAULT
+#define WEBGPU_ENABLED base::FEATURE_DISABLED_BY_DEFAULT
+ #else
+ #define WEBGPU_ENABLED base::FEATURE_DISABLED_BY_DEFAULT
+ #endif
+diff --git a/third_party/blink/renderer/modules/webgpu/gpu.cc b/third_party/blink/renderer/modules/webgpu/gpu.cc
+--- a/third_party/blink/renderer/modules/webgpu/gpu.cc
+++ b/third_party/blink/renderer/modules/webgpu/gpu.cc
+@@ -357,6 +357,7 @@ ScriptPromise GPU::requestAdapter(ScriptState* script_state,
+         "WebGPU is experimental on this platform. See "
+         "https://github.com/gpuweb/gpuweb/wiki/"
+         "Implementation-Status#implementation-status"));
+    //(UAZO) add site setting
+   }
+ 
+   auto* resolver = MakeGarbageCollected<ScriptPromiseResolver>(script_state);
+--
+2.25.1
@@ -0,0 +1,37 @@
+From: Your Name <you@example.com>
+Date: Sun, 26 Feb 2023 19:46:04 +0000
+Subject: Disable csp reports
+
+---
+ third_party/blink/renderer/core/loader/ping_loader.cc | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/third_party/blink/renderer/core/loader/ping_loader.cc b/third_party/blink/renderer/core/loader/ping_loader.cc
+--- a/third_party/blink/renderer/core/loader/ping_loader.cc
+++ b/third_party/blink/renderer/core/loader/ping_loader.cc
+@@ -68,6 +68,7 @@ bool SendBeaconCommon(const ScriptState& state,
+                       LocalFrame* frame,
+                       const KURL& url,
+                       const BeaconData& beacon) {
+  if ((true)) return true;
+   if (!frame->DomWindow()
+            ->GetContentSecurityPolicyForWorld(&state.World())
+            ->AllowConnectToSource(url, url, RedirectStatus::kNoRedirect)) {
+@@ -103,6 +104,7 @@ bool SendBeaconCommon(const ScriptState& state,
+ void PingLoader::SendLinkAuditPing(LocalFrame* frame,
+                                    const KURL& ping_url,
+                                    const KURL& destination_url) {
+  if ((true)) return;
+   if (!ping_url.ProtocolIsInHTTPFamily())
+     return;
+ 
+@@ -140,6 +142,7 @@ void PingLoader::SendLinkAuditPing(LocalFrame* frame,
+ void PingLoader::SendViolationReport(ExecutionContext* execution_context,
+                                      const KURL& report_url,
+                                      scoped_refptr<EncodedFormData> report) {
+  if ((true)) return;
+   ResourceRequest request(report_url);
+   request.SetHttpMethod(http_names::kPOST);
+   request.SetHTTPContentType(AtomicString("application/csp-report"));
+--
+2.25.1
@@ -0,0 +1,31 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Mon, 17 Apr 2023 12:38:44 +0000
+Subject: Disable devtools remote and custom protocols
+
+---
+ chrome/browser/ui/webui/devtools_ui_data_source.cc | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/chrome/browser/ui/webui/devtools_ui_data_source.cc b/chrome/browser/ui/webui/devtools_ui_data_source.cc
+--- a/chrome/browser/ui/webui/devtools_ui_data_source.cc
+++ b/chrome/browser/ui/webui/devtools_ui_data_source.cc
+@@ -175,7 +175,7 @@ void DevToolsDataSource::StartDataRequest(
+   // Serve request to devtools://remote from remote location.
+   std::string remote_path_prefix(chrome::kChromeUIDevToolsRemotePath);
+   remote_path_prefix += "/";
+-  if (base::StartsWith(path, remote_path_prefix,
+  if ((false) && base::StartsWith(path, remote_path_prefix,
+                        base::CompareCase::INSENSITIVE_ASCII)) {
+     if (MaybeHandleCustomRequest(path.substr(remote_path_prefix.length()),
+                                  &callback)) {
+@@ -198,7 +198,7 @@ void DevToolsDataSource::StartDataRequest(
+   // Serve request to devtools://custom from custom URL.
+   std::string custom_path_prefix(chrome::kChromeUIDevToolsCustomPath);
+   custom_path_prefix += "/";
+-  if (base::StartsWith(path, custom_path_prefix,
+  if ((false) && base::StartsWith(path, custom_path_prefix,
+                        base::CompareCase::INSENSITIVE_ASCII)) {
+     GURL custom_devtools_frontend = GetCustomDevToolsFrontendURL();
+     if (!custom_devtools_frontend.is_empty()) {
+--
+2.25.1
@@ -0,0 +1,25 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Fri, 20 Oct 2023 14:53:41 +0000
+Subject: Disable prefers-reduced-transparency media query
+
+This feature can be used for fingerprinting as it exposes a user preference
+---
+ .../blink/renderer/platform/runtime_enabled_features.json5    | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/third_party/blink/renderer/platform/runtime_enabled_features.json5 b/third_party/blink/renderer/platform/runtime_enabled_features.json5
+--- a/third_party/blink/renderer/platform/runtime_enabled_features.json5
+++ b/third_party/blink/renderer/platform/runtime_enabled_features.json5
+@@ -3003,8 +3003,8 @@
+       base_feature: "none",
+     },
+     {
+-      name: "PrefersReducedTransparency",
+-      status: "stable",
+      name: "PrefersReducedTransparency",  // disabled by default
+      status: "experimental",              // see https://bugs.chromium.org/p/chromium/issues/detail?id=1424879
+     },
+     // This feature is deprecated and we are evangelizing affected sites.
+     // See https://crbug.com/346236 for current status.
+--
+2.25.1
@@ -0,0 +1,177 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Tue, 14 Mar 2023 15:59:38 +0000
+Subject: Disable privacy issues in password manager
+
+License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
+---
+ chrome/android/java/AndroidManifest.xml       |  9 --------
+ .../generated_password_leak_detection_pref.cc |  3 +--
+ .../affiliation/affiliation_backend.cc        |  1 +
+ .../affiliation/affiliation_service_impl.cc   |  4 ++++
+ .../core/browser/affiliation/facet_manager.cc | 23 +++----------------
+ .../browser/features/password_features.cc     | 12 +++++-----
+ .../leak_detection_check_factory_impl.cc      |  5 ++++
+ .../leak_detection_check_impl.cc              |  4 +---
+ 8 files changed, 21 insertions(+), 40 deletions(-)
+
+diff --git a/chrome/android/java/AndroidManifest.xml b/chrome/android/java/AndroidManifest.xml
+--- a/chrome/android/java/AndroidManifest.xml
+++ b/chrome/android/java/AndroidManifest.xml
+@@ -446,15 +446,6 @@ by a child template that "extends" this file.
+             </intent-filter>
+         </receiver>
+ 
+-        <!-- Phishing Protection related -->
+-        <receiver android:name="org.chromium.chrome.browser.safe_browsing.PasswordProtectionBroadcastReceiver"
+-        android:exported="true"
+-        android:permission="com.google.android.gms.permission.INTERNAL_BROADCAST">
+-            <intent-filter>
+-                <action android:name="com.android.chrome.safe_browsing.LOGIN" />
+-            </intent-filter>
+-        </receiver>
+-
+         <!-- Upgrade related -->
+         <receiver android:name="org.chromium.chrome.browser.upgrade.PackageReplacedBroadcastReceiver"
+             android:exported="false">
+diff --git a/chrome/browser/password_manager/generated_password_leak_detection_pref.cc b/chrome/browser/password_manager/generated_password_leak_detection_pref.cc
+--- a/chrome/browser/password_manager/generated_password_leak_detection_pref.cc
+++ b/chrome/browser/password_manager/generated_password_leak_detection_pref.cc
+@@ -20,8 +20,7 @@ namespace {
+ 
+ // Returns whether the user can use the leak detection feature.
+ bool IsUserAllowedToUseLeakDetection(Profile* profile) {
+-  return !profile->IsGuestSession() &&
+-         IdentityManagerFactory::GetForProfileIfExists(profile);
+  return false;
+ }
+ 
+ // Returns whether the effective value of the Safe Browsing preferences for
+diff --git a/components/password_manager/core/browser/affiliation/affiliation_backend.cc b/components/password_manager/core/browser/affiliation/affiliation_backend.cc
+--- a/components/password_manager/core/browser/affiliation/affiliation_backend.cc
+++ b/components/password_manager/core/browser/affiliation/affiliation_backend.cc
+@@ -404,6 +404,7 @@ void AffiliationBackend::OnMalformedResponse(
+ }
+ 
+ bool AffiliationBackend::OnCanSendNetworkRequest() {
+  if ((true)) return false;
+   DCHECK(!fetcher_);
+   std::vector<FacetURI> requested_facet_uris;
+   for (const auto& facet_manager_pair : facet_managers_) {
+diff --git a/components/password_manager/core/browser/affiliation/affiliation_service_impl.cc b/components/password_manager/core/browser/affiliation/affiliation_service_impl.cc
+--- a/components/password_manager/core/browser/affiliation/affiliation_service_impl.cc
+++ b/components/password_manager/core/browser/affiliation/affiliation_service_impl.cc
+@@ -127,6 +127,10 @@ void AffiliationServiceImpl::Shutdown() {
+ void AffiliationServiceImpl::PrefetchChangePasswordURLs(
+     const std::vector<GURL>& urls,
+     base::OnceClosure callback) {
+  if ((true)) {
+    std::move(callback).Run();
+    return;
+  }
+   std::vector<FacetURI> facets;
+   std::vector<url::SchemeHostPort> tuple_origins;
+   for (const auto& url : urls) {
+diff --git a/components/password_manager/core/browser/affiliation/facet_manager.cc b/components/password_manager/core/browser/affiliation/facet_manager.cc
+--- a/components/password_manager/core/browser/affiliation/facet_manager.cc
+++ b/components/password_manager/core/browser/affiliation/facet_manager.cc
+@@ -117,25 +117,7 @@ void FacetManager::GetAffiliationsAndBranding(
+   RequestInfo request_info;
+   request_info.callback = std::move(callback);
+   request_info.callback_task_runner = callback_task_runner;
+-  if (IsCachedDataFresh()) {
+-    AffiliatedFacetsWithUpdateTime affiliation;
+-    if (!backend_->ReadAffiliationsAndBrandingFromDatabase(facet_uri_,
+-                                                           &affiliation)) {
+-      ServeRequestWithFailure(std::move(request_info));
+-      return;
+-    }
+-    DCHECK_EQ(affiliation.last_update_time, last_update_time_) << facet_uri_;
+-    ServeRequestWithSuccess(std::move(request_info), affiliation.facets);
+-  } else if (cache_miss_strategy == StrategyOnCacheMiss::FETCH_OVER_NETWORK) {
+-    pending_requests_.push_back(std::move(request_info));
+-    backend_->SignalNeedNetworkRequest();
+-  } else if (cache_miss_strategy ==
+-             StrategyOnCacheMiss::TRY_ONCE_OVER_NETWORK) {
+-    pending_one_time_requests_.push_back(std::move(request_info));
+-    backend_->SignalNeedNetworkRequest();
+-  } else {
+-    ServeRequestWithFailure(std::move(request_info));
+-  }
+  ServeRequestWithFailure(std::move(request_info));
+ }
+ 
+ void FacetManager::Prefetch(const base::Time& keep_fresh_until) {
+@@ -254,7 +236,8 @@ void FacetManager::ServeRequestWithSuccess(
+     const AffiliatedFacets& affiliation) {
+   request_info.callback_task_runner->PostTask(
+       FROM_HERE,
+-      base::BindOnce(std::move(request_info.callback), affiliation, true));
+      base::BindOnce(std::move(request_info.callback),
+                                AffiliatedFacets(), false));
+ }
+ 
+ // static
+diff --git a/components/password_manager/core/browser/features/password_features.cc b/components/password_manager/core/browser/features/password_features.cc
+--- a/components/password_manager/core/browser/features/password_features.cc
+++ b/components/password_manager/core/browser/features/password_features.cc
+@@ -61,8 +61,8 @@ BASE_FEATURE(kFillingAcrossGroupedSites,
+ // Enables the experiment for the password manager to only fill on account
+ // selection, rather than autofilling on page load, with highlighting of fields.
+ BASE_FEATURE(kFillOnAccountSelect,
+-             "fill-on-account-select",
+-             base::FEATURE_DISABLED_BY_DEFAULT);
+             "fill-on-account-select",           // always enabled
+             base::FEATURE_ENABLED_BY_DEFAULT);  // by default
+ 
+ #if !BUILDFLAG(IS_ANDROID) && !BUILDFLAG(IS_IOS)
+ // Enables new confirmation bubble flow if generated password was used in a
+@@ -88,14 +88,14 @@ BASE_FEATURE(kSharedPasswordNotificationUI,
+ // Enables password receiving service including incoming password sharing
+ // invitation sync data type.
+ BASE_FEATURE(kPasswordManagerEnableReceiverService,
+-             "PasswordManagerEnableReceiverService",
+-             base::FEATURE_DISABLED_BY_DEFAULT);
+             "PasswordManagerEnableReceiverService", // must disable
+             base::FEATURE_DISABLED_BY_DEFAULT);     // by default
+ 
+ // Enables password sender service including outgoing password sharing
+ // invitation sync data type.
+ BASE_FEATURE(kPasswordManagerEnableSenderService,
+-             "PasswordManagerEnableSenderService",
+-             base::FEATURE_DISABLED_BY_DEFAULT);
+             "PasswordManagerEnableSenderService",  // must disable
+             base::FEATURE_DISABLED_BY_DEFAULT);    // by default
+ 
+ // Enables logging the content of chrome://password-manager-internals to the
+ // terminal.
+diff --git a/components/password_manager/core/browser/leak_detection/leak_detection_check_factory_impl.cc b/components/password_manager/core/browser/leak_detection/leak_detection_check_factory_impl.cc
+--- a/components/password_manager/core/browser/leak_detection/leak_detection_check_factory_impl.cc
+++ b/components/password_manager/core/browser/leak_detection/leak_detection_check_factory_impl.cc
+@@ -46,6 +46,11 @@ LeakDetectionCheckFactoryImpl::TryCreateLeakCheck(
+     version_info::Channel channel) const {
+   CHECK(identity_manager);
+ 
+  if ((true)) {
+    delegate->OnError(LeakDetectionError::kNotSignIn);
+    return nullptr;
+  }
+
+   return std::make_unique<LeakDetectionCheckImpl>(
+       delegate, identity_manager, std::move(url_loader_factory),
+       GetAPIKey(LeakDetectionCheckImpl::HasAccountForRequest(identity_manager),
+diff --git a/components/password_manager/core/browser/leak_detection/leak_detection_check_impl.cc b/components/password_manager/core/browser/leak_detection/leak_detection_check_impl.cc
+--- a/components/password_manager/core/browser/leak_detection/leak_detection_check_impl.cc
+++ b/components/password_manager/core/browser/leak_detection/leak_detection_check_impl.cc
+@@ -190,9 +190,7 @@ bool LeakDetectionCheckImpl::HasAccountForRequest(
+   // always return something if the user is signed in.
+   // On Android it will be empty if the user isn't syncing. Thus,
+   // GetAccountsWithRefreshTokens() check is necessary.
+-  return identity_manager &&
+-         (identity_manager->HasPrimaryAccount(signin::ConsentLevel::kSignin) ||
+-          !identity_manager->GetAccountsWithRefreshTokens().empty());
+  return false;
+ }
+ 
+ void LeakDetectionCheckImpl::Start(LeakDetectionInitiator initiator,
+--
+2.25.1
@@ -0,0 +1,39 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Sun, 8 Oct 2023 16:04:56 +0000
+Subject: Disable ranker_url_fetcher
+
+License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
+---
+ .../translate/core/browser/translate_ranker_impl.cc    | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/components/translate/core/browser/translate_ranker_impl.cc b/components/translate/core/browser/translate_ranker_impl.cc
+--- a/components/translate/core/browser/translate_ranker_impl.cc
+++ b/components/translate/core/browser/translate_ranker_impl.cc
+@@ -94,11 +94,11 @@ const char kDefaultTranslateRankerModelURL[] =
+ #endif
+ 
+ BASE_FEATURE(kTranslateRankerQuery,
+-             "TranslateRankerQuery",
+-             base::FEATURE_ENABLED_BY_DEFAULT);
+             "TranslateRankerQuery",             // disable
+             base::FEATURE_DISABLED_BY_DEFAULT); // by default
+ BASE_FEATURE(kTranslateRankerEnforcement,
+-             "TranslateRankerEnforcement",
+-             base::FEATURE_ENABLED_BY_DEFAULT);
+             "TranslateRankerEnforcement",        // disable
+             base::FEATURE_DISABLED_BY_DEFAULT);  // by default
+ 
+ BASE_FEATURE(kTranslateRankerPreviousLanguageMatchesOverride,
+              "TranslateRankerPreviousLanguageMatchesOverride",
+@@ -234,7 +234,7 @@ bool TranslateRankerImpl::ShouldOfferTranslation(
+   // absence of a model or if enforcement is disabled. As this is ranker is
+   // subsumed into a more general assist ranker, this default will go away
+   // (or become False).
+-  const bool kDefaultResponse = true;
+  const bool kDefaultResponse = false;
+ 
+   translate_event->set_ranker_request_timestamp_sec(
+       (base::TimeTicks::Now() - base::TimeTicks()).InSeconds());
+--
+2.25.1
@@ -0,0 +1,65 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Tue, 1 Aug 2023 13:56:42 +0000
+Subject: Disable remote altsvc for h3 connections
+
+and only sets the use of port 443
+
+License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
+---
+ net/http/http_server_properties_manager.cc     | 2 +-
+ net/http/http_stream_factory_job_controller.cc | 9 ++-------
+ net/quic/quic_context.h                        | 2 +-
+ 3 files changed, 4 insertions(+), 9 deletions(-)
+
+diff --git a/net/http/http_server_properties_manager.cc b/net/http/http_server_properties_manager.cc
+--- a/net/http/http_server_properties_manager.cc
+++ b/net/http/http_server_properties_manager.cc
+@@ -38,7 +38,7 @@ const int kMissingVersion = 0;
+ const int kVersionNumber = 5;
+ 
+ // Persist at most 200 currently-broken alternative services to disk.
+-const int kMaxBrokenAlternativeServicesToPersist = 200;
+const int kMaxBrokenAlternativeServicesToPersist = 0;
+ 
+ const char kServerKey[] = "server";
+ const char kQuicServerIdKey[] = "server_id";
+diff --git a/net/http/http_stream_factory_job_controller.cc b/net/http/http_stream_factory_job_controller.cc
+--- a/net/http/http_stream_factory_job_controller.cc
+++ b/net/http/http_stream_factory_job_controller.cc
+@@ -1233,11 +1233,7 @@ HttpStreamFactory::JobController::GetAlternativeServiceInfoInternal(
+     // single user on a multi-user system to hijack the alternate protocol.
+     // These systems also enforce ports <1024 as restricted ports.  So don't
+     // allow protocol upgrades to user-controllable ports.
+-    const int kUnrestrictedPort = 1024;
+-    if (!session_->params().enable_user_alternate_protocol_ports &&
+-        (alternative_service_info.alternative_service().port >=
+-             kUnrestrictedPort &&
+-         original_url.EffectiveIntPort() < kUnrestrictedPort))
+    if (alternative_service_info.alternative_service().port != 443)
+       continue;
+ 
+     if (alternative_service_info.protocol() == kProtoHTTP2) {
+@@ -1274,8 +1270,7 @@ HttpStreamFactory::JobController::GetAlternativeServiceInfoInternal(
+ 
+     GURL destination = CreateAltSvcUrl(
+         original_url, alternative_service_info.host_port_pair());
+-    if (session_key.host() != destination.host_piece() &&
+-        !session_->context().quic_context->params()->allow_remote_alt_svc) {
+    if (session_key.host() != destination.host_piece()) {
+       continue;
+     }
+     RewriteUrlWithHostMappingRules(destination);
+diff --git a/net/quic/quic_context.h b/net/quic/quic_context.h
+--- a/net/quic/quic_context.h
+++ b/net/quic/quic_context.h
+@@ -179,7 +179,7 @@ struct NET_EXPORT QuicParams {
+   bool allow_server_migration = false;
+   // If true, allows QUIC to use alternative services with a different
+   // hostname from the origin.
+-  bool allow_remote_alt_svc = true;
+  bool allow_remote_alt_svc = false; // Disabled by default
+   // If true, estimate the initial RTT for QUIC connections based on network.
+   bool estimate_initial_rtt = false;
+   // The initial rtt that will be used in crypto handshake if no cached
+--
+2.25.1
@@ -0,0 +1,188 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Thu, 20 Apr 2023 15:03:13 +0000
+Subject: Disable speechSynthesis getVoices API
+
+Adds flag disable-speechsynthesis-voice-list to disable
+SpeechSynthesis.getVoices() call.
+If not active the user must also set the system timezone override
+to enable it.
+Disable LiveCaption
+Require: Timezone-customization.patch
+
+License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
+---
+ chrome/browser/about_flags.cc                   |  5 +++++
+ .../renderer/chrome_content_renderer_client.cc  |  2 +-
+ .../renderer/content_settings_agent_impl.cc     |  9 ++++++++-
+ .../renderer/content_settings_agent_impl.h      |  2 ++
+ media/base/media_switches.cc                    |  8 ++++----
+ third_party/blink/common/features.cc            |  4 ++++
+ third_party/blink/public/common/features.h      |  2 ++
+ .../platform/web_content_settings_client.h      |  2 ++
+ .../renderer/modules/speech/speech_synthesis.cc | 17 ++++++++++++++---
+ 9 files changed, 42 insertions(+), 9 deletions(-)
+
+diff --git a/chrome/browser/about_flags.cc b/chrome/browser/about_flags.cc
+--- a/chrome/browser/about_flags.cc
+++ b/chrome/browser/about_flags.cc
+@@ -7944,6 +7944,11 @@ const FeatureEntry kFeatureEntries[] = {
+      flag_descriptions::kFileSystemObserverDescription, kOsAll,
+      FEATURE_VALUE_TYPE(blink::features::kFileSystemObserver)},
+ 
+    {"disable-speechsynthesis-voice-list",
+     "Disable speechSynthesis.getVoices()",
+     "Disables access to the list of items installed on the device", kOsAll,
+     FEATURE_VALUE_TYPE(blink::features::kDisableSpeechSynthesisVoiceList)},
+
+     {"strict-origin-isolation", flag_descriptions::kStrictOriginIsolationName,
+      flag_descriptions::kStrictOriginIsolationDescription, kOsAll,
+      FEATURE_VALUE_TYPE(features::kStrictOriginIsolation)},
+diff --git a/chrome/renderer/chrome_content_renderer_client.cc b/chrome/renderer/chrome_content_renderer_client.cc
+--- a/chrome/renderer/chrome_content_renderer_client.cc
+++ b/chrome/renderer/chrome_content_renderer_client.cc
+@@ -1597,7 +1597,7 @@ ChromeContentRendererClient::CreateWorkerContentSettingsClient(
+ std::unique_ptr<media::SpeechRecognitionClient>
+ ChromeContentRendererClient::CreateSpeechRecognitionClient(
+     content::RenderFrame* render_frame) {
+-  return std::make_unique<ChromeSpeechRecognitionClient>(render_frame);
+  return nullptr;
+ }
+ #endif  // BUILDFLAG(ENABLE_SPEECH_SERVICE)
+ 
+diff --git a/components/content_settings/renderer/content_settings_agent_impl.cc b/components/content_settings/renderer/content_settings_agent_impl.cc
+--- a/components/content_settings/renderer/content_settings_agent_impl.cc
+++ b/components/content_settings/renderer/content_settings_agent_impl.cc
+@@ -496,6 +496,14 @@ bool ContentSettingsAgentImpl::IsAllowlistedForContentSettings() const {
+   return false;
+ }
+ 
+bool ContentSettingsAgentImpl::IsTimezoneChanged() {
+  if (!content_setting_rules_)
+    return false;
+  // CONTENT_SETTING_ALLOW = use system time
+  return CONTENT_SETTING_ALLOW != GetContentSetting(
+             ContentSettingsType::TIMEZONE_OVERRIDE, CONTENT_SETTING_ALLOW);
+}
+
+ bool ContentSettingsAgentImpl::UpdateOverrides() {
+   // Evaluate the content setting rules
+   ContentSetting setting = CONTENT_SETTING_ALLOW;
+@@ -506,7 +514,6 @@ bool ContentSettingsAgentImpl::UpdateOverrides() {
+   }
+   return UpdateTimeZoneOverride(
+       setting, content_setting_rules_->timezone_override_value);
+-  //&& UpdateLocaleOverride(setting);
+ }
+ 
+ bool ContentSettingsAgentImpl::UpdateTimeZoneOverride(
+diff --git a/components/content_settings/renderer/content_settings_agent_impl.h b/components/content_settings/renderer/content_settings_agent_impl.h
+--- a/components/content_settings/renderer/content_settings_agent_impl.h
+++ b/components/content_settings/renderer/content_settings_agent_impl.h
+@@ -117,6 +117,8 @@ class ContentSettingsAgentImpl
+   void SetRendererContentSettingRulesForTest(
+       const RendererContentSettingRules& rules);
+ 
+  bool IsTimezoneChanged() override;
+
+  protected:
+   // Allow this to be overridden by tests.
+   virtual void BindContentSettingsManager(
+diff --git a/media/base/media_switches.cc b/media/base/media_switches.cc
+--- a/media/base/media_switches.cc
+++ b/media/base/media_switches.cc
+@@ -915,7 +915,7 @@ const base::FeatureParam<std::string> kMediaFoundationClearKeyCdmPathForTesting{
+ #endif  // BUILDFLAG(IS_WIN)
+ 
+ // Enables the Live Caption feature on supported devices.
+-BASE_FEATURE(kLiveCaption, "LiveCaption", base::FEATURE_ENABLED_BY_DEFAULT);
+BASE_FEATURE(kLiveCaption, "LiveCaption", base::FEATURE_DISABLED_BY_DEFAULT);
+ 
+ // Controls whether a "Share this tab instead" button should be shown for
+ // getDisplayMedia captures. Note: This flag does not control if the "Share this
+@@ -974,9 +974,9 @@ BASE_FEATURE(kLiveCaptionRightClick,
+              base::FEATURE_DISABLED_BY_DEFAULT);
+ 
+ // Enable or disable Live Caption support for WebAudio.
+-BASE_FEATURE(kLiveCaptionWebAudio,
+-             "LiveCaptionWebAudio",
+-             base::FEATURE_ENABLED_BY_DEFAULT);
+BASE_FEATURE(kLiveCaptionWebAudio,               // disabled by
+             "LiveCaptionWebAudio",              // default
+             base::FEATURE_DISABLED_BY_DEFAULT); // in bromite
+ 
+ // Live Caption runs system-wide on ChromeOS, as opposed to just in the browser.
+ BASE_FEATURE(kLiveCaptionSystemWideOnChromeOS,
+diff --git a/third_party/blink/common/features.cc b/third_party/blink/common/features.cc
+--- a/third_party/blink/common/features.cc
+++ b/third_party/blink/common/features.cc
+@@ -653,6 +653,10 @@ BASE_FEATURE(kDirectCompositorThreadIpc,
+              "DirectCompositorThreadIpc",
+              base::FEATURE_DISABLED_BY_DEFAULT);
+ 
+BASE_FEATURE(kDisableSpeechSynthesisVoiceList,
+             "DisableSpeechSynthesisVoiceList",
+             base::FEATURE_ENABLED_BY_DEFAULT);
+
+ BASE_FEATURE(kDisableArrayBufferSizeLimitsForTesting,
+              "DisableArrayBufferSizeLimitsForTesting",
+              base::FEATURE_DISABLED_BY_DEFAULT);
+diff --git a/third_party/blink/public/common/features.h b/third_party/blink/public/common/features.h
+--- a/third_party/blink/public/common/features.h
+++ b/third_party/blink/public/common/features.h
+@@ -330,6 +330,8 @@ extern const base::FeatureParam<double> kCostReductionOfMultiplexedRequests;
+ // hopping through the IO thread first.
+ BLINK_COMMON_EXPORT BASE_DECLARE_FEATURE(kDirectCompositorThreadIpc);
+ 
+BLINK_COMMON_EXPORT BASE_DECLARE_FEATURE(kDisableSpeechSynthesisVoiceList);
+
+ // TODO(https://crbug.com/1201109): temporary flag to disable new ArrayBuffer
+ // size limits, so that tests can be written against code receiving these
+ // buffers. Remove when the bindings code instituting these limits is removed.
+diff --git a/third_party/blink/public/platform/web_content_settings_client.h b/third_party/blink/public/platform/web_content_settings_client.h
+--- a/third_party/blink/public/platform/web_content_settings_client.h
+++ b/third_party/blink/public/platform/web_content_settings_client.h
+@@ -119,6 +119,8 @@ class WebContentSettingsClient {
+   // frame.
+   virtual bool ShouldAutoupgradeMixedContent() { return true; }
+ 
+  virtual bool IsTimezoneChanged() { return false; }
+
+   // Controls whether the ViewTransition callback needs to be larger than
+   // default.
+   virtual bool IncreaseViewTransitionCallbackTimeout() const { return false; }
+diff --git a/third_party/blink/renderer/modules/speech/speech_synthesis.cc b/third_party/blink/renderer/modules/speech/speech_synthesis.cc
+--- a/third_party/blink/renderer/modules/speech/speech_synthesis.cc
+++ b/third_party/blink/renderer/modules/speech/speech_synthesis.cc
+@@ -35,6 +35,7 @@
+ #include "third_party/blink/public/common/privacy_budget/identifiable_token_builder.h"
+ #include "third_party/blink/public/common/thread_safe_browser_interface_broker_proxy.h"
+ #include "third_party/blink/public/platform/platform.h"
+#include "third_party/blink/public/platform/web_content_settings_client.h"
+ #include "third_party/blink/renderer/bindings/modules/v8/v8_speech_synthesis_error_event_init.h"
+ #include "third_party/blink/renderer/bindings/modules/v8/v8_speech_synthesis_event_init.h"
+ #include "third_party/blink/renderer/core/dom/document.h"
+@@ -93,9 +94,19 @@ SpeechSynthesis::SpeechSynthesis(LocalDOMWindow& window)
+ void SpeechSynthesis::OnSetVoiceList(
+     Vector<mojom::blink::SpeechSynthesisVoicePtr> mojom_voices) {
+   voice_list_.clear();
+-  for (auto& mojom_voice : mojom_voices) {
+-    voice_list_.push_back(
+-        MakeGarbageCollected<SpeechSynthesisVoice>(std::move(mojom_voice)));
+  bool allowed = !base::FeatureList::IsEnabled(features::kDisableSpeechSynthesisVoiceList);
+  if (allowed) {
+    auto* frame = GetSupplementable()->GetFrame();
+    if (frame) {
+      blink::WebContentSettingsClient* settings = frame->GetContentSettingsClient();
+      if (settings) allowed = !settings->IsTimezoneChanged();
+    }
+  }
+  if (allowed) {
+    for (auto& mojom_voice : mojom_voices) {
+      voice_list_.push_back(
+          MakeGarbageCollected<SpeechSynthesisVoice>(std::move(mojom_voice)));
+    }
+   }
+   VoicesDidChange();
+ }
+--
+2.25.1
@@ -0,0 +1,66 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Tue, 14 Feb 2023 16:41:42 +0000
+Subject: Disable visited pseudo class
+
+Disable support for pseudo css visited class
+
+License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
+---
+ components/visitedlink/browser/visitedlink_writer.cc | 8 ++++----
+ components/visitedlink/common/visitedlink_common.cc  | 1 +
+ 2 files changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/components/visitedlink/browser/visitedlink_writer.cc b/components/visitedlink/browser/visitedlink_writer.cc
+--- a/components/visitedlink/browser/visitedlink_writer.cc
+++ b/components/visitedlink/browser/visitedlink_writer.cc
+@@ -234,7 +234,7 @@ VisitedLinkWriter::VisitedLinkWriter(content::BrowserContext* browser_context,
+     : browser_context_(browser_context),
+       delegate_(delegate),
+       listener_(std::make_unique<VisitedLinkEventListener>(browser_context)),
+-      persist_to_disk_(persist_to_disk) {}
+      persist_to_disk_(false) {}
+ 
+ VisitedLinkWriter::VisitedLinkWriter(Listener* listener,
+                                      VisitedLinkDelegate* delegate,
+@@ -244,10 +244,10 @@ VisitedLinkWriter::VisitedLinkWriter(Listener* listener,
+                                      int32_t default_table_size)
+     : delegate_(delegate),
+       listener_(listener),
+-      persist_to_disk_(persist_to_disk),
+      persist_to_disk_(false),
+       database_name_override_(filename),
+       table_size_override_(default_table_size),
+-      suppress_rebuild_(suppress_rebuild) {
+      suppress_rebuild_(false) {
+   DCHECK(listener_);
+ }
+ 
+@@ -317,6 +317,7 @@ void VisitedLinkWriter::AddURL(const GURL& url, bool update_file) {
+ }
+ 
+ VisitedLinkWriter::Hash VisitedLinkWriter::TryToAddURL(const GURL& url) {
+  if ((true)) return null_hash_;
+   // Extra check that we are not incognito. This should not happen.
+   // TODO(boliu): Move this check to HistoryService when IsOffTheRecord is
+   // removed from BrowserContext.
+@@ -1033,7 +1034,6 @@ bool VisitedLinkWriter::RebuildTableFromDelegate() {
+ 
+   // TODO(brettw) make sure we have reasonable salt!
+   table_builder_ = new TableBuilder(this, salt_);
+-  delegate_->RebuildTable(table_builder_);
+   return true;
+ }
+ 
+diff --git a/components/visitedlink/common/visitedlink_common.cc b/components/visitedlink/common/visitedlink_common.cc
+--- a/components/visitedlink/common/visitedlink_common.cc
+++ b/components/visitedlink/common/visitedlink_common.cc
+@@ -41,6 +41,7 @@ bool VisitedLinkCommon::IsVisited(const GURL& url) const {
+ }
+ 
+ bool VisitedLinkCommon::IsVisited(Fingerprint fingerprint) const {
+  if ((true)) return false;
+   // Go through the table until we find the item or an empty spot (meaning it
+   // wasn't found). This loop will terminate as long as the table isn't full,
+   // which should be enforced by AddFingerprint.
+--
+2.25.1
@@ -0,0 +1,25 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Sat, 3 Jun 2023 15:09:26 +0000
+Subject: Disallow Android App Scheme as referrer
+
+---
+ chrome/renderer/chrome_content_renderer_client.cc | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/chrome/renderer/chrome_content_renderer_client.cc b/chrome/renderer/chrome_content_renderer_client.cc
+--- a/chrome/renderer/chrome_content_renderer_client.cc
+++ b/chrome/renderer/chrome_content_renderer_client.cc
+@@ -529,11 +529,6 @@ void ChromeContentRendererClient::RenderThreadStarted() {
+   // TODO(nyquist): Add test to ensure this happens when the flag is set.
+   WebSecurityPolicy::RegisterURLSchemeAsDisplayIsolated(dom_distiller_scheme);
+ 
+-#if BUILDFLAG(IS_ANDROID)
+-  WebSecurityPolicy::RegisterURLSchemeAsAllowedForReferrer(
+-      WebString::FromUTF8(content::kAndroidAppScheme));
+-#endif
+-
+   // chrome-search: pages should not be accessible by bookmarklets
+   // or javascript: URLs typed in the omnibox.
+   WebSecurityPolicy::RegisterURLSchemeAsNotAllowingJavascriptURLs(
+--
+2.25.1
@@ -0,0 +1,23 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Sat, 3 Jun 2023 13:11:22 +0000
+Subject: Disallowing MIDI permission by default
+
+License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
+---
+ components/permissions/features.cc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/components/permissions/features.cc b/components/permissions/features.cc
+--- a/components/permissions/features.cc
+++ b/components/permissions/features.cc
+@@ -169,7 +169,7 @@ BASE_FEATURE(kWindowPlacementPermissionAlias,
+ // Enables disallowing MIDI permission by default.
+ BASE_FEATURE(kBlockMidiByDefault,
+              "BlockMidiByDefault",
+-             base::FEATURE_DISABLED_BY_DEFAULT);
+             base::FEATURE_ENABLED_BY_DEFAULT);
+ 
+ }  // namespace features
+ namespace feature_params {
+--
+2.25.1
@@ -0,0 +1,40 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Wed, 23 Aug 2023 13:49:19 +0000
+Subject: Enable Android Dynamic Performance Framework
+
+License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
+---
+ chrome/version.gni                | 2 +-
+ components/viz/common/features.cc | 5 +++--
+ 2 files changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/chrome/version.gni b/chrome/version.gni
+--- a/chrome/version.gni
+++ b/chrome/version.gni
+@@ -75,7 +75,7 @@ if (is_mac) {
+         "trichrome_64_version_code = \"@TRICHROME_64_VERSION_CODE@\" "
+     _version_dictionary_template +=
+         "trichrome_auto_64_version_code = \"@TRICHROME_AUTO_64_VERSION_CODE@\" "
+-    if (target_cpu == "arm64") {
+    if (target_cpu == "arm64" || target_cpu == "x64") {
+       _version_dictionary_template += "trichrome_64_32_high_version_code = \"@TRICHROME_64_32_HIGH_VERSION_CODE@\" "
+       _version_dictionary_template += "trichrome_auto_64_32_high_version_code = \"@TRICHROME_AUTO_64_32_HIGH_VERSION_CODE@\" "
+     }
+diff --git a/components/viz/common/features.cc b/components/viz/common/features.cc
+--- a/components/viz/common/features.cc
+++ b/components/viz/common/features.cc
+@@ -291,9 +291,10 @@ const base::FeatureParam<double> kADPFMidFrameBoostDurationMultiplier{
+ 
+ // If enabled, Chrome includes the Renderer Main thread(s) into the
+ // ADPF(Android Dynamic Performance Framework) hint session.
+// see https://source.chromium.org/chromium/chromium/src/+/e7507d15614ac7f499fb89086b3a09772fa8deb4
+ BASE_FEATURE(kEnableADPFRendererMain,
+-             "EnableADPFRendererMain",
+-             base::FEATURE_DISABLED_BY_DEFAULT);
+             "EnableADPFRendererMain",           // enabled
+             base::FEATURE_ENABLED_BY_DEFAULT);  // by default
+ 
+ // If enabled, surface activation and draw do not block on dependencies.
