)]}' { "log": [ { "commit": "6254e4403e2057f6fca8eb18dc640f94a0704e22", "tree": "cebd3a02b6e518b6f0a909608921435f8d07ffac", "parents": [ "6834a1161113f547d28529be711db7bfae47ea2e" ], "author": { "name": "Stefan Smolen", "email": "ssmole@microsoft.com", "time": "Wed Sep 02 21:12:47 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Sep 02 21:32:57 2026" }, "message": "Make ssmole@microsoft.com a sandbox/win/owners\n\nChange-Id: I0107f28156717bee0297fb96c528ba6a7fe2513c\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8315851\nReviewed-by: Will Harris \u003cwfh@chromium.org\u003e\nCommit-Queue: Stefan Smolen \u003cssmole@microsoft.com\u003e\nReviewed-by: Alex Gough \u003cajgo@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1691089}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: a882ff0d733f0f4b5c8216915325561409c27bb7\n" }, { "commit": "6834a1161113f547d28529be711db7bfae47ea2e", "tree": "a44b9df142f9a5647dcb26911f232722b99df2ab", "parents": [ "38c61404e954946660c29c00ac7af6b4d1f92db5" ], "author": { "name": "Mahmoud Rashad", "email": "mmrashad@google.com", "time": "Mon Aug 31 22:04:03 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Mon Aug 31 22:14:36 2026" }, "message": "Fix unsafe buffer usage in sandbox/linux/services/proc_util.cc\n\nReplaced strcmp and strncmp with std::string_view to fix unsafe buffer\noperations.\n\nInitial patchet generated by headless gemini-cli using:\n//agents/prompts/projects/spanification/run.py\n\nFixed: 455561662\nChange-Id: I6b31b679097cebdacdf2bd3e014e63813f3522d8\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7082593\nReviewed-by: Ben Scarlato \u003cakhna@google.com\u003e\nCommit-Queue: Mahmoud Rashad \u003cmmrashad@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1689323}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 3135423df30f4f52d16e64d61a1be8a03e784ac3\n" }, { "commit": "38c61404e954946660c29c00ac7af6b4d1f92db5", "tree": "113a830f38d6957c2d97e8e9757936161d0f787d", "parents": [ "61ba54e9a2ac3c471318e48ba8f0bdaaf03eedd6" ], "author": { "name": "utzcoz", "email": "utzcoz@gmail.com", "time": "Fri Aug 28 18:01:50 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Fri Aug 28 18:06:35 2026" }, "message": "sandbox: skip uprobe/uretprobe in SandboxBPF.SyntheticPolicy\n\nSyntheticPolicy installs a filter that returns a synthetic errno for\nevery syscall number and asserts each one reports it. On recent\nkernels two x86-64 syscall numbers never reach the filter: the kernel\nexecutes uretprobe(2) (passthrough merged in 2025, ~6.15) and\nuprobe(2) (~6.18) without consulting seccomp, because they are kernel\nimplementation details of uprobes that default container policies -\nwhich return errno for unlisted syscalls - were breaking in every\nuprobed process. Invoked from outside a real probe trampoline,\nuretprobe(2) raises SIGILL and uprobe(2) fails with its own errno, so\non such kernels the test dies with signal 4 or asserts on the\nunexpected errno.\n\nSkip both numbers in the loop, and define them in the x86-64 syscall\nheader (the build sysroot\u0027s kernel headers predate them).\n\nBug: 553918183\nChange-Id: Ic7e641e5b7e453b09b9c70ee0ea84881dd33115b\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8304617\nCommit-Queue: Tom Sepez \u003ctsepez@chromium.org\u003e\nReviewed-by: Tom Sepez \u003ctsepez@chromium.org\u003e\nReviewed-by: Alex Gough \u003cajgo@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1688157}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 0f1b5f6879bc36319c1d518e9347f4620ae53bfd\n" }, { "commit": "61ba54e9a2ac3c471318e48ba8f0bdaaf03eedd6", "tree": "0480afdeb9b94d03af956f88a2a218e92fe83bd1", "parents": [ "e7468b2bf8343597ce6eb407f91a2cfe8fff0538" ], "author": { "name": "Joe Mason", "email": "joenotcharles@google.com", "time": "Thu Aug 27 03:50:43 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Thu Aug 27 03:55:02 2026" }, "message": "Replace KiBU/MiBU/etc with KiB/MiB/etc for sandbox/policy/win\n\nThe base::KiBU() family of functions have been deprecated and replaced\nwith base::KiB().\n\nMechanically converted with:\n\ngit grep -l base::[KMGTPE]iBU|xargs sed -i\n\"s/base::\\([KMGTPE]\\)iBU/base::\\1iB/g\"\n\nThis CL was uploaded by git cl split.\n\nBug: 448661443\nChange-Id: Icf19c0a7fea73fa61da60a508bc5d8697f928e98\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8257547\nCommit-Queue: Joe Mason \u003cjoenotcharles@google.com\u003e\nReviewed-by: Will Harris \u003cwfh@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1686935}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 2d2645167c2e90359eb5a3370ed62a7af1c30c5c\n" }, { "commit": "e7468b2bf8343597ce6eb407f91a2cfe8fff0538", "tree": "a1e24b59d2cbb50df5dbd44e4882958bcbe86d7f", "parents": [ "e3c5d845f77f9ffff3439eb47ae035c1cf32aa52" ], "author": { "name": "Jeffrey Yu", "email": "yuje@chromium.org", "time": "Tue Aug 25 07:10:39 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue Aug 25 07:14:22 2026" }, "message": "[net] Remove kAddressTrackerLinuxIsProxied flag\n\nThe net::features::kAddressTrackerLinuxIsProxied feature flag has been\nenabled by default. This CL removes the flag and cleans up the\nassociated code, always assuming the feature is enabled.\n\nConsequently, AddressTrackerLinux is always proxied/brokered on Linux,\nand the network service no longer needs to run it directly, which\nimproves the Linux network service sandbox.\n\nWe also remove the now-obsolete //net dependency in sandbox/policy since\nwe no longer need to check the feature flag there.\n\n NetworkServiceConnectionTypeSyncedBrowserTest.*\n\nBug: b:356624159\nTest: AddressMapLinuxBrowserTest.*,\nChange-Id: I754eb10b3d941f6e28c9f3d122334f0292dd1c17\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7887860\nReviewed-by: Adam Rice \u003cricea@chromium.org\u003e\nReviewed-by: Kenichi Ishibashi \u003cbashi@chromium.org\u003e\nAuto-Submit: Jeffrey Yu \u003cyuje@chromium.org\u003e\nCommit-Queue: Kenichi Ishibashi \u003cbashi@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1685277}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 88276310dd6288c08d65736d18f29662c063a6e9\n" }, { "commit": "e3c5d845f77f9ffff3439eb47ae035c1cf32aa52", "tree": "0fc7ffad2ae48b2ac2f28a81f8cde51d65fa94bc", "parents": [ "7cee0c2beca60606076616488fe7e361a88e9d66" ], "author": { "name": "Mahmoud Rashad", "email": "mmrashad@google.com", "time": "Mon Aug 24 18:02:41 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Mon Aug 24 18:07:03 2026" }, "message": "Fix unsafe buffer usage in setuid_sandbox_host.cc\n\nReplaced a raw pointer loop over kSUIDUnsafeEnvironmentVariables with a\nrange-based for loop over a base::span. This ensures safe access to the\narray and resolves the unsafe buffer usage warning.\n\nInitial patchset generated by headless gemini-cli using:\n//agents/prompts/projects/spanification/run.py\n\nFixed: 457304340\nChange-Id: I134fe17e569d31d96f67fea4b356a5cd9d035ea2\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7109399\nReviewed-by: Elly \u003cellyjones@chromium.org\u003e\nCommit-Queue: Mahmoud Rashad \u003cmmrashad@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1684852}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 633121b9cdd70ae5bfdf897a3ae85c0f569aaa55\n" }, { "commit": "7cee0c2beca60606076616488fe7e361a88e9d66", "tree": "c412f88419c2d72b06dc7a45f35cd6bc381ff457", "parents": [ "9fe45cb3abc8491cb0fdeb616c2e00d480686cb4" ], "author": { "name": "Avi Drissman", "email": "avi@chromium.org", "time": "Fri Aug 21 23:33:43 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Fri Aug 21 23:37:57 2026" }, "message": "Update sandbox .sb files for a macOS 13 minimum\n\nChromium requires macOS 13; update the .sb files accordingly.\n\nBug: none\nChange-Id: I66db3cd7ce89ad374e374954c778ae7a6a6a6964\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8272124\nCommit-Queue: Avi Drissman \u003cavi@chromium.org\u003e\nReviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1684302}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: e54bf6723b8f86bf6917ea2e904d52781245cb36\n" }, { "commit": "9fe45cb3abc8491cb0fdeb616c2e00d480686cb4", "tree": "66beceaf3a482bb81a96b920a08685f88eb4cfd0", "parents": [ "1f39137045960083d732b4f5c415a1de1383e738" ], "author": { "name": "Bryan Oltman", "email": "bryanoltman@google.com", "time": "Fri Aug 21 19:58:55 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Fri Aug 21 20:02:26 2026" }, "message": "[macoOS] Removes the kMacSandboxDistributedNotifications feature\n\nThis feature was released in 150 and no related issues have surfaced.\nRemove the feature and use the default behavior.\n\nBug: 513454805\nChange-Id: I76cea4d315c9ab33b5e143cc771792c54d937951\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8281185\nReviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\nCommit-Queue: Bryan Oltman \u003cbryanoltman@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1684147}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 698ef05b8d29a10ad0ed6640cf866cf293cc9b49\n" }, { "commit": "1f39137045960083d732b4f5c415a1de1383e738", "tree": "bb201a3b06bfe2034e5dd443fc067940422e0ab8", "parents": [ "125c2275f54d5b8c39efa3c365c8666e98f8d511" ], "author": { "name": "Lily Chen", "email": "chlily@chromium.org", "time": "Mon Aug 17 20:20:00 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Mon Aug 17 20:23:29 2026" }, "message": "Revert \"[macOS] Use process-isolated subdirectories for the GPU child process\"\n\nThis reverts commit 184ba1c1ecc60dc52f1b6480b14828b8311e67fb.\n\nReason for revert: speculative fix for many failing Mac browser tests\n\nFailure Link:\nhttps://ci.chromium.org/ui/p/chromium/builders/ci/mac15-x64-rel-tests/21010/overview\nhttps://ci.chromium.org/ui/p/chrome/builders/ci/mac64/303516/overview\n\nOriginal change\u0027s description:\n\u003e [macOS] Use process-isolated subdirectories for the GPU child process\n\u003e\n\u003e This CL restricts the GPU process\u0027s access to the shared Darwin per-user\n\u003e directories (`_CS_DARWIN_USER_DIR`, `_CS_DARWIN_USER_TEMP_DIR`, and\n\u003e `_CS_DARWIN_USER_CACHE_DIR`, which default to `/var/folders/.../0/`,\n\u003e `/var/folders/.../T/`, and `/var/folders/.../C/`) to isolated\n\u003e per-process subdirectories, created at process launch time.\n\u003e\n\u003e Key changes:\n\u003e\n\u003e 1. Update the GPU process\u0027s seatbelt profile to tighten the current\n\u003e broad access to the Darwin user directories to a process-isolated\n\u003e subdirectories. This is accomplished using the\n\u003e DIRHELPER_USER_DIR_SUFFIX\n\u003e environment variable, which the macOS dirhelper utility appends to\n\u003e the default `_CS_DARWIN` directory paths.\n\u003e 2. Allow different process types to specify whether whether they need\n\u003e the isolated directories mentioned above. This will allow child\n\u003e processes other than the GPU to take advantage of this functionality\n\u003e should they need it in the future.\n\u003e 3. Disables the flaky\n\u003e conformance/extensions/khr-parallel-shader-compile.html test on Intel\n\u003e Macs.\n\u003e\n\u003e This change is gated by the `kMacGpuSandboxDarwinUserDirs` feature flag.\n\u003e\n\u003e This is a roll-forward of https://crrev.com/c/7965675 with fixes:\n\u003e\n\u003e 1. common.sb has been updated to allow issuance of sandbox extensions\n\u003e for the new Metal shader cache location, fixing some of the CI\n\u003e failures caused by the original CL.\n\u003e 2. `ChildProcessLauncherHelper::CreateProcessIsolatedDarwinUserDirs`\n\u003e uses `CreateUniqueTempDirUnderPath` (with the Darwin user temp dir\n\u003e as the path) instead of `CreateUniqueTempDir` to avoid providing a\n\u003e subdir of MAC_CHROMIUM_TMPDIR as the sandboxed Darwin user temp dir.\n\u003e 3. More WPT test expectation updates.\n\u003e\n\u003e Fixed: 528379972,520019273,516947138,521559611,521486621,516893912\n\u003e Cq-Include-Trybots: luci.chromium.try:mac15-x64-rel-tests\n\u003e Change-Id: I0572c413180723aed8369b959335aef099b4ab6a\n\u003e Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8209919\n\u003e Reviewed-by: Avi Drissman \u003cavi@chromium.org\u003e\n\u003e Commit-Queue: Bryan Oltman \u003cbryanoltman@google.com\u003e\n\u003e Reviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\n\u003e Cr-Commit-Position: refs/heads/main@{#1679814}\n\nBug: 547819999,528379972,520019273,516947138,521559611,521486621,516893912\nCq-Include-Trybots: luci.chromium.try:mac15-x64-rel-tests\nChange-Id: I3ee17dedbeb18ff3bc142d8a877065c5bda39fae\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8263476\nBot-Commit: rubber-stamper@appspot.gserviceaccount.com \u003crubber-stamper@appspot.gserviceaccount.com\u003e\nCommit-Queue: Lily Chen \u003cchlily@chromium.org\u003e\nOwners-Override: Lily Chen \u003cchlily@chromium.org\u003e\nReviewed-by: Bryan Oltman \u003cbryanoltman@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1680732}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 9e99f5a70fe686c819d0c354ac580c3aaf5efd9e\n" }, { "commit": "125c2275f54d5b8c39efa3c365c8666e98f8d511", "tree": "e92013128859a304a4b16a94118b20251bc93f6b", "parents": [ "f1b146552f84bdda07c3ba5a56af3c0116e3b393" ], "author": { "name": "Bryan Oltman", "email": "bryanoltman@google.com", "time": "Fri Aug 14 19:34:10 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Fri Aug 14 19:37:05 2026" }, "message": "[macOS] Use process-isolated subdirectories for the GPU child process\n\nThis CL restricts the GPU process\u0027s access to the shared Darwin per-user\ndirectories (`_CS_DARWIN_USER_DIR`, `_CS_DARWIN_USER_TEMP_DIR`, and\n`_CS_DARWIN_USER_CACHE_DIR`, which default to `/var/folders/.../0/`,\n`/var/folders/.../T/`, and `/var/folders/.../C/`) to isolated\nper-process subdirectories, created at process launch time.\n\nKey changes:\n\n1. Update the GPU process\u0027s seatbelt profile to tighten the current\n broad access to the Darwin user directories to a process-isolated\n subdirectories. This is accomplished using the\n DIRHELPER_USER_DIR_SUFFIX\n environment variable, which the macOS dirhelper utility appends to\n the default `_CS_DARWIN` directory paths.\n2. Allow different process types to specify whether whether they need\n the isolated directories mentioned above. This will allow child\n processes other than the GPU to take advantage of this functionality\n should they need it in the future.\n3. Disables the flaky\n conformance/extensions/khr-parallel-shader-compile.html test on Intel\n Macs.\n\nThis change is gated by the `kMacGpuSandboxDarwinUserDirs` feature flag.\n\nThis is a roll-forward of https://crrev.com/c/7965675 with fixes:\n\n1. common.sb has been updated to allow issuance of sandbox extensions\n for the new Metal shader cache location, fixing some of the CI\n failures caused by the original CL.\n2. `ChildProcessLauncherHelper::CreateProcessIsolatedDarwinUserDirs`\n uses `CreateUniqueTempDirUnderPath` (with the Darwin user temp dir\n as the path) instead of `CreateUniqueTempDir` to avoid providing a\n subdir of MAC_CHROMIUM_TMPDIR as the sandboxed Darwin user temp dir.\n3. More WPT test expectation updates.\n\nFixed: 528379972,520019273,516947138,521559611,521486621,516893912\nCq-Include-Trybots: luci.chromium.try:mac15-x64-rel-tests\nChange-Id: I0572c413180723aed8369b959335aef099b4ab6a\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8209919\nReviewed-by: Avi Drissman \u003cavi@chromium.org\u003e\nCommit-Queue: Bryan Oltman \u003cbryanoltman@google.com\u003e\nReviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1679814}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 184ba1c1ecc60dc52f1b6480b14828b8311e67fb\n" }, { "commit": "f1b146552f84bdda07c3ba5a56af3c0116e3b393", "tree": "bb201a3b06bfe2034e5dd443fc067940422e0ab8", "parents": [ "9e38a92ed052f20b0959c8e7de808539d95865ca" ], "author": { "name": "Yue She", "email": "yueshe@google.com", "time": "Fri Aug 14 18:40:28 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Fri Aug 14 18:44:38 2026" }, "message": "Reland \"Reland \"[mac] Enable aperitif on helper executables.\"\"\n\nThis is a reland of commit 62716c1f59e0b0f5375abb2ee955e26e470af79f\n\nReason for reland: adding libaperitif.dylib to signing list\n\nOriginal change\u0027s description:\n\u003e Reland \"[mac] Enable aperitif on helper executables.\"\n\u003e\n\u003e This is a reland of commit dfa0e77c016df17590e562dc975ac0ca0f64ff39\n\u003e\n\u003e Original change\u0027s description:\n\u003e \u003e [mac] Enable aperitif on helper executables.\n\u003e \u003e\n\u003e \u003e This CL sets up \"Aperitified\" helper executables, as well as putting\n\u003e \u003e these behind a feature flag. This does mean that we will be shipping\n\u003e \u003e two versions of each helper, one that is linked w/ dlopen() and one\n\u003e \u003e linked w/ libaperitif. This will allow us to do A/B testing on the\n\u003e \u003e performance improvements of libaperitif.\n\u003e \u003e\n\u003e \u003e This CL also modifies the aperitif_unittest. Previously it looped\n\u003e \u003e through every initializer printed with DYLD_PRINT_INITIALIZERS, but\n\u003e \u003e now it stops the loop once it sees libaperitif is initialized.\n\u003e \u003e\n\u003e \u003e Bug: 40794783\n\u003e \u003e Change-Id: I1eee5a7fa4b5aa50e64adb8cf00e89f2ade4b701\n\u003e \u003e Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7970768\n\u003e \u003e Reviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\n\u003e \u003e Reviewed-by: Avi Drissman \u003cavi@chromium.org\u003e\n\u003e \u003e Reviewed-by: Tom Sepez \u003ctsepez@chromium.org\u003e\n\u003e \u003e Commit-Queue: Liza Burakova \u003cliza@chromium.org\u003e\n\u003e \u003e Cr-Commit-Position: refs/heads/main@{#1676768}\n\u003e\n\u003e Bug: 40794783\n\u003e Change-Id: Ice4ab35a832aeaabe6d555dc424959f854b9ac6b\n\u003e Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8242707\n\u003e Reviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\n\u003e Reviewed-by: Yue She \u003cyueshe@google.com\u003e\n\u003e Reviewed-by: Avi Drissman \u003cavi@chromium.org\u003e\n\u003e Reviewed-by: Tom Sepez \u003ctsepez@chromium.org\u003e\n\u003e Commit-Queue: Liza Burakova \u003cliza@chromium.org\u003e\n\u003e Cr-Commit-Position: refs/heads/main@{#1679014}\n\nBug: 40794783\nChange-Id: Ia52ceea3207eb38d5a9657b964cb01856a3b08c2\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8257183\nReviewed-by: Tom Sepez \u003ctsepez@chromium.org\u003e\nReviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\nReviewed-by: Avi Drissman \u003cavi@chromium.org\u003e\nCommit-Queue: Yue She \u003cyueshe@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1679745}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 95c20af3e1d6cecc4793af5afd949eafe00a1622\n" }, { "commit": "9e38a92ed052f20b0959c8e7de808539d95865ca", "tree": "1621212ae7276dc21c1c585a53e9e2a5df076968", "parents": [ "618789ce127df546601ef461141f51ae5f9ce07a" ], "author": { "name": "Volodymyr Plotkin", "email": "vplotkin@google.com", "time": "Fri Aug 14 13:30:21 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Fri Aug 14 13:33:27 2026" }, "message": "Revert \"Reland \"[mac] Enable aperitif on helper executables.\"\"\n\nThis reverts commit 62716c1f59e0b0f5375abb2ee955e26e470af79f.\n\nReason for revert: Breaks official mac-universalizer signing b/546422406\n\nFailure Link: http://sponge2/b2761f1e-bfec-40ba-81aa-ca6fbc072fd2\n\nOriginal change\u0027s description:\n\u003e Reland \"[mac] Enable aperitif on helper executables.\"\n\u003e\n\u003e This is a reland of commit dfa0e77c016df17590e562dc975ac0ca0f64ff39\n\u003e\n\u003e Original change\u0027s description:\n\u003e \u003e [mac] Enable aperitif on helper executables.\n\u003e \u003e\n\u003e \u003e This CL sets up \"Aperitified\" helper executables, as well as putting\n\u003e \u003e these behind a feature flag. This does mean that we will be shipping\n\u003e \u003e two versions of each helper, one that is linked w/ dlopen() and one\n\u003e \u003e linked w/ libaperitif. This will allow us to do A/B testing on the\n\u003e \u003e performance improvements of libaperitif.\n\u003e \u003e\n\u003e \u003e This CL also modifies the aperitif_unittest. Previously it looped\n\u003e \u003e through every initializer printed with DYLD_PRINT_INITIALIZERS, but\n\u003e \u003e now it stops the loop once it sees libaperitif is initialized.