fix: stop embed thread before destroying environments in worker teardown

FreeEnvironment (called via environments_.clear()) runs uv_run to drain
handle close callbacks. On Windows, both that uv_run and the embed
thread's PollEvents call GetQueuedCompletionStatus on the same IOCP
handle. IOCP completions are consumed by exactly one waiter, so the
embed thread can steal completions that FreeEnvironment needs, causing
uv_run to block indefinitely. On Linux/Mac epoll_wait/kevent can wake
multiple waiters for the same event so the race doesn't manifest.

Add NodeBindings::StopPolling() which cleanly joins the embed thread
without destroying handles or the loop, and allows PrepareEmbedThread +
StartPolling to restart it later. Call StopPolling() in
WebWorkerObserver::ContextWillDestroy before environments_.clear() so
FreeEnvironment's uv_run is the only thread touching the IOCP.

Split PrepareEmbedThread's handle initialization (uv_async_init,
uv_sem_init) from thread creation via a new embed_thread_prepared_ flag
so the handles survive across stop/restart cycles for pooled worklets
while the embed thread itself can be recreated.

DEPS

@@ -2,7 +2,7 @@ gclient_gn_args_from = 'src'
 
 vars = {
   'chromium_version':
-    '148.0.7768.0',
+    '148.0.7778.0',
   'node_version':
     'v24.14.1',
   'nan_version':

docs/api/menu-item.md

@@ -63,17 +63,10 @@ See [`Menu`](menu.md) for examples.
   * `afterGroupContaining` string[] (optional) - Provides a means for a single context menu to declare
     the placement of their containing group after the containing group of the item
     with the specified id.
-  * `badge` Object (optional) _macOS_ - Only available on macOS 14 and up.
-    * `type` string (optional) - Can be one of `alerts`, `updates`, `new-items` or `none`. Default is `none`.
-    * `count` number (optional) - The number of items the badge displays. Cannot be used with `type: 'none'`.
-    * `content` string (optional) - A custom string to display in the badge. Only usable with `type: 'none'`.
 
 > [!NOTE]
 > `acceleratorWorksWhenHidden` is specified as being macOS-only because accelerators always work when items are hidden on Windows and Linux. The option is exposed to users to give them the option to turn it off, as this is possible in native macOS development.
 
-> [!NOTE]
-> If you use one of the predefined badge types on macOS (not 'none'), the system localizes and pluralizes the string for you. If you create your own custom badge string, you need to localize and pluralize that string yourself.
-
 ### Instance Properties
 
 The following properties are available on instances of `MenuItem`:
@@ -188,9 +181,3 @@ A `number` indicating an item's sequential unique id.
 #### `menuItem.menu`
 
 A [`Menu`](menu.md) that the item is a part of.
-
-#### `menuItem.badge` _macOS_
-
-An [`MenuItemBadge`](structures/menu-item-badge.md) indicating the badge for the menu item.
-
-This property can be dynamically changed. Only available on macOS 14 and up.

docs/api/structures/menu-item-badge.md

@@ -1,5 +0,0 @@
-# MenuItemBadge Object
-
-* `type` string (optional) - Can be one of `alerts`, `updates`, `new-items` or `none`. Default is `none`.
-* `count` number (optional) - The number of items the badge displays. Cannot be used with `type: 'none'`.
-* `content` string (optional) - A custom string to display in the badge. Only usable with `type: 'none'`.

filenames.auto.gni

@@ -111,7 +111,6 @@ auto_filenames = {
     "docs/api/structures/media-access-permission-request.md",
     "docs/api/structures/memory-info.md",
     "docs/api/structures/memory-usage-details.md",
-    "docs/api/structures/menu-item-badge.md",
     "docs/api/structures/mime-typed-buffer.md",
     "docs/api/structures/mouse-input-event.md",
     "docs/api/structures/mouse-wheel-input-event.md",

lib/browser/api/menu-item.ts

@@ -38,24 +38,6 @@ const MenuItem = function (this: any, options: any) {
   this.overrideProperty('acceleratorWorksWhenHidden', true);
   this.overrideProperty('registerAccelerator', roles.shouldRegisterAccelerator(this.role));
 
-  if (process.platform === 'darwin') {
-    let badgeValue = options.badge;
-    Object.defineProperty(this, 'badge', {
-      get: () => badgeValue,
-      set: (newValue) => {
-        badgeValue = newValue;
-        // Update native badge if this item is already in a menu
-        if (this.menu) {
-          const index = this.menu.getIndexOfCommandId(this.commandId);
-          if (index !== -1 && badgeValue) {
-            this.menu.setBadge(index, badgeValue);
-          }
-        }
-      },
-      enumerable: true
-    });
-  }
-
   if (!MenuItem.types.includes(this.type)) {
     throw new Error(`Unknown menu item type: ${this.type}`);
   }

lib/browser/api/menu.ts

@@ -176,9 +176,6 @@ Menu.prototype.insert = function (pos, item) {
   if (item.type === 'palette' || item.type === 'header') {
     this.setCustomType(pos, item.type);
   }
-  if (process.platform === 'darwin' && item.badge) {
-    this.setBadge(pos, item.badge);
-  }
 
   // Make menu accessible to items.
   item.overrideReadOnlyProperty('menu', this);

patches/boringssl/expose_ripemd160.patch

@@ -10,10 +10,10 @@ this patch is required to provide ripemd160 support in the nodejs crypto
 module.
 
 diff --git a/crypto/digest/digest_extra.cc b/crypto/digest/digest_extra.cc
-index 17961ba6bd9de78b5b1b1008eb1f73babd49d0e7..6a870dce37df8f49106c24b183308a2c7a03fd7d 100644
+index d38e0c1132da60ec96c3a5c2416ff07589f03b80..cd60baaf22a8d5dc20544d861d36b7d74d986e7b 100644
 --- a/crypto/digest/digest_extra.cc
 +++ b/crypto/digest/digest_extra.cc
-@@ -47,6 +47,7 @@ static const struct nid_to_digest nid_to_digest_mapping[] = {
+@@ -48,6 +48,7 @@ static const struct nid_to_digest nid_to_digest_mapping[] = {
      {NID_sha512, EVP_sha512, SN_sha512, LN_sha512},
      {NID_sha512_256, EVP_sha512_256, SN_sha512_256, LN_sha512_256},
      {NID_md5_sha1, EVP_md5_sha1, SN_md5_sha1, LN_md5_sha1},
@@ -62,10 +62,10 @@ index a246a51103701e0ac8a0722324350a462f95bcc9..ddf0a90337d4e40de09bc345cf959dff
 +
  #undef CHECK
 diff --git a/decrepit/evp/evp_do_all.cc b/decrepit/evp/evp_do_all.cc
-index feaf17c72cecb8099bc11ac10747fbad719ddca9..891a73f229e3f0838cb2fa99b8fb24fdeac1962b 100644
+index 584b1390a841cc1b1dcb69e16d8242a88e4bb9cb..637aeccb8de8d793eabc38e32bef6834ac0e6ad3 100644
 --- a/decrepit/evp/evp_do_all.cc
 +++ b/decrepit/evp/evp_do_all.cc
-@@ -79,6 +79,7 @@ void EVP_MD_do_all_sorted(void (*callback)(const EVP_MD *cipher,
+@@ -82,6 +82,7 @@ void EVP_MD_do_all_sorted(void (*callback)(const EVP_MD *md,
    callback(EVP_sha384(), "SHA384", nullptr, arg);
    callback(EVP_sha512(), "SHA512", nullptr, arg);
    callback(EVP_sha512_256(), "SHA512-256", nullptr, arg);
@@ -73,16 +73,16 @@ index feaf17c72cecb8099bc11ac10747fbad719ddca9..891a73f229e3f0838cb2fa99b8fb24fd
  
    callback(EVP_md4(), "md4", nullptr, arg);
    callback(EVP_md5(), "md5", nullptr, arg);
-@@ -88,6 +89,7 @@ void EVP_MD_do_all_sorted(void (*callback)(const EVP_MD *cipher,
+@@ -91,6 +92,7 @@ void EVP_MD_do_all_sorted(void (*callback)(const EVP_MD *md,
    callback(EVP_sha384(), "sha384", nullptr, arg);
    callback(EVP_sha512(), "sha512", nullptr, arg);
    callback(EVP_sha512_256(), "sha512-256", nullptr, arg);
 +  callback(EVP_ripemd160(), "ripemd160", nullptr, arg);
  }
  
- void EVP_MD_do_all(void (*callback)(const EVP_MD *cipher, const char *name,
+ void EVP_MD_do_all(void (*callback)(const EVP_MD *md, const char *name,
 diff --git a/include/openssl/digest.h b/include/openssl/digest.h
-index 40670234682ac00dec268dea43f0ee1e39e8684f..293fbc9faf01ea0ca4e58b0a65b14597fe4916a6 100644
+index 62ad57368cb3059ee25df08bb07876fef499de2e..322daef194b3c7b73011419bb74bccb311eb03a5 100644
 --- a/include/openssl/digest.h
 +++ b/include/openssl/digest.h
 @@ -48,6 +48,9 @@ OPENSSL_EXPORT const EVP_MD *EVP_blake2b256(void);

patches/boringssl/feat_expose_several_extra_cipher_functions.patch

@@ -64,10 +64,10 @@ index dabc54aa13745600a62e57ecbb427e48a4565282..ce213e00573102ce9405a794d3c140d9
  
  const EVP_CIPHER *EVP_get_cipherbynid(int nid) {
 diff --git a/decrepit/evp/evp_do_all.cc b/decrepit/evp/evp_do_all.cc
-index 891a73f229e3f0838cb2fa99b8fb24fdeac1962b..f7d0c5dc66f016eb9338c15e7f5ef59e6de2969d 100644
+index 637aeccb8de8d793eabc38e32bef6834ac0e6ad3..c5dd0b18d7338457e47ae47088d9822472b24212 100644
 --- a/decrepit/evp/evp_do_all.cc
 +++ b/decrepit/evp/evp_do_all.cc
-@@ -20,8 +20,10 @@ void EVP_CIPHER_do_all_sorted(void (*callback)(const EVP_CIPHER *cipher,
+@@ -23,8 +23,10 @@ void EVP_CIPHER_do_all_sorted(void (*callback)(const EVP_CIPHER *cipher,
                                                 const char *unused, void *arg),
                                void *arg) {
    callback(EVP_aes_128_cbc(), "AES-128-CBC", nullptr, arg);
@@ -78,7 +78,7 @@ index 891a73f229e3f0838cb2fa99b8fb24fdeac1962b..f7d0c5dc66f016eb9338c15e7f5ef59e
    callback(EVP_aes_128_ctr(), "AES-128-CTR", nullptr, arg);
    callback(EVP_aes_192_ctr(), "AES-192-CTR", nullptr, arg);
    callback(EVP_aes_256_ctr(), "AES-256-CTR", nullptr, arg);
-@@ -34,9 +36,13 @@ void EVP_CIPHER_do_all_sorted(void (*callback)(const EVP_CIPHER *cipher,
+@@ -37,9 +39,13 @@ void EVP_CIPHER_do_all_sorted(void (*callback)(const EVP_CIPHER *cipher,
    callback(EVP_aes_128_gcm(), "AES-128-GCM", nullptr, arg);
    callback(EVP_aes_192_gcm(), "AES-192-GCM", nullptr, arg);
    callback(EVP_aes_256_gcm(), "AES-256-GCM", nullptr, arg);
@@ -92,7 +92,7 @@ index 891a73f229e3f0838cb2fa99b8fb24fdeac1962b..f7d0c5dc66f016eb9338c15e7f5ef59e
    callback(EVP_des_ede_cbc(), "DES-EDE-CBC", nullptr, arg);
    callback(EVP_des_ede3_cbc(), "DES-EDE3-CBC", nullptr, arg);
    callback(EVP_rc2_cbc(), "RC2-CBC", nullptr, arg);
-@@ -44,8 +50,10 @@ void EVP_CIPHER_do_all_sorted(void (*callback)(const EVP_CIPHER *cipher,
+@@ -47,8 +53,10 @@ void EVP_CIPHER_do_all_sorted(void (*callback)(const EVP_CIPHER *cipher,
  
    // OpenSSL returns everything twice, the second time in lower case.
    callback(EVP_aes_128_cbc(), "aes-128-cbc", nullptr, arg);
@@ -103,7 +103,7 @@ index 891a73f229e3f0838cb2fa99b8fb24fdeac1962b..f7d0c5dc66f016eb9338c15e7f5ef59e
    callback(EVP_aes_128_ctr(), "aes-128-ctr", nullptr, arg);
    callback(EVP_aes_192_ctr(), "aes-192-ctr", nullptr, arg);
    callback(EVP_aes_256_ctr(), "aes-256-ctr", nullptr, arg);
-@@ -58,9 +66,13 @@ void EVP_CIPHER_do_all_sorted(void (*callback)(const EVP_CIPHER *cipher,
+@@ -61,9 +69,13 @@ void EVP_CIPHER_do_all_sorted(void (*callback)(const EVP_CIPHER *cipher,
    callback(EVP_aes_128_gcm(), "aes-128-gcm", nullptr, arg);
    callback(EVP_aes_192_gcm(), "aes-192-gcm", nullptr, arg);
    callback(EVP_aes_256_gcm(), "aes-256-gcm", nullptr, arg);

patches/chromium/.patches

@@ -150,3 +150,4 @@ fix_use_fresh_lazynow_for_onendworkitemimpl_after_didruntask.patch
 fix_pulseaudio_stream_and_icon_names.patch
 fix_fire_menu_popup_start_for_dynamically_created_aria_menus.patch
 feat_allow_enabling_extensions_on_custom_protocols.patch
+fix_initialize_com_on_desktopmedialistcapturethread_on_windows.patch

patches/chromium/add_didinstallconditionalfeatures.patch

@@ -23,10 +23,10 @@ index 3f8cf4edc7448e6b584adae8fcbb872d27377126..1d03dc809d4c18f24314d94811e0bf52
                                          int32_t world_id) {}
    virtual void DidClearWindowObject() {}
 diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
-index bed7c59163e10f2d273a6eb07d095d3f5af97db9..9a881bb119f6f93ae86b2cc75f95a30cde91cfbc 100644
+index ab959e66f8841d7367863bb13d6c7a0854d0df23..5279ba15f45bd7634b5f24553ad64c0069318cc0 100644
 --- a/content/renderer/render_frame_impl.cc
 +++ b/content/renderer/render_frame_impl.cc
-@@ -4731,6 +4731,12 @@ void RenderFrameImpl::DidCreateScriptContext(v8::Local<v8::Context> context,
+@@ -4733,6 +4733,12 @@ void RenderFrameImpl::DidCreateScriptContext(v8::Local<v8::Context> context,
      observer.DidCreateScriptContext(context, world_id);
  }
  

patches/chromium/allow_disabling_blink_scheduler_throttling_per_renderview.patch

@@ -6,7 +6,7 @@ Subject: allow disabling blink scheduler throttling per RenderView
 This allows us to disable throttling for hidden windows.
 
 diff --git a/content/browser/renderer_host/navigation_controller_impl_unittest.cc b/content/browser/renderer_host/navigation_controller_impl_unittest.cc
-index 29d5b174e122cbd140554687548106ead8f8e8d9..da74da96c3fe35a0f3838f04bca08846f7b41abe 100644
+index f5a6ffc61f6cdff3897a97003b74838aac27e2a1..9b10aeb457a010db0ab89211610ea97b1a364453 100644
 --- a/content/browser/renderer_host/navigation_controller_impl_unittest.cc
 +++ b/content/browser/renderer_host/navigation_controller_impl_unittest.cc
 @@ -168,6 +168,12 @@ class MockPageBroadcast : public blink::mojom::PageBroadcast {
@@ -51,7 +51,7 @@ index 89fed16c112d55c13a9f23695e2898d630f7d815..b7f486337f46daac015644525c9870f5
    void SendRendererPreferencesToRenderer(
        const blink::RendererPreferences& preferences);
 diff --git a/content/browser/renderer_host/render_widget_host_view_aura.cc b/content/browser/renderer_host/render_widget_host_view_aura.cc
-index 2a6ec0fbdd46427de42f880031fef19ff6269b77..cae6b1a65d0b8483f7a2bf0bd6dfc7a310216202 100644
+index 53ec5cd693539d74424c683f78e953e85c13c098..ccfe78580c2acb9a3afa43d246e1a83cc0e28598 100644
 --- a/content/browser/renderer_host/render_widget_host_view_aura.cc
 +++ b/content/browser/renderer_host/render_widget_host_view_aura.cc
 @@ -655,8 +655,8 @@ void RenderWidgetHostViewAura::ShowImpl(PageVisibilityState page_visibility) {
@@ -116,7 +116,7 @@ index 932658273154ef2e022358e493a8e7c00c86e732..57bbfb5cde62c9496c351c861880a189
    // Visibility -----------------------------------------------------------
  
 diff --git a/third_party/blink/renderer/core/exported/web_view_impl.cc b/third_party/blink/renderer/core/exported/web_view_impl.cc
-index 8646f9337065b8009a210c8878bdbb132265ab3e..1f38d76c867c5d7ee4b8584db49f5025aff6c50e 100644
+index b5a7e1b177f031837f670c26bff7394315eb6ea5..ed63aa041733e2fb09d77a219c93c322985cc81e 100644
 --- a/third_party/blink/renderer/core/exported/web_view_impl.cc
 +++ b/third_party/blink/renderer/core/exported/web_view_impl.cc
 @@ -2471,6 +2471,10 @@ void WebViewImpl::SetPageLifecycleStateInternal(
@@ -130,7 +130,7 @@ index 8646f9337065b8009a210c8878bdbb132265ab3e..1f38d76c867c5d7ee4b8584db49f5025
    bool storing_in_bfcache = new_state->is_in_back_forward_cache &&
                              !old_state->is_in_back_forward_cache;
    bool restoring_from_bfcache = !new_state->is_in_back_forward_cache &&
-@@ -4163,10 +4167,23 @@ PageScheduler* WebViewImpl::Scheduler() const {
+@@ -4170,10 +4174,23 @@ PageScheduler* WebViewImpl::Scheduler() const {
    return GetPage()->GetPageScheduler();
  }
  
@@ -155,7 +155,7 @@ index 8646f9337065b8009a210c8878bdbb132265ab3e..1f38d76c867c5d7ee4b8584db49f5025
    // Do not throttle if the page should be painting.
    bool is_visible =
 diff --git a/third_party/blink/renderer/core/exported/web_view_impl.h b/third_party/blink/renderer/core/exported/web_view_impl.h
-index 8d5c7349c360726778e37976fc54d660d7424f1f..96ee25c8ae4b50ab265bd698517efe15e2f1f44d 100644
+index b2ad789e53146b06e0e416f2dcf384cf7e9c17ae..838c67ac5b02c427858febbfbddf25fb03632b37 100644
 --- a/third_party/blink/renderer/core/exported/web_view_impl.h
 +++ b/third_party/blink/renderer/core/exported/web_view_impl.h
 @@ -446,6 +446,7 @@ class CORE_EXPORT WebViewImpl final : public WebView,

patches/chromium/blink_local_frame.patch

@@ -15,7 +15,7 @@ Refs changes in:
 This patch reverts the changes to fix associated crashes in Electron.
 