+ BASE_FEATURE(kDrawImmediatelyWhenInteractive,
+--
+2.25.1
@@ -0,0 +1,97 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Tue, 28 Mar 2023 15:43:18 +0000
+Subject: Enable Document Open Inheritance Removal
+
+License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
+---
+ .../blink/renderer/core/dom/document.cc       | 64 -------------------
+ .../platform/runtime_enabled_features.json5   |  1 -
+ 2 files changed, 65 deletions(-)
+
+diff --git a/third_party/blink/renderer/core/dom/document.cc b/third_party/blink/renderer/core/dom/document.cc
+--- a/third_party/blink/renderer/core/dom/document.cc
+++ b/third_party/blink/renderer/core/dom/document.cc
+@@ -3442,70 +3442,6 @@ void Document::open(LocalDOMWindow* entered_window,
+         // https://chromestatus.com/metrics/feature/timeline/popularity/4375
+         CountUse(WebFeature::kDocumentOpenMutateSandbox);
+       }
+-
+-      if (!RuntimeEnabledFeatures::
+-              DocumentOpenSandboxInheritanceRemovalEnabled()) {
+-        // We inherit the sandbox flags of the entered document, so mask on
+-        // the ones contained in the CSP. The operator| is a bitwise operation
+-        // on the sandbox flags bits. It makes the sandbox policy stricter (or
+-        // as strict) as both policy.
+-        //
+-        // TODO(arthursonzogni): Why merging sandbox flags?
+-        // This doesn't look great at many levels:
+-        // - The browser process won't be notified of the update.
+-        // - The origin won't be made opaque, despite the new flags.
+-        // - The sandbox flags of the document can't be considered to be an
+-        //   immutable property anymore.
+-        //
+-        // Ideally:
+-        // - javascript-url document.
+-        // - XSLT document.
+-        // - document.open.
+-        // should not mutate the security properties of the current document.
+-        // From the browser process point of view, all of those operations are
+-        // not considered to produce new documents. No IPCs are sent, it is as
+-        // if it was a no-op.
+-        //
+-        // TODO(https://crbug.com/1360795) Remove this. Only Chrome implements
+-        // it. Safari/Firefox do not.
+-        dom_window_->GetSecurityContext().SetSandboxFlags(
+-            dom_window_->GetSecurityContext().GetSandboxFlags() |
+-            entered_window->GetSandboxFlags());
+-      }
+-
+-      // We would like to remove this block. See:
+-      // https://docs.google.com/document/d/1_89X4cNUab-PZE0iBDTKIftaQZsFbk7SbFmHbqY54os
+-      //
+-      // This is not specified. Only Webkit/Blink implement it. Gecko doesn't.
+-      //
+-      // 2023-06-02: Removal would impact 0.02% page load.
+-      // https://chromestatus.com/metrics/feature/timeline/popularity/4535
+-      // We hope the document.domain deprecation is going to drive this number
+-      // down quickly:
+-      // https://developer.chrome.com/blog/document-domain-setter-deprecation/
+-      if (!RuntimeEnabledFeatures::DocumentOpenOriginAliasRemovalEnabled()) {
+-        dom_window_->GetSecurityContext().SetSecurityOrigin(
+-            entered_window->GetMutableSecurityOrigin());
+-
+-        // The SecurityOrigin is now shared in between two different window. It
+-        // means mutating one can have side effect on the other.
+-        entered_window->GetMutableSecurityOrigin()
+-            ->set_aliased_by_document_open();
+-      }
+-
+-      // Question: Should we remove the inheritance of the CookieURL via
+-      // document.open?
+-      //
+-      // Arguments in favor of maintaining this behavior include the fact that
+-      // document.open can be used to alter the document's URL. According to
+-      // prior talks, this is necessary for web compatibility. It looks nicer if
+-      // all URL variations change uniformly and simultaneously.
+-      //
+-      // Arguments in favor of eliminating this behavior include the fact that
+-      // cookie URLs are extremely particular pieces of state that resemble the
+-      // origin more than they do actual URLs. The less we inherit via
+-      // document.open, the better.
+-      cookie_url_ = entered_window->document()->CookieURL();
+     }
+   }
+ 
+diff --git a/third_party/blink/renderer/platform/runtime_enabled_features.json5 b/third_party/blink/renderer/platform/runtime_enabled_features.json5
+--- a/third_party/blink/renderer/platform/runtime_enabled_features.json5
+++ b/third_party/blink/renderer/platform/runtime_enabled_features.json5
+@@ -1441,7 +1441,6 @@
+     {
+       name: "DocumentOpenSandboxInheritanceRemoval",
+       status: "stable",
+-      copied_from_base_feature_if: "overridden",
+     },
+     {
+       name: "DocumentPictureInPictureAPI",
+--
+2.25.1
@@ -0,0 +1,105 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Tue, 12 Sep 2023 12:39:23 +0000
+Subject: Enable ImprovedBookmarks by default
+
+License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
+---
+ chrome/android/java/res/layout/bookmark_search_box_row.xml    | 4 ++--
+ .../chromium/chrome/browser/bookmarks/BookmarkFeatures.java   | 2 +-
+ .../browser/bookmarks/BookmarkSearchBoxRowViewBinder.java     | 2 ++
+ .../chromium/chrome/browser/bookmarks/BookmarkUiPrefs.java    | 2 +-
+ .../org/chromium/chrome/browser/bookmarks/BookmarkUtils.java  | 3 ++-
+ chrome/browser/flags/android/chrome_feature_list.cc           | 2 +-
+ 6 files changed, 9 insertions(+), 6 deletions(-)
+
+diff --git a/chrome/android/java/res/layout/bookmark_search_box_row.xml b/chrome/android/java/res/layout/bookmark_search_box_row.xml
+--- a/chrome/android/java/res/layout/bookmark_search_box_row.xml
+++ b/chrome/android/java/res/layout/bookmark_search_box_row.xml
+@@ -58,8 +58,8 @@ found in the LICENSE file.
+ 
+   <LinearLayout
+     android:layout_width="match_parent"
+-    android:layout_height="48dp"
+-    android:layout_marginTop="6dp"
+    android:layout_height="wrap_content"
+    android:layout_marginTop="0dp"
+     android:orientation="horizontal">
+ 
+     <org.chromium.components.browser_ui.widget.chips.ChipView
+diff --git a/chrome/android/java/src/org/chromium/chrome/browser/bookmarks/BookmarkFeatures.java b/chrome/android/java/src/org/chromium/chrome/browser/bookmarks/BookmarkFeatures.java
+--- a/chrome/android/java/src/org/chromium/chrome/browser/bookmarks/BookmarkFeatures.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/bookmarks/BookmarkFeatures.java
+@@ -14,7 +14,7 @@ import org.chromium.chrome.browser.flags.MutableFlagWithSafeDefault;
+  */
+ public class BookmarkFeatures {
+     private static final MutableFlagWithSafeDefault sAndroidImprovedBookmarksFlag =
+-            new MutableFlagWithSafeDefault(ChromeFeatureList.ANDROID_IMPROVED_BOOKMARKS, false);
+            new MutableFlagWithSafeDefault(ChromeFeatureList.ANDROID_IMPROVED_BOOKMARKS, true);
+ 
+     /** Returns whether an additional "add bookmark" item should be in the overflow menu. */
+     public static boolean isBookmarkMenuItemAsDedicatedRowEnabled() {
+diff --git a/chrome/android/java/src/org/chromium/chrome/browser/bookmarks/BookmarkSearchBoxRowViewBinder.java b/chrome/android/java/src/org/chromium/chrome/browser/bookmarks/BookmarkSearchBoxRowViewBinder.java
+--- a/chrome/android/java/src/org/chromium/chrome/browser/bookmarks/BookmarkSearchBoxRowViewBinder.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/bookmarks/BookmarkSearchBoxRowViewBinder.java
+@@ -5,6 +5,7 @@
+ package org.chromium.chrome.browser.bookmarks;
+ 
+ import android.view.View;
+import android.view.ViewGroup;
+ 
+ import androidx.annotation.DrawableRes;
+ import androidx.annotation.StringRes;
+@@ -53,6 +54,7 @@ class BookmarkSearchBoxRowViewBinder {
+     private void bindInternal(PropertyModel model, View view, PropertyKey key) {
+         BookmarkSearchBoxRow row = (BookmarkSearchBoxRow) view;
+         ChipView shoppingChip = view.findViewById(R.id.shopping_filter_chip);
+        shoppingChip.setVisibility(ViewGroup.GONE);
+         if (key == BookmarkSearchBoxRowProperties.SEARCH_TEXT_CHANGE_CALLBACK) {
+             Callback<String> callback =
+                     wrapCallback(model, BookmarkSearchBoxRowProperties.SEARCH_TEXT_CHANGE_CALLBACK);
+diff --git a/chrome/android/java/src/org/chromium/chrome/browser/bookmarks/BookmarkUiPrefs.java b/chrome/android/java/src/org/chromium/chrome/browser/bookmarks/BookmarkUiPrefs.java
+--- a/chrome/android/java/src/org/chromium/chrome/browser/bookmarks/BookmarkUiPrefs.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/bookmarks/BookmarkUiPrefs.java
+@@ -21,7 +21,7 @@ import java.lang.annotation.RetentionPolicy;
+  */
+ public class BookmarkUiPrefs {
+     private static final @BookmarkRowDisplayPref int INITIAL_BOOKMARK_ROW_DISPLAY_PREF =
+-            BookmarkRowDisplayPref.VISUAL;
+            BookmarkRowDisplayPref.COMPACT;
+     private static final @BookmarkRowSortOrder int INITIAL_BOOKMARK_ROW_SORT_ORDER =
+             BookmarkRowSortOrder.MANUAL;
+ 
+diff --git a/chrome/android/java/src/org/chromium/chrome/browser/bookmarks/BookmarkUtils.java b/chrome/android/java/src/org/chromium/chrome/browser/bookmarks/BookmarkUtils.java
+--- a/chrome/android/java/src/org/chromium/chrome/browser/bookmarks/BookmarkUtils.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/bookmarks/BookmarkUtils.java
+@@ -38,6 +38,7 @@ import org.chromium.chrome.browser.app.bookmarks.BookmarkAddEditFolderActivity;
+ import org.chromium.chrome.browser.app.bookmarks.BookmarkEditActivity;
+ import org.chromium.chrome.browser.app.bookmarks.BookmarkFolderPickerActivity;
+ import org.chromium.chrome.browser.app.bookmarks.BookmarkFolderSelectActivity;
+import org.chromium.chrome.browser.bookmarks.BookmarkFeatures;
+ import org.chromium.chrome.browser.bookmarks.BookmarkUiPrefs.BookmarkRowDisplayPref;
+ import org.chromium.chrome.browser.commerce.ShoppingServiceFactory;
+ import org.chromium.chrome.browser.document.ChromeLauncherActivity;
+@@ -405,7 +406,7 @@ public class BookmarkUtils {
+             RecordUserAction.record("MobileBookmarkManagerReopenBookmarksInSameSession");
+         }
+ 
+-        if (DeviceFormFactor.isNonMultiDisplayContextOnTablet(context)) {
+        if (BookmarkFeatures.isAndroidImprovedBookmarksEnabled() || DeviceFormFactor.isNonMultiDisplayContextOnTablet(context)) {
+             showBookmarkManagerOnTablet(context,
+                     activity == null ? null : activity.getComponentName(), url, isIncognito);
+         } else {
+diff --git a/chrome/browser/flags/android/chrome_feature_list.cc b/chrome/browser/flags/android/chrome_feature_list.cc
+--- a/chrome/browser/flags/android/chrome_feature_list.cc
+++ b/chrome/browser/flags/android/chrome_feature_list.cc
+@@ -509,7 +509,7 @@ BASE_FEATURE(kAndroidSearchEngineChoiceNotification,
+ 
+ BASE_FEATURE(kAndroidImprovedBookmarks,
+              "AndroidImprovedBookmarks",
+-             base::FEATURE_DISABLED_BY_DEFAULT);
+             base::FEATURE_ENABLED_BY_DEFAULT);
+ 
+ BASE_FEATURE(kAndroidNoVisibleHintForTablets,
+              "AndroidNoVisibleHintForTablets",
+--
+2.25.1
@@ -0,0 +1,38 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Tue, 14 Feb 2023 16:23:08 +0000
+Subject: Evict the entire FrameTree like desktop
+
+License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
+---
+ components/viz/common/features.cc | 2 +-
+ content/common/features.cc        | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/components/viz/common/features.cc b/components/viz/common/features.cc
+--- a/components/viz/common/features.cc
+++ b/components/viz/common/features.cc
+@@ -233,7 +233,7 @@ BASE_FEATURE(kRendererAllocatesImages,
+ // evicts itself. This differs from Destkop platforms which evict the entire
+ // FrameTree along with the topmost viz::Surface. When this feature is enabled,
+ // Android will begin also evicting the entire FrameTree.
+-BASE_FEATURE(kEvictSubtree, "EvictSubtree", base::FEATURE_ENABLED_BY_DEFAULT);
+BASE_FEATURE(kEvictSubtree, "EvictSubtree", base::FEATURE_ENABLED_BY_DEFAULT); // enabled by default
+ 
+ // If enabled, CompositorFrameSinkClient::OnBeginFrame is also treated as the
+ // DidReceiveCompositorFrameAck. Both in providing the Ack for the previous
+diff --git a/content/common/features.cc b/content/common/features.cc
+--- a/content/common/features.cc
+++ b/content/common/features.cc
+@@ -241,8 +241,8 @@ BASE_FEATURE(kInMemoryCodeCache,
+ // frames. Otherwise only toplevel frames and OOPIF are handled, and other
+ // cases, e.g. PDF tiles are ignored. See https://crbug.com/1360351 for details.
+ BASE_FEATURE(kInnerFrameCompositorSurfaceEviction,
+-             "InnerFrameCompositorSurfaceEviction",
+-             base::FEATURE_ENABLED_BY_DEFAULT);
+             "InnerFrameCompositorSurfaceEviction", // guard this
+             base::FEATURE_ENABLED_BY_DEFAULT);     // guard this
+ 
+ // Enable IOSurface based screen capturer.
+ #if BUILDFLAG(IS_MAC)
+--
+2.25.1
@@ -0,0 +1,494 @@
+From: Your Name <you@example.com>
+Date: Wed, 6 Sep 2023 17:55:01 +0000
+Subject: Fix chromium build bugs
+
+because of
+https://bugs.chromium.org/p/chromium/issues/detail?id=1491776#c10
+---
+ BUILD.gn                                      |  1 -
+ .../AutofillSaveCardBottomSheetBridge.java    |  2 +-
+ .../chromium/chrome/browser/tab/TabImpl.java  |  2 +-
+ .../intent_helper/intent_picker_helpers.cc    |  2 ++
+ ...owser_main_extra_parts_nacl_deprecation.cc |  2 ++
+ .../download/download_ui_safe_browsing_util.h |  2 +-
+ .../api/autofill_private/autofill_util.cc     |  2 ++
+ .../reading_list/reading_list_event_router.h  |  2 +-
+ ...vigation_predictor_metrics_document_data.h |  2 ++
+ chrome/browser/safe_browsing/BUILD.gn         |  1 +
+ .../tpcd/support/tpcd_support_manager.cc      |  2 +-
+ ...ion_consented_debugging_infobar_delegate.h |  2 +-
+ .../read_anything_container_view.cc           | 12 +++----
+ chrome/browser/ui/views/tabs/tab.cc           |  2 +-
+ .../browser/ui/views/tabs/tab_group_header.cc |  2 +-
+ .../app_management_page_handler.cc            |  2 ++
+ chrome/browser/usb/chrome_usb_delegate.cc     |  2 ++
+ .../core/browser/data_model/address.cc        |  2 +-
+ .../autofill/core/browser/form_structure.cc   |  2 ++
+ .../core/browser/webdata/autofill_table.cc    | 36 +++++++++----------
+ .../omnibox/browser/autocomplete_controller.h |  2 +-
+ .../omnibox/browser/omnibox_field_trial.cc    |  4 +--
+ components/omnibox/browser/omnibox_view.cc    |  2 ++
+ .../browser/tailored_word_break_iterator.cc   |  2 +-
+ .../phishing_image_embedder.cc                | 14 ++------
+ content/browser/browser_interface_binders.cc  |  1 +
+ crypto/BUILD.gn                               |  3 ++
+ net/BUILD.gn                                  |  1 +
+ third_party/libevent/BUILD.gn                 |  2 ++
+ 29 files changed, 64 insertions(+), 49 deletions(-)
+
+diff --git a/BUILD.gn b/BUILD.gn
+--- a/BUILD.gn
+++ b/BUILD.gn
+@@ -396,7 +396,6 @@ group("gn_all") {
+           "//android_webview:empty_group",
+           "//android_webview/test",
+           "//android_webview/tools/automated_ui_tests:webview_ui_test_app",
+-          "//android_webview/tools/captured_sites_tests:captured_sites_test_app",
+           "//android_webview/tools/system_webview_shell",
+           "//chrome/android:chrome_junit_tests",
+           "//chrome/android:chrome_public_apk",
+diff --git a/chrome/android/java/src/org/chromium/chrome/browser/autofill/AutofillSaveCardBottomSheetBridge.java b/chrome/android/java/src/org/chromium/chrome/browser/autofill/AutofillSaveCardBottomSheetBridge.java
+--- a/chrome/android/java/src/org/chromium/chrome/browser/autofill/AutofillSaveCardBottomSheetBridge.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/autofill/AutofillSaveCardBottomSheetBridge.java
+@@ -42,7 +42,7 @@ public class AutofillSaveCardBottomSheetBridge {
+                 AutofillSaveCardBottomSheetCoordinator::new);
+     }
+ 
+-    @CalledByNative
+    //@CalledByNative
+     @VisibleForTesting
+     /*package*/ AutofillSaveCardBottomSheetBridge(long nativeAutofillSaveCardBottomSheetBridge,
+             WindowAndroid window, TabModel tabModel, CoordinatorFactory coordinatorFactory) {
+diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tab/TabImpl.java b/chrome/android/java/src/org/chromium/chrome/browser/tab/TabImpl.java
+--- a/chrome/android/java/src/org/chromium/chrome/browser/tab/TabImpl.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/tab/TabImpl.java
+@@ -401,7 +401,7 @@ public class TabImpl implements Tab {
+     }
+ 
+     @Override
+-    @CalledByNative
+    // @CalledByNative
+     public int getId() {
+         return mId;
+     }
+diff --git a/chrome/browser/apps/intent_helper/intent_picker_helpers.cc b/chrome/browser/apps/intent_helper/intent_picker_helpers.cc
+--- a/chrome/browser/apps/intent_helper/intent_picker_helpers.cc
+++ b/chrome/browser/apps/intent_helper/intent_picker_helpers.cc
+@@ -32,6 +32,7 @@
+ namespace apps {
+ namespace {
+ 
+#if BUILDFLAG(IS_MAC)
+ std::vector<apps::IntentPickerAppInfo> CombinePossibleMacAppWithOtherApps(
+     std::vector<apps::IntentPickerAppInfo> apps,
+     absl::optional<apps::IntentPickerAppInfo> mac_app) {
+@@ -40,6 +41,7 @@ std::vector<apps::IntentPickerAppInfo> CombinePossibleMacAppWithOtherApps(
+   }
+   return apps;
+ }
+#endif
+ 
+ PickerEntryType GetPickerEntryType(AppType app_type) {
+   PickerEntryType picker_entry_type = PickerEntryType::kUnknown;
+diff --git a/chrome/browser/chrome_browser_main_extra_parts_nacl_deprecation.cc b/chrome/browser/chrome_browser_main_extra_parts_nacl_deprecation.cc
+--- a/chrome/browser/chrome_browser_main_extra_parts_nacl_deprecation.cc
+++ b/chrome/browser/chrome_browser_main_extra_parts_nacl_deprecation.cc
+@@ -16,6 +16,7 @@
+ 
+ namespace {
+ 
+#if BUILDFLAG(ENABLE_NACL)
+ bool ShouldNaClBeAllowed() {
+   // Enabled by policy.
+   if (g_browser_process->local_state()->GetBoolean(
+@@ -24,6 +25,7 @@ bool ShouldNaClBeAllowed() {
+   }
+   return base::FeatureList::IsEnabled(kNaclAllow);
+ }
+#endif
+ 
+ }  // namespace
+ 
+diff --git a/chrome/browser/download/download_ui_safe_browsing_util.h b/chrome/browser/download/download_ui_safe_browsing_util.h
+--- a/chrome/browser/download/download_ui_safe_browsing_util.h
+++ b/chrome/browser/download/download_ui_safe_browsing_util.h
+@@ -9,7 +9,7 @@ class Profile;
+ 
+ namespace download {
+ class DownloadItem;
+-};
+}
+ 
+ // Utilities for determining how to display a download in the desktop UI based
+ // on Safe Browsing state and verdict.
+diff --git a/chrome/browser/extensions/api/autofill_private/autofill_util.cc b/chrome/browser/extensions/api/autofill_private/autofill_util.cc
+--- a/chrome/browser/extensions/api/autofill_private/autofill_util.cc
+++ b/chrome/browser/extensions/api/autofill_private/autofill_util.cc
+@@ -43,6 +43,7 @@ namespace {
+ // Get the multi-valued element for |type| and return it as a |vector|.
+ // TODO(khorimoto): remove this function since multi-valued types are
+ // deprecated.
+#if BUILDFLAG(IS_ANDROID)
+ std::vector<std::string> GetList(const autofill::AutofillProfile& profile,
+                                  autofill::ServerFieldType type) {
+   std::vector<std::string> list;
+@@ -66,6 +67,7 @@ std::vector<std::string> GetList(const autofill::AutofillProfile& profile,
+ 
+   return list;
+ }
+#endif
+ 
+ // Gets the string corresponding to |type| from |profile|.
+ std::string GetStringFromProfile(const autofill::AutofillProfile& profile,
+diff --git a/chrome/browser/extensions/api/reading_list/reading_list_event_router.h b/chrome/browser/extensions/api/reading_list/reading_list_event_router.h
+--- a/chrome/browser/extensions/api/reading_list/reading_list_event_router.h
+++ b/chrome/browser/extensions/api/reading_list/reading_list_event_router.h
+@@ -33,7 +33,7 @@ class ReadingListEventRouter : public KeyedService,
+ 
+  private:
+   // ReadingListModelObserver:
+-  void ReadingListModelLoaded(const ReadingListModel* model) override{};
+  void ReadingListModelLoaded(const ReadingListModel* model) override {}
+   void ReadingListDidAddEntry(const ReadingListModel* model,
+                               const GURL& url,
+                               reading_list::EntrySource source) override;
+diff --git a/chrome/browser/navigation_predictor/navigation_predictor_metrics_document_data.h b/chrome/browser/navigation_predictor/navigation_predictor_metrics_document_data.h
+--- a/chrome/browser/navigation_predictor/navigation_predictor_metrics_document_data.h
+++ b/chrome/browser/navigation_predictor/navigation_predictor_metrics_document_data.h
+@@ -68,6 +68,8 @@ class NavigationPredictorMetricsDocumentData
+     UserInteractionsData();
+     UserInteractionsData(const UserInteractionsData&);
+ 
+    UserInteractionsData& operator=(UserInteractionsData&&) noexcept = default;
+
+     // True if the anchor element is still in viewport, otherwise false.
+     bool is_in_viewport = false;
+     // True if the pointer is still hovering over the anchor element,
+diff --git a/chrome/browser/safe_browsing/BUILD.gn b/chrome/browser/safe_browsing/BUILD.gn
+--- a/chrome/browser/safe_browsing/BUILD.gn
+++ b/chrome/browser/safe_browsing/BUILD.gn
+@@ -182,6 +182,7 @@ static_library("safe_browsing") {
+       "//components/version_info",
+       "//content/public/browser",
+       "//services/preferences/public/mojom:mojom",
+      "//third_party/flatbuffers:flatbuffers",
+     ]
+     if (safe_browsing_mode == 1) {
+       # "Safe Browsing Full" files in addition to the "basic" ones to use for
+diff --git a/chrome/browser/tpcd/support/tpcd_support_manager.cc b/chrome/browser/tpcd/support/tpcd_support_manager.cc
+--- a/chrome/browser/tpcd/support/tpcd_support_manager.cc
+++ b/chrome/browser/tpcd/support/tpcd_support_manager.cc
+@@ -38,7 +38,7 @@ TpcdSupportManager::TpcdSupportManager(
+     std::unique_ptr<TpcdSupportDelegate> delegate)
+     : content::WebContentsObserver(web_contents),
+       content::WebContentsUserData<TpcdSupportManager>(*web_contents),
+-      delegate_(std::move(delegate)){};
+      delegate_(std::move(delegate)){}
+ 
+ TpcdSupportManager::~TpcdSupportManager() = default;
+ 
+diff --git a/chrome/browser/ui/startup/bidding_and_auction_consented_debugging_infobar_delegate.h b/chrome/browser/ui/startup/bidding_and_auction_consented_debugging_infobar_delegate.h
+--- a/chrome/browser/ui/startup/bidding_and_auction_consented_debugging_infobar_delegate.h
+++ b/chrome/browser/ui/startup/bidding_and_auction_consented_debugging_infobar_delegate.h
+@@ -12,7 +12,7 @@
+ 
+ namespace content {
+ class WebContents;
+-};
+}
+ 
+ // An infobar for Chrome for Testing, which displays a message saying that this
+ // flavor of chrome is unsupported and does not auto-update.
+diff --git a/chrome/browser/ui/views/side_panel/read_anything/read_anything_container_view.cc b/chrome/browser/ui/views/side_panel/read_anything/read_anything_container_view.cc
+--- a/chrome/browser/ui/views/side_panel/read_anything/read_anything_container_view.cc
+++ b/chrome/browser/ui/views/side_panel/read_anything/read_anything_container_view.cc
+@@ -23,12 +23,12 @@
+ 
+ namespace {
+ 
+-int GetNormalizedFontScale(double font_scale) {
+-  DCHECK(font_scale >= kReadAnythingMinimumFontScale &&
+-         font_scale <= kReadAnythingMaximumFontScale);
+-  return (font_scale - kReadAnythingMinimumFontScale) *
+-         (1 / kReadAnythingFontScaleIncrement);
+-}
+// int GetNormalizedFontScale(double font_scale) {
+//   DCHECK(font_scale >= kReadAnythingMinimumFontScale &&
+//          font_scale <= kReadAnythingMaximumFontScale);
+//   return (font_scale - kReadAnythingMinimumFontScale) *
+//          (1 / kReadAnythingFontScaleIncrement);
+// }
+ 
+ }  // namespace
+ 
+diff --git a/chrome/browser/ui/views/tabs/tab.cc b/chrome/browser/ui/views/tabs/tab.cc
+--- a/chrome/browser/ui/views/tabs/tab.cc
+++ b/chrome/browser/ui/views/tabs/tab.cc
+@@ -541,7 +541,7 @@ bool Tab::OnMousePressed(const ui::MouseEvent& event) {
+ }
+ 
+ bool Tab::OnMouseDragged(const ui::MouseEvent& event) {
+-  controller_->ContinueDrag(this, event);
+  (void)controller_->ContinueDrag(this, event); // fix error: ignoring return value of function declared with 'nodiscard' attribute [-Werror,-Wunused-result]
+   return true;
+ }
+ 
+diff --git a/chrome/browser/ui/views/tabs/tab_group_header.cc b/chrome/browser/ui/views/tabs/tab_group_header.cc
+--- a/chrome/browser/ui/views/tabs/tab_group_header.cc
+++ b/chrome/browser/ui/views/tabs/tab_group_header.cc
+@@ -208,7 +208,7 @@ bool TabGroupHeader::OnMousePressed(const ui::MouseEvent& event) {
+ }
+ 
+ bool TabGroupHeader::OnMouseDragged(const ui::MouseEvent& event) {
+-  tab_slot_controller_->ContinueDrag(this, event);
+  (void)tab_slot_controller_->ContinueDrag(this, event);
+   return true;
+ }
+ 
+diff --git a/chrome/browser/ui/webui/app_management/app_management_page_handler.cc b/chrome/browser/ui/webui/app_management/app_management_page_handler.cc
+--- a/chrome/browser/ui/webui/app_management/app_management_page_handler.cc
+++ b/chrome/browser/ui/webui/app_management/app_management_page_handler.cc
+@@ -137,6 +137,7 @@ bool CanShowDefaultAppAssociationsUi() {
+ #endif
+ }
+ 
+#if BUILDFLAG(IS_CHROMEOS)
+ // Returns a list of intent filters that support http/https given an app ID.
+ apps::IntentFilters GetSupportedLinkIntentFilters(Profile* profile,
+                                                   const std::string& app_id) {
+@@ -171,6 +172,7 @@ std::vector<std::string> GetSupportedLinks(Profile* profile,
+   return std::vector<std::string>(supported_links.begin(),
+                                   supported_links.end());
+ }
+#endif
+ 
+ #if !BUILDFLAG(IS_CHROMEOS)
+ std::vector<std::string> GetSupportedLinksForPWAs(
+diff --git a/chrome/browser/usb/chrome_usb_delegate.cc b/chrome/browser/usb/chrome_usb_delegate.cc
+--- a/chrome/browser/usb/chrome_usb_delegate.cc
+++ b/chrome/browser/usb/chrome_usb_delegate.cc
+@@ -46,6 +46,7 @@ UsbChooserContext* GetChooserContext(content::BrowserContext* browser_context) {
+   return profile ? UsbChooserContextFactory::GetForProfile(profile) : nullptr;
+ }
+ 
+#if !BUILDFLAG(IS_ANDROID)
+ UsbConnectionTracker* GetConnectionTracker(
+     content::BrowserContext* browser_context,
+     bool create) {
+@@ -55,6 +56,7 @@ UsbConnectionTracker* GetConnectionTracker(
+   return profile ? UsbConnectionTrackerFactory::GetForProfile(profile, create)
+                  : nullptr;
+ }
+#endif
+ 
+ #if BUILDFLAG(ENABLE_EXTENSIONS)
+ // These extensions can claim the smart card USB class and automatically gain
+diff --git a/components/autofill/core/browser/data_model/address.cc b/components/autofill/core/browser/data_model/address.cc
+--- a/components/autofill/core/browser/data_model/address.cc
+++ b/components/autofill/core/browser/data_model/address.cc
+@@ -59,7 +59,7 @@ Address& Address::operator=(const Address& address) {
+ 
+   structured_address_->CopyFrom(address.GetStructuredAddress());
+   return *this;
+-};
+}
+ 
+ bool Address::operator==(const Address& other) const {
+   if (this == &other)
+diff --git a/components/autofill/core/browser/form_structure.cc b/components/autofill/core/browser/form_structure.cc
+--- a/components/autofill/core/browser/form_structure.cc
+++ b/components/autofill/core/browser/form_structure.cc
+@@ -221,6 +221,7 @@ void EncodeRandomizedValue(const RandomizedEncoder& encoder,
+ //   In that case, use the server prediction instead. In the special case that
+ //   the last specified manual override is a pass through, copy all server
+ //   predictions.
+#if !BUILDFLAG(IS_ANDROID)
+ std::deque<FieldSuggestion> MergeManualAndServerOverrides(
+     std::deque<FieldSuggestion> manual_overrides,
+     std::deque<FieldSuggestion> server_overrides) {
+@@ -246,6 +247,7 @@ std::deque<FieldSuggestion> MergeManualAndServerOverrides(
+ 
+   return result;
+ }
+#endif
+ 
+ void PopulateRandomizedFormMetadata(const RandomizedEncoder& encoder,
+                                     const FormStructure& form,
+diff --git a/components/autofill/core/browser/webdata/autofill_table.cc b/components/autofill/core/browser/webdata/autofill_table.cc
+--- a/components/autofill/core/browser/webdata/autofill_table.cc
+++ b/components/autofill/core/browser/webdata/autofill_table.cc
+@@ -961,24 +961,24 @@ time_t GetEndTime(const base::Time& end) {
+ // Returns |s| with |escaper| in front of each of occurrence of a character
+ // from |special_chars|. Any occurrence of |escaper| in |s| is doubled. For
+ // example, Substitute("hello_world!", "_%", '!'') returns "hello!_world!!".
+-std::u16string Substitute(const std::u16string& s,
+-                          const std::u16string& special_chars,
+-                          const char16_t& escaper) {
+-  // Prepend |escaper| to the list of |special_chars|.
+-  std::u16string escape_wildcards(special_chars);
+-  escape_wildcards.insert(escape_wildcards.begin(), escaper);
+-
+-  // Prepend the |escaper| just before |special_chars| in |s|.
+-  std::u16string result(s);
+-  for (char16_t c : escape_wildcards) {
+-    for (size_t pos = 0; (pos = result.find(c, pos)) != std::u16string::npos;
+-         pos += 2) {
+-      result.insert(result.begin() + pos, escaper);
+-    }
+-  }
+-
+-  return result;
+-}
+// std::u16string Substitute(const std::u16string& s,
+//                           const std::u16string& special_chars,
+//                           const char16_t& escaper) {
+//   // Prepend |escaper| to the list of |special_chars|.
+//   std::u16string escape_wildcards(special_chars);
+//   escape_wildcards.insert(escape_wildcards.begin(), escaper);
+
+//   // Prepend the |escaper| just before |special_chars| in |s|.
+//   std::u16string result(s);
+//   for (char16_t c : escape_wildcards) {
+//     for (size_t pos = 0; (pos = result.find(c, pos)) != std::u16string::npos;
+//          pos += 2) {
+//       result.insert(result.begin() + pos, escaper);
+//     }
+//   }
+
+//   return result;
+// }
+ 
+ // This helper function binds the `profile`s properties to the placeholders in
+ // `s`, in the order the columns are defined in the header file.
+diff --git a/components/omnibox/browser/autocomplete_controller.h b/components/omnibox/browser/autocomplete_controller.h
+--- a/components/omnibox/browser/autocomplete_controller.h
+++ b/components/omnibox/browser/autocomplete_controller.h
+@@ -208,7 +208,7 @@ class AutocompleteController : public AutocompleteProviderListener,
+   OpenTabProvider* open_tab_provider() const { return open_tab_provider_; }
+ 
+   const AutocompleteInput& input() const { return input_; }
+-  const AutocompleteResult& result() const { return published_result_; };
+  const AutocompleteResult& result() const { return published_result_; }
+   // Groups `published_result_` by search vs URL.
+   // See also `AutocompleteResult::GroupSuggestionsBySearchVsURL()`.
+   void GroupSuggestionsBySearchVsURL(size_t begin, size_t end);
+diff --git a/components/omnibox/browser/omnibox_field_trial.cc b/components/omnibox/browser/omnibox_field_trial.cc
+--- a/components/omnibox/browser/omnibox_field_trial.cc
+++ b/components/omnibox/browser/omnibox_field_trial.cc
+@@ -1090,11 +1090,11 @@ MLConfig::MLConfig(const MLConfig&) = default;
+ 
+ ScopedMLConfigForTesting::ScopedMLConfigForTesting()
+     : original_config_(std::make_unique<MLConfig>(GetMLConfig())) {
+-  GetMLConfigInternal() = {};
+  //GetMLConfigInternal() = {};
+ }
+ 
+ ScopedMLConfigForTesting::~ScopedMLConfigForTesting() {
+-  GetMLConfigInternal() = *original_config_;
+  //GetMLConfigInternal() = *original_config_;
+ }
+ 
+ MLConfig& ScopedMLConfigForTesting::GetMLConfig() {
+diff --git a/components/omnibox/browser/omnibox_view.cc b/components/omnibox/browser/omnibox_view.cc
+--- a/components/omnibox/browser/omnibox_view.cc
+++ b/components/omnibox/browser/omnibox_view.cc
+@@ -56,12 +56,14 @@ bool RichAutocompletionEitherNonPrefixEnabled() {
+              kRichAutocompletionAutocompleteNonPrefixShortcutProvider.Get();
+ }
+ 
+#if !BUILDFLAG(IS_ANDROID) && !BUILDFLAG(IS_IOS)
+ // Return true if the given match uses a vector icon with a background.
+ bool HasVectorIconBackground(const AutocompleteMatch& match) {
+   return OmniboxFieldTrial::IsActionsUISimplificationEnabled() &&
+          (match.type == AutocompleteMatchType::HISTORY_CLUSTER ||
+           match.type == AutocompleteMatchType::PEDAL);
+ }
+#endif
+ 
+ }  // namespace
+ 
+diff --git a/components/omnibox/browser/tailored_word_break_iterator.cc b/components/omnibox/browser/tailored_word_break_iterator.cc
+--- a/components/omnibox/browser/tailored_word_break_iterator.cc
+++ b/components/omnibox/browser/tailored_word_break_iterator.cc
+@@ -18,7 +18,7 @@ TailoredWordBreakIterator::TailoredWordBreakIterator(
+       pos_(0),
+       word_breaks_{u"0123456789"},
+       non_word_breaks_{u"_"},
+-      all_breaks_{word_breaks_ + non_word_breaks_} {};
+      all_breaks_{word_breaks_ + non_word_breaks_} {}
+ 
+ TailoredWordBreakIterator::~TailoredWordBreakIterator() {}
+ 
+diff --git a/components/safe_browsing/content/renderer/phishing_classifier/phishing_image_embedder.cc b/components/safe_browsing/content/renderer/phishing_classifier/phishing_image_embedder.cc
+--- a/components/safe_browsing/content/renderer/phishing_classifier/phishing_image_embedder.cc
+++ b/components/safe_browsing/content/renderer/phishing_classifier/phishing_image_embedder.cc
+@@ -52,17 +52,9 @@ void PhishingImageEmbedder::BeginImageEmbedding(DoneCallback done_callback) {
+ }
+ 
+ void PhishingImageEmbedder::OnPlaybackDone(std::unique_ptr<SkBitmap> bitmap) {
+-  if (bitmap) {
+-    bitmap_ = std::move(bitmap);
+-    ScorerStorage::GetInstance()
+-        ->GetScorer()
+-        ->ApplyVisualTfLiteModelImageEmbedding(
+-            *bitmap_,
+-            base::BindOnce(&PhishingImageEmbedder::OnImageEmbeddingDone,
+-                           weak_factory_.GetWeakPtr()));
+-  } else {
+-    RunFailureCallback();
+-  }
+  // (UAZO) removed due error:
+  // no member named 'ApplyVisualTfLiteModelImageEmbedding' in 'safe_browsing::Scorer'
+  RunFailureCallback();
+ }
+ 
+ void PhishingImageEmbedder::CancelPendingImageEmbedding() {
+diff --git a/content/browser/browser_interface_binders.cc b/content/browser/browser_interface_binders.cc
+--- a/content/browser/browser_interface_binders.cc
+++ b/content/browser/browser_interface_binders.cc
+@@ -346,6 +346,7 @@ void BindDateTimeChooserForFrame(
+ void BindTextSuggestionHostForFrame(
+     RenderFrameHost* host,
+     mojo::PendingReceiver<blink::mojom::TextSuggestionHost> receiver) {
+  if ((true)) return;
+   auto* view = static_cast<RenderWidgetHostViewAndroid*>(host->GetView());
+   if (!view || !view->text_suggestion_host())
+     return;
+diff --git a/crypto/BUILD.gn b/crypto/BUILD.gn
+--- a/crypto/BUILD.gn
+++ b/crypto/BUILD.gn
+@@ -14,6 +14,9 @@ buildflag_header("buildflags") {
+ }
+ 
+ component("crypto") {
+  # fix error
+  # [chromium-rawptr] Use raw_ptr<T> instead of a raw pointer.