\n\u003e \u003e\n\u003e \u003e Bug: 40794783\n\u003e \u003e Change-Id: I1eee5a7fa4b5aa50e64adb8cf00e89f2ade4b701\n\u003e \u003e Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7970768\n\u003e \u003e Reviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\n\u003e \u003e Reviewed-by: Avi Drissman \u003cavi@chromium.org\u003e\n\u003e \u003e Reviewed-by: Tom Sepez \u003ctsepez@chromium.org\u003e\n\u003e \u003e Commit-Queue: Liza Burakova \u003cliza@chromium.org\u003e\n\u003e \u003e Cr-Commit-Position: refs/heads/main@{#1676768}\n\u003e\n\u003e Bug: 40794783\n\u003e Change-Id: Ice4ab35a832aeaabe6d555dc424959f854b9ac6b\n\u003e Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8242707\n\u003e Reviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\n\u003e Reviewed-by: Yue She \u003cyueshe@google.com\u003e\n\u003e Reviewed-by: Avi Drissman \u003cavi@chromium.org\u003e\n\u003e Reviewed-by: Tom Sepez \u003ctsepez@chromium.org\u003e\n\u003e Commit-Queue: Liza Burakova \u003cliza@chromium.org\u003e\n\u003e Cr-Commit-Position: refs/heads/main@{#1679014}\n\nBug: 40794783\nNo-Presubmit: true\nNo-Tree-Checks: true\nNo-Try: true\nChange-Id: I50895e4319c6fa13338be49743d9c3507206f529\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8255311\nBot-Commit: rubber-stamper@appspot.gserviceaccount.com \u003crubber-stamper@appspot.gserviceaccount.com\u003e\nReviewed-by: Yue She \u003cyueshe@google.com\u003e\nOwners-Override: Mark Mentovai \u003cmark@chromium.org\u003e\nReviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\nAuto-Submit: Volodymyr Plotkin \u003cvplotkin@google.com\u003e\nCommit-Queue: Mark Mentovai \u003cmark@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1679492}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 3809a089e372acecd0efa646cea36c555e98d830\n" }, { "commit": "618789ce127df546601ef461141f51ae5f9ce07a", "tree": "bb201a3b06bfe2034e5dd443fc067940422e0ab8", "parents": [ "c45c430e09c4841fa0894a89e7f3c0b9bdf9a128" ], "author": { "name": "Phillis Tang", "email": "phillis@chromium.org", "time": "Fri Aug 14 00:21:52 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Fri Aug 14 00:25:44 2026" }, "message": "webnn: setup coreml compiler sandbox rules\n\nSetup sandboxing rules for the WebNN CoreML backend compiler service.\nThe current rules allow the compiler service to run CoreML model compile\nAPI to compile model to darwin-user-temp-dir.\n\nBug: 524263705\nChange-Id: I297bdd1ca48450e90d252d3bb3e9725ec352790b\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8163822\nReviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\nReviewed-by: Bryan Oltman \u003cbryanoltman@google.com\u003e\nCommit-Queue: Phillis Tang \u003cphillis@chromium.org\u003e\nReviewed-by: Alex Gough \u003cajgo@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1679213}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 5e04fe944317ce9f6de7d7d83ea4c61018d8e83e\n" }, { "commit": "c45c430e09c4841fa0894a89e7f3c0b9bdf9a128", "tree": "8e759c79a106d28b664bed35494ed6a923be5065", "parents": [ "297ca3f3ab8fedd7fce1e24716e4bac6b662ec81" ], "author": { "name": "Liza Burakova", "email": "liza@chromium.org", "time": "Thu Aug 13 18:57:51 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Thu Aug 13 19:02:18 2026" }, "message": "Reland \"[mac] Enable aperitif on helper executables.\"\n\nThis is a reland of commit dfa0e77c016df17590e562dc975ac0ca0f64ff39\n\nOriginal change\u0027s description:\n\u003e [mac] Enable aperitif on helper executables.\n\u003e\n\u003e This CL sets up \"Aperitified\" helper executables, as well as putting\n\u003e these behind a feature flag. This does mean that we will be shipping\n\u003e two versions of each helper, one that is linked w/ dlopen() and one\n\u003e linked w/ libaperitif. This will allow us to do A/B testing on the\n\u003e performance improvements of libaperitif.\n\u003e\n\u003e This CL also modifies the aperitif_unittest. Previously it looped\n\u003e through every initializer printed with DYLD_PRINT_INITIALIZERS, but\n\u003e now it stops the loop once it sees libaperitif is initialized.\n\u003e\n\u003e Bug: 40794783\n\u003e Change-Id: I1eee5a7fa4b5aa50e64adb8cf00e89f2ade4b701\n\u003e Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7970768\n\u003e Reviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\n\u003e Reviewed-by: Avi Drissman \u003cavi@chromium.org\u003e\n\u003e Reviewed-by: Tom Sepez \u003ctsepez@chromium.org\u003e\n\u003e Commit-Queue: Liza Burakova \u003cliza@chromium.org\u003e\n\u003e Cr-Commit-Position: refs/heads/main@{#1676768}\n\nBug: 40794783\nChange-Id: Ice4ab35a832aeaabe6d555dc424959f854b9ac6b\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8242707\nReviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\nReviewed-by: Yue She \u003cyueshe@google.com\u003e\nReviewed-by: Avi Drissman \u003cavi@chromium.org\u003e\nReviewed-by: Tom Sepez \u003ctsepez@chromium.org\u003e\nCommit-Queue: Liza Burakova \u003cliza@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1679014}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 62716c1f59e0b0f5375abb2ee955e26e470af79f\n" }, { "commit": "297ca3f3ab8fedd7fce1e24716e4bac6b662ec81", "tree": "74faf50749af5f597e3b8cbc2a986c00cc17f8f6", "parents": [ "22990fe3bbeb58945111bc6166d336a9c575b561" ], "author": { "name": "Adem Derinel", "email": "derinel@google.com", "time": "Tue Aug 11 07:25:18 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue Aug 11 07:28:42 2026" }, "message": "Revert \"[mac] Enable aperitif on helper executables.\"\n\nThis reverts commit dfa0e77c016df17590e562dc975ac0ca0f64ff39.\n\nReason for revert: b/544963541\n\nFailure Link: https://ci.chromium.org/ui/test/chromium/%3A%2F%2Fchrome%2Ftest%5C%3Aunit_tests!gtest%3A%3AAperitifTest%23InitializerOrder?q\u003dV%3Abucket%3Dci+V%3Abuilder%3DMac%2520ASan%252064%2520Tests%2520%281%29+V%3Aos%3DMac-15+V%3Atest_suite%3Dunit_tests\n\nOriginal change\u0027s description:\n\u003e [mac] Enable aperitif on helper executables.\n\u003e\n\u003e This CL sets up \"Aperitified\" helper executables, as well as putting\n\u003e these behind a feature flag. This does mean that we will be shipping\n\u003e two versions of each helper, one that is linked w/ dlopen() and one\n\u003e linked w/ libaperitif. This will allow us to do A/B testing on the\n\u003e performance improvements of libaperitif.\n\u003e\n\u003e This CL also modifies the aperitif_unittest. Previously it looped\n\u003e through every initializer printed with DYLD_PRINT_INITIALIZERS, but\n\u003e now it stops the loop once it sees libaperitif is initialized.\n\u003e\n\u003e Bug: 40794783\n\u003e Change-Id: I1eee5a7fa4b5aa50e64adb8cf00e89f2ade4b701\n\u003e Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7970768\n\u003e Reviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\n\u003e Reviewed-by: Avi Drissman \u003cavi@chromium.org\u003e\n\u003e Reviewed-by: Tom Sepez \u003ctsepez@chromium.org\u003e\n\u003e Commit-Queue: Liza Burakova \u003cliza@chromium.org\u003e\n\u003e Cr-Commit-Position: refs/heads/main@{#1676768}\n\nBug: 40794783, 544963541\nNo-Presubmit: true\nNo-Tree-Checks: true\nNo-Try: true\nBug: 40794783\nChange-Id: Ibdc1d6abd3029bd1959eed5ce0b049428a281009\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8233260\nBot-Commit: rubber-stamper@appspot.gserviceaccount.com \u003crubber-stamper@appspot.gserviceaccount.com\u003e\nAuto-Submit: Adem Derinel \u003cderinel@google.com\u003e\nCommit-Queue: rubber-stamper@appspot.gserviceaccount.com \u003crubber-stamper@appspot.gserviceaccount.com\u003e\nOwners-Override: Adem Derinel \u003cderinel@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1677012}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 9c6fc942af8949f57a05e43946c873b21a5c8d7f\n" }, { "commit": "22990fe3bbeb58945111bc6166d336a9c575b561", "tree": "8e759c79a106d28b664bed35494ed6a923be5065", "parents": [ "9c8b3249ed811fe344dda7cb20e7223f1ce4367f" ], "author": { "name": "Liza Burakova", "email": "liza@chromium.org", "time": "Mon Aug 10 22:46:48 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Mon Aug 10 22:52:24 2026" }, "message": "[mac] Enable aperitif on helper executables.\n\nThis CL sets up \"Aperitified\" helper executables, as well as putting\nthese behind a feature flag. This does mean that we will be shipping\ntwo versions of each helper, one that is linked w/ dlopen() and one\nlinked w/ libaperitif. This will allow us to do A/B testing on the\nperformance improvements of libaperitif.\n\nThis CL also modifies the aperitif_unittest. Previously it looped\nthrough every initializer printed with DYLD_PRINT_INITIALIZERS, but\nnow it stops the loop once it sees libaperitif is initialized.\n\nBug: 40794783\nChange-Id: I1eee5a7fa4b5aa50e64adb8cf00e89f2ade4b701\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7970768\nReviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\nReviewed-by: Avi Drissman \u003cavi@chromium.org\u003e\nReviewed-by: Tom Sepez \u003ctsepez@chromium.org\u003e\nCommit-Queue: Liza Burakova \u003cliza@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1676768}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: dfa0e77c016df17590e562dc975ac0ca0f64ff39\n" }, { "commit": "9c8b3249ed811fe344dda7cb20e7223f1ce4367f", "tree": "74faf50749af5f597e3b8cbc2a986c00cc17f8f6", "parents": [ "25aab982238e590092c929262dba9140f7e0460a" ], "author": { "name": "Victor Hugo Vianna Silva", "email": "victorvianna@google.com", "time": "Wed Aug 05 21:26:40 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Aug 05 21:29:54 2026" }, "message": "Fix include guard presubmit warnings\n\n`git cl presubmit --all` reported 185 CheckForIncludeGuards warnings on\nheaders that predate the check or drifted from it.\n\nBug: 542921651\nChange-Id: I765467f184ee89b8ba9bf9889756e175512f6b73\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8203984\nOwners-Override: Avi Drissman \u003cavi@chromium.org\u003e\nCommit-Queue: Victor Vianna \u003cvictorvianna@google.com\u003e\nSLSA-Policy-Verified: SLSA Policy Verification Service \u003cdevtools-gerritcodereview-exitgate@google.com\u003e\nReviewed-by: Avi Drissman \u003cavi@chromium.org\u003e\nAuto-Submit: Victor Vianna \u003cvictorvianna@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1674510}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: f9c7fc25182a632b7bdc6d1941781cad49c86440\n" }, { "commit": "25aab982238e590092c929262dba9140f7e0460a", "tree": "c73a93834d5145b6aea2cec1ce42d91d67b70a6b", "parents": [ "fcac155e61971a22cd157804aaccd8972635a421" ], "author": { "name": "Aliaksei Bahdzevich", "email": "thelex@google.com", "time": "Wed Aug 05 13:32:54 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Aug 05 13:36:43 2026" }, "message": "Revert \"[macOS] Use process-isolated subdirectories for the GPU child process\"\n\nThis reverts commit c2706c3317723e987f85322a25ed475bdfe3a719.\n\nReason for revert: Causing mac64 builder to fail\n\nFailure Link: https://ci.chromium.org/ui/p/chrome/builders/ci/mac64/301795/overview\n\nOriginal change\u0027s description:\n\u003e [macOS] Use process-isolated subdirectories for the GPU child process\n\u003e\n\u003e This CL restricts the GPU process\u0027s access to the shared Darwin per-user\n\u003e directories (`_CS_DARWIN_USER_DIR`, `_CS_DARWIN_USER_TEMP_DIR`, and\n\u003e `_CS_DARWIN_USER_CACHE_DIR`, which default to `/var/folders/.../0/`,\n\u003e `/var/folders/.../T/`, and `/var/folders/.../C/`) to isolated\n\u003e per-process subdirectories, created at process launch time.\n\u003e\n\u003e Key changes:\n\u003e\n\u003e 1. Update the GPU process\u0027s seatbelt profile to tighten the current\n\u003e broad access to the Darwin user directories to a process-isolated\n\u003e subdirectories. This is accomplished using the\n\u003e DIRHELPER_USER_DIR_SUFFIX\n\u003e environment variable, which the macOS dirhelper utility appends to\n\u003e the default `_CS_DARWIN` directory paths.\n\u003e 2. Allow different process types to specify whether whether they need\n\u003e the isolated directories mentioned above. This will allow child\n\u003e processes other than the GPU to take advantage of this functionality\n\u003e should they need it in the future.\n\u003e 3. Disables the flaky\n\u003e conformance/extensions/khr-parallel-shader-compile.html test on Intel\n\u003e Macs.\n\u003e\n\u003e This change is gated by the `kMacGpuSandboxDarwinUserDirs` feature flag.\n\u003e\n\u003e Include-Ci-Only-Tests: true\n\u003e Fixed: 528379972\n\u003e Change-Id: Icbcdb93889b46dc8645b1f9bed68649174d19134\n\u003e Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7965675\n\u003e Reviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\n\u003e Reviewed-by: Camille Lamy \u003cclamy@chromium.org\u003e\n\u003e Cr-Commit-Position: refs/heads/main@{#1673842}\n\nBug: 528379972\nNo-Presubmit: true\nNo-Tree-Checks: true\nNo-Try: true\nChange-Id: I245c9b82d0d6613f56d1e2416c98adc6f5cc6ba1\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8202167\nBot-Commit: rubber-stamper@appspot.gserviceaccount.com \u003crubber-stamper@appspot.gserviceaccount.com\u003e\nCommit-Queue: Keren Zhu \u003ckerenzhu@chromium.org\u003e\nOwners-Override: Keren Zhu \u003ckerenzhu@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1674094}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 08120a049a0c0dab3246bcf947f379fee33037b9\n" }, { "commit": "fcac155e61971a22cd157804aaccd8972635a421", "tree": "fc4fe5ce2a54d8901752ca6632878f96562236f6", "parents": [ "2ac1ce33d6a51dc3e2ddbbf2d71a062c9bc598bd" ], "author": { "name": "Bryan Oltman", "email": "bryanoltman@google.com", "time": "Wed Aug 05 01:48:25 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Aug 05 01:52:55 2026" }, "message": "[macOS] Use process-isolated subdirectories for the GPU child process\n\nThis CL restricts the GPU process\u0027s access to the shared Darwin per-user\ndirectories (`_CS_DARWIN_USER_DIR`, `_CS_DARWIN_USER_TEMP_DIR`, and\n`_CS_DARWIN_USER_CACHE_DIR`, which default to `/var/folders/.../0/`,\n`/var/folders/.../T/`, and `/var/folders/.../C/`) to isolated\nper-process subdirectories, created at process launch time.\n\nKey changes:\n\n1. Update the GPU process\u0027s seatbelt profile to tighten the current\n broad access to the Darwin user directories to a process-isolated\n subdirectories. This is accomplished using the\n DIRHELPER_USER_DIR_SUFFIX\n environment variable, which the macOS dirhelper utility appends to\n the default `_CS_DARWIN` directory paths.\n2. Allow different process types to specify whether whether they need\n the isolated directories mentioned above. This will allow child\n processes other than the GPU to take advantage of this functionality\n should they need it in the future.\n3. Disables the flaky\n conformance/extensions/khr-parallel-shader-compile.html test on Intel\n Macs.\n\nThis change is gated by the `kMacGpuSandboxDarwinUserDirs` feature flag.\n\nInclude-Ci-Only-Tests: true\nFixed: 528379972\nChange-Id: Icbcdb93889b46dc8645b1f9bed68649174d19134\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7965675\nReviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\nReviewed-by: Camille Lamy \u003cclamy@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1673842}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: c2706c3317723e987f85322a25ed475bdfe3a719\n" }, { "commit": "2ac1ce33d6a51dc3e2ddbbf2d71a062c9bc598bd", "tree": "c73a93834d5145b6aea2cec1ce42d91d67b70a6b", "parents": [ "727326f0ea00b17d35a199380dc311b4ee607ad1" ], "author": { "name": "Bryan Oltman", "email": "bryanoltman@google.com", "time": "Tue Aug 04 20:07:40 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue Aug 04 20:12:21 2026" }, "message": "Revert \"Remove file-issue-extension permission from gpu seatbelt profile\"\n\nThis reverts commit 2701413522262a4b49624ecbc95226435c80b61e.\n\nReason for revert: dawn tests failing on macOS 14.4.1 (`vpython3 tools/utr -p chromium -B try -b dawn-mac-x64-deps-rel -t \"webgpu_swiftshader_blink_web_tests_with_backend_validation on AMD 0x7340 GPU on Mac Retina\" compile-and-test -- --gtest_filter\u003dwpt_internal/webgpu/web_platform/canvas/copy_element_image_to_texture-clipped.https.html`)\n\nFailure Link: https://chromium-swarm.appspot.com/task?id\u003d79e6b96ad6f6d710\n\nOriginal change\u0027s description:\n\u003e Remove file-issue-extension permission from gpu seatbelt profile\n\u003e\n\u003e As per the discussion in the linked bug, this permissions was originally\n\u003e granted to fix an issue affecting macOS version between 14.2.1 and\n\u003e 14.3.1 (https://g-issues.chromium.org/issues/41485470#comment8). The\n\u003e issue may have affected earlier versions of macOS 14, but specifically\n\u003e did not affect 13.6.4\n\u003e (https://g-issues.chromium.org/issues/41485470#comment10).\n\u003e\n\u003e Furthermore, the issue seems to have only manifested on bots\n\u003e (https://g-issues.chromium.org/issues/41485470#comment32), which\n\u003e execute tests in a directory that does not have `/Users` as an\n\u003e ancestor.\n\u003e\n\u003e This CL simply removes the permission, as it\u0027s not clear there was\n\u003e ever a user-facing impact and we do not have any bots running affected\n\u003e versions of macOS.\n\u003e\n\u003e Fixed: 517249110\n\u003e Change-Id: I5aefbbc6bb1381232a5fa26386cd733790884913\n\u003e Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8131180\n\u003e Reviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\n\u003e Commit-Queue: Bryan Oltman \u003cbryanoltman@google.com\u003e\n\u003e Cr-Commit-Position: refs/heads/main@{#1665672}\n\nBug: 517249110\nChange-Id: I7fc05cc4b94fa1067c21f1d8bdfa29b1283764b8\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8192637\nReviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\nCommit-Queue: Bryan Oltman \u003cbryanoltman@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1673618}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 006487cd473e8d75743ab5e6e5f7705ec8606a11\n" }, { "commit": "727326f0ea00b17d35a199380dc311b4ee607ad1", "tree": "6579b807a8f0b6778a7059bce7680ddd86fadb89", "parents": [ "a9e64af164a0bad2d71a1336c83b2e374e35fdc7" ], "author": { "name": "Devon Loehr", "email": "dloehr@google.com", "time": "Wed Jul 29 18:05:16 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Jul 29 18:10:31 2026" }, "message": "Start loading msdia140.dll when loading dbghelp.dll\n\nIn the newest windows SDK versions, dbghelp.dll now depends on\nmsdia140.dll, which is also present in more locations in the toolchain\npackage. However, dbghelp loads msdia dynamically at runtime, so we\nneed to ensure it\u0027s prewarmed before entering the sandbox.\n\nWe also need to make sure that we copy the dll to the out directory.\nSince GN expects steps to always have the same output, we copy some\nversion of the dll even for older SDK versions, where it will usually\nbe ignored.\n\nBug: 534305839\nChange-Id: Ic7d76e728a2942bdd28f0a3fbda88c5167e06214\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8125374\nReviewed-by: Avi Drissman \u003cavi@chromium.org\u003e\nReviewed-by: Alex Gough \u003cajgo@chromium.org\u003e\nCommit-Queue: Devon Loehr \u003cdloehr@google.com\u003e\nReviewed-by: Nico Weber \u003cthakis@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1670418}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 5b107640bfc27738593a545105bb887844cce688\n" }, { "commit": "a9e64af164a0bad2d71a1336c83b2e374e35fdc7", "tree": "21629019f031843a19553be993fe58a65e15c5f0", "parents": [ "8f54579476219ba0ff155c55520fa226941acce1" ], "author": { "name": "Mohannad Farrag", "email": "aymanm@google.com", "time": "Wed Jul 29 15:17:52 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Jul 29 15:20:52 2026" }, "message": "Add GRO to fieldtrial_testing_config\n\nGRO is only supported on Linux and its derivatives (e.g. Android and\nChromeOS). So enable it in the fieldtrial so I can go ahead with the\nexperimentation. In order for this to pass, GRO socketopt must be\nallowed in the sandbox so I\u0027m doing both in the same CL.