 diff --git a/third_party/blink/renderer/core/frame/frame.cc b/third_party/blink/renderer/core/frame/frame.cc
-index 3f1ccee622b92fe8004f7763d2374d02117236f7..03f53c6755d4f6f46d23f7860b19390bb77bd4de 100644
+index 9827a89c56141596fde57b78f9c9894f273db83e..cedb4bd8217a0ad3ab07d85421e1850bc4d910f5 100644
 --- a/third_party/blink/renderer/core/frame/frame.cc
 +++ b/third_party/blink/renderer/core/frame/frame.cc
 @@ -135,14 +135,6 @@ bool Frame::Detach(FrameDetachType type) {

patches/chromium/build_do_not_depend_on_packed_resource_integrity.patch

@@ -28,10 +28,10 @@ index 0af4d4b75d0519fabcb5d48bd9d5bd465bc80e92..eb6b23655afaa268f25d99301a0853aa
          ":chrome_dll",
          ":chrome_exe_version",
 diff --git a/chrome/test/BUILD.gn b/chrome/test/BUILD.gn
-index a14985635e8cb2c9e98044ece46a557ac5f36f08..8e94e37dc75ebadedece1e370538c151c31b7b35 100644
+index e91f97276866bd500720962c74acaca2c22fff7c..22867153821d2b1e83feb1a2a7a6b8c26ba776eb 100644
 --- a/chrome/test/BUILD.gn
 +++ b/chrome/test/BUILD.gn
-@@ -7720,6 +7720,10 @@ test("unit_tests") {
+@@ -7737,6 +7737,10 @@ test("unit_tests") {
        "//chrome/notification_helper",
      ]
  
@@ -42,7 +42,7 @@ index a14985635e8cb2c9e98044ece46a557ac5f36f08..8e94e37dc75ebadedece1e370538c151
      deps += [
        "//chrome:other_version",
        "//chrome//services/util_win:unit_tests",
-@@ -8693,6 +8697,10 @@ test("unit_tests") {
+@@ -8711,6 +8715,10 @@ test("unit_tests") {
        "../browser/performance_manager/policies/background_tab_loading_policy_unittest.cc",
      ]
  
@@ -53,7 +53,7 @@ index a14985635e8cb2c9e98044ece46a557ac5f36f08..8e94e37dc75ebadedece1e370538c151
      sources += [
        # The importer code is not used on Android.
        "../common/importer/firefox_importer_utils_unittest.cc",
-@@ -8749,7 +8757,7 @@ test("unit_tests") {
+@@ -8767,7 +8775,7 @@ test("unit_tests") {
      # TODO(crbug.com/417513088): Maybe merge with the non-android `deps` declaration above?
      deps += [
        "../browser/screen_ai:screen_ai_install_state",

patches/chromium/can_create_window.patch

@@ -9,10 +9,10 @@ potentially prevent a window from being created.
 TODO(loc): this patch is currently broken.
 
 diff --git a/content/browser/renderer_host/render_frame_host_impl.cc b/content/browser/renderer_host/render_frame_host_impl.cc
-index 3f5964a623d18b59d3761d0617644fc8ccfd9eb1..b898ebdd18bfefb4c6d8fa62e3e128a5154b049c 100644
+index ac474e220d411dec278c40448f038b25e6788d2a..e4ff8f11bed9e53f3134068492ac94b4c9bb4df2 100644
 --- a/content/browser/renderer_host/render_frame_host_impl.cc
 +++ b/content/browser/renderer_host/render_frame_host_impl.cc
-@@ -10217,6 +10217,7 @@ void RenderFrameHostImpl::CreateNewWindow(
+@@ -10228,6 +10228,7 @@ void RenderFrameHostImpl::CreateNewWindow(
            last_committed_origin_, params->window_container_type,
            params->target_url, params->referrer.To<Referrer>(),
            params->frame_name, params->disposition, *params->features,
@@ -21,10 +21,10 @@ index 3f5964a623d18b59d3761d0617644fc8ccfd9eb1..b898ebdd18bfefb4c6d8fa62e3e128a5
            &no_javascript_access);
  
 diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
-index b0f9312b11641fa4a3e0e9d87281153bbf577f0e..0088e16862b4eb08e2100f13e0d9fecfc0d8aa9d 100644
+index 3e0c8bd308d8a947a2bd295a2d83e385e53853fb..4e91b3aeb5630476c660e8814e2fd9d92c5a9ca1 100644
 --- a/content/browser/web_contents/web_contents_impl.cc
 +++ b/content/browser/web_contents/web_contents_impl.cc
-@@ -5494,6 +5494,10 @@ FrameTree* WebContentsImpl::CreateNewWindow(
+@@ -5501,6 +5501,10 @@ FrameTree* WebContentsImpl::CreateNewWindow(
    create_params.initially_hidden = renderer_started_hidden;
    create_params.initial_popup_url = params.target_url;
  
@@ -35,7 +35,7 @@ index b0f9312b11641fa4a3e0e9d87281153bbf577f0e..0088e16862b4eb08e2100f13e0d9fecf
    // Even though all codepaths leading here are in response to a renderer
    // trying to open a new window, if the new window ends up in a different
    // browsing instance, then the RenderViewHost, RenderWidgetHost,
-@@ -5548,6 +5552,12 @@ FrameTree* WebContentsImpl::CreateNewWindow(
+@@ -5555,6 +5559,12 @@ FrameTree* WebContentsImpl::CreateNewWindow(
    // Sets the newly created WebContents WindowOpenDisposition.
    new_contents_impl->original_window_open_disposition_ = params.disposition;
  
@@ -48,7 +48,7 @@ index b0f9312b11641fa4a3e0e9d87281153bbf577f0e..0088e16862b4eb08e2100f13e0d9fecf
    // If the new frame has a name, make sure any SiteInstances that can find
    // this named frame have proxies for it.  Must be called after
    // SetSessionStorageNamespace, since this calls CreateRenderView, which uses
-@@ -5589,12 +5599,6 @@ FrameTree* WebContentsImpl::CreateNewWindow(
+@@ -5596,12 +5606,6 @@ FrameTree* WebContentsImpl::CreateNewWindow(
      AddWebContentsDestructionObserver(new_contents_impl);
    }
  
@@ -77,10 +77,10 @@ index 444fa7009d0db33470cac9ab9cfdc23ceacec942..ab9aeb852e5ea89583284386d9a78a3e
  
  // Operation result when the renderer asks the browser to create a new window.
 diff --git a/content/public/browser/content_browser_client.cc b/content/public/browser/content_browser_client.cc
-index 35e40748ca10661e13f1e04d22e0867d335b46c0..8651e4d019b6dc4e94cae9706eccf8dacb5350a2 100644
+index e806de04ca92cb8351e9a242a5241c0d4286da97..d0b3e4bc348921df7e6446dbc1f14860b8a84d87 100644
 --- a/content/public/browser/content_browser_client.cc
 +++ b/content/public/browser/content_browser_client.cc
-@@ -862,6 +862,8 @@ bool ContentBrowserClient::CanCreateWindow(
+@@ -854,6 +854,8 @@ bool ContentBrowserClient::CanCreateWindow(
      const std::string& frame_name,
      WindowOpenDisposition disposition,
      const blink::mojom::WindowFeatures& features,
@@ -90,7 +90,7 @@ index 35e40748ca10661e13f1e04d22e0867d335b46c0..8651e4d019b6dc4e94cae9706eccf8da
      bool opener_suppressed,
      bool* no_javascript_access) {
 diff --git a/content/public/browser/content_browser_client.h b/content/public/browser/content_browser_client.h
-index 27a2f100c949319889f791a661b6990b6d0bf97a..02321334795bb096206146caf24084c12347664e 100644
+index 70588ccd619ac7969918771bccf5c054320e4f6f..eb684232648424fab4ba73b1fc813b0b3f8b809b 100644
 --- a/content/public/browser/content_browser_client.h
 +++ b/content/public/browser/content_browser_client.h
 @@ -205,6 +205,7 @@ class NetworkService;
@@ -101,7 +101,7 @@ index 27a2f100c949319889f791a661b6990b6d0bf97a..02321334795bb096206146caf24084c1
  }  // namespace network
  
  namespace sandbox {
-@@ -1414,6 +1415,8 @@ class CONTENT_EXPORT ContentBrowserClient {
+@@ -1406,6 +1407,8 @@ class CONTENT_EXPORT ContentBrowserClient {
        const std::string& frame_name,
        WindowOpenDisposition disposition,
        const blink::mojom::WindowFeatures& features,
@@ -170,10 +170,10 @@ index 0650197909d484b8a0f48ab61b22471c71bce0e8..29c380d7845aab1a7b3417e0d3940ea0
    // typically happens when popups are created.
    virtual void WebContentsCreated(WebContents* source_contents,
 diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
-index e5dae3b2c85ce3d38fdfcb64bb732f6e45e34217..bed7c59163e10f2d273a6eb07d095d3f5af97db9 100644
+index 5936c5eaa081abde7f7c26cc990a122622e46908..ab959e66f8841d7367863bb13d6c7a0854d0df23 100644
 --- a/content/renderer/render_frame_impl.cc
 +++ b/content/renderer/render_frame_impl.cc
-@@ -6842,6 +6842,10 @@ WebView* RenderFrameImpl::CreateNewWindow(
+@@ -6845,6 +6845,10 @@ WebView* RenderFrameImpl::CreateNewWindow(
    params->started_by_ad =
        GetWebFrame()->IsAdFrame() || GetWebFrame()->IsAdScriptInStack();
  

patches/chromium/chore_expose_isolate_parameter_in_script_lifecycle_observers.patch

@@ -34,10 +34,10 @@ index 1d03dc809d4c18f24314d94811e0bf527aa7b5b4..16030bcecb2e39b8870144ce7c3d11dd
    virtual void DidClearWindowObject() {}
    virtual void DidChangeScrollOffset() {}
 diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
-index 9a881bb119f6f93ae86b2cc75f95a30cde91cfbc..540935b14c5f78b573a14414f4259db9c34d02ae 100644
+index 5279ba15f45bd7634b5f24553ad64c0069318cc0..2840f22e2b8b4aae09a06774a70f2ec7340536d9 100644
 --- a/content/renderer/render_frame_impl.cc
 +++ b/content/renderer/render_frame_impl.cc
-@@ -4737,10 +4737,11 @@ void RenderFrameImpl::DidInstallConditionalFeatures(
+@@ -4739,10 +4739,11 @@ void RenderFrameImpl::DidInstallConditionalFeatures(
      observer.DidInstallConditionalFeatures(context, world_id);
  }
  

patches/chromium/chore_partial_revert_of.patch

@@ -14,10 +14,10 @@ track down the source of this problem & figure out if we can fix it
 by changing something in Electron.
 
 diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
-index f6b48f3641674bae565ec2c6294d9f6cf1d48db4..09346abdd2df2f672b1c3cc1757fa375eb6e0c72 100644
+index aaa2b2229dac8c5e8cf590300b436082f6c3773b..e12758010f5c243d2fb9c733b74bcb0eea89f5da 100644
 --- a/content/browser/web_contents/web_contents_impl.cc
 +++ b/content/browser/web_contents/web_contents_impl.cc
-@@ -5465,7 +5465,7 @@ FrameTree* WebContentsImpl::CreateNewWindow(
+@@ -5472,7 +5472,7 @@ FrameTree* WebContentsImpl::CreateNewWindow(
            : IsGuest();
    // While some guest types do not have a guest SiteInstance, the ones that
    // don't all override WebContents creation above.

patches/chromium/chore_provide_iswebcontentscreationoverridden_with_full_params.patch

@@ -80,10 +80,10 @@ index 39fa45f0a0f9076bd7ac0be6f455dd540a276512..3d0381d463eed73470b28085830f2a23
        content::WebContents* source,
        const content::OpenURLParams& params,
 diff --git a/chrome/browser/ui/browser.cc b/chrome/browser/ui/browser.cc
-index c71041d2eae5ea25af82137351f12e46182e6c69..d8263194614006213e157f6b10f3facb093b2944 100644
+index 8f8852b2af1acfa4ec985fd1c8b50563b991b12a..c2f2903545b191c5ab13462bf330efce37d7d08c 100644
 --- a/chrome/browser/ui/browser.cc
 +++ b/chrome/browser/ui/browser.cc
-@@ -2287,7 +2287,8 @@ bool Browser::IsWebContentsCreationOverridden(
+@@ -2310,7 +2310,8 @@ bool Browser::IsWebContentsCreationOverridden(
      content::mojom::WindowContainerType window_container_type,
      const GURL& opener_url,
      const std::string& frame_name,
@@ -93,7 +93,7 @@ index c71041d2eae5ea25af82137351f12e46182e6c69..d8263194614006213e157f6b10f3facb
    if (HasActorTaskPreventingNewWebContents(profile(), opener)) {
      // If an ExecutionEngine is acting on the opener, prevent it from creating a
      // new WebContents. We'll instead force the navigation to happen in the same
-@@ -2300,7 +2301,7 @@ bool Browser::IsWebContentsCreationOverridden(
+@@ -2323,7 +2324,7 @@ bool Browser::IsWebContentsCreationOverridden(
    return (window_container_type ==
                content::mojom::WindowContainerType::BACKGROUND &&
            ShouldCreateBackgroundContents(source_site_instance, opener_url,
@@ -223,10 +223,10 @@ index b969f1d97b7e3396119b579cfbe61e19ff7d2dd4..b8d6169652da28266a514938b45b39c5
    content::WebContents* AddNewContents(
        content::WebContents* source,
 diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
-index ec75b1a31c029ff9f1d23f297be4ae40bc24af9c..1a45bab9c0e4e429bb338c757cdc49d64f337b88 100644
+index d43e75c20aca09080f4223d339c88381f030c504..8cd59445bae73ff0193e4512d7c36740cbad847f 100644
 --- a/content/browser/web_contents/web_contents_impl.cc
 +++ b/content/browser/web_contents/web_contents_impl.cc
-@@ -5429,8 +5429,7 @@ FrameTree* WebContentsImpl::CreateNewWindow(
+@@ -5436,8 +5436,7 @@ FrameTree* WebContentsImpl::CreateNewWindow(
    if (delegate_ &&
        delegate_->IsWebContentsCreationOverridden(
            opener, source_site_instance, params.window_container_type,
@@ -357,7 +357,7 @@ index f459dddeb3f8f3a33ffead0e96fba791d18a0108..f7a229b186774ca3a01f2d747eab139a
        content::RenderFrameHost* opener,
        content::SiteInstance* source_site_instance,
 diff --git a/fuchsia_web/webengine/browser/frame_impl.cc b/fuchsia_web/webengine/browser/frame_impl.cc
-index 3b50b6b3616ead57de44d309a306db09dce82c65..c709f13b7c0bac9f41cac745678aaee04c1caf46 100644
+index 9c1fb0b2ed4f013ef6108a9844b22f6bfe697621..ef4991adc766d53b03d280395630b83ced38c2e8 100644
 --- a/fuchsia_web/webengine/browser/frame_impl.cc
 +++ b/fuchsia_web/webengine/browser/frame_impl.cc
 @@ -585,8 +585,7 @@ bool FrameImpl::IsWebContentsCreationOverridden(

patches/chromium/create_browser_v8_snapshot_file_name_fuse.patch

@@ -7,12 +7,12 @@ By default, chromium sets up one v8 snapshot to be used in all v8 contexts. This
 to have a dedicated browser process v8 snapshot defined by the file `browser_v8_context_snapshot.bin`.
 
 diff --git a/content/app/content_main_runner_impl.cc b/content/app/content_main_runner_impl.cc
-index b795a9dbf898570a7cd8469ee386c4edf4bfa275..449940fe1b6969576f1b2c21d7719620e578e8a8 100644
+index e795339c000cf695ca05c6d3c736678fa47df21e..bbcad80a8efdac88c26ececeaf4023152631b662 100644
 --- a/content/app/content_main_runner_impl.cc
 +++ b/content/app/content_main_runner_impl.cc
-@@ -277,8 +277,13 @@ void AsanProcessInfoCB(const char* reason,
- }
- #endif  // defined(ADDRESS_SANITIZER)
+@@ -261,8 +261,13 @@ std::string GetSnapshotDataDescriptor(const base::CommandLine& command_line) {
+ 
+ #endif
  
 -void LoadV8SnapshotFile(const base::CommandLine& command_line) {
 +void LoadV8SnapshotFile(const raw_ptr<ContentMainDelegate> delegate, const base::CommandLine& command_line) {

patches/chromium/disable_compositor_recycling.patch

@@ -6,10 +6,10 @@ Subject: fix: disabling compositor recycling
 Compositor recycling is useful for Chrome because there can be many tabs and spinning up a compositor for each one would be costly. In practice, Chrome uses the parent compositor code path of browser_compositor_view_mac.mm; the NSView of each tab is detached when it's hidden and attached when it's shown. For Electron, there is no parent compositor, so we're forced into the "own compositor" code path, which seems to be non-optimal and pretty ruthless in terms of the release of resources. Electron has no real concept of multiple tabs per window, so it should be okay to disable this ruthless recycling altogether in Electron.
 
 diff --git a/content/browser/renderer_host/render_widget_host_view_mac.mm b/content/browser/renderer_host/render_widget_host_view_mac.mm
-index f7c3e60f748e24e51bffa2bc8914a8a7b67bd504..2324454f8a782bb4fe065b727a39b7cf523d9ce8 100644
+index 886b3e87e9041931d3cb59ef775b5012e8e2f908..9287bde2d8c0eaa00c29fca974111b3f32b6e813 100644
 --- a/content/browser/renderer_host/render_widget_host_view_mac.mm
 +++ b/content/browser/renderer_host/render_widget_host_view_mac.mm
-@@ -590,7 +590,11 @@
+@@ -597,7 +597,11 @@
    }
  
    host()->WasHidden();

patches/chromium/disable_hidden.patch

@@ -6,10 +6,10 @@ Subject: disable_hidden.patch
 Electron uses this to disable background throttling for hidden windows.
 
 diff --git a/content/browser/renderer_host/render_widget_host_impl.cc b/content/browser/renderer_host/render_widget_host_impl.cc
-index ced1f88a6ab9ad7b8e180149cbb652adb5b5b47f..1919546e9be90303d1aee29208d8227ece452827 100644
+index fe46ebe4e5bcda2eff543aa5b5a2310628a3ea5a..8df679251dc314a94079fcc9d4edd7fab12873d4 100644
 --- a/content/browser/renderer_host/render_widget_host_impl.cc
 +++ b/content/browser/renderer_host/render_widget_host_impl.cc
-@@ -810,6 +810,10 @@ void RenderWidgetHostImpl::WasHidden() {
+@@ -818,6 +818,10 @@ void RenderWidgetHostImpl::WasHidden() {
      return;
    }
  
@@ -21,10 +21,10 @@ index ced1f88a6ab9ad7b8e180149cbb652adb5b5b47f..1919546e9be90303d1aee29208d8227e
    // Prompts should remain open and functional across tab switches.
    if (!delegate_ || !delegate_->IsWaitingForPointerLockPrompt(this)) {
 diff --git a/content/browser/renderer_host/render_widget_host_impl.h b/content/browser/renderer_host/render_widget_host_impl.h
-index 0886acf77ef00ac54a33103585c4e1c022e9d5d6..71a0a74f8bc32e58f98a1841a1dd9c4b4c37118e 100644
+index 37b2ca1000ead76ec7e403bf1e2dc647bcee74ce..1312c87909729ac59ea661321c10862f34072f95 100644
 --- a/content/browser/renderer_host/render_widget_host_impl.h
 +++ b/content/browser/renderer_host/render_widget_host_impl.h
-@@ -1055,6 +1055,8 @@ class CONTENT_EXPORT RenderWidgetHostImpl
+@@ -1059,6 +1059,8 @@ class CONTENT_EXPORT RenderWidgetHostImpl
  
    base::TimeDelta GetHungRendererDelayForTesting();
  