+  configs -= [ "//build/config/clang:find_bad_constructs" ]
+   output_name = "crcrypto"  # Avoid colliding with OpenSSL's libcrypto.
+   sources = [
+     "aead.cc",
+diff --git a/net/BUILD.gn b/net/BUILD.gn
+--- a/net/BUILD.gn
+++ b/net/BUILD.gn
+@@ -1651,6 +1651,7 @@ component("net") {
+     configs -= [ "//build/config/compiler:default_optimization" ]
+     configs += [ "//build/config/compiler:optimize_max" ]
+   }
+  configs -= [ "//build/config/clang:find_bad_constructs" ]
+ }
+ 
+ # net_export.h has its own build target so that code (eg
+diff --git a/third_party/libevent/BUILD.gn b/third_party/libevent/BUILD.gn
+--- a/third_party/libevent/BUILD.gn
+++ b/third_party/libevent/BUILD.gn
+@@ -69,6 +69,8 @@ static_library("libevent") {
+     configs += [ "//build/config/compiler:optimize_max" ]
+   }
+ 
+  configs -= [ "//build/config/clang:find_bad_constructs" ]
+
+   configs -= [ "//build/config/compiler:chromium_code" ]
+   configs += [ "//build/config/compiler:no_chromium_code" ]
+ }
+--
+2.25.1
@@ -0,0 +1,23 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Thu, 7 Sep 2023 06:15:28 +0000
+Subject: Fix crash on customize profile ui
+
+License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
+---
+ .../webui/customize_themes/chrome_customize_themes_handler.cc   | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/chrome/browser/ui/webui/customize_themes/chrome_customize_themes_handler.cc b/chrome/browser/ui/webui/customize_themes/chrome_customize_themes_handler.cc
+--- a/chrome/browser/ui/webui/customize_themes/chrome_customize_themes_handler.cc
+++ b/chrome/browser/ui/webui/customize_themes/chrome_customize_themes_handler.cc
+@@ -79,7 +79,7 @@ void ChromeCustomizeThemesHandler::GetChromeThemes(
+     auto theme_colors = GetAutogeneratedThemeColors(color_info.color);
+     auto theme = customize_themes::mojom::ChromeTheme::New();
+     theme->id = color_info.id;
+-    theme->label = l10n_util::GetStringUTF8(color_info.label_id);
+    //theme->label = l10n_util::GetStringUTF8(color_info.label_id);
+     auto colors = customize_themes::mojom::ThemeColors::New();
+     colors->frame = theme_colors.frame_color;
+     colors->active_tab = theme_colors.active_tab_color;
+--
+2.25.1
@@ -0,0 +1,626 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Wed, 1 Mar 2023 15:37:55 +0000
+Subject: Fonts fingerprinting mitigation
+
+The patch disables the use of non-standard fonts by blink,
+used for device fingerprinting.
+Access to local fonts and downloading fonts via Android
+Downloadable Fonts API is disabled.
+In windows, the patch exposes only fonts from the default
+installation based on the user language exposed to the websites,
+eliminating the ability to retrieve fonts handled differently
+by gdi and directwrite.
+It is possible to restore the original behavior via the
+fonts-fingerprint-mitigation flag, which is active by default.
+
+License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
+---
+ chrome/browser/about_flags.cc                 |   5 +
+ chrome/browser/flag_descriptions.cc           |   5 +
+ chrome/browser/flag_descriptions.h            |   3 +
+ content/common/features.cc                    |   8 +-
+ skia/ext/skia_utils_win.cc                    |  20 ++
+ skia/ext/skia_utils_win.h                     |   3 +
+ third_party/blink/common/features.cc          |   6 +-
+ third_party/blink/public/common/features.h    |   3 +
+ third_party/blink/renderer/platform/BUILD.gn  |   1 +
+ .../renderer/platform/fonts/font_cache.h      |   2 +-
+ .../fonts/skia/bromite_allowed_fonts.h        | 270 ++++++++++++++++++
+ .../platform/fonts/skia/font_cache_skia.cc    |  44 ++-
+ .../platform/fonts/win/font_cache_skia_win.cc |   7 +-
+ 13 files changed, 363 insertions(+), 14 deletions(-)
+ create mode 100644 third_party/blink/renderer/platform/fonts/skia/bromite_allowed_fonts.h
+
+diff --git a/chrome/browser/about_flags.cc b/chrome/browser/about_flags.cc
+--- a/chrome/browser/about_flags.cc
+++ b/chrome/browser/about_flags.cc
+@@ -10408,6 +10408,11 @@ const FeatureEntry kFeatureEntries[] = {
+                                     kClipboardMaximumAgeVariations,
+                                     "ClipboardMaximumAge")},
+ 
+    {"fonts-fingerprint-mitigation",
+     flag_descriptions::kFontsFingerprintMitigationName,
+     flag_descriptions::kFontsFingerprintMitigationDescription, kOsAll,
+     FEATURE_VALUE_TYPE(blink::features::kFontsFingerprintMitigation)},
+
+ #if BUILDFLAG(IS_CHROMEOS_ASH)
+     {"enable-media-dynamic-cgroup", flag_descriptions::kMediaDynamicCgroupName,
+      flag_descriptions::kMediaDynamicCgroupDescription, kOsCrOS,
+diff --git a/chrome/browser/flag_descriptions.cc b/chrome/browser/flag_descriptions.cc
+--- a/chrome/browser/flag_descriptions.cc
+++ b/chrome/browser/flag_descriptions.cc
+@@ -159,6 +159,11 @@ const char kClipboardUnsanitizedContentDescription[] =
+     "Allows reading/writing unsanitized content from/to the clipboard. "
+     "Currently, it is only applicable to HTML format. See crbug.com/1268679.";
+ 
+const char kFontsFingerprintMitigationName[] =
+    "Enable fonts fingerprint mitigation";
+const char kFontsFingerprintMitigationDescription[] =
+    "Filters the list of fonts allowing only standard ones to be used.";
+
+ const char kChromeRootStoreEnabledName[] = "Chrome Root Store";
+ const char kChromeRootStoreEnabledDescription[] =
+     "Enable use of Chrome Root Store over platform roots. "
+diff --git a/chrome/browser/flag_descriptions.h b/chrome/browser/flag_descriptions.h
+--- a/chrome/browser/flag_descriptions.h
+++ b/chrome/browser/flag_descriptions.h
+@@ -131,6 +131,9 @@ extern const char kClickToCallDescription[];
+ extern const char kClipboardUnsanitizedContentName[];
+ extern const char kClipboardUnsanitizedContentDescription[];
+ 
+extern const char kFontsFingerprintMitigationName[];
+extern const char kFontsFingerprintMitigationDescription[];
+
+ extern const char kClipboardMaximumAgeName[];
+ extern const char kClipboardMaximumAgeDescription[];
+ 
+diff --git a/content/common/features.cc b/content/common/features.cc
+--- a/content/common/features.cc
+++ b/content/common/features.cc
+@@ -21,8 +21,8 @@ BASE_FEATURE(kAllowContentInitiatedDataUrlNavigations,
+ // Allows Blink to request fonts from the Android Downloadable Fonts API through
+ // the service implemented on the Java side.
+ BASE_FEATURE(kAndroidDownloadableFontsMatching,
+-             "AndroidDownloadableFontsMatching",
+-             base::FEATURE_ENABLED_BY_DEFAULT);
+             "AndroidDownloadableFontsMatching", // disabled
+             base::FEATURE_DISABLED_BY_DEFAULT); // by default
+ 
+ // The following two features, when enabled, result in the browser process only
+ // asking the renderer process to run beforeunload handlers if it knows such
+@@ -195,8 +195,8 @@ const base::FeatureParam<int> kFledgeLimitNumAuctionsParam{
+ // font name or postscript name. Rolling out behind a flag, as enabling this
+ // enables a font indexer on Android which we need to test in the field first.
+ BASE_FEATURE(kFontSrcLocalMatching,
+-             "FontSrcLocalMatching",
+-             base::FEATURE_ENABLED_BY_DEFAULT);
+             "FontSrcLocalMatching",             // disable
+             base::FEATURE_DISABLED_BY_DEFAULT); // by default
+ 
+ // Feature controlling whether or not memory pressure signals will be forwarded
+ // to the GPU process.
+diff --git a/skia/ext/skia_utils_win.cc b/skia/ext/skia_utils_win.cc
+--- a/skia/ext/skia_utils_win.cc
+++ b/skia/ext/skia_utils_win.cc
+@@ -364,6 +364,26 @@ void CreateBitmapHeaderForXRGB888(int width,
+   CreateBitmapHeaderWithColorDepth(width, height, 32, hdr);
+ }
+ 
+void DWriteFontTypeface_GetGDIFamilyName(SkTypeface* typeface, SkString* familyName) {
+  DWriteFontTypeface* tf = reinterpret_cast<DWriteFontTypeface*>(typeface);
+  SkString localSkGDIName;
+  SkTScopedComPtr<IDWriteLocalizedStrings> familyNames;
+  BOOL exists = FALSE;
+  if (FAILED(tf->fDWriteFont->GetInformationalStrings(
+                  DWRITE_INFORMATIONAL_STRING_WIN32_FAMILY_NAMES,
+                  &familyNames,
+                  &exists)) ||
+      !exists ||
+      FAILED(sk_get_locale_string(familyNames.get(), nullptr, &localSkGDIName)))
+  {
+      HRV(tf->fDWriteFontFamily->GetFamilyNames(&familyNames));
+      sk_get_locale_string(familyNames.get(), nullptr/*fMgr->fLocaleName.get()*/, familyName);
+  }
+  if (familyName) {
+      *familyName = localSkGDIName;
+  }
+}
+
+ base::win::ScopedBitmap CreateHBitmapXRGB8888(int width,
+                                               int height,
+                                               HANDLE shared_section,
+diff --git a/skia/ext/skia_utils_win.h b/skia/ext/skia_utils_win.h
+--- a/skia/ext/skia_utils_win.h
+++ b/skia/ext/skia_utils_win.h
+@@ -13,6 +13,7 @@
+ #include "third_party/skia/include/core/SkImageInfo.h"
+ #include "third_party/skia/include/core/SkMatrix.h"
+ #include "third_party/skia/include/core/SkRefCnt.h"
+#include "third_party/skia/src/ports/SkTypeface_win_dw.h"
+ 
+ #include "build/build_config.h"
+ #include <windows.h>
+@@ -113,6 +114,8 @@ SK_API void CreateBitmapHeaderForXRGB888(int width,
+                                          int height,
+                                          BITMAPINFOHEADER* hdr);
+ 
+SK_API void DWriteFontTypeface_GetGDIFamilyName(SkTypeface* tf, SkString* familyName);
+
+ // Creates an HBITMAP backed by 32-bits-per-pixel RGB data (the high bits are
+ // unused in each pixel).
+ SK_API base::win::ScopedBitmap CreateHBitmapXRGB8888(
+diff --git a/third_party/blink/common/features.cc b/third_party/blink/common/features.cc
+--- a/third_party/blink/common/features.cc
+++ b/third_party/blink/common/features.cc
+@@ -923,7 +923,7 @@ BASE_FEATURE(kFrequencyCappingForOverlayPopupDetection,
+              "FrequencyCappingForOverlayPopupDetection",
+              base::FEATURE_ENABLED_BY_DEFAULT);
+ 
+-BASE_FEATURE(kGMSCoreEmoji, "GMSCoreEmoji", base::FEATURE_ENABLED_BY_DEFAULT);
+BASE_FEATURE(kGMSCoreEmoji, "GMSCoreEmoji", base::FEATURE_DISABLED_BY_DEFAULT);
+ 
+ BASE_FEATURE(kGainmapHdrImages,
+              "GainmapHdrImages",
+@@ -2036,6 +2036,10 @@ BASE_FEATURE(kWebRtcH264WithOpenH264FFmpeg,
+              base::FEATURE_ENABLED_BY_DEFAULT);
+ #endif  // BUILDFLAG(RTC_USE_H264) && BUILDFLAG(ENABLE_FFMPEG_VIDEO_DECODERS)
+ 
+BASE_FEATURE(kFontsFingerprintMitigation,
+             "FontsFingerprintMitigation",
+             base::FEATURE_ENABLED_BY_DEFAULT);
+
+ // Exposes non-standard stats in the WebRTC getStats() API.
+ BASE_FEATURE(kWebRtcExposeNonStandardStats,
+              "WebRtc-ExposeNonStandardStats",
+diff --git a/third_party/blink/public/common/features.h b/third_party/blink/public/common/features.h
+--- a/third_party/blink/public/common/features.h
+++ b/third_party/blink/public/common/features.h
+@@ -249,6 +249,9 @@ BLINK_COMMON_EXPORT BASE_DECLARE_FEATURE(kCompressParkableStrings);
+ BLINK_COMMON_EXPORT extern const base::FeatureParam<int>
+     kMaxDiskDataAllocatorCapacityMB;
+ 
+// Filter the list of fonts allowing the use of only standard fonts
+BLINK_COMMON_EXPORT BASE_DECLARE_FEATURE(kFontsFingerprintMitigation);
+
+ BLINK_COMMON_EXPORT BASE_DECLARE_FEATURE(kConsumeCodeCacheOffThread);
+ 
+ BLINK_COMMON_EXPORT BASE_DECLARE_FEATURE(kContentCaptureConstantStreaming);
+diff --git a/third_party/blink/renderer/platform/BUILD.gn b/third_party/blink/renderer/platform/BUILD.gn
+--- a/third_party/blink/renderer/platform/BUILD.gn
+++ b/third_party/blink/renderer/platform/BUILD.gn
+@@ -755,6 +755,7 @@ component("platform") {
+     "fonts/simple_font_data.cc",
+     "fonts/simple_font_data.h",
+     "fonts/skia/font_cache_skia.cc",
+    "fonts/skia/bromite_allowed_fonts.h",
+     "fonts/skia/skia_text_metrics.cc",
+     "fonts/skia/skia_text_metrics.h",
+     "fonts/skia/sktypeface_factory.cc",
+diff --git a/third_party/blink/renderer/platform/fonts/font_cache.h b/third_party/blink/renderer/platform/fonts/font_cache.h
+--- a/third_party/blink/renderer/platform/fonts/font_cache.h
+++ b/third_party/blink/renderer/platform/fonts/font_cache.h
+@@ -328,7 +328,7 @@ class PLATFORM_EXPORT FontCache final {
+ 
+   sk_sp<SkTypeface> CreateTypeface(const FontDescription&,
+                                    const FontFaceCreationParams&,
+-                                   std::string& name);
+                                   std::string& name, std::string& original_name);
+ 
+ #if BUILDFLAG(IS_ANDROID) || BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_CHROMEOS)
+   static AtomicString GetFamilyNameForCharacter(SkFontMgr*,
+diff --git a/third_party/blink/renderer/platform/fonts/skia/bromite_allowed_fonts.h b/third_party/blink/renderer/platform/fonts/skia/bromite_allowed_fonts.h
+new file mode 100644
+--- /dev/null
+++ b/third_party/blink/renderer/platform/fonts/skia/bromite_allowed_fonts.h
+@@ -0,0 +1,270 @@
+/*
+    This file is part of Bromite.
+
+    Bromite is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    Bromite is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with Bromite. If not, see <https://www.gnu.org/licenses/>.
+*/
+
+#include "base/logging.h"
+#include "base/command_line.h"
+#include "ui/base/ui_base_switches.h"
+#include "base/strings/string_util.h"
+
+namespace blink {
+
+const char16_t* kAllowedFontNames[] = {
+    u"Sans",     u"Arial",   u"MS UI Gothic",    u"Microsoft Sans Serif",
+    u"Segoe UI", u"Calibri", u"Times New Roman", u"Courier New",
+    // also used
+    u"Monospace",
+#if BUILDFLAG(IS_ANDROID)
+    u"default", u"sans-serif", u"serif", u"cursive", u"fantasy",
+    u"Courier", u"Courier 10 Pitch", u"Courier New"
+#endif
+#if BUILDFLAG(IS_WIN)
+    // see https://learn.microsoft.com/en-us/typography/fonts/windows_11_font_list
+    u"Arial", u"Arial Italic", u"Arial Bold", u"Arial Bold Italic", u"Arial Black",
+    u"Bahnschrift", u"Bahnschrift Light", u"Bahnschrift SemiBold",
+    u"Calibri Light", u"Calibri Light Italic", u"Calibri", u"Calibri Italic",
+    u"Calibri Bold", u"Calibri Bold Italic", u"Cambria", u"Cambria Italic",
+    u"Cambria Bold", u"Cambria Bold Italic", u"Cambria Math", u"Candara Light",
+    u"Candara Light Italic", u"Candara", u"Candara Italic", u"Candara Bold",
+    u"Candara Bold Italic", u"Cascadia Code ExtraLight", u"Cascadia Code ExtraLight Italic",
+    u"Cascadia Code Light", u"Cascadia Code Light Italic", u"Cascadia Code SemiLight",
+    u"Cascadia Code SemiLight Italic", u"Cascadia Code Regular", u"Cascadia Code Italic",
+    u"Cascadia Code SemiBold", u"Cascadia Code SemiBold Italic", u"Cascadia Code Bold",
+    u"Cascadia Code Bold Italic", u"Cascadia Mono ExtraLight", u"Cascadia Mono ExtraLight Italic",
+    u"Cascadia Mono Light", u"Cascadia Mono Light Italic", u"Cascadia Mono SemiLight",
+    u"Cascadia Mono SemiLight Italic", u"Cascadia Mono Regular", u"Cascadia Mono Italic",
+    u"Cascadia Mono SemiBold", u"Cascadia Mono SemiBold Italic", u"Cascadia Mono Bold",
+    u"Cascadia Mono Bold Italic", u"Comic Sans MS", u"Comic Sans MS Italic", u"Comic Sans MS Bold",
+    u"Comic Sans MS Bold Italic", u"Consolas", u"Consolas Italic", u"Consolas Bold",
+    u"Consolas Bold Italic", u"Constantia", u"Constantia Italic", u"Constantia Bold",
+    u"Constantia Bold Italic", u"Corbel Light", u"Corbel Light Italic", u"Corbel",
+    u"Corbel Italic", u"Corbel Bold", u"Corbel Bold Italic", u"Courier New",
+    u"Courier New Italic", u"Courier New Bold", u"Courier New Bold Italic", u"Ebrima",
+    u"Ebrima Bold", u"Franklin Gothic", u"Franklin Gothic Medium", u"Franklin Gothic Medium Italic",
+    u"Gabriola", u"Gadugi", u"Gadugi Bold", u"Georgia", u"Georgia Italic",
+    u"Georgia Bold", u"Georgia Bold Italic", u"HoloLens MDL2 Assets", u"Impact",
+    u"Ink Free", u"Javanese Text", u"Leelawadee UI", u"Leelawadee UI Semilight",
+    u"Leelawadee UI Bold", u"Lucida Console", u"Lucida Sans Unicode", u"Malgun Gothic",
+    u"Malgun Gothic Bold", u"Malgun Gothic Semilight", u"Marlett", u"Microsoft Himalaya",
+    u"Microsoft JhengHei Light", u"Microsoft JhengHei", u"Microsoft JhengHei Bold",
+    u"Microsoft JhengHei UI Light", u"Microsoft JhengHei UI", u"Microsoft JhengHei UI Bold",
+    u"Microsoft New Tai Lue", u"Microsoft New Tai Lue Bold", u"Microsoft PhagsPa",
+    u"Microsoft PhagsPa Bold", u"Microsoft Sans Serif", u"Microsoft Tai Le",
+    u"Microsoft Tai Le Bold", u"Microsoft YaHei Light", u"Microsoft YaHei",
+    u"Microsoft YaHei Bold", u"Microsoft YaHei UI Light", u"Microsoft YaHei UI",
+    u"Microsoft YaHei UI Bold", u"Microsoft Yi Baiti", u"MingLiU-ExtB",
+    u"PMingLiU-ExtB", u"MingLiU_HKSCS-ExtB", u"Mongolian Baiti", u"MS Gothic",
+    u"MS PGothic", u"MS UI Gothic", u"MV Boli", u"Myanmar Text", u"Myanmar Text Bold",
+    u"Nirmala UI Semilight", u"Nirmala UI", u"Nirmala UI Bold", u"Palatino Linotype",
+    u"Palatino Linotype Italic", u"Palatino Linotype Bold", u"Palatino Linotype Bold Italic",
+    u"Segoe Fluent Icons", u"Segoe MDL2 Assets", u"Segoe Print", u"Segoe Print Bold",
+    u"Segoe Script", u"Segoe Script Bold", u"Segoe UI Light", u"Segoe UI Light Italic",
+    u"Segoe UI Semilight", u"Segoe UI Semilight Italic", u"Segoe UI", u"Segoe UI Italic",
+    u"Segoe UI Semibold", u"Segoe UI Semibold Italic", u"Segoe UI Bold", u"Segoe UI Bold Italic",
+    u"Segoe UI Black", u"Segoe UI Black Italic", u"Segoe UI Emoji", u"Segoe UI Historic",
+    u"Segoe UI Symbol", u"Segoe UI Variable Display Light", u"Segoe UI Variable Display Semilight",
+    u"Segoe UI Variable Display Regular", u"Segoe UI Variable Display Semibold",
+    u"Segoe UI Variable Display Bold", u"Segoe UI Variable Small Light",
+    u"Segoe UI Variable Small Semilight", u"Segoe UI Variable Small Regular",
+    u"Segoe UI Variable Small Semibold", u"Segoe UI Variable Small Bold",
+    u"Segoe UI Variable Text Light", u"Segoe UI Variable Text Semilight",
+    u"Segoe UI Variable Text Regular", u"Segoe UI Variable Text Semibold",
+    u"Segoe UI Variable Text Bold", u"SimSun", u"NSimSun", u"SimSun-ExtB", u"Sitka Banner",
+    u"Sitka Banner Italic", u"Sitka Banner Semibold", u"Sitka Banner Semibold Italic",
+    u"Sitka Banner Bold", u"Sitka Banner Bold Italic", u"Sitka Display", u"Sitka Display Italic",
+    u"Sitka Display Semibold", u"Sitka Display Semibold Italic", u"Sitka Display Bold",
+    u"Sitka Display Bold Italic", u"Sitka Small", u"Sitka Small Italic", u"Sitka Small Semibold",
+    u"Sitka Small Semibold Italic", u"Sitka Small Bold", u"Sitka Small Bold Italic", u"Sitka Heading",
+    u"Sitka Heading Italic",  u"Sitka Heading Semibold", u"Sitka Heading Semibold Italic",
+    u"Sitka Heading Bold", u"Sitka Heading Bold Italic", u"Sitka Subheading",
+    u"Sitka Subheading Italic", u"Sitka Subheading Semibold", u"Sitka Subheading Semibold Italic",
+    u"Sitka Subheading Bold", u"Sitka Subheading Bold Italic", u"Sitka Text",
+    u"Sitka Text Italic", u"Sitka Text Semibold", u"Sitka Text Semibold Italic",
+    u"Sitka Text Bold", u"Sitka Text Bold Italic", u"Sylfaen", u"Symbol",
+    u"Tahoma", u"Tahoma Bold", u"Times New Roman", u"Times New Roman Italic", u"Times New Roman Bold",
+    u"Times New Roman Bold Italic", u"Trebuchet MS", u"Trebuchet MS Italic", u"Trebuchet MS Bold",
+    u"Trebuchet MS Bold Italic", u"Verdana", u"Verdana Italic", u"Verdana Bold",
+    u"Verdana Bold Italic", u"Webdings", u"Wingdings", u"Yu Gothic", u"Yu Gothic Light",
+    u"Yu Gothic Regular", u"Yu Gothic Medium", u"Yu Gothic Bold", u"Yu Gothic UI", u"Yu Gothic UI Light",
+    u"Yu Gothic UI Semilight", u"Yu Gothic UI Regular", u"Yu Gothic UI Semibold", u"Yu Gothic UI Bold",
+#endif
+};
+
+#if BUILDFLAG(IS_WIN)
+
+// List from https://learn.microsoft.com/en-us/windows/deployment/windows-10-missing-fonts
+// and https://learn.microsoft.com/en-us/typography/fonts/windows_11_font_list
+// https://unicode-org.github.io/cldr-staging/charts/37/supplemental/locale_coverage.html
+
+// Languages using Arabic script; e.g., Arabic, Persian, Urdu.
+const char16_t* kAllowedFontNames_ar_fa_ur[] = {
+    u"Aldhabi", u"Andalus", u"Arabic Typesetting", u"Microsoft Uighur",
+    u"Sakkal Majalla", u"Simplified Arabic", u"Traditional Arabic",
+    u"Urdu Typesetting"};
+// Languages using Bangla script; e.g., Assamese, Bangla.
+const char16_t* kAllowedFontNames_as_bn[] = {
+    u"Shonar Bangla", u"Vrinda"};
+// Languages using Canadian Syllabics script; e.g., Inuktitut.
+const char16_t* kAllowedFontNames_iu[] = {
+    u"Euphemia"};
+// Cherokee.
+const char16_t* kAllowedFontNames_chr[] = {
+    u"Plantagenet Cherokee"};
+// Language using Devanagari script; e.g., Hindi, Konkani, Marathi.
+const char16_t* kAllowedFontNames_hi_kok_mr[] = {
+    u"Aparajita", u"Kokila", u"Mangal", u"Sanskrit Text",
+    u"Utsaah"};
+// Languages using Ethiopic script; e.g., Amharic, Tigrinya.
+const char16_t* kAllowedFontNames_am_ti[] = {
+    u"Nyala"};
+// Gujarati; any other language using Gujurati script.
+const char16_t* kAllowedFontNames_gu[] = {
+    u"Shruti"};
+// Panjabi; any other language using Gurmukhi script
+const char16_t* kAllowedFontNames_pa[] = {
+    u"Raavi"};
+// Chinese
+const char16_t* kAllowedFontNames_zh[] = {
+    // Simplified Chinese
+    u"DengXian", u"FangSong", u"KaiTi", u"SimHei",
+    // Traditional Chinese
+    u"DFKai-SB", u"MingLiU"};
+// Hebrew
+const char16_t* kAllowedFontNames_he[] = {
+    u"Aharoni Bold", u"David", u"FrankRuehl", u"Gisha",
+    u"Levenim MT", u"Miriam", u"Narkisim", u"Rod"};
+// Japanese
+const char16_t* kAllowedFontNames_ja[] = {
+    u"BIZ UDGothic", u"BIZ UDMincho Medium", u"Meiryo", u"MS Mincho",
+    u"UD Digi Kyokasho", u"Yu Mincho"};
+// Kannada; any other language using Kannada script.
+const char16_t* kAllowedFontNames_kn[] = {
+    u"Tunga"};
+// Cambodian; any other language using Khmer script.
+const char16_t* kAllowedFontNames_km[] = {
+    u"DaunPenh", u"Khmer UI", u"MoolBoran"};
+// Korean
+const char16_t* kAllowedFontNames_ko[] = {
+    u"Batang", u"Dotum", u"Gulim", u"Gungsuh"};
+// Lao; any other language using Lao script.
+const char16_t* kAllowedFontNames_lo[] = {
+    u"DokChampa", u"Lao UI"};
+// Malayalam; any other language using Malayalam script.
+const char16_t* kAllowedFontNames_ml[] = {
+    u"Kartika"};
+// Odia; any other language using Odia script.
+const char16_t* kAllowedFontNames_or[] = {
+    u"Kalinga"};
+// Sinhala; any other language using Sinhala script.
+const char16_t* kAllowedFontNames_si[] = {
+    u"Iskoola Pota"};
+// Languages using Syriac script.
+const char16_t* kAllowedFontNames_syr[] = {
+    u"Estrangelo Edessa"};
+// Tamil; any other language using Tamil script.
+const char16_t* kAllowedFontNames_ta[] = {
+    u"Latha", u"Vijaya"};
+// Telugu; any other language using Telugu script.
+const char16_t* kAllowedFontNames_te[] = {
+    u"Gautami", u"Vani"};
+// Thai; any other language using Thai script.
+const char16_t* kAllowedFontNames_th[] = {
+    u"Angsana New", u"AngsanaUPC", u"Browallia New", u"BrowalliaUPC",
+    u"Cordia New", u"CordiaUPC", u"DilleniaUPC", u"EucrosiaUPC",
+    u"FreesiaUPC", u"IrisUPC", u"JasmineUPC", u"KodchiangUPC",
+    u"Leelawadee", u"LilyUPC"};
+
+#endif
+
+template<int N>
+bool IsInList(const std::u16string& font_name, const char16_t*(&list)[N]) {
+  for(int t = 0; t < N; ++t)
+    if (base::EqualsCaseInsensitiveASCII(font_name, list[t]))
+      return true;
+  return false;
+}
+
+bool IsFontAllowed(const std::u16string& font_name) {
+  for (const char16_t* last_resort_font_name : kAllowedFontNames) {
+    if (base::EqualsCaseInsensitiveASCII(font_name, last_resort_font_name))
+      return true;
+  }
+
+#if BUILDFLAG(IS_ANDROID)
+  // allow synthetic family names (used for emoji)
+  if (base::EndsWith(font_name, u"##fallback", base::CompareCase::INSENSITIVE_ASCII))
+    return true;
+#endif
+
+#if BUILDFLAG(IS_WIN)
+  // check fonts against locale
+  const base::CommandLine& command_line = *base::CommandLine::ForCurrentProcess();
+  if (command_line.HasSwitch(switches::kLang)) {
+    std::string locale = command_line.GetSwitchValueASCII(::switches::kLang);
+
+    if (locale == "ar" || locale == "fa" || locale == "ur")
+      return IsInList(font_name, kAllowedFontNames_ar_fa_ur);
+    else if (locale == "as" || locale == "bn")
+      return IsInList(font_name, kAllowedFontNames_as_bn);
+    else if (locale == "iu")
+      return IsInList(font_name, kAllowedFontNames_iu);
+    else if (locale == "chr")
+      return IsInList(font_name, kAllowedFontNames_chr);
+    else if (locale == "hi" || locale == "kok" || locale == "mr")
+      return IsInList(font_name, kAllowedFontNames_hi_kok_mr);
+    else if (locale == "am" || locale == "ti")
+      return IsInList(font_name, kAllowedFontNames_am_ti);
+    else if (locale == "gu")
+      return IsInList(font_name, kAllowedFontNames_gu);
+    else if (locale == "pa")
+      return IsInList(font_name, kAllowedFontNames_pa);
+    else if (locale == "zh")
+      return IsInList(font_name, kAllowedFontNames_zh);
+    else if (locale == "he")
+      return IsInList(font_name, kAllowedFontNames_he);
+    else if (locale == "ja")
+      return IsInList(font_name, kAllowedFontNames_ja);
+    else if (locale == "kn")
+      return IsInList(font_name, kAllowedFontNames_kn);
+    else if (locale == "km")
+      return IsInList(font_name, kAllowedFontNames_km);
+    else if (locale == "ko")
+      return IsInList(font_name, kAllowedFontNames_ko);
+    else if (locale == "lo")
+      return IsInList(font_name, kAllowedFontNames_lo);
+    else if (locale == "ml")
+      return IsInList(font_name, kAllowedFontNames_ml);
+    else if (locale == "or")
+      return IsInList(font_name, kAllowedFontNames_or);
+    else if (locale == "si")
+      return IsInList(font_name, kAllowedFontNames_si);
+    else if (locale == "syr")
+      return IsInList(font_name, kAllowedFontNames_syr);
+    else if (locale == "ta")
+      return IsInList(font_name, kAllowedFontNames_ta);
+    else if (locale == "te")
+      return IsInList(font_name, kAllowedFontNames_te);
+    else if (locale == "th")
+      return IsInList(font_name, kAllowedFontNames_th);
+  }
+#endif
+
+  //LOG(INFO) << "---not allowed " << font_name;
+
+  return false;
+}
+
+}
+diff --git a/third_party/blink/renderer/platform/fonts/skia/font_cache_skia.cc b/third_party/blink/renderer/platform/fonts/skia/font_cache_skia.cc
+--- a/third_party/blink/renderer/platform/fonts/skia/font_cache_skia.cc
+++ b/third_party/blink/renderer/platform/fonts/skia/font_cache_skia.cc
+@@ -58,12 +58,35 @@
+ #error This file should not be used by MacOS.
+ #endif
+ 
+#include "base/feature_list.h"
+#include "base/strings/utf_string_conversions.h"
+#include "third_party/blink/public/common/features.h"
+#include "bromite_allowed_fonts.h"
+#if BUILDFLAG(IS_WIN)
+#include "skia/ext/skia_utils_win.h"
+#endif
+
+ namespace blink {
+ 
+ AtomicString ToAtomicString(const SkString& str) {
+   return AtomicString::FromUTF8(str.c_str(), str.size());
+ }
+ 
+sk_sp<SkTypeface> ReturnIfAllowed(sk_sp<SkTypeface> typeface, bool check_fonts) {
+  if (!check_fonts) return typeface;
+#if BUILDFLAG(IS_WIN)
+  if (!typeface) return nullptr;
+
+  SkString skia_family_name;
+  skia::DWriteFontTypeface_GetGDIFamilyName(typeface.get(), &skia_family_name);
+  const AtomicString& family = ToAtomicString(skia_family_name);
+  std::string name = family.Utf8();
+  if (!IsFontAllowed(base::UTF8ToUTF16(name)))
+    return nullptr;
+#endif // BUILDFLAG(IS_WIN)
+  return typeface;
+}
+
+ #if BUILDFLAG(IS_ANDROID) || BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_CHROMEOS)
+ // This function is called on android or when we are emulating android fonts on
+ // linux and the embedder has overriden the default fontManager with
+@@ -201,7 +224,7 @@ scoped_refptr<SimpleFontData> FontCache::GetLastResortFallbackFont(
+ sk_sp<SkTypeface> FontCache::CreateTypeface(
+     const FontDescription& font_description,
+     const FontFaceCreationParams& creation_params,
+-    std::string& name) {
+    std::string& name, std::string& original_name) {
+ #if !BUILDFLAG(IS_WIN) && !BUILDFLAG(IS_ANDROID) && !BUILDFLAG(IS_FUCHSIA)
+   // TODO(fuchsia): Revisit this and other font code for Fuchsia.
+ 
+@@ -219,6 +242,16 @@ sk_sp<SkTypeface> FontCache::CreateTypeface(
+   DCHECK_NE(family, font_family_names::kSystemUi);
+   // convert the name to utf8
+   name = family.Utf8();
+  if (original_name.empty()) original_name = name;
+
+  bool check_fonts = base::FeatureList::IsEnabled(features::kFontsFingerprintMitigation);
+  if (check_fonts) {
+    if (!IsFontAllowed(base::UTF8ToUTF16(name))) {
+      return nullptr;
+    } else if (!IsFontAllowed(base::UTF8ToUTF16(original_name))) {
+      return nullptr;
+    }
+  }
+ 
+ #if BUILDFLAG(IS_ANDROID)
+   // If this is a locale-specific family, try looking up locale-specific
+@@ -226,15 +259,15 @@ sk_sp<SkTypeface> FontCache::CreateTypeface(
+   if (const char* locale_family = GetLocaleSpecificFamilyName(family)) {
+     if (sk_sp<SkTypeface> typeface =
+             CreateLocaleSpecificTypeface(font_description, locale_family))
+-      return typeface;
+      return ReturnIfAllowed(typeface, check_fonts);
+   }
+ #endif  // BUILDFLAG(IS_ANDROID)
+ 
+   // TODO(https://crbug.com/1425390: Assign FontCache::font_manager_ in the
+   // ctor.