\n\nBug: 515333601\nChange-Id: Ib2e2e7857ea423ff917af06b944dd50005a0dd21\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8158642\nReviewed-by: Ben Scarlato \u003cakhna@google.com\u003e\nReviewed-by: Etienne Dechamps \u003cedechamps@google.com\u003e\nCommit-Queue: Mohannad Farrag \u003caymanm@google.com\u003e\nAuto-Submit: Mohannad Farrag \u003caymanm@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1670267}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 7daf5842f98dc7584545c3c22fc074d1e031cc4d\n" }, { "commit": "8f54579476219ba0ff155c55520fa226941acce1", "tree": "df7b23f6ed9bb19c6d0ead201c56a1451b4da121", "parents": [ "af0b56ae50156f5d0b802ce98a6eb82b0683f2a1" ], "author": { "name": "Will Harris", "email": "wfh@chromium.org", "time": "Wed Jul 29 03:43:32 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Jul 29 03:47:01 2026" }, "message": "Enable WinSboxModuleTamperingProtection by default\n\nThis feature is shipping shortly, so enable the feature in the code.\n\nBug: 499921564\nChange-Id: I9818a6737f4b94961d19bb92ad665956858959f4\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8154781\nCommit-Queue: Will Harris \u003cwfh@chromium.org\u003e\nReviewed-by: Alex Gough \u003cajgo@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1669973}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 51a1fadc7f8429be578f8e222fb95d6ebb9962ff\n" }, { "commit": "af0b56ae50156f5d0b802ce98a6eb82b0683f2a1", "tree": "d2b7142173dda97f5240e9084ab662b18f9a212a", "parents": [ "8dcfa325304eaf28956bc614a59c0738e74e16b2" ], "author": { "name": "Arthur Sonzogni", "email": "arthursonzogni@chromium.org", "time": "Tue Jul 28 16:37:13 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue Jul 28 16:40:46 2026" }, "message": "[unsafe-buffers] Update allow_unsafe_buffers in sandbox/ SUID C files\n\nKeep #pragma allow_unsafe_buffers in sandbox.c and\nsuid_unsafe_environment_variables.h with a comment explaining that\nthey are C files and cannot use C++ base/compiler_specific.h.\n\nBug: 351564777, 501112808\nChange-Id: If8e067c2b8ba06e9b37d3ffd0eb757c9269b8ff3\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8152727\nReviewed-by: Elly \u003cellyjones@chromium.org\u003e\nCommit-Queue: Arthur Sonzogni \u003carthursonzogni@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1669571}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 4fd6491fed66a940a9c96b4003798212cae6c996\n" }, { "commit": "8dcfa325304eaf28956bc614a59c0738e74e16b2", "tree": "a862cac88770c5bd4e84872ceabb7a0eef9daf5a", "parents": [ "86344cd80725dea60e3c4e17beb8c7616710ea75" ], "author": { "name": "Greg Thompson", "email": "grt@chromium.org", "time": "Tue Jul 28 15:24:54 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue Jul 28 15:28:11 2026" }, "message": "[sandbox/linux] Fix directory traversal vulnerability\n\nBrokerFilePermission::ValidatePath failed to reject paths ending with\nthe `/.` (current directory) self-reference. This allowed an attacker to\nrequest `/tmp/.`, which bypassed ValidatePath() but still successfully\nmatched the base::StartsWith() check for the `/tmp/` recursive\npermission in MatchPath(), improperly granting a dirfd to the root\ncapability. BrokerFilePermission now rejects paths containing `/../` or\n`/./`, as well as trailing `/..` and `/.` references.\n\nFixed: 500311587\nChange-Id: If6beb2361a8a69c6f6a3955aa38c6585d102f3cb\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8160841\nReviewed-by: Elly \u003cellyjones@chromium.org\u003e\nAuto-Submit: Greg Thompson \u003cgrt@chromium.org\u003e\nCommit-Queue: Elly \u003cellyjones@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1669516}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 4298968d02fa7a24dccc65b03071af84c5418c38\n" }, { "commit": "86344cd80725dea60e3c4e17beb8c7616710ea75", "tree": "a4ebaf19e1d240345830c9e766841a9ac2c175d9", "parents": [ "997a324ea58a60dfadf6b704115de384bac94040" ], "author": { "name": "Will Harris", "email": "wfh@chromium.org", "time": "Fri Jul 24 01:58:33 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Fri Jul 24 02:02:48 2026" }, "message": "Enable WinSboxHighGPUJobMemoryLimits by default\n\nThis feature is launching shortly, so enable the feature by default in\nChromium.\n\nUpdate some tests too, so they understand the feature state and have the\ncorrect expectations.\n\nBug: 376720478\nChange-Id: Id376f6f5a9d10c462f01a61f29aec4a24de9d96b\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8134608\nReviewed-by: Alex Gough \u003cajgo@chromium.org\u003e\nCommit-Queue: Will Harris \u003cwfh@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1667590}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 75356963ee8f47d1272d099f39a8671d34f3893c\n" }, { "commit": "997a324ea58a60dfadf6b704115de384bac94040", "tree": "ac410b6a1e3f279691a41692765a1caf9380abee", "parents": [ "361c10db79042622119e1d91f99ce3eda3ddbf7e" ], "author": { "name": "Julia Hansbrough", "email": "flowerhack@google.com", "time": "Thu Jul 23 07:41:45 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Thu Jul 23 07:45:09 2026" }, "message": "[finch] Remove the three-argument BASE_FEATURE macro everywhere it is\nsafe to do so.\n\nUsage of the three-argument BASE_FEATURE macro is discouraged in current\ncode.\n\nWe have some legacy callsites for the three-argument macro that can\u0027t be\nseamlessly updatdd, because the C++ identifier doesn\u0027t match the Feature\nname (e.g. the C++ identifier isn\u0027t just the feature name prepended with\na \"k\").\n\nHowever, we have some ~130 callsites where they DO match, and so we\ncould simply be using the two-argument macro.\n\nLet\u0027s update all those callsites accordingly.\n\nBug: 530271065\nChange-Id: I943f63ea1b62ba7b8f8952bf57b7f60608ad2717\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8033026\nCommit-Queue: Colin Blundell \u003cblundell@chromium.org\u003e\nReviewed-by: Thomas Lukaszewicz \u003ctluk@chromium.org\u003e\nReviewed-by: Alexei Svitkine \u003casvitkine@chromium.org\u003e\nReviewed-by: Kentaro Hara \u003charaken@chromium.org\u003e\nOwners-Override: Colin Blundell \u003cblundell@chromium.org\u003e\nReviewed-by: Bo Liu \u003cboliu@chromium.org\u003e\nReviewed-by: Colin Blundell \u003cblundell@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1666880}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: a410d4615c83e62d027c8708907213bed2598fbe\n" }, { "commit": "361c10db79042622119e1d91f99ce3eda3ddbf7e", "tree": "8cd18b2e15d7599de14476bd36bb309a92a63dd4", "parents": [ "b061f8b8beaced209d1a33650e07a4d168227d5a" ], "author": { "name": "Bryan Oltman", "email": "bryanoltman@google.com", "time": "Tue Jul 21 19:08:09 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue Jul 21 19:12:19 2026" }, "message": "Remove file-issue-extension permission from gpu seatbelt profile\n\nAs per the discussion in the linked bug, this permissions was originally\ngranted to fix an issue affecting macOS version between 14.2.1 and\n14.3.1 (https://g-issues.chromium.org/issues/41485470#comment8). The\nissue may have affected earlier versions of macOS 14, but specifically\ndid not affect 13.6.4\n(https://g-issues.chromium.org/issues/41485470#comment10).\n\nFurthermore, the issue seems to have only manifested on bots\n(https://g-issues.chromium.org/issues/41485470#comment32), which\nexecute tests in a directory that does not have `/Users` as an\nancestor.\n\nThis CL simply removes the permission, as it\u0027s not clear there was\never a user-facing impact and we do not have any bots running affected\nversions of macOS.\n\nFixed: 517249110\nChange-Id: I5aefbbc6bb1381232a5fa26386cd733790884913\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8131180\nReviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\nCommit-Queue: Bryan Oltman \u003cbryanoltman@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1665672}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 2701413522262a4b49624ecbc95226435c80b61e\n" }, { "commit": "b061f8b8beaced209d1a33650e07a4d168227d5a", "tree": "d25789053aa9096afd9d4955ff59faf8e5eadd87", "parents": [ "a663ede4bbdd538be40ded88eb54d283ceda6be0" ], "author": { "name": "Karim El Harim", "email": "karimelharim@gmail.com", "time": "Mon Jul 13 16:10:28 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Mon Jul 13 16:12:34 2026" }, "message": "[sandbox/linux] Fix off-by-one DCHECK in BrokerSimpleMessage::WriteBytes\n\nWriteBytes() checks write_next_offset_ + bytes.size() \u003c\nmessage_.size(), which rejects a write that exactly fills the message\nbuffer. The bounds check in AddDataToMessage()/AddIntToMessage()\n(safe_length \u003e message_.size()) and the DCHECK_LE in ReadBytes() both\naccept the exact-fill case, so an entry sized to exactly fill the\nbuffer trips the DCHECK despite being in bounds. Use DCHECK_LE to\nmatch. DCHECK-only; no release behavior change.\n\nThe DCHECK was introduced together with the WriteBytes() helper in the\nspanification in crrev.com/c/7276084.\n\nAdd a regression test that exactly fills the message buffer; under\nDCHECKs it fails before this fix and passes after.\n\nDeveloped on Windows, where this Linux-only target does not build, so\nlocal validation was by inspection; a CQ dry run of\nsandbox_linux_unittests (BrokerSimpleMessage.*) would be appreciated.\n\nThis CL also adds me to AUTHORS (individual CLA signed). The entry\npreviously rode CL 8046740; it moved here so that exactly one open CL\ncarries it.\n\nR\u003dmpdenton@chromium.org\n\nBug: 508092637\nChange-Id: I6279125f3ea0c299d7da9249b655f3458f1eac54\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8051224\nReviewed-by: Matthew Denton \u003cmpdenton@chromium.org\u003e\nReviewed-by: Elly \u003cellyjones@chromium.org\u003e\nCommit-Queue: Elly \u003cellyjones@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1661155}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 90487eb8ebdb130f28392cbe71d97ea00231ef8d\n" }, { "commit": "a663ede4bbdd538be40ded88eb54d283ceda6be0", "tree": "ee37e34952885eb9e9461ee609ce7b0c0c412bc8", "parents": [ "37c67f39561b2f7988352dfa7df51f0992b4c543" ], "author": { "name": "Jianfeng Liu", "email": "liujianfeng1994@gmail.com", "time": "Mon Jul 13 02:10:08 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Mon Jul 13 02:11:46 2026" }, "message": "media: make enable of v4l2/vaapi on linux possible\n\nV4L2 and VA-API are mutually exclusive upstream: the GN args forbid\nbuilding with both use_v4l2_codec and use_vaapi set, and a number of\nsource files assume the two are never compiled together (the\npreprocessor uses #if/#elif chains, the sandbox computes a single policy\ntype, etc.). That makes it impossible to ship a single Linux build that\ncan target both a V4L2-based and a VA-API-based video pipeline at once.\n\nLift the mutual exclusion and select the active backend at runtime,\ncentralized in media::ActiveLinuxVideoDecoderType() (decoder.h), which\nthe decoder, encoder, image processor, video frame mapper and mojo media\nclients all consult so the whole pipeline agrees on one backend. The\ndefault is VA-API; a new base::Feature, kPreferV4L2VideoAcceleration\n(disabled by default), switches to V4L2 when enabled.\n\nThe build-time mutual-exclusion assert in media/gpu/BUILD.gn and\nmedia/gpu/chromeos/BUILD.gn is removed, and the #if/#elif chains that\nassumed exclusivity (fourcc, image_processor_factory,\nvideo_decoder_pipeline, gpu_video_encode_accelerator_factory,\nvideo_frame_mapper_factory, gpu_mojo_media_client_{cros,linux},\noop_video_decoder_factory_service) are rewritten as independent #if\nblocks so both code paths compile when both flags are on.\n\nThe hardware video decoding/encoding sandboxes also assumed a single\nbackend. They now grant the union of the broker permissions and seccomp\nfilters that either backend needs, since the runtime choice is not\nvisible at sandbox-build time (and broker permissions are immutable once\nthe sandbox is up). This widens the attack surface of a mixed build\ncompared to a single-backend build; the relevant call sites call this\nout in comments.\n\nThe mixed-build decoding sandbox preserves the existing Intel/AMD split\nfor the VA-API half: ComputePolicyType() selects kVaapiAndV4L2 (Intel\nVA-API + V4L2) or kVaapiOnAMDAndV4L2 (AMD VA-API + V4L2) based on\nuse_amd_specific_policies.\n\nbrowser video decoding with default flags (VA-API) and with\n--enable-features\u003dPreferV4L2VideoAcceleration (V4L2).\n\nBug: 530450488\nTest: Built with use_vaapi\u003dtrue use_v4l2_codec\u003dtrue. Ran\nChange-Id: Id62dbbe42d93e8422a66dccccba94eabe84787f7\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8061367\nCommit-Queue: Jianfeng Liu \u003cliujianfeng1994@gmail.com\u003e\nReviewed-by: Ted (Chromium) Meyer \u003ctmathmeyer@chromium.org\u003e\nReviewed-by: Ben Scarlato \u003cakhna@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1660921}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 8c1f628030183bcf5874245f6c15cbe28ca80036\n" }, { "commit": "37c67f39561b2f7988352dfa7df51f0992b4c543", "tree": "16e51ecf0b59319693df58c306712e75c32e9589", "parents": [ "91b71b3e5cd1d2bfdd614c29c0d30dd9c68859ca" ], "author": { "name": "Arthur Sonzogni", "email": "arthursonzogni@chromium.org", "time": "Fri Jul 10 14:24:47 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Fri Jul 10 14:26:53 2026" }, "message": "[unsafe-buffers] Sandbox: Use std::array in baseline_policy_unittest\n\nConvert kTestString and read_buf to std::array in\nbaseline_policy_unittest.cc. This allows us to remove the UNSAFE_TODO\nwrappers introduced in the parent CL:8035239.\n\nBug: 40285824\nChange-Id: I19299bb9522db80277bda6c2e347bce6a4a98881\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8064266\nReviewed-by: Will Harris \u003cwfh@chromium.org\u003e\nCommit-Queue: Arthur Sonzogni \u003carthursonzogni@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1660251}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: b58a3d752b770114d176b617d371a923821d9103\n" }, { "commit": "91b71b3e5cd1d2bfdd614c29c0d30dd9c68859ca", "tree": "a8b04b15a50c374a772d7731f1d558b49d307e85", "parents": [ "3e19954e214a50feedd38c772e363c394d8096de" ], "author": { "name": "Joshua Peraza", "email": "jperaza@google.com", "time": "Thu Jul 09 12:20:41 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Thu Jul 09 12:22:51 2026" }, "message": "Fix unsafe buffer usage in seccomp_broker_process_unittest.cc\n\nRefactored buffer handling in seccomp broker integration tests to use\nmodern C++ and Chromium idioms. Key changes include:\n- Replaced raw pointer and size parameters in `Syscaller::Readlink`\n with `base::span\u003cchar\u003e`.\n- Converted C-style arrays to `std::array`.\n- Replaced `memcmp` and `memset` with `base::span` comparisons and\n `std::ranges::fill`.\n- Used `base::SpanReader` to safely parse `inotify_event` structures.\n\nThese changes eliminate several `UNSAFE_TODO` markers and improve\noverall memory safety by leveraging bounds-checked containers.\n\nInitial patchset generated by headless gemini-cli using:\n//agents/prompts/projects/spanification/run.py\n\nFixed: 506879694\nChange-Id: Ic5741e76ec75e6317d6fa1152e67fc69db51c006\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7790227\nReviewed-by: Matthew Denton \u003cmpdenton@chromium.org\u003e\nCommit-Queue: Arthur Sonzogni \u003carthursonzogni@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1659482}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: ca4e7b38b991a24bb88383b125d30fadea0a9447\n" }, { "commit": "3e19954e214a50feedd38c772e363c394d8096de", "tree": "48c240d50d5ec503f7d4db6bffe9331ee60d7ace", "parents": [ "588d3217052ebfcae3abab7dd8db1ff4b9cbc5ab" ], "author": { "name": "Arthur Sonzogni", "email": "arthursonzogni@chromium.org", "time": "Wed Jul 08 15:19:34 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Jul 08 15:22:47 2026" }, "message": "[unsafe-buffers] Remove allow_unsafe_buffers from sandbox/\n\nThis is a mechanical change transitioning the last few files in sandbox/\nfrom coarse, file-level pragmas to fine-grained, instruction-level\nUNSAFE_TODO() macros.\n\nBug: 351564777, 501112808\nDoc: go/complete_unsafe_todo_migration\nChange-Id: Ie018f5d447476d25e57901e1317be8f65cf151bd\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8035239\nAuto-Submit: Arthur Sonzogni \u003carthursonzogni@chromium.org\u003e\nReviewed-by: Will Harris \u003cwfh@chromium.org\u003e\nCommit-Queue: Will Harris \u003cwfh@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1658776}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: ea018b8384df874e50c8b47e61233bad30822ca5\n" }, { "commit": "588d3217052ebfcae3abab7dd8db1ff4b9cbc5ab", "tree": "f2fe891e2186ee29cb8580eed6cdc341b71c55b8", "parents": [ "72d193317eb3e505aee8e2413006ffd0051780c0" ], "author": { "name": "yoshiki iguchi", "email": "yoshiki@google.com", "time": "Thu Jul 02 12:44:43 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Thu Jul 02 12:46:21 2026" }, "message": "Clean up: Fix 5 wrong escapes in 1 DEPS files in sandbox\n\nAccording to the checkdeps doc, the period (.) should be escaped with\ntwo backslashes (\\\\), but sometimes it was done with one backslash (\\)\nwrongly.\n\nThis CL fixes these wrong escapes.\n\nSee the checkdeps doc for the detailed format:\nhttps://chromium.googlesource.com/chromium/src/+/master/buildtools/checkdeps/README.md\n\nTest: Passed CQ\nTest: Ran `/buildtools/checkdeps/checkdeps.py`\nChange-Id: I2383f6b6c0a2cb97d5d454d0355e26c680cfb026\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7882512\nCommit-Queue: Mark Mentovai \u003cmark@chromium.org\u003e\nAuto-Submit: Yoshiki IGUCHI \u003cyoshiki@chromium.org\u003e\nReviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1656034}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: b05f02867daef952785febd1c5d057b8a8bd99c6\n" }, { "commit": "72d193317eb3e505aee8e2413006ffd0051780c0", "tree": "5a734cebd116c9c7eec290d986ba4fc7dfc4eee9", "parents": [ "c83dc7945a7fdbc7d59792d4049217d4f8f676b0" ], "author": { "name": "Victor Hugo Vianna Silva", "email": "victorvianna@google.com", "time": "Wed Jul 01 15:36:34 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Jul 01 15:38:26 2026" }, "message": "Fix macOS 27 build of `chrome` target\n\nsandbox::Seatbelt::kProfilePureComputation is unused, so can be\nremoved.\n\nFixed: 530141405\nChange-Id: Idcca8b7863c2b10821d8eae5bca782c80be6fe70\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8025516\nAuto-Submit: Victor Vianna \u003cvictorvianna@google.com\u003e\nReviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\nCommit-Queue: Mark Mentovai \u003cmark@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1655528}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 6c0a651f9cf91d07c87be8feba854a38a311aba6\n" }, { "commit": "c83dc7945a7fdbc7d59792d4049217d4f8f676b0", "tree": "b801178081f9b4f21955ece70f26dd468070d837", "parents": [ "6d5856b4d3b2c866fd60aec854b52b4d9f1cffe7" ], "author": { "name": "Liza Burakova", "email": "liza@chromium.org", "time": "Wed Jul 01 15:12:48 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Jul 01 15:15:19 2026" }, "message": "Add UNSAFE_BUFFERS macros to C API calls.\n\nThe unsafe buffers plugin was modified upstream to now guard\ntype size queries on incomplete types. As a result we\u0027re now seeing\nwarnings in these two locations from the plugin.\n\nThe syscall broker has to pass a raw pointer into a syscall, and the\ncrashpad API is a C-style API so it makes sense to suppress both of\nthese.\n\nBug: 529689763\nChange-Id: Ib9361ca061043bcf9ebd87b18cff5815a19fc58f\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8026394\nReviewed-by: Colin Blundell \u003cblundell@chromium.org\u003e\nAuto-Submit: Liza Burakova \u003cliza@chromium.org\u003e\nReviewed-by: Matthew Denton \u003cmpdenton@chromium.org\u003e\nCommit-Queue: Liza Burakova \u003cliza@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1655514}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 5866f94ae7ca7620873a096f2cbda3e5e7a7e47a\n" }, { "commit": "6d5856b4d3b2c866fd60aec854b52b4d9f1cffe7", "tree": "53819e32861fdf607428aa7adc67689edc9582e1", "parents": [ "b004489cb005b9879445b26149b5b74b8501376c" ], "author": { "name": "mingmingtasd", "email": "mingming1.xu@intel.com", "time": "Tue Jun 30 01:05:23 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue Jun 30 01:07:03 2026" }, "message": "WebNN: Add a dedicated flag to disable the WebNN compiler process sandbox\n\nAdd --disable-webnn-compiler-sandbox to disable only the WebNN compiler\nprocess sandbox without affecting other sandboxed processes. This is\nuseful for debugging and development scenarios where --no-sandbox is too\nbroad.