@@ -34,10 +34,10 @@ index 0886acf77ef00ac54a33103585c4e1c022e9d5d6..71a0a74f8bc32e58f98a1841a1dd9c4b
    // |routing_id| must not be IPC::mojom::kRoutingIdNone.
    // If this object outlives |delegate|, DetachDelegate() must be called when
 diff --git a/content/browser/renderer_host/render_widget_host_view_aura.cc b/content/browser/renderer_host/render_widget_host_view_aura.cc
-index e001bfdf97408a06bcbe7e3dbcdad743d86e57fc..2a6ec0fbdd46427de42f880031fef19ff6269b77 100644
+index 550a2090d11ea151d8003610cb39a8035c5d299c..53ec5cd693539d74424c683f78e953e85c13c098 100644
 --- a/content/browser/renderer_host/render_widget_host_view_aura.cc
 +++ b/content/browser/renderer_host/render_widget_host_view_aura.cc
-@@ -717,7 +717,7 @@ void RenderWidgetHostViewAura::HideImpl() {
+@@ -712,7 +712,7 @@ void RenderWidgetHostViewAura::HideImpl() {
    CHECK(visibility_ == Visibility::HIDDEN ||
          visibility_ == Visibility::OCCLUDED);
  

patches/chromium/expose_setuseragent_on_networkcontext.patch

@@ -33,10 +33,10 @@ index 0ab8187b0db8ae6db46d81738f653a2bc4c566f6..de3d55e85c22317f7f9375eb94d0d5d4
  
  }  // namespace net
 diff --git a/services/network/network_context.cc b/services/network/network_context.cc
-index 4efd5407479b9e5ee6af84a4cd6d26895d8b19f7..498c877f3f159729eae4857b5210b913eec962d0 100644
+index cf1001557f2f59747ceb394ab2c93b4bf379dafb..2e16a8d19e1ccfbfc838ed33ecac3375f1e81b17 100644
 --- a/services/network/network_context.cc
 +++ b/services/network/network_context.cc
-@@ -1965,6 +1965,13 @@ void NetworkContext::SetNetworkConditions(
+@@ -1994,6 +1994,13 @@ void NetworkContext::SetNetworkConditions(
                                        std::move(network_conditions));
  }
  
@@ -51,10 +51,10 @@ index 4efd5407479b9e5ee6af84a4cd6d26895d8b19f7..498c877f3f159729eae4857b5210b913
    // This may only be called on NetworkContexts created with the constructor
    // that calls MakeURLRequestContext().
 diff --git a/services/network/network_context.h b/services/network/network_context.h
-index 912e4d60647f6376dfef62d18998b556bc7efa32..53082e9f0bfb98c1267fc034fa34e157b4c04d9b 100644
+index 04e6e884dccbb680a39f2b9c8a54de162e056a30..672dd48040586190b761e2db554ba0767d254f62 100644
 --- a/services/network/network_context.h
 +++ b/services/network/network_context.h
-@@ -331,6 +331,7 @@ class COMPONENT_EXPORT(NETWORK_SERVICE) NetworkContext
+@@ -332,6 +332,7 @@ class COMPONENT_EXPORT(NETWORK_SERVICE) NetworkContext
    void SetNetworkConditions(
        const base::UnguessableToken& throttling_profile_id,
        std::vector<mojom::MatchedNetworkConditionsPtr> conditions) override;
@@ -63,10 +63,10 @@ index 912e4d60647f6376dfef62d18998b556bc7efa32..53082e9f0bfb98c1267fc034fa34e157
    void SetEnableReferrers(bool enable_referrers) override;
  #if BUILDFLAG(IS_CT_SUPPORTED)
 diff --git a/services/network/public/mojom/network_context.mojom b/services/network/public/mojom/network_context.mojom
-index 63d410dd356594a5928ed2f84b05b403bf3367f0..ca47c9cb58d5d69faade9f85d1e63683d79cb5e3 100644
+index 6c43c2985123525793dd6b60c9d7d7c1db7fdf04..7493bd8dd37b36a3e7a96b1373619fee0b6a9d8e 100644
 --- a/services/network/public/mojom/network_context.mojom
 +++ b/services/network/public/mojom/network_context.mojom
-@@ -1291,6 +1291,9 @@ interface NetworkContext {
+@@ -1299,6 +1299,9 @@ interface NetworkContext {
    SetNetworkConditions(mojo_base.mojom.UnguessableToken throttling_profile_id,
                         array<MatchedNetworkConditions> conditions);
  
@@ -77,7 +77,7 @@ index 63d410dd356594a5928ed2f84b05b403bf3367f0..ca47c9cb58d5d69faade9f85d1e63683
    SetAcceptLanguage(string new_accept_language);
  
 diff --git a/services/network/test/test_network_context.h b/services/network/test/test_network_context.h
-index bc26f449109b3be84490fbb3569e36aa4aca8c4b..d273faec6c235cb7d29f0f7fb90affdca7240e51 100644
+index b472be0acdc0cd4971e6e0a9e623bc1c84d07a02..f328a3aa2df9f5c6163a5023a5df157350d3707f 100644
 --- a/services/network/test/test_network_context.h
 +++ b/services/network/test/test_network_context.h
 @@ -156,6 +156,7 @@ class TestNetworkContext : public mojom::NetworkContext {

patches/chromium/extend_apply_webpreferences.patch

@@ -15,7 +15,7 @@ Ideally we could add an embedder observer pattern here but that can be
 done in future work.
 
 diff --git a/third_party/blink/renderer/core/exported/web_view_impl.cc b/third_party/blink/renderer/core/exported/web_view_impl.cc
-index 1f38d76c867c5d7ee4b8584db49f5025aff6c50e..00221901d054f1ed9280af17559731ef75442c5d 100644
+index ed63aa041733e2fb09d77a219c93c322985cc81e..ea23d47128d4e974353ea5a976a72d4fa0600e2b 100644
 --- a/third_party/blink/renderer/core/exported/web_view_impl.cc
 +++ b/third_party/blink/renderer/core/exported/web_view_impl.cc
 @@ -1855,6 +1855,8 @@ void WebView::ApplyWebPreferences(const web_pref::WebPreferences& prefs,

patches/chromium/feat_add_streaming-protocol_registry_to_multibuffer_data_source.patch

@@ -17,11 +17,11 @@ which removed range-requests-supported on non-http protocols. See https://issues
 for more information.
 
 diff --git a/third_party/blink/renderer/platform/media/multi_buffer_data_source.cc b/third_party/blink/renderer/platform/media/multi_buffer_data_source.cc
-index d96ffd263cad628c3e12b0a39cf082161ea6bb58..b33f52a48f570c7aee1a3f55fb3f9a1ed3bd35c0 100644
+index 0af2ad19954bd868f6b92616da869b350f088103..efc53247962f166f2b441f76c7a2c94d8ceb979a 100644
 --- a/third_party/blink/renderer/platform/media/multi_buffer_data_source.cc
 +++ b/third_party/blink/renderer/platform/media/multi_buffer_data_source.cc
-@@ -11,8 +11,10 @@
- #include "base/containers/adapters.h"
+@@ -12,8 +12,10 @@
+ #include "base/functional/callback_helpers.h"
  #include "base/location.h"
  #include "base/memory/raw_span.h"
 +#include "base/no_destructor.h"
@@ -31,7 +31,7 @@ index d96ffd263cad628c3e12b0a39cf082161ea6bb58..b33f52a48f570c7aee1a3f55fb3f9a1e
  #include "media/base/media_log.h"
  #include "net/base/net_errors.h"
  #include "third_party/blink/renderer/platform/media/buffered_data_source_host_impl.h"
-@@ -69,6 +71,10 @@ constexpr base::TimeDelta kSeekDelay = base::Milliseconds(20);
+@@ -70,6 +72,10 @@ constexpr base::TimeDelta kSeekDelay = base::Milliseconds(20);
  
  }  // namespace
  
@@ -42,7 +42,7 @@ index d96ffd263cad628c3e12b0a39cf082161ea6bb58..b33f52a48f570c7aee1a3f55fb3f9a1e
  class MultiBufferDataSource::ReadOperation {
   public:
    ReadOperation() = delete;
-@@ -136,13 +142,29 @@ MultiBufferDataSource::~MultiBufferDataSource() {
+@@ -137,13 +143,29 @@ MultiBufferDataSource::~MultiBufferDataSource() {
    DCHECK(render_task_runner_->BelongsToCurrentThread());
  }
  
@@ -74,18 +74,18 @@ index d96ffd263cad628c3e12b0a39cf082161ea6bb58..b33f52a48f570c7aee1a3f55fb3f9a1e
  
  void MultiBufferDataSource::SetReader(
 diff --git a/third_party/blink/renderer/platform/media/multi_buffer_data_source.h b/third_party/blink/renderer/platform/media/multi_buffer_data_source.h
-index 342c690100eacf3cdde92bb60b6c08769f693e96..4980848c38703764de3c210c119f844bed508aa2 100644
+index 470b6015dad4063375175324f49afb3548cdf0dd..61b633d65eaa76f98fd0d858d490b12077646ad2 100644
 --- a/third_party/blink/renderer/platform/media/multi_buffer_data_source.h
 +++ b/third_party/blink/renderer/platform/media/multi_buffer_data_source.h
-@@ -18,6 +18,7 @@
+@@ -19,6 +19,7 @@
  #include "media/base/data_source.h"
  #include "media/base/ranges.h"
  #include "media/base/tuneable.h"
 +#include "third_party/blink/public/platform/web_common.h"
+ #include "third_party/blink/renderer/platform/media/buffered_data_source_host_impl.h"
  #include "third_party/blink/renderer/platform/media/url_index.h"
  #include "third_party/blink/renderer/platform/platform_export.h"
- #include "third_party/blink/renderer/platform/wtf/vector.h"
-@@ -35,6 +36,8 @@ namespace blink {
+@@ -37,6 +38,8 @@ namespace blink {
  class BufferedDataSourceHost;
  class MultiBufferReader;
  
@@ -94,7 +94,7 @@ index 342c690100eacf3cdde92bb60b6c08769f693e96..4980848c38703764de3c210c119f844b
  // A data source capable of loading URLs and buffering the data using an
  // in-memory sliding window.
  //
-@@ -64,6 +67,8 @@ class PLATFORM_EXPORT MultiBufferDataSource
+@@ -94,6 +97,8 @@ class PLATFORM_EXPORT MultiBufferDataSource
      return url_data_->mime_type();
    }
  

patches/chromium/feat_allow_enabling_extensions_on_custom_protocols.patch

@@ -44,10 +44,10 @@ index 57ed3cf54b2921df09ad84906b3da7527c6080bb..ffe3a0894c612adaa429a783827c8503
  class WebRequestEventRouter : public KeyedService {
   public:
 diff --git a/extensions/common/extension.cc b/extensions/common/extension.cc
-index 731994059b8900e7cec46acfb9d17f18c3b8ed89..c32aee04fa1788ae26a0f9a0c5b9d2afb94c84c6 100644
+index 542bc99fbaace39351a6f991a7702d0c77c891eb..9fef3d7fe3108cca843100967489f1cc1b6b4589 100644
 --- a/extensions/common/extension.cc
 +++ b/extensions/common/extension.cc
-@@ -222,7 +222,8 @@ const int Extension::kValidHostPermissionSchemes =
+@@ -223,7 +223,8 @@ const int Extension::kValidHostPermissionSchemes =
      URLPattern::SCHEME_CHROMEUI | URLPattern::SCHEME_HTTP |
      URLPattern::SCHEME_HTTPS | URLPattern::SCHEME_FILE |
      URLPattern::SCHEME_FTP | URLPattern::SCHEME_WS | URLPattern::SCHEME_WSS |

patches/chromium/feat_configure_launch_options_for_service_process.patch

@@ -167,7 +167,7 @@ index 34b4e7c1b449312e9cb517be192a39a6b5286e3c..4f39415717f423b9a87f83779851e08b
                             FinishStartSandboxedProcessOnLauncherThread,
                         this));
 diff --git a/content/browser/service_host/service_process_host_impl.cc b/content/browser/service_host/service_process_host_impl.cc
-index d9c14f91747bde0e76056d7f2f2ada166e67f994..09335acac17f526fb8d8e42e4b2d993b11045786 100644
+index 4c0b23afb38066f4d29ead2d5705ae2b58ddca34..b79eb508bdfc1ae08dce254cfa57ab6c9b7bfc8a 100644
 --- a/content/browser/service_host/service_process_host_impl.cc
 +++ b/content/browser/service_host/service_process_host_impl.cc
 @@ -69,6 +69,21 @@ void LaunchServiceProcess(mojo::GenericPendingReceiver receiver,
@@ -584,10 +584,10 @@ index 4159eef9e1f54c82ac0d8ad6437925dd3c6fa3ec..b835257f686635b91f80c2d6651fb735
  #if BUILDFLAG(IS_MAC)
    // Whether or not to disclaim TCC responsibility for the process, defaults to
 diff --git a/content/public/browser/service_process_host.cc b/content/public/browser/service_process_host.cc
-index d1bc550a891979e2d41d8d5b18a2f9287468e460..5d255f628788bc8b40d8df0039b08c06ffec8730 100644
+index a3970c9358d7e03b58e646c85a488d97609c44fd..1afc67fab97a3bb9515afefb8a3f051147d1d678 100644
 --- a/content/public/browser/service_process_host.cc
 +++ b/content/public/browser/service_process_host.cc
-@@ -53,12 +53,62 @@ ServiceProcessHost::Options::WithExtraCommandLineSwitches(
+@@ -53,6 +53,26 @@ ServiceProcessHost::Options::WithExtraCommandLineSwitches(
    return *this;
  }
  
@@ -614,6 +614,7 @@ index d1bc550a891979e2d41d8d5b18a2f9287468e460..5d255f628788bc8b40d8df0039b08c06
  ServiceProcessHost::Options& ServiceProcessHost::Options::WithProcessCallback(
      base::OnceCallback<void(const base::Process&)> callback) {
    process_callback = std::move(callback);
+@@ -68,6 +88,36 @@ ServiceProcessHost::Options& ServiceProcessHost::Options::WithObserver(
    return *this;
  }
  
@@ -651,18 +652,18 @@ index d1bc550a891979e2d41d8d5b18a2f9287468e460..5d255f628788bc8b40d8df0039b08c06
  ServiceProcessHost::Options&
  ServiceProcessHost::Options::WithPreloadedLibraries(
 diff --git a/content/public/browser/service_process_host.h b/content/public/browser/service_process_host.h
-index 0062d2cb6634b8b29977a0312516b1b13936b40a..888ff36d70c83010f1f45e9eeb2dd6b573158db5 100644
+index ea68aa0d16c46ad53b63e10027e81503610051d9..ac1ffa290b59d964931a312a911efbecc5eb04ac 100644
 --- a/content/public/browser/service_process_host.h
 +++ b/content/public/browser/service_process_host.h
-@@ -14,6 +14,7 @@
- #include "base/command_line.h"
+@@ -15,6 +15,7 @@
  #include "base/functional/callback.h"
+ #include "base/memory/weak_ptr.h"
  #include "base/observer_list_types.h"
 +#include "base/process/launch.h"
  #include "base/process/process_handle.h"
  #include "content/common/content_export.h"
  #include "content/public/browser/service_process_info.h"
-@@ -28,6 +29,10 @@
+@@ -29,6 +30,10 @@
  #include "base/types/pass_key.h"
  #endif  // BUILDFLAG(IS_WIN)
  
@@ -673,7 +674,7 @@ index 0062d2cb6634b8b29977a0312516b1b13936b40a..888ff36d70c83010f1f45e9eeb2dd6b5
  namespace base {
  class Process;
  }  // namespace base
-@@ -94,11 +99,40 @@ class CONTENT_EXPORT ServiceProcessHost {
+@@ -98,6 +103,16 @@ class CONTENT_EXPORT ServiceProcessHost {
      // Specifies extra command line switches to append before launch.
      Options& WithExtraCommandLineSwitches(std::vector<std::string> switches);
  
@@ -690,8 +691,10 @@ index 0062d2cb6634b8b29977a0312516b1b13936b40a..888ff36d70c83010f1f45e9eeb2dd6b5
      // Specifies a callback to be invoked with service process once it's
      // launched. Will be on UI thread.
      Options& WithProcessCallback(
-         base::OnceCallback<void(const base::Process&)>);
- 
+@@ -111,6 +126,24 @@ class CONTENT_EXPORT ServiceProcessHost {
+     // the service process terminates, notifications are silently skipped.
+     // Will be called on the UI thread.
+     Options& WithObserver(base::WeakPtr<Observer> observer);
 +    // Specifies the working directory for the launched process.
 +    Options& WithCurrentDirectory(const base::FilePath& cwd);
 +
@@ -710,11 +713,10 @@ index 0062d2cb6634b8b29977a0312516b1b13936b40a..888ff36d70c83010f1f45e9eeb2dd6b5
 +    // Specifies if the process should disclaim TCC responsibility.
 +    Options& WithDisclaimResponsibility(bool disclaim_responsibility);
 +#endif  // BUILDFLAG(IS_MAC)
-+
+ 
  #if BUILDFLAG(IS_WIN)
      // Specifies libraries to preload before the sandbox is locked down. Paths
-     // should be absolute paths. Libraries will be preloaded before sandbox
-@@ -127,11 +161,26 @@ class CONTENT_EXPORT ServiceProcessHost {
+@@ -140,12 +173,27 @@ class CONTENT_EXPORT ServiceProcessHost {
      std::optional<GURL> site;
      std::optional<int> child_flags;
      std::vector<std::string> extra_switches;
@@ -725,6 +727,7 @@ index 0062d2cb6634b8b29977a0312516b1b13936b40a..888ff36d70c83010f1f45e9eeb2dd6b5
 +    base::FileHandleMappingVector fds_to_remap;
 +#endif
      base::OnceCallback<void(const base::Process&)> process_callback;
+     base::WeakPtr<Observer> observer;
  #if BUILDFLAG(IS_WIN)
      std::vector<base::FilePath> preload_libraries;
  #endif  // BUILDFLAG(IS_WIN)
@@ -740,7 +743,7 @@ index 0062d2cb6634b8b29977a0312516b1b13936b40a..888ff36d70c83010f1f45e9eeb2dd6b5
 +#endif  // BUILDFLAG(IS_MAC)
    };
  
-   // An interface which can be implemented and registered/unregistered with
+   // An interface which can be implemented and used with
 diff --git a/sandbox/policy/win/sandbox_win.cc b/sandbox/policy/win/sandbox_win.cc
 index 5c92eec064e36fa4be5a57a769a4091a18e3396d..b705450708560c0ae8b386d7efdb5c526964c629 100644
 --- a/sandbox/policy/win/sandbox_win.cc

patches/chromium/feat_corner_smoothing_css_rule_and_blink_painting.patch

@@ -46,7 +46,7 @@ index 6e60de1319c5506d7180719fa230ab9cf537b832..e570e335fbd413340ddedeee423eca71
                      'internal-forced-visited-'):
                  internal_visited_order = 0
 diff --git a/third_party/blink/renderer/core/css/css_properties.json5 b/third_party/blink/renderer/core/css/css_properties.json5
-index 3a14c5d0a462f0f6785bd8d711a7e70e50c05ff9..5f39e61139318294cf2ecdf2e922741740ab8ae9 100644
+index f46a4e31e0ea81f362be1c06bc23f6e6cb15d967..1a7874271e123d4fadd8ae694394061fc0c73cfe 100644
 --- a/third_party/blink/renderer/core/css/css_properties.json5
 +++ b/third_party/blink/renderer/core/css/css_properties.json5
 @@ -9643,6 +9643,27 @@
@@ -91,10 +91,10 @@ index 2afe18e9e4a5404ed184aeedc1c02a313853f463..7c3b0c2da6ded539764ce59bc43f49e9
        return a.EmptyCells() == b.EmptyCells();
      case CSSPropertyID::kFill:
 diff --git a/third_party/blink/renderer/core/css/properties/longhands/longhands_custom.cc b/third_party/blink/renderer/core/css/properties/longhands/longhands_custom.cc
-index b73db1a68d20cca66468db23d4c8e0e49db648b3..8dc1458ab436ce8202811371ee7ce8e077d4fa7b 100644
+index 65c9b1f3a73d3822371f09b0cb764c63aaeb8a31..6e3737cf147252c6999ddcb887309682a91787d6 100644
 --- a/third_party/blink/renderer/core/css/properties/longhands/longhands_custom.cc
 +++ b/third_party/blink/renderer/core/css/properties/longhands/longhands_custom.cc
-@@ -13324,5 +13324,36 @@ const CSSValue* InternalEmptyLineHeight::ParseSingleValue(
+@@ -13328,5 +13328,36 @@ const CSSValue* InternalEmptyLineHeight::ParseSingleValue(
                                           CSSValueID::kNone>(stream);
  }
  