+   auto font_manager = font_manager_ ? font_manager_ : SkFontMgr::RefDefault();
+-  return sk_sp<SkTypeface>(font_manager->matchFamilyStyle(
+-      name.empty() ? nullptr : name.c_str(), font_description.SkiaFontStyle()));
+  return ReturnIfAllowed(sk_sp<SkTypeface>(font_manager->matchFamilyStyle(
+      name.empty() ? nullptr : name.c_str(), font_description.SkiaFontStyle())), check_fonts);
+ }
+ 
+ #if !BUILDFLAG(IS_WIN)
+@@ -244,6 +277,7 @@ std::unique_ptr<FontPlatformData> FontCache::CreateFontPlatformData(
+     float font_size,
+     AlternateFontName alternate_name) {
+   std::string name;
+  std::string original_name;
+ 
+   sk_sp<SkTypeface> typeface;
+ #if BUILDFLAG(IS_ANDROID) || BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_CHROMEOS)
+@@ -264,7 +298,7 @@ std::unique_ptr<FontPlatformData> FontCache::CreateFontPlatformData(
+        noto_color_emoji_from_gmscore)) {
+     typeface = CreateTypefaceFromUniqueName(creation_params);
+   } else {
+-    typeface = CreateTypeface(font_description, creation_params, name);
+    typeface = CreateTypeface(font_description, creation_params, name, original_name);
+   }
+ #else
+   typeface = CreateTypeface(font_description, creation_params, name);
+diff --git a/third_party/blink/renderer/platform/fonts/win/font_cache_skia_win.cc b/third_party/blink/renderer/platform/fonts/win/font_cache_skia_win.cc
+--- a/third_party/blink/renderer/platform/fonts/win/font_cache_skia_win.cc
+++ b/third_party/blink/renderer/platform/fonts/win/font_cache_skia_win.cc
+@@ -427,6 +427,7 @@ std::unique_ptr<FontPlatformData> FontCache::CreateFontPlatformData(
+   sk_sp<SkTypeface> typeface;
+ 
+   std::string name;
+  std::string original_name;
+ 
+   if (alternate_font_name == AlternateFontName::kLocalUniqueFace &&
+       RuntimeEnabledFeatures::FontSrcLocalMatchingEnabled()) {
+@@ -438,7 +439,7 @@ std::unique_ptr<FontPlatformData> FontCache::CreateFontPlatformData(
+       return nullptr;
+ 
+   } else {
+-    typeface = CreateTypeface(font_description, creation_params, name);
+    typeface = CreateTypeface(font_description, creation_params, name, original_name);
+ 
+     // For a family match, Windows will always give us a valid pointer here,
+     // even if the face name is non-existent. We have to double-check and see if
+@@ -472,7 +473,7 @@ std::unique_ptr<FontPlatformData> FontCache::CreateFontPlatformData(
+         FontDescription adjusted_font_description = font_description;
+         adjusted_font_description.SetWeight(variant_weight);
+         typeface =
+-            CreateTypeface(adjusted_font_description, adjusted_params, name);
+            CreateTypeface(adjusted_font_description, adjusted_params, name, original_name);
+         if (!typeface ||
+             !TypefacesMatchesFamily(typeface.get(), adjusted_name)) {
+           return nullptr;
+@@ -484,7 +485,7 @@ std::unique_ptr<FontPlatformData> FontCache::CreateFontPlatformData(
+         FontDescription adjusted_font_description = font_description;
+         adjusted_font_description.SetStretch(variant_stretch);
+         typeface =
+-            CreateTypeface(adjusted_font_description, adjusted_params, name);
+            CreateTypeface(adjusted_font_description, adjusted_params, name, original_name);
+         if (!typeface ||
+             !TypefacesMatchesFamily(typeface.get(), adjusted_name)) {
+           return nullptr;
+--
+2.25.1
@@ -0,0 +1,22 @@
+From: Your Name <you@example.com>
+Date: Tue, 31 Oct 2023 16:20:12 +0000
+Subject: Keep Manta Service Disabled
+
+---
+ components/manta/features.cc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/components/manta/features.cc b/components/manta/features.cc
+--- a/components/manta/features.cc
+++ b/components/manta/features.cc
+@@ -8,7 +8,7 @@
+ 
+ namespace manta::features {
+ 
+-BASE_FEATURE(kMantaService, "MantaService", base::FEATURE_DISABLED_BY_DEFAULT);
+BASE_FEATURE(kMantaService, "MantaService", base::FEATURE_DISABLED_BY_DEFAULT); // keep disabled
+ 
+ bool IsMantaServiceEnabled() {
+   return base::FeatureList::IsEnabled(kMantaService);
+--
+2.25.1
@@ -0,0 +1,99 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Mon, 17 Jul 2023 15:24:16 +0000
+Subject: Keep Side Panel Companion disabled
+
+License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
+---
+ chrome/browser/companion/core/features.cc     | 23 ++++++++++---------
+ .../ui/side_search/side_search_prefs.cc       |  2 +-
+ chrome/browser/ui/ui_features.cc              |  2 +-
+ components/search_engines/template_url.cc     |  2 +-
+ 4 files changed, 15 insertions(+), 14 deletions(-)
+
+diff --git a/chrome/browser/companion/core/features.cc b/chrome/browser/companion/core/features.cc
+--- a/chrome/browser/companion/core/features.cc
+++ b/chrome/browser/companion/core/features.cc
+@@ -23,17 +23,17 @@ namespace internal {
+ // `kSidePanelCompanion2`. This makes it possible for Companion to be
+ // enabled via multiple field trials (e.g., one that's session consistent, other
+ // that's permanent consistent).
+-BASE_FEATURE(kSidePanelCompanion,
+-             "SidePanelCompanion",
+-             base::FEATURE_DISABLED_BY_DEFAULT);
+-BASE_FEATURE(kSidePanelCompanion2,
+-             "SidePanelCompanion2",
+-             base::FEATURE_DISABLED_BY_DEFAULT);
+BASE_FEATURE(kSidePanelCompanion,                           // keep
+             "SidePanelCompanion",                          // disabled
+             base::FEATURE_DISABLED_BY_DEFAULT);            // in bromite
+BASE_FEATURE(kSidePanelCompanion2,                          // keep
+             "SidePanelCompanion2",                         // disabled
+             base::FEATURE_DISABLED_BY_DEFAULT);            // in bromite
+ // Dynamically enables the search companion if the user has experiments
+ // enabled.
+-BASE_FEATURE(kCompanionEnabledByObservingExpsNavigations,
+-             "CompanionEnabledByObservingExpsNavigations",
+-             base::FEATURE_DISABLED_BY_DEFAULT);
+BASE_FEATURE(kCompanionEnabledByObservingExpsNavigations,   // keep
+             "CompanionEnabledByObservingExpsNavigations",  // disabled
+             base::FEATURE_DISABLED_BY_DEFAULT);            // in bromite
+ }  // namespace internal
+ 
+ // When search companion is enabled, show a context menu item that allows the
+@@ -53,8 +53,8 @@ BASE_FEATURE(kCompanionEnableNewBadgesInContextMenu,
+ // user had previously opted in. The user won't be able to opt in (or out) when
+ // this is disabled.
+ BASE_FEATURE(kCompanionEnablePageContent,
+-             "CompanionEnablePageContent",
+-             base::FEATURE_DISABLED_BY_DEFAULT);
+             "CompanionEnablePageContent",       // keep
+             base::FEATURE_DISABLED_BY_DEFAULT); // disabled
+ }  // namespace features
+ 
+ namespace switches {
+@@ -65,6 +65,7 @@ const char kDisableCheckUserPermissionsForCompanion[] =
+ const char kForceCompanionPinnedState[] = "force-companion-pinned-state";
+ 
+ bool ShouldOverrideCheckingUserPermissionsForCompanion() {
+  if ((true)) return false;
+   base::CommandLine* command_line = base::CommandLine::ForCurrentProcess();
+   return command_line->HasSwitch(kDisableCheckUserPermissionsForCompanion);
+ }
+diff --git a/chrome/browser/ui/side_search/side_search_prefs.cc b/chrome/browser/ui/side_search/side_search_prefs.cc
+--- a/chrome/browser/ui/side_search/side_search_prefs.cc
+++ b/chrome/browser/ui/side_search/side_search_prefs.cc
+@@ -13,7 +13,7 @@ namespace side_search_prefs {
+ const char kSideSearchEnabled[] = "side_search.enabled";
+ 
+ void RegisterProfilePrefs(user_prefs::PrefRegistrySyncable* registry) {
+-  registry->RegisterBooleanPref(kSideSearchEnabled, true);
+  registry->RegisterBooleanPref(kSideSearchEnabled, false);
+ }
+ 
+ }  // namespace side_search_prefs
+diff --git a/chrome/browser/ui/ui_features.cc b/chrome/browser/ui/ui_features.cc
+--- a/chrome/browser/ui/ui_features.cc
+++ b/chrome/browser/ui/ui_features.cc
+@@ -122,7 +122,7 @@ BASE_FEATURE(kResponsiveToolbar,
+ 
+ // Enables the side search feature for Google Search. Presents recent Google
+ // search results in a browser side panel.
+-BASE_FEATURE(kSideSearch, "SideSearch", base::FEATURE_ENABLED_BY_DEFAULT);
+BASE_FEATURE(kSideSearch, "SideSearch", base::FEATURE_DISABLED_BY_DEFAULT);
+ 
+ BASE_FEATURE(kSideSearchFeedback,
+              "SideSearchFeedback",
+diff --git a/components/search_engines/template_url.cc b/components/search_engines/template_url.cc
+--- a/components/search_engines/template_url.cc
+++ b/components/search_engines/template_url.cc
+@@ -1829,7 +1829,7 @@ GURL TemplateURL::GenerateSuggestionURL(
+ }
+ 
+ bool TemplateURL::IsSideSearchSupported() const {
+-  return !side_search_param().empty();
+  return false;
+ }
+ 
+ bool TemplateURL::IsSideImageSearchSupported() const {
+--
+2.25.1
@@ -0,0 +1,49 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Thu, 28 Sep 2023 08:11:00 +0000
+Subject: Keep disabled FetchLaterAPI
+
+---
+ third_party/blink/common/features.cc                      | 8 ++++----
+ .../renderer/platform/runtime_enabled_features.json5      | 3 ++-
+ 2 files changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/third_party/blink/common/features.cc b/third_party/blink/common/features.cc
+--- a/third_party/blink/common/features.cc
+++ b/third_party/blink/common/features.cc
+@@ -1026,8 +1026,8 @@ BASE_FEATURE(kKalmanHeuristics,
+              base::FEATURE_DISABLED_BY_DEFAULT);
+ 
+ BASE_FEATURE(kKeepAliveInBrowserMigration,
+-             "KeepAliveInBrowserMigration",
+-             base::FEATURE_DISABLED_BY_DEFAULT);
+             "KeepAliveInBrowserMigration",      // keep
+             base::FEATURE_DISABLED_BY_DEFAULT); // disabled
+ 
+ // Enables reporting as LCP of the time the first frame of an animated image was
+ // painted.
+@@ -1278,8 +1278,8 @@ BASE_FEATURE(kPath2DPaintCache,
+              base::FEATURE_DISABLED_BY_DEFAULT);
+ 
+ BASE_FEATURE(kPendingBeaconAPI,
+-             "PendingBeaconAPI",
+-             base::FEATURE_DISABLED_BY_DEFAULT);
+             "PendingBeaconAPI",                 // keep
+             base::FEATURE_DISABLED_BY_DEFAULT); // disabled
+ const base::FeatureParam<bool> kPendingBeaconAPIRequiresOriginTrial = {
+     &kPendingBeaconAPI, "requires_origin_trial", false};
+ const base::FeatureParam<bool> kPendingBeaconAPIForcesSendingOnNavigation = {
+diff --git a/third_party/blink/renderer/platform/runtime_enabled_features.json5 b/third_party/blink/renderer/platform/runtime_enabled_features.json5
+--- a/third_party/blink/renderer/platform/runtime_enabled_features.json5
+++ b/third_party/blink/renderer/platform/runtime_enabled_features.json5
+@@ -1700,7 +1700,8 @@
+     },
+     {
+       // The Blink runtime-enabled feature name for the API's IDL.
+-      name: "FetchLaterAPI",
+      name: "FetchLaterAPI",   // disable
+      status: "experimental",  // by default
+       public: true,
+     },
+     {
+--
+2.25.1
@@ -0,0 +1,287 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Tue, 14 Mar 2023 15:48:21 +0000
+Subject: Keyboard protection flag
+
+Hides user preference on the system keyboard by setting the standard
+eng layout and removing the layout information from the javascript
+keyboard events.
+
+License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
+---
+ chrome/browser/about_flags.cc                 |  3 +
+ chrome/browser/flag_descriptions.cc           |  6 ++
+ chrome/browser/flag_descriptions.h            |  3 +
+ .../renderer/core/events/keyboard_event.cc    | 66 +++++++++++++++++++
+ .../renderer/core/events/keyboard_event.h     |  3 +
+ ui/base/ui_base_features.cc                   |  8 +++
+ ui/base/ui_base_features.h                    |  2 +
+ .../dom/dom_keyboard_layout_map_win.cc        | 13 ++++
+ .../keycodes/keyboard_code_conversion.cc      | 10 ++-
+ ui/events/keycodes/keyboard_code_conversion.h |  2 +-
+ 10 files changed, 113 insertions(+), 3 deletions(-)
+
+diff --git a/chrome/browser/about_flags.cc b/chrome/browser/about_flags.cc
+--- a/chrome/browser/about_flags.cc
+++ b/chrome/browser/about_flags.cc
+@@ -5413,6 +5413,9 @@ const FeatureEntry kFeatureEntries[] = {
+     {"system-keyboard-lock", flag_descriptions::kSystemKeyboardLockName,
+      flag_descriptions::kSystemKeyboardLockDescription, kOsDesktop,
+      FEATURE_VALUE_TYPE(features::kSystemKeyboardLock)},
+    {"system-keyboard-protection", flag_descriptions::kSystemKeyboardProtectionName,
+     flag_descriptions::kSystemKeyboardProtectionDescription, kOsAll,
+     FEATURE_VALUE_TYPE(features::kSystemKeyboardProtection)},
+ #if BUILDFLAG(IS_ANDROID)
+     {"add-to-homescreen-iph", flag_descriptions::kAddToHomescreenIPHName,
+      flag_descriptions::kAddToHomescreenIPHDescription, kOsAndroid,
+diff --git a/chrome/browser/flag_descriptions.cc b/chrome/browser/flag_descriptions.cc
+--- a/chrome/browser/flag_descriptions.cc
+++ b/chrome/browser/flag_descriptions.cc
+@@ -3340,6 +3340,12 @@ const char kSystemKeyboardLockDescription[] =
+     "keyboard shortcuts and have the events routed directly to the website "
+     "when in fullscreen mode.";
+ 
+const char kSystemKeyboardProtectionName[] = "System keyboard protection";
+const char kSystemKeyboardProtectionDescription[] =
+    "Hides user preference on the system keyboard by setting the standard "
+    "eng layout and removing the layout information from the "
+    "javascript keyboard events.";
+
+ const char kSystemSoundsName[] = "Power Sounds";
+ const char kSystemSoundsDescription[] =
+     "Enable device charging and low battery warning sounds.";
+diff --git a/chrome/browser/flag_descriptions.h b/chrome/browser/flag_descriptions.h
+--- a/chrome/browser/flag_descriptions.h
+++ b/chrome/browser/flag_descriptions.h
+@@ -1923,6 +1923,9 @@ extern const char kSuppressToolbarCapturesDescription[];
+ extern const char kSystemKeyboardLockName[];
+ extern const char kSystemKeyboardLockDescription[];
+ 
+extern const char kSystemKeyboardProtectionName[];
+extern const char kSystemKeyboardProtectionDescription[];
+
+ extern const char kSystemSoundsName[];
+ extern const char kSystemSoundsDescription[];
+ 
+diff --git a/third_party/blink/renderer/core/events/keyboard_event.cc b/third_party/blink/renderer/core/events/keyboard_event.cc
+--- a/third_party/blink/renderer/core/events/keyboard_event.cc
+++ b/third_party/blink/renderer/core/events/keyboard_event.cc
+@@ -23,9 +23,12 @@
+ #include "third_party/blink/renderer/core/events/keyboard_event.h"
+ 
+ #include "build/build_config.h"
+#include "base/feature_list.h"
+ #include "third_party/blink/public/common/input/web_input_event.h"
+ #include "third_party/blink/public/platform/platform.h"
+ #include "third_party/blink/renderer/bindings/core/v8/v8_keyboard_event_init.h"
+#include "third_party/blink/renderer/core/dom/events/event_dispatch_result.h"
+#include "third_party/blink/renderer/core/dom/events/event_dispatcher.h"
+ #include "third_party/blink/renderer/core/editing/ime/input_method_controller.h"
+ #include "third_party/blink/renderer/core/event_interface_names.h"
+ #include "third_party/blink/renderer/core/frame/local_dom_window.h"
+@@ -34,7 +37,10 @@
+ #include "third_party/blink/renderer/platform/bindings/dom_wrapper_world.h"
+ #include "third_party/blink/renderer/platform/bindings/script_state.h"
+ #include "third_party/blink/renderer/platform/windows_keyboard_codes.h"
+#include "ui/base/ui_base_features.h"
+ #include "ui/events/keycodes/dom/keycode_converter.h"
+#include "ui/events/keycodes/dom/dom_codes_array.h"
+#include "ui/events/keycodes/keyboard_code_conversion.h"
+ 
+ namespace blink {
+ 
+@@ -133,6 +139,60 @@ KeyboardEvent::KeyboardEvent(const WebKeyboardEvent& key,
+   else
+     key_code_ = char_code_;
+ 
+  if (features::IsSystemKeyboardProtectionEnabled()) {
+    // we need character for transformation
+    ui::DomKey ascii_key;
+    ui::DomKey original_dom_key = static_cast<ui::DomKey>(key.dom_key);
+    // 1 <= char_code <= 26: exclude ctrl-a ... control-z
+    if (char_code_ > 26 && original_dom_key.IsCharacter())
+      ascii_key = ui::DomKey::FromCharacter(key.text[0]);
+    else
+      ascii_key = original_dom_key;
+
+    // get domcode of us layout keyboard
+    // we transform the character pressed by the user into
+    // the relevant domkey of the English keyboard
+    // so, for example:
+    //    for ascii_key = "
+    //    in italian keyboard --> shift + Digit2
+    //    in us keybord       --> shift + Quote
+    int shift_needed = 0;
+    ui::DomCode us_code = ui::UsLayoutDomKeyToDomCode(ascii_key, &shift_needed);
+    if (shift_needed == 0)
+      modifiers_ &= ~WebInputEvent::kShiftKey;
+    else if (shift_needed == 1)
+      modifiers_ |= WebInputEvent::kShiftKey;
+
+    // convert keyboard code to us layout (platform code)
+    if (type() == event_type_names::kKeydown ||
+        type() == event_type_names::kKeyup) {
+      int windows_key_code = ui::DomCodeToUsLayoutNonLocatedKeyboardCode(us_code);
+      key_code_ = windows_key_code;
+    }
+
+    // regenerate key_ and code_ for us keyboard
+    key_ = FromUTF8(ui::KeycodeConverter::DomKeyToKeyString(ascii_key));
+    code_ = FromUTF8(ui::KeycodeConverter::DomCodeToCodeString(us_code));
+
+    if (ui::KeycodeConverter::IsDomKeyForModifier(original_dom_key) ||
+        original_dom_key.IsDeadKey()) {
+      // suppress event if is ctrl/shift/alt... otherwise key_code of
+      // the next character can be stolen
+      // and do not send dead keys
+      // we cannot do otherwise because some characters are generated
+      // with the shift or without depending on the keyboard
+      suppress_event_ = true;
+    }
+    // do not leak status of numlock/capslock/scrolllock/etc
+    modifiers_ &= ~(WebInputEvent::kSymbolKey | WebInputEvent::kFnKey |
+                    WebInputEvent::kAltGrKey | WebInputEvent::kMetaKey |
+                    WebInputEvent::kAltKey | WebInputEvent::kIsKeyPad |
+                    WebInputEvent::kSymbolKey | WebInputEvent::kScrollLockOn |
+                    WebInputEvent::kCapsLockOn | WebInputEvent::kNumLockOn);
+    // always clear location
+    location_ = KeyboardEvent::kDomKeyLocationStandard;
+  }
+
+ #if BUILDFLAG(IS_ANDROID)
+   // FIXME: Check to see if this applies to other OS.
+   // If the key event belongs to IME composition then propagate to JS.
+@@ -205,6 +265,12 @@ unsigned KeyboardEvent::which() const {
+   return (unsigned)keyCode();
+ }
+ 
+DispatchEventResult KeyboardEvent::DispatchEvent(EventDispatcher& dispatcher) {
+  if (suppress_event_)
+    return DispatchEventResult::kNotCanceled;
+  return dispatcher.Dispatch();
+}
+
+ void KeyboardEvent::InitLocationModifiers(unsigned location) {
+   switch (location) {
+     case KeyboardEvent::kDomKeyLocationNumpad:
+diff --git a/third_party/blink/renderer/core/events/keyboard_event.h b/third_party/blink/renderer/core/events/keyboard_event.h
+--- a/third_party/blink/renderer/core/events/keyboard_event.h
+++ b/third_party/blink/renderer/core/events/keyboard_event.h
+@@ -97,6 +97,8 @@ class CORE_EXPORT KeyboardEvent final : public UIEventWithKeyState {
+   unsigned which() const override;
+   bool isComposing() const { return is_composing_; }
+ 
+  DispatchEventResult DispatchEvent(EventDispatcher&) override;
+
+   void Trace(Visitor*) const override;
+ 
+  private:
+@@ -109,6 +111,7 @@ class CORE_EXPORT KeyboardEvent final : public UIEventWithKeyState {
+   bool is_composing_ = false;
+   unsigned char_code_ = 0;
+   unsigned key_code_ = 0;
+  bool suppress_event_ = false;
+ };
+ 
+ template <>
+diff --git a/ui/base/ui_base_features.cc b/ui/base/ui_base_features.cc
+--- a/ui/base/ui_base_features.cc
+++ b/ui/base/ui_base_features.cc
+@@ -184,6 +184,14 @@ BASE_FEATURE(kSystemKeyboardLock,
+              "SystemKeyboardLock",
+              base::FEATURE_ENABLED_BY_DEFAULT);
+ 
+BASE_FEATURE(kSystemKeyboardProtection,
+             "SystemKeyboardProtection",
+             base::FEATURE_ENABLED_BY_DEFAULT);
+
+bool IsSystemKeyboardProtectionEnabled() {
+  return base::FeatureList::IsEnabled(kSystemKeyboardProtection);
+}
+
+ // Enables GPU rasterization for all UI drawing (where not blocklisted).
+ BASE_FEATURE(kUiGpuRasterization,
+              "UiGpuRasterization",
+diff --git a/ui/base/ui_base_features.h b/ui/base/ui_base_features.h
+--- a/ui/base/ui_base_features.h
+++ b/ui/base/ui_base_features.h
+@@ -30,6 +30,8 @@ BASE_DECLARE_FEATURE(kWindowsScrollingPersonality);
+ COMPONENT_EXPORT(UI_BASE_FEATURES) bool IsPercentBasedScrollingEnabled();
+ COMPONENT_EXPORT(UI_BASE_FEATURES) BASE_DECLARE_FEATURE(kSystemCaptionStyle);
+ COMPONENT_EXPORT(UI_BASE_FEATURES) BASE_DECLARE_FEATURE(kSystemKeyboardLock);
+COMPONENT_EXPORT(UI_BASE_FEATURES) BASE_DECLARE_FEATURE(kSystemKeyboardProtection);
+COMPONENT_EXPORT(UI_BASE_FEATURES) bool IsSystemKeyboardProtectionEnabled();
+ COMPONENT_EXPORT(UI_BASE_FEATURES)
+ BASE_DECLARE_FEATURE(kUiCompositorScrollWithLayers);
+ 
+diff --git a/ui/events/keycodes/dom/dom_keyboard_layout_map_win.cc b/ui/events/keycodes/dom/dom_keyboard_layout_map_win.cc
+--- a/ui/events/keycodes/dom/dom_keyboard_layout_map_win.cc
+++ b/ui/events/keycodes/dom/dom_keyboard_layout_map_win.cc
+@@ -13,6 +13,8 @@
+ #include "base/containers/flat_map.h"
+ #include "base/logging.h"
+ #include "base/ranges/algorithm.h"
+#include "base/feature_list.h"
+#include "ui/base/ui_base_features.h"
+ #include "ui/events/keycodes/dom/dom_code.h"
+ #include "ui/events/keycodes/dom/dom_key.h"
+ #include "ui/events/keycodes/dom/dom_keyboard_layout_map_base.h"
+@@ -74,6 +76,17 @@ uint32_t DomKeyboardLayoutMapWin::GetKeyboardLayoutCount() {
+       iter != keyboard_layout_handles_.end())
+     std::iter_swap(keyboard_layout_handles_.begin(), iter);
+ 
+  if (features::IsSystemKeyboardProtectionEnabled()) {
+    HKL actual_layout = GetKeyboardLayout(0);
+
+    // get handle for en-us keyboard layout
+    keyboard_layout_handles_.clear();
+    keyboard_layout_handles_.resize(1);
+    keyboard_layout_handles_[0] = LoadKeyboardLayoutA("00000409", KLF_ACTIVATE);
+
+    // reactivate user keyboard layout
+    ActivateKeyboardLayout(actual_layout, KLF_SETFORPROCESS);
+  }
+   return keyboard_layout_handles_.size();
+ }
+ 
+diff --git a/ui/events/keycodes/keyboard_code_conversion.cc b/ui/events/keycodes/keyboard_code_conversion.cc
+--- a/ui/events/keycodes/keyboard_code_conversion.cc
+++ b/ui/events/keycodes/keyboard_code_conversion.cc
+@@ -293,16 +293,22 @@ int ModifierDomKeyToEventFlag(DomKey key) {
+   //   DomKey::SYMBOL_LOCK
+ }
+ 
+-DomCode UsLayoutDomKeyToDomCode(DomKey dom_key) {
+DomCode UsLayoutDomKeyToDomCode(DomKey dom_key, int *need_shift) {
+   if (dom_key.IsCharacter()) {
+     char16_t c = dom_key.ToCharacter();
+     for (const auto& it : kPrintableCodeMap) {
+-      if (it.character[0] == c || it.character[1] == c) {
+      if (it.character[0] == c) {
+        *need_shift = 0;
+        return it.dom_code;
+      }
+      if (it.character[1] == c) {
+        *need_shift = 1;
+         return it.dom_code;
+       }
+     }
+   }
+ 
+  *need_shift = -1;
+   for (const auto& it : kNonPrintableCodeMap) {
+     if (it.dom_key == dom_key)
+       return it.dom_code;
+diff --git a/ui/events/keycodes/keyboard_code_conversion.h b/ui/events/keycodes/keyboard_code_conversion.h
+--- a/ui/events/keycodes/keyboard_code_conversion.h
+++ b/ui/events/keycodes/keyboard_code_conversion.h
+@@ -111,7 +111,7 @@ EVENTS_BASE_EXPORT int ModifierDomKeyToEventFlag(DomKey key);
+ 
+ // Returns the physical DOM code along with a corresponding non-located
+ // Windows-based key_code.
+-EVENTS_BASE_EXPORT DomCode UsLayoutDomKeyToDomCode(DomKey dom_key);
+EVENTS_BASE_EXPORT DomCode UsLayoutDomKeyToDomCode(DomKey dom_key, int *need_shift);
+ 
+ }  // namespace ui
+ 
+--
+2.25.1
@@ -0,0 +1,25 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Mon, 17 Jul 2023 15:24:54 +0000
+Subject: Lock Profile Cookie Database
+
+License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
+---
+ chrome/browser/browser_features.cc | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/chrome/browser/browser_features.cc b/chrome/browser/browser_features.cc
+--- a/chrome/browser/browser_features.cc
+++ b/chrome/browser/browser_features.cc
+@@ -213,8 +213,8 @@ BASE_FEATURE(kAppBoundEncryptionMetrics,
+ // Enables locking the cookie database for profiles.
+ // TODO(crbug.com/1430226): Remove after fully launched.
+ BASE_FEATURE(kLockProfileCookieDatabase,
+-             "LockProfileCookieDatabase",
+-             base::FEATURE_ENABLED_BY_DEFAULT);
+             "LockProfileCookieDatabase",        // enabled
+             base::FEATURE_ENABLED_BY_DEFAULT);  // by default
+ 
+ // Don't call the Win32 API PrefetchVirtualMemory when loading chrome.dll inside
+ // non-browser processes. This is done by passing flags to these processes. This
+--
+2.25.1
@@ -0,0 +1,347 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Mon, 5 Jun 2023 17:06:03 +0000
+Subject: Log dangling attributes in some html elements
+
+Log for iframes and the base tag all attributes
+containing newlines or the less-then sign that can be exploited
+to extract or send otherwise inaccessible information.
+under enable-log-dangling-attributes about flag
+
+License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
+---
+ chrome/browser/about_flags.cc                 |  5 ++++-
+ .../blink/renderer/core/dom/document.cc       | 18 +++++++++++++++
+ .../blink/renderer/core/dom/element.cc        | 20 ++++++++++++++++-
+ third_party/blink/renderer/core/dom/element.h |  3 ++-
+ .../editing/serializers/markup_formatter.cc   |  9 ++++++++
+ .../renderer/core/html/html_base_element.cc   |  6 +++++
+ .../renderer/core/html/html_base_element.h    |  2 ++
+ .../core/html/html_frame_element_base.cc      | 10 +++++++++
+ .../renderer/core/html/html_iframe_element.cc | 16 ++++++++++++++
+ .../renderer/core/html/html_iframe_element.h  |  2 ++
+ .../core/loader/frame_load_request.cc         |  9 ++++++++
+ .../blink/renderer/core/page/frame_tree.cc    | 22 +++++++++++++++++++
+ .../platform/runtime_enabled_features.json5   | 10 +++++++--
+ 13 files changed, 127 insertions(+), 5 deletions(-)
+
+diff --git a/chrome/browser/about_flags.cc b/chrome/browser/about_flags.cc
+--- a/chrome/browser/about_flags.cc
+++ b/chrome/browser/about_flags.cc
+@@ -5361,7 +5361,10 @@ const FeatureEntry kFeatureEntries[] = {
+      flag_descriptions::kWebShareDescription, kOsWin | kOsCrOS | kOsMac,
+      FEATURE_VALUE_TYPE(features::kWebShare)},
+ #endif  // BUILDFLAG(IS_CHROMEOS) || BUILDFLAG(IS_WIN) || BUILDFLAG(IS_MAC)
+-
+    {"enable-log-dangling-attributes",
+     "Log some dangling attributes",
+     "NOTE: log only", kOsAll,
+     FEATURE_VALUE_TYPE(blink::features::kLogDanglingAttributes)},
+ #if BUILDFLAG(IS_LINUX)
+     {"ozone-platform-hint", flag_descriptions::kOzonePlatformHintName,
+      flag_descriptions::kOzonePlatformHintDescription, kOsLinux,
+diff --git a/third_party/blink/renderer/core/dom/document.cc b/third_party/blink/renderer/core/dom/document.cc
+--- a/third_party/blink/renderer/core/dom/document.cc
+++ b/third_party/blink/renderer/core/dom/document.cc
+@@ -4580,6 +4580,14 @@ void Document::ProcessBaseElement() {
+   KURL base_element_url;
+   if (href) {
+     String stripped_href = StripLeadingAndTrailingHTMLSpaces(*href);
+    if (stripped_href.Contains('\n') || stripped_href.Contains('<')) {
+      AddConsoleMessage(MakeGarbageCollected<ConsoleMessage>(
+          mojom::ConsoleMessageSource::kSecurity,
+          mojom::ConsoleMessageLevel::kInfo,
+          "Bromite Dangling Markup Prevention: '" + stripped_href +
+              "' is not allowed as base href value."));
+      //stripped_href = g_empty_atom;
+    }
+     if (!stripped_href.empty())
+       base_element_url = KURL(FallbackBaseURL(), stripped_href);
+   }
+@@ -4598,6 +4606,14 @@ void Document::ProcessBaseElement() {
+         !GetExecutionContext()->GetSecurityOrigin()->CanRequest(
+             base_element_url)) {
+       UseCounter::Count(*this, WebFeature::kBaseWithCrossOriginHref);
+      if (RuntimeEnabledFeatures::LogDanglingAttributesEnabled()) {
+        AddConsoleMessage(MakeGarbageCollected<ConsoleMessage>(
+            mojom::ConsoleMessageSource::kSecurity,
+            mojom::ConsoleMessageLevel::kInfo,
+            "Bromite Dangling Markup Prevention: '" + base_element_url.GetString() +
+                "' URL is cross origin and cannot be used as base URLs for a document."));
+      }
+      // base_element_url = BlankURL();
+     }
+   }
+ 
+@@ -4617,6 +4633,8 @@ void Document::ProcessBaseElement() {
+     if (target->Contains('<'))
+       UseCounter::Count(*this, WebFeature::kBaseWithOpenBracketInTarget);
+     base_target_ = *target;
+    if (target->Contains('\n') || target->Contains('\r') || target->Contains('<'))
+      base_target_ = g_null_atom;
+   } else {
+     base_target_ = g_null_atom;
+   }
+diff --git a/third_party/blink/renderer/core/dom/element.cc b/third_party/blink/renderer/core/dom/element.cc
+--- a/third_party/blink/renderer/core/dom/element.cc
+++ b/third_party/blink/renderer/core/dom/element.cc
+@@ -2608,8 +2608,26 @@ void Element::StripScriptingAttributes(
+   attribute_vector.Shrink(destination);
+ }
+ 
+void Element::RemoveDanglingAttributes(
+    Vector<Attribute, kAttributePrealloc>& attribute_vector) {
+  for (auto& attribute : attribute_vector) {
+    auto value = attribute.Value();
+    if (value.Contains('\n') || value.Contains('<')) {
+      if (RuntimeEnabledFeatures::LogDanglingAttributesEnabled()) {
+        GetDocument().AddConsoleMessage(MakeGarbageCollected<ConsoleMessage>(
+            mojom::ConsoleMessageSource::kSecurity,
+            mojom::ConsoleMessageLevel::kWarning,
+            "'" + value + "' is removed from attribute '" +
+              attribute.GetName().ToString() + "' of element '" +
+              tagName() + "' as may contains dangling markup"));
+      }
+      //attribute.SetValue(g_empty_atom);
+    }
+  }
+}
+
+ void Element::ParserSetAttributes(
+-    const Vector<Attribute, kAttributePrealloc>& attribute_vector) {
+    Vector<Attribute, kAttributePrealloc>& attribute_vector) {
+   DCHECK(!isConnected());
+   DCHECK(!parentNode());
+   DCHECK(!element_data_);
+diff --git a/third_party/blink/renderer/core/dom/element.h b/third_party/blink/renderer/core/dom/element.h
+--- a/third_party/blink/renderer/core/dom/element.h
+++ b/third_party/blink/renderer/core/dom/element.h
+@@ -579,7 +579,8 @@ class CORE_EXPORT Element : public ContainerNode, public Animatable {
+   virtual bool HasLegalLinkAttribute(const QualifiedName&) const;
+ 
+   // Only called by the parser immediately after element construction.
+-  void ParserSetAttributes(const Vector<Attribute, kAttributePrealloc>&);
+  virtual void ParserSetAttributes(Vector<Attribute, kAttributePrealloc>&);
+  void RemoveDanglingAttributes(Vector<Attribute, kAttributePrealloc>&);
+ 
+   // Remove attributes that might introduce scripting from the vector leaving
+   // the element unchanged.