\n\nThe flag is plumbed through ContentBrowserClient following the same\npattern as ShouldSandboxAudioService/NetworkService. PreSandboxInit()\nand switch propagation are decoupled from sandbox_type so they work\ncorrectly when the sandbox is overridden. The flag is also added to the\nbad flags list to show the security warning infobar.\n\nBug: 527276309,502249078\nChange-Id: I7344f5d652a09be740217e9b852fa494a5e3eb1d\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8001093\nReviewed-by: Reilly Grant \u003creillyg@chromium.org\u003e\nReviewed-by: Alex Gough \u003cajgo@chromium.org\u003e\nReviewed-by: Avi Drissman \u003cavi@chromium.org\u003e\nReviewed-by: Hu, Ningxin \u003cningxin.hu@intel.com\u003e\nCommit-Queue: Xu, Mingming1 \u003cmingming1.xu@intel.com\u003e\nCr-Commit-Position: refs/heads/main@{#1654507}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: f887faf2f10883b6c19eed2852ced221c0b30cc5\n" }, { "commit": "b004489cb005b9879445b26149b5b74b8501376c", "tree": "315bb339920d72c2b096a3e4aa228e0335daf5c0", "parents": [ "7868c25dcc0afeab964867039c408247f534922f" ], "author": { "name": "Sam Maier", "email": "smaier@google.com", "time": "Mon Jun 29 22:22:44 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Mon Jun 29 22:24:47 2026" }, "message": "Reland \"Fix Javaless Renderer bugs\"\n\nThis reverts commit 4ee163e6d5ca5434b35917847ca09ef9de243822.\n\nReason for revert: Missed chromecast dep removal, now done\n\nOriginal change\u0027s description:\n\u003e Revert \"Fix Javaless Renderer bugs\"\n\u003e\n\u003e This reverts commit 89fe9f088d7a9d2004596b3da7653e5fbef21418.\n\u003e\n\u003e Reason for revert:\n\u003e LUCI Bisection has identified this change as the culprit of a build failure. See the analysis: https://ci.chromium.org/ui/p/chromium/bisection/compile-analysis/b/8677641089075382913\n\u003e\n\u003e Sample failed build: https://ci.chromium.org/b/8677641089075382913\n\u003e\n\u003e If this is a false positive, please report it at http://b.corp.google.com/createIssue?component\u003d1199205\u0026description\u003dAnalysis%3A+https%3A%2F%2Fchromium-review.googlesource.com%2Fc%2Fchromium%2Fsrc%2F%2B%2F8008103\u0026format\u003dPLAIN\u0026priority\u003dP3\u0026title\u003dWrongly+blamed+https%3A%2F%2Fci.chromium.org%2Fui%2Fp%2Fchromium%2Fbisection%2Fcompile-analysis%2Fb%2F8677641089075382913\u0026type\u003dBUG\n\u003e\n\u003e Original change\u0027s description:\n\u003e \u003e Fix Javaless Renderer bugs\n\u003e \u003e\n\u003e \u003e 1) Moves javaless_child_process_service into the main content/app target\n\u003e \u003e so not everyone needs to depend onto it.\n\u003e \u003e 2) Add a weak symbol to javaless_child_process_service in case no\n\u003e \u003e NativeInitializationHook is needed for a target\n\u003e \u003e 3) Early return on some DNS config calls that require android\n\u003e \u003e permissions and thus already return false for all sandboxed isolated\n\u003e \u003e services.\n\u003e \u003e 4) Add some extra code to sandbox.cc that matches Android\u0027s\n\u003e \u003e implementation to check whether a process is sandboxed.\n\u003e \u003e\n\u003e \u003e Bug: 529318456\n\u003e \u003e Change-Id: I1c924bacc623cf6f5c8066279a1db37c6a6a6964\n\u003e \u003e Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8008103\n\u003e \u003e Reviewed-by: Alex Gough \u003cajgo@chromium.org\u003e\n\u003e \u003e Reviewed-by: Stefano Duo \u003cstefanoduo@google.com\u003e\n\u003e \u003e Reviewed-by: Andrew Grieve \u003cagrieve@chromium.org\u003e\n\u003e \u003e Commit-Queue: Sam Maier \u003csmaier@google.com\u003e\n\u003e \u003e Owners-Override: Sam Maier \u003csmaier@google.com\u003e\n\u003e \u003e Cr-Commit-Position: refs/heads/main@{#1654158}\n\u003e \u003e\n\u003e\n\u003e Bug: 529318456\n\u003e No-Presubmit: true\n\u003e No-Tree-Checks: true\n\u003e No-Try: true\n\u003e Change-Id: Ie2717385efe0fde170bea3526486acadeb4e7b40\n\u003e Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8020955\n\u003e Bot-Commit: luci-bisection@appspot.gserviceaccount.com \u003cluci-bisection@appspot.gserviceaccount.com\u003e\n\u003e Commit-Queue: luci-bisection@appspot.gserviceaccount.com \u003cluci-bisection@appspot.gserviceaccount.com\u003e\n\u003e Owners-Override: luci-bisection@appspot.gserviceaccount.com \u003cluci-bisection@appspot.gserviceaccount.com\u003e\n\u003e Cr-Commit-Position: refs/heads/main@{#1654160}\n\nBug: 529318456\nChange-Id: Id524edce69ef415ede43883c3155b0a8a22b87c0\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8017831\nReviewed-by: Peter Wen \u003cwnwen@chromium.org\u003e\nOwners-Override: Sam Maier \u003csmaier@google.com\u003e\nReviewed-by: Yaron Friedman \u003cyfriedman@chromium.org\u003e\nCommit-Queue: Yaron Friedman \u003cyfriedman@chromium.org\u003e\nAuto-Submit: Sam Maier \u003csmaier@google.com\u003e\nCommit-Queue: Sam Maier \u003csmaier@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1654404}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: dcefd60f2022cec9bcca2517a4052b0083fbf8b0\n" }, { "commit": "7868c25dcc0afeab964867039c408247f534922f", "tree": "7d131e133f5dc2416613a7a4d1aca16632d04548", "parents": [ "860639705d61c89587a6f8c15aa546dff12cec64" ], "author": { "name": "luci-bisection@appspot.gserviceaccount.com", "email": "luci-bisection@appspot.gserviceaccount.com", "time": "Mon Jun 29 17:31:11 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Mon Jun 29 17:33:10 2026" }, "message": "Revert \"Fix Javaless Renderer bugs\"\n\nThis reverts commit 89fe9f088d7a9d2004596b3da7653e5fbef21418.\n\nReason for revert:\nLUCI Bisection has identified this change as the culprit of a build failure. See the analysis: https://ci.chromium.org/ui/p/chromium/bisection/compile-analysis/b/8677641089075382913\n\nSample failed build: https://ci.chromium.org/b/8677641089075382913\n\nIf this is a false positive, please report it at http://b.corp.google.com/createIssue?component\u003d1199205\u0026description\u003dAnalysis%3A+https%3A%2F%2Fchromium-review.googlesource.com%2Fc%2Fchromium%2Fsrc%2F%2B%2F8008103\u0026format\u003dPLAIN\u0026priority\u003dP3\u0026title\u003dWrongly+blamed+https%3A%2F%2Fci.chromium.org%2Fui%2Fp%2Fchromium%2Fbisection%2Fcompile-analysis%2Fb%2F8677641089075382913\u0026type\u003dBUG\n\nOriginal change\u0027s description:\n\u003e Fix Javaless Renderer bugs\n\u003e\n\u003e 1) Moves javaless_child_process_service into the main content/app target\n\u003e so not everyone needs to depend onto it.\n\u003e 2) Add a weak symbol to javaless_child_process_service in case no\n\u003e NativeInitializationHook is needed for a target\n\u003e 3) Early return on some DNS config calls that require android\n\u003e permissions and thus already return false for all sandboxed isolated\n\u003e services.\n\u003e 4) Add some extra code to sandbox.cc that matches Android\u0027s\n\u003e implementation to check whether a process is sandboxed.\n\u003e\n\u003e Bug: 529318456\n\u003e Change-Id: I1c924bacc623cf6f5c8066279a1db37c6a6a6964\n\u003e Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8008103\n\u003e Reviewed-by: Alex Gough \u003cajgo@chromium.org\u003e\n\u003e Reviewed-by: Stefano Duo \u003cstefanoduo@google.com\u003e\n\u003e Reviewed-by: Andrew Grieve \u003cagrieve@chromium.org\u003e\n\u003e Commit-Queue: Sam Maier \u003csmaier@google.com\u003e\n\u003e Owners-Override: Sam Maier \u003csmaier@google.com\u003e\n\u003e Cr-Commit-Position: refs/heads/main@{#1654158}\n\u003e\n\nBug: 529318456\nNo-Presubmit: true\nNo-Tree-Checks: true\nNo-Try: true\nChange-Id: Ie2717385efe0fde170bea3526486acadeb4e7b40\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8020955\nBot-Commit: luci-bisection@appspot.gserviceaccount.com \u003cluci-bisection@appspot.gserviceaccount.com\u003e\nCommit-Queue: luci-bisection@appspot.gserviceaccount.com \u003cluci-bisection@appspot.gserviceaccount.com\u003e\nOwners-Override: luci-bisection@appspot.gserviceaccount.com \u003cluci-bisection@appspot.gserviceaccount.com\u003e\nCr-Commit-Position: refs/heads/main@{#1654160}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 4ee163e6d5ca5434b35917847ca09ef9de243822\n" }, { "commit": "860639705d61c89587a6f8c15aa546dff12cec64", "tree": "315bb339920d72c2b096a3e4aa228e0335daf5c0", "parents": [ "90bdb7142fdea7da1da8639e3e0322b55f18b59c" ], "author": { "name": "Sam Maier", "email": "smaier@google.com", "time": "Mon Jun 29 17:07:42 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Mon Jun 29 17:09:43 2026" }, "message": "Fix Javaless Renderer bugs\n\n1) Moves javaless_child_process_service into the main content/app target\n so not everyone needs to depend onto it.\n2) Add a weak symbol to javaless_child_process_service in case no\n NativeInitializationHook is needed for a target\n3) Early return on some DNS config calls that require android\n permissions and thus already return false for all sandboxed isolated\n services.\n4) Add some extra code to sandbox.cc that matches Android\u0027s\n implementation to check whether a process is sandboxed.\n\nBug: 529318456\nChange-Id: I1c924bacc623cf6f5c8066279a1db37c6a6a6964\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8008103\nReviewed-by: Alex Gough \u003cajgo@chromium.org\u003e\nReviewed-by: Stefano Duo \u003cstefanoduo@google.com\u003e\nReviewed-by: Andrew Grieve \u003cagrieve@chromium.org\u003e\nCommit-Queue: Sam Maier \u003csmaier@google.com\u003e\nOwners-Override: Sam Maier \u003csmaier@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1654158}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 89fe9f088d7a9d2004596b3da7653e5fbef21418\n" }, { "commit": "90bdb7142fdea7da1da8639e3e0322b55f18b59c", "tree": "7d131e133f5dc2416613a7a4d1aca16632d04548", "parents": [ "42737446aad4b7a1cfc0568c3fcaef604b6032ea" ], "author": { "name": "mingmingtasd", "email": "mingming1.xu@intel.com", "time": "Mon Jun 29 04:15:29 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Mon Jun 29 04:16:57 2026" }, "message": "WebNN: Align WebNN Compiler job memory limit with the renderer process\n\nSet the job memory limit for the WebNN Compiler process sandbox\n(Sandbox::kWebNNModelCompilation) to 1 TB on Windows, matching the\nrenderer process limit. The reason is that renderer process hosts WebNN\nCPU model compilation; WebNN compiler process sandbox is as tighten as\nrenderer process\u0027 sandbox. Previously it used a physical-memory-based\nscaling heuristic capped at 64 GB, which could be too low for large\nmodel compilations.\n\nBug: 502616233,502249078\nChange-Id: Ie25de73fac3e3a321f3c3270296469d2639c7778\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7997893\nCommit-Queue: Xu, Mingming1 \u003cmingming1.xu@intel.com\u003e\nReviewed-by: Rafael Cintron \u003crafael.cintron@microsoft.com\u003e\nReviewed-by: Alex Gough \u003cajgo@chromium.org\u003e\nReviewed-by: Hu, Ningxin \u003cningxin.hu@intel.com\u003e\nReviewed-by: Reilly Grant \u003creillyg@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1653854}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 47a04cacb6fcb2477e7c9ff5afbc449d076d5587\n" }, { "commit": "42737446aad4b7a1cfc0568c3fcaef604b6032ea", "tree": "6ce8fa7bed612c0dfbdbe76d60ab722ba8011bbd", "parents": [ "a9d727a8b62acf9cd716c8a340a8ae551d06972d" ], "author": { "name": "Mohannad Farrag", "email": "aymanm@google.com", "time": "Fri Jun 26 15:43:34 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Fri Jun 26 15:45:32 2026" }, "message": "sandbox: Allow recvmmsg in seccomp sandbox on Linux\n\nThis allows the recvmmsg system call in the seccomp sandbox on Linux,\nwhich is required for the new QUIC ReadMultiple API.\n\nAlso allows recvmmsg_time64 on 32-bit platforms, which is implicitly\nused by glibc for Y2038 safety when calling recvmmsg.\n\nBug: 515333601\nChange-Id: Ic8fb553f5014e71cbbe8fc9bf5af225afc5378fd\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7992621\nCommit-Queue: Mohannad Farrag \u003caymanm@google.com\u003e\nReviewed-by: Ben Scarlato \u003cakhna@google.com\u003e\nAuto-Submit: Mohannad Farrag \u003caymanm@google.com\u003e\nReviewed-by: Adam Rice \u003cricea@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1653188}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 3d3de2644a6d9275be330b0d15c1cd63d2a02c0a\n" }, { "commit": "a9d727a8b62acf9cd716c8a340a8ae551d06972d", "tree": "4005b6f9a40cc27a27b57495f511b077af9f3203", "parents": [ "859a4872ff8e67b463d56e0a9605bc62385336fb" ], "author": { "name": "Bryan Oltman", "email": "bryanoltman@google.com", "time": "Thu Jun 25 20:47:39 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Thu Jun 25 20:49:36 2026" }, "message": "[macOS] Guard ODME process directory access behind flag\n\nThe sandboxed on-device model execution process has broad read and write\npermissions for the user directory, as well as the user\u0027s cache and temp\ndirectories. This access could lead to security issues, and it is not\nclear that they are still necessary. These elevated permissions were\nadded when the sandbox profile was first introduced in\nhttps://crrev.com/c/5015229, and seem to have been inherited from the\ngpu.sb file. Narrower exceptions (like the Metal shader cache directory\nfor the specific helper bundle ID) are already explicitly handled via\nmaybe-allow-metal-shader-cache-access in common.sb.\n\nI\u0027m unable to trigger any sandbox logs with these permissions removed on\nthe hardware I have available to me (running 26.5.1 and 27 beta 2). The\nmodel loading and mock prompt execution flows on\nchrome://on-device-internals were used with these permissions\nrestricted, and they succeeded without triggering any OS sandbox\nviolations or initialization failures.\n\nThis change is gated with the kMacSandboxOdmeUserDirAccess feature, and\nshould be updated to either restrict the file access granted to the\non-device model execution process to include only the needed directories\nonce we know what those are or removed entirely if this access is no\nlonger needed.\n\nFixed: 527915149\nChange-Id: I8cc31a5b5b5adaaebd38b44bab3dae4820d0f406\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7958375\nCommit-Queue: Bryan Oltman \u003cbryanoltman@google.com\u003e\nReviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1652692}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 1883a1d1686efaa9f45d981128e7bfbbdf8e1f15\n" }, { "commit": "859a4872ff8e67b463d56e0a9605bc62385336fb", "tree": "fbdf6dee2584e3c7253be7f39b2dc5a01c8176b9", "parents": [ "18a3f72c8583c20bc052f54ceddd111d2319c584" ], "author": { "name": "Bryan Oltman", "email": "bryanoltman@google.com", "time": "Thu Jun 25 16:07:21 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Thu Jun 25 16:09:32 2026" }, "message": "[macOS] Guard network process directory access behind flag\n\nThe sandboxed network process has broad read and write permissions for\nthe user cache and temp dirs. This access could lead to security issues,\nand it is not clear that they are still necessary. These elevated\npermissions were added before the the release of the earliest macOS\nversion that we still support, and I\u0027m unable to trigger any sandbox\nlogs with these permissions removed on the hardware I have available to\nme (running 26.5.1 and 27 beta 2). No reason is given for the addition\nof darwin-user-cache-dir, and darwin-user-temp-dir was added due to\nhttps://crbug.com/40099129 (Unable to view \u0027Stop logging to disk\u0027 option\non Mac 10.14.6). I\u0027ve verified that this bug does not reproduce on a\nlocal build with these sandbox permissions removed.\n\nThis change is gated with the kMacSandboxNetworkUserDirAccess feature,\nand should be updated to either restrict the file access granted to the\nGPU process to include only the needed directories once we know what\nthose are, or removed entirely if this access is no longer needed.\n\nFixed: 527885521\nChange-Id: I2a2ecec48688027478acac620fe1dd63e27e66f0\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7983514\nCommit-Queue: Bryan Oltman \u003cbryanoltman@google.com\u003e\nReviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1652469}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 39a2dda84313c3bdb796260a884c3bf501370c29\n" }, { "commit": "18a3f72c8583c20bc052f54ceddd111d2319c584", "tree": "aab10fb6c4d02969e935bcbffc47ca7acb4859cd", "parents": [ "974cb223bd024249acc0b79c738ef358ccab71a5" ], "author": { "name": "Rafael Cintron", "email": "rafael.cintron@microsoft.com", "time": "Wed Jun 17 15:00:49 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Jun 17 15:03:58 2026" }, "message": "[WebNN] Tighten model-compilation utility sandbox to USER_LOCKDOWN\n\nThe kWebNNModelCompilation sandbox added in 1adb86c8ac1a was a clone of\nthe GPU-process policy, which caps out at USER_LIMITED. Model\ncompilation, on the other hand, just needs to load run the third-party\nexecution-provider preload helper (today the ONNX Runtime; LiteRT and\nother backends may follow), and then sit doing pure compute. So we can\nlock it down further.\n\nDrive the process through three stages:\n\n1. Process creation (broker, utility_sandbox_delegate_win.cc):\n * Less Privileged App Container \"cr.sb.wnn\" with capabilities:\n - lpacChromeInstallFiles (added by SetupAppContainerProfile\u0027s\n common path)\n - registryRead (ditto)\n - chromeInstallFiles (impersonation capability, for access\n checks against chrome.exe\u0027s install directory at process\n creation time)\n * Token: USER_RESTRICTED_SAME_ACCESS initially.\n * MITIGATION_WIN32K_DISABLE as a *startup* mitigation via\n AddWin32kLockdownPolicy(), so the kernel rejects every Win32k\n syscall from the child\u0027s first instruction of user code.\n * JobLevel::kLockdown with no UI exceptions.\n * SetLockdownDefaultDacl() to tighten the default DACL on kernel\n objects this process creates so that other processes can\u0027t open\n handles into them.\n * Delayed MITIGATION_DYNAMIC_CODE_DISABLE (added via the common\n network/audio/iconreader path in GenerateConfigForSandboxedProcess).\n\n2. Process creation (chrome layer,\n chrome/browser/chrome_content_browser_client.cc::PreSpawnChild()):\n * Startup MITIGATION_FORCE_MS_SIGNED_BINS via enforce_code_integrity\n \u003d true, the same path used by the renderer, network, and\n JIT-enabled service processes. The chrome layer pairs the\n mitigation with AllowExtraDll() for chrome.dll and chrome_elf.dll\n so the loader can still map those two Google-signed DLLs at\n startup; subsequent attempts by the preload helper to pull in\n unsigned vendor / AV / IME / shim DLLs are denied with\n STATUS_INVALID_IMAGE_HASH. Enabled by default; pass\n --allow-third-party-modules to disable (the same switch that\n disables the delayed MITIGATION_FORCE_MS_SIGNED_BINS in\n sandbox::policy::SandboxWin). This arm is also compiled out in\n component builds, under ASAN, and when chrome.exe itself is the\n module being loaded, so a developer build still works.\n\n3. Pre-LowerToken (child, content/utility/utility_main.cc):\n Right before LowerToken(), the kWebNNModelCompilation branch calls\n webnn::PreSandboxInit() to load and one-time-initialize the\n third-party execution-provider preload helper. The current\n implementation calls\n webnn::ort::PlatformFunctions::EnsureInitialized(); as additional\n backends come online webnn::PreSandboxInit() is their extension\n point. LowerToken() then engages USER_LOCKDOWN and the delayed\n mitigations.\n\nWhy LPAC:\n\nUSER_LIMITED\u0027s restricting set {Users, Everyone, RESTRICTED} does not\ninclude the user\u0027s own SID, which would block writes under\nC:\\Users\\\u003cuser\u003e\\*. However, it also blocks *reads* of paths whose ACLs\ndo not contain BUILTIN\\Users, which is exactly the case for per-user\ninstalls under C:\\Users\\\u003cuser\u003e\\AppData\\Local\\... and developer builds\nunder C:\\Users\\\u003cuser\u003e\\chromium\\src\\out\\... . LPAC instead reaches\nChrome\u0027s install directory via the lpacChromeInstallFiles capability\nACEs the installer already places on it.