@@ -203,10 +203,10 @@ index 19cda703154dab9397827ab6ea66c2ca446c644d..dd5943c511886f4e39b2e7f10e67e60f
      return result;
    }
 diff --git a/third_party/blink/renderer/platform/BUILD.gn b/third_party/blink/renderer/platform/BUILD.gn
-index 214c0c8bcf1033d077672b822ad53a42d0e09213..e8f9b4873defc9dea6868e8c481e4f4668a7686c 100644
+index 87f64f5c2cfd4bdc8aca697f6115effed091b86e..a11c5cb976077e53a6c3d456d2583f16fb58e415 100644
 --- a/third_party/blink/renderer/platform/BUILD.gn
 +++ b/third_party/blink/renderer/platform/BUILD.gn
-@@ -1673,6 +1673,8 @@ component("platform") {
+@@ -1675,6 +1675,8 @@ component("platform") {
      "widget/widget_base.h",
      "widget/widget_base_client.h",
      "windows_keyboard_codes.h",
@@ -314,7 +314,7 @@ index 18f283e625101318ee14b50e6e765dfd1c9a1a44..44a3a55974c9e4b9e715574075f25661
  
    auto DrawAsSinglePath = [&]() {
 diff --git a/third_party/blink/renderer/platform/runtime_enabled_features.json5 b/third_party/blink/renderer/platform/runtime_enabled_features.json5
-index 515cbf4825600e20ab4ed9c54f2ae705eb5e8f27..4f016f7411882db169ebdff1cfc311698744e760 100644
+index 89301f737c6a1f4043a47366db604967159b7cb6..0f6417f6933f3f71f39b4a06ac229efd3ac7634b 100644
 --- a/third_party/blink/renderer/platform/runtime_enabled_features.json5
 +++ b/third_party/blink/renderer/platform/runtime_enabled_features.json5
 @@ -215,6 +215,10 @@

patches/chromium/feat_enable_offscreen_rendering_with_viz_compositor.patch

@@ -8,10 +8,10 @@ rendering with the viz compositor by way of a custom HostDisplayClient
 and LayeredWindowUpdater.
 
 diff --git a/components/viz/host/host_display_client.cc b/components/viz/host/host_display_client.cc
-index b153c538488b7b77af0630a454604d9fb7eba487..1b97bfae745d3aeaa4ebd3d3a0dfc64f48da0d70 100644
+index 65df78d7f2a311633e8512f46efa005c41930873..1978ac9a080c63f8e9aa323c7215051890c55f00 100644
 --- a/components/viz/host/host_display_client.cc
 +++ b/components/viz/host/host_display_client.cc
-@@ -49,9 +49,9 @@ void HostDisplayClient::OnDisplayReceivedCALayerParams(
+@@ -50,9 +50,9 @@ void HostDisplayClient::OnDisplayReceivedCALayerParams(
  }
  #endif
  
@@ -22,7 +22,7 @@ index b153c538488b7b77af0630a454604d9fb7eba487..1b97bfae745d3aeaa4ebd3d3a0dfc64f
    if (!NeedsToUseLayerWindow(widget_)) {
      DLOG(ERROR) << "HWND shouldn't be using a layered window";
      return;
-@@ -59,7 +59,15 @@ void HostDisplayClient::CreateLayeredWindowUpdater(
+@@ -60,7 +60,15 @@ void HostDisplayClient::CreateLayeredWindowUpdater(
  
    layered_window_updater_ =
        std::make_unique<LayeredWindowUpdaterImpl>(widget_, std::move(receiver));
@@ -508,10 +508,10 @@ index 0000000000000000000000000000000000000000..e1a22ee881c0fd679ac2d2d4d11a3c93
 +
 +#endif  // COMPONENTS_VIZ_SERVICE_DISPLAY_EMBEDDER_SOFTWARE_OUTPUT_DEVICE_PROXY_H_
 diff --git a/components/viz/service/display_embedder/software_output_device_win.cc b/components/viz/service/display_embedder/software_output_device_win.cc
-index b5154321105f08335b67ad2d552afa61337a4976..cb28230d9a8da6bd2259ef0c898013293421ac56 100644
+index 4f9e8946fa02d859e92a6896beba82721914f868..78486eaa993ee7ffd5188b31503de7dda1158297 100644
 --- a/components/viz/service/display_embedder/software_output_device_win.cc
 +++ b/components/viz/service/display_embedder/software_output_device_win.cc
-@@ -156,7 +156,7 @@ void SoftwareOutputDeviceWinProxy::EndPaintDelegated(
+@@ -158,7 +158,7 @@ void SoftwareOutputDeviceWinProxy::EndPaintDelegated(
    if (!canvas_)
      return;
  

patches/chromium/feat_enable_passing_exit_code_on_service_process_crash.patch

@@ -11,10 +11,10 @@ ServiceProcessHost::Observer functions, but we need to pass the exit code to
 the observer.
 
 diff --git a/content/browser/service_host/service_process_tracker.cc b/content/browser/service_host/service_process_tracker.cc
-index fb41c8dfd147a90d7d581b49ad7f909d947cb214..ae0dce9d1dde14f1562adac7d324635983bb4c09 100644
+index c7b620b9dd25c7842470c4827bd55c81c5816e05..a5f72f8bd55e7a2a43e792f91878de52f09fb988 100644
 --- a/content/browser/service_host/service_process_tracker.cc
 +++ b/content/browser/service_host/service_process_tracker.cc
-@@ -51,7 +51,8 @@ void ServiceProcessTracker::NotifyTerminated(ServiceProcessId id) {
+@@ -67,7 +67,8 @@ void ServiceProcessTracker::NotifyTerminated(ServiceProcessId id) {
  
  void ServiceProcessTracker::NotifyCrashed(
      ServiceProcessId id,
@@ -24,22 +24,19 @@ index fb41c8dfd147a90d7d581b49ad7f909d947cb214..ae0dce9d1dde14f1562adac7d3246359
    DCHECK_CURRENTLY_ON(BrowserThread::UI);
    auto iter = processes_.find(id);
    CHECK(iter != processes_.end());
-@@ -65,7 +66,9 @@ void ServiceProcessTracker::NotifyCrashed(
-       break;
+@@ -82,6 +83,7 @@ void ServiceProcessTracker::NotifyCrashed(
    }
-   for (auto& observer : observers_) {
--    observer.OnServiceProcessCrashed(iter->second.Duplicate());
-+    auto params = iter->second.Duplicate();
-+    params.set_exit_code(exit_code);
-+    observer.OnServiceProcessCrashed(params);
+ 
+   auto info_dup = iter->second.Duplicate();
++  info_dup.set_exit_code(exit_code);
+   for (auto& obs : observers_) {
+     obs.OnServiceProcessCrashed(info_dup);
    }
-   processes_.erase(iter);
- }
 diff --git a/content/browser/service_host/service_process_tracker.h b/content/browser/service_host/service_process_tracker.h
-index 9a5179c4eeacf8bbfb2d831b4301836df490f3a8..511fc9b9d5ce14a1b5ef457a1047e40d3bb64273 100644
+index 899fa2680af1c3c491b110cdd2154abe2695bebe..bfd3a4837f361b106e46849e8be2675066387448 100644
 --- a/content/browser/service_host/service_process_tracker.h
 +++ b/content/browser/service_host/service_process_tracker.h
-@@ -36,7 +36,8 @@ class ServiceProcessTracker {
+@@ -40,7 +40,8 @@ class ServiceProcessTracker {
    void NotifyTerminated(ServiceProcessId id);
  
    void NotifyCrashed(ServiceProcessId id,
@@ -50,11 +47,11 @@ index 9a5179c4eeacf8bbfb2d831b4301836df490f3a8..511fc9b9d5ce14a1b5ef457a1047e40d
    void AddObserver(ServiceProcessHost::Observer* observer);
  
 diff --git a/content/browser/service_host/utility_process_client.cc b/content/browser/service_host/utility_process_client.cc
-index 99da7eee3cb1a09b984832211bceee385147aec2..5e4bd537d94ad26c8d309ebfb63845a8d3d11dae 100644
+index 6bb0ad536c4b8ddd32461e54b93471e8a055c5ea..c549032bd6ac0c161e05f6ace5ec0390fda95258 100644
 --- a/content/browser/service_host/utility_process_client.cc
 +++ b/content/browser/service_host/utility_process_client.cc
-@@ -40,7 +40,7 @@ void UtilityProcessClient::OnProcessTerminatedNormally() {
-       process_info_->service_process_id());
+@@ -42,7 +42,7 @@ void UtilityProcessClient::OnProcessTerminatedNormally() {
+   GetServiceProcessTracker().NotifyTerminated(*service_process_id_);
  }
  
 -void UtilityProcessClient::OnProcessCrashed(CrashType type) {
@@ -62,19 +59,19 @@ index 99da7eee3cb1a09b984832211bceee385147aec2..5e4bd537d94ad26c8d309ebfb63845a8
    // TODO(crbug.com/40654042): It is unclear how we can observe
    // |OnProcessCrashed()| without observing |OnProcessLaunched()| first, but
    // it can happen on Android. Ignore the notification in this case.
-@@ -49,6 +49,6 @@ void UtilityProcessClient::OnProcessCrashed(CrashType type) {
+@@ -50,6 +50,6 @@ void UtilityProcessClient::OnProcessCrashed(CrashType type) {
+     return;
    }
  
-   GetServiceProcessTracker().NotifyCrashed(process_info_->service_process_id(),
--                                           type);
-+                                           type, exit_code);
+-  GetServiceProcessTracker().NotifyCrashed(*service_process_id_, type);
++  GetServiceProcessTracker().NotifyCrashed(*service_process_id_, type, exit_code);
  }
  }  // namespace content
 diff --git a/content/browser/service_host/utility_process_client.h b/content/browser/service_host/utility_process_client.h
-index 2648adb1cf38ab557b66ffd0e3034b26b04d76d6..98eab587f343f6ca472efc3d4e7b31b2b8821417 100644
+index 97a0f76571caf19e39d861bf188da9173fc2f8f6..e651e9b2f9a35265da00432cf2ffdc5857c1fa08 100644
 --- a/content/browser/service_host/utility_process_client.h
 +++ b/content/browser/service_host/utility_process_client.h
-@@ -36,7 +36,7 @@ class UtilityProcessClient : public UtilityProcessHost::Client {
+@@ -39,7 +39,7 @@ class UtilityProcessClient : public UtilityProcessHost::Client {
  
    void OnProcessTerminatedNormally() override;
  

patches/chromium/feat_plumb_node_integration_in_worker_through_workersettings.patch

@@ -34,6 +34,48 @@ index 7ea6daec53a497bf867d799e041bf6ae7191ef7b..15940624940d5c629c40319f45c59282
      agent_group_scheduler_compositor_task_runner =
          execution_context->GetScheduler()
              ->ToFrameScheduler()
+diff --git a/third_party/blink/renderer/core/workers/threaded_worklet_messaging_proxy.cc b/third_party/blink/renderer/core/workers/threaded_worklet_messaging_proxy.cc
+index 936f5ebe28caa993ed5de0f7de3613fa338e263f..961ac8091aa82128e1cfb8800a7efcb80d100a05 100644
+--- a/third_party/blink/renderer/core/workers/threaded_worklet_messaging_proxy.cc
++++ b/third_party/blink/renderer/core/workers/threaded_worklet_messaging_proxy.cc
+@@ -13,10 +13,12 @@
+ #include "third_party/blink/public/platform/task_type.h"
+ #include "third_party/blink/renderer/core/dom/document.h"
+ #include "third_party/blink/renderer/core/execution_context/security_context.h"
++#include "third_party/blink/renderer/core/exported/web_view_impl.h"
+ #include "third_party/blink/renderer/core/frame/csp/content_security_policy.h"
+ #include "third_party/blink/renderer/core/frame/local_dom_window.h"
+ #include "third_party/blink/renderer/core/frame/local_frame.h"
+ #include "third_party/blink/renderer/core/frame/local_frame_client.h"
++#include "third_party/blink/renderer/core/frame/web_local_frame_impl.h"
+ #include "third_party/blink/renderer/core/inspector/thread_debugger_common_impl.h"
+ #include "third_party/blink/renderer/core/loader/worker_fetch_context.h"
+ #include "third_party/blink/renderer/core/origin_trials/origin_trial_context.h"
+@@ -135,6 +137,14 @@ void ThreadedWorkletMessagingProxy::Initialize(
+   DCHECK(csp);
+ 
+   LocalFrameClient* frame_client = window->GetFrame()->Client();
++  auto worklet_settings =
++      std::make_unique<WorkerSettings>(window->GetFrame()->GetSettings());
++  if (auto* web_local_frame = WebLocalFrameImpl::FromFrame(window->GetFrame())) {
++    if (auto* web_view = web_local_frame->ViewImpl()) {
++      worklet_settings->SetNodeIntegrationInWorker(
++          web_view->GetWebPreferences().node_integration_in_worker);
++    }
++  }
+   auto global_scope_creation_params =
+       std::make_unique<GlobalScopeCreationParams>(
+           window->Url(), mojom::blink::ScriptType::kModule, global_scope_name,
+@@ -147,8 +157,7 @@ void ThreadedWorkletMessagingProxy::Initialize(
+           window->GetHttpsState(), worker_clients,
+           frame_client->CreateWorkerContentSettingsClient(),
+           OriginTrialContext::GetInheritedTrialFeatures(window).get(),
+-          base::UnguessableToken::Create(),
+-          std::make_unique<WorkerSettings>(window->GetFrame()->GetSettings()),
++          base::UnguessableToken::Create(), std::move(worklet_settings),
+           mojom::blink::V8CacheOptions::kDefault, module_responses_map,
+           mojo::NullRemote() /* browser_interface_broker */,
+           window->GetFrame()->Loader().CreateWorkerCodeCacheHost(),
 diff --git a/third_party/blink/renderer/core/workers/worker_settings.cc b/third_party/blink/renderer/core/workers/worker_settings.cc
 index 45680c5f6ea0c7e89ccf43eb88f8a11e3318c02e..3fa3af62f4e7ba8186441c5e3184b1c04fe32d12 100644
 --- a/third_party/blink/renderer/core/workers/worker_settings.cc
@@ -71,3 +113,56 @@ index 45c60dd2c44b05fdd279f759069383479823c7f2..33a2a0337efb9a46293e11d0d09b3fc1
  
    GenericFontFamilySettings generic_font_family_settings_;
  };
+diff --git a/third_party/blink/renderer/core/workers/worklet_global_scope.cc b/third_party/blink/renderer/core/workers/worklet_global_scope.cc
+index b5300dea97f20d72a807543a6da0baf61d21955f..a7030c1ba6851b26c765c7b05cd26e1453866719 100644
+--- a/third_party/blink/renderer/core/workers/worklet_global_scope.cc
++++ b/third_party/blink/renderer/core/workers/worklet_global_scope.cc
+@@ -32,6 +32,7 @@
+ #include "third_party/blink/renderer/core/script/modulator.h"
+ #include "third_party/blink/renderer/core/workers/global_scope_creation_params.h"
+ #include "third_party/blink/renderer/core/workers/worker_reporting_proxy.h"
++#include "third_party/blink/renderer/core/workers/worker_settings.h"
+ #include "third_party/blink/renderer/core/workers/worker_thread.h"
+ #include "third_party/blink/renderer/core/workers/worklet_module_responses_map.h"
+ #include "third_party/blink/renderer/core/workers/worklet_module_tree_client.h"
+@@ -110,6 +111,10 @@ WorkletGlobalScope::WorkletGlobalScope(
+       parent_cross_origin_isolated_capability_(
+           creation_params->cross_origin_isolated_capability),
+       parent_is_isolated_context_(creation_params->parent_is_isolated_context),
++      node_integration_in_worker_(
++          creation_params->worker_settings
++              ? creation_params->worker_settings->NodeIntegrationInWorker()
++              : false),
+       browser_interface_broker_proxy_(this) {
+   DCHECK((thread_type_ == ThreadType::kMainThread && frame_) ||
+          (thread_type_ == ThreadType::kOffMainThread && worker_thread_));
+diff --git a/third_party/blink/renderer/core/workers/worklet_global_scope.h b/third_party/blink/renderer/core/workers/worklet_global_scope.h
+index c7dd62900f0de48ab992a7c99058f5b6d98212cf..47ceea11ec9db6b67cef6945d165f46c868f4ca5 100644
+--- a/third_party/blink/renderer/core/workers/worklet_global_scope.h
++++ b/third_party/blink/renderer/core/workers/worklet_global_scope.h
+@@ -140,6 +140,13 @@ class CORE_EXPORT WorkletGlobalScope : public WorkerOrWorkletGlobalScope {
+   // Returns the WorkletToken that uniquely identifies this worklet.
+   virtual WorkletToken GetWorkletToken() const = 0;
+ 
++  // Electron: returns whether the creator frame had the
++  // `nodeIntegrationInWorker` web preference enabled. Copied from
++  // GlobalScopeCreationParams::worker_settings at construction time so the
++  // value is readable on the worker thread without crossing back to the
++  // main thread.
++  bool NodeIntegrationInWorker() const { return node_integration_in_worker_; }
++
+   // Returns the ExecutionContextToken that uniquely identifies the parent
+   // context that created this worklet. Note that this will always be a
+   // LocalFrameToken.
+@@ -207,6 +214,11 @@ class CORE_EXPORT WorkletGlobalScope : public WorkerOrWorkletGlobalScope {
+   // TODO(crbug.com/1206150): We need a spec for this capability.
+   const bool parent_is_isolated_context_;
+ 
++  // Electron: snapshot of the creator frame's nodeIntegrationInWorker
++  // WebPreference, copied out of GlobalScopeCreationParams::worker_settings
++  // at construction time.
++  const bool node_integration_in_worker_;
++
+   // This is the interface that handles generated code cache
+   // requests both to fetch code cache when loading resources
+   // and to store generated code cache to disk.

patches/chromium/fix_adjust_headless_mode_handling_in_native_widget.patch

@@ -170,7 +170,7 @@ index 75a82bc82ebe8e7b5b51b760cf4258cfd65a2df5..4b29c955c3347e2907c0d064834d917c
  
    if (params.opacity == views::Widget::InitParams::WindowOpacity::kInferred &&
 diff --git a/ui/views/widget/widget.h b/ui/views/widget/widget.h
-index 9741a329a96db439d074c1d9013558a51f18ed86..c95b315a30994b539fdd2429bab53674823ff5b5 100644
+index 93a47570d4854a3136fc4ac7f46d2f3d5c55db6c..78b720d556fb4f3f316baedaa70e56b1a171ab6a 100644
 --- a/ui/views/widget/widget.h
 +++ b/ui/views/widget/widget.h
 @@ -324,6 +324,11 @@ class VIEWS_EXPORT Widget : public internal::NativeWidgetDelegate,
@@ -195,7 +195,7 @@ index 9741a329a96db439d074c1d9013558a51f18ed86..c95b315a30994b539fdd2429bab53674
      // If set, the window size will follow the content preferred size.
      bool autosize = false;
  