+diff --git a/third_party/blink/renderer/core/editing/serializers/markup_formatter.cc b/third_party/blink/renderer/core/editing/serializers/markup_formatter.cc
+--- a/third_party/blink/renderer/core/editing/serializers/markup_formatter.cc
+++ b/third_party/blink/renderer/core/editing/serializers/markup_formatter.cc
+@@ -28,6 +28,8 @@
+ #include "third_party/blink/renderer/core/editing/serializers/markup_formatter.h"
+ 
+ #include "third_party/blink/public/mojom/use_counter/metrics/web_feature.mojom-shared.h"
+#include "third_party/blink/renderer/platform/heap/garbage_collected.h"
+#include "third_party/blink/renderer/core/inspector/console_message.h"
+ #include "third_party/blink/renderer/core/dom/cdata_section.h"
+ #include "third_party/blink/renderer/core/dom/comment.h"
+ #include "third_party/blink/renderer/core/dom/document.h"
+@@ -216,6 +218,13 @@ void MarkupFormatter::AppendAttributeValue(StringBuilder& result,
+                                            const Document& document) {
+   if (attribute.Contains('<') || attribute.Contains('>')) {
+     document.CountUse(mojom::blink::WebFeature::kAttributeValueContainsLtOrGt);
+    if (RuntimeEnabledFeatures::LogDanglingAttributesEnabled()) {
+      document.AddConsoleMessage(MakeGarbageCollected<ConsoleMessage>(
+              mojom::ConsoleMessageSource::kSecurity,
+              mojom::ConsoleMessageLevel::kInfo,
+              "Bromite Dangling Markup Prevention: '" + attribute +
+                  "' is not allowed as parameter value."));
+    }
+   }
+ 
+   EntityMask entity_mask =
+diff --git a/third_party/blink/renderer/core/html/html_base_element.cc b/third_party/blink/renderer/core/html/html_base_element.cc
+--- a/third_party/blink/renderer/core/html/html_base_element.cc
+++ b/third_party/blink/renderer/core/html/html_base_element.cc
+@@ -61,6 +61,12 @@ bool HTMLBaseElement::IsURLAttribute(const Attribute& attribute) const {
+          HTMLElement::IsURLAttribute(attribute);
+ }
+ 
+void HTMLBaseElement::ParserSetAttributes(
+    Vector<Attribute, kAttributePrealloc>& attribute_vector) {
+  Element::RemoveDanglingAttributes(attribute_vector);
+  Element::ParserSetAttributes(attribute_vector);
+}
+
+ KURL HTMLBaseElement::href() const {
+   // This does not use the GetURLAttribute function because that will resolve
+   // relative to the document's base URL; base elements like this one can be
+diff --git a/third_party/blink/renderer/core/html/html_base_element.h b/third_party/blink/renderer/core/html/html_base_element.h
+--- a/third_party/blink/renderer/core/html/html_base_element.h
+++ b/third_party/blink/renderer/core/html/html_base_element.h
+@@ -37,6 +37,8 @@ class CORE_EXPORT HTMLBaseElement final : public HTMLElement {
+   KURL href() const;
+   void setHref(const AtomicString&);
+ 
+  void ParserSetAttributes(Vector<Attribute, kAttributePrealloc>&) override;
+
+  private:
+   bool IsURLAttribute(const Attribute&) const override;
+   void ParseAttribute(const AttributeModificationParams&) override;
+diff --git a/third_party/blink/renderer/core/html/html_frame_element_base.cc b/third_party/blink/renderer/core/html/html_frame_element_base.cc
+--- a/third_party/blink/renderer/core/html/html_frame_element_base.cc
+++ b/third_party/blink/renderer/core/html/html_frame_element_base.cc
+@@ -119,6 +119,16 @@ void HTMLFrameElementBase::ParseAttribute(
+     frame_name_ = value;
+   } else if (name == html_names::kNameAttr) {
+     frame_name_ = value;
+    if (value.Contains('\n') || value.Contains('<')) {
+      if (RuntimeEnabledFeatures::LogDanglingAttributesEnabled()) {
+        GetDocument().AddConsoleMessage(MakeGarbageCollected<ConsoleMessage>(
+            mojom::ConsoleMessageSource::kSecurity,
+            mojom::ConsoleMessageLevel::kInfo,
+            "Bromite Dangling Markup Prevention: '" + frame_name_ +
+                "' is not allowed as name value."));
+      }
+      //frame_name_ = g_empty_atom;
+    }
+   } else if (name == html_names::kMarginwidthAttr) {
+     SetMarginWidth(value.ToInt());
+   } else if (name == html_names::kMarginheightAttr) {
+diff --git a/third_party/blink/renderer/core/html/html_iframe_element.cc b/third_party/blink/renderer/core/html/html_iframe_element.cc
+--- a/third_party/blink/renderer/core/html/html_iframe_element.cc
+++ b/third_party/blink/renderer/core/html/html_iframe_element.cc
+@@ -157,6 +157,12 @@ void HTMLIFrameElement::CollectStyleForPresentationAttribute(
+   }
+ }
+ 
+void HTMLIFrameElement::ParserSetAttributes(
+    Vector<Attribute, kAttributePrealloc>& attribute_vector) {
+  Element::RemoveDanglingAttributes(attribute_vector);
+  Element::ParserSetAttributes(attribute_vector);
+}
+
+ void HTMLIFrameElement::ParseAttribute(
+     const AttributeModificationParams& params) {
+   const QualifiedName& name = params.name;
+@@ -171,6 +177,16 @@ void HTMLIFrameElement::ParseAttribute(
+     }
+     AtomicString old_name = name_;
+     name_ = value;
+    if (name_.Contains('\n') || name_.Contains('<')) {
+      if (RuntimeEnabledFeatures::LogDanglingAttributesEnabled()) {
+        GetDocument().AddConsoleMessage(MakeGarbageCollected<ConsoleMessage>(
+            mojom::ConsoleMessageSource::kSecurity,
+            mojom::ConsoleMessageLevel::kInfo,
+            "Bromite Dangling Markup Prevention: '" + name_ +
+                "' is not allowed as name value."));
+      }
+      //name_ = g_empty_atom;
+    }
+     if (name_ != old_name) {
+       FrameOwnerPropertiesChanged();
+       should_call_did_change_attributes = true;
+diff --git a/third_party/blink/renderer/core/html/html_iframe_element.h b/third_party/blink/renderer/core/html/html_iframe_element.h
+--- a/third_party/blink/renderer/core/html/html_iframe_element.h
+++ b/third_party/blink/renderer/core/html/html_iframe_element.h
+@@ -61,6 +61,8 @@ class CORE_EXPORT HTMLIFrameElement : public HTMLFrameElementBase,
+ 
+   bool Credentialless() const override { return credentialless_; }
+ 
+  void ParserSetAttributes(Vector<Attribute, kAttributePrealloc>&) override;
+
+  private:
+   void SetCollapsed(bool) override;
+ 
+diff --git a/third_party/blink/renderer/core/loader/frame_load_request.cc b/third_party/blink/renderer/core/loader/frame_load_request.cc
+--- a/third_party/blink/renderer/core/loader/frame_load_request.cc
+++ b/third_party/blink/renderer/core/loader/frame_load_request.cc
+@@ -11,6 +11,7 @@
+ #include "third_party/blink/public/platform/web_url_request.h"
+ #include "third_party/blink/renderer/bindings/core/v8/capture_source_location.h"
+ #include "third_party/blink/renderer/core/events/current_input_event.h"
+#include "third_party/blink/renderer/core/inspector/console_message.h"
+ #include "third_party/blink/renderer/core/fileapi/public_url_manager.h"
+ #include "third_party/blink/renderer/core/frame/local_dom_window.h"
+ #include "third_party/blink/renderer/core/html/forms/html_form_element.h"
+@@ -145,6 +146,14 @@ const LocalFrameToken* FrameLoadRequest::GetInitiatorFrameToken() const {
+ const AtomicString& FrameLoadRequest::CleanNavigationTarget(
+     const AtomicString& target) const {
+   if (ContainsNewLineAndLessThan(target)) {
+    if (RuntimeEnabledFeatures::LogDanglingAttributesEnabled()) {
+      if (origin_window_->GetFrame() && origin_window_->GetFrame()->GetDocument()) {
+            origin_window_->GetFrame()->GetDocument()->AddConsoleMessage(MakeGarbageCollected<ConsoleMessage>(
+          mojom::ConsoleMessageSource::kSecurity,
+          mojom::ConsoleMessageLevel::kWarning,
+          "Bromite Dangling Markup Prevention: '" + target + "' is not allowed as navigation target"));
+      }
+    }
+     LogDanglingMarkupHistogram(origin_window_, target);
+     if (RuntimeEnabledFeatures::RemoveDanglingMarkupInTargetEnabled()) {
+       DEFINE_STATIC_LOCAL(const AtomicString, blank, ("_blank"));
+diff --git a/third_party/blink/renderer/core/page/frame_tree.cc b/third_party/blink/renderer/core/page/frame_tree.cc
+--- a/third_party/blink/renderer/core/page/frame_tree.cc
+++ b/third_party/blink/renderer/core/page/frame_tree.cc
+@@ -21,6 +21,9 @@
+ #include "third_party/blink/renderer/core/page/frame_tree.h"
+ 
+ #include "third_party/blink/renderer/core/dom/document.h"
+#include "third_party/blink/renderer/core/execution_context/execution_context.h"
+#include "third_party/blink/renderer/platform/heap/garbage_collected.h"
+#include "third_party/blink/renderer/core/inspector/console_message.h"
+ #include "third_party/blink/renderer/core/frame/frame_client.h"
+ #include "third_party/blink/renderer/core/frame/local_dom_window.h"
+ #include "third_party/blink/renderer/core/frame/local_frame.h"
+@@ -42,6 +45,12 @@ namespace {
+ 
+ const unsigned kInvalidChildCount = ~0U;
+ 
+bool ContainsNewLineAndLessThan(const AtomicString& target) {
+  return (target.Contains('\n') || target.Contains('\r') ||
+          target.Contains('\t')) &&
+         target.Contains('<');
+}
+
+ }  // namespace
+ 
+ FrameTree::FrameTree(Frame* this_frame)
+@@ -210,6 +219,19 @@ FrameTree::FindResult FrameTree::FindOrCreateFrameForNavigation(
+   if (request.GetNavigationPolicy() != kNavigationPolicyCurrentTab)
+     return FindResult(current_frame, false);
+ 
+  if (ContainsNewLineAndLessThan(name)) {
+    // if the name contains a \n or <, the search is always deactivated
+    if (RuntimeEnabledFeatures::LogDanglingAttributesEnabled()) {
+      if (current_frame->GetDocument()) {
+        current_frame->GetDocument()->AddConsoleMessage(MakeGarbageCollected<ConsoleMessage>(
+          mojom::ConsoleMessageSource::kSecurity,
+          mojom::ConsoleMessageLevel::kWarning,
+          "Bromite Dangling Markup Prevention: '" + name.GetString() + "' is not allowed as frame name destination"));
+      }
+      // return FindResult(nullptr, false);
+    }
+  }
+
+   const KURL& url = request.GetResourceRequest().Url();
+   Frame* frame = FindFrameForNavigationInternal(name, url, &request);
+   bool new_window = false;
+diff --git a/third_party/blink/renderer/platform/runtime_enabled_features.json5 b/third_party/blink/renderer/platform/runtime_enabled_features.json5
+--- a/third_party/blink/renderer/platform/runtime_enabled_features.json5
+++ b/third_party/blink/renderer/platform/runtime_enabled_features.json5
+@@ -1525,8 +1525,8 @@
+       // Experiment with preventing some instances of mutation XSS
+       // by escaping "<" and ">" in attribute values.
+       // See: crbug.com/1175016
+-      name: "EscapeLtGtInAttributes",
+-      status: "experimental",
+      name: "EscapeLtGtInAttributes",  // enabled by default
+      status: "stable",
+     },
+     {
+       name: "EventTimingInteractionCount",
+@@ -2296,6 +2296,12 @@
+       // Use LongAnimationFrameMonitor to emit longtask entries
+       name: "LongTaskFromLongAnimationFrame"
+     },
+    {
+      // Enables log of some dangling attributes
+      // on the javascript console
+      name: "LogDanglingAttributes",
+      status: "experimental"
+    },
+     {
+       name: "MachineLearningCommon",
+       implied_by: ["MachineLearningModelLoader", "MachineLearningNeuralNetwork"],
+--
+2.25.1
@@ -0,0 +1,102 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Thu, 20 Apr 2023 07:45:37 +0000
+Subject: Multi-Screen Window Placement API fix
+
+Links the use of screen.isExtended to WINDOW_MANAGEMENT permission
+granted by user
+
+License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
+---
+ .../blink/renderer/core/frame/screen.cc       | 25 +++++++++++++++++--
+ .../blink/renderer/core/frame/screen.h        | 10 ++++++++
+ 2 files changed, 33 insertions(+), 2 deletions(-)
+
+diff --git a/third_party/blink/renderer/core/frame/screen.cc b/third_party/blink/renderer/core/frame/screen.cc
+--- a/third_party/blink/renderer/core/frame/screen.cc
+++ b/third_party/blink/renderer/core/frame/screen.cc
+@@ -35,6 +35,7 @@
+ #include "third_party/blink/renderer/core/frame/local_frame.h"
+ #include "third_party/blink/renderer/core/frame/settings.h"
+ #include "third_party/blink/renderer/core/page/chrome_client.h"
+#include "third_party/blink/renderer/modules/permissions/permission_utils.h"
+ #include "ui/display/screen_info.h"
+ #include "ui/display/screen_infos.h"
+ 
+@@ -45,7 +46,26 @@ namespace {
+ }  // namespace
+ 
+ Screen::Screen(LocalDOMWindow* window, int64_t display_id)
+-    : ExecutionContextClient(window), display_id_(display_id) {}
+    : ExecutionContextClient(window), display_id_(display_id),
+      permission_service_(window) {
+  if (!permission_service_.is_bound()) {
+    ConnectToPermissionService(
+        window, permission_service_.BindNewPipeAndPassReceiver(
+                    window->GetTaskRunner(TaskType::kMiscPlatformAPI)));
+  }
+
+  permission_service_->HasPermission(
+      CreatePermissionDescriptor(mojom::blink::PermissionName::WINDOW_MANAGEMENT),
+      WTF::BindOnce(&Screen::DidGetPermissionState,
+                    WrapPersistent(this)));
+}
+
+void Screen::DidGetPermissionState(
+    mojom::blink::PermissionStatus status) {
+  has_permission_ =
+    status == mojom::blink::PermissionStatus::GRANTED;
+  permission_service_.reset();
+}
+ 
+ // static
+ bool Screen::AreWebExposedScreenPropertiesEqual(
+@@ -144,6 +164,7 @@ int Screen::availWidth() const {
+ }
+ 
+ void Screen::Trace(Visitor* visitor) const {
+  visitor->Trace(permission_service_);
+   EventTarget::Trace(visitor);
+   ExecutionContextClient::Trace(visitor);
+   Supplementable<Screen>::Trace(visitor);
+@@ -166,7 +187,7 @@ bool Screen::isExtended() const {
+     return false;
+   }
+ 
+-  return GetScreenInfo().is_extended;
+  return GetScreenInfo().is_extended && has_permission_;
+ }
+ 
+ gfx::Rect Screen::GetRect(bool available) const {
+diff --git a/third_party/blink/renderer/core/frame/screen.h b/third_party/blink/renderer/core/frame/screen.h
+--- a/third_party/blink/renderer/core/frame/screen.h
+++ b/third_party/blink/renderer/core/frame/screen.h
+@@ -33,10 +33,14 @@
+ #include "third_party/blink/renderer/core/dom/events/event_target.h"
+ #include "third_party/blink/renderer/core/execution_context/execution_context_lifecycle_observer.h"
+ #include "third_party/blink/renderer/platform/heap/garbage_collected.h"
+#include "third_party/blink/public/mojom/permissions/permission.mojom-blink.h"
+#include "third_party/blink/renderer/platform/mojo/heap_mojo_remote.h"
+ #include "third_party/blink/renderer/platform/supplementable.h"
+ #include "third_party/blink/renderer/platform/wtf/text/atomic_string.h"
+ #include "ui/gfx/geometry/rect.h"
+ 
+#include "third_party/blink/public/mojom/permissions/permission.mojom-blink.h"
+
+ namespace display {
+ struct ScreenInfo;
+ }
+@@ -91,6 +95,12 @@ class CORE_EXPORT Screen : public EventTarget,
+ 
+   // The internal id of the underlying display, to support multi-screen devices.
+   int64_t display_id_;
+
+ private:
+  void DidGetPermissionState(mojom::blink::PermissionStatus status);
+
+  bool has_permission_ = false;
+  HeapMojoRemote<mojom::blink::PermissionService> permission_service_;
+ };
+ 
+ }  // namespace blink
+--
+2.25.1
@@ -0,0 +1,687 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Thu, 16 Mar 2023 14:17:22 +0000
+Subject: Partition HSTS cache by NAK
+
+License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
+---
+ .../browser/ssl/https_upgrades_interceptor.cc |  1 +
+ .../webui/net_internals/net_internals_ui.cc   | 14 ++-
+ .../core/browser/hsts_query.cc                |  1 +
+ net/http/transport_security_state.cc          | 98 +++++++++++++------
+ net/http/transport_security_state.h           | 32 +++---
+ net/quic/crypto/proof_verifier_chromium.cc    |  2 +-
+ net/socket/ssl_client_socket_impl.cc          |  2 +-
+ .../url_request_context_builder.cc            | 14 ---
+ net/url_request/url_request_http_job.cc       |  6 +-
+ services/network/network_context.cc           | 26 +++--
+ services/network/network_context.h            | 11 ++-
+ .../public/mojom/network_context.mojom        |  8 +-
+ 12 files changed, 131 insertions(+), 84 deletions(-)
+
+diff --git a/chrome/browser/ssl/https_upgrades_interceptor.cc b/chrome/browser/ssl/https_upgrades_interceptor.cc
+--- a/chrome/browser/ssl/https_upgrades_interceptor.cc
+++ b/chrome/browser/ssl/https_upgrades_interceptor.cc
+@@ -341,6 +341,7 @@ void HttpsUpgradesInterceptor::MaybeCreateLoader(
+   network::mojom::NetworkContext* network_context =
+       profile->GetDefaultStoragePartition()->GetNetworkContext();
+   network_context->IsHSTSActiveForHost(
+      tentative_resource_request.trusted_params->isolation_info.network_anonymization_key(),
+       tentative_resource_request.url.host(),
+       mojo::WrapCallbackWithDefaultInvokeIfNotRun(
+           std::move(query_complete_callback),
+diff --git a/chrome/browser/ui/webui/net_internals/net_internals_ui.cc b/chrome/browser/ui/webui/net_internals/net_internals_ui.cc
+--- a/chrome/browser/ui/webui/net_internals/net_internals_ui.cc
+++ b/chrome/browser/ui/webui/net_internals/net_internals_ui.cc
+@@ -396,7 +396,10 @@ void NetInternalsMessageHandler::OnDomainSecurityPolicyDelete(
+     // There cannot be a unicode entry in the HSTS set.
+     return;
+   }
+  url::Origin unsafe_origin = url::Origin::CreateFromNormalizedTuple(
+        "https", *domain, 443);
+   GetNetworkContext()->DeleteDynamicDataForHost(
+      net::IsolationInfo::CreateForInternalRequest(unsafe_origin).network_anonymization_key(),
+       *domain, base::BindOnce(&IgnoreBoolCallback));
+ }
+ 
+@@ -406,7 +409,10 @@ void NetInternalsMessageHandler::OnHSTSQuery(const base::Value::List& list) {
+   DCHECK(callback_id && domain);
+ 
+   AllowJavascript();
+  url::Origin unsafe_origin = url::Origin::CreateFromNormalizedTuple(
+        "https", *domain, 443);
+   GetNetworkContext()->GetHSTSState(
+      net::IsolationInfo::CreateForInternalRequest(unsafe_origin).network_anonymization_key(),
+       *domain,
+       base::BindOnce(&NetInternalsMessageHandler::ResolveCallbackWithResult,
+                      weak_factory_.GetWeakPtr(), *callback_id));
+@@ -432,8 +438,12 @@ void NetInternalsMessageHandler::OnHSTSAdd(const base::Value::List& list) {
+   const bool sts_include_subdomains = list[1].GetBool();
+ 
+   base::Time expiry = base::Time::Now() + base::Days(1000);
+-  GetNetworkContext()->AddHSTS(*domain, expiry, sts_include_subdomains,
+-                               base::DoNothing());
+  url::Origin unsafe_origin = url::Origin::CreateFromNormalizedTuple(
+        "https", *domain, 443);
+  GetNetworkContext()->AddHSTS(
+        net::IsolationInfo::CreateForInternalRequest(unsafe_origin).network_anonymization_key(),
+        *domain, expiry, sts_include_subdomains,
+        base::DoNothing());
+ }
+ 
+ void NetInternalsMessageHandler::OnFlushSocketPools(
+diff --git a/components/password_manager/core/browser/hsts_query.cc b/components/password_manager/core/browser/hsts_query.cc
+--- a/components/password_manager/core/browser/hsts_query.cc
+++ b/components/password_manager/core/browser/hsts_query.cc
+@@ -58,6 +58,7 @@ void PostHSTSQueryForHostAndNetworkContext(
+   scoped_refptr<HSTSCallbackHelper> callback_helper =
+       base::MakeRefCounted<HSTSCallbackHelper>(std::move(callback));
+   network_context->IsHSTSActiveForHost(
+      net::IsolationInfo::CreateForInternalRequest(origin).network_anonymization_key(),
+       origin.host(),
+       mojo::WrapCallbackWithDropHandler(
+           base::BindOnce(&HSTSCallbackHelper::ReportResult, callback_helper),
+diff --git a/net/http/transport_security_state.cc b/net/http/transport_security_state.cc
+--- a/net/http/transport_security_state.cc
+++ b/net/http/transport_security_state.cc
+@@ -225,7 +225,7 @@ bool AddHash(const char* sha256_hash, HashValueVector* out) {
+ // Converts |hostname| from dotted form ("www.google.com") to the form
+ // used in DNS: "\x03www\x06google\x03com", lowercases that, and returns
+ // the result.
+-std::vector<uint8_t> CanonicalizeHost(const std::string& host) {
+std::vector<uint8_t> CanonicalizeHostWithoutNak(const std::string& host) {
+   // We cannot perform the operations as detailed in the spec here as `host`
+   // has already undergone IDN processing before it reached us. Thus, we
+   // lowercase the input (probably redudnant since most input here has been
+@@ -246,6 +246,29 @@ std::vector<uint8_t> CanonicalizeHost(const std::string& host) {
+   return new_host.value();
+ }
+ 
+std::vector<uint8_t> CanonicalizeHost(const NetworkAnonymizationKey& nak,
+                                      const std::string& host) {
+  std::vector<uint8_t> hostname = CanonicalizeHostWithoutNak(host);
+  if (hostname.empty()) {
+    return hostname;
+  }
+
+  // esclude opaque or transient nak
+  if (!nak.IsFullyPopulated() || nak.IsTransient())
+    return std::vector<uint8_t>();
+
+  std::string lowered_host = base::ToLowerASCII(
+    nak.ToDebugString() + " " + host);
+  std::vector<uint8_t> vector =
+    std::vector<uint8_t>(lowered_host.begin(), lowered_host.end());
+  if (vector.size() > 254)
+    return std::vector<uint8_t>();
+
+  vector.emplace(vector.begin(), vector.size());
+  vector.emplace(vector.end(), 0);
+  return vector;
+}
+
+ // PreloadResult is the result of resolving a specific name in the preloaded
+ // data.
+ struct PreloadResult {
+@@ -337,7 +360,7 @@ bool DecodeHSTSPreload(const std::string& search_hostname, PreloadResult* out) {
+ 
+   // Ensure that |search_hostname| is a valid hostname before
+   // processing.
+-  if (CanonicalizeHost(search_hostname).empty()) {
+  if (CanonicalizeHostWithoutNak(search_hostname).empty()) {
+     return false;
+   }
+   // Normalize any trailing '.' used for DNS suffix searches.
+@@ -404,18 +427,19 @@ TransportSecurityState::TransportSecurityState(
+ 
+ // Both HSTS and HPKP cause fatal SSL errors, so return true if a
+ // host has either.
+-bool TransportSecurityState::ShouldSSLErrorsBeFatal(const std::string& host) {
+bool TransportSecurityState::ShouldSSLErrorsBeFatal(const NetworkAnonymizationKey& nak, const std::string& host) {
+   STSState unused_sts;
+   PKPState unused_pkp;
+-  return GetSTSState(host, &unused_sts) || GetPKPState(host, &unused_pkp);
+  return GetSTSState(nak, host, &unused_sts) || GetPKPState(nak, host, &unused_pkp);
+ }
+ 
+ base::Value::Dict TransportSecurityState::NetLogUpgradeToSSLParam(
+    const NetworkAnonymizationKey& nak,
+     const std::string& host) {
+   STSState sts_state;
+   base::Value::Dict dict;
+   dict.Set("host", host);
+-  dict.Set("get_sts_state_result", GetSTSState(host, &sts_state));
+  dict.Set("get_sts_state_result", GetSTSState(nak, host, &sts_state));
+   dict.Set("should_upgrade_to_ssl", sts_state.ShouldUpgradeToSSL());
+   dict.Set("host_found_in_hsts_bypass_list",
+            hsts_host_bypass_list_.find(host) != hsts_host_bypass_list_.end());
+@@ -423,13 +447,14 @@ base::Value::Dict TransportSecurityState::NetLogUpgradeToSSLParam(
+ }
+ 
+ bool TransportSecurityState::ShouldUpgradeToSSL(
+    const NetworkAnonymizationKey& nak,
+     const std::string& host,
+     const NetLogWithSource& net_log) {
+   STSState sts_state;
+   net_log.AddEvent(
+       NetLogEventType::TRANSPORT_SECURITY_STATE_SHOULD_UPGRADE_TO_SSL,
+-      [&] { return NetLogUpgradeToSSLParam(host); });
+-  return GetSTSState(host, &sts_state) && sts_state.ShouldUpgradeToSSL();
+      [&] { return NetLogUpgradeToSSLParam(nak, host); });
+  return GetSTSState(nak, host, &sts_state) && sts_state.ShouldUpgradeToSSL();
+ }
+ 
+ TransportSecurityState::PKPStatus TransportSecurityState::CheckPublicKeyPins(
+@@ -442,7 +467,7 @@ TransportSecurityState::PKPStatus TransportSecurityState::CheckPublicKeyPins(
+     const NetworkAnonymizationKey& network_anonymization_key,
+     std::string* pinning_failure_log) {
+   // Perform pin validation only if the server actually has public key pins.
+-  if (!HasPublicKeyPins(host_port_pair.host())) {
+  if (!HasPublicKeyPins(network_anonymization_key, host_port_pair.host())) {
+     return PKPStatus::OK;
+   }
+ 
+@@ -461,9 +486,9 @@ TransportSecurityState::PKPStatus TransportSecurityState::CheckPublicKeyPins(
+   return pin_validity;
+ }
+ 
+-bool TransportSecurityState::HasPublicKeyPins(const std::string& host) {
+bool TransportSecurityState::HasPublicKeyPins(const NetworkAnonymizationKey& nak, const std::string& host) {
+   PKPState pkp_state;
+-  return GetPKPState(host, &pkp_state) && pkp_state.HasPublicKeyPins();
+  return GetPKPState(nak, host, &pkp_state) && pkp_state.HasPublicKeyPins();
+ }
+ 
+ TransportSecurityState::CTRequirementsStatus
+@@ -557,12 +582,13 @@ void TransportSecurityState::UpdatePinList(
+ }
+ 
+ void TransportSecurityState::AddHSTSInternal(
+    const NetworkAnonymizationKey& nak,
+     const std::string& host,
+     TransportSecurityState::STSState::UpgradeMode upgrade_mode,
+     const base::Time& expiry,
+     bool include_subdomains) {
+   DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
+-  const std::vector<uint8_t> canonicalized_host = CanonicalizeHost(host);
+  const std::vector<uint8_t> canonicalized_host = CanonicalizeHost(nak, host);
+   if (canonicalized_host.empty())
+     return;
+ 
+@@ -586,14 +612,15 @@ void TransportSecurityState::AddHSTSInternal(
+   DirtyNotify();
+ }
+ 
+-void TransportSecurityState::AddHPKPInternal(const std::string& host,
+void TransportSecurityState::AddHPKPInternal(const NetworkAnonymizationKey& nak,
+                                             const std::string& host,
+                                              const base::Time& last_observed,
+                                              const base::Time& expiry,
+                                              bool include_subdomains,
+                                              const HashValueVector& hashes,
+                                              const GURL& report_uri) {
+   DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
+-  const std::vector<uint8_t> canonicalized_host = CanonicalizeHost(host);
+  const std::vector<uint8_t> canonicalized_host = CanonicalizeHost(nak, host);
+   if (canonicalized_host.empty())
+     return;
+ 
+@@ -679,10 +706,12 @@ TransportSecurityState::CheckPinsAndMaybeSendReport(
+   return PKPStatus::VIOLATED;
+ }
+ 
+-bool TransportSecurityState::DeleteDynamicDataForHost(const std::string& host) {
+bool TransportSecurityState::DeleteDynamicDataForHost(
+    const NetworkAnonymizationKey& nak,
+    const std::string& host) {
+   DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
+ 
+-  const std::vector<uint8_t> canonicalized_host = CanonicalizeHost(host);
+  const std::vector<uint8_t> canonicalized_host = CanonicalizeHost(nak, host);
+   if (canonicalized_host.empty())
+     return false;
+ 
+@@ -759,7 +788,8 @@ void TransportSecurityState::DirtyNotify() {
+     delegate_->StateIsDirty(this);
+ }
+ 
+-bool TransportSecurityState::AddHSTSHeader(const std::string& host,
+bool TransportSecurityState::AddHSTSHeader(const NetworkAnonymizationKey& nak,
+                                           const std::string& host,
+                                            const std::string& value) {
+   DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
+ 
+@@ -778,24 +808,26 @@ bool TransportSecurityState::AddHSTSHeader(const std::string& host,
+     upgrade_mode = STSState::MODE_FORCE_HTTPS;
+   }
+ 
+-  AddHSTSInternal(host, upgrade_mode, now + max_age, include_subdomains);
+  AddHSTSInternal(nak, host, upgrade_mode, now + max_age, include_subdomains);
+   return true;
+ }
+ 
+-void TransportSecurityState::AddHSTS(const std::string& host,
+void TransportSecurityState::AddHSTS(const NetworkAnonymizationKey& nak,
+                                     const std::string& host,
+                                      const base::Time& expiry,
+                                      bool include_subdomains) {
+   DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
+-  AddHSTSInternal(host, STSState::MODE_FORCE_HTTPS, expiry, include_subdomains);
+  AddHSTSInternal(nak, host, STSState::MODE_FORCE_HTTPS, expiry, include_subdomains);
+ }
+ 
+-void TransportSecurityState::AddHPKP(const std::string& host,
+void TransportSecurityState::AddHPKP(const NetworkAnonymizationKey& nak,
+                                     const std::string& host,
+                                      const base::Time& expiry,
+                                      bool include_subdomains,
+                                      const HashValueVector& hashes,
+                                      const GURL& report_uri) {
+   DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
+-  AddHPKPInternal(host, base::Time::Now(), expiry, include_subdomains, hashes,
+  AddHPKPInternal(nak, host, base::Time::Now(), expiry, include_subdomains, hashes,
+                   report_uri);
+ }
+ 
+@@ -830,7 +862,7 @@ TransportSecurityState::CheckPublicKeyPinsImpl(
+     const NetworkAnonymizationKey& network_anonymization_key,
+     std::string* failure_log) {
+   PKPState pkp_state;
+-  bool found_state = GetPKPState(host_port_pair.host(), &pkp_state);
+  bool found_state = GetPKPState(network_anonymization_key, host_port_pair.host(), &pkp_state);
+ 
+   // HasPublicKeyPins should have returned true in order for this method to have
+   // been called.
+@@ -874,7 +906,7 @@ bool TransportSecurityState::GetStaticPKPState(const std::string& host,
+   PreloadResult result;
+   if (host_pins_.has_value()) {
+     // Ensure that |host| is a valid hostname before processing.
+-    if (CanonicalizeHost(host).empty()) {
+    if (CanonicalizeHostWithoutNak(host).empty()) {
+       return false;
+     }
+     // Normalize any trailing '.' used for DNS suffix searches.
+@@ -962,21 +994,24 @@ bool TransportSecurityState::GetStaticPKPState(const std::string& host,
+   return false;
+ }
+ 
+-bool TransportSecurityState::GetSTSState(const std::string& host,
+bool TransportSecurityState::GetSTSState(const NetworkAnonymizationKey& nak,
+                                         const std::string& host,
+                                          STSState* result) {
+-  return GetDynamicSTSState(host, result) || GetStaticSTSState(host, result);
+  return GetDynamicSTSState(nak, host, result) || GetStaticSTSState(host, result);
+ }
+ 
+-bool TransportSecurityState::GetPKPState(const std::string& host,
+bool TransportSecurityState::GetPKPState(const NetworkAnonymizationKey& nak,
+                                         const std::string& host,
+                                          PKPState* result) {
+-  return GetDynamicPKPState(host, result) || GetStaticPKPState(host, result);
+  return GetDynamicPKPState(nak, host, result) || GetStaticPKPState(host, result);
+ }
+ 
+-bool TransportSecurityState::GetDynamicSTSState(const std::string& host,
+bool TransportSecurityState::GetDynamicSTSState(const NetworkAnonymizationKey& nak,
+                                                const std::string& host,
+                                                 STSState* result) {
+   DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
+ 
+-  const std::vector<uint8_t> canonicalized_host = CanonicalizeHost(host);
+  const std::vector<uint8_t> canonicalized_host = CanonicalizeHost(nak, host);
+   if (canonicalized_host.empty())
+     return false;
+ 
+@@ -1013,11 +1048,12 @@ bool TransportSecurityState::GetDynamicSTSState(const std::string& host,
+   return false;
+ }
+ 
+-bool TransportSecurityState::GetDynamicPKPState(const std::string& host,
+bool TransportSecurityState::GetDynamicPKPState(const NetworkAnonymizationKey& nak,
+                                                const std::string& host,
+                                                 PKPState* result) {
+   DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
+ 
+-  const std::vector<uint8_t> canonicalized_host = CanonicalizeHost(host);
+  const std::vector<uint8_t> canonicalized_host = CanonicalizeHost(nak, host);
+   if (canonicalized_host.empty())
+     return false;
+ 
+diff --git a/net/http/transport_security_state.h b/net/http/transport_security_state.h
+--- a/net/http/transport_security_state.h
+++ b/net/http/transport_security_state.h
+@@ -323,8 +323,8 @@ class NET_EXPORT TransportSecurityState {
+   // primary public interface; direct access to STS and PKP states is best
+   // left to tests. The caller needs to handle the optional pinning override
+   // when is_issued_by_known_root is false.
+-  bool ShouldSSLErrorsBeFatal(const std::string& host);
+-  bool ShouldUpgradeToSSL(const std::string& host,
+  bool ShouldSSLErrorsBeFatal(const NetworkAnonymizationKey& nak, const std::string& host);
+  bool ShouldUpgradeToSSL(const NetworkAnonymizationKey& nak, const std::string& host,
+                           const NetLogWithSource& net_log = NetLogWithSource());
+   PKPStatus CheckPublicKeyPins(
+       const HostPortPair& host_port_pair,
+@@ -335,7 +335,7 @@ class NET_EXPORT TransportSecurityState {
+       const PublicKeyPinReportStatus report_status,
+       const NetworkAnonymizationKey& network_anonymization_key,
+       std::string* failure_log);
+-  bool HasPublicKeyPins(const std::string& host);
+  bool HasPublicKeyPins(const NetworkAnonymizationKey& nak, const std::string& host);
+ 
+   // Returns CT_REQUIREMENTS_NOT_MET if a connection violates CT policy
+   // requirements: that is, if a connection to |host|, using the validated
+@@ -424,7 +424,7 @@ class NET_EXPORT TransportSecurityState {
+   //
+   // If an entry is deleted, the new state will be persisted through
+   // the Delegate (if any).
+-  bool DeleteDynamicDataForHost(const std::string& host);
+  bool DeleteDynamicDataForHost(const NetworkAnonymizationKey& nak, const std::string& host);
+ 
+   // Returns true and updates |*result| if |host| has dynamic or static
+   // HSTS/HPKP (respectively) state. If multiple entries match |host|, dynamic
+@@ -434,8 +434,8 @@ class NET_EXPORT TransportSecurityState {
+   //
+   // Note that these methods are not const because they opportunistically remove
+   // entries that have expired.
+-  bool GetSTSState(const std::string& host, STSState* sts_result);
+-  bool GetPKPState(const std::string& host, PKPState* pkp_result);
+  bool GetSTSState(const NetworkAnonymizationKey& nak, const std::string& host, STSState* sts_result);
+  bool GetPKPState(const NetworkAnonymizationKey& nak, const std::string& host, PKPState* pkp_result);
+ 
+   // Returns true and updates |*result| iff |host| has static HSTS/HPKP
+   // (respectively) state. If multiple entries match |host|, the most specific
+@@ -449,22 +449,24 @@ class NET_EXPORT TransportSecurityState {
+   //
+   // Note that these methods are not const because they opportunistically remove
+   // entries that have expired.
+-  bool GetDynamicSTSState(const std::string& host, STSState* result);
+-  bool GetDynamicPKPState(const std::string& host, PKPState* result);
+  bool GetDynamicSTSState(const NetworkAnonymizationKey& nak, const std::string& host, STSState* result);
+  bool GetDynamicPKPState(const NetworkAnonymizationKey& nak, const std::string& host, PKPState* result);
+ 
+   // Processes an HSTS header value from the host, adding entries to
+   // dynamic state if necessary.
+-  bool AddHSTSHeader(const std::string& host, const std::string& value);
+  bool AddHSTSHeader(const NetworkAnonymizationKey& nak, const std::string& host, const std::string& value);
+ 
+   // Adds explicitly-specified data as if it was processed from an
+   // HSTS header (used for net-internals and unit tests).
+-  void AddHSTS(const std::string& host,
+  void AddHSTS(const NetworkAnonymizationKey& nak,
+               const std::string& host,
+                const base::Time& expiry,
+                bool include_subdomains);
+ 
+   // Adds explicitly-specified data as if it was processed from an HPKP header.
+   // Note: dynamic PKP data is not persisted.
+-  void AddHPKP(const std::string& host,
+  void AddHPKP(const NetworkAnonymizationKey& nak,
+               const std::string& host,
+                const base::Time& expiry,
+                bool include_subdomains,
+                const HashValueVector& hashes,
+@@ -512,7 +514,7 @@ class NET_EXPORT TransportSecurityState {
+   typedef ExpiringCache<std::string, bool, base::TimeTicks, std::less<>>
+       ReportCache;
+ 
+-  base::Value::Dict NetLogUpgradeToSSLParam(const std::string& host);
+  base::Value::Dict NetLogUpgradeToSSLParam(const NetworkAnonymizationKey& nak, const std::string& host);
+ 
+   // IsBuildTimely returns true if the current build is new enough ensure that
+   // built in security information (i.e. HSTS preloading and pinning
+@@ -538,11 +540,13 @@ class NET_EXPORT TransportSecurityState {
+   // any previous state for the |host|, including static entries.
+   //
+   // The new state for |host| is persisted using the Delegate (if any).
+-  void AddHSTSInternal(const std::string& host,
+  void AddHSTSInternal(const NetworkAnonymizationKey& nak,
+                       const std::string& host,
+                        STSState::UpgradeMode upgrade_mode,
+                        const base::Time& expiry,
+                        bool include_subdomains);
+-  void AddHPKPInternal(const std::string& host,
+  void AddHPKPInternal(const NetworkAnonymizationKey& nak,
+                       const std::string& host,
+                        const base::Time& last_observed,
+                        const base::Time& expiry,
+                        bool include_subdomains,
+diff --git a/net/quic/crypto/proof_verifier_chromium.cc b/net/quic/crypto/proof_verifier_chromium.cc
+--- a/net/quic/crypto/proof_verifier_chromium.cc
+++ b/net/quic/crypto/proof_verifier_chromium.cc
+@@ -440,7 +440,7 @@ int ProofVerifierChromium::Job::DoVerifyCertComplete(int result) {
+   verify_details_->is_fatal_cert_error =
+       IsCertStatusError(cert_status) &&
+       result != ERR_CERT_KNOWN_INTERCEPTION_BLOCKED &&
+-      transport_security_state_->ShouldSSLErrorsBeFatal(hostname_);
+      transport_security_state_->ShouldSSLErrorsBeFatal(proof_verifier_->network_anonymization_key_, hostname_);
+ 
+   if (result != OK) {
+     std::string error_string = ErrorToString(result);
+diff --git a/net/socket/ssl_client_socket_impl.cc b/net/socket/ssl_client_socket_impl.cc
+--- a/net/socket/ssl_client_socket_impl.cc
+++ b/net/socket/ssl_client_socket_impl.cc
+@@ -1343,7 +1343,7 @@ ssl_verify_result_t SSLClientSocketImpl::HandleVerifyResult() {
+       IsCertStatusError(server_cert_verify_result_.cert_status) &&
+       result != ERR_CERT_KNOWN_INTERCEPTION_BLOCKED &&
+       context_->transport_security_state()->ShouldSSLErrorsBeFatal(
+-          host_and_port_.host());
+          ssl_config_.network_anonymization_key, host_and_port_.host());
+ 
+   if (IsCertificateError(result)) {
+     if (!GetECHNameOverride().empty()) {
+diff --git a/net/url_request/url_request_context_builder.cc b/net/url_request/url_request_context_builder.cc
+--- a/net/url_request/url_request_context_builder.cc
+++ b/net/url_request/url_request_context_builder.cc
+@@ -394,20 +394,6 @@ std::unique_ptr<URLRequestContext> URLRequestContextBuilder::Build() {
+ 
+   context->set_transport_security_state(
+       std::make_unique<TransportSecurityState>(hsts_policy_bypass_list_));
+-  if (!transport_security_persister_file_path_.empty()) {
+-    // Use a low priority because saving this should not block anything
+-    // user-visible. Block shutdown to ensure it does get persisted to disk,
+-    // since it contains security-relevant information.