\n\nEnabling LPAC also flips DisableDefaultPolicy() to true (LPAC sandboxes\nin this delegate always disable the default policy), so\nAddDefaultConfigForSandboxedProcess() no longer runs.\nWebNNModelCompilationInitializeConfig is now responsible for the entire\nper-process configuration; the LPAC\u0027s capability SIDs and its own\nintegrity-level semantics replace the default INTEGRITY_LEVEL_LOW /\nINTEGRITY_LEVEL_UNTRUSTED + lockdown DACL + kDeviceApi handle closure\nthat non-LPAC utility processes inherit.\n\nBug: 500769395\nChange-Id: I9354caae9afca64c3ed2eef2a40dcee9797d54ef\nCq-Include-Trybots: luci.chromium.try:win11-blink-rel, mac14.arm64-blink-rel, mac14-blink-rel, mac15.arm64-blink-rel, mac15-blink-rel, linux-blink-rel\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7831437\nReviewed-by: Stefan Smolen \u003cssmole@microsoft.com\u003e\nCommit-Queue: Rafael Cintron \u003crafael.cintron@microsoft.com\u003e\nReviewed-by: Hu, Ningxin \u003cningxin.hu@intel.com\u003e\nReviewed-by: Alex Gough \u003cajgo@chromium.org\u003e\nReviewed-by: Avi Drissman \u003cavi@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1648320}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 5bb6464b27fce6ed3e2062cd4f2f624ca2bd9c66\n" }, { "commit": "974cb223bd024249acc0b79c738ef358ccab71a5", "tree": "1b04509f135be73c218364606a7ab26c03663b76", "parents": [ "db7ad29144efff68d6b986f3057d4ac128b46b07" ], "author": { "name": "Richard Townsend", "email": "ritownsend@google.com", "time": "Tue Jun 16 17:44:01 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue Jun 16 17:46:16 2026" }, "message": "fix: UsePerformanceHelper affinity mode\n\nBefore the cleanup[1], we detected the SoC model and allowed\naffinity changes on Google SoCs. The cleanup removed this check and\nrelied solely on IsEligibleForBigCoreAffinityChange. However,\nIsEligibleForBigCoreAffinityChange returns true only if at least\nthree distinct CPU frequencies are detected. It seems this\ninformation can\u0027t be read once the sandbox is active.\n\nFix the issue by caching the values early in startup.\n\nAlso simplify the sandbox tests to prevent intermittent, flaky\nerrors.\n\n[1] crev.com/940fa9ee3b90c6d23593ab18219cbdcbbea1b5f4\n\nBug: 517465598, 464505581\n\nChange-Id: Iecad7d302348e619d550fc5e3e4a3bf8a96e1c97\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7946241\nReviewed-by: Kentaro Hara \u003charaken@chromium.org\u003e\nReviewed-by: Ben Scarlato \u003cakhna@google.com\u003e\nCommit-Queue: Richard Townsend \u003critownsend@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1647713}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: ce9f9305ae9131eec094f1a8aad76e90471a70ea\n" }, { "commit": "db7ad29144efff68d6b986f3057d4ac128b46b07", "tree": "f31cc26d505564bd5ebdd3baf2bf6d5e9c9dc4e8", "parents": [ "0bc587e3fec1f118486702ef3579d491da5041b7" ], "author": { "name": "Avi Drissman", "email": "avi@chromium.org", "time": "Tue Jun 16 14:41:00 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue Jun 16 14:43:00 2026" }, "message": "Remove code supporting macOS 12 from sandbox\n\nChromium no longer supports macOS 12.\n\nBug: 473856754\nChange-Id: I635b19138114112d25461230537e582b6a6a6964\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7921546\nReviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\nCommit-Queue: Avi Drissman \u003cavi@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1647545}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 05445ba537148abcbd843998b0d0e0e3573b13f5\n" }, { "commit": "0bc587e3fec1f118486702ef3579d491da5041b7", "tree": "404cda6f550dc127b25eef9c4824e718aaf1b8fe", "parents": [ "43b6b0c1c6fefc08932707be88bd1cfa50b377b3" ], "author": { "name": "Evan Liu", "email": "evliu@google.com", "time": "Fri Jun 05 02:05:20 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Fri Jun 05 02:08:06 2026" }, "message": "Harden Speech Recognition Utility Process Sandbox on Windows\n\nThis CL addresses several security gaps related to the SODA (Speech\nOn-Device API) utility process:\n\n1. Interface Binding Check: BindSpeechRecognitionContextHandler now\nverifies that the user has explicitly enabled Live Caption or Headless\nCaption before binding the Mojo interface, preventing unsolicited\nconnections from compromised renderers.\n\n2. Sandbox Hardening (Windows): The kSpeechRecognition sandbox policy is\nstrengthened by enabling Win32k lockdown and Arbitrary Code Guard (ACG /\nMITIGATION_DYNAMIC_CODE_DISABLE).\n\n3. Handle Validation: Adds a missing NULL check in SodaClientImpl::Reset\nto safely handle initialization failures and ensure consistent internal\nstate.\n\nFixed: 513852202\nChange-Id: Ida417199cd0501f6c26cbff26c32d4823e231b04\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7896183\nReviewed-by: Will Harris \u003cwfh@chromium.org\u003e\nCommit-Queue: Evan Liu \u003cevliu@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1642088}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 20696bc7300449a01888d3d51dd60160f0e9f80d\n" }, { "commit": "43b6b0c1c6fefc08932707be88bd1cfa50b377b3", "tree": "cc9eadf4f2a37a1bb4bd6a6ce7ab7f40623e2e48", "parents": [ "b97abb934bdd93c84e36ee2b595d79010e182e69" ], "author": { "name": "Etienne Pierre-doray", "email": "etiennep@chromium.org", "time": "Wed Jun 03 14:43:54 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Jun 03 14:45:59 2026" }, "message": "[tracing] Migrate async track events to more appropriate alternatives in sandbox/win\n\nThis CL changes async events on custom tracks (TRACE_EVENT_BEGIN/_END)\nto synchronous events.\n\nThere\u0027s a cost to using async events:\n- async events take a lot of vertical space in tracing UI\n- async events looses context of where the start and end happen\n- custom track are tricky to use, and Track::FromPointer is problematic because it can alias when pointers are reused.\nhttps://chromium.googlesource.com/chromium/src.git/+/HEAD/docs/trace_events.md#asynchronous-events\n\nAs a general rule of thumb synchronous events are more appropriate when a slice is well nested in a function.\n\nThis CL was uploaded by git cl split.\n\nBug: 432427382\nChange-Id: Iaf9a2426b4bf773dab27169faf69402893d97f1a\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7871612\nReviewed-by: Alex Gough \u003cajgo@chromium.org\u003e\nCommit-Queue: Etienne Pierre-Doray \u003cetiennep@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1640927}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: f51e1724fb49571e596eb9878178e700be5c8a1d\n" }, { "commit": "b97abb934bdd93c84e36ee2b595d79010e182e69", "tree": "408c21e0782960f80365437af6e4664fa45eeca3", "parents": [ "7596fc42155575b26a56ebb3fb8eb654a650d780" ], "author": { "name": "Joe Mason", "email": "joenotcharles@google.com", "time": "Wed Jun 03 05:26:20 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Jun 03 05:28:45 2026" }, "message": "Migrate SysInfo::AmountOfPhysicalMemory callers to AmountOfTotalPhysicalMemory in sandbox/policy/win\n\nConvert callers of base::SysInfo::AmountOfPhysicalMemory to use\nAmountOfTotalPhysicalMemory. In cases where the caller expects a\nByteCount, convert the result using AsDeprecatedByteCount() to minimize\nunrelated changes.\n\nThis CL was uploaded by git cl split.\n\nThis CL was uploaded by an experimental version of git cl split\n(https://crbug.com/389069356).\n\nR\u003dajgo@chromium.org\n\nTAG\u003dagy\nCONV\u003d0f63b45d-cf24-4852-82b7-233c5d9bb873\n\nBug: 448661443\nChange-Id: If7ddd22a6f0ef6008bdc0a488ae80bfc445af49d\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7869862\nAuto-Submit: Joe Mason \u003cjoenotcharles@google.com\u003e\nReviewed-by: Alex Gough \u003cajgo@chromium.org\u003e\nCommit-Queue: Joe Mason \u003cjoenotcharles@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1640711}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 762f2d35669b3d9a918820d25b1919338fdbadc7\n" }, { "commit": "7596fc42155575b26a56ebb3fb8eb654a650d780", "tree": "cf560ebf13e566f99ad9f76498ec24d08e420d6f", "parents": [ "026845c3bbb697b60e1bda699f99e6f47bba236f" ], "author": { "name": "Richard Townsend", "email": "ritownsend@google.com", "time": "Tue Jun 02 18:15:22 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue Jun 02 18:17:43 2026" }, "message": "fix: remove incorrect flag from sandbox/ test\n\nThe intent of the test was to pass only if a particular feature flag was\nset. [1] simplified the flag\u0027s behaviour, since we\u0027ve disentangled that\nCPU affinity experiment from another, but this wasn\u0027t picked up.\n\n[1] https://chromium-review.googlesource.com/c/chromium/src/+/7860382\n\nBug: 464505581\nChange-Id: Ieaf62261edde3d15515debb64e43157fd61115a9\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7881488\nCommit-Queue: Richard Townsend \u003critownsend@google.com\u003e\nReviewed-by: Ben Scarlato \u003cakhna@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1640323}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 401bb76b0ba879bed55e2270a32349e87f7bb7ef\n" }, { "commit": "026845c3bbb697b60e1bda699f99e6f47bba236f", "tree": "e7611127b94d799da050b8735e8188289c8d0ee1", "parents": [ "ea341c6a1ebbcc65a551edc381c4d8e81deb89cd" ], "author": { "name": "Masa Fujita", "email": "massan@google.com", "time": "Mon Jun 01 18:06:36 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Mon Jun 01 18:09:04 2026" }, "message": "Disable BaselinePolicyAndroid.SchedSetAffinity_Maybe_Allowed\n\nWe are disabling BaselinePolicyAndroid.SchedSetAffinity_Maybe_Allowed\nas it has been flaky.\n\nhttps://ci.chromium.org/ui/test/chromium/%3A%2F%2Fsandbox%2Flinux%5C%3Asandbox_linux_unittests!gtest%3A%3ABaselinePolicyAndroid%23SchedSetAffinity_Maybe_Allowed?q\u003dVHash%3Aeecda6478354dbe2\n\nBug: 518561648\nChange-Id: Ie744bbbc65f84d31c2fafa986436ab77e061ff1b\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7888996\nReviewed-by: Henrique Nakashima \u003chnakashima@chromium.org\u003e\nOwners-Override: Henrique Nakashima \u003chnakashima@chromium.org\u003e\nCommit-Queue: Henrique Nakashima \u003chnakashima@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1639529}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 757e97a2fcee9f6a792b8d8681565d765098301a\n" }, { "commit": "ea341c6a1ebbcc65a551edc381c4d8e81deb89cd", "tree": "a4d604007a9bb1845132c3f86b773994f898370f", "parents": [ "534adc71ea6b6d4a918f23dda0b0f9125de0fe41" ], "author": { "name": "Filipa Senra", "email": "fsenra@google.com", "time": "Fri May 29 12:24:13 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Fri May 29 12:26:05 2026" }, "message": "[Gardener] Disable SchedGetAffinity_Maybe_Allowed test.\n\nFailures in several builds, https://ci.chromium.org/ui/test/chromium/%3A%2F%2Fsandbox%2Flinux%5C%3Asandbox_linux_unittests!gtest%3A%3ABaselinePolicyAndroid%23SchedGetAffinity_Maybe_Allowed.\n\nBug: 517465598\nChange-Id: I4c45556227d64c54d7fd1c336a9b6041d1fb05f5\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7883227\nOwners-Override: Filipa Senra \u003cfsenra@google.com\u003e\nCommit-Queue: Filipa Senra \u003cfsenra@google.com\u003e\nReviewed-by: Oleh Lamzin \u003clamzin@google.com\u003e\nAuto-Submit: Filipa Senra \u003cfsenra@google.com\u003e\nReviewed-by: Martin Šrámek \u003cmsramek@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1638409}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 67229357efab4b3eeecd36243eceab279a023e3e\n" }, { "commit": "534adc71ea6b6d4a918f23dda0b0f9125de0fe41", "tree": "61c920f2605e730b622232ae91745cd3574426e7", "parents": [ "9c0871b0bce934fbb600e098f79584bf70c4ba8c" ], "author": { "name": "Ivana Žužić", "email": "izuzic@google.com", "time": "Thu May 28 17:03:46 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Thu May 28 17:05:55 2026" }, "message": "Revert \"[Gardening] Fix BaselinePolicyAndroid affinity test\"\n\nThis reverts commit cc49845de15e83dde753b6007ac285f6c700e50e.\n\nReason for revert: This was a speculative fix and it didn\u0027t work.\nRecent failure: https://ci.chromium.org/ui/p/chrome/builders/ci/android-14-arm64-rel-tests/4242/overview\n\nOriginal change\u0027s description:\n\u003e [Gardening] Fix BaselinePolicyAndroid affinity test\n\u003e\n\u003e The seccomp-bpf policy in BaselinePolicyAndroid grants access to\n\u003e sched_getaffinity and sched_setaffinity based on CPU topology\n\u003e eligibility (base::IsEligibleForBigCoreAffinityChange()).\n\u003e\n\u003e However, the corresponding unit tests in\n\u003e baseline_policy_android_unittest.cc checked the feature flag\n\u003e base::kRestrictBigCoreThreadAffinity instead of the eligibility logic.\n\u003e\n\u003e This mismatch caused test failures in environments that are eligible for\n\u003e affinity changes but do not have the feature flag enabled, as the system\n\u003e calls succeeded instead of returning EPERM.\n\u003e\n\u003e This CL updates the test assertions to check the device\u0027s eligibility\n\u003e instead of the feature state.\n\u003e\n\u003e Bug: 517465598\n\u003e Change-Id: If35b5e49368ed1674de78ab6f29810f1af9a42d4\n\u003e Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7881599\n\u003e Auto-Submit: Ivana Žužić \u003cizuzic@google.com\u003e\n\u003e Reviewed-by: Friedrich Hauser \u003cfriedrichh@chromium.org\u003e\n\u003e Commit-Queue: Friedrich Hauser \u003cfriedrichh@chromium.org\u003e\n\u003e Owners-Override: Ivana Žužić \u003cizuzic@google.com\u003e\n\u003e Cr-Commit-Position: refs/heads/main@{#1637640}\n\nBug: 517465598\nNo-Presubmit: true\nNo-Tree-Checks: true\nNo-Try: true\nChange-Id: Iaa7f6f0cd539c341d88c680806591a7bcd97e0ad\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7880198\nCommit-Queue: Ivana Žužić \u003cizuzic@google.com\u003e\nCommit-Queue: rubber-stamper@appspot.gserviceaccount.com \u003crubber-stamper@appspot.gserviceaccount.com\u003e\nBot-Commit: rubber-stamper@appspot.gserviceaccount.com \u003crubber-stamper@appspot.gserviceaccount.com\u003e\nOwners-Override: Ivana Žužić \u003cizuzic@google.com\u003e\nReviewed-by: Ben Scarlato \u003cakhna@google.com\u003e\nAuto-Submit: Ivana Žužić \u003cizuzic@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1637778}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 45e41b7be3149fe9a2c3b9fb4641399124ee6b81\n" }, { "commit": "9c0871b0bce934fbb600e098f79584bf70c4ba8c", "tree": "bed2c4670ef503e327a432f0b8ca8c84a791b96e", "parents": [ "d7337e58477eed88017d6db9ab7384eb8a550b5d" ], "author": { "name": "Ivana Žužić", "email": "izuzic@google.com", "time": "Thu May 28 13:07:56 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Thu May 28 13:12:15 2026" }, "message": "[Gardening] Fix BaselinePolicyAndroid affinity test\n\nThe seccomp-bpf policy in BaselinePolicyAndroid grants access to\nsched_getaffinity and sched_setaffinity based on CPU topology\neligibility (base::IsEligibleForBigCoreAffinityChange()).\n\nHowever, the corresponding unit tests in\nbaseline_policy_android_unittest.cc checked the feature flag\nbase::kRestrictBigCoreThreadAffinity instead of the eligibility logic.\n\nThis mismatch caused test failures in environments that are eligible for\naffinity changes but do not have the feature flag enabled, as the system\ncalls succeeded instead of returning EPERM.\n\nThis CL updates the test assertions to check the device\u0027s eligibility\ninstead of the feature state.\n\nBug: 517465598\nChange-Id: If35b5e49368ed1674de78ab6f29810f1af9a42d4\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7881599\nAuto-Submit: Ivana Žužić \u003cizuzic@google.com\u003e\nReviewed-by: Friedrich Hauser \u003cfriedrichh@chromium.org\u003e\nCommit-Queue: Friedrich Hauser \u003cfriedrichh@chromium.org\u003e\nOwners-Override: Ivana Žužić \u003cizuzic@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1637640}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: cc49845de15e83dde753b6007ac285f6c700e50e\n" }, { "commit": "d7337e58477eed88017d6db9ab7384eb8a550b5d", "tree": "61c920f2605e730b622232ae91745cd3574426e7", "parents": [ "4c39da162f625f357cdc03ff8a11c3353c00efa0" ], "author": { "name": "Richard Townsend", "email": "ritownsend@google.com", "time": "Wed May 27 15:29:49 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed May 27 15:33:44 2026" }, "message": "Remove setPreferPowerEfficiency experiment\n\nField data indicated that this wasn\u0027t as effective as regular CPU\naffinity.\n\nBug: 464505581\nChange-Id: I4c621642f9dee35f33d736021a094ce1848eaf0a\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7860382\nCommit-Queue: Richard Townsend \u003critownsend@google.com\u003e\nReviewed-by: Joe Mason \u003cjoenotcharles@google.com\u003e\nReviewed-by: Kyle Charbonneau \u003ckylechar@chromium.org\u003e\nReviewed-by: Elly \u003cellyjones@chromium.org\u003e\nReviewed-by: Kentaro Hara \u003charaken@chromium.org\u003e\nReviewed-by: Etienne Pierre-Doray \u003cetiennep@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1636980}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 940fa9ee3b90c6d23593ab18219cbdcbbea1b5f4\n" }, { "commit": "4c39da162f625f357cdc03ff8a11c3353c00efa0", "tree": "b68c50d4cc2f45116a9d530076b9595edb3c79a2", "parents": [ "d197319ad43976d4b4fe687e21e96257bb65b2f5" ], "author": { "name": "Joe Mason", "email": "joenotcharles@google.com", "time": "Mon May 25 16:17:38 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Mon May 25 16:31:36 2026" }, "message": "Migrate SysInfo::AmountOfPhysicalMemory callers to AmountOfTotalPhysicalMemory in sandbox/policy/linux\n\nConvert callers of base::SysInfo::AmountOfPhysicalMemory to use\nAmountOfTotalPhysicalMemory. In cases where the caller expects a\nByteCount, convert the result using AsDeprecatedByteCount() to minimize\nunrelated changes.\n\nThis CL was uploaded by git cl split.\n\nThis CL was uploaded by an experimental version of git cl split\n(https://crbug.com/389069356).\n\nR\u003dellyjones@chromium.org\n\nTAG\u003dagy\nCONV\u003d0f63b45d-cf24-4852-82b7-233c5d9bb873\n\nBug: 448661443\nChange-Id: I6eb71a9278718161c42b4a16ae8ff4ee8aeb9558\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7872677\nAuto-Submit: Joe Mason \u003cjoenotcharles@google.com\u003e\nReviewed-by: Elly \u003cellyjones@chromium.org\u003e\nCommit-Queue: Elly \u003cellyjones@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1635746}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 0d6d366861f69447e03997ab967fe33ff9285981\n" }, { "commit": "d197319ad43976d4b4fe687e21e96257bb65b2f5", "tree": "5b32b6949ecfee01249fb68e0c2ad030b2659d01", "parents": [ "d407c402bc92e24e4fefecec27a22c6598c8c7c0" ], "author": { "name": "Bryan Oltman", "email": "bryanoltman@google.com", "time": "Wed May 20 19:17:09 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed May 20 19:20:18 2026" }, "message": "[macOS] Deny distributed notifications in the renderer sandbox\n\nHarden the renderer sandbox by denying the ability to post distributed\nnotifications and looking up the distributed notification service.\n\nThis change includes a feature, kMacSandboxDistributedNotifications\n(disabled by default), that can be used as a killswitch if needed.\n\nFixed: 513454805\nChange-Id: I82a9c46a2f9e921be7f5b286fdbbb9c2bcc6b643\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7858672\nReviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\nCommit-Queue: Bryan Oltman \u003cbryanoltman@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1633749}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: cd96f38a97b7dc0524c55a35d209065ef0be03b8\n" }, { "commit": "d407c402bc92e24e4fefecec27a22c6598c8c7c0", "tree": "738ab0e00b4a2b833ee3b5e988fbbbf6a9122aea", "parents": [ "1ec95929e5c5d6c4388472cd44664be1f37ec93a" ], "author": { "name": "Matt Stark", "email": "msta@google.com", "time": "Tue May 19 07:55:08 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue May 19 07:59:03 2026" }, "message": "Run `gn format` on all BUILD.gn files.