-@@ -1295,6 +1303,11 @@ class VIEWS_EXPORT Widget : public internal::NativeWidgetDelegate,
+@@ -1285,6 +1293,11 @@ class VIEWS_EXPORT Widget : public internal::NativeWidgetDelegate,
    // with it. TYPE_CONTROL and TYPE_TOOLTIP is not considered top level.
    bool is_top_level() const { return is_top_level_; }
  
@@ -207,7 +207,7 @@ index 9741a329a96db439d074c1d9013558a51f18ed86..c95b315a30994b539fdd2429bab53674
    // True if the window size will follow the content preferred size.
    bool is_autosized() const { return is_autosized_; }
  
-@@ -1743,6 +1756,9 @@ class VIEWS_EXPORT Widget : public internal::NativeWidgetDelegate,
+@@ -1730,6 +1743,9 @@ class VIEWS_EXPORT Widget : public internal::NativeWidgetDelegate,
    // If true, the mouse is currently down.
    bool is_mouse_button_pressed_ = false;
  

patches/chromium/fix_check_for_file_existence_before_setting_mtime.patch

@@ -8,7 +8,7 @@ Check for broken links by confirming the file exists before setting its utime.
 This patch should be upstreamed & removed.
 
 diff --git a/tools/clang/scripts/update.py b/tools/clang/scripts/update.py
-index 31e2b5775021564b7c80b6756020973141c08530..88446019ce1a98eab8a648220e5ed0cac623c1e9 100755
+index 5bce95d5ea98c9a6522905f5c237fc5934fe2800..761df90191dd6444d64caf30e2a14c54c8ab536f 100755
 --- a/tools/clang/scripts/update.py
 +++ b/tools/clang/scripts/update.py
 @@ -201,10 +201,9 @@ def DownloadAndUnpack(url, output_dir, path_prefixes=None, is_known_zip=False):

patches/chromium/fix_crash_loading_non-standard_schemes_in_iframes.patch

@@ -28,10 +28,10 @@ The patch should be removed in favor of either:
 Upstream bug https://bugs.chromium.org/p/chromium/issues/detail?id=1081397.
 
 diff --git a/content/browser/renderer_host/navigation_request.cc b/content/browser/renderer_host/navigation_request.cc
-index c0961beb9e8ee039fce607513c81f911128a2d81..4b67c11fa1749c42e9fe04865b8d369a80c7d847 100644
+index 7532fbb742624d86c342df29a7621867fa99180b..45cbb6bcaf16307a6949473ddb62a2be95031199 100644
 --- a/content/browser/renderer_host/navigation_request.cc
 +++ b/content/browser/renderer_host/navigation_request.cc
-@@ -11913,6 +11913,11 @@ url::Origin NavigationRequest::GetOriginForURLLoaderFactoryUnchecked() {
+@@ -11915,6 +11915,11 @@ url::Origin NavigationRequest::GetOriginForURLLoaderFactoryUnchecked() {
              target_rph_id);
    }
  

patches/chromium/fix_initialize_com_on_desktopmedialistcapturethread_on_windows.patch

@@ -0,0 +1,32 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Charles Kerr <charles@charleskerr.com>
+Date: Tue, 24 Mar 2026 16:33:20 -0500
+Subject: fix: initialize COM on DesktopMediaListCaptureThread on Windows
+
+On Windows, the DesktopMediaListCaptureThread runs with a UI message
+pump that doesn't initialize COM. When WebRTC's window capturer
+enumerates windows, interacting with UWP/Metro windows causes twinapi.dll
+to internally call ::CoCreateInstance(), which hits Chromium's
+DCheckedCoCreateInstance hook and triggers a crash.
+
+This patch fixes the crash by ensuring COM is initialized on the
+capture thread by calling `init_com_with_mta(false)`.
+
+diff --git a/chrome/browser/media/webrtc/native_desktop_media_list.cc b/chrome/browser/media/webrtc/native_desktop_media_list.cc
+index 9a8ebb4edfb92d9fe28ae4b87463a68547ea1ab3..13446d9849c54f1bfe515c3db4d69dd181ec6d39 100644
+--- a/chrome/browser/media/webrtc/native_desktop_media_list.cc
++++ b/chrome/browser/media/webrtc/native_desktop_media_list.cc
+@@ -786,6 +786,13 @@ NativeDesktopMediaList::NativeDesktopMediaList(
+   base::MessagePumpType thread_type = base::MessagePumpType::UI;
+ #else
+   base::MessagePumpType thread_type = base::MessagePumpType::DEFAULT;
++#endif
++#if BUILDFLAG(IS_WIN)
++  // On Windows, window enumeration via webrtc::DesktopCapturer may interact
++  // with UWP/Metro windows through twinapi.dll, which internally calls
++  // CoCreateInstance. Initialize COM on this thread to prevent crashes in
++  // Chromium's DCheckedCoCreateInstance hook.
++  thread_.init_com_with_mta(false);
+ #endif
+   thread_.StartWithOptions(base::Thread::Options(thread_type, 0));
+ 

patches/chromium/fix_on-screen-keyboard_hides_on_input_blur_in_webview.patch

@@ -9,10 +9,10 @@ focus node change via TextInputManager.
 chromium-bug: https://crbug.com/1369605
 
 diff --git a/content/browser/renderer_host/render_widget_host_view_aura.cc b/content/browser/renderer_host/render_widget_host_view_aura.cc
-index cae6b1a65d0b8483f7a2bf0bd6dfc7a310216202..6ac0fc4b5d31ff3bce6440ae418145d0dc6882ed 100644
+index ccfe78580c2acb9a3afa43d246e1a83cc0e28598..30218b43ce1d57e45e9c265de4edcdce496cda79 100644
 --- a/content/browser/renderer_host/render_widget_host_view_aura.cc
 +++ b/content/browser/renderer_host/render_widget_host_view_aura.cc
-@@ -3406,6 +3406,12 @@ void RenderWidgetHostViewAura::OnTextSelectionChanged(
+@@ -3403,6 +3403,12 @@ void RenderWidgetHostViewAura::OnTextSelectionChanged(
    }
  }
  
@@ -39,10 +39,10 @@ index 448104cb33edbf6f2c046c4adbac3185eb4c9cb1..47b2677d2878cb9d5544798ddc49b54d
    // Detaches |this| from the input method object.
    // is_removed flag is true if this is called while the window is
 diff --git a/content/browser/renderer_host/text_input_manager.cc b/content/browser/renderer_host/text_input_manager.cc
-index 705a2ee24e463a65784a48844d7c9c26ae7b48db..87bf9b64616688152bd681cb57cefbc68a46d618 100644
+index 86dff7f91f1934d699371f49ee71fea458eb9822..5eda935a18ebabc0a76f99069f6c6a754139f8cc 100644
 --- a/content/browser/renderer_host/text_input_manager.cc
 +++ b/content/browser/renderer_host/text_input_manager.cc
-@@ -184,6 +184,7 @@ void TextInputManager::UpdateTextInputState(
+@@ -185,6 +185,7 @@ void TextInputManager::UpdateTextInputState(
  
    if (text_input_state.type == ui::TEXT_INPUT_TYPE_NONE &&
        active_view_ != view) {
@@ -50,7 +50,7 @@ index 705a2ee24e463a65784a48844d7c9c26ae7b48db..87bf9b64616688152bd681cb57cefbc6
      // We reached here because an IPC is received to reset the TextInputState
      // for |view|. But |view| != |active_view_|, which suggests that at least
      // one other view has become active and we have received the corresponding
-@@ -474,6 +475,12 @@ void TextInputManager::NotifyObserversAboutInputStateUpdate(
+@@ -475,6 +476,12 @@ void TextInputManager::NotifyObserversAboutInputStateUpdate(
      observer.OnUpdateTextInputStateCalled(this, updated_view, did_update_state);
  }
  
@@ -87,10 +87,10 @@ index a4768b51dae6817c9e9a467e9b16e827e0bfebda..83c42b5062aa8193fe2f56e407abe67d
    // The view with active text input state, i.e., a focused <input> element.
    // It will be nullptr if no such view exists. Note that the active view
 diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
-index 8f98cd136d73d5ff795fd3c62a696cc7d2fd3c84..f6b48f3641674bae565ec2c6294d9f6cf1d48db4 100644
+index e039e2c82ad75ca4b95763414f7aafb6d3a3dbf2..aaa2b2229dac8c5e8cf590300b436082f6c3773b 100644
 --- a/content/browser/web_contents/web_contents_impl.cc
 +++ b/content/browser/web_contents/web_contents_impl.cc
-@@ -10430,7 +10430,7 @@ void WebContentsImpl::OnFocusedElementChangedInFrame(
+@@ -10437,7 +10437,7 @@ void WebContentsImpl::OnFocusedElementChangedInFrame(
                          "WebContentsImpl::OnFocusedElementChangedInFrame",
                          "render_frame_host", frame);
    RenderWidgetHostViewBase* root_view =

patches/chromium/fix_restore_original_resize_performance_on_macos.patch

@@ -11,10 +11,10 @@ This patch should be upstreamed as a conditional revert of the logic in desktop
 vs mobile runtimes.  i.e. restore the old logic only on desktop platforms
 
 diff --git a/content/browser/renderer_host/render_widget_host_impl.cc b/content/browser/renderer_host/render_widget_host_impl.cc
-index 3e62cf797e2fc127c4af86a912224f6c745b87f5..903b731a9cd58e418c26099044da62f7a23bd6ea 100644
+index 06599737a290ba4c52a7d36725aef565d49800bd..fe26e2aeba6fc03201373693d4afa2b78c89e54a 100644
 --- a/content/browser/renderer_host/render_widget_host_impl.cc
 +++ b/content/browser/renderer_host/render_widget_host_impl.cc
-@@ -2147,9 +2147,8 @@ RenderWidgetHostImpl::GetWidgetInputHandler() {
+@@ -2155,9 +2155,8 @@ RenderWidgetHostImpl::GetWidgetInputHandler() {
  void RenderWidgetHostImpl::NotifyScreenInfoChanged() {
    // The resize message (which may not happen immediately) will carry with it
    // the screen info as well as the new size (if the screen has changed scale

patches/chromium/fix_return_v8_value_from_localframe_requestexecutescript.patch

@@ -211,7 +211,7 @@ index f2c94689450f0333a144ccf82cf147c194896e6b..1c2e9fe36c297f7d614d9ca290e4d13c
    const mojom::blink::UserActivationOption user_activation_option_;
    const mojom::blink::LoadEventBlockingOption blocking_option_;
 diff --git a/third_party/blink/renderer/core/frame/web_frame_test.cc b/third_party/blink/renderer/core/frame/web_frame_test.cc
-index dec0b09e07c568b74b5ba25e8e3cb9f5b5cf7070..f28392d50ded3bb1ecb891314a989f1c07167bf6 100644
+index 7d4039de028e6c7ef87e93792961c338032b261d..41d0a336dc4c91c74c57383f9203f7bca7675b66 100644
 --- a/third_party/blink/renderer/core/frame/web_frame_test.cc
 +++ b/third_party/blink/renderer/core/frame/web_frame_test.cc
 @@ -300,6 +300,7 @@ void ExecuteScriptsInMainWorld(

patches/chromium/fix_select_the_first_menu_item_when_opened_via_keyboard.patch

@@ -6,7 +6,7 @@ Subject: fix: select the first menu item when opened via keyboard
 This fixes an accessibility issue where the root view is 'focused' to the screen reader instead of the first menu item as with all other native menus. This patch will be upstreamed.
 
 diff --git a/ui/views/controls/menu/menu_controller.cc b/ui/views/controls/menu/menu_controller.cc
-index 1b779f740710a49056f8b6b88df9033dd1289c91..21339edaab1069186f904f1c64a9c66f70c42a77 100644
+index 63f140c698fb1e5ba1f93c24bfe19bc3f87cec19..ea1824d09b37f6404985ffb048ce196ad5811507 100644
 --- a/ui/views/controls/menu/menu_controller.cc
 +++ b/ui/views/controls/menu/menu_controller.cc
 @@ -724,6 +724,16 @@ void MenuController::Run(Widget* parent,
@@ -26,7 +26,7 @@ index 1b779f740710a49056f8b6b88df9033dd1289c91..21339edaab1069186f904f1c64a9c66f
    if (button_controller) {
      pressed_lock_ = button_controller->TakeLock(
          false, ui::LocatedEvent::FromIfValid(event));
-@@ -2530,18 +2540,15 @@ void MenuController::OpenMenuImpl(MenuItemView* item, bool show) {
+@@ -2535,18 +2545,15 @@ void MenuController::OpenMenuImpl(MenuItemView* item, bool show) {
      }
      item->GetSubmenu()->ShowAt(params);
  

patches/chromium/frame_host_manager.patch

@@ -6,10 +6,10 @@ Subject: frame_host_manager.patch
 Allows embedder to intercept site instances created by chromium.
 
 diff --git a/content/browser/renderer_host/render_frame_host_manager.cc b/content/browser/renderer_host/render_frame_host_manager.cc
-index 1e76d25ab16ec1215e4c532fd7cb73702f16ffc6..8af96cfe14c4358cb6ab09135c04b04530f6e033 100644
+index f9179c9f42b16b5c73b7102700410f2d1b83aeab..abce85bb4fb63d1662bbc9ad28a1047f97c6d3c4 100644
 --- a/content/browser/renderer_host/render_frame_host_manager.cc
 +++ b/content/browser/renderer_host/render_frame_host_manager.cc
-@@ -4891,6 +4891,9 @@ RenderFrameHostManager::GetSiteInstanceForNavigationRequest(
+@@ -4913,6 +4913,9 @@ RenderFrameHostManager::GetSiteInstanceForNavigationRequest(
      request->ResetStateForSiteInstanceChange();
    }
  
@@ -20,7 +20,7 @@ index 1e76d25ab16ec1215e4c532fd7cb73702f16ffc6..8af96cfe14c4358cb6ab09135c04b045
  }
  
 diff --git a/content/public/browser/content_browser_client.h b/content/public/browser/content_browser_client.h
-index 02321334795bb096206146caf24084c12347664e..70d485a1ef60230e2bcc5e64c02f35af805c87f5 100644
+index eb684232648424fab4ba73b1fc813b0b3f8b809b..42b6fe4eb2c1db7afd6379ae07c1062856ed958e 100644
 --- a/content/public/browser/content_browser_client.h
 +++ b/content/public/browser/content_browser_client.h
 @@ -350,6 +350,11 @@ class CONTENT_EXPORT ContentBrowserClient {

patches/chromium/gritsettings_resource_ids.patch

@@ -6,10 +6,10 @@ Subject: gritsettings_resource_ids.patch
 Add electron resources file to the list of resource ids generation.
 
 diff --git a/tools/gritsettings/resource_ids.spec b/tools/gritsettings/resource_ids.spec
-index 98b18d9e8129f2b06c4633b4ff74320fa2dee5f6..2f9bbe7578ce8e255a4aed6dd9dacea245640795 100644
+index ffd47250ce5a6a75471bb65aaf3d65b550be3586..e75f89f05ba0e3cc29d857f76244d777efdf1b84 100644
 --- a/tools/gritsettings/resource_ids.spec
 +++ b/tools/gritsettings/resource_ids.spec
-@@ -1670,6 +1670,11 @@
+@@ -1678,6 +1678,11 @@
      "includes": [12000],
    },
  

patches/chromium/mas_avoid_private_macos_api_usage.patch.patch

@@ -50,7 +50,7 @@ system font by checking if it's kCTFontPriorityAttribute is set to
 system priority.
 
 diff --git a/base/BUILD.gn b/base/BUILD.gn
-index 2fea06e3d762884df05e74c0cef98990c302f814..fbadbe444df1b58e9e9cb985d30d009b661802ec 100644
+index aad39d792791fb1e17d7a529eb234f74fdb65b09..95262f1cb611bfa9ac61321312b0aa5a979900cd 100644
 --- a/base/BUILD.gn
 +++ b/base/BUILD.gn
 @@ -1086,6 +1086,7 @@ component("base") {
@@ -129,7 +129,7 @@ index 416e541436d201aabca26cdbf7e8477103bd014c..8c5f92b03d67e5f0587b0e9420969061
  }
  
 diff --git a/base/allocator/partition_allocator/src/partition_alloc/BUILD.gn b/base/allocator/partition_allocator/src/partition_alloc/BUILD.gn
-index 5c058b320fb0655db4eeb807b56547de83baa59a..ac397a51a961886e374bcf732fd5731ccfaf687e 100644
+index 51a9d1fef7b2dbfef69f8474d74d45b69f16219d..cd61d8ae6ac772f8b8c28157e21b439cdb87dcca 100644
 --- a/base/allocator/partition_allocator/src/partition_alloc/BUILD.gn
 +++ b/base/allocator/partition_allocator/src/partition_alloc/BUILD.gn
 @@ -978,6 +978,7 @@ if (is_clang_or_gcc) {
@@ -974,7 +974,7 @@ index 664e12c07204feeb5be16581fe51e8adc4b898dd..38159d146cdf71f84611d58e2983418a
    return kAttributes;
  }
 diff --git a/content/browser/BUILD.gn b/content/browser/BUILD.gn
-index 1742ffc72707b7566982e60ae4964d0da901cbfe..56a1b7fb501979812b1f2e194044667f84f2312e 100644
+index 718b28f411f7c32af45dc1e1cf4b4deeba78b06b..3a2189e97b99b2b2cf0308feeeddb9a249b3edb5 100644
 --- a/content/browser/BUILD.gn
 +++ b/content/browser/BUILD.gn
 @@ -363,6 +363,7 @@ source_set("browser") {
@@ -1020,7 +1020,7 @@ index d4320df856533ef75f943deeac82119c746f5e20..c6e9cc8fd3b3e152493086a6f401d1c6
    // Used to force the NSApplication's focused accessibility element to be the
    // content::BrowserAccessibilityCocoa accessibility tree when the NSView for
 diff --git a/content/browser/renderer_host/render_widget_host_view_mac.mm b/content/browser/renderer_host/render_widget_host_view_mac.mm
-index 0241e3d3afaf7cd70214f71c1c8f023a49669ff8..f7c3e60f748e24e51bffa2bc8914a8a7b67bd504 100644
+index 63041c4311293c53d370522646012cde803e0a99..886b3e87e9041931d3cb59ef775b5012e8e2f908 100644
 --- a/content/browser/renderer_host/render_widget_host_view_mac.mm
 +++ b/content/browser/renderer_host/render_widget_host_view_mac.mm
 @@ -53,6 +53,7 @@
@@ -1042,7 +1042,7 @@ index 0241e3d3afaf7cd70214f71c1c8f023a49669ff8..f7c3e60f748e24e51bffa2bc8914a8a7
  
    // Reset `ns_view_` before resetting `remote_ns_view_` to avoid dangling
    // pointers. `ns_view_` gets reinitialized later in this method.
-@@ -1713,10 +1716,12 @@ void CombineTextNodesAndMakeCallback(SpeechCallback callback,
+@@ -1720,10 +1723,12 @@ void CombineTextNodesAndMakeCallback(SpeechCallback callback,
  
  gfx::NativeViewAccessible
  RenderWidgetHostViewMac::AccessibilityGetNativeViewAccessibleForWindow() {
@@ -1055,7 +1055,7 @@ index 0241e3d3afaf7cd70214f71c1c8f023a49669ff8..f7c3e60f748e24e51bffa2bc8914a8a7
    return gfx::NativeViewAccessible([GetInProcessNSView() window]);
  }
  