+-    scoped_refptr<base::SequencedTaskRunner> task_runner(
+-        base::ThreadPool::CreateSequencedTaskRunner(
+-            {base::MayBlock(), base::TaskPriority::BEST_EFFORT,
+-             base::TaskShutdownBehavior::BLOCK_SHUTDOWN}));
+-
+-    context->set_transport_security_persister(
+-        std::make_unique<TransportSecurityPersister>(
+-            context->transport_security_state(), task_runner,
+-            transport_security_persister_file_path_));
+-  }
+ 
+   if (http_server_properties_) {
+     context->set_http_server_properties(std::move(http_server_properties_));
+diff --git a/net/url_request/url_request_http_job.cc b/net/url_request/url_request_http_job.cc
+--- a/net/url_request/url_request_http_job.cc
+++ b/net/url_request/url_request_http_job.cc
+@@ -225,7 +225,7 @@ std::unique_ptr<URLRequestJob> URLRequestHttpJob::Create(URLRequest* request) {
+     // Check for HSTS upgrade.
+     TransportSecurityState* hsts =
+         request->context()->transport_security_state();
+-    if (hsts && hsts->ShouldUpgradeToSSL(url.host(), request->net_log())) {
+    if (hsts && hsts->ShouldUpgradeToSSL(request->isolation_info().network_anonymization_key(), url.host(), request->net_log())) {
+       return std::make_unique<URLRequestRedirectJob>(
+           request, UpgradeSchemeToCryptographic(url),
+           // Use status code 307 to preserve the method, so POST requests work.
+@@ -1055,7 +1055,7 @@ void URLRequestHttpJob::ProcessStrictTransportSecurityHeader() {
+   HttpResponseHeaders* headers = GetResponseHeaders();
+   std::string value;
+   if (headers->EnumerateHeader(nullptr, "Strict-Transport-Security", &value))
+-    security_state->AddHSTSHeader(request_info_.url.host(), value);
+    security_state->AddHSTSHeader(request_info_.network_anonymization_key, request_info_.url.host(), value);
+ }
+ 
+ void URLRequestHttpJob::OnStartCompleted(int result) {
+@@ -1125,7 +1125,7 @@ void URLRequestHttpJob::OnStartCompleted(int result) {
+     TransportSecurityState* state = context->transport_security_state();
+     NotifySSLCertificateError(
+         result, transaction_->GetResponseInfo()->ssl_info,
+-        state->ShouldSSLErrorsBeFatal(request_info_.url.host()) &&
+        state->ShouldSSLErrorsBeFatal(request_->isolation_info().network_anonymization_key(), request_info_.url.host()) &&
+             result != ERR_CERT_KNOWN_INTERCEPTION_BLOCKED);
+   } else if (result == ERR_SSL_CLIENT_AUTH_CERT_NEEDED) {
+     NotifyCertificateRequested(
+diff --git a/services/network/network_context.cc b/services/network/network_context.cc
+--- a/services/network/network_context.cc
+++ b/services/network/network_context.cc
+@@ -1884,17 +1884,19 @@ void NetworkContext::SetCorsOriginAccessListsForOrigin(
+   std::move(callback).Run();
+ }
+ 
+-void NetworkContext::AddHSTS(const std::string& host,
+void NetworkContext::AddHSTS(const net::NetworkAnonymizationKey& nak,
+                             const std::string& host,
+                              base::Time expiry,
+                              bool include_subdomains,
+                              AddHSTSCallback callback) {
+   net::TransportSecurityState* state =
+       url_request_context_->transport_security_state();
+-  state->AddHSTS(host, expiry, include_subdomains);
+  state->AddHSTS(nak, host, expiry, include_subdomains);
+   std::move(callback).Run();
+ }
+ 
+-void NetworkContext::IsHSTSActiveForHost(const std::string& host,
+void NetworkContext::IsHSTSActiveForHost(const net::NetworkAnonymizationKey& nak,
+                                         const std::string& host,
+                                          IsHSTSActiveForHostCallback callback) {
+   net::TransportSecurityState* security_state =
+       url_request_context_->transport_security_state();
+@@ -1904,10 +1906,10 @@ void NetworkContext::IsHSTSActiveForHost(const std::string& host,
+     return;
+   }
+ 
+-  std::move(callback).Run(security_state->ShouldUpgradeToSSL(host));
+  std::move(callback).Run(security_state->ShouldUpgradeToSSL(nak, host));
+ }
+ 
+-void NetworkContext::GetHSTSState(const std::string& domain,
+void NetworkContext::GetHSTSState(const net::NetworkAnonymizationKey& nak, const std::string& domain,
+                                   GetHSTSStateCallback callback) {
+   base::Value::Dict result;
+ 
+@@ -1943,10 +1945,10 @@ void NetworkContext::GetHSTSState(const std::string& domain,
+       net::TransportSecurityState::STSState dynamic_sts_state;
+       net::TransportSecurityState::PKPState dynamic_pkp_state;
+       bool found_sts_dynamic = transport_security_state->GetDynamicSTSState(
+-          domain, &dynamic_sts_state);
+          nak, domain, &dynamic_sts_state);
+ 
+       bool found_pkp_dynamic = transport_security_state->GetDynamicPKPState(
+-          domain, &dynamic_pkp_state);
+          nak, domain, &dynamic_pkp_state);
+       if (found_sts_dynamic) {
+         result.Set("dynamic_upgrade_mode",
+                    static_cast<int>(dynamic_sts_state.upgrade_mode));
+@@ -1982,6 +1984,7 @@ void NetworkContext::GetHSTSState(const std::string& domain,
+ }
+ 
+ void NetworkContext::DeleteDynamicDataForHost(
+    const net::NetworkAnonymizationKey& nak,
+     const std::string& host,
+     DeleteDynamicDataForHostCallback callback) {
+   net::TransportSecurityState* transport_security_state =
+@@ -1992,7 +1995,7 @@ void NetworkContext::DeleteDynamicDataForHost(
+   }
+ 
+   std::move(callback).Run(
+-      transport_security_state->DeleteDynamicDataForHost(host));
+      transport_security_state->DeleteDynamicDataForHost(nak, host));
+ }
+ 
+ void NetworkContext::EnableStaticKeyPinningForTesting(
+@@ -2125,7 +2128,7 @@ void NetworkContext::PreconnectSockets(
+   DCHECK(!require_network_anonymization_key_ ||
+          !network_anonymization_key.IsEmpty());
+ 
+-  GURL url = GetHSTSRedirect(original_url);
+  GURL url = GetHSTSRedirect(network_anonymization_key, original_url);
+ 
+   // |PreconnectSockets| may receive arguments from the renderer, which is not
+   // guaranteed to validate them.
+@@ -2945,12 +2948,15 @@ void NetworkContext::OnConnectionError() {
+     std::move(on_connection_close_callback_).Run(this);
+ }
+ 
+-GURL NetworkContext::GetHSTSRedirect(const GURL& original_url) {
+GURL NetworkContext::GetHSTSRedirect(
+    const net::NetworkAnonymizationKey& network_anonymization_key,
+    const GURL& original_url) {
+   // TODO(lilyhoughton) This needs to be gotten rid of once explicit
+   // construction with a URLRequestContext is no longer supported.
+   if (!url_request_context_->transport_security_state() ||
+       !original_url.SchemeIs("http") ||
+       !url_request_context_->transport_security_state()->ShouldUpgradeToSSL(
+          network_anonymization_key,
+           original_url.host())) {
+     return original_url;
+   }
+diff --git a/services/network/network_context.h b/services/network/network_context.h
+--- a/services/network/network_context.h
+++ b/services/network/network_context.h
+@@ -419,15 +419,17 @@ class COMPONENT_EXPORT(NETWORK_SERVICE) NetworkContext
+       const std::string& ocsp_result,
+       const std::string& sct_list,
+       VerifyCertForSignedExchangeCallback callback) override;
+-  void AddHSTS(const std::string& host,
+  void AddHSTS(const net::NetworkAnonymizationKey& nak,
+               const std::string& host,
+                base::Time expiry,
+                bool include_subdomains,
+                AddHSTSCallback callback) override;
+-  void IsHSTSActiveForHost(const std::string& host,
+  void IsHSTSActiveForHost(const net::NetworkAnonymizationKey& nak, const std::string& host,
+                            IsHSTSActiveForHostCallback callback) override;
+-  void GetHSTSState(const std::string& domain,
+  void GetHSTSState(const net::NetworkAnonymizationKey& nak, const std::string& domain,
+                     GetHSTSStateCallback callback) override;
+   void DeleteDynamicDataForHost(
+      const net::NetworkAnonymizationKey& nak,
+       const std::string& host,
+       DeleteDynamicDataForHostCallback callback) override;
+   void SetCorsOriginAccessListsForOrigin(
+@@ -724,7 +726,8 @@ class COMPONENT_EXPORT(NETWORK_SERVICE) NetworkContext
+       mojo::PendingRemote<mojom::CookieAccessObserver> cookie_observer,
+       net::FirstPartySetMetadata first_party_set_metadata);
+ 
+-  GURL GetHSTSRedirect(const GURL& original_url);
+  GURL GetHSTSRedirect(const net::NetworkAnonymizationKey& network_anonymization_key,
+                       const GURL& original_url);
+ 
+ #if BUILDFLAG(IS_P2P_ENABLED)
+   void DestroySocketManager(P2PSocketManager* socket_manager);
+diff --git a/services/network/public/mojom/network_context.mojom b/services/network/public/mojom/network_context.mojom
+--- a/services/network/public/mojom/network_context.mojom
+++ b/services/network/public/mojom/network_context.mojom
+@@ -1529,16 +1529,16 @@ interface NetworkContext {
+ 
+   // Adds explicitly-specified data as if it was processed from an
+   // HSTS header. Used by tests and implementation of chrome://net-internals.
+-  AddHSTS(string host, mojo_base.mojom.Time expiry,
+  AddHSTS(NetworkAnonymizationKey nak, string host, mojo_base.mojom.Time expiry,
+           bool include_subdomains) => ();
+ 
+   // Returns true if it is known that |host| has requested to always be
+   // accessed via HTTPS.
+-  IsHSTSActiveForHost(string host) => (bool result);
+  IsHSTSActiveForHost(NetworkAnonymizationKey nak, string host) => (bool result);
+ 
+   // Retrieve values from the HSTS state from the associated contexts
+   // transport security state.
+-  GetHSTSState(string domain)
+  GetHSTSState(NetworkAnonymizationKey nak, string domain)
+       => (mojo_base.mojom.DictionaryValue state);
+ 
+   // Sets allowed and blocked origins respectively for the URLLoaderFactory
+@@ -1557,7 +1557,7 @@ interface NetworkContext {
+   // Deletes any dynamic data stored for |host| from the transport
+   // security state. Returns true iff an entry was deleted.
+   // See net::TransportSecurityState::DeleteDynamicDataForHost for more detail.
+-  DeleteDynamicDataForHost(string host) => (bool result);
+  DeleteDynamicDataForHost(NetworkAnonymizationKey nak, string host) => (bool result);
+ 
+   // Sets whether the HTTP auth cache will be split the NetworkAnonymizationKey.
+   // Only affects server (not proxy) credentials. Whenever the effective value
+--
+2.25.1
@@ -0,0 +1,62 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Thu, 28 Sep 2023 07:56:11 +0000
+Subject: Partition MediaDeviceId by default
+
+and, in windows, hide the presence of the webcam if the user has not given permission
+License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
+---
+ components/media_device_salt/media_device_salt_service.cc | 8 ++++----
+ .../browser/renderer_host/media/media_devices_manager.cc  | 5 +++++
+ content/common/features.cc                                | 4 ++--
+ 3 files changed, 11 insertions(+), 6 deletions(-)
+
+diff --git a/components/media_device_salt/media_device_salt_service.cc b/components/media_device_salt/media_device_salt_service.cc
+--- a/components/media_device_salt/media_device_salt_service.cc
+++ b/components/media_device_salt/media_device_salt_service.cc
+@@ -23,11 +23,11 @@
+ namespace media_device_salt {
+ 
+ BASE_FEATURE(kMediaDeviceIdPartitioning,
+-             "MediaDeviceIdPartitioning",
+-             base::FEATURE_ENABLED_BY_DEFAULT);
+             "MediaDeviceIdPartitioning",             // keep
+             base::FEATURE_ENABLED_BY_DEFAULT);       // enabled
+ BASE_FEATURE(kMediaDeviceIdRandomSaltsPerStorageKey,
+-             "MediaDeviceIdRandomSaltsPerStorageKey",
+-             base::FEATURE_DISABLED_BY_DEFAULT);
+             "MediaDeviceIdRandomSaltsPerStorageKey", // enabled
+             base::FEATURE_ENABLED_BY_DEFAULT);       // by default
+ 
+ namespace {
+ 
+diff --git a/content/browser/renderer_host/media/media_devices_manager.cc b/content/browser/renderer_host/media/media_devices_manager.cc
+--- a/content/browser/renderer_host/media/media_devices_manager.cc
+++ b/content/browser/renderer_host/media/media_devices_manager.cc
+@@ -763,6 +763,11 @@ void MediaDevicesManager::OnDevicesEnumerated(
+           has_permissions[i], salt_and_origin, device_info));
+     }
+   }
+#if !BUILDFLAG(IS_ANDROID)
+  int video_input_index = static_cast<size_t>(MediaDeviceType::kMediaVideoInput);
+  if (requested_types[video_input_index] && !has_permissions[video_input_index])
+    translation[video_input_index].clear();
+#endif
+ 
+   GetAudioInputCapabilities(video_input_capabilities_requested,
+                             audio_input_capabilities_requested,
+diff --git a/content/common/features.cc b/content/common/features.cc
+--- a/content/common/features.cc
+++ b/content/common/features.cc
+@@ -164,8 +164,8 @@ BASE_FEATURE(kEnsureAllowBindingsIsAlwaysForWebUI,
+ // media-device enumeration will provide at most one device per type and the
+ // device IDs will not be available.
+ BASE_FEATURE(kEnumerateDevicesHideDeviceIDs,
+-             "EnumerateDevicesHideDeviceIDs",
+-             base::FEATURE_ENABLED_BY_DEFAULT);
+             "EnumerateDevicesHideDeviceIDs",    // keep
+             base::FEATURE_ENABLED_BY_DEFAULT);  // enabled
+ 
+ // Content counterpart of ExperimentalContentSecurityPolicyFeatures in
+ // third_party/blink/renderer/platform/runtime_enabled_features.json5. Enables
+--
+2.25.1
@@ -0,0 +1,321 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Mon, 9 Jan 2023 12:02:05 +0000
+Subject: Partitioning all cookies by top frame domain
+
+Enables cookie partitioning by top frame etld, respecting the
+user's possible wish to disable all third-party cookies.
+Disabling the flag via the ui restores the normal mode, where
+samesite=none first-party cookies are sent in third-party contexts.
+
+License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
+---
+ .../browser/net/profile_network_context_service.cc   |  8 ++++----
+ .../core/common/cookie_settings_base.cc              |  2 +-
+ components/content_settings/core/common/features.cc  |  4 ++--
+ components/permissions/features.cc                   |  4 ++--
+ content/public/common/content_features.cc            |  4 ++--
+ net/base/features.cc                                 | 12 ++++++------
+ net/cookies/canonical_cookie.cc                      | 12 +-----------
+ net/cookies/cookie_deletion_info.cc                  |  3 ++-
+ net/cookies/parsed_cookie.h                          |  7 ++++++-
+ net/extras/sqlite/sqlite_persistent_cookie_store.cc  | 10 ++++++++++
+ net/url_request/url_request_http_job.cc              |  2 +-
+ services/network/restricted_cookie_manager.cc        |  3 +++
+ .../renderer/modules/cookie_store/cookie_init.idl    |  2 +-
+ .../renderer/modules/cookie_store/cookie_store.cc    | 12 ++++++++++++
+ .../cookie_store/cookie_store_delete_options.idl     |  2 +-
+ ui/webui/webui_allowlist.cc                          |  1 +
+ 16 files changed, 55 insertions(+), 33 deletions(-)
+
+diff --git a/chrome/browser/net/profile_network_context_service.cc b/chrome/browser/net/profile_network_context_service.cc
+--- a/chrome/browser/net/profile_network_context_service.cc
+++ b/chrome/browser/net/profile_network_context_service.cc
+@@ -613,14 +613,14 @@ ProfileNetworkContextService::CreateCookieManagerParams(
+   // UI to interact with SameSite cookies on accounts.google.com, which is used
+   // for displaying a list of available accounts on the NTP
+   // (chrome://new-tab-page), etc.
+-  out->secure_origin_cookies_allowed_schemes.push_back(
+-      content::kChromeUIScheme);
+  // out->secure_origin_cookies_allowed_schemes.push_back(
+  //     content::kChromeUIScheme);
+ #if BUILDFLAG(ENABLE_EXTENSIONS)
+   // TODO(chlily): To be consistent with the content_settings version of
+   // CookieSettings, we should probably also add kExtensionScheme to the list of
+   // matching_scheme_cookies_allowed_schemes.
+-  out->third_party_cookies_allowed_schemes.push_back(
+-      extensions::kExtensionScheme);
+  // out->third_party_cookies_allowed_schemes.push_back(
+  //     extensions::kExtensionScheme);
+ #endif
+ 
+   HostContentSettingsMap* host_content_settings_map =
+diff --git a/components/content_settings/core/common/cookie_settings_base.cc b/components/content_settings/core/common/cookie_settings_base.cc
+--- a/components/content_settings/core/common/cookie_settings_base.cc
+++ b/components/content_settings/core/common/cookie_settings_base.cc
+@@ -318,7 +318,7 @@ CookieSettingsBase::GetCookieSettingInternal(
+   absl::optional<ThirdPartyBlockingScope> scope;
+   if (block_third) {
+     scope = IsAllowed(setting)
+-                ? ThirdPartyBlockingScope::kUnpartitionedOnly
+                ? ThirdPartyBlockingScope::kUnpartitionedAndPartitioned
+                 : ThirdPartyBlockingScope::kUnpartitionedAndPartitioned;
+   }
+   return {block_third ? CONTENT_SETTING_BLOCK : setting, scope,
+diff --git a/components/content_settings/core/common/features.cc b/components/content_settings/core/common/features.cc
+--- a/components/content_settings/core/common/features.cc
+++ b/components/content_settings/core/common/features.cc
+@@ -79,8 +79,8 @@ BASE_FEATURE(kImprovedSemanticsActivityIndicators,
+              base::FEATURE_DISABLED_BY_DEFAULT);
+ 
+ BASE_FEATURE(kTrackingProtection3pcd,
+-             "TrackingProtection3pcd",
+-             base::FEATURE_DISABLED_BY_DEFAULT);
+             "TrackingProtection3pcd",           // disabled
+             base::FEATURE_DISABLED_BY_DEFAULT); // by default
+ 
+ }  // namespace features
+ }  // namespace content_settings
+diff --git a/components/permissions/features.cc b/components/permissions/features.cc
+--- a/components/permissions/features.cc
+++ b/components/permissions/features.cc
+@@ -156,8 +156,8 @@ BASE_FEATURE(kMitigateUnpartitionedWebviewPermissions,
+ // This includes enabling prompts, a new settings page and page info and
+ // omnibox integration.
+ BASE_FEATURE(kPermissionStorageAccessAPI,
+-             "PermissionStorageAccessAPI",
+-             base::FEATURE_DISABLED_BY_DEFAULT);
+             "PermissionStorageAccessAPI",        // guard
+             base::FEATURE_DISABLED_BY_DEFAULT);  // this
+ 
+ // When enabled "window-placement" may be used as an alias for
+ // "window-management". Additionally, reverse mappings (i.e. enum to string)
+diff --git a/content/public/common/content_features.cc b/content/public/common/content_features.cc
+--- a/content/public/common/content_features.cc
+++ b/content/public/common/content_features.cc
+@@ -186,8 +186,8 @@ BASE_FEATURE(kCompositeBGColorAnimation,
+ // server side testing without cookies.
+ // (See https://developer.chrome.com/en/docs/privacy-sandbox/chrome-testing)
+ BASE_FEATURE(kCookieDeprecationFacilitatedTesting,
+-             "CookieDeprecationFacilitatedTesting",
+-             base::FEATURE_DISABLED_BY_DEFAULT);
+             "CookieDeprecationFacilitatedTesting",  // disabled
+             base::FEATURE_DISABLED_BY_DEFAULT);     // by default
+ 
+ // Set whether to enable cookie deprecation API for off-the-record profiles.
+ const base::FeatureParam<bool>
+diff --git a/net/base/features.cc b/net/base/features.cc
+--- a/net/base/features.cc
+++ b/net/base/features.cc
+@@ -260,8 +260,8 @@ BASE_FEATURE(kWaitForFirstPartySetsInit,
+              base::FEATURE_DISABLED_BY_DEFAULT);
+ 
+ BASE_FEATURE(kPartitionedCookies,
+-             "PartitionedCookies",
+-             base::FEATURE_ENABLED_BY_DEFAULT);
+             "PartitionedCookies",                  // guard this
+             base::FEATURE_ENABLED_BY_DEFAULT);     // guard this
+ 
+ BASE_FEATURE(kBlockTruncatedCookies,
+              "BlockTruncatedCookies",
+@@ -272,8 +272,8 @@ BASE_FEATURE(kStaticKeyPinningEnforcement,
+              base::FEATURE_ENABLED_BY_DEFAULT);
+ 
+ BASE_FEATURE(kCookieDomainRejectNonASCII,
+-             "CookieDomainRejectNonASCII",
+-             base::FEATURE_DISABLED_BY_DEFAULT);
+             "CookieDomainRejectNonASCII",          // guard this
+             base::FEATURE_ENABLED_BY_DEFAULT);     // guard this
+ 
+ // Enables partitioning of third party storage (IndexedDB, CacheStorage, etc.)
+ // by the top level site to reduce fingerprinting.
+@@ -469,8 +469,8 @@ BASE_FEATURE(kDigestAuthEnableSecureAlgorithms,
+ // are disabled by default. Partitioned storage will not be allowed if
+ // third-party cookies are disabled due to a specific rule.
+ BASE_FEATURE(kThirdPartyPartitionedStorageAllowedByDefault,
+-             "ThirdPartyPartitionedStorageAllowedByDefault",
+-             base::FEATURE_ENABLED_BY_DEFAULT);
+             "ThirdPartyPartitionedStorageAllowedByDefault",  // must be
+             base::FEATURE_DISABLED_BY_DEFAULT);              // disabled
+ 
+ BASE_FEATURE(kPriorityHeader,
+              "PriorityHeader",
+diff --git a/net/cookies/canonical_cookie.cc b/net/cookies/canonical_cookie.cc
+--- a/net/cookies/canonical_cookie.cc
+++ b/net/cookies/canonical_cookie.cc
+@@ -1469,8 +1469,6 @@ bool CanonicalCookie::IsCanonicalForFromStorage() const {
+   if (IsPartitioned()) {
+     if (CookiePartitionKey::HasNonce(partition_key_))
+       return true;
+-    if (!secure_)
+-      return false;
+   }
+ 
+   return true;
+@@ -1727,15 +1725,7 @@ bool CanonicalCookie::IsCookiePartitionedValid(const GURL& url,
+                                                bool secure,
+                                                bool is_partitioned,
+                                                bool partition_has_nonce) {
+-  if (!is_partitioned)
+-    return true;
+-  if (partition_has_nonce)
+-    return true;
+-  CookieAccessScheme scheme = cookie_util::ProvisionalAccessScheme(url);
+-  bool result = (scheme != CookieAccessScheme::kNonCryptographic) && secure;
+-  DLOG_IF(WARNING, !result)
+-      << "CanonicalCookie has invalid Partitioned attribute";
+-  return result;
+  return true;
+ }
+ 
+ CookieAndLineWithAccessResult::CookieAndLineWithAccessResult() = default;
+diff --git a/net/cookies/cookie_deletion_info.cc b/net/cookies/cookie_deletion_info.cc
+--- a/net/cookies/cookie_deletion_info.cc
+++ b/net/cookies/cookie_deletion_info.cc
+@@ -131,7 +131,8 @@ bool CookieDeletionInfo::Matches(const CanonicalCookie& cookie,
+     return false;
+   }
+ 
+-  if (cookie.IsPartitioned() &&
+  // opened bug https://bugs.chromium.org/p/chromium/issues/detail?id=1405772
+  if (cookie.IsPartitioned() && !cookie_partition_key_collection.IsEmpty() &&
+       !cookie_partition_key_collection.Contains(*cookie.PartitionKey())) {
+     return false;
+   }
+diff --git a/net/cookies/parsed_cookie.h b/net/cookies/parsed_cookie.h
+--- a/net/cookies/parsed_cookie.h
+++ b/net/cookies/parsed_cookie.h
+@@ -11,6 +11,7 @@
+ #include <utility>
+ #include <vector>
+ 
+#include "net/base/features.h"
+ #include "net/base/net_export.h"
+ #include "net/cookies/cookie_constants.h"
+ 
+@@ -86,7 +87,11 @@ class NET_EXPORT ParsedCookie {
+       CookieSameSiteString* samesite_string = nullptr) const;
+   CookiePriority Priority() const;
+   bool IsSameParty() const { return same_party_index_ != 0; }
+-  bool IsPartitioned() const { return partitioned_index_ != 0; }
+  bool IsPartitioned() const {
+    if (base::FeatureList::IsEnabled(net::features::kPartitionedCookies))
+      return true;
+     return partitioned_index_ != 0;
+  }
+   bool HasInternalHtab() const { return internal_htab_; }
+   TruncatingCharacterInCookieStringType
+   GetTruncatingCharacterInCookieStringType() const {
+diff --git a/net/extras/sqlite/sqlite_persistent_cookie_store.cc b/net/extras/sqlite/sqlite_persistent_cookie_store.cc
+--- a/net/extras/sqlite/sqlite_persistent_cookie_store.cc
+++ b/net/extras/sqlite/sqlite_persistent_cookie_store.cc
+@@ -814,6 +814,16 @@ bool SQLitePersistentCookieStore::Backend::DoInitializeDatabase() {
+   if (!restore_old_session_cookies_)
+     DeleteSessionCookiesOnStartup();
+ 
+  // Since there is no automatic transition to partitioned cookies
+  // (the information would be missing), we clean the current ones
+  // present because they would otherwise be sent in third-party contexts
+  // even if the flag is active.
+  if (base::FeatureList::IsEnabled(features::kPartitionedCookies)) {
+    if (!db()->Execute("DELETE FROM cookies WHERE top_frame_site_key = ''")) {
+      LOG(WARNING) << "Unable to delete unpartitioned cookies.";
+    }
+  }
+
+   return true;
+ }
+ 
+diff --git a/net/url_request/url_request_http_job.cc b/net/url_request/url_request_http_job.cc
+--- a/net/url_request/url_request_http_job.cc
+++ b/net/url_request/url_request_http_job.cc
+@@ -758,7 +758,7 @@ void URLRequestHttpJob::SetCookieHeaderAndStart(
+ 
+       size_t n_partitioned_cookies = 0;
+       bool may_set_sec_cookie_deprecation_header =
+-          !request_->context()->cookie_deprecation_label().value_or("").empty();
+          false;
+ 
+       // TODO(crbug.com/1031664): Reduce the number of times the cookie list
+       // is iterated over. Get metrics for every cookie which is included.
+diff --git a/services/network/restricted_cookie_manager.cc b/services/network/restricted_cookie_manager.cc
+--- a/services/network/restricted_cookie_manager.cc
+++ b/services/network/restricted_cookie_manager.cc
+@@ -808,6 +808,9 @@ void RestrictedCookieManager::SetCookieFromString(
+   std::move(callback).Run(site_for_cookies_ok, top_frame_origin_ok);
+   callback = base::DoNothing();
+ 
+  // https://bugs.chromium.org/p/chromium/issues/detail?id=911299
+  if (!site_for_cookies_ok || !top_frame_origin_ok) return;
+
+   net::CookieInclusionStatus status;
+   std::unique_ptr<net::CanonicalCookie> parsed_cookie =
+       net::CanonicalCookie::Create(
+diff --git a/third_party/blink/renderer/modules/cookie_store/cookie_init.idl b/third_party/blink/renderer/modules/cookie_store/cookie_init.idl
+--- a/third_party/blink/renderer/modules/cookie_store/cookie_init.idl
+++ b/third_party/blink/renderer/modules/cookie_store/cookie_init.idl
+@@ -17,5 +17,5 @@ dictionary CookieInit {
+   USVString path = "/";
+   DOMHighResTimeStamp? expires = null;
+   CookieSameSite sameSite = "strict";
+-  [RuntimeEnabled=PartitionedCookies] boolean partitioned = false;
+  [RuntimeEnabled=PartitionedCookies] boolean partitioned = true;
+ };
+diff --git a/third_party/blink/renderer/modules/cookie_store/cookie_store.cc b/third_party/blink/renderer/modules/cookie_store/cookie_store.cc
+--- a/third_party/blink/renderer/modules/cookie_store/cookie_store.cc
+++ b/third_party/blink/renderer/modules/cookie_store/cookie_store.cc
+@@ -321,6 +321,10 @@ ScriptPromise CookieStore::set(ScriptState* script_state,
+   CookieInit* set_options = CookieInit::Create();
+   set_options->setName(name);
+   set_options->setValue(value);
+  if (RuntimeEnabledFeatures::PartitionedCookiesEnabled(
+      CurrentExecutionContext(script_state->GetIsolate()))) {
+    set_options->setPartitioned(true);
+  }
+   return set(script_state, set_options, exception_state);
+ }
+ 
+@@ -343,6 +347,10 @@ ScriptPromise CookieStore::Delete(ScriptState* script_state,
+   set_options->setName(name);
+   set_options->setValue("deleted");
+   set_options->setExpires(0);
+  if (RuntimeEnabledFeatures::PartitionedCookiesEnabled(
+      CurrentExecutionContext(script_state->GetIsolate()))) {
+    set_options->setPartitioned(true);
+  }
+   return DoWrite(script_state, set_options, exception_state);
+ }
+ 
+@@ -357,6 +365,10 @@ ScriptPromise CookieStore::Delete(ScriptState* script_state,
+   set_options->setPath(options->path());
+   set_options->setSameSite("strict");
+   set_options->setPartitioned(options->partitioned());
+  if (RuntimeEnabledFeatures::PartitionedCookiesEnabled(
+      CurrentExecutionContext(script_state->GetIsolate()))) {
+    set_options->setPartitioned(true);
+  }
+   return DoWrite(script_state, set_options, exception_state);
+ }
+ 
+diff --git a/third_party/blink/renderer/modules/cookie_store/cookie_store_delete_options.idl b/third_party/blink/renderer/modules/cookie_store/cookie_store_delete_options.idl
+--- a/third_party/blink/renderer/modules/cookie_store/cookie_store_delete_options.idl
+++ b/third_party/blink/renderer/modules/cookie_store/cookie_store_delete_options.idl
+@@ -8,5 +8,5 @@ dictionary CookieStoreDeleteOptions {
+   required USVString name;
+   USVString? domain = null;
+   USVString path = "/";
+-  [RuntimeEnabled=PartitionedCookies] boolean partitioned = false;
+  [RuntimeEnabled=PartitionedCookies] boolean partitioned = true;
+ };
+diff --git a/ui/webui/webui_allowlist.cc b/ui/webui/webui_allowlist.cc
+--- a/ui/webui/webui_allowlist.cc
+++ b/ui/webui/webui_allowlist.cc
+@@ -74,6 +74,7 @@ void WebUIAllowlist::RegisterAutoGrantedPermissions(
+ void WebUIAllowlist::RegisterAutoGrantedThirdPartyCookies(
+     const url::Origin& top_level_origin,
+     const std::vector<ContentSettingsPattern>& origin_patterns) {
+  if ((true)) return;
+   DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
+   DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
+ 
+--
+2.25.1
@@ -0,0 +1,286 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Sat, 15 Apr 2023 11:46:48 +0000
+Subject: Remove ChromiumNetworkAdapter
+
+Removes from java code the ability to make http connections
+without asking the native code
+
+License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
+---
+ .../browser/download/OMADownloadHandler.java  | 38 -------------
+ .../browser/feedback/ConnectivityChecker.java | 37 +------------
+ .../ConnectivityDetector.java                 | 54 -------------------
+ .../chrome/browser/omaha/OmahaBase.java       |  3 +-
+ .../util/HttpURLConnectionFactoryImpl.java    |  7 +--
+ .../firstrun/VariationsSeedFetcher.java       | 26 +--------
+ .../chromium/net/ChromiumNetworkAdapter.java  | 12 -----
+ 7 files changed, 4 insertions(+), 173 deletions(-)
+
+diff --git a/chrome/android/java/src/org/chromium/chrome/browser/download/OMADownloadHandler.java b/chrome/android/java/src/org/chromium/chrome/browser/download/OMADownloadHandler.java
+--- a/chrome/android/java/src/org/chromium/chrome/browser/download/OMADownloadHandler.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/download/OMADownloadHandler.java
+@@ -968,44 +968,6 @@ public class OMADownloadHandler extends BroadcastReceiver {
+         protected Boolean doInBackground() {
+             HttpURLConnection urlConnection = null;
+             boolean success = false;
+-            try {
+-                URL url = new URL(mOMAInfo.getValue(OMA_INSTALL_NOTIFY_URI));
+-                urlConnection = (HttpURLConnection) ChromiumNetworkAdapter.openConnection(
+-                        url, TRAFFIC_ANNOTATION);
+-                urlConnection.setDoOutput(true);
+-                urlConnection.setUseCaches(false);
+-                urlConnection.setRequestMethod("POST");
+-                String userAgent = mDownloadInfo.getUserAgent();
+-                if (TextUtils.isEmpty(userAgent)) {
+-                    userAgent = ContentUtils.getBrowserUserAgent();
+-                }
+-                urlConnection.setRequestProperty("User-Agent", userAgent);
+-                urlConnection.setRequestProperty("cookie", mDownloadInfo.getCookie());
+-
+-                DataOutputStream dos = new DataOutputStream(urlConnection.getOutputStream());
+-                try {
+-                    dos.writeBytes(mStatusMessage);
+-                    dos.flush();
+-                } catch (IOException e) {
+-                    Log.w(TAG, "Cannot write status message.", e);
+-                } finally {
+-                    dos.close();
+-                }
+-                int responseCode = urlConnection.getResponseCode();
+-                if (responseCode == HttpURLConnection.HTTP_OK || responseCode == -1) {
+-                    success = true;
+-                } else {
+-                    success = false;
+-                }
+-            } catch (MalformedURLException e) {
+-                Log.w(TAG, "Invalid notification URL.", e);
+-            } catch (IOException e) {
+-                Log.w(TAG, "Cannot connect to server.", e);
+-            } catch (IllegalStateException e) {
+-                Log.w(TAG, "Cannot connect to server.", e);
+-            } finally {
+-                if (urlConnection != null) urlConnection.disconnect();
+-            }
+ 
+             if (success) {
+                 String path = mDownloadInfo.getFilePath();
+diff --git a/chrome/android/java/src/org/chromium/chrome/browser/feedback/ConnectivityChecker.java b/chrome/android/java/src/org/chromium/chrome/browser/feedback/ConnectivityChecker.java
+--- a/chrome/android/java/src/org/chromium/chrome/browser/feedback/ConnectivityChecker.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/feedback/ConnectivityChecker.java
+@@ -136,42 +136,7 @@ public final class ConnectivityChecker {
+             postResult(callback, ConnectivityCheckResult.ERROR);
+             return;
+         }
+-        new AsyncTask<Integer>() {
+-            @Override
+-            protected Integer doInBackground() {
+-                try {
+-                    HttpURLConnection conn =
+-                            (HttpURLConnection) ChromiumNetworkAdapter.openConnection(
+-                                    url, TRAFFIC_ANNOTATION);
+-                    conn.setInstanceFollowRedirects(false);
+-                    conn.setRequestMethod("GET");
+-                    conn.setDoInput(false);
+-                    conn.setDoOutput(false);
+-                    conn.setConnectTimeout(timeoutMs);
+-                    conn.setReadTimeout(timeoutMs);
+-
+-                    conn.connect();
+-                    int responseCode = conn.getResponseCode();
+-                    if (responseCode == HttpURLConnection.HTTP_NO_CONTENT) {
+-                        return ConnectivityCheckResult.CONNECTED;
+-                    } else {
+-                        return ConnectivityCheckResult.NOT_CONNECTED;
+-                    }
+-                } catch (SocketTimeoutException e) {
+-                    return ConnectivityCheckResult.TIMEOUT;
+-                } catch (ProtocolException e) {
+-                    return ConnectivityCheckResult.ERROR;
+-                } catch (IOException e) {
+-                    return ConnectivityCheckResult.NOT_CONNECTED;
+-                }
+-            }
+-
+-            @Override
+-            protected void onPostExecute(Integer result) {
+-                callback.onResult(result);
+-            }
+-        }
+-                .executeOnExecutor(AsyncTask.THREAD_POOL_EXECUTOR);
+        postResult(callback, ConnectivityCheckResult.ERROR);
+     }
+ 
+     /**
+diff --git a/chrome/android/java/src/org/chromium/chrome/browser/net/connectivitydetector/ConnectivityDetector.java b/chrome/android/java/src/org/chromium/chrome/browser/net/connectivitydetector/ConnectivityDetector.java
+--- a/chrome/android/java/src/org/chromium/chrome/browser/net/connectivitydetector/ConnectivityDetector.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/net/connectivitydetector/ConnectivityDetector.java
+@@ -390,60 +390,6 @@ public class ConnectivityDetector implements NetworkChangeNotifier.ConnectionTyp
+         new AsyncTask<Integer>() {
+             @Override
+             protected Integer doInBackground() {
+-                HttpURLConnection urlConnection = null;
+-                try {
+-                    RecordHistogram.recordCount1MHistogram(
+-                            "ConnectivityDetector.SentHttpProbe." + mClientName, 1);
+-                    Log.i(TAG, "Sending HTTP Probe now to url:" + urlString);
+-
+-                    URL url = new URL(urlString);
+-                    urlConnection = (HttpURLConnection) ChromiumNetworkAdapter.openConnection(
+-                            url, NetworkTrafficAnnotationTag.MISSING_TRAFFIC_ANNOTATION);
+-                    urlConnection.setInstanceFollowRedirects(false);
+-                    urlConnection.setRequestMethod(sProbeMethod);
+-                    urlConnection.setConnectTimeout(timeoutMs);
+-                    urlConnection.setReadTimeout(timeoutMs);
+-                    urlConnection.setUseCaches(false);
+-                    urlConnection.setRequestProperty(USER_AGENT_HEADER_NAME, mUserAgentString);
+-
+-                    long requestTimestamp = SystemClock.elapsedRealtime();
+-                    urlConnection.connect();
+-                    long responseTimestamp = SystemClock.elapsedRealtime();
+-                    int responseCode = urlConnection.getResponseCode();
+-
+-                    Log.i(TAG,
+-                            "Probe " + urlString + " time=" + (responseTimestamp - requestTimestamp)
+-                                    + "ms ret=" + responseCode
+-                                    + " headers=" + urlConnection.getHeaderFields());
+-
+-                    if (responseCode == HttpURLConnection.HTTP_NO_CONTENT) {
+-                        return ProbeResult.VALIDATED_WITH_NO_CONTENT;
+-                    } else if (responseCode >= 400) {
+-                        return ProbeResult.SERVER_ERROR;
+-                    } else if (responseCode == HttpURLConnection.HTTP_OK) {
+-                        // Treat 200 response with zero content length to not be a captive portal
+-                        // because the user cannot sign in to an empty page. Probably this is due to
+-                        // a broken transparent proxy.