\n\nNO_IFTTT\u003dFormatting change only\n\nLink: https://chromium-review.googlesource.com/id/I94ec311d69c76b9f85351c08b4d3bd216a6a6964\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7858711\nReviewed-by: Takuto Ikuta \u003ctikuta@chromium.org\u003e\nOwners-Override: Takuto Ikuta \u003ctikuta@chromium.org\u003e\nCommit-Queue: Matt Stark \u003cmsta@google.com\u003e\nSLSA-Policy-Verified: SLSA Policy Verification Service \u003cdevtools-gerritcodereview-exitgate@google.com\u003e\nReviewed-by: Junji Watanabe \u003cjwata@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1632679}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: ad14f9bebfdee678ba25da9430c2d5c3b00d6a11\n" }, { "commit": "1ec95929e5c5d6c4388472cd44664be1f37ec93a", "tree": "f172a366f33c3f2e7f82d511875204fb2bde0205", "parents": [ "272ebff906f655bc5951e333ab3177f1379282b0" ], "author": { "name": "Emily Stark", "email": "estark@google.com", "time": "Thu May 14 23:53:00 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Thu May 14 23:57:03 2026" }, "message": "Move test-only GetNtPathFromWin32Path into test file\n\nThis function appears to only be used in a couple tests, so move it into\nthe test file to avoid any confusion about whether it has security\nconsequences.\n\nBug: 512919802\nChange-Id: Id8e272f060450b4cc5bd50faf0cd2779bdbc18f2\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7846335\nCommit-Queue: Emily Stark \u003cestark@chromium.org\u003e\nReviewed-by: Will Harris \u003cwfh@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1630907}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: ba15804e0999cab6686af217101050a174a16ef1\n" }, { "commit": "272ebff906f655bc5951e333ab3177f1379282b0", "tree": "6b754606fc75fe5ed90dd603a1453b5d6ba7c1d7", "parents": [ "f8acb8c15965924de365958ee4d3e0cfdaebc104" ], "author": { "name": "Andrew Paseltiner", "email": "apaseltiner@chromium.org", "time": "Wed Apr 29 19:36:37 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Apr 29 19:38:33 2026" }, "message": "Reland \"Fix mmap seccomp policy in speech recognition sandbox\"\n\nThis is a reland of commit d732652538cc407ab189c0dbd4804793b13b510a.\n\nThe speech recognition policy test uses __NR_mmap, which is not\navailable on some architectures (e.g., ARM, which uses __NR_mmap2\ninstead). This caused build failures on the chromeos-arm-generic-dbg\nbuilder.\n\nThis CL guards the entire test file with #if defined(__NR_mmap) to\nensure it only compiles on architectures where the syscall is available.\nThis matches the pattern used in the production policy implementation.\n\nOriginal change\u0027s description:\n\u003e Fix mmap seccomp policy in speech recognition sandbox\n\u003e\n\u003e The Linux speech recognition sandbox policy incorrectly used a C++\n\u003e ternary operator with a BPF DSL expression. This caused the expression\n\u003e to be evaluated as a boolean during policy generation, which\n\u003e unconditionally evaluated to true. As a result, mmap was always allowed,\n\u003e bypassing baseline security restrictions.\n\u003e\n\u003e This CL fixes the logic by refactoring the baseline RestrictMmapFlags()\n\u003e helper to support an optional extra_allowed_mask. The speech recognition\n\u003e policy now uses this helper with MAP_POPULATE. This eliminates\n\u003e duplication of the baseline flag mask and ensures the speech recognition\n\u003e sandbox stays in sync with baseline security updates, while correctly\n\u003e allowing the required MAP_POPULATE flag.\n\u003e\n\u003e Fixed: 502023400\n\u003e Change-Id: Id4db89418b21d11aa5590115c84ad64c8e838a00\n\u003e Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7800739\n\u003e Commit-Queue: Andrew Paseltiner \u003capaseltiner@chromium.org\u003e\n\u003e Reviewed-by: Ben Scarlato \u003cakhna@google.com\u003e\n\u003e Reviewed-by: Will Harris \u003cwfh@chromium.org\u003e\n\u003e Cr-Commit-Position: refs/heads/main@{#1622456}\n\nFixed: 502023400\nChange-Id: I253ed2b15127dde71489e6219364cfa183896d0c\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7800978\nReviewed-by: Ben Scarlato \u003cakhna@google.com\u003e\nCommit-Queue: Andrew Paseltiner \u003capaseltiner@chromium.org\u003e\nReviewed-by: Will Harris \u003cwfh@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1622647}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: e38655623b2ca9ddb59df5a54e9ba549f6ca8bcb\n" }, { "commit": "f8acb8c15965924de365958ee4d3e0cfdaebc104", "tree": "1d2b8ebbbfac099acb2d356c9af21652efb84fa7", "parents": [ "37259f7555cb32bb29e85db3ad84ba1022c6370a" ], "author": { "name": "Ian Wells", "email": "iwells@chromium.org", "time": "Wed Apr 29 16:24:20 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Apr 29 16:26:19 2026" }, "message": "Revert \"Fix mmap seccomp policy in speech recognition sandbox\"\n\nThis reverts commit d732652538cc407ab189c0dbd4804793b13b510a.\n\nReason for revert: suspected cause of compile failure that closed the tree: https://ci.chromium.org/ui/p/chromium/builders/ci/chromeos-arm-generic-dbg/131289/overview\n\nOriginal change\u0027s description:\n\u003e Fix mmap seccomp policy in speech recognition sandbox\n\u003e\n\u003e The Linux speech recognition sandbox policy incorrectly used a C++\n\u003e ternary operator with a BPF DSL expression. This caused the expression\n\u003e to be evaluated as a boolean during policy generation, which\n\u003e unconditionally evaluated to true. As a result, mmap was always allowed,\n\u003e bypassing baseline security restrictions.\n\u003e\n\u003e This CL fixes the logic by refactoring the baseline RestrictMmapFlags()\n\u003e helper to support an optional extra_allowed_mask. The speech recognition\n\u003e policy now uses this helper with MAP_POPULATE. This eliminates\n\u003e duplication of the baseline flag mask and ensures the speech recognition\n\u003e sandbox stays in sync with baseline security updates, while correctly\n\u003e allowing the required MAP_POPULATE flag.\n\u003e\n\u003e Fixed: 502023400\n\u003e Change-Id: Id4db89418b21d11aa5590115c84ad64c8e838a00\n\u003e Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7800739\n\u003e Commit-Queue: Andrew Paseltiner \u003capaseltiner@chromium.org\u003e\n\u003e Reviewed-by: Ben Scarlato \u003cakhna@google.com\u003e\n\u003e Reviewed-by: Will Harris \u003cwfh@chromium.org\u003e\n\u003e Cr-Commit-Position: refs/heads/main@{#1622456}\n\nBug: 502023400\nNo-Presubmit: true\nNo-Tree-Checks: true\nNo-Try: true\nChange-Id: Id042bc8b9f47550999e19b11b700e4ccfe5e32f9\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7803989\nBot-Commit: rubber-stamper@appspot.gserviceaccount.com \u003crubber-stamper@appspot.gserviceaccount.com\u003e\nCommit-Queue: Ian Wells \u003ciwells@chromium.org\u003e\nAuto-Submit: Ian Wells \u003ciwells@chromium.org\u003e\nOwners-Override: Ian Wells \u003ciwells@chromium.org\u003e\nReviewed-by: Ian Wells \u003ciwells@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1622502}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 867d78b2beca419f30e347620e1c768093d67e3d\n" }, { "commit": "37259f7555cb32bb29e85db3ad84ba1022c6370a", "tree": "f4151b115c178523c804b0b3df9358e3de61438d", "parents": [ "d072df6ff77fec8a22c84bcb2599daa3d2b4eff2" ], "author": { "name": "Andrew Paseltiner", "email": "apaseltiner@chromium.org", "time": "Wed Apr 29 14:59:14 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Apr 29 15:02:02 2026" }, "message": "Fix mmap seccomp policy in speech recognition sandbox\n\nThe Linux speech recognition sandbox policy incorrectly used a C++\nternary operator with a BPF DSL expression. This caused the expression\nto be evaluated as a boolean during policy generation, which\nunconditionally evaluated to true. As a result, mmap was always allowed,\nbypassing baseline security restrictions.\n\nThis CL fixes the logic by refactoring the baseline RestrictMmapFlags()\nhelper to support an optional extra_allowed_mask. The speech recognition\npolicy now uses this helper with MAP_POPULATE. This eliminates\nduplication of the baseline flag mask and ensures the speech recognition\nsandbox stays in sync with baseline security updates, while correctly\nallowing the required MAP_POPULATE flag.\n\nFixed: 502023400\nChange-Id: Id4db89418b21d11aa5590115c84ad64c8e838a00\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7800739\nCommit-Queue: Andrew Paseltiner \u003capaseltiner@chromium.org\u003e\nReviewed-by: Ben Scarlato \u003cakhna@google.com\u003e\nReviewed-by: Will Harris \u003cwfh@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1622456}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: d732652538cc407ab189c0dbd4804793b13b510a\n" }, { "commit": "d072df6ff77fec8a22c84bcb2599daa3d2b4eff2", "tree": "1d2b8ebbbfac099acb2d356c9af21652efb84fa7", "parents": [ "2c9c12ee09371b8f9875f837ef85483a727ea43b" ], "author": { "name": "mingmingtasd", "email": "mingming1.xu@intel.com", "time": "Wed Apr 29 03:49:58 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Apr 29 03:51:53 2026" }, "message": "WebNN: Add kWebNNModelCompilation sandbox type\n\nAdd a new sandbox type `kWebNNModelCompilation` for the upcoming\nWebNN Compiler utility process, which will handle ORT graph\ncompilation isolated from the GPU process.\n\nThe sandbox configuration mirrors the GPU process sandbox:\n- Token level: USER_LIMITED (same as GPU process)\n- Integrity level: LOW\n- Job level: kLimitedUser with display-related UI restrictions\n- DACL lockdown with restricting random SID\n- AppContainer (LPAC) is NOT enabled, as GPU/NPU hardware\n accelerator drivers are incompatible with it\n\nAlso:\n- Register the new sandbox type in sandbox_type.cc mappings\n- Add GetSandboxTypeInEnglish and job memory limit in\n sandbox_win.cc\n- Forward WebNN-specific command-line switches (e.g.\n --webnn-ort-logging-level) to kWebNNModelCompilation\n processes only\n- Add switch cases in chrome_content_browser_client.cc for\n GetAppContainerSidForSandboxType and PreSpawnChild\n\nThis is the first CL split from [1].\n\n[1] https://chromium-review.googlesource.com/c/chromium/src/+/7714177\n\nBug: 502249078\nChange-Id: I351319d96eb7e43c5e66e64b80560e9553f2f0d5\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7759629\nReviewed-by: Reilly Grant \u003creillyg@chromium.org\u003e\nCommit-Queue: Xu, Mingming1 \u003cmingming1.xu@intel.com\u003e\nReviewed-by: Alex Gough \u003cajgo@chromium.org\u003e\nReviewed-by: Hu, Ningxin \u003cningxin.hu@intel.com\u003e\nCr-Commit-Position: refs/heads/main@{#1622211}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 1adb86c8ac1a409b9b9f83a9abfc88e42c4c225b\n" }, { "commit": "2c9c12ee09371b8f9875f837ef85483a727ea43b", "tree": "1cd2bd0bc9b55d32c9a5fe376349f4f96eb3eac4", "parents": [ "0b13e471e5ece7e17c428a1d2bc792c630eb03a4" ], "author": { "name": "Primiano Tucci", "email": "primiano@chromium.org", "time": "Tue Apr 28 12:12:14 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue Apr 28 12:14:55 2026" }, "message": "seccomp: Add a test to ensure long term feature detection\n\nSome code in Android Platform uses the combination of\nseccomp(SECCOMP_GET_ACTION_AVAIL, 0. nullptr)\nto detect the presence of a chromium sandbox.\nThis test ensures that in future nobody accidentally\nallows it, breaking the detection on the android side.\nThis still leaves the door open to allowing\nSECCOMP_GET_ACTION_AVAIL in future, as long as the\n4th \u003d\u003d nullptr combination is still trapped with EPERM.\n\nBug: b/507048056\nChange-Id: Ifd19f3b26e9d52d908455d0b2ad3a0916b1f6ff9\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7796500\nReviewed-by: Elly \u003cellyjones@chromium.org\u003e\nAuto-Submit: Primiano Tucci \u003cprimiano@chromium.org\u003e\nCommit-Queue: Primiano Tucci \u003cprimiano@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1621684}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 81349d760b1b2a0393a3699540ac0333367f74d9\n" }, { "commit": "0b13e471e5ece7e17c428a1d2bc792c630eb03a4", "tree": "50ce054c2a634ae035526e798603a925ce33efe0", "parents": [ "3c404be92189833f8197983dee6842006960f573" ], "author": { "name": "Ho Cheung", "email": "hocheung@chromium.org", "time": "Tue Apr 21 15:19:53 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue Apr 21 15:24:14 2026" }, "message": "[sandbox] Fix SYS_SECCOMP conflict with newer glibc\n\nglibc now exposes SYS_SECCOMP in signal headers, which conflicts with\nChromium\u0027s fallback macro in linux_seccomp.h.\n\nStop defining SYS_SECCOMP in the public compat header and use a local\nfallback in trap.cc instead.\n\nTest: Tested on an Ubuntu 26.04 container using use_sysroot \u003d false.\nBug: 456218403\nChange-Id: I73ddfa85453dd9d524b64b4c1bca4f95b82c9f2b\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7781604\nReviewed-by: Elly \u003cellyjones@chromium.org\u003e\nCommit-Queue: Aaron Teo \u003chocheung@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1618207}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 83a9ccb1265dcdeeb8bf17205e00b751f86641d3\n" }, { "commit": "3c404be92189833f8197983dee6842006960f573", "tree": "9bb8e9ab14af492749fe98917434b71b6ea9fb5f", "parents": [ "2492a9343d247a882103c2bcefefe7124567c823" ], "author": { "name": "Chris Davis", "email": "chrdavis@microsoft.com", "time": "Sat Apr 18 15:46:23 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Sat Apr 18 15:48:23 2026" }, "message": "Reland \"Remove dependency on ATL Security objects\"\n\nThis reverts commit 65404b1bc402d294990921bdaec592915072644a.\n\nReason for revert: Same changes but with the patch for elevation\nservice internal unit tests to prevent chrome build break.\n\nOriginal change\u0027s description:\n\u003e Revert \"Remove dependency on ATL Security objects\"\n\u003e\n\u003e This reverts commit 9425684f8e0d4b9066062d5057f0a565f905c6f0.\n\u003e\n\u003e Reason for revert: broke win-chrome and win64-chrome builders: https://ci.chromium.org/ui/p/chrome/builders/ci/win-chrome/38679/overview\n\u003e\n\u003e Original change\u0027s description:\n\u003e \u003e Remove dependency on ATL Security objects\n\u003e \u003e\n\u003e \u003e This CL removes ATL security class dependencies (CSecurityDesc, CDacl,\n\u003e \u003e CAccessToken, CSecurityAttributes, CSid) from chrome/updater and\n\u003e \u003e chrome/enterprise_companion, replacing them with\n\u003e \u003e base::win::SecurityDescriptor, base::win::AccessToken, and\n\u003e \u003e base::win::Sid.\n\u003e \u003e\n\u003e \u003e Key changes:\n\u003e \u003e\n\u003e \u003e Security descriptor refactoring (chrome/updater/util/win_util.cc):\n\u003e \u003e\n\u003e \u003e - Replace CSecurityDesc/CDacl with base::win::SecurityDescriptor in GetCurrentUserDefaultSecurityDescriptor(),\n\u003e \u003e GetAdminDaclSecurityDescriptor(), and AddCurrentUserAllowedAce().\n\u003e \u003e - Refactor NamedObjectAttributes to accept SDDL strings instead of CSecurityDesc, managing the absolute security\n\u003e \u003e descriptor lifetime internally.\n\u003e \u003e - Fix IsCOMCallerAdmin() to use TOKEN_QUERY + CheckTokenMembership (via AccessToken::IsMember) instead of\n\u003e \u003e TOKEN_DUPLICATE + DuplicateImpersonation, which failed with\n\u003e \u003e ERROR_LOGON_SESSION_DOES_NOT_EXIST in system-service COM\n\u003e \u003e scenarios.\n\u003e \u003e - Fix CreateForegroundParentWindowForUAC() to correctly compute top-left coordinates for window centering.\n\u003e \u003e - Replace std::wstring::find() !\u003d npos with std::wstring::contains() in unit tests.\n\u003e \u003e\n\u003e \u003e base::win::SecurityDescriptor enhancement:\n\u003e \u003e\n\u003e \u003e - Add SetDaclEntry overload accepting AccessToken for convenient ACE creation using the token\u0027s user SID.\n\u003e \u003e\n\u003e \u003e Enterprise companion deduplication (app_server.cc):\n\u003e \u003e\n\u003e \u003e - Remove duplicate GetLoggedOnUserToken() implementation; reuse updater::GetLoggedOnUserToken() from\n\u003e \u003e chrome/updater/util/win_util.h.\n\u003e \u003e\n\u003e \u003e Test coverage:\n\u003e \u003e\n\u003e \u003e - Add cross-platform network_fetcher_unittest.cc with 12 tests covering NetworkFetcherFactory proxy configurations\n\u003e \u003e and LoggingNetworkFetcher delegation, error propagation, and header\n\u003e \u003e forwarding.\n\u003e \u003e - Expand win_util_unittest.cc with tests for NamedObjectAttributes, AddCurrentUserAllowedAce, and\n\u003e \u003e GetCurrentUserDefaultSecurityDescriptor.\n\u003e \u003e\n\u003e \u003e Other cleanups:\n\u003e \u003e\n\u003e \u003e - Remove components/named_system_lock dependency on ATL CSecurityAttributes.\n\u003e \u003e - Inline single-use test variables per review feedback.\n\u003e \u003e - Use base::DoNothing() instead of empty lambdas.\n\u003e \u003e\n\u003e \u003e This is a part of an ongoing effort to remove ATL from Chromium.\n\u003e \u003e\n\u003e \u003e Bug: 41184135\n\u003e \u003e Change-Id: I0e8fdd373193c73fe9e3a933a2fff378d4105589\n\u003e \u003e Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7738372\n\u003e \u003e Reviewed-by: Sorin Jianu \u003csorin@chromium.org\u003e\n\u003e \u003e Commit-Queue: Chris Davis \u003cchrdavis@microsoft.com\u003e\n\u003e \u003e Cr-Commit-Position: refs/heads/main@{#1614798}\n\u003e\n\u003e Bug: 41184135\n\u003e Change-Id: I5486729ff1b5bd3a0422d43ac192905ff5e610f5\n\u003e Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7761458\n\u003e Auto-Submit: Justin Lulejian \u003cjlulejian@chromium.org\u003e\n\u003e Bot-Commit: rubber-stamper@appspot.gserviceaccount.com \u003crubber-stamper@appspot.gserviceaccount.com\u003e\n\u003e Owners-Override: Justin Lulejian \u003cjlulejian@chromium.org\u003e\n\u003e Reviewed-by: Simon Ziegltrum \u003cziegltrum@google.com\u003e\n\u003e Commit-Queue: Justin Lulejian \u003cjlulejian@chromium.org\u003e\n\u003e Cr-Commit-Position: refs/heads/main@{#1615445}\n\nBug: 41184135\nChange-Id: I4b31a426e02c251dc7fcbf98e0940c0d5254be45\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7767058\nReviewed-by: Sorin Jianu \u003csorin@chromium.org\u003e\nReviewed-by: Alex Gough \u003cajgo@chromium.org\u003e\nCommit-Queue: Chris Davis \u003cchrdavis@microsoft.com\u003e\nCr-Commit-Position: refs/heads/main@{#1617098}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: c7f06b9157944d3608361dab75eceeab590ea9ef\n" }, { "commit": "2492a9343d247a882103c2bcefefe7124567c823", "tree": "1942abebf65a81dc8003b716501c3d65f7430b49", "parents": [ "5d45cbea21d38b7aec3ac82049163576bf30b6d1" ], "author": { "name": "Klaus", "email": "Vampirelightsss@gmail.com", "time": "Fri Apr 17 21:30:36 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Fri Apr 17 21:35:29 2026" }, "message": "[sandbox] Enable Module Tampering Protection for CIG processes\n\nWhen a kernel driver modifies the child process IAT to inject a\nnon-Microsoft-signed DLL, CIG rejects the load during import\nresolution, causing STATUS_INVALID_IMAGE_HASH and process startup\nfailure.\n\nEnable PROCESS_CREATION_MITIGATION_POLICY2_MODULE_TAMPERING_PROTECTION\n_ALWAYS_ON (Win10 RS3+) alongside CIG. This causes the loader to\ndetect IAT tampering via the SharedOriginal CoW bit and remap a clean\ncopy of the main image before imports are snapped, so the injected\nDLL never enters the import chain.\n\nBug: 499921564\nChange-Id: Ie63fa447abd7cd5e85c29c5f9ed0288a6a94a170\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7725712\nAuto-Submit: Klaus Vampirelights \u003cvampirelightsss@gmail.com\u003e\nReviewed-by: Alex Gough \u003cajgo@chromium.org\u003e\nReviewed-by: James Forshaw \u003cforshaw@chromium.org\u003e\nCommit-Queue: Alex Gough \u003cajgo@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1616862}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 60632edf877f929dab0bd0d553b12356ddf3ec15\n" }, { "commit": "5d45cbea21d38b7aec3ac82049163576bf30b6d1", "tree": "3f0328b7b7795b6ad363d74c68a98416dfdfe5a4", "parents": [ "d6ded8144a4179b30a32659283822866c9263cf6" ], "author": { "name": "Justin Lulejian", "email": "jlulejian@chromium.org", "time": "Wed Apr 15 22:12:43 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Apr 15 22:15:27 2026" }, "message": "Revert \"Remove dependency on ATL Security objects\"\n\nThis reverts commit 9425684f8e0d4b9066062d5057f0a565f905c6f0.\n\nReason for revert: broke win-chrome and win64-chrome builders: https://ci.chromium.org/ui/p/chrome/builders/ci/win-chrome/38679/overview\n\nOriginal change\u0027s description:\n\u003e Remove dependency on ATL Security objects\n\u003e\n\u003e This CL removes ATL security class dependencies (CSecurityDesc, CDacl,\n\u003e CAccessToken, CSecurityAttributes, CSid) from chrome/updater and\n\u003e chrome/enterprise_companion, replacing them with\n\u003e base::win::SecurityDescriptor, base::win::AccessToken, and\n\u003e base::win::Sid.