-@@ -1768,9 +1773,11 @@ void CombineTextNodesAndMakeCallback(SpeechCallback callback,
+@@ -1775,9 +1780,11 @@ void CombineTextNodesAndMakeCallback(SpeechCallback callback,
  }
  
  void RenderWidgetHostViewMac::SetAccessibilityWindow(NSWindow* window) {
@@ -1067,7 +1067,7 @@ index 0241e3d3afaf7cd70214f71c1c8f023a49669ff8..f7c3e60f748e24e51bffa2bc8914a8a7
  }
  
  bool RenderWidgetHostViewMac::SyncIsWidgetForMainFrame(
-@@ -2300,20 +2307,26 @@ void CombineTextNodesAndMakeCallback(SpeechCallback callback,
+@@ -2307,20 +2314,26 @@ void CombineTextNodesAndMakeCallback(SpeechCallback callback,
  void RenderWidgetHostViewMac::GetRenderWidgetAccessibilityToken(
      GetRenderWidgetAccessibilityTokenCallback callback) {
    base::ProcessId pid = getpid();
@@ -1095,10 +1095,10 @@ index 0241e3d3afaf7cd70214f71c1c8f023a49669ff8..f7c3e60f748e24e51bffa2bc8914a8a7
  
  ///////////////////////////////////////////////////////////////////////////////
 diff --git a/content/common/BUILD.gn b/content/common/BUILD.gn
-index c759540ec86f1eca0d5b6ef61b899eb5fcdca16f..9ea2729f7c805bea9aa417fc0371fd2240cf544a 100644
+index 6294792999d1653b73c695ebfddda0f8a45d82c9..da6be02dcff5d956e69fa356ec6dea65aa9780af 100644
 --- a/content/common/BUILD.gn
 +++ b/content/common/BUILD.gn
-@@ -280,6 +280,7 @@ source_set("common") {
+@@ -282,6 +282,7 @@ source_set("common") {
      "//ui/shell_dialogs",
      "//url",
      "//url/ipc:url_ipc",
@@ -1189,7 +1189,7 @@ index a1068589ad844518038ee7bc15a3de9bc5cba525..1ff781c49f086ec8015c7d3c44567dbe
  
  }  // namespace content
 diff --git a/content/test/BUILD.gn b/content/test/BUILD.gn
-index 45de48909df23b461aa8924bb391f13242aacef4..da0faf5bc419a11d192487ea373cee63596c2032 100644
+index ec792aa7e050550721cd221bfe8ff335e22e90ef..4521cc9e247c44248627c12b9eda0961f837d744 100644
 --- a/content/test/BUILD.gn
 +++ b/content/test/BUILD.gn
 @@ -701,6 +701,7 @@ static_library("test_support") {
@@ -1209,7 +1209,7 @@ index 45de48909df23b461aa8924bb391f13242aacef4..da0faf5bc419a11d192487ea373cee63
  }
  
  mojom("content_test_mojo_bindings") {
-@@ -2077,6 +2080,7 @@ test("content_browsertests") {
+@@ -2078,6 +2081,7 @@ test("content_browsertests") {
      "//ui/shell_dialogs",
      "//ui/snapshot",
      "//ui/webui:test_support",
@@ -1217,7 +1217,7 @@ index 45de48909df23b461aa8924bb391f13242aacef4..da0faf5bc419a11d192487ea373cee63
    ]
  
    if (!(is_chromeos && target_cpu == "arm64" && current_cpu == "arm")) {
-@@ -3441,6 +3445,7 @@ test("content_unittests") {
+@@ -3446,6 +3450,7 @@ test("content_unittests") {
      "//ui/shell_dialogs",
      "//ui/webui:test_support",
      "//url",

patches/chromium/network_service_allow_remote_certificate_verification_logic.patch

@@ -7,10 +7,10 @@ This adds a callback from the network service that's used to implement
 session.setCertificateVerifyCallback.
 
 diff --git a/services/network/network_context.cc b/services/network/network_context.cc
-index 0d70e10657f5f1cc5811e56044f13d9ae6c7f2a1..4efd5407479b9e5ee6af84a4cd6d26895d8b19f7 100644
+index 68b3acc5a4e67fee975fd982f252cbf46c28ccac..cf1001557f2f59747ceb394ab2c93b4bf379dafb 100644
 --- a/services/network/network_context.cc
 +++ b/services/network/network_context.cc
-@@ -172,6 +172,11 @@
+@@ -173,6 +173,11 @@
  #include "services/network/web_transport.h"
  #include "url/gurl.h"
  
@@ -22,7 +22,7 @@ index 0d70e10657f5f1cc5811e56044f13d9ae6c7f2a1..4efd5407479b9e5ee6af84a4cd6d2689
  #if BUILDFLAG(IS_CT_SUPPORTED)
  // gn check does not account for BUILDFLAG(). So, for iOS builds, it will
  // complain about a missing dependency on the target exposing this header. Add a
-@@ -631,6 +636,111 @@ void RecordHSTSPreconnectUpgradeReason(HSTSRedirectUpgradeReason reason) {
+@@ -632,6 +637,111 @@ void RecordHSTSPreconnectUpgradeReason(HSTSRedirectUpgradeReason reason) {
  
  }  // namespace
  
@@ -134,7 +134,7 @@ index 0d70e10657f5f1cc5811e56044f13d9ae6c7f2a1..4efd5407479b9e5ee6af84a4cd6d2689
  constexpr uint32_t NetworkContext::kMaxOutstandingRequestsPerProcess;
  
  NetworkContext::NetworkContextHttpAuthPreferences::
-@@ -1078,6 +1188,13 @@ void NetworkContext::SetClient(
+@@ -1081,6 +1191,13 @@ void NetworkContext::SetClient(
    client_.Bind(std::move(client));
  }
  
@@ -148,7 +148,7 @@ index 0d70e10657f5f1cc5811e56044f13d9ae6c7f2a1..4efd5407479b9e5ee6af84a4cd6d2689
  void NetworkContext::CreateURLLoaderFactory(
      mojo::PendingReceiver<mojom::URLLoaderFactory> receiver,
      mojom::URLLoaderFactoryParamsPtr params) {
-@@ -2767,6 +2884,10 @@ URLRequestContextOwner NetworkContext::MakeURLRequestContext(
+@@ -2800,6 +2917,10 @@ URLRequestContextOwner NetworkContext::MakeURLRequestContext(
      cert_verifier = std::make_unique<net::CachingCertVerifier>(
          std::make_unique<net::CoalescingCertVerifier>(
              std::move(cert_verifier)));
@@ -160,10 +160,10 @@ index 0d70e10657f5f1cc5811e56044f13d9ae6c7f2a1..4efd5407479b9e5ee6af84a4cd6d2689
  
    builder.SetCertVerifier(IgnoreErrorsCertVerifier::MaybeWrapCertVerifier(
 diff --git a/services/network/network_context.h b/services/network/network_context.h
-index 80f64d8bc17c9a706dafd3e9639a6d7e62caf0d5..912e4d60647f6376dfef62d18998b556bc7efa32 100644
+index 54a5feca1fbec658039826304f27283bd9d9c15a..04e6e884dccbb680a39f2b9c8a54de162e056a30 100644
 --- a/services/network/network_context.h
 +++ b/services/network/network_context.h
-@@ -121,6 +121,7 @@ class SimpleUrlPatternMatcher;
+@@ -122,6 +122,7 @@ class SimpleUrlPatternMatcher;
  }
  
  namespace network {
@@ -171,7 +171,7 @@ index 80f64d8bc17c9a706dafd3e9639a6d7e62caf0d5..912e4d60647f6376dfef62d18998b556
  class CookieManager;
  class HostResolver;
  class MdnsResponderManager;
-@@ -257,6 +258,8 @@ class COMPONENT_EXPORT(NETWORK_SERVICE) NetworkContext
+@@ -258,6 +259,8 @@ class COMPONENT_EXPORT(NETWORK_SERVICE) NetworkContext
    void CreateURLLoaderFactory(
        mojo::PendingReceiver<mojom::URLLoaderFactory> receiver,
        mojom::URLLoaderFactoryParamsPtr params) override;
@@ -180,7 +180,7 @@ index 80f64d8bc17c9a706dafd3e9639a6d7e62caf0d5..912e4d60647f6376dfef62d18998b556
    void ResetURLLoaderFactories() override;
    void GetViaObliviousHttp(
        mojom::ObliviousHttpRequestPtr request,
-@@ -982,6 +985,8 @@ class COMPONENT_EXPORT(NETWORK_SERVICE) NetworkContext
+@@ -1002,6 +1005,8 @@ class COMPONENT_EXPORT(NETWORK_SERVICE) NetworkContext
    std::vector<base::OnceClosure> dismount_closures_;
  #endif  // BUILDFLAG(IS_DIRECTORY_TRANSFER_REQUIRED)
  
@@ -190,7 +190,7 @@ index 80f64d8bc17c9a706dafd3e9639a6d7e62caf0d5..912e4d60647f6376dfef62d18998b556
    std::unique_ptr<HostResolver> internal_host_resolver_;
    std::set<std::unique_ptr<HostResolver>, base::UniquePtrComparator>
 diff --git a/services/network/public/mojom/network_context.mojom b/services/network/public/mojom/network_context.mojom
-index 47134ad9365ce50035d5a305418e36a41fc917c9..63d410dd356594a5928ed2f84b05b403bf3367f0 100644
+index 152bffb4e6565437e867b79364c594305350047f..6c43c2985123525793dd6b60c9d7d7c1db7fdf04 100644
 --- a/services/network/public/mojom/network_context.mojom
 +++ b/services/network/public/mojom/network_context.mojom
 @@ -325,6 +325,17 @@ struct SocketBrokerRemotes {
@@ -211,7 +211,7 @@ index 47134ad9365ce50035d5a305418e36a41fc917c9..63d410dd356594a5928ed2f84b05b403
  // Parameters for constructing a network context.
  struct NetworkContextParams {
    // The user agent string.
-@@ -977,6 +988,9 @@ interface NetworkContext {
+@@ -981,6 +992,9 @@ interface NetworkContext {
    // Sets a client for this network context.
    SetClient(pending_remote<NetworkContextClient> client);
  
@@ -222,7 +222,7 @@ index 47134ad9365ce50035d5a305418e36a41fc917c9..63d410dd356594a5928ed2f84b05b403
    CreateURLLoaderFactory(
        pending_receiver<URLLoaderFactory> url_loader_factory,
 diff --git a/services/network/test/test_network_context.h b/services/network/test/test_network_context.h
-index beb1c3dba14fcc504886f100b1568768231a4f2d..bc26f449109b3be84490fbb3569e36aa4aca8c4b 100644
+index 8b419ec4a949551557eba8c84589a18147b78c5d..b472be0acdc0cd4971e6e0a9e623bc1c84d07a02 100644
 --- a/services/network/test/test_network_context.h
 +++ b/services/network/test/test_network_context.h
 @@ -63,6 +63,8 @@ class TestNetworkContext : public mojom::NetworkContext {

patches/chromium/printing.patch

@@ -512,10 +512,10 @@ index aa79c324af2cec50019bca3bccff5d420fb30ffd..0b85598f87673537eccdd0b310e8462e
      scoped_refptr<base::RefCountedMemory> print_data,
      const gfx::Size& page_size,
 diff --git a/chrome/browser/printing/print_view_manager_base.h b/chrome/browser/printing/print_view_manager_base.h
-index db3b04ba3353831ec766f48450b6dce40909bc59..d6fd0d304dffa71be42547a3f6ee6cdb7546de8b 100644
+index b6bbf0f1829a6759f65535679aafb8e407242166..f355b8981e8fc672b1ad165b3b770d3f17b3e13c 100644
 --- a/chrome/browser/printing/print_view_manager_base.h
 +++ b/chrome/browser/printing/print_view_manager_base.h
-@@ -46,6 +46,8 @@ namespace printing {
+@@ -48,6 +48,8 @@ namespace printing {
  class PrintQueriesQueue;
  class PrinterQuery;
  
@@ -524,7 +524,7 @@ index db3b04ba3353831ec766f48450b6dce40909bc59..d6fd0d304dffa71be42547a3f6ee6cdb
  // Base class for managing the print commands for a WebContents.
  class PrintViewManagerBase : public PrintManager, public PrintJob::Observer {
   public:
-@@ -76,7 +78,9 @@ class PrintViewManagerBase : public PrintManager, public PrintJob::Observer {
+@@ -78,7 +80,9 @@ class PrintViewManagerBase : public PrintManager, public PrintJob::Observer {
    // Prints the current document immediately. Since the rendering is
    // asynchronous, the actual printing will not be completed on the return of
    // this function. Returns false if printing is impossible at the moment.
@@ -535,7 +535,7 @@ index db3b04ba3353831ec766f48450b6dce40909bc59..d6fd0d304dffa71be42547a3f6ee6cdb
  
    // Like PrintNow(), but for the node under the context menu, instead of the
    // entire frame.
-@@ -130,8 +134,10 @@ class PrintViewManagerBase : public PrintManager, public PrintJob::Observer {
+@@ -132,8 +136,10 @@ class PrintViewManagerBase : public PrintManager, public PrintJob::Observer {
    void IsPrintingEnabled(IsPrintingEnabledCallback callback) override;
    void ScriptedPrint(mojom::ScriptedPrintParamsPtr params,
                       ScriptedPrintCallback callback) override;
@@ -546,7 +546,7 @@ index db3b04ba3353831ec766f48450b6dce40909bc59..d6fd0d304dffa71be42547a3f6ee6cdb
  
    // Adds and removes observers for `PrintViewManagerBase` events. The order in
    // which notifications are sent to observers is undefined. Observers must be
-@@ -139,6 +145,14 @@ class PrintViewManagerBase : public PrintManager, public PrintJob::Observer {
+@@ -141,6 +147,14 @@ class PrintViewManagerBase : public PrintManager, public PrintJob::Observer {
    void AddTestObserver(TestObserver& observer);
    void RemoveTestObserver(TestObserver& observer);
  
@@ -561,7 +561,7 @@ index db3b04ba3353831ec766f48450b6dce40909bc59..d6fd0d304dffa71be42547a3f6ee6cdb
   protected:
  #if BUILDFLAG(ENTERPRISE_CONTENT_ANALYSIS)
    using PrintDocumentCallback =
-@@ -218,7 +232,7 @@ class PrintViewManagerBase : public PrintManager, public PrintJob::Observer {
+@@ -220,7 +234,7 @@ class PrintViewManagerBase : public PrintManager, public PrintJob::Observer {
                                       mojom::ScriptedPrintParamsPtr params,
                                       ScriptedPrintCallback callback);
  
@@ -570,7 +570,7 @@ index db3b04ba3353831ec766f48450b6dce40909bc59..d6fd0d304dffa71be42547a3f6ee6cdb
    // Helper method bound to `content_analysis_before_printing_document_` when
    // content analysis should happen right before the document is to be printed.
    // This method is virtual for testing purposes.
-@@ -282,6 +296,7 @@ class PrintViewManagerBase : public PrintManager, public PrintJob::Observer {
+@@ -284,6 +298,7 @@ class PrintViewManagerBase : public PrintManager, public PrintJob::Observer {
                                  bool success);
  #endif
    void CompleteUpdatePrintSettings(
@@ -578,7 +578,7 @@ index db3b04ba3353831ec766f48450b6dce40909bc59..d6fd0d304dffa71be42547a3f6ee6cdb
        base::DictValue job_settings,
        std::unique_ptr<PrintSettings> print_settings,
        UpdatePrintSettingsCallback callback);
-@@ -376,8 +391,11 @@ class PrintViewManagerBase : public PrintManager, public PrintJob::Observer {
+@@ -378,8 +393,11 @@ class PrintViewManagerBase : public PrintManager, public PrintJob::Observer {
    // The current RFH that is printing with a system printing dialog.
    raw_ptr<content::RenderFrameHost> printing_rfh_ = nullptr;
  

patches/chromium/refactor_expose_cursor_changes_to_the_webcontentsobserver.patch

@@ -30,10 +30,10 @@ index 4dad6bbade99a00b5ae0f45d4de34d866918545c..6c7ec195fa64e3a1a718811192c9f6fd
    // RenderWidgetHost on the primary main frame, and false otherwise.
    virtual bool IsWidgetForPrimaryMainFrame(RenderWidgetHostImpl*);
 diff --git a/content/browser/renderer_host/render_widget_host_impl.cc b/content/browser/renderer_host/render_widget_host_impl.cc
-index 1919546e9be90303d1aee29208d8227ece452827..3e62cf797e2fc127c4af86a912224f6c745b87f5 100644
+index 8df679251dc314a94079fcc9d4edd7fab12873d4..06599737a290ba4c52a7d36725aef565d49800bd 100644
 --- a/content/browser/renderer_host/render_widget_host_impl.cc
 +++ b/content/browser/renderer_host/render_widget_host_impl.cc
-@@ -2058,6 +2058,9 @@ void RenderWidgetHostImpl::SetCursor(const ui::Cursor& cursor) {
+@@ -2066,6 +2066,9 @@ void RenderWidgetHostImpl::SetCursor(const ui::Cursor& cursor) {
    if (view_) {
      view_->UpdateCursor(cursor);
    }
@@ -44,10 +44,10 @@ index 1919546e9be90303d1aee29208d8227ece452827..3e62cf797e2fc127c4af86a912224f6c
  
  void RenderWidgetHostImpl::ShowContextMenuAtPoint(
 diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
-index 0088e16862b4eb08e2100f13e0d9fecfc0d8aa9d..ec75b1a31c029ff9f1d23f297be4ae40bc24af9c 100644
+index 4e91b3aeb5630476c660e8814e2fd9d92c5a9ca1..d43e75c20aca09080f4223d339c88381f030c504 100644
 --- a/content/browser/web_contents/web_contents_impl.cc
 +++ b/content/browser/web_contents/web_contents_impl.cc
-@@ -6335,6 +6335,11 @@ TextInputManager* WebContentsImpl::GetTextInputManager() {
+@@ -6342,6 +6342,11 @@ TextInputManager* WebContentsImpl::GetTextInputManager() {
    return text_input_manager_.get();
  }
  

patches/chromium/refactor_expose_file_system_access_blocklist.patch

@@ -8,7 +8,7 @@ it in Electron and prevent drift from Chrome's blocklist. We should look for a w
 to upstream this change to Chrome.
 
 diff --git a/chrome/browser/file_system_access/chrome_file_system_access_permission_context.cc b/chrome/browser/file_system_access/chrome_file_system_access_permission_context.cc
-index 4e769e8be28ffd18788d8786fe7341e5d5b0697c..2f447d1a3e7ab50458159bcb717220bb60f6f6ea 100644
+index fc75611edcaffa0501d5ad171e82e42a9d48002b..087d79d3249b7589f7f4cd5f7330edf33b7ec165 100644
 --- a/chrome/browser/file_system_access/chrome_file_system_access_permission_context.cc
 +++ b/chrome/browser/file_system_access/chrome_file_system_access_permission_context.cc
 @@ -83,11 +83,13 @@
@@ -25,14 +25,10 @@ index 4e769e8be28ffd18788d8786fe7341e5d5b0697c..2f447d1a3e7ab50458159bcb717220bb
  #include "components/tabs/public/tab_interface.h"
  #if BUILDFLAG(ENABLE_PLATFORM_APPS)
  #include "extensions/browser/extension_registry.h"  // nogncheck
-@@ -286,190 +288,10 @@ bool MaybeIsLocalUNCPath(const base::FilePath& path) {
+@@ -287,214 +289,10 @@ bool MaybeIsLocalUNCPath(const base::FilePath& path) {
  }
  #endif
  