+-                        if (urlConnection.getContentLength() == 0) {
+-                            return ProbeResult.VALIDATED_WITH_OK_BUT_ZERO_CONTENT_LENGTH;
+-                        } else if (urlConnection.getContentLength() == -1) {
+-                            // When no Content-length (default value == -1), attempt to read a byte
+-                            // from the response.
+-                            if (urlConnection.getInputStream().read() == -1) {
+-                                return ProbeResult.VALIDATED_WITH_OK_BUT_NO_CONTENT_LENGTH;
+-                            }
+-                        }
+-                    }
+-                } catch (IOException e) {
+-                    Log.i(TAG, "Probe " + urlString + " failed w/ exception " + e);
+-                    // Most likely the exception is thrown due to host name not resolved or socket
+-                    // timeout.
+-                    return ProbeResult.NO_INTERNET;
+-                } finally {
+-                    if (urlConnection != null) {
+-                        urlConnection.disconnect();
+-                    }
+-                }
+                 // The result returned from a well-known URL doesn't match the expected result,
+                 // probably due to that the traffic is intercepted by the captive portal.
+                 return ProbeResult.NOT_VALIDATED;
+diff --git a/chrome/android/java/src/org/chromium/chrome/browser/omaha/OmahaBase.java b/chrome/android/java/src/org/chromium/chrome/browser/omaha/OmahaBase.java
+--- a/chrome/android/java/src/org/chromium/chrome/browser/omaha/OmahaBase.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/omaha/OmahaBase.java
+@@ -461,8 +461,7 @@ public class OmahaBase {
+                         + "}");
+         try {
+             URL url = new URL(getRequestGenerator().getServerUrl());
+-            HttpURLConnection connection =
+-                    (HttpURLConnection) ChromiumNetworkAdapter.openConnection(url, annotation);
+            HttpURLConnection connection = null;
+             connection.setConnectTimeout(MS_CONNECTION_TIMEOUT);
+             connection.setReadTimeout(MS_CONNECTION_TIMEOUT);
+             return connection;
+diff --git a/components/minidump_uploader/android/java/src/org/chromium/components/minidump_uploader/util/HttpURLConnectionFactoryImpl.java b/components/minidump_uploader/android/java/src/org/chromium/components/minidump_uploader/util/HttpURLConnectionFactoryImpl.java
+--- a/components/minidump_uploader/android/java/src/org/chromium/components/minidump_uploader/util/HttpURLConnectionFactoryImpl.java
+++ b/components/minidump_uploader/android/java/src/org/chromium/components/minidump_uploader/util/HttpURLConnectionFactoryImpl.java
+@@ -37,11 +37,6 @@ public class HttpURLConnectionFactoryImpl implements HttpURLConnectionFactory {
+ 
+     @Override
+     public HttpURLConnection createHttpURLConnection(String url) {
+-        try {
+-            return (HttpURLConnection) ChromiumNetworkAdapter.openConnection(
+-                    new URL(url), TRAFFIC_ANNOTATION);
+-        } catch (IOException e) {
+-            return null;
+-        }
+        return null;
+     }
+ }
+diff --git a/components/variations/android/java/src/org/chromium/components/variations/firstrun/VariationsSeedFetcher.java b/components/variations/android/java/src/org/chromium/components/variations/firstrun/VariationsSeedFetcher.java
+--- a/components/variations/android/java/src/org/chromium/components/variations/firstrun/VariationsSeedFetcher.java
+++ b/components/variations/android/java/src/org/chromium/components/variations/firstrun/VariationsSeedFetcher.java
+@@ -186,14 +186,6 @@ public class VariationsSeedFetcher {
+         ResettersForTesting.register(() -> sInstance = oldValue);
+     }
+ 
+-    @VisibleForTesting
+-    protected HttpURLConnection getServerConnection(SeedFetchParameters params)
+-            throws MalformedURLException, IOException {
+-        String urlString = getConnectionString(params);
+-        URL url = new URL(urlString);
+-        return (HttpURLConnection) ChromiumNetworkAdapter.openConnection(url, TRAFFIC_ANNOTATION);
+-    }
+-
+     @VisibleForTesting
+     protected List<String> getAvailableInstanceManipulations() {
+         List<String> compressions = new ArrayList<String>();
+@@ -508,24 +500,8 @@ public class VariationsSeedFetcher {
+         HttpURLConnection connection = null;
+         try {
+             long startTimeMillis = SystemClock.elapsedRealtime();
+-            connection = getServerConnection(params);
+-            connection.setReadTimeout(READ_TIMEOUT);
+-            connection.setConnectTimeout(REQUEST_TIMEOUT);
+-            connection.setDoInput(true);
+-            if (currInfo != null) {
+-                VariationsSeed currentVariationsSeed = currInfo.getParsedVariationsSeed();
+-                if (currentVariationsSeed != null) {
+-                    String serialNumber = currentVariationsSeed.getSerialNumber();
+-                    if (!serialNumber.isEmpty()) {
+-                        connection.setRequestProperty("If-None-Match", serialNumber);
+-                    }
+-                }
+-            }
+             List<String> requestedInstanceManipulations = getAvailableInstanceManipulations();
+-            connection.setRequestProperty("A-IM", String.join(",", requestedInstanceManipulations));
+-            connection.connect();
+-            int responseCode = connection.getResponseCode();
+-            fetchInfo.seedFetchResult = responseCode;
+            int responseCode = 400;
+             if (responseCode == HttpURLConnection.HTTP_OK) {
+                 recordSeedConnectTime(SystemClock.elapsedRealtime() - startTimeMillis);
+ 
+diff --git a/net/android/java/src/org/chromium/net/ChromiumNetworkAdapter.java b/net/android/java/src/org/chromium/net/ChromiumNetworkAdapter.java
+--- a/net/android/java/src/org/chromium/net/ChromiumNetworkAdapter.java
+++ b/net/android/java/src/org/chromium/net/ChromiumNetworkAdapter.java
+@@ -25,10 +25,6 @@ public final class ChromiumNetworkAdapter {
+      *     what data gets sent, what triggers it, etc.
+      * @return a URLConnection linking to the URL.
+      */
+-    public static URLConnection openConnection(
+-            URL url, NetworkTrafficAnnotationTag trafficAnnotation) throws IOException {
+-        return url.openConnection();
+-    }
+ 
+     /**
+      * Wrapper around URL#openConnection(Proxy), with an extra argument for static analysis/privacy
+@@ -40,10 +36,6 @@ public final class ChromiumNetworkAdapter {
+      *     what data gets sent, what triggers it, etc.
+      * @return a URLConnection linking to the URL.
+      */
+-    public static URLConnection openConnection(URL url, Proxy proxy,
+-            NetworkTrafficAnnotationTag trafficAnnotation) throws IOException {
+-        return url.openConnection(proxy);
+-    }
+ 
+     /**
+      * Wrapper around URL#openStream(), with an extra argument for static analysis/privacy
+@@ -54,8 +46,4 @@ public final class ChromiumNetworkAdapter {
+      *     what data gets sent, what triggers it, etc.
+      * @return an InputStream linking to the URL.
+      */
+-    public static InputStream openStream(URL url, NetworkTrafficAnnotationTag trafficAnnotation)
+-            throws IOException {
+-        return url.openStream();
+-    }
+ }
+--
+2.25.1
@@ -0,0 +1,90 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Tue, 5 Sep 2023 12:55:40 +0000
+Subject: Remove GoogleAccountsPrivateApiHost
+
+License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
+---
+ .../google_accounts_private_api_util.cc       | 20 +------------------
+ ...rusted_vault_encryption_keys_tab_helper.cc |  6 ++----
+ .../google_accounts_private_api_util.cc       | 11 ----------
+ 3 files changed, 3 insertions(+), 34 deletions(-)
+
+diff --git a/chrome/browser/signin/google_accounts_private_api_util.cc b/chrome/browser/signin/google_accounts_private_api_util.cc
+--- a/chrome/browser/signin/google_accounts_private_api_util.cc
+++ b/chrome/browser/signin/google_accounts_private_api_util.cc
+@@ -9,25 +9,7 @@
+ #include "content/public/browser/site_instance.h"
+ #include "google_apis/gaia/gaia_urls.h"
+ 
+-const url::Origin& GetAllowedGoogleAccountsOrigin() {
+-  const url::Origin& origin = GaiaUrls::GetInstance()->gaia_origin();
+-  CHECK(!origin.opaque());
+-  return origin;
+-}
+-
+ bool ShouldExposeGoogleAccountsPrivateApi(
+     content::NavigationHandle* navigation_handle) {
+-  if (!navigation_handle->HasCommitted() || navigation_handle->IsErrorPage()) {
+-    return false;
+-  }
+-
+-  content::RenderFrameHost* rfh = navigation_handle->GetRenderFrameHost();
+-  const url::Origin rfh_origin = rfh->GetLastCommittedOrigin();
+-  // Restrict to allowed origin and only if site isolation requires a dedicated
+-  // process. The host is compared explicitly to confirm that the allowed origin
+-  // uses a dedicated process, rather than sharing process with eTLD+1.
+-  return rfh_origin == GetAllowedGoogleAccountsOrigin() &&
+-         rfh->GetSiteInstance()->RequiresDedicatedProcess() &&
+-         rfh->GetSiteInstance()->GetSiteURL().host() ==
+-             GetAllowedGoogleAccountsOrigin().host();
+  return false;
+ }
+diff --git a/chrome/browser/trusted_vault/trusted_vault_encryption_keys_tab_helper.cc b/chrome/browser/trusted_vault/trusted_vault_encryption_keys_tab_helper.cc
+--- a/chrome/browser/trusted_vault/trusted_vault_encryption_keys_tab_helper.cc
+++ b/chrome/browser/trusted_vault/trusted_vault_encryption_keys_tab_helper.cc
+@@ -57,8 +57,7 @@ class EncryptionKeyApi
+           trusted_vault_keys,
+       SetEncryptionKeysCallback callback) override {
+     // Extra safeguard.
+-    if (receivers_.GetCurrentTargetFrame()->GetLastCommittedOrigin() !=
+-        GetAllowedGoogleAccountsOrigin()) {
+    if ((true)) {
+       return;
+     }
+ 
+@@ -91,8 +90,7 @@ class EncryptionKeyApi
+       int method_type_hint,
+       AddTrustedRecoveryMethodCallback callback) override {
+     // Extra safeguard.
+-    if (receivers_.GetCurrentTargetFrame()->GetLastCommittedOrigin() !=
+-        GetAllowedGoogleAccountsOrigin()) {
+    if ((true)) {
+       return;
+     }
+ 
+diff --git a/chrome/renderer/google_accounts_private_api_util.cc b/chrome/renderer/google_accounts_private_api_util.cc
+--- a/chrome/renderer/google_accounts_private_api_util.cc
+++ b/chrome/renderer/google_accounts_private_api_util.cc
+@@ -12,20 +12,9 @@
+ 
+ namespace {
+ 
+-const url::Origin& GetAllowedGoogleAccountsOrigin() {
+-  const url::Origin& origin = GaiaUrls::GetInstance()->gaia_origin();
+-  CHECK(!origin.opaque());
+-  return origin;
+-}
+-
+ }  // namespace
+ 
+ bool ShouldExposeGoogleAccountsJavascriptApi(
+     content::RenderFrame* render_frame) {
+   if ((true)) return false;
+-  DCHECK(render_frame);
+-
+-  const url::Origin origin = render_frame->GetWebFrame()->GetSecurityOrigin();
+-  return origin == GetAllowedGoogleAccountsOrigin() &&
+-         blink::Platform::Current()->IsLockedToSite();
+ }
+--
+2.25.1
@@ -0,0 +1,54 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Wed, 19 Apr 2023 06:53:19 +0000
+Subject: Remove auth header upon cross origin redirect
+
+License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
+---
+ third_party/blink/common/features.cc                          | 4 ++--
+ .../blink/renderer/platform/loader/fetch/resource_loader.cc   | 3 +++
+ .../platform/loader/fetch/url_loader/sync_load_context.cc     | 4 ++++
+ 3 files changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/third_party/blink/common/features.cc b/third_party/blink/common/features.cc
+--- a/third_party/blink/common/features.cc
+++ b/third_party/blink/common/features.cc
+@@ -1526,8 +1526,8 @@ BASE_FEATURE(kRemoteResourceCache,
+              base::FEATURE_DISABLED_BY_DEFAULT);
+ 
+ BASE_FEATURE(kRemoveAuthroizationOnCrossOriginRedirect,
+-             "RemoveAutorizationOnCrossOriginRedirect",
+-             base::FEATURE_ENABLED_BY_DEFAULT);
+             "RemoveAutorizationOnCrossOriginRedirect",  // guard
+             base::FEATURE_ENABLED_BY_DEFAULT);          // this
+ 
+ BASE_FEATURE(kRenderBlockingFonts,
+              "RenderBlockingFonts",
+diff --git a/third_party/blink/renderer/platform/loader/fetch/resource_loader.cc b/third_party/blink/renderer/platform/loader/fetch/resource_loader.cc
+--- a/third_party/blink/renderer/platform/loader/fetch/resource_loader.cc
+++ b/third_party/blink/renderer/platform/loader/fetch/resource_loader.cc
+@@ -822,6 +822,9 @@ bool ResourceLoader::WillFollowRedirect(
+                                      new_url)) {
+     fetcher_->GetUseCounter().CountUse(
+         mojom::WebFeature::kAuthorizationCrossOrigin);
+    if (removed_headers) {
+      removed_headers->push_back(net::HttpRequestHeaders::kAuthorization);
+    }
+   }
+ 
+   // TODO(https://crbug.com/471397, https://crbug.com/1406737): Reconsider
+diff --git a/third_party/blink/renderer/platform/loader/fetch/url_loader/sync_load_context.cc b/third_party/blink/renderer/platform/loader/fetch/url_loader/sync_load_context.cc
+--- a/third_party/blink/renderer/platform/loader/fetch/url_loader/sync_load_context.cc
+++ b/third_party/blink/renderer/platform/loader/fetch/url_loader/sync_load_context.cc
+@@ -197,6 +197,10 @@ void SyncLoadContext::FollowRedirect(std::vector<std::string> removed_headers) {
+     return;
+   }
+ 
+  if (response_->has_authorization_header_between_cross_origin_redirect_) {
+    removed_headers.push_back(net::HttpRequestHeaders::kAuthorization);
+  }
+
+   response_->redirect_info = net::RedirectInfo();
+   *context_for_redirect_ = nullptr;
+   std::move(follow_redirect_callback_).Run(std::move(removed_headers));
+--
+2.25.1
@@ -0,0 +1,23 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Mon, 17 Apr 2023 12:43:19 +0000
+Subject: Remove detection of captive portals
+
+License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
+---
+ chrome/browser/net/profile_network_context_service.cc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/chrome/browser/net/profile_network_context_service.cc b/chrome/browser/net/profile_network_context_service.cc
+--- a/chrome/browser/net/profile_network_context_service.cc
+++ b/chrome/browser/net/profile_network_context_service.cc
+@@ -411,7 +411,7 @@ void ProfileNetworkContextService::UpdateAdditionalCertificates() {
+ void ProfileNetworkContextService::RegisterProfilePrefs(
+     user_prefs::PrefRegistrySyncable* registry) {
+   registry->RegisterBooleanPref(embedder_support::kAlternateErrorPagesEnabled,
+-                                true);
+                                false);
+   registry->RegisterBooleanPref(prefs::kQuicAllowed, true);
+   registry->RegisterBooleanPref(prefs::kGloballyScopeHTTPAuthCacheEnabled,
+                                 false);
+--
+2.25.1
@@ -0,0 +1,24 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Thu, 20 Apr 2023 15:03:56 +0000
+Subject: Remove https connection from chrome://discards
+
+---
+ chrome/browser/resources/discards/graph_doc_template.html | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/chrome/browser/resources/discards/graph_doc_template.html b/chrome/browser/resources/discards/graph_doc_template.html
+--- a/chrome/browser/resources/discards/graph_doc_template.html
+++ b/chrome/browser/resources/discards/graph_doc_template.html
+@@ -82,10 +82,6 @@ URL. As result, this document needs to be self-contained, hence inline scripts.
+       }
+ 
+     </style>
+-  <script src="https://ajax.googleapis.com/ajax/libs/d3js/5.7.0/d3.min.js"
+-      integrity="sha384-HL96dun1KbYEq6UT/ZlsspAODCyQ+Zp4z318ajUPBPSMzy5dvxl6ziwmnil8/Cpd"
+-      crossorigin="anonymous">
+-  </script>
+   <script type="application/javascript">
+ ${javascript_file}
+   </script>
+--
+2.25.1
@@ -0,0 +1,207 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Tue, 27 Jun 2023 11:11:53 +0000
+Subject: Remove support for device memory and cpu recovery
+
+License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
+---
+ .../browser/blob/blob_memory_controller.cc    | 20 ++++++++++---------
+ .../browser/quota/quota_device_info_helper.cc | 17 ++++++++++++++--
+ .../approximated_device_memory.cc             |  7 ++++++-
+ third_party/blink/common/features.cc          |  4 ++--
+ .../frame/navigator_concurrent_hardware.cc    |  8 ++++++--
+ .../blink/renderer/core/timing/memory_info.cc | 14 ++++++++++---
+ .../core/timing/window_performance.cc         |  2 +-
+ 7 files changed, 52 insertions(+), 20 deletions(-)
+
+diff --git a/storage/browser/blob/blob_memory_controller.cc b/storage/browser/blob/blob_memory_controller.cc
+--- a/storage/browser/blob/blob_memory_controller.cc
+++ b/storage/browser/blob/blob_memory_controller.cc
+@@ -50,6 +50,15 @@ using MemoryAllocation = BlobMemoryController::MemoryAllocation;
+ using QuotaAllocationTask = BlobMemoryController::QuotaAllocationTask;
+ using DiskSpaceFuncPtr = BlobMemoryController::DiskSpaceFuncPtr;
+ 
+// static
+#if BUILDFLAG(IS_ANDROID)
+float approximated_device_memory_gb_ = 4.0;
+constexpr int64_t approximated_device_disk_size = 8ull * 1024 * 1024 * 1024;
+#else
+float approximated_device_memory_gb_ = 8.0;
+constexpr int64_t approximated_device_disk_size = 200ull * 1024 * 1024 * 1024;
+#endif
+
+ File::Error CreateBlobDirectory(const FilePath& blob_storage_dir) {
+   File::Error error = File::FILE_OK;
+   base::CreateDirectoryAndGetError(blob_storage_dir, &error);
+@@ -79,23 +88,16 @@ BlobStorageLimits CalculateBlobStorageLimitsImpl(
+   int64_t disk_size = 0ull;
+   uint64_t memory_size = optional_memory_size_for_testing
+                              ? optional_memory_size_for_testing.value()
+-                             : base::SysInfo::AmountOfPhysicalMemory();
+                             : approximated_device_memory_gb_;
+   if (disk_enabled && CreateBlobDirectory(storage_dir) == base::File::FILE_OK)
+-    disk_size = base::SysInfo::AmountOfTotalDiskSpace(storage_dir);
+    disk_size = approximated_device_disk_size;
+ 
+   BlobStorageLimits limits;
+ 
+   // Don't do specialty configuration for error size (-1).
+   if (memory_size > 0) {
+-#if !BUILDFLAG(IS_CHROMEOS_ASH) && !BUILDFLAG(IS_ANDROID) && \
+-    defined(ARCH_CPU_64_BITS)
+     constexpr size_t kTwoGigabytes = 2ull * 1024 * 1024 * 1024;
+     limits.max_blob_in_memory_space = kTwoGigabytes;
+-#elif BUILDFLAG(IS_ANDROID)
+-    limits.max_blob_in_memory_space = static_cast<size_t>(memory_size / 100);
+-#else
+-    limits.max_blob_in_memory_space = static_cast<size_t>(memory_size / 5);
+-#endif
+   }
+   // Devices just on the edge (RAM == 256MB) should not fail because
+   // max_blob_in_memory_space turns out smaller than min_page_file_size
+diff --git a/storage/browser/quota/quota_device_info_helper.cc b/storage/browser/quota/quota_device_info_helper.cc
+--- a/storage/browser/quota/quota_device_info_helper.cc
+++ b/storage/browser/quota/quota_device_info_helper.cc
+@@ -8,17 +8,30 @@
+ 
+ namespace storage {
+ 
+namespace {
+
+// static
+#if BUILDFLAG(IS_ANDROID)
+float approximated_device_memory_gb_ = 4.0;
+constexpr int64_t approximated_device_disk_size = 8ull * 1024 * 1024 * 1024;
+#else
+float approximated_device_memory_gb_ = 8.0;
+constexpr int64_t approximated_device_disk_size = 200ull * 1024 * 1024 * 1024;
+#endif
+
+}
+
+ QuotaDeviceInfoHelper::~QuotaDeviceInfoHelper() = default;
+ 
+ int64_t QuotaDeviceInfoHelper::AmountOfTotalDiskSpace(
+     const base::FilePath& path) const {
+-  int64_t disk_space = base::SysInfo::AmountOfTotalDiskSpace(path);
+  int64_t disk_space = approximated_device_disk_size;
+   UMA_HISTOGRAM_BOOLEAN("Quota.TotalDiskSpaceIsZero", disk_space <= 0);
+   return disk_space;
+ }
+ 
+ uint64_t QuotaDeviceInfoHelper::AmountOfPhysicalMemory() const {
+-  return base::SysInfo::AmountOfPhysicalMemory();
+  return approximated_device_memory_gb_;
+ }
+ 
+ }  // namespace storage
+diff --git a/third_party/blink/common/device_memory/approximated_device_memory.cc b/third_party/blink/common/device_memory/approximated_device_memory.cc
+--- a/third_party/blink/common/device_memory/approximated_device_memory.cc
+++ b/third_party/blink/common/device_memory/approximated_device_memory.cc
+@@ -4,13 +4,18 @@
+ 
+ #include "third_party/blink/public/common/device_memory/approximated_device_memory.h"
+ 
+#include "build/build_config.h"
+ #include "base/check_op.h"
+ #include "base/system/sys_info.h"
+ 
+ namespace blink {
+ 
+ // static
+-float ApproximatedDeviceMemory::approximated_device_memory_gb_ = 0.0;
+#if BUILDFLAG(IS_ANDROID)
+float ApproximatedDeviceMemory::approximated_device_memory_gb_ = 4.0;
+#else
+float ApproximatedDeviceMemory::approximated_device_memory_gb_ = 8.0;
+#endif
+ int64_t ApproximatedDeviceMemory::physical_memory_mb_ = 0;
+ 
+ // static
+diff --git a/third_party/blink/common/features.cc b/third_party/blink/common/features.cc
+--- a/third_party/blink/common/features.cc
+++ b/third_party/blink/common/features.cc
+@@ -2034,8 +2034,8 @@ BASE_FEATURE(kWebFontsCacheAwareTimeoutAdaption,
+ // Controls whether the implementation of the performance.measureMemory
+ // web API uses PerformanceManager or not.
+ BASE_FEATURE(kWebMeasureMemoryViaPerformanceManager,
+-             "WebMeasureMemoryViaPerformanceManager",
+-             base::FEATURE_ENABLED_BY_DEFAULT);
+             "WebMeasureMemoryViaPerformanceManager",  // need to be
+             base::FEATURE_DISABLED_BY_DEFAULT);       // disabled by default
+ 
+ BASE_FEATURE(kWebRtcCombinedNetworkAndWorkerThread,
+              "WebRtcCombinedNetworkAndWorkerThread",
+diff --git a/third_party/blink/renderer/core/frame/navigator_concurrent_hardware.cc b/third_party/blink/renderer/core/frame/navigator_concurrent_hardware.cc
+--- a/third_party/blink/renderer/core/frame/navigator_concurrent_hardware.cc
+++ b/third_party/blink/renderer/core/frame/navigator_concurrent_hardware.cc
+@@ -3,13 +3,17 @@
+ // found in the LICENSE file.
+ 
+ #include "third_party/blink/renderer/core/frame/navigator_concurrent_hardware.h"
+-
+#include "build/build_config.h"
+ #include "base/system/sys_info.h"
+ 
+ namespace blink {
+ 
+ unsigned NavigatorConcurrentHardware::hardwareConcurrency() const {
+-  return static_cast<unsigned>(base::SysInfo::NumberOfProcessors());
+#if BUILDFLAG(IS_ANDROID)
+  return static_cast<unsigned>(2);
+#else
+  return static_cast<unsigned>(8);
+#endif
+ }
+ 
+ }  // namespace blink
+diff --git a/third_party/blink/renderer/core/timing/memory_info.cc b/third_party/blink/renderer/core/timing/memory_info.cc
+--- a/third_party/blink/renderer/core/timing/memory_info.cc
+++ b/third_party/blink/renderer/core/timing/memory_info.cc
+@@ -34,6 +34,8 @@
+ 
+ #include "base/time/default_tick_clock.h"
+ #include "base/time/time.h"
+#include "base/rand_util.h"
+#include "build/build_config.h"
+ #include "third_party/blink/renderer/core/frame/settings.h"
+ #include "third_party/blink/renderer/platform/runtime_enabled_features.h"
+ #include "third_party/blink/renderer/platform/wtf/math_extras.h"
+@@ -43,15 +45,21 @@ namespace blink {
+ 
+ static constexpr base::TimeDelta kTwentyMinutes = base::Minutes(20);
+ static constexpr base::TimeDelta kFiftyMs = base::Milliseconds(50);
+#if BUILDFLAG(IS_ANDROID)
+static constexpr int64_t heap_size_limit = 528744448;
+#else
+static constexpr int64_t heap_size_limit = 4294705152;
+#endif
+ 
+ static void GetHeapSize(HeapInfo& info) {
+   v8::HeapStatistics heap_statistics;
+   v8::Isolate::GetCurrent()->GetHeapStatistics(&heap_statistics);
+  const double scale_factor = 1.0 + base::RandInt(-300, 300) / 10000.0;
+   info.used_js_heap_size =
+-      heap_statistics.used_heap_size() + heap_statistics.external_memory();
+      (heap_statistics.used_heap_size() + heap_statistics.external_memory()) * scale_factor;
+   info.total_js_heap_size =
+-      heap_statistics.total_physical_size() + heap_statistics.external_memory();
+-  info.js_heap_size_limit = heap_statistics.heap_size_limit();
+      (heap_statistics.total_physical_size() + heap_statistics.external_memory()) * scale_factor;
+  info.js_heap_size_limit = heap_size_limit;
+ }
+ 
+ class HeapSizeCache {
+diff --git a/third_party/blink/renderer/core/timing/window_performance.cc b/third_party/blink/renderer/core/timing/window_performance.cc
+--- a/third_party/blink/renderer/core/timing/window_performance.cc
+++ b/third_party/blink/renderer/core/timing/window_performance.cc
+@@ -255,7 +255,7 @@ MemoryInfo* WindowPerformance::memory(ScriptState* script_state) const {
+   auto* memory_info = MakeGarbageCollected<MemoryInfo>(
+       Platform::Current()->IsLockedToSite()
+           ? MemoryInfo::Precision::kPrecise
+-          : MemoryInfo::Precision::kBucketized);
+          : MemoryInfo::Precision::kPrecise);
+   // Record Web Memory UKM.
+   const uint64_t kBytesInKB = 1024;
+   auto* execution_context = ExecutionContext::From(script_state);
+--
+2.25.1
@@ -0,0 +1,417 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Tue, 30 May 2023 15:13:31 +0000
+Subject: Restore LastTabStandingTracker
+
+License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
+---
+ chrome/browser/BUILD.gn                       | 10 ++++
+ .../host_content_settings_map_factory.cc      |  2 +
+ .../permissions/last_tab_standing_tracker.cc  | 59 +++++++++++++++++++
+ .../permissions/last_tab_standing_tracker.h   | 40 +++++++++++++
+ .../last_tab_standing_tracker_factory.cc      | 35 +++++++++++
+ .../last_tab_standing_tracker_factory.h       | 40 +++++++++++++
+ .../last_tab_standing_tracker_observer.h      | 24 ++++++++
+ .../last_tab_standing_tracker_tab_helper.cc   | 42 +++++++++++++
+ .../last_tab_standing_tracker_tab_helper.h    | 37 ++++++++++++
+ ...hrome_browser_main_extra_parts_profiles.cc |  2 +
+ chrome/browser/ui/tab_helpers.cc              |  2 +
+ 11 files changed, 293 insertions(+)
+ create mode 100644 chrome/browser/permissions/last_tab_standing_tracker.cc
+ create mode 100644 chrome/browser/permissions/last_tab_standing_tracker.h
+ create mode 100644 chrome/browser/permissions/last_tab_standing_tracker_factory.cc
+ create mode 100644 chrome/browser/permissions/last_tab_standing_tracker_factory.h
+ create mode 100644 chrome/browser/permissions/last_tab_standing_tracker_observer.h
+ create mode 100644 chrome/browser/permissions/last_tab_standing_tracker_tab_helper.cc
+ create mode 100644 chrome/browser/permissions/last_tab_standing_tracker_tab_helper.h
+
+diff --git a/chrome/browser/BUILD.gn b/chrome/browser/BUILD.gn
+--- a/chrome/browser/BUILD.gn
+++ b/chrome/browser/BUILD.gn
+@@ -1970,6 +1970,16 @@ static_library("browser") {
+     ]
+   }
+ 
+  sources += [
+    "permissions/last_tab_standing_tracker.cc",
+    "permissions/last_tab_standing_tracker.h",
+    "permissions/last_tab_standing_tracker_factory.cc",
+    "permissions/last_tab_standing_tracker_factory.h",
+    "permissions/last_tab_standing_tracker_observer.h",
+    "permissions/last_tab_standing_tracker_tab_helper.cc",
+    "permissions/last_tab_standing_tracker_tab_helper.h",
+  ]
+
+   if (is_android) {
+     sources += [
+       "importer/profile_writer.cc",
+diff --git a/chrome/browser/content_settings/host_content_settings_map_factory.cc b/chrome/browser/content_settings/host_content_settings_map_factory.cc
+--- a/chrome/browser/content_settings/host_content_settings_map_factory.cc
+++ b/chrome/browser/content_settings/host_content_settings_map_factory.cc
+@@ -11,6 +11,7 @@
+ #include "build/buildflag.h"
+ #include "chrome/browser/content_settings/one_time_permission_provider.h"
+ #include "chrome/browser/permissions/one_time_permissions_tracker_factory.h"
+#include "chrome/browser/permissions/last_tab_standing_tracker_factory.h"
+ #include "chrome/browser/profiles/off_the_record_profile_impl.h"
+ #include "chrome/browser/profiles/profile.h"
+ #include "chrome/browser/search_engines/template_url_service_factory.h"
+@@ -60,6 +61,7 @@ HostContentSettingsMapFactory::HostContentSettingsMapFactory()
+               // Guest mode.
+               .WithGuest(ProfileSelection::kOwnInstance)
+               .Build()) {
+  DependsOn(LastTabStandingTrackerFactory::GetInstance());
+ #if BUILDFLAG(ENABLE_SUPERVISED_USERS)
+   DependsOn(SupervisedUserSettingsServiceFactory::GetInstance());
+ #endif
+diff --git a/chrome/browser/permissions/last_tab_standing_tracker.cc b/chrome/browser/permissions/last_tab_standing_tracker.cc
+new file mode 100644
+--- /dev/null
+++ b/chrome/browser/permissions/last_tab_standing_tracker.cc
+@@ -0,0 +1,59 @@
+// Copyright 2020 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/permissions/last_tab_standing_tracker.h"
+
+#include "base/observer_list.h"
+#include "url/gurl.h"
+
+LastTabStandingTracker::LastTabStandingTracker(content::BrowserContext* context)
+    : context_(context) {}
+
+LastTabStandingTracker::~LastTabStandingTracker() = default;
+
+void LastTabStandingTracker::Shutdown() {
+  for (auto& observer : observer_list_) {
+    observer.OnShutdown();
+  }
+  observer_list_.Clear();
+}
+
+void LastTabStandingTracker::AddObserver(
+    LastTabStandingTrackerObserver* observer) {
+  observer_list_.AddObserver(observer);
+}
+
+void LastTabStandingTracker::RemoveObserver(
+    LastTabStandingTrackerObserver* observer) {
+  observer_list_.RemoveObserver(observer);
+}
+
+void LastTabStandingTracker::WebContentsLoadedOrigin(
+    const url::Origin& origin) {
+  if (origin.opaque())
+    return;
+  // There are cases where chrome://newtab/ and chrome://new-tab-page/ are
+  // used synonymously causing inconsistencies in the map. So we just ignore
+  // them.
+  if (origin == url::Origin::Create(GURL("chrome://newtab/")) ||
+      origin == url::Origin::Create(GURL("chrome://new-tab-page/")))
+    return;
+  tab_counter_[origin]++;
+}
+
+void LastTabStandingTracker::WebContentsUnloadedOrigin(
+    const url::Origin& origin) {
+  if (origin.opaque())
+    return;
+  if (origin == url::Origin::Create(GURL("chrome://newtab/")) ||
+      origin == url::Origin::Create(GURL("chrome://new-tab-page/")))
+    return;
+  DCHECK(tab_counter_.find(origin) != tab_counter_.end());
+  tab_counter_[origin]--;
+  if (tab_counter_[origin] <= 0) {
+    tab_counter_.erase(origin);
+    for (auto& observer : observer_list_) {
+      observer.OnLastPageFromOriginClosed(origin);
+    }
+}
+diff --git a/chrome/browser/permissions/last_tab_standing_tracker.h b/chrome/browser/permissions/last_tab_standing_tracker.h
+new file mode 100644
+--- /dev/null
+++ b/chrome/browser/permissions/last_tab_standing_tracker.h
+@@ -0,0 +1,40 @@
+// Copyright 2020 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_PERMISSIONS_LAST_TAB_STANDING_TRACKER_H_
+#define CHROME_BROWSER_PERMISSIONS_LAST_TAB_STANDING_TRACKER_H_
+
+#include <map>
+
+#include "base/observer_list.h"
+#include "chrome/browser/profiles/profile.h"
+#include "chrome/browser/permissions/last_tab_standing_tracker_observer.h"
+#include "components/keyed_service/core/keyed_service.h"
+#include "url/origin.h"
+
+// This class keep tracks of all open tabs. And notifies its observers when
+// all tabs of a particular origin have been closed or navigated away from.
+class LastTabStandingTracker : public KeyedService {
+ public:
+  LastTabStandingTracker(content::BrowserContext* context);
+  ~LastTabStandingTracker() override;
+
+  LastTabStandingTracker(const LastTabStandingTracker&) = delete;
+  LastTabStandingTracker& operator=(const LastTabStandingTracker&) = delete;
+
+  void WebContentsLoadedOrigin(const url::Origin& origin);
+  void WebContentsUnloadedOrigin(const url::Origin& origin);
+  void AddObserver(LastTabStandingTrackerObserver* observer);
+  void RemoveObserver(LastTabStandingTrackerObserver* observer);
+
+  void Shutdown() override;
+
+ private:
+  base::ObserverList<LastTabStandingTrackerObserver> observer_list_;
+  raw_ptr<content::BrowserContext> context_;
+  // Tracks how many tabs of a particular origin are open at any given time.