\n\u003e\n\u003e Key changes:\n\u003e\n\u003e Security descriptor refactoring (chrome/updater/util/win_util.cc):\n\u003e\n\u003e - Replace CSecurityDesc/CDacl with base::win::SecurityDescriptor in GetCurrentUserDefaultSecurityDescriptor(),\n\u003e GetAdminDaclSecurityDescriptor(), and AddCurrentUserAllowedAce().\n\u003e - Refactor NamedObjectAttributes to accept SDDL strings instead of CSecurityDesc, managing the absolute security\n\u003e descriptor lifetime internally.\n\u003e - Fix IsCOMCallerAdmin() to use TOKEN_QUERY + CheckTokenMembership (via AccessToken::IsMember) instead of\n\u003e TOKEN_DUPLICATE + DuplicateImpersonation, which failed with\n\u003e ERROR_LOGON_SESSION_DOES_NOT_EXIST in system-service COM\n\u003e scenarios.\n\u003e - Fix CreateForegroundParentWindowForUAC() to correctly compute top-left coordinates for window centering.\n\u003e - Replace std::wstring::find() !\u003d npos with std::wstring::contains() in unit tests.\n\u003e\n\u003e base::win::SecurityDescriptor enhancement:\n\u003e\n\u003e - Add SetDaclEntry overload accepting AccessToken for convenient ACE creation using the token\u0027s user SID.\n\u003e\n\u003e Enterprise companion deduplication (app_server.cc):\n\u003e\n\u003e - Remove duplicate GetLoggedOnUserToken() implementation; reuse updater::GetLoggedOnUserToken() from\n\u003e chrome/updater/util/win_util.h.\n\u003e\n\u003e Test coverage:\n\u003e\n\u003e - Add cross-platform network_fetcher_unittest.cc with 12 tests covering NetworkFetcherFactory proxy configurations\n\u003e and LoggingNetworkFetcher delegation, error propagation, and header\n\u003e forwarding.\n\u003e - Expand win_util_unittest.cc with tests for NamedObjectAttributes, AddCurrentUserAllowedAce, and\n\u003e GetCurrentUserDefaultSecurityDescriptor.\n\u003e\n\u003e Other cleanups:\n\u003e\n\u003e - Remove components/named_system_lock dependency on ATL CSecurityAttributes.\n\u003e - Inline single-use test variables per review feedback.\n\u003e - Use base::DoNothing() instead of empty lambdas.\n\u003e\n\u003e This is a part of an ongoing effort to remove ATL from Chromium.\n\u003e\n\u003e Bug: 41184135\n\u003e Change-Id: I0e8fdd373193c73fe9e3a933a2fff378d4105589\n\u003e Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7738372\n\u003e Reviewed-by: Sorin Jianu \u003csorin@chromium.org\u003e\n\u003e Commit-Queue: Chris Davis \u003cchrdavis@microsoft.com\u003e\n\u003e Cr-Commit-Position: refs/heads/main@{#1614798}\n\nBug: 41184135\nChange-Id: I5486729ff1b5bd3a0422d43ac192905ff5e610f5\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7761458\nAuto-Submit: Justin Lulejian \u003cjlulejian@chromium.org\u003e\nBot-Commit: rubber-stamper@appspot.gserviceaccount.com \u003crubber-stamper@appspot.gserviceaccount.com\u003e\nOwners-Override: Justin Lulejian \u003cjlulejian@chromium.org\u003e\nReviewed-by: Simon Ziegltrum \u003cziegltrum@google.com\u003e\nCommit-Queue: Justin Lulejian \u003cjlulejian@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1615445}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 65404b1bc402d294990921bdaec592915072644a\n" }, { "commit": "d6ded8144a4179b30a32659283822866c9263cf6", "tree": "a25148844f604ddca8913961fbb8c07772676832", "parents": [ "9da15abe13c3ebc048827e2a667b2f351efe5527" ], "author": { "name": "Chris Davis", "email": "chrdavis@microsoft.com", "time": "Wed Apr 15 00:24:10 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Apr 15 00:26:38 2026" }, "message": "Remove dependency on ATL Security objects\n\nThis CL removes ATL security class dependencies (CSecurityDesc, CDacl,\nCAccessToken, CSecurityAttributes, CSid) from chrome/updater and\nchrome/enterprise_companion, replacing them with\nbase::win::SecurityDescriptor, base::win::AccessToken, and\nbase::win::Sid.\n\nKey changes:\n\nSecurity descriptor refactoring (chrome/updater/util/win_util.cc):\n\n - Replace CSecurityDesc/CDacl with base::win::SecurityDescriptor in GetCurrentUserDefaultSecurityDescriptor(),\nGetAdminDaclSecurityDescriptor(), and AddCurrentUserAllowedAce().\n - Refactor NamedObjectAttributes to accept SDDL strings instead of CSecurityDesc, managing the absolute security\ndescriptor lifetime internally.\n - Fix IsCOMCallerAdmin() to use TOKEN_QUERY + CheckTokenMembership (via AccessToken::IsMember) instead of\nTOKEN_DUPLICATE + DuplicateImpersonation, which failed with\nERROR_LOGON_SESSION_DOES_NOT_EXIST in system-service COM\n scenarios.\n - Fix CreateForegroundParentWindowForUAC() to correctly compute top-left coordinates for window centering.\n - Replace std::wstring::find() !\u003d npos with std::wstring::contains() in unit tests.\n\nbase::win::SecurityDescriptor enhancement:\n\n - Add SetDaclEntry overload accepting AccessToken for convenient ACE creation using the token\u0027s user SID.\n\nEnterprise companion deduplication (app_server.cc):\n\n - Remove duplicate GetLoggedOnUserToken() implementation; reuse updater::GetLoggedOnUserToken() from\nchrome/updater/util/win_util.h.\n\nTest coverage:\n\n - Add cross-platform network_fetcher_unittest.cc with 12 tests covering NetworkFetcherFactory proxy configurations\nand LoggingNetworkFetcher delegation, error propagation, and header\nforwarding.\n - Expand win_util_unittest.cc with tests for NamedObjectAttributes, AddCurrentUserAllowedAce, and\nGetCurrentUserDefaultSecurityDescriptor.\n\nOther cleanups:\n\n - Remove components/named_system_lock dependency on ATL CSecurityAttributes.\n - Inline single-use test variables per review feedback.\n - Use base::DoNothing() instead of empty lambdas.\n\nThis is a part of an ongoing effort to remove ATL from Chromium.\n\nBug: 41184135\nChange-Id: I0e8fdd373193c73fe9e3a933a2fff378d4105589\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7738372\nReviewed-by: Sorin Jianu \u003csorin@chromium.org\u003e\nCommit-Queue: Chris Davis \u003cchrdavis@microsoft.com\u003e\nCr-Commit-Position: refs/heads/main@{#1614798}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 9425684f8e0d4b9066062d5057f0a565f905c6f0\n" }, { "commit": "9da15abe13c3ebc048827e2a667b2f351efe5527", "tree": "3f0328b7b7795b6ad363d74c68a98416dfdfe5a4", "parents": [ "68cd6a76c888342f1b3a3afdb93df5e5dacdf485" ], "author": { "name": "Primiano Tucci", "email": "primiano@chromium.org", "time": "Tue Apr 14 17:58:22 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue Apr 14 18:01:28 2026" }, "message": "Allow PI futex operations on Android in the sandbox.\n\nThis change unconditionally allows priority-inheritance\nfutex operations (FUTEX_LOCK_PI, etc.) within the sandbox\non Android. These operations are used by platform code\nfor system tracing.\n\nChange-Id: I940696b5b269dbe13b5b386d37c571dbd1aa3b85\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7748930\nCommit-Queue: Primiano Tucci \u003cprimiano@chromium.org\u003e\nReviewed-by: Elly \u003cellyjones@chromium.org\u003e\nAuto-Submit: Primiano Tucci \u003cprimiano@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1614605}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 8756c7fa10540244b3ef83a4d20df81dede4a54a\n" }, { "commit": "68cd6a76c888342f1b3a3afdb93df5e5dacdf485", "tree": "bb01fb8e869e835ea15eb7485a3414a4686ec580", "parents": [ "597bd6ba996ab57861e6acfba903efc4fb0ccf14" ], "author": { "name": "Alex Gough", "email": "ajgo@chromium.org", "time": "Fri Apr 10 08:35:37 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Fri Apr 10 08:38:31 2026" }, "message": "Add akhna \u0026 ellyjones to sandbox/linux/OWNERS\n\nBug: n/a\nChange-Id: I9fa76147f954baaf4fe8267e1b4d7aa15a6becb2\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7741199\nReviewed-by: Nasko Oskov \u003cnasko@chromium.org\u003e\nCommit-Queue: Alex Gough \u003cajgo@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1612692}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: f81757a0de333e5e6bb95224e6fb9c2e97a5df37\n" }, { "commit": "597bd6ba996ab57861e6acfba903efc4fb0ccf14", "tree": "764529bcafcae2acc642e2bec40f030700c12573", "parents": [ "9bba53455376bef7ed8683d78b14a003d36bd2d9" ], "author": { "name": "Jiawei Shao", "email": "jiawei.shao@intel.com", "time": "Tue Apr 07 10:11:54 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue Apr 07 10:13:38 2026" }, "message": "[Sandbox] Add a feature to remove the job memory limit for GPU\n\nCurrently there is still a memory limit inside sandbox for GPU process,\npreventing us from running the machine learning models with WebGPU that\nneeds a large amount of memory.\n\nThis CL adds a feature to disable the job memory limit for the GPU\nprocess on Windows, by setting it to 1Tb, just like what we are\ndoing for the renderer process.\n\nWith this feature we can better measure the increase in memory usage\nand effect on stability that might occur as a result of this CL.\n\nBug: 376720478\nChange-Id: I4d83149925a279e78a56605cf8ca3f7fd3f3fc4b\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7691133\nReviewed-by: Will Harris \u003cwfh@chromium.org\u003e\nReviewed-by: Kenneth Russell \u003ckbr@chromium.org\u003e\nCommit-Queue: Shao, Jiawei \u003cjiawei.shao@intel.com\u003e\nCr-Commit-Position: refs/heads/main@{#1610644}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 705baec3c63abe88f017437dc2a8bdb88ab84fcb\n" }, { "commit": "9bba53455376bef7ed8683d78b14a003d36bd2d9", "tree": "888b50b2a55393f514f24c6fd4f36f590defbb41", "parents": [ "37aaf1a253f6a5832178983ff282ef12531f7cbf" ], "author": { "name": "Daniel Cheng", "email": "dcheng@chromium.org", "time": "Mon Apr 06 15:24:45 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Mon Apr 06 15:27:34 2026" }, "message": "Fix various IWYU errors related to base/logging.h\n\nA followup CL removes base/logging.h from validation_errors.h, which\nreveals a lot of pre-existing IWYU violations of base/logging.h and/or\nheaders included from base/logging.h.\n\nCL largely generated by gemini-cli, using an iterative process and a\nscript to add the most appropriate includes to source files that failed\nto build. Manual fixups for additional issues found via the trybots.\n\nBug: 499476145\nChange-Id: I0c06e20742765161d6a94ba1daae60cbc89a3982\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7730403\nReviewed-by: Takuto Ikuta \u003ctikuta@chromium.org\u003e\nOwners-Override: Takuto Ikuta \u003ctikuta@chromium.org\u003e\nCommit-Queue: Daniel Cheng \u003cdcheng@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1610307}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 3be1f60ad497eb027cf5b261fb36ab0b70f95dbf\n" }, { "commit": "37aaf1a253f6a5832178983ff282ef12531f7cbf", "tree": "c6e26dd079279d3912939d0cce798e8205c2981c", "parents": [ "68f759838e9ce95f59bb0fb9ac8ee9032dce1927" ], "author": { "name": "Tom Anderson", "email": "thomasanderson@chromium.org", "time": "Thu Apr 02 19:27:33 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Thu Apr 02 19:29:52 2026" }, "message": "[sandbox] Update seccomp-bpf filters for arm64 glibc\n\nThis brings linux-arm64-rel-fyi down to 89 test failures from 370.\n\nBug: 493612000\nChange-Id: Iffab6bc1c933a321680e48e5c862256f805f53cc\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7709995\nCommit-Queue: Tom Sepez \u003ctsepez@chromium.org\u003e\nReviewed-by: Tom Sepez \u003ctsepez@chromium.org\u003e\nAuto-Submit: Thomas Anderson \u003cthomasanderson@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1609428}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 29982c503d2649e4212fecebf1e5791639e35620\n" }, { "commit": "68f759838e9ce95f59bb0fb9ac8ee9032dce1927", "tree": "8ab04b78bdbbf91514b09ddeddf345d2df01a620", "parents": [ "815e874bb0c02da7a5924b3f85947591b40a2447" ], "author": { "name": "Etienne Pierre-doray", "email": "etiennep@chromium.org", "time": "Thu Apr 02 05:06:54 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Thu Apr 02 05:09:03 2026" }, "message": "[task] Inject ThreadDelegate through Thread constructor\n\nPassing the custom delegate in constructor improves encapsulation, and allows a derived class to inject its own delegate\n(needed in follow up\nhttps://chromium-review.git.corp.google.com/c/chromium/src/+/3399727)\n\nDoing so however prevents a thread to be re-started; a Restartable\noption is added to Thread and few cases are fixed.\n\nBug: 40881604\nChange-Id: I5533618bff5906f295db559da6469fc76ecf2d37\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7696887\nReviewed-by: Colin Blundell \u003cblundell@chromium.org\u003e\nReviewed-by: Dale Curtis \u003cdalecurtis@chromium.org\u003e\nReviewed-by: Gabriel Charette \u003cgab@chromium.org\u003e\nReviewed-by: Dave Tapuska \u003cdtapuska@chromium.org\u003e\nReviewed-by: Simeon Anfinrud \u003csanfin@chromium.org\u003e\nCommit-Queue: Etienne Pierre-Doray \u003cetiennep@chromium.org\u003e\nReviewed-by: Alex Gough \u003cajgo@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1608974}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 7d910347de3bdafc9d036294efe497bb1e23b24e\n" }, { "commit": "815e874bb0c02da7a5924b3f85947591b40a2447", "tree": "d1da9375ecde676bb8f40877cbe9165d17eedad0", "parents": [ "2ee2cbbf14cc888a2f77bda90a1f3e060bb10898" ], "author": { "name": "Alexei Svitkine", "email": "asvitkine@chromium.org", "time": "Thu Mar 26 16:18:00 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Thu Mar 26 16:21:35 2026" }, "message": "Cleanup: Remove histogram macros header includes in sandbox\n\nBug: None\nChange-Id: Id634c78dca926f360095e759eca749c18c285fec\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7702455\nAuto-Submit: Alexei Svitkine \u003casvitkine@chromium.org\u003e\nCommit-Queue: Jorge Lucangeli Obes \u003cjorgelo@chromium.org\u003e\nReviewed-by: Jorge Lucangeli Obes \u003cjorgelo@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1605580}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 98177db5ef1471d5d61a11583e494165346957d6\n" }, { "commit": "2ee2cbbf14cc888a2f77bda90a1f3e060bb10898", "tree": "753b915cf6e1ce23a19faa580cf2d17b61a04baf", "parents": [ "eb6cc9a1abb350b9f49ca33b6b18f7a72eb89764" ], "author": { "name": "Dale Curtis", "email": "dalecurtis@chromium.org", "time": "Tue Mar 17 23:03:31 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue Mar 17 23:07:38 2026" }, "message": "Tighten macOS GPU sandbox restrictions\n\nThese were added back in 2018 and don\u0027t seem to be necessary\nanymore.\n\nChanges suggested by mark \u003cat\u003e advert.com.au\n\nFixed: 491422244\nChange-Id: Ie7c37352b0b9fbb324611eb247bae9b4ab4ad467\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7671372\nReviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\nCommit-Queue: Dale Curtis \u003cdalecurtis@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1600856}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 7082f06110390405f1ecd750a783101b40e8fbfa\n" }, { "commit": "eb6cc9a1abb350b9f49ca33b6b18f7a72eb89764", "tree": "a0a5aab5fdfbb06308799c5653be94522fbc6456", "parents": [ "0bbf2e00ac087e4518e814718f4af09fd0ac785d" ], "author": { "name": "Will Harris", "email": "wfh@chromium.org", "time": "Fri Mar 13 19:54:50 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Fri Mar 13 20:01:10 2026" }, "message": "Revert \"Reland \"Enable network sandbox by default on Windows\"\"\n\nThis reverts commit a0ad012e15a9b40a92f88a197189d6fbb1865529.\n\nReason for revert: crbug.com/466139402 is still happening\n\nOriginal change\u0027s description:\n\u003e Reland \"Enable network sandbox by default on Windows\"\n\u003e\n\u003e This is a reland of commit c6bd7f09744da20cbba08c7ffe86537885f4353d\n\u003e\n\u003e Original change\u0027s description:\n\u003e \u003e Enable network sandbox by default on Windows\n\u003e \u003e\n\u003e \u003e This is in preparation for the full launch.\n\u003e \u003e\n\u003e \u003e BUG\u003d40091331\n\u003e \u003e\n\u003e \u003e Change-Id: I6ca7bb2c8e2367ce2e2323c6a7e21676174cc3f9\n\u003e \u003e Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7204292\n\u003e \u003e Reviewed-by: Alex Gough \u003cajgo@chromium.org\u003e\n\u003e \u003e Commit-Queue: Will Harris \u003cwfh@chromium.org\u003e\n\u003e \u003e Cr-Commit-Position: refs/heads/main@{#1550154}\n\u003e\n\u003e Bug: 40091331\n\u003e Change-Id: I1c42079dd7341844ee0d09e35195f187b934a941\n\u003e Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7655271\n\u003e Commit-Queue: Will Harris \u003cwfh@chromium.org\u003e\n\u003e Reviewed-by: Elly FJ \u003cellyjones@chromium.org\u003e\n\u003e Cr-Commit-Position: refs/heads/main@{#1597508}\n\nBug: 40091331, 466139402\nBug: 40091331\nChange-Id: I2b3cef4380b7f76ac43c0b5dc1e92212e07597bb\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7666851\nReviewed-by: mmenke \u003cmmenke@chromium.org\u003e\nCommit-Queue: Will Harris \u003cwfh@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1599266}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 41a8f03d1643249bd08a5e17bf4bc4adbc5a4918\n" }, { "commit": "0bbf2e00ac087e4518e814718f4af09fd0ac785d", "tree": "00a7d2041e36e9939720e67e034667fed83235ea", "parents": [ "e2a5f67579407ed3fd2c17ec3461f4537fa7e1ab" ], "author": { "name": "James Forshaw", "email": "forshaw@chromium.org", "time": "Wed Mar 11 16:28:11 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Mar 11 16:32:46 2026" }, "message": "[Windows] Remove legacy TestRunner code from the sandbox tests.\n\nThis CL removes the legacy TestRunner class and removes unneeded code.\nThe GenericTestRunner class is stripped down to the bare minimum, the\nimplementation of RunTest is instead moved to the base class with the\ncommand passed in via the constructor. This allows test runners to\nbe passed back as pointers to the base class making usage more generic.\n\nBug: 447171244\nChange-Id: I714760d695d1f18eb610ef7a137d9ea0bf787f85\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7656229\nReviewed-by: Will Harris \u003cwfh@chromium.org\u003e\nCommit-Queue: James Forshaw \u003cforshaw@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1597808}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 8dacc768f23547fc0eafa131b338065bc2705692\n" }, { "commit": "e2a5f67579407ed3fd2c17ec3461f4537fa7e1ab", "tree": "afe18c5d42465fe1a60e19145a7dc2a1dbde9bb4", "parents": [ "ab1e3e98559a6ed63f03e8528950ea9f65834b7b" ], "author": { "name": "Will Harris", "email": "wfh@chromium.org", "time": "Wed Mar 11 04:01:29 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Mar 11 04:07:11 2026" }, "message": "Reland \"Enable network sandbox by default on Windows\"\n\nThis is a reland of commit c6bd7f09744da20cbba08c7ffe86537885f4353d\n\nOriginal change\u0027s description:\n\u003e Enable network sandbox by default on Windows\n\u003e\n\u003e This is in preparation for the full launch.\n\u003e\n\u003e BUG\u003d40091331\n\u003e\n\u003e Change-Id: I6ca7bb2c8e2367ce2e2323c6a7e21676174cc3f9\n\u003e Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7204292\n\u003e Reviewed-by: Alex Gough \u003cajgo@chromium.org\u003e\n\u003e Commit-Queue: Will Harris \u003cwfh@chromium.org\u003e\n\u003e Cr-Commit-Position: refs/heads/main@{#1550154}\n\nBug: 40091331\nChange-Id: I1c42079dd7341844ee0d09e35195f187b934a941\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7655271\nCommit-Queue: Will Harris \u003cwfh@chromium.org\u003e\nReviewed-by: Elly FJ \u003cellyjones@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1597508}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: a0ad012e15a9b40a92f88a197189d6fbb1865529\n" }, { "commit": "ab1e3e98559a6ed63f03e8528950ea9f65834b7b", "tree": "a8eb7b40f1edb52b2aeaf739154bd5fcf5c28686", "parents": [ "fc6163b5766901d7630916bdb430f28d8de5c027" ], "author": { "name": "Arthur Sonzogni", "email": "arthursonzogni@chromium.org", "time": "Tue Mar 10 23:58:26 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Mar 11 00:05:21 2026" }, "message": "Convert to UNSAFE_TODO in sandbox\n\nThis is an automated #cleanup patch using the [Script] below.\n\nWe are migrating from coarse-grained file-level suppression (#pragma\nallow_unsafe_buffers) to granular, expression-level markers\n(UNSAFE_TODO()). The pragma disables safety checks for an entire file,\nwhereas UNSAFE_TODO() isolates specific potentially unsafe operations,\nallowing the rest of the file to be enforced as safe.\n\nThis CL was uploaded by git cl split.\n\nThis CL was uploaded by an experimental version of git cl split\n(https://crbug.com/389069356).