--// Sentinel used to indicate that no PathService key is specified for a path in
--// the struct below.
--constexpr const int kNoBasePathKey = -1;
--
 -// A wrapper around `base::NormalizeFilePath` that returns its result instead of
 -// using an out parameter.
 -base::FilePath NormalizeFilePath(const base::FilePath& path) {
@@ -62,117 +58,132 @@ index 4e769e8be28ffd18788d8786fe7341e5d5b0697c..2f447d1a3e7ab50458159bcb717220bb
 -
 -std::unique_ptr<ChromeFileSystemAccessPermissionContext::BlockPathRules>
 -GenerateBlockPaths(bool should_normalize_file_path) {
--  static constexpr ChromeFileSystemAccessPermissionContext::BlockPath
--      kBlockPaths[] = {
--          // Don't allow users to share their entire home directory, entire
--          // desktop or entire documents folder, but do allow sharing anything
--          // inside those directories not otherwise blocked.
--          {base::DIR_HOME, nullptr, BlockType::kDontBlockChildren},
--          {base::DIR_USER_DESKTOP, nullptr, BlockType::kDontBlockChildren},
--          {chrome::DIR_USER_DOCUMENTS, nullptr, BlockType::kDontBlockChildren},
--          // Similar restrictions for the downloads directory.
--          {chrome::DIR_DEFAULT_DOWNLOADS, nullptr,
--           BlockType::kDontBlockChildren},
--          {chrome::DIR_DEFAULT_DOWNLOADS_SAFE, nullptr,
--           BlockType::kDontBlockChildren},
--          // The Chrome installation itself should not be modified by the web.
--          {base::DIR_EXE, nullptr, BlockType::kBlockAllChildren},
--          {base::DIR_MODULE, nullptr, BlockType::kBlockAllChildren},
--          {base::DIR_ASSETS, nullptr, BlockType::kBlockAllChildren},
--          // And neither should the configuration of at least the currently
--          // running Chrome instance (note that this does not take
--          // --user-data-dir command line overrides into account).
--          {chrome::DIR_USER_DATA, nullptr, BlockType::kBlockAllChildren},
--          // ~/.ssh is pretty sensitive on all platforms, so block access to
--          // that.
--          {base::DIR_HOME, FILE_PATH_LITERAL(".ssh"),
--           BlockType::kBlockAllChildren},
--          // And limit access to ~/.gnupg as well.
--          {base::DIR_HOME, FILE_PATH_LITERAL(".gnupg"),
--           BlockType::kBlockAllChildren},
+-  using BlockPath = ChromeFileSystemAccessPermissionContext::BlockPath;
+-  static constexpr BlockPath kBlockPaths[] = {
+-      // Don't allow users to share their entire home directory, entire desktop
+-      // or entire documents folder, but do allow sharing anything inside those
+-      // directories not otherwise blocked.
+-      BlockPath::CreateRelative(base::DIR_HOME, BlockType::kDontBlockChildren),
+-      BlockPath::CreateRelative(base::DIR_USER_DESKTOP,
+-                                BlockType::kDontBlockChildren),
+-      BlockPath::CreateRelative(chrome::DIR_USER_DOCUMENTS,
+-                                BlockType::kDontBlockChildren),
+-      // Similar restrictions for the downloads directory.
+-      BlockPath::CreateRelative(chrome::DIR_DEFAULT_DOWNLOADS,
+-                                BlockType::kDontBlockChildren),
+-      BlockPath::CreateRelative(chrome::DIR_DEFAULT_DOWNLOADS_SAFE,
+-                                BlockType::kDontBlockChildren),
+-      // The Chrome installation itself should not be modified by the web.
+-      BlockPath::CreateRelative(base::DIR_EXE, BlockType::kBlockAllChildren),
+-      BlockPath::CreateRelative(base::DIR_MODULE, BlockType::kBlockAllChildren),
+-      BlockPath::CreateRelative(base::DIR_ASSETS, BlockType::kBlockAllChildren),
+-      // And neither should the configuration of at least the currently running
+-      // Chrome instance (note that this does not take --user-data-dir command
+-      // line overrides into account).
+-      BlockPath::CreateRelative(chrome::DIR_USER_DATA,
+-                                BlockType::kBlockAllChildren),
+-      // ~/.ssh is pretty sensitive on all platforms, so block access to that.
+-      BlockPath::CreateRelative(base::DIR_HOME, FILE_PATH_LITERAL(".ssh"),
+-                                BlockType::kBlockAllChildren),
+-      // And limit access to ~/.gnupg as well.
+-      BlockPath::CreateRelative(base::DIR_HOME, FILE_PATH_LITERAL(".gnupg"),
+-                                BlockType::kBlockAllChildren),
 -#if BUILDFLAG(IS_WIN)
--          // Some Windows specific directories to block, basically all apps, the
--          // operating system itself, as well as configuration data for apps.
--          {base::DIR_PROGRAM_FILES, nullptr, BlockType::kBlockAllChildren},
--          {base::DIR_PROGRAM_FILESX86, nullptr, BlockType::kBlockAllChildren},
--          {base::DIR_PROGRAM_FILES6432, nullptr, BlockType::kBlockAllChildren},
--          {base::DIR_WINDOWS, nullptr, BlockType::kBlockAllChildren},
--          {base::DIR_ROAMING_APP_DATA, nullptr, BlockType::kBlockAllChildren},
--          {base::DIR_LOCAL_APP_DATA, nullptr, BlockType::kBlockAllChildren},
--          {base::DIR_COMMON_APP_DATA, nullptr, BlockType::kBlockAllChildren},
--          // Opening a file from an MTP device, such as a smartphone or a
--          // camera, is
--          // implemented by Windows as opening a file in the temporary internet
--          // files directory. To support that, allow opening files in that
--          // directory, but not whole directories.
--          {base::DIR_IE_INTERNET_CACHE, nullptr,
--           BlockType::kBlockNestedDirectories},
+-      // Some Windows specific directories to block, basically all apps, the
+-      // operating system itself, as well as configuration data for apps.
+-      BlockPath::CreateRelative(base::DIR_PROGRAM_FILES,
+-                                BlockType::kBlockAllChildren),
+-      BlockPath::CreateRelative(base::DIR_PROGRAM_FILESX86,
+-                                BlockType::kBlockAllChildren),
+-      BlockPath::CreateRelative(base::DIR_PROGRAM_FILES6432,
+-                                BlockType::kBlockAllChildren),
+-      BlockPath::CreateRelative(base::DIR_WINDOWS,
+-                                BlockType::kBlockAllChildren),
+-      BlockPath::CreateRelative(base::DIR_ROAMING_APP_DATA,
+-                                BlockType::kBlockAllChildren),
+-      BlockPath::CreateRelative(base::DIR_LOCAL_APP_DATA,
+-                                BlockType::kBlockAllChildren),
+-      BlockPath::CreateRelative(base::DIR_COMMON_APP_DATA,
+-                                BlockType::kBlockAllChildren),
+-      // Opening a file from an MTP device, such as a smartphone or a camera, is
+-      // implemented by Windows as opening a file in the temporary internet
+-      // files directory. To support that, allow opening files in that
+-      // directory, but not whole directories.
+-      BlockPath::CreateRelative(base::DIR_IE_INTERNET_CACHE,
+-                                BlockType::kBlockNestedDirectories),
+-      // Block */.git/hooks on Windows, see crbug.com/465668234.
+-      BlockPath::CreateSuffix(FILE_PATH_LITERAL(".git/hooks"),
+-                              BlockType::kBlockWrite),
 -#endif
 -#if BUILDFLAG(IS_MAC)
--          // Similar Mac specific blocks.
--          {base::DIR_APP_DATA, nullptr, BlockType::kBlockAllChildren},
--          // Block access to the current bundle directory.
--          {chrome::DIR_OUTER_BUNDLE, nullptr, BlockType::kBlockAllChildren},
--          // Block access to the user's Applications directory.
--          {base::DIR_HOME, FILE_PATH_LITERAL("Applications"),
--           BlockType::kBlockAllChildren},
--          // Block access to the root Applications directory.
--          {kNoBasePathKey, FILE_PATH_LITERAL("/Applications"),
--           BlockType::kBlockAllChildren},
--          {base::DIR_HOME, FILE_PATH_LITERAL("Library"),
--           BlockType::kBlockAllChildren},
--          // Allow access to other cloud files, such as Google Drive.
--          {base::DIR_HOME, FILE_PATH_LITERAL("Library/CloudStorage"),
--           BlockType::kDontBlockChildren},
--          // Allow the site to interact with data from its corresponding
--          // natively
--          // installed (sandboxed) application. It would be nice to limit a site
--          // to
--          // access only _its_ corresponding natively installed application, but
--          // unfortunately there's no straightforward way to do that. See
--          // https://crbug.com/40095723#c22.
--          {base::DIR_HOME, FILE_PATH_LITERAL("Library/Containers"),
--           BlockType::kDontBlockChildren},
--          // Allow access to iCloud files...
--          {base::DIR_HOME, FILE_PATH_LITERAL("Library/Mobile Documents"),
--           BlockType::kDontBlockChildren},
--          // ... which may also appear at this directory.
--          {base::DIR_HOME,
--           FILE_PATH_LITERAL("Library/Mobile Documents/com~apple~CloudDocs"),
--           BlockType::kDontBlockChildren},
+-      // Similar Mac specific blocks.
+-      BlockPath::CreateRelative(base::DIR_APP_DATA,
+-                                BlockType::kBlockAllChildren),
+-      // Block access to the current bundle directory.
+-      BlockPath::CreateRelative(chrome::DIR_OUTER_BUNDLE,
+-                                BlockType::kBlockAllChildren),
+-      // Block access to the user's Applications directory.
+-      BlockPath::CreateRelative(base::DIR_HOME,
+-                                FILE_PATH_LITERAL("Applications"),
+-                                BlockType::kBlockAllChildren),
+-      // Block access to the root Applications directory.
+-      BlockPath::CreateAbsolute(FILE_PATH_LITERAL("/Applications"),
+-                                BlockType::kBlockAllChildren),
+-      BlockPath::CreateRelative(base::DIR_HOME, FILE_PATH_LITERAL("Library"),
+-                                BlockType::kBlockAllChildren),
+-      // Allow access to other cloud files, such as Google Drive.
+-      BlockPath::CreateRelative(base::DIR_HOME,
+-                                FILE_PATH_LITERAL("Library/CloudStorage"),
+-                                BlockType::kDontBlockChildren),
+-      // Allow the site to interact with data from its corresponding natively
+-      // installed (sandboxed) application. It would be nice to limit a site to
+-      // access only _its_ corresponding natively installed application, but
+-      // unfortunately there's no straightforward way to do that. See
+-      // https://crbug.com/40095723#c22.
+-      BlockPath::CreateRelative(base::DIR_HOME,
+-                                FILE_PATH_LITERAL("Library/Containers"),
+-                                BlockType::kDontBlockChildren),
+-      // Allow access to iCloud files...
+-      BlockPath::CreateRelative(base::DIR_HOME,
+-                                FILE_PATH_LITERAL("Library/Mobile Documents"),
+-                                BlockType::kDontBlockChildren),
+-      // ... which may also appear at this directory.
+-      BlockPath::CreateRelative(
+-          base::DIR_HOME,
+-          FILE_PATH_LITERAL("Library/Mobile Documents/com~apple~CloudDocs"),
+-          BlockType::kDontBlockChildren),
 -#endif
 -#if BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_CHROMEOS) || BUILDFLAG(IS_ANDROID)
--          // On Linux also block access to devices via /dev.
--          {kNoBasePathKey, FILE_PATH_LITERAL("/dev"),
--           BlockType::kBlockAllChildren},
--          // And security sensitive data in /proc and /sys.
--          {kNoBasePathKey, FILE_PATH_LITERAL("/proc"),
--           BlockType::kBlockAllChildren},
--          {kNoBasePathKey, FILE_PATH_LITERAL("/sys"),
--           BlockType::kBlockAllChildren},
--          // And system files in /boot and /etc.
--          {kNoBasePathKey, FILE_PATH_LITERAL("/boot"),
--           BlockType::kBlockAllChildren},
--          {kNoBasePathKey, FILE_PATH_LITERAL("/etc"),
--           BlockType::kBlockAllChildren},
--          // And block all of ~/.config, matching the similar restrictions on
--          // mac
--          // and windows.
--          {base::DIR_HOME, FILE_PATH_LITERAL(".config"),
--           BlockType::kBlockAllChildren},
--          // Block ~/.dbus as well, just in case, although there probably isn't
--          // much
--          // a website can do with access to that directory and its contents.
--          {base::DIR_HOME, FILE_PATH_LITERAL(".dbus"),
--           BlockType::kBlockAllChildren},
+-      // On Linux also block access to devices via /dev.
+-      BlockPath::CreateAbsolute(FILE_PATH_LITERAL("/dev"),
+-                                BlockType::kBlockAllChildren),
+-      // And security sensitive data in /proc and /sys.
+-      BlockPath::CreateAbsolute(FILE_PATH_LITERAL("/proc"),
+-                                BlockType::kBlockAllChildren),
+-      BlockPath::CreateAbsolute(FILE_PATH_LITERAL("/sys"),
+-                                BlockType::kBlockAllChildren),
+-      // And system files in /boot and /etc.
+-      BlockPath::CreateAbsolute(FILE_PATH_LITERAL("/boot"),
+-                                BlockType::kBlockAllChildren),
+-      BlockPath::CreateAbsolute(FILE_PATH_LITERAL("/etc"),
+-                                BlockType::kBlockAllChildren),
+-      // And block all of ~/.config, matching the similar restrictions on mac
+-      // and windows.
+-      BlockPath::CreateRelative(base::DIR_HOME, FILE_PATH_LITERAL(".config"),
+-                                BlockType::kBlockAllChildren),
+-      // Block ~/.dbus as well, just in case, although there probably isn't much
+-      // a website can do with access to that directory and its contents.
+-      BlockPath::CreateRelative(base::DIR_HOME, FILE_PATH_LITERAL(".dbus"),
+-                                BlockType::kBlockAllChildren),
 -#endif
 -#if BUILDFLAG(IS_ANDROID)
--          {base::DIR_ANDROID_APP_DATA, nullptr, BlockType::kBlockAllChildren},
--          {base::DIR_CACHE, nullptr, BlockType::kBlockAllChildren},
+-      BlockPath::CreateRelative(base::DIR_ANDROID_APP_DATA,
+-                                BlockType::kBlockAllChildren),
+-      BlockPath::CreateRelative(base::DIR_CACHE, BlockType::kBlockAllChildren),
 -#endif
--          // TODO(crbug.com/40095723): Refine this list, for example add
--          // XDG_CONFIG_HOME when it is not set ~/.config?
--      };
+-      // TODO(crbug.com/40095723): Refine this list, for example add
+-      // XDG_CONFIG_HOME when it is not set ~/.config?
+-  };
 -
 -  // ChromeOS supports multi-user sign-in. base::DIR_HOME only returns the
 -  // profile path for the primary user, the first user to sign in. We want to
@@ -187,28 +198,41 @@ index 4e769e8be28ffd18788d8786fe7341e5d5b0697c..2f447d1a3e7ab50458159bcb717220bb
 -
 -  for (const auto& blocked_path : kBlockPaths) {
 -    base::FilePath path;
--    if (blocked_path.base_path_key != kNoBasePathKey) {
--      if (kUseProfilePathForDirHome &&
--          blocked_path.base_path_key == base::DIR_HOME) {
--        block_path_rules->profile_based_block_path_rules_.emplace_back(
--            blocked_path.path, blocked_path.type);
+-    switch (blocked_path.block_path_type) {
+-      case ChromeFileSystemAccessPermissionContext::BlockPathType::kAbsolute: {
+-        CHECK(blocked_path.path);
+-        path = base::FilePath(blocked_path.path);
+-        break;
+-      }
+-      case ChromeFileSystemAccessPermissionContext::BlockPathType::kRelative: {
+-        CHECK(blocked_path.base_path_key);
+-        if (kUseProfilePathForDirHome &&
+-            blocked_path.base_path_key == base::DIR_HOME) {
+-          block_path_rules->profile_based_block_path_rules_.emplace_back(
+-              blocked_path.path, blocked_path.block_type);
+-          continue;
+-        }
+-
+-        if (!base::PathService::Get(blocked_path.base_path_key.value(),
+-                                    &path)) {
+-          continue;
+-        }
+-
+-        if (blocked_path.path) {
+-          path = path.Append(blocked_path.path);
+-        }
+-        break;
+-      }
+-      case ChromeFileSystemAccessPermissionContext::BlockPathType::kSuffix: {
+-        block_path_rules->suffix_block_path_rules_.emplace_back(
+-            blocked_path.path, blocked_path.block_type);
 -        continue;
 -      }
--
--      if (!base::PathService::Get(blocked_path.base_path_key, &path)) {
--        continue;
--      }
--
--      if (blocked_path.path) {
--        path = path.Append(blocked_path.path);
--      }
--    } else {
--      DCHECK(blocked_path.path);
--      path = base::FilePath(blocked_path.path);
 -    }
+-
 -    block_path_rules->block_path_rules_.emplace_back(
 -        should_normalize_file_path ? NormalizeFilePath(path) : path,
--        blocked_path.type);
+-        blocked_path.block_type);
 -  }
 -
 -  return block_path_rules;
@@ -220,7 +244,7 @@ index 4e769e8be28ffd18788d8786fe7341e5d5b0697c..2f447d1a3e7ab50458159bcb717220bb
  
  // Checks if `path` should be blocked by the `rules`.
  // The BlockType of the nearest ancestor of a path to check is what
-@@ -1404,16 +1226,6 @@ struct ChromeFileSystemAccessPermissionContext::OriginState {
+@@ -1474,16 +1272,6 @@ struct ChromeFileSystemAccessPermissionContext::OriginState {
    std::unique_ptr<base::RetainingOneShotTimer> cleanup_timer;
  };
  
@@ -237,7 +261,7 @@ index 4e769e8be28ffd18788d8786fe7341e5d5b0697c..2f447d1a3e7ab50458159bcb717220bb
  ChromeFileSystemAccessPermissionContext::
      ChromeFileSystemAccessPermissionContext(content::BrowserContext* context,
                                              const base::Clock* clock)
-@@ -1432,7 +1244,7 @@ ChromeFileSystemAccessPermissionContext::
+@@ -1502,7 +1290,7 @@ ChromeFileSystemAccessPermissionContext::
  #if BUILDFLAG(IS_ANDROID)
    one_time_permissions_tracker_.Observe(
        OneTimePermissionsTrackerFactory::GetForBrowserContext(context));
@@ -246,7 +270,7 @@ index 4e769e8be28ffd18788d8786fe7341e5d5b0697c..2f447d1a3e7ab50458159bcb717220bb
    auto* provider = web_app::WebAppProvider::GetForWebApps(
        Profile::FromBrowserContext(profile_));
    if (provider) {
-@@ -2812,7 +2624,7 @@ void ChromeFileSystemAccessPermissionContext::OnShutdown() {
+@@ -2885,7 +2673,7 @@ void ChromeFileSystemAccessPermissionContext::OnShutdown() {
    one_time_permissions_tracker_.Reset();
  }
  