+  std::map<url::Origin, int> tab_counter_;
+};
+
+#endif  // CHROME_BROWSER_PERMISSIONS_LAST_TAB_STANDING_TRACKER_H_
+diff --git a/chrome/browser/permissions/last_tab_standing_tracker_factory.cc b/chrome/browser/permissions/last_tab_standing_tracker_factory.cc
+new file mode 100644
+--- /dev/null
+++ b/chrome/browser/permissions/last_tab_standing_tracker_factory.cc
+@@ -0,0 +1,35 @@
+// Copyright 2020 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/permissions/last_tab_standing_tracker_factory.h"
+
+#include "base/memory/singleton.h"
+#include "chrome/browser/permissions/last_tab_standing_tracker.h"
+#include "chrome/browser/profiles/profile.h"
+
+LastTabStandingTracker* LastTabStandingTrackerFactory::GetForBrowserContext(
+    content::BrowserContext* browser_context) {
+  return static_cast<LastTabStandingTracker*>(
+      GetInstance()->GetServiceForBrowserContext(browser_context, true));
+}
+
+LastTabStandingTrackerFactory* LastTabStandingTrackerFactory::GetInstance() {
+  return base::Singleton<LastTabStandingTrackerFactory>::get();
+}
+
+LastTabStandingTrackerFactory::LastTabStandingTrackerFactory()
+    : ProfileKeyedServiceFactory(
+          "LastTabStandingTrackerKeyedService",
+          ProfileSelections::BuildForRegularAndIncognito()) {}
+
+LastTabStandingTrackerFactory::~LastTabStandingTrackerFactory() = default;
+
+bool LastTabStandingTrackerFactory::ServiceIsCreatedWithBrowserContext() const {
+  return true;
+}
+
+KeyedService* LastTabStandingTrackerFactory::BuildServiceInstanceFor(
+    content::BrowserContext* context) const {
+  return new LastTabStandingTracker(context);
+}
+diff --git a/chrome/browser/permissions/last_tab_standing_tracker_factory.h b/chrome/browser/permissions/last_tab_standing_tracker_factory.h
+new file mode 100644
+--- /dev/null
+++ b/chrome/browser/permissions/last_tab_standing_tracker_factory.h
+@@ -0,0 +1,40 @@
+// Copyright 2020 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_PERMISSIONS_LAST_TAB_STANDING_TRACKER_FACTORY_H_
+#define CHROME_BROWSER_PERMISSIONS_LAST_TAB_STANDING_TRACKER_FACTORY_H_
+
+#include "chrome/browser/profiles/profile_keyed_service_factory.h"
+
+namespace base {
+template <typename T>
+struct DefaultSingletonTraits;
+}
+class LastTabStandingTracker;
+
+class LastTabStandingTrackerFactory : public ProfileKeyedServiceFactory {
+ public:
+  LastTabStandingTrackerFactory(const LastTabStandingTrackerFactory&) = delete;
+  LastTabStandingTrackerFactory& operator=(
+      const LastTabStandingTrackerFactory&) = delete;
+
+  static LastTabStandingTracker* GetForBrowserContext(
+      content::BrowserContext* context);
+  static LastTabStandingTrackerFactory* GetInstance();
+
+ protected:
+  bool ServiceIsCreatedWithBrowserContext() const override;
+
+ private:
+  friend struct base::DefaultSingletonTraits<LastTabStandingTrackerFactory>;
+
+  LastTabStandingTrackerFactory();
+  ~LastTabStandingTrackerFactory() override;
+
+  // BrowserContextKeyedServiceFactory:
+  KeyedService* BuildServiceInstanceFor(
+      content::BrowserContext* context) const override;
+};
+
+#endif  // CHROME_BROWSER_PERMISSIONS_LAST_TAB_STANDING_TRACKER_FACTORY_H_
+diff --git a/chrome/browser/permissions/last_tab_standing_tracker_observer.h b/chrome/browser/permissions/last_tab_standing_tracker_observer.h
+new file mode 100644
+--- /dev/null
+++ b/chrome/browser/permissions/last_tab_standing_tracker_observer.h
+@@ -0,0 +1,24 @@
+// Copyright 2020 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_PERMISSIONS_LAST_TAB_STANDING_TRACKER_OBSERVER_H_
+#define CHROME_BROWSER_PERMISSIONS_LAST_TAB_STANDING_TRACKER_OBSERVER_H_
+
+#include "base/observer_list_types.h"
+#include "url/origin.h"
+
+class LastTabStandingTrackerObserver : public base::CheckedObserver {
+ public:
+  // Event fired when the last tab in a given Profile whose top-level document
+  // is from |origin| is closed or navigated away.
+  virtual void OnLastPageFromOriginClosed(const url::Origin&) = 0;
+
+  // Event fired to let the observers know that the BrowserContext is going to
+  // shut down.
+  // The observers don't need to take care of removing themselves as an
+  // observer.
+  virtual void OnShutdown() = 0;
+};
+
+#endif  // CHROME_BROWSER_PERMISSIONS_LAST_TAB_STANDING_TRACKER_OBSERVER_H_
+diff --git a/chrome/browser/permissions/last_tab_standing_tracker_tab_helper.cc b/chrome/browser/permissions/last_tab_standing_tracker_tab_helper.cc
+new file mode 100644
+--- /dev/null
+++ b/chrome/browser/permissions/last_tab_standing_tracker_tab_helper.cc
+@@ -0,0 +1,42 @@
+// Copyright 2020 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/permissions/last_tab_standing_tracker_tab_helper.h"
+
+#include "chrome/browser/permissions/last_tab_standing_tracker.h"
+#include "chrome/browser/permissions/last_tab_standing_tracker_factory.h"
+#include "content/public/browser/navigation_handle.h"
+
+LastTabStandingTrackerTabHelper::~LastTabStandingTrackerTabHelper() = default;
+
+void LastTabStandingTrackerTabHelper::WebContentsDestroyed() {
+  if (last_committed_origin_) {
+    LastTabStandingTrackerFactory::GetForBrowserContext(
+        web_contents()->GetBrowserContext())
+        ->WebContentsUnloadedOrigin(*last_committed_origin_);
+  }
+}
+
+void LastTabStandingTrackerTabHelper::PrimaryPageChanged(content::Page& page) {
+  url::Origin new_origin = page.GetMainDocument().GetLastCommittedOrigin();
+  if (last_committed_origin_ && *last_committed_origin_ == new_origin)
+    return;
+  auto* last_tab_standing_tracker =
+      LastTabStandingTrackerFactory::GetForBrowserContext(
+          web_contents()->GetBrowserContext());
+  if (last_committed_origin_) {
+    last_tab_standing_tracker->WebContentsUnloadedOrigin(
+        *last_committed_origin_);
+  }
+  last_tab_standing_tracker->WebContentsLoadedOrigin(new_origin);
+  last_committed_origin_ = std::move(new_origin);
+}
+
+LastTabStandingTrackerTabHelper::LastTabStandingTrackerTabHelper(
+    content::WebContents* web_contents)
+    : content::WebContentsObserver(web_contents),
+      content::WebContentsUserData<LastTabStandingTrackerTabHelper>(
+          *web_contents) {}
+
+WEB_CONTENTS_USER_DATA_KEY_IMPL(LastTabStandingTrackerTabHelper);
+diff --git a/chrome/browser/permissions/last_tab_standing_tracker_tab_helper.h b/chrome/browser/permissions/last_tab_standing_tracker_tab_helper.h
+new file mode 100644
+--- /dev/null
+++ b/chrome/browser/permissions/last_tab_standing_tracker_tab_helper.h
+@@ -0,0 +1,37 @@
+// Copyright 2020 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_PERMISSIONS_LAST_TAB_STANDING_TRACKER_TAB_HELPER_H_
+#define CHROME_BROWSER_PERMISSIONS_LAST_TAB_STANDING_TRACKER_TAB_HELPER_H_
+
+#include "content/public/browser/web_contents_observer.h"
+#include "content/public/browser/web_contents_user_data.h"
+
+// This class informs LastTabStandingTracker of pages being loaded, navigated or
+// destroyed in each tab. This information is then used by the
+// OneTimeGeolocationPermissionProvider to revoke permissions.
+class LastTabStandingTrackerTabHelper
+    : public content::WebContentsObserver,
+      public content::WebContentsUserData<LastTabStandingTrackerTabHelper> {
+ public:
+  ~LastTabStandingTrackerTabHelper() override;
+
+  LastTabStandingTrackerTabHelper(const LastTabStandingTrackerTabHelper&) =
+      delete;
+  LastTabStandingTrackerTabHelper& operator=(
+      const LastTabStandingTrackerTabHelper&) = delete;
+
+  // content::WebContentObserver
+  void PrimaryPageChanged(content::Page& page) override;
+  void WebContentsDestroyed() override;
+
+ private:
+  explicit LastTabStandingTrackerTabHelper(content::WebContents* webContents);
+  friend class content::WebContentsUserData<LastTabStandingTrackerTabHelper>;
+  absl::optional<url::Origin> last_committed_origin_;
+
+  WEB_CONTENTS_USER_DATA_KEY_DECL();
+};
+
+#endif  // CHROME_BROWSER_PERMISSIONS_LAST_TAB_STANDING_TRACKER_TAB_HELPER_H_
+diff --git a/chrome/browser/profiles/chrome_browser_main_extra_parts_profiles.cc b/chrome/browser/profiles/chrome_browser_main_extra_parts_profiles.cc
+--- a/chrome/browser/profiles/chrome_browser_main_extra_parts_profiles.cc
+++ b/chrome/browser/profiles/chrome_browser_main_extra_parts_profiles.cc
+@@ -123,6 +123,7 @@
+ #include "chrome/browser/password_manager/password_reuse_manager_factory.h"
+ #include "chrome/browser/password_manager/password_store_factory.h"
+ #include "chrome/browser/permissions/adaptive_quiet_notification_permission_ui_enabler.h"
+#include "chrome/browser/permissions/last_tab_standing_tracker_factory.h"
+ #include "chrome/browser/permissions/notifications_engagement_service_factory.h"
+ #include "chrome/browser/permissions/one_time_permissions_tracker_factory.h"
+ #include "chrome/browser/permissions/origin_keyed_permission_action_service_factory.h"
+@@ -921,6 +922,7 @@ void ChromeBrowserMainExtraPartsProfiles::
+ #if BUILDFLAG(BUILD_WITH_TFLITE_LIB)
+   OnDeviceTailModelServiceFactory::GetInstance();
+ #endif
+  LastTabStandingTrackerFactory::GetInstance();
+ #if !BUILDFLAG(IS_ANDROID)
+   OneGoogleBarServiceFactory::GetInstance();
+   if (base::FeatureList::IsEnabled(permissions::features::kOneTimePermission)) {
+diff --git a/chrome/browser/ui/tab_helpers.cc b/chrome/browser/ui/tab_helpers.cc
+--- a/chrome/browser/ui/tab_helpers.cc
+++ b/chrome/browser/ui/tab_helpers.cc
+@@ -63,6 +63,7 @@
+ #include "chrome/browser/page_load_metrics/page_load_metrics_initialize.h"
+ #include "chrome/browser/password_manager/chrome_password_manager_client.h"
+ #include "chrome/browser/performance_manager/public/user_tuning/user_performance_tuning_manager.h"
+#include "chrome/browser/permissions/last_tab_standing_tracker_tab_helper.h"
+ #include "chrome/browser/permissions/one_time_permissions_tracker_helper.h"
+ #include "chrome/browser/predictors/loading_predictor_factory.h"
+ #include "chrome/browser/predictors/loading_predictor_tab_helper.h"
+@@ -396,6 +397,7 @@ void TabHelpers::AttachTabHelpers(WebContents* web_contents) {
+   HistoryClustersTabHelper::CreateForWebContents(web_contents);
+   HttpsOnlyModeTabHelper::CreateForWebContents(web_contents);
+   webapps::InstallableManager::CreateForWebContents(web_contents);
+  LastTabStandingTrackerTabHelper::CreateForWebContents(web_contents);
+   login_detection::LoginDetectionTabHelper::MaybeCreateForWebContents(
+       web_contents);
+   if (MediaEngagementService::IsEnabled())
+--
+2.25.1
@@ -0,0 +1,37 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Fri, 20 Oct 2023 12:36:07 +0000
+Subject: Show full urls for bookmark
+
+Restore omnibox-bookmark-paths flag and show full urls
+in android bookmark page
+See https://source.chromium.org/chromium/chromium/src/+/4a9dd5ab3709d60f40beb2f801a0185ab2ba992a
+---
+ .../src/org/chromium/components/bookmarks/BookmarkItem.java     | 1 +
+ components/omnibox/browser/titled_url_match_utils.cc            | 2 +-
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/components/bookmarks/common/android/java/src/org/chromium/components/bookmarks/BookmarkItem.java b/components/bookmarks/common/android/java/src/org/chromium/components/bookmarks/BookmarkItem.java
+--- a/components/bookmarks/common/android/java/src/org/chromium/components/bookmarks/BookmarkItem.java
+++ b/components/bookmarks/common/android/java/src/org/chromium/components/bookmarks/BookmarkItem.java
+@@ -51,6 +51,7 @@ public class BookmarkItem {
+ 
+     /** Returns the string to display for the item's url. */
+     public String getUrlForDisplay() {
+        if ((true)) return getUrl().getSpec();
+         return UrlFormatter.formatUrlForSecurityDisplay(
+                 getUrl(), SchemeDisplay.OMIT_HTTP_AND_HTTPS);
+     }
+diff --git a/components/omnibox/browser/titled_url_match_utils.cc b/components/omnibox/browser/titled_url_match_utils.cc
+--- a/components/omnibox/browser/titled_url_match_utils.cc
+++ b/components/omnibox/browser/titled_url_match_utils.cc
+@@ -80,7 +80,7 @@ AutocompleteMatch TitledUrlMatchToAutocompleteMatch(
+   // Otherwise, display the path, even if the input matches both or neither.
+   bool show_path = titled_url_match.has_ancestor_match ||
+                    titled_url_match.url_match_positions.empty();
+-  match.contents = show_path ? path : formatted_url;
+  match.contents = /*show_path ? path :*/ formatted_url;
+   // The path can become stale (when the bookmark is moved). So persist the URL
+   // instead when creating shortcuts.
+   if (show_path)
+--
+2.25.1
@@ -0,0 +1,27 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Mon, 17 Jul 2023 15:26:11 +0000
+Subject: Show warnings on downloads over HTTP
+
+License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
+---
+ chrome/common/chrome_features.cc | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/chrome/common/chrome_features.cc b/chrome/common/chrome_features.cc
+--- a/chrome/common/chrome_features.cc
+++ b/chrome/common/chrome_features.cc
+@@ -1228,9 +1228,9 @@ BASE_FEATURE(kTreatUnsafeDownloadsAsActive,
+              base::FEATURE_ENABLED_BY_DEFAULT);
+ 
+ // Show warnings on downloads not delivered over HTTPS.
+-BASE_FEATURE(kInsecureDownloadWarnings,
+-             "InsecureDownloadWarnings",
+-             base::FEATURE_DISABLED_BY_DEFAULT);
+BASE_FEATURE(kInsecureDownloadWarnings,         // enabled by
+             "InsecureDownloadWarnings",        // default
+             base::FEATURE_ENABLED_BY_DEFAULT); // in bromite
+ 
+ // TrustSafetySentimentSurvey
+ #if !BUILDFLAG(IS_ANDROID)
+--
+2.25.1
@@ -0,0 +1,22 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Fri, 19 May 2023 12:26:37 +0000
+Subject: TEMP Add a log to track strange behavior
+
+License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
+---
+ net/spdy/spdy_session.cc | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/spdy/spdy_session.cc b/net/spdy/spdy_session.cc
+--- a/net/spdy/spdy_session.cc
+++ b/net/spdy/spdy_session.cc
+@@ -2964,6 +2964,7 @@ void SpdySession::OnHeaders(spdy::SpdyStreamId stream_id,
+   if (it == active_streams_.end()) {
+     // NOTE:  it may just be that the stream was cancelled.
+     LOG(WARNING) << "Received HEADERS for invalid stream " << stream_id;
+    LOG(WARNING) << "--- " << headers.DebugString();
+     return;
+   }
+ 
+--
+2.25.1
@@ -0,0 +1,23 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Tue, 20 Dec 2022 15:09:46 +0000
+Subject: Temp Disable kAutomaticLazyFrameLoadingToEmbeds
+
+License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
+---
+ third_party/blink/common/features.cc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/third_party/blink/common/features.cc b/third_party/blink/common/features.cc
+--- a/third_party/blink/common/features.cc
+++ b/third_party/blink/common/features.cc
+@@ -180,7 +180,7 @@ const base::FeatureParam<int> kSkipFrameCountForLazyAds(
+ // Vitals.
+ BASE_FEATURE(kAutomaticLazyFrameLoadingToEmbeds,
+              "AutomaticLazyFrameLoadingToEmbeds",    // must be enabled
+-             base::FEATURE_ENABLED_BY_DEFAULT);      // in Bromite
+             base::FEATURE_DISABLED_BY_DEFAULT);      // in Bromite
+ 
+ // The timeout value that forces loading iframes that are lazy loaded by
+ // LazyEmbeds. After this timeout, the frame loading is triggered even when the
+--
+2.25.1
@@ -0,0 +1,51 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Wed, 11 Oct 2023 09:40:53 +0000
+Subject: Temp PerformanceNavigationTiming privacy fix
+
+License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
+---
+ .../renderer/core/timing/performance_navigation_timing.cc      | 2 ++
+ .../blink/renderer/core/timing/performance_resource_timing.cc  | 3 ++-
+ 2 files changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/third_party/blink/renderer/core/timing/performance_navigation_timing.cc b/third_party/blink/renderer/core/timing/performance_navigation_timing.cc
+--- a/third_party/blink/renderer/core/timing/performance_navigation_timing.cc
+++ b/third_party/blink/renderer/core/timing/performance_navigation_timing.cc
+@@ -31,6 +31,7 @@ using network::mojom::blink::NavigationDeliveryType;
+ namespace {
+ 
+ String GetSystemEntropy(DocumentLoader* loader) {
+  if ((true)) return "high";
+   if (loader) {
+     switch (loader->GetTiming().SystemEntropyAtNavigationStart()) {
+       case mojom::blink::SystemEntropy::kHigh:
+@@ -215,6 +216,7 @@ AtomicString PerformanceNavigationTiming::type() const {
+ }
+ 
+ AtomicString PerformanceNavigationTiming::deliveryType() const {
+  if ((true)) return g_empty_atom;
+   DocumentLoader* loader = GetDocumentLoader();
+   if (!loader) {
+     return GetDeliveryType();
+diff --git a/third_party/blink/renderer/core/timing/performance_resource_timing.cc b/third_party/blink/renderer/core/timing/performance_resource_timing.cc
+--- a/third_party/blink/renderer/core/timing/performance_resource_timing.cc
+++ b/third_party/blink/renderer/core/timing/performance_resource_timing.cc
+@@ -122,7 +122,7 @@ uint64_t PerformanceResourceTiming::GetTransferSize(
+ AtomicString PerformanceResourceTiming::GetDeliveryType() const {
+   return info_->cache_state == mojom::blink::CacheState::kNone
+              ? g_empty_atom
+-             : delivery_type_names::kCache;
+             : g_empty_atom;
+ }
+ 
+ AtomicString PerformanceResourceTiming::deliveryType() const {
+@@ -156,6 +156,7 @@ AtomicString PerformanceResourceTiming::GetNextHopProtocol(
+     returnedProtocol = g_empty_atom;
+   }
+ 
+  returnedProtocol = g_empty_atom;
+   return returnedProtocol;
+ }
+ 
+--
+2.25.1
@@ -0,0 +1,23 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Sat, 12 Aug 2023 14:48:57 +0000
+Subject: Temp disable predictive back gesture
+
+License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
+---
+ chrome/android/java/AndroidManifest.xml | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/chrome/android/java/AndroidManifest.xml b/chrome/android/java/AndroidManifest.xml
+--- a/chrome/android/java/AndroidManifest.xml
+++ b/chrome/android/java/AndroidManifest.xml
+@@ -188,7 +188,7 @@ by a child template that "extends" this file.
+         android:networkSecurityConfig="@xml/network_security_config"
+         android:allowAudioPlaybackCapture="false"
+         android:appComponentFactory="org.chromium.chrome.browser.base.SplitCompatAppComponentFactory"
+-        android:enableOnBackInvokedCallback="true"
+        android:enableOnBackInvokedCallback="false"
+         {% block extra_application_attributes %}{% endblock %}>
+ 
+         {% if channel in ['canary', 'dev', 'default'] %}
+--
+2.25.1
@@ -0,0 +1,49 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Sun, 29 Oct 2023 15:18:24 +0000
+Subject: Temp guard FileSystemAccessPersistentPermissions
+
+---
+ .../chrome_file_system_access_permission_context.cc  | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/chrome/browser/file_system_access/chrome_file_system_access_permission_context.cc b/chrome/browser/file_system_access/chrome_file_system_access_permission_context.cc
+--- a/chrome/browser/file_system_access/chrome_file_system_access_permission_context.cc
+++ b/chrome/browser/file_system_access/chrome_file_system_access_permission_context.cc
+@@ -75,13 +75,13 @@
+ 
+ namespace features {
+ BASE_FEATURE(kFileSystemAccessPersistentPermissions,
+-             "kFileSystemAccessPersistentPermissions",
+-             base::FEATURE_DISABLED_BY_DEFAULT);
+             "kFileSystemAccessPersistentPermissions", // guard
+             base::FEATURE_DISABLED_BY_DEFAULT);       // this
+ 
+ #if BUILDFLAG(IS_WIN)
+ BASE_FEATURE(kFileSystemAccessLocalUNCPathBlock,
+-             "kFileSystemAccessLocalUNCPathBlock",
+-             base::FEATURE_ENABLED_BY_DEFAULT);
+             "kFileSystemAccessLocalUNCPathBlock",    // guard
+             base::FEATURE_ENABLED_BY_DEFAULT);       // this
+ #endif
+ }  // namespace features
+ 
+@@ -377,7 +377,7 @@ bool ShouldBlockAccessToPath(const base::FilePath& check_path,
+     }
+ 
+     if (check_path == blocked_path || check_path.IsParent(blocked_path)) {
+-      VLOG(1) << "Blocking access to " << check_path
+      LOG(INFO) << "Blocking access to " << check_path
+               << " because it is a parent of " << blocked_path << " ("
+               << block.base_path_key << ")";
+       return true;
+@@ -406,7 +406,7 @@ bool ShouldBlockAccessToPath(const base::FilePath& check_path,
+   }
+ 
+   // The nearest ancestor blocks access to its children, so block access.
+-  VLOG(1) << "Blocking access to " << check_path << " because it is inside "
+  LOG(INFO) << "Blocking access to " << check_path << " because it is inside "
+           << nearest_ancestor << " (" << nearest_ancestor_path_key << ")";
+   return true;
+ }
+--
+2.25.1
@@ -0,0 +1,29 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Wed, 11 Oct 2023 10:33:02 +0000
+Subject: Temp remove support for shared workers
+
+Due to bugid 1147281 and 1490268 temporarily remove
+support for shared workers (active only in desktops)
+
+Ref
+https://bugs.chromium.org/p/chromium/issues/detail?id=1147281
+https://bugs.chromium.org/p/chromium/issues/detail?id=1490268
+
+Test with https://worker-playground.glitch.me/
+---
+ chrome/browser/chrome_content_browser_client.cc | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/chrome/browser/chrome_content_browser_client.cc b/chrome/browser/chrome_content_browser_client.cc
+--- a/chrome/browser/chrome_content_browser_client.cc
+++ b/chrome/browser/chrome_content_browser_client.cc
+@@ -3164,6 +3164,7 @@ bool ChromeContentBrowserClient::AllowSharedWorker(
+     content::BrowserContext* context,
+     int render_process_id,
+     int render_frame_id) {
+  if ((true)) return false;
+   DCHECK_CURRENTLY_ON(BrowserThread::UI);
+ 
+   // Check if cookies are allowed.
+--
+2.25.1
@@ -0,0 +1,28 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Mon, 15 May 2023 13:35:24 +0000
+Subject: WIN Add some prefs to secure preferences
+
+---
+ chrome/browser/prefs/chrome_pref_service_factory.cc | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/chrome/browser/prefs/chrome_pref_service_factory.cc b/chrome/browser/prefs/chrome_pref_service_factory.cc
+--- a/chrome/browser/prefs/chrome_pref_service_factory.cc
+++ b/chrome/browser/prefs/chrome_pref_service_factory.cc
+@@ -121,6 +121,14 @@ bool g_disable_domain_check_for_testing = false;
+ // See CleanupDeprecatedTrackedPreferences() in pref_hash_filter.cc to remove a
+ // deprecated tracked preference.
+ const prefs::TrackedPreferenceMetadata kTrackedPrefs[] = {
+#if BUILDFLAG(IS_WIN)
+    {200, prefs::kFileOrDirectoryPickerWithoutGestureAllowedForOrigins, EnforcementLevel::ENFORCE_ON_LOAD,
+     PrefTrackingStrategy::ATOMIC, ValueType::IMPERSONAL},
+    {201, prefs::kAutoplayAllowlist, EnforcementLevel::ENFORCE_ON_LOAD,
+     PrefTrackingStrategy::ATOMIC, ValueType::IMPERSONAL},
+    {202, prefs::kScreenCaptureWithoutGestureAllowedForOrigins, EnforcementLevel::ENFORCE_ON_LOAD,
+     PrefTrackingStrategy::ATOMIC, ValueType::IMPERSONAL},
+#endif
+     {0, prefs::kShowHomeButton, EnforcementLevel::ENFORCE_ON_LOAD,
+      PrefTrackingStrategy::ATOMIC, ValueType::IMPERSONAL},
+     {1, prefs::kHomePageIsNewTabPage, EnforcementLevel::ENFORCE_ON_LOAD,
+--
+2.25.1
@@ -0,0 +1,26 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Tue, 14 Mar 2023 15:58:00 +0000
+Subject: WIN Disable TabHoverCard images
+
+License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
+---
+ chrome/browser/ui/ui_features.cc | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/chrome/browser/ui/ui_features.cc b/chrome/browser/ui/ui_features.cc
+--- a/chrome/browser/ui/ui_features.cc
+++ b/chrome/browser/ui/ui_features.cc
+@@ -217,11 +217,7 @@ BASE_FEATURE(kTabHoverCardImageSettings,
+ // https://crbug.com/928954
+ BASE_FEATURE(kTabHoverCardImages,
+              "TabHoverCardImages",
+-#if BUILDFLAG(IS_MAC)
+              base::FEATURE_DISABLED_BY_DEFAULT
+-#else
+-             base::FEATURE_ENABLED_BY_DEFAULT
+-#endif
+ );
+ 
+ const char kTabHoverCardImagesNotReadyDelayParameterName[] =
+--
+2.25.1
@@ -0,0 +1,22 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Sun, 7 May 2023 14:18:46 +0000
+Subject: WIN Disable first run
+
+---
+ chrome/browser/ui/startup/first_run_service.cc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/chrome/browser/ui/startup/first_run_service.cc b/chrome/browser/ui/startup/first_run_service.cc
+--- a/chrome/browser/ui/startup/first_run_service.cc
+++ b/chrome/browser/ui/startup/first_run_service.cc
+@@ -174,7 +174,7 @@ bool IsFirstRunMarkedFinishedInPrefs() {
+ 
+ // static
+ void FirstRunService::RegisterLocalStatePrefs(PrefRegistrySimple* registry) {
+-  registry->RegisterBooleanPref(prefs::kFirstRunFinished, false);
+  registry->RegisterBooleanPref(prefs::kFirstRunFinished, true);
+   registry->RegisterStringPref(prefs::kFirstRunStudyGroup, "");
+ }
+ 
+--
+2.25.1
@@ -0,0 +1,22 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Sat, 3 Jun 2023 15:39:31 +0000
+Subject: WIN Disable search for image
+
+---
+ components/renderer_context_menu/context_menu_content_type.cc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/components/renderer_context_menu/context_menu_content_type.cc b/components/renderer_context_menu/context_menu_content_type.cc
+--- a/components/renderer_context_menu/context_menu_content_type.cc
+++ b/components/renderer_context_menu/context_menu_content_type.cc
+@@ -99,7 +99,7 @@ bool ContextMenuContentType::SupportsGroupInternal(int group) {
+ 
+     case ITEM_GROUP_SEARCHWEBFORIMAGE:
+       // Image menu items imply search web for image item.
+-      return SupportsGroupInternal(ITEM_GROUP_MEDIA_IMAGE);
+      return false;
+ 
+     case ITEM_GROUP_MEDIA_VIDEO:
+       return params_.media_type == ContextMenuDataMediaType::kVideo;
+--
+2.25.1
@@ -0,0 +1,69 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Fri, 17 Feb 2023 16:22:00 +0000
+Subject: WIN Disable sharing hub
+
+License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
+---
+ chrome/browser/sharing_hub/sharing_hub_features.cc          | 2 +-
+ chrome/browser/ui/browser_command_controller.cc             | 6 +++---
+ chrome/browser/ui/browser_commands.cc                       | 1 +
+ .../qrcode_generator/qrcode_generator_bubble_controller.cc  | 5 +----
+ 4 files changed, 6 insertions(+), 8 deletions(-)
+
+diff --git a/chrome/browser/sharing_hub/sharing_hub_features.cc b/chrome/browser/sharing_hub/sharing_hub_features.cc
+--- a/chrome/browser/sharing_hub/sharing_hub_features.cc
+++ b/chrome/browser/sharing_hub/sharing_hub_features.cc
+@@ -73,7 +73,7 @@ BASE_FEATURE(kDesktopScreenshots,
+ 
+ #if !BUILDFLAG(IS_ANDROID) && !BUILDFLAG(IS_CHROMEOS)
+ void RegisterProfilePrefs(PrefRegistrySimple* registry) {
+-  registry->RegisterBooleanPref(prefs::kDesktopSharingHubEnabled, true);
+  registry->RegisterBooleanPref(prefs::kDesktopSharingHubEnabled, false);
+ }
+ #endif
+ 
+diff --git a/chrome/browser/ui/browser_command_controller.cc b/chrome/browser/ui/browser_command_controller.cc
+--- a/chrome/browser/ui/browser_command_controller.cc
+++ b/chrome/browser/ui/browser_command_controller.cc
+@@ -1708,10 +1708,10 @@ void BrowserCommandController::UpdateCommandsForFullscreenMode() {
+   command_updater_.UpdateCommandEnabled(IDC_CHROME_WHATS_NEW, show_main_ui);
+ #endif
+   command_updater_.UpdateCommandEnabled(IDC_CONTENT_CONTEXT_SHARING_SUBMENU,
+-                                        show_main_ui);
+-  command_updater_.UpdateCommandEnabled(IDC_SHARING_HUB, show_main_ui);
+                                        false);
+  command_updater_.UpdateCommandEnabled(IDC_SHARING_HUB, false);
+   command_updater_.UpdateCommandEnabled(IDC_SHARING_HUB_SCREENSHOT,
+-                                        show_main_ui);
+                                        false);
+   command_updater_.UpdateCommandEnabled(IDC_SHOW_APP_MENU, show_main_ui);
+   command_updater_.UpdateCommandEnabled(IDC_SHOW_MANAGEMENT_PAGE, true);
+   command_updater_.UpdateCommandEnabled(IDC_FOLLOW, show_main_ui);
+diff --git a/chrome/browser/ui/browser_commands.cc b/chrome/browser/ui/browser_commands.cc
+--- a/chrome/browser/ui/browser_commands.cc
+++ b/chrome/browser/ui/browser_commands.cc
+@@ -1556,6 +1556,7 @@ void SendTabToSelfFromPageAction(Browser* browser) {
+ }
+ 
+ bool CanGenerateQrCode(const Browser* browser) {
+  if ((true)) return false;
+   return !sharing_hub::SharingIsDisabledByPolicy(browser->profile()) &&
+          qrcode_generator::QRCodeGeneratorBubbleController::
+              IsGeneratorAvailable(browser->tab_strip_model()
+diff --git a/chrome/browser/ui/qrcode_generator/qrcode_generator_bubble_controller.cc b/chrome/browser/ui/qrcode_generator/qrcode_generator_bubble_controller.cc
+--- a/chrome/browser/ui/qrcode_generator/qrcode_generator_bubble_controller.cc
+++ b/chrome/browser/ui/qrcode_generator/qrcode_generator_bubble_controller.cc
+@@ -23,10 +23,7 @@ QRCodeGeneratorBubbleController::~QRCodeGeneratorBubbleController() {
+ 
+ // static
+ bool QRCodeGeneratorBubbleController::IsGeneratorAvailable(const GURL& url) {
+-  if (!url.SchemeIsHTTPOrHTTPS())
+-    return false;
+-
+-  return true;
+  return false;
+ }
+ 
+ // static
+--
+2.25.1
@@ -0,0 +1,106 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Sun, 7 May 2023 14:03:55 +0000
+Subject: WIN Disable updater
+
+---
+ .../browser_process_platform_part_win.cc      |  3 ++
+ chrome/browser/updater/BUILD.gn               |  9 ------
+ .../browser/updater/browser_updater_client.cc | 32 +------------------
+ 3 files changed, 4 insertions(+), 40 deletions(-)
+
+diff --git a/chrome/browser/browser_process_platform_part_win.cc b/chrome/browser/browser_process_platform_part_win.cc
+--- a/chrome/browser/browser_process_platform_part_win.cc
+++ b/chrome/browser/browser_process_platform_part_win.cc
+@@ -5,12 +5,15 @@
+ #include "chrome/browser/browser_process_platform_part_win.h"
+ 
+ #include "chrome/browser/active_use_util.h"
+#include "chrome/install_static/buildflags.h"
+ 
+ BrowserProcessPlatformPart::BrowserProcessPlatformPart() = default;
+ BrowserProcessPlatformPart::~BrowserProcessPlatformPart() = default;
+ 
+ void BrowserProcessPlatformPart::PlatformSpecificCommandLineProcessing(
+     const base::CommandLine& command_line) {
+#if BUILDFLAG(USE_GOOGLE_UPDATE_INTEGRATION)
+   if (!did_run_updater_ && ShouldRecordActiveUse(command_line))
+     did_run_updater_.emplace();
+#endif
+ }
+diff --git a/chrome/browser/updater/BUILD.gn b/chrome/browser/updater/BUILD.gn
+--- a/chrome/browser/updater/BUILD.gn
+++ b/chrome/browser/updater/BUILD.gn
+@@ -22,15 +22,6 @@ source_set("browser_updater_client") {
+     "//components/version_info",
+   ]
+ 
+-  if (is_win) {
+-    sources += [ "browser_updater_client_win.cc" ]
+-
+-    deps += [
+-      "//chrome/browser/google",
+-      "//chrome/install_static:install_static_util",
+-    ]
+-  }
+-
+   if (is_mac) {
+     sources += [
+       "browser_updater_client_mac.mm",
+diff --git a/chrome/browser/updater/browser_updater_client.cc b/chrome/browser/updater/browser_updater_client.cc
+--- a/chrome/browser/updater/browser_updater_client.cc
+++ b/chrome/browser/updater/browser_updater_client.cc
+@@ -29,19 +29,6 @@ BrowserUpdaterClient::~BrowserUpdaterClient() = default;
+ 
+ void BrowserUpdaterClient::Register(base::OnceClosure complete) {
+   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+-  base::ThreadPool::PostTaskAndReplyWithResult(
+-      FROM_HERE, {base::MayBlock()},
+-      base::BindOnce(&BrowserUpdaterClient::GetRegistrationRequest, this),
+-      base::BindOnce(
+-          [](base::OnceCallback<void(int)> callback,
+-             scoped_refptr<updater::UpdateService> update_service,
+-             const updater::RegistrationRequest& request) {
+-            update_service->RegisterApp(request, std::move(callback));
+-          },
+-          base::BindPostTaskToCurrentDefault(
+-              base::BindOnce(&BrowserUpdaterClient::RegistrationCompleted, this,
+-                             std::move(complete))),
+-          update_service_));
+ }
+ 
+ void BrowserUpdaterClient::RegistrationCompleted(base::OnceClosure complete,
+@@ -72,18 +59,6 @@ void BrowserUpdaterClient::GetUpdaterVersionCompleted(
+ void BrowserUpdaterClient::CheckForUpdate(
+     updater::UpdateService::StateChangeCallback version_updater_callback) {
+   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+-
+-  updater::UpdateService::UpdateState update_state;
+-  update_state.state =
+-      updater::UpdateService::UpdateState::State::kCheckingForUpdates;
+-  version_updater_callback.Run(update_state);
+-  update_service_->Update(
+-      GetAppId(), {}, updater::UpdateService::Priority::kForeground,
+-      updater::UpdateService::PolicySameVersionUpdate::kNotAllowed,
+-      base::BindPostTaskToCurrentDefault(version_updater_callback),
+-      base::BindPostTaskToCurrentDefault(
+-          base::BindOnce(&BrowserUpdaterClient::UpdateCompleted, this,
+-                         version_updater_callback)));
+ }
+ 
+ void BrowserUpdaterClient::UpdateCompleted(
+@@ -129,12 +104,7 @@ void BrowserUpdaterClient::IsBrowserRegisteredCompleted(
+     base::OnceCallback<void(bool)> callback,
+     const std::vector<updater::UpdateService::AppState>& apps) {
+   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+-  const std::string app_id = GetAppId();
+-  std::move(callback).Run(
+-      std::find_if(apps.begin(), apps.end(),
+-                   [&](const updater::UpdateService::AppState& app) {
+-                     return app.app_id == app_id;
+-                   }) != apps.end());
+  std::move(callback).Run(true);
+ }
+ 
+ scoped_refptr<BrowserUpdaterClient> BrowserUpdaterClient::Create(
+--
+2.25.1
@@ -0,0 +1,41 @@
+From: uazo <uazo@users.noreply.github.com>
+Date: Fri, 17 Feb 2023 16:23:20 +0000
+Subject: WIN Enable Network Service Sandbox and CIG
+
+License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
+---
+ chrome/browser/chrome_content_browser_client.cc | 2 +-
+ sandbox/policy/features.cc                      | 6 +++++-
+ 2 files changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/chrome/browser/chrome_content_browser_client.cc b/chrome/browser/chrome_content_browser_client.cc
+--- a/chrome/browser/chrome_content_browser_client.cc
+++ b/chrome/browser/chrome_content_browser_client.cc
+@@ -774,7 +774,7 @@ const char kDEPRECATED_AllowlistedExtensionID[] = "whitelisted-extension-id";
+ // https://blogs.windows.com/blog/tag/code-integrity-guard/.
+ BASE_FEATURE(kNetworkServiceCodeIntegrity,
+              "NetworkServiceCodeIntegrity",
+-             base::FEATURE_DISABLED_BY_DEFAULT);
+             base::FEATURE_ENABLED_BY_DEFAULT);
+ 
+ #endif  // BUILDFLAG(IS_WIN) && !defined(COMPONENT_BUILD) &&
+         // !defined(ADDRESS_SANITIZER)
+diff --git a/sandbox/policy/features.cc b/sandbox/policy/features.cc
+--- a/sandbox/policy/features.cc
+++ b/sandbox/policy/features.cc
+@@ -18,8 +18,12 @@ namespace sandbox::policy::features {
+ // Enables network service sandbox.
+ // (Only causes an effect when feature kNetworkServiceInProcess is disabled.)
+ BASE_FEATURE(kNetworkServiceSandbox,
+-             "NetworkServiceSandbox",
+             "NetworkServiceSandbox", // enabled only in windows
+#if BUILDFLAG(IS_WIN)
+             base::FEATURE_ENABLED_BY_DEFAULT);
+#else
+              base::FEATURE_DISABLED_BY_DEFAULT);
+#endif
+ 
+ #if BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_CHROMEOS)
+ // Enables a fine-grained seccomp-BPF syscall filter for the network service.
+--
+2.25.1
--- a/Show More
+++ b/Show More