\n\nScript: https://docs.google.com/document/d/1ORQGBNn2R-CEvNbDTjRd-GrOBOFlCxIHdcvSUA_EhR4/edit?usp\u003dsharing\nAX-Relnotes: N/A\nCleanup: This is an automated #cleanup.\nBug: 409340989\nChange-Id: Ief88a0d1fb4c042a3a2233f8e43e563e89346700\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7552772\nAuto-Submit: Arthur Sonzogni \u003carthursonzogni@chromium.org\u003e\nReviewed-by: Tom Sepez \u003ctsepez@chromium.org\u003e\nCommit-Queue: Arthur Sonzogni \u003carthursonzogni@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1597413}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 39de2dcaf5aadf02cb722dae255a93c1d8d2c240\n" }, { "commit": "fc6163b5766901d7630916bdb430f28d8de5c027", "tree": "3319123159ac0bdc2d6bcd5520756644b836075e", "parents": [ "b4a606e68e9092e52d20509afe96708a04dff92c" ], "author": { "name": "James Forshaw", "email": "forshaw@chromium.org", "time": "Tue Mar 10 20:37:30 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue Mar 10 20:44:30 2026" }, "message": "[Windows] Refactor remaining old style TestRunner integration tests.\n\nThis CL refactors the remaining integration tests then rely on the\nold style TestRunner class.\n\nBug: 447171244\nChange-Id: Ib52065ea939480d6fa9d226b715d54ea33b7d47e\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7651916\nReviewed-by: Will Harris \u003cwfh@chromium.org\u003e\nCommit-Queue: James Forshaw \u003cforshaw@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1597285}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: a46d026734858ae96a80416f24f821d0362777a1\n" }, { "commit": "b4a606e68e9092e52d20509afe96708a04dff92c", "tree": "4a9f61c76760aa8dc50a1b48c0cd3c27237c327b", "parents": [ "1eae871aa15aecf6ca1f71993ed97eecd868e4b7" ], "author": { "name": "James Forshaw", "email": "forshaw@chromium.org", "time": "Tue Mar 10 16:28:38 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue Mar 10 16:35:01 2026" }, "message": "[Windows] Refactor integration tests for process mitigations.\n\nThis CL refactors tests process mitigations to use the new generic test\nrunner. A new header file has been created to allow sharing of the test\nrunners between source files.\n\nBug: 447171244\nChange-Id: If2062eb0d8f198724d7d74a1645525668a18d0b7\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7649251\nReviewed-by: Will Harris \u003cwfh@chromium.org\u003e\nCommit-Queue: James Forshaw \u003cforshaw@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1597122}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 3db47bd0355c1eaafdd69a3af7d632d6a584886e\n" }, { "commit": "1eae871aa15aecf6ca1f71993ed97eecd868e4b7", "tree": "f4dc786b8d2eb744af431d38d5cdd99d5167d664", "parents": [ "88e03e3c68c0dec89cbbade33663672601104572" ], "author": { "name": "Francisco Ochoa", "email": "frankchavez@google.com", "time": "Mon Mar 09 18:49:54 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Mon Mar 09 18:55:26 2026" }, "message": "spanification: automatically spanify sandbox/linux/bpf_dsl/test_trap_registry_unittest.cc etc.\n\nThis is the result of running the automatic spanification on linux and\nupdating code to use and pass spans where size is known.\n\nThe original patch was fully automated using script:\n//tools/clang/spanify/rewrite-multiple-platforms.sh -platforms\u003dlinux\nThen refined with gemini-cli\n\ngemini-run/batch-run-1761710114/group_43\n\nBug: 439964610\nChange-Id: I79717cc87502c4f6f4b7790f860ac8b8b70342b3\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7639759\nReviewed-by: Matthew Denton \u003cmpdenton@chromium.org\u003e\nAuto-Submit: Francisco Ochoa \u003cfrankchavez@google.com\u003e\nCommit-Queue: Arthur Sonzogni \u003carthursonzogni@chromium.org\u003e\nReviewed-by: Arthur Sonzogni \u003carthursonzogni@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1596482}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 26677e8b7be512f12c88a53af72114078f4ff106\n" }, { "commit": "88e03e3c68c0dec89cbbade33663672601104572", "tree": "d275f61326fed0910d80b709d18e200767d40852", "parents": [ "ffe1f9282990b56e101c4faf96782437ad5fe02f" ], "author": { "name": "James Forshaw", "email": "forshaw@chromium.org", "time": "Mon Mar 09 18:13:07 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Mon Mar 09 18:17:55 2026" }, "message": "[Windows] Refactor integration tests for IPC, LPC, Warmup and Handles.\n\nThis CL refactors tests for IPC leak, LPC policy, sandbox warmup, and\nhandle inheritance to use the new generic test runner.\n\nBug: 447171244\nChange-Id: Ic6d4a373ed0bd0098fb09f40240f2a78998324fd\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7648708\nReviewed-by: Alex Gough \u003cajgo@chromium.org\u003e\nCommit-Queue: James Forshaw \u003cforshaw@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1596467}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: fcb6b9608d3d2743aff455347474792b0b565abd\n" }, { "commit": "ffe1f9282990b56e101c4faf96782437ad5fe02f", "tree": "f059558f7039b85758cc4f7421f3b59cb5803923", "parents": [ "f2387b2f9d915edf623bae9db33995c397211b5c" ], "author": { "name": "James Forshaw", "email": "forshaw@chromium.org", "time": "Mon Mar 09 17:50:57 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Mon Mar 09 17:56:15 2026" }, "message": "[Windows] Refactor sandbox validation tests.\n\nThis CL refactors the sandbox validation tests to use the new generic\ntest runner.\n\nBug: 447171244\nChange-Id: I9b843ffbd1da798bcc6c89cc4f29f6174ae6abf0\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7646652\nCommit-Queue: James Forshaw \u003cforshaw@chromium.org\u003e\nReviewed-by: Will Harris \u003cwfh@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1596449}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: ced2af7e14f2db046c399fac0736a130260d02a7\n" }, { "commit": "f2387b2f9d915edf623bae9db33995c397211b5c", "tree": "721b81eb57ac6ea5b43ce447ee81077d01f69fee", "parents": [ "9e6fda197bebef62f0f012400e7ffc78625e8d20" ], "author": { "name": "James Forshaw", "email": "forshaw@chromium.org", "time": "Mon Mar 09 16:59:15 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Mon Mar 09 17:05:59 2026" }, "message": "[Windows] Refactor integration tests for ZeroAppShim and DLL unloading.\n\nThis CL refactors tests for ZeroAppShim and DLL unloading to use the\nnew generic test runner.\n\nBug: 447171244\nChange-Id: I278a3b6f6a1d52d9517a7a3f538c6ad91d58f964\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7646135\nCommit-Queue: James Forshaw \u003cforshaw@chromium.org\u003e\nReviewed-by: Will Harris \u003cwfh@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1596412}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 710ba2c349c6d32c2ad189e93d20c5923c8936a7\n" }, { "commit": "9e6fda197bebef62f0f012400e7ffc78625e8d20", "tree": "24d4aac8d6100aec875fb55f80f9f32ce85c159f", "parents": [ "94a49cc7628d7b38b526160855f786b02f7809c5" ], "author": { "name": "James Forshaw", "email": "forshaw@chromium.org", "time": "Sat Mar 07 20:03:15 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Sat Mar 07 20:07:42 2026" }, "message": "[Windows] Refactor integration tests for integrity levels.\n\nThis CL refactors tests for integrity levels to use the new generic\ntest runner.\n\nBug: 447171244\nChange-Id: I2522aaec48413f97f7e110e0e9663a7438ca7622\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7644728\nCommit-Queue: James Forshaw \u003cforshaw@chromium.org\u003e\nReviewed-by: Will Harris \u003cwfh@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1595973}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: c67aa02ba757bd502acb3c85139b5681130a1609\n" }, { "commit": "94a49cc7628d7b38b526160855f786b02f7809c5", "tree": "4dd39236d398338b1e3ce33e9cfa22bbf1d7216f", "parents": [ "59415c22ab1a7c92eb45a0befa54caad00657ee1" ], "author": { "name": "James Forshaw", "email": "forshaw@chromium.org", "time": "Sat Mar 07 09:54:23 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Sat Mar 07 10:01:07 2026" }, "message": "[Windows] Refactor integration tests for IPC, Handle Closer, ASAN.\n\nThis CL refactors tests for IPC, Handle Closer and ASAN to use the\nnew generic test runner. It also contains a change to the controller\nto add support for wide character string pointers.\n\nBug: 447171244\nChange-Id: I17210589ed85ceb2abd031a854d91f7ee2548c0d\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7642894\nReviewed-by: Alex Gough \u003cajgo@chromium.org\u003e\nCommit-Queue: James Forshaw \u003cforshaw@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1595912}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 84f44e331528705536e7629cb3596ba8da8f7f66\n" }, { "commit": "59415c22ab1a7c92eb45a0befa54caad00657ee1", "tree": "c054c93b8064d0cbc177dfc0c8bf612347ecfd0f", "parents": [ "2ab77c94c3c87eded403b87b454f9805a7f7890e" ], "author": { "name": "James Forshaw", "email": "forshaw@chromium.org", "time": "Sat Mar 07 09:51:09 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Sat Mar 07 09:56:58 2026" }, "message": "[Windows] Refactor integration tests for AppContainer.\n\nThis CL refactors tests for AppContainer to use the new generic test\nrunner.\n\nBug: 447171244\nChange-Id: Idc4522179267a08889c8fc69f5dca3c4316ee709\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7643914\nCommit-Queue: James Forshaw \u003cforshaw@chromium.org\u003e\nReviewed-by: Alex Gough \u003cajgo@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1595910}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 7a39ae18d6c684e568b69e886f89a55d8c471558\n" }, { "commit": "2ab77c94c3c87eded403b87b454f9805a7f7890e", "tree": "5598354f7025b33b2d0b3ffc5bc31e978d031a6e", "parents": [ "a6b198e11b0d9a3a1befd66d96754799644205cd" ], "author": { "name": "Omar Ramadan", "email": "omar@blockcast.net", "time": "Sat Mar 07 01:11:50 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Sat Mar 07 01:18:04 2026" }, "message": "Allow MCAST_JOIN/LEAVE_SOURCE_GROUP in network service seccomp filter\n\nAdd MCAST_JOIN_SOURCE_GROUP and MCAST_LEAVE_SOURCE_GROUP to the BPF\nsetsockopt allowlist for the network service process. These socket\noptions are used by IGMPv3/MLDv2 source-specific multicast (SSM),\nwhich is needed for the Direct Sockets API SSM feature.\n\nWithout this allowlist entry, any SSM setsockopt call from the network\nservice hits CrashSIGSYSSockopt() and kills the process.\n\nBug: 461262401\nChange-Id: Ideff9275c1fb4f08d0bc6ce98dbee9a8bfbdf4d1\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7641869\nReviewed-by: Reilly Grant \u003creillyg@chromium.org\u003e\nCommit-Queue: Reilly Grant \u003creillyg@chromium.org\u003e\nReviewed-by: Matthew Denton \u003cmpdenton@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1595817}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: acf38610f12403205046ed055c58e954b165421a\n" }, { "commit": "a6b198e11b0d9a3a1befd66d96754799644205cd", "tree": "f19f12431a9b72aad1da38ba38af4849a72e8646", "parents": [ "b82014a9387d8ccf291507380a2dacf18ea73ffc" ], "author": { "name": "James Forshaw", "email": "forshaw@chromium.org", "time": "Fri Mar 06 18:36:53 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Fri Mar 06 18:42:50 2026" }, "message": "[Windows] Update sandbox policy rule fuzzer to use wstring_view.\n\nThis CL updates the sandbox policy rule fuzzer to use the correct\ntype for string parameters. The code wasn\u0027t updated when the sandbox\nimplementation was changed to use std::wstring_view from a raw wchar_t\npointer. This resulted in an out of bounds read on the stack. This was\nonly a bug in the fuzzer, it was not a security issue in the sandbox\ncode itself.\n\nBug: 490139165\nChange-Id: If85670ff72bce0aecdba97f991692d57407f65b9\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7642848\nCommit-Queue: James Forshaw \u003cforshaw@chromium.org\u003e\nReviewed-by: Alex Gough \u003cajgo@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1595515}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 9119844985b63a54902b2d408b52d9973c930c3f\n" }, { "commit": "b82014a9387d8ccf291507380a2dacf18ea73ffc", "tree": "72543ee4703c7bf40a00eeb529209ccba226cc0f", "parents": [ "831481e9ece61996db196b6066514ac3e5cb9e96" ], "author": { "name": "James Forshaw", "email": "forshaw@chromium.org", "time": "Sat Feb 28 01:13:44 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Sat Feb 28 01:23:24 2026" }, "message": "[Windows] Update select tests to use new TestRunner API.\n\nThis CL completes the changes needed to implement the new generic\nTestRunner API. It includes changes to some select tests to ensure\nthat they function correctly.\n\nBug: 447171244\nChange-Id: Iba330d11148d80b1cafef0ed446019485d487cac\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7615011\nReviewed-by: Alex Gough \u003cajgo@chromium.org\u003e\nCommit-Queue: James Forshaw \u003cforshaw@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1591917}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 7b688cd2ddf43056958761e6e32569431508ef93\n" }, { "commit": "831481e9ece61996db196b6066514ac3e5cb9e96", "tree": "8a0d73be063bcd6571fe6df96c311d7fa304eba3", "parents": [ "065e9b434f602da13b0bcd7bfc35cae1b3ce0996" ], "author": { "name": "James Forshaw", "email": "forshaw@chromium.org", "time": "Sat Feb 28 00:43:19 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Sat Feb 28 00:48:40 2026" }, "message": "[Windows] Implement new sandbox test runner API.\n\nThis CL implements a new API for running tests in sandbox processes.\nIt removes the need to build up a command line string and instead\nallows the passing of arguments directly to the RunTest method. The\nCL leaves the old API available for existing code until it can be\nchanged.\n\nBug: 447171244\nChange-Id: I5a7188668622628d30055b3adb7f87ad9f309258\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7609501\nReviewed-by: Alex Gough \u003cajgo@chromium.org\u003e\nCommit-Queue: James Forshaw \u003cforshaw@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1591903}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: f6e64900d7d9a426f201bb2481f10bca38d8eddb\n" }, { "commit": "065e9b434f602da13b0bcd7bfc35cae1b3ce0996", "tree": "1e614c700c3654bc61a091b0c8de3f1f2cb2fe4b", "parents": [ "faf36c36bd4fd24d94d05c6db208a9b1a21a55cd" ], "author": { "name": "James Forshaw", "email": "forshaw@chromium.org", "time": "Tue Feb 24 11:17:30 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue Feb 24 11:22:54 2026" }, "message": "[Windows] Rework TestRunner dispatch and remove unsafe buffers.\n\nThis CL reworks the dispatch for the TestRunner to remove unsafe\nbuffer usage. It also changes the command line format so that the\nbase::CommandLine class can be used to create the process. Additionally\nbase strings have been converted to string views.\n\nBug: 447171244\nChange-Id: I934f1e2ab42f10641240934574cf9f3aed3c1aab\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7594523\nReviewed-by: Alex Gough \u003cajgo@chromium.org\u003e\nCommit-Queue: James Forshaw \u003cforshaw@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1589292}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 2bf81ebd5460d4fd19f8ef19a699d8aa67eff07d\n" }, { "commit": "faf36c36bd4fd24d94d05c6db208a9b1a21a55cd", "tree": "2216c944c929482ed2aa76e53abb3f7ddbf6c8a2", "parents": [ "10dec33db620b652673cc7f2a31bc91d721c58e9" ], "author": { "name": "James Forshaw", "email": "forshaw@chromium.org", "time": "Fri Feb 20 08:58:16 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Fri Feb 20 09:05:36 2026" }, "message": "[Windows] Use base::CommandLine in SpawnTargetAsync.\n\nThis CL changes SpawnTargetAsync to accept a base::CommandLine argument\nfor the new process\u0027 command line. This will allow for simplification\nof the test runner to remove unsafe memory access from the runner itself\nas well as in the test callbacks. It also introduces a new test only\nfunction to generate a command line for a command so that the format\nof the command line can change without needing to change the test.\n\nBug: 447171244\nChange-Id: Idb9412fc9a0aa0f2b35877ebe61f433af1e71363\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7594517\nReviewed-by: Alex Gough \u003cajgo@chromium.org\u003e\nCommit-Queue: James Forshaw \u003cforshaw@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1587669}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 7d5676168c848880a00bf85c3b6a4b15f8afe443\n" }, { "commit": "10dec33db620b652673cc7f2a31bc91d721c58e9", "tree": "64729855c70a8d6560b20d0a39c837beb7e4ef3f", "parents": [ "4f48746e1ad830ed155f68f11c0bd308222649d3" ], "author": { "name": "James Forshaw", "email": "forshaw@chromium.org", "time": "Thu Feb 19 17:22:10 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Thu Feb 19 17:28:49 2026" }, "message": "[Windows] Use string_view for sandbox policy interface.\n\nThis CL replaces use of bare string pointers for wstring_view in the\nsandbox policy interface. It includes changes necessary to support\nthis in the some process launch delegates.\n\nBug: 447171244\nChange-Id: I1fe104f54f4b5f6f7dec342cc5d5d19762a665ab\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7576555\nReviewed-by: Alex Gough \u003cajgo@chromium.org\u003e\nCommit-Queue: James Forshaw \u003cforshaw@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1587215}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 3cc7d6aa1b352511cb9595bfe36ecc023ae100f5\n" }, { "commit": "4f48746e1ad830ed155f68f11c0bd308222649d3", "tree": "61702a9bfe2b325361e1409bd57f3bb098ad801f", "parents": [ "114deb396c6328cdd4e3f511bd5e57db185637bc" ], "author": { "name": "James Forshaw", "email": "forshaw@chromium.org", "time": "Wed Feb 18 19:12:15 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Feb 18 19:18:25 2026" }, "message": "[Windows] Convert Sid class to using wstring_view and span.\n\nThis CL includes a few small changes to the base::win::Sid class to use\nwstring_view and span with a minor change in one of the Windows file\nutilities to support the slightly different API.\n\nBug: 447171244\nChange-Id: I2d47c404567bd419fc70468b21826bf825671fd5\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7581957\nReviewed-by: Alex Gough \u003cajgo@chromium.org\u003e\nCommit-Queue: James Forshaw \u003cforshaw@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1586568}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 00ed769b082c64d21ad4c1b74358a2d322672c8e\n" }, { "commit": "114deb396c6328cdd4e3f511bd5e57db185637bc", "tree": "1311ec73382b918f418beb1fd0769d550c0480c2", "parents": [ "469b8b6457566cb66c7378a96c2c8a8a7d00bb5f" ], "author": { "name": "Stanisław Solarewicz", "email": "ssolarewicz@chromium.org", "time": "Fri Feb 13 11:23:49 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Fri Feb 13 11:28:56 2026" }, "message": "[Okta SSO] Execute URLSessionURLLoader in the Network Service\n\nThis change moves the instantiation and execution of\n`URLSessionURLLoader` to the Network Service to improve security and\narchitectural layering. Previously, this logic resided in the browser\nprocess.\n\nTo this end the `network_service.mojo` is updated to expose a new\nfunction: `CreateURLSessionURLLoaderAndStart`.\nThe `ProxyingURLLoaderFactory` is updated to forward requests to the\n`NetworkService` via this new method.\n\nAdditionally, this updates the macOS sandbox policy to allow the Network\nService to communicate with `com.apple.AppSSO.service-xpc`, which is\nrequired for the Okta SSO flow via `URLSession`.\n\nThis integration is already tested in\nchrome/browser/enterprise/platform_auth/extensible_enterprise_sso_okta_browsertest.mm.\n\nBug: b:433226247, 472326815\nDD: go/cec-okta-sso-dd\nBypass-Check-License: Parent cl moves existing files\nChange-Id: I1363a073b01ebdb377539c72ee32242d0f57a798\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7531759\nReviewed-by: Thomas Nguyen \u003ctungnh@chromium.org\u003e\nReviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\nReviewed-by: Igor Ruvinov \u003cigorruvinov@chromium.org\u003e\nReviewed-by: Adam Rice \u003cricea@chromium.org\u003e\nCommit-Queue: Stanisław Solarewicz \u003cssolarewicz@chromium.org\u003e\nReviewed-by: Arthur Sonzogni \u003carthursonzogni@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1584555}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 38530d3136901a4aaaca7731610a9885d8b39852\n" } ], "next": "469b8b6457566cb66c7378a96c2c8a8a7d00bb5f" }