@@ -255,7 +279,7 @@ index 4e769e8be28ffd18788d8786fe7341e5d5b0697c..2f447d1a3e7ab50458159bcb717220bb
  void ChromeFileSystemAccessPermissionContext::OnWebAppInstalled(
      const webapps::AppId& app_id) {
    if (!base::FeatureList::IsEnabled(
-@@ -3170,11 +2982,7 @@ bool ChromeFileSystemAccessPermissionContext::
+@@ -3243,11 +3031,7 @@ bool ChromeFileSystemAccessPermissionContext::
          HandleType handle_type,
          UserAction user_action,
          GrantType grant_type) {
@@ -268,7 +292,7 @@ index 4e769e8be28ffd18788d8786fe7341e5d5b0697c..2f447d1a3e7ab50458159bcb717220bb
    if (!base::FeatureList::IsEnabled(
            features::kFileSystemAccessPersistentPermissions)) {
      return false;
-@@ -3225,6 +3033,7 @@ bool ChromeFileSystemAccessPermissionContext::
+@@ -3298,6 +3082,7 @@ bool ChromeFileSystemAccessPermissionContext::
  
    return false;
  #endif  // BUILDFLAG(IS_ANDROID)
@@ -277,10 +301,10 @@ index 4e769e8be28ffd18788d8786fe7341e5d5b0697c..2f447d1a3e7ab50458159bcb717220bb
  
  std::vector<FileRequestData> ChromeFileSystemAccessPermissionContext::
 diff --git a/chrome/browser/file_system_access/chrome_file_system_access_permission_context.h b/chrome/browser/file_system_access/chrome_file_system_access_permission_context.h
-index add60ba0e2ca7be385b59d46e3bdaceb55996947..5163e7092c3016494321b4c4a5f785f37f8b9411 100644
+index ae026d5321cd513c188297e53fe65aaaa77d6f34..184fda7f5851a5d22957b3ebd9d47a4f635a1aff 100644
 --- a/chrome/browser/file_system_access/chrome_file_system_access_permission_context.h
 +++ b/chrome/browser/file_system_access/chrome_file_system_access_permission_context.h
-@@ -9,10 +9,13 @@
+@@ -10,10 +10,13 @@
  #include <vector>
  
  #include "base/auto_reset.h"
@@ -294,7 +318,7 @@ index add60ba0e2ca7be385b59d46e3bdaceb55996947..5163e7092c3016494321b4c4a5f785f3
  #include "base/scoped_observation.h"
  #include "base/sequence_checker.h"
  #include "base/time/clock.h"
-@@ -22,6 +25,7 @@
+@@ -23,6 +26,7 @@
  #include "chrome/browser/file_system_access/file_system_access_permission_request_manager.h"
  #include "chrome/browser/permissions/one_time_permissions_tracker.h"
  #include "chrome/browser/permissions/one_time_permissions_tracker_observer.h"
@@ -302,7 +326,7 @@ index add60ba0e2ca7be385b59d46e3bdaceb55996947..5163e7092c3016494321b4c4a5f785f3
  #include "components/enterprise/buildflags/buildflags.h"
  #include "components/permissions/features.h"
  #include "components/permissions/object_permission_context_base.h"
-@@ -419,6 +423,191 @@ class ChromeFileSystemAccessPermissionContext
+@@ -471,6 +475,219 @@ class ChromeFileSystemAccessPermissionContext
    bool IsPathInDowngradedReadPathsForTesting(const url::Origin& origin,
                                               const base::FilePath& path);
  
@@ -339,117 +363,132 @@ index add60ba0e2ca7be385b59d46e3bdaceb55996947..5163e7092c3016494321b4c4a5f785f3
 +
 +  static std::unique_ptr<ChromeFileSystemAccessPermissionContext::BlockPathRules>
 +  GenerateBlockPaths(bool should_normalize_file_path) {
-+    static constexpr ChromeFileSystemAccessPermissionContext::BlockPath
-+        kBlockPaths[] = {
-+            // Don't allow users to share their entire home directory, entire
-+            // desktop or entire documents folder, but do allow sharing anything
-+            // inside those directories not otherwise blocked.
-+            {base::DIR_HOME, nullptr, BlockType::kDontBlockChildren},
-+            {base::DIR_USER_DESKTOP, nullptr, BlockType::kDontBlockChildren},
-+            {chrome::DIR_USER_DOCUMENTS, nullptr, BlockType::kDontBlockChildren},
-+            // Similar restrictions for the downloads directory.
-+            {chrome::DIR_DEFAULT_DOWNLOADS, nullptr,
-+            BlockType::kDontBlockChildren},
-+            {chrome::DIR_DEFAULT_DOWNLOADS_SAFE, nullptr,
-+            BlockType::kDontBlockChildren},
-+            // The Chrome installation itself should not be modified by the web.
-+            {base::DIR_EXE, nullptr, BlockType::kBlockAllChildren},
-+            {base::DIR_MODULE, nullptr, BlockType::kBlockAllChildren},
-+            {base::DIR_ASSETS, nullptr, BlockType::kBlockAllChildren},
-+            // And neither should the configuration of at least the currently
-+            // running Chrome instance (note that this does not take
-+            // --user-data-dir command line overrides into account).
-+            {chrome::DIR_USER_DATA, nullptr, BlockType::kBlockAllChildren},
-+            // ~/.ssh is pretty sensitive on all platforms, so block access to
-+            // that.
-+            {base::DIR_HOME, FILE_PATH_LITERAL(".ssh"),
-+            BlockType::kBlockAllChildren},
-+            // And limit access to ~/.gnupg as well.
-+            {base::DIR_HOME, FILE_PATH_LITERAL(".gnupg"),
-+            BlockType::kBlockAllChildren},
++    using BlockPath = ChromeFileSystemAccessPermissionContext::BlockPath;
++    static constexpr BlockPath kBlockPaths[] = {
++        // Don't allow users to share their entire home directory, entire desktop
++        // or entire documents folder, but do allow sharing anything inside those
++        // directories not otherwise blocked.
++        BlockPath::CreateRelative(base::DIR_HOME, BlockType::kDontBlockChildren),
++        BlockPath::CreateRelative(base::DIR_USER_DESKTOP,
++                                  BlockType::kDontBlockChildren),
++        BlockPath::CreateRelative(chrome::DIR_USER_DOCUMENTS,
++                                  BlockType::kDontBlockChildren),
++        // Similar restrictions for the downloads directory.
++        BlockPath::CreateRelative(chrome::DIR_DEFAULT_DOWNLOADS,
++                                  BlockType::kDontBlockChildren),
++        BlockPath::CreateRelative(chrome::DIR_DEFAULT_DOWNLOADS_SAFE,
++                                  BlockType::kDontBlockChildren),
++        // The Chrome installation itself should not be modified by the web.
++        BlockPath::CreateRelative(base::DIR_EXE, BlockType::kBlockAllChildren),
++        BlockPath::CreateRelative(base::DIR_MODULE, BlockType::kBlockAllChildren),
++        BlockPath::CreateRelative(base::DIR_ASSETS, BlockType::kBlockAllChildren),
++        // And neither should the configuration of at least the currently running
++        // Chrome instance (note that this does not take --user-data-dir command
++        // line overrides into account).
++        BlockPath::CreateRelative(chrome::DIR_USER_DATA,
++                                  BlockType::kBlockAllChildren),
++        // ~/.ssh is pretty sensitive on all platforms, so block access to that.
++        BlockPath::CreateRelative(base::DIR_HOME, FILE_PATH_LITERAL(".ssh"),
++                                  BlockType::kBlockAllChildren),
++        // And limit access to ~/.gnupg as well.
++        BlockPath::CreateRelative(base::DIR_HOME, FILE_PATH_LITERAL(".gnupg"),
++                                  BlockType::kBlockAllChildren),
 +  #if BUILDFLAG(IS_WIN)
-+            // Some Windows specific directories to block, basically all apps, the
-+            // operating system itself, as well as configuration data for apps.
-+            {base::DIR_PROGRAM_FILES, nullptr, BlockType::kBlockAllChildren},
-+            {base::DIR_PROGRAM_FILESX86, nullptr, BlockType::kBlockAllChildren},
-+            {base::DIR_PROGRAM_FILES6432, nullptr, BlockType::kBlockAllChildren},
-+            {base::DIR_WINDOWS, nullptr, BlockType::kBlockAllChildren},
-+            {base::DIR_ROAMING_APP_DATA, nullptr, BlockType::kBlockAllChildren},
-+            {base::DIR_LOCAL_APP_DATA, nullptr, BlockType::kBlockAllChildren},
-+            {base::DIR_COMMON_APP_DATA, nullptr, BlockType::kBlockAllChildren},
-+            // Opening a file from an MTP device, such as a smartphone or a
-+            // camera, is
-+            // implemented by Windows as opening a file in the temporary internet
-+            // files directory. To support that, allow opening files in that
-+            // directory, but not whole directories.
-+            {base::DIR_IE_INTERNET_CACHE, nullptr,
-+            BlockType::kBlockNestedDirectories},
++        // Some Windows specific directories to block, basically all apps, the
++        // operating system itself, as well as configuration data for apps.
++        BlockPath::CreateRelative(base::DIR_PROGRAM_FILES,
++                                  BlockType::kBlockAllChildren),
++        BlockPath::CreateRelative(base::DIR_PROGRAM_FILESX86,
++                                  BlockType::kBlockAllChildren),
++        BlockPath::CreateRelative(base::DIR_PROGRAM_FILES6432,
++                                  BlockType::kBlockAllChildren),
++        BlockPath::CreateRelative(base::DIR_WINDOWS,
++                                  BlockType::kBlockAllChildren),
++        BlockPath::CreateRelative(base::DIR_ROAMING_APP_DATA,
++                                  BlockType::kBlockAllChildren),
++        BlockPath::CreateRelative(base::DIR_LOCAL_APP_DATA,
++                                  BlockType::kBlockAllChildren),
++        BlockPath::CreateRelative(base::DIR_COMMON_APP_DATA,
++                                  BlockType::kBlockAllChildren),
++        // Opening a file from an MTP device, such as a smartphone or a camera, is
++        // implemented by Windows as opening a file in the temporary internet
++        // files directory. To support that, allow opening files in that
++        // directory, but not whole directories.
++        BlockPath::CreateRelative(base::DIR_IE_INTERNET_CACHE,
++                                  BlockType::kBlockNestedDirectories),
++        // Block */.git/hooks on Windows, see crbug.com/465668234.
++        BlockPath::CreateSuffix(FILE_PATH_LITERAL(".git/hooks"),
++                                BlockType::kBlockWrite),
 +  #endif
 +  #if BUILDFLAG(IS_MAC)
-+            // Similar Mac specific blocks.
-+            {base::DIR_APP_DATA, nullptr, BlockType::kBlockAllChildren},
-+            // Block access to the current bundle directory.
-+            {chrome::DIR_OUTER_BUNDLE, nullptr, BlockType::kBlockAllChildren},
-+            // Block access to the user's Applications directory.
-+            {base::DIR_HOME, FILE_PATH_LITERAL("Applications"),
-+            BlockType::kBlockAllChildren},
-+            // Block access to the root Applications directory.
-+            {kNoBasePathKey, FILE_PATH_LITERAL("/Applications"),
-+            BlockType::kBlockAllChildren},
-+            {base::DIR_HOME, FILE_PATH_LITERAL("Library"),
-+            BlockType::kBlockAllChildren},
-+            // Allow access to other cloud files, such as Google Drive.
-+            {base::DIR_HOME, FILE_PATH_LITERAL("Library/CloudStorage"),
-+            BlockType::kDontBlockChildren},
-+            // Allow the site to interact with data from its corresponding
-+            // natively
-+            // installed (sandboxed) application. It would be nice to limit a site
-+            // to
-+            // access only _its_ corresponding natively installed application, but
-+            // unfortunately there's no straightforward way to do that. See
-+            // https://crbug.com/984641#c22.
-+            {base::DIR_HOME, FILE_PATH_LITERAL("Library/Containers"),
-+            BlockType::kDontBlockChildren},
-+            // Allow access to iCloud files...
-+            {base::DIR_HOME, FILE_PATH_LITERAL("Library/Mobile Documents"),
-+            BlockType::kDontBlockChildren},
-+            // ... which may also appear at this directory.
-+            {base::DIR_HOME,
++        // Similar Mac specific blocks.
++        BlockPath::CreateRelative(base::DIR_APP_DATA,
++                                  BlockType::kBlockAllChildren),
++        // Block access to the current bundle directory.
++        BlockPath::CreateRelative(chrome::DIR_OUTER_BUNDLE,
++                                  BlockType::kBlockAllChildren),
++        // Block access to the user's Applications directory.
++        BlockPath::CreateRelative(base::DIR_HOME,
++                                  FILE_PATH_LITERAL("Applications"),
++                                  BlockType::kBlockAllChildren),
++        // Block access to the root Applications directory.
++        BlockPath::CreateAbsolute(FILE_PATH_LITERAL("/Applications"),
++                                  BlockType::kBlockAllChildren),
++        BlockPath::CreateRelative(base::DIR_HOME, FILE_PATH_LITERAL("Library"),
++                                  BlockType::kBlockAllChildren),
++        // Allow access to other cloud files, such as Google Drive.
++        BlockPath::CreateRelative(base::DIR_HOME,
++                                  FILE_PATH_LITERAL("Library/CloudStorage"),
++                                  BlockType::kDontBlockChildren),
++        // Allow the site to interact with data from its corresponding natively
++        // installed (sandboxed) application. It would be nice to limit a site to
++        // access only _its_ corresponding natively installed application, but
++        // unfortunately there's no straightforward way to do that. See
++        // https://crbug.com/40095723#c22.
++        BlockPath::CreateRelative(base::DIR_HOME,
++                                  FILE_PATH_LITERAL("Library/Containers"),
++                                  BlockType::kDontBlockChildren),
++        // Allow access to iCloud files...
++        BlockPath::CreateRelative(base::DIR_HOME,
++                                  FILE_PATH_LITERAL("Library/Mobile Documents"),
++                                  BlockType::kDontBlockChildren),
++        // ... which may also appear at this directory.
++        BlockPath::CreateRelative(
++            base::DIR_HOME,
 +            FILE_PATH_LITERAL("Library/Mobile Documents/com~apple~CloudDocs"),
-+            BlockType::kDontBlockChildren},
++            BlockType::kDontBlockChildren),
 +  #endif
 +  #if BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_CHROMEOS) || BUILDFLAG(IS_ANDROID)
-+            // On Linux also block access to devices via /dev.
-+            {kNoBasePathKey, FILE_PATH_LITERAL("/dev"),
-+            BlockType::kBlockAllChildren},
-+            // And security sensitive data in /proc and /sys.
-+            {kNoBasePathKey, FILE_PATH_LITERAL("/proc"),
-+            BlockType::kBlockAllChildren},
-+            {kNoBasePathKey, FILE_PATH_LITERAL("/sys"),
-+            BlockType::kBlockAllChildren},
-+            // And system files in /boot and /etc.
-+            {kNoBasePathKey, FILE_PATH_LITERAL("/boot"),
-+            BlockType::kBlockAllChildren},
-+            {kNoBasePathKey, FILE_PATH_LITERAL("/etc"),
-+            BlockType::kBlockAllChildren},
-+            // And block all of ~/.config, matching the similar restrictions on
-+            // mac
-+            // and windows.
-+            {base::DIR_HOME, FILE_PATH_LITERAL(".config"),
-+            BlockType::kBlockAllChildren},
-+            // Block ~/.dbus as well, just in case, although there probably isn't
-+            // much
-+            // a website can do with access to that directory and its contents.
-+            {base::DIR_HOME, FILE_PATH_LITERAL(".dbus"),
-+            BlockType::kBlockAllChildren},
++        // On Linux also block access to devices via /dev.
++        BlockPath::CreateAbsolute(FILE_PATH_LITERAL("/dev"),
++                                  BlockType::kBlockAllChildren),
++        // And security sensitive data in /proc and /sys.
++        BlockPath::CreateAbsolute(FILE_PATH_LITERAL("/proc"),
++                                  BlockType::kBlockAllChildren),
++        BlockPath::CreateAbsolute(FILE_PATH_LITERAL("/sys"),
++                                  BlockType::kBlockAllChildren),
++        // And system files in /boot and /etc.
++        BlockPath::CreateAbsolute(FILE_PATH_LITERAL("/boot"),
++                                  BlockType::kBlockAllChildren),
++        BlockPath::CreateAbsolute(FILE_PATH_LITERAL("/etc"),
++                                  BlockType::kBlockAllChildren),
++        // And block all of ~/.config, matching the similar restrictions on mac
++        // and windows.
++        BlockPath::CreateRelative(base::DIR_HOME, FILE_PATH_LITERAL(".config"),
++                                  BlockType::kBlockAllChildren),
++        // Block ~/.dbus as well, just in case, although there probably isn't much
++        // a website can do with access to that directory and its contents.
++        BlockPath::CreateRelative(base::DIR_HOME, FILE_PATH_LITERAL(".dbus"),
++                                  BlockType::kBlockAllChildren),
 +  #endif
 +  #if BUILDFLAG(IS_ANDROID)
-+            {base::DIR_ANDROID_APP_DATA, nullptr, BlockType::kBlockAllChildren},
-+            {base::DIR_CACHE, nullptr, BlockType::kBlockAllChildren},
++        BlockPath::CreateRelative(base::DIR_ANDROID_APP_DATA,
++                                  BlockType::kBlockAllChildren),
++        BlockPath::CreateRelative(base::DIR_CACHE, BlockType::kBlockAllChildren),
 +  #endif
-+            // TODO(crbug.com/40095723): Refine this list, for example add
-+            // XDG_CONFIG_HOME when it is not set ~/.config?
-+        };
++        // TODO(crbug.com/40095723): Refine this list, for example add
++        // XDG_CONFIG_HOME when it is not set ~/.config?
++    };
 +
 +    // ChromeOS supports multi-user sign-in. base::DIR_HOME only returns the
 +    // profile path for the primary user, the first user to sign in. We want to
@@ -464,28 +503,41 @@ index add60ba0e2ca7be385b59d46e3bdaceb55996947..5163e7092c3016494321b4c4a5f785f3
 +
 +    for (const auto& blocked_path : kBlockPaths) {
 +      base::FilePath path;
-+      if (blocked_path.base_path_key != kNoBasePathKey) {
-+        if (kUseProfilePathForDirHome &&
-+            blocked_path.base_path_key == base::DIR_HOME) {
-+          block_path_rules->profile_based_block_path_rules_.emplace_back(
-+              blocked_path.path, blocked_path.type);
++      switch (blocked_path.block_path_type) {
++        case ChromeFileSystemAccessPermissionContext::BlockPathType::kAbsolute: {
++          CHECK(blocked_path.path);
++          path = base::FilePath(blocked_path.path);
++          break;
++        }
++        case ChromeFileSystemAccessPermissionContext::BlockPathType::kRelative: {
++          CHECK(blocked_path.base_path_key);
++          if (kUseProfilePathForDirHome &&
++              blocked_path.base_path_key == base::DIR_HOME) {
++            block_path_rules->profile_based_block_path_rules_.emplace_back(
++                blocked_path.path, blocked_path.block_type);
++            continue;
++          }
++
++          if (!base::PathService::Get(blocked_path.base_path_key.value(),
++                                      &path)) {
++            continue;
++          }
++
++          if (blocked_path.path) {
++            path = path.Append(blocked_path.path);
++          }
++          break;
++        }
++        case ChromeFileSystemAccessPermissionContext::BlockPathType::kSuffix: {
++          block_path_rules->suffix_block_path_rules_.emplace_back(
++              blocked_path.path, blocked_path.block_type);
 +          continue;
 +        }
-+
-+        if (!base::PathService::Get(blocked_path.base_path_key, &path)) {
-+          continue;
-+        }
-+
-+        if (blocked_path.path) {
-+          path = path.Append(blocked_path.path);
-+        }
-+      } else {
-+        DCHECK(blocked_path.path);
-+        path = base::FilePath(blocked_path.path);
 +      }
++
 +      block_path_rules->block_path_rules_.emplace_back(
 +          should_normalize_file_path ? NormalizeFilePath(path) : path,
-+          blocked_path.type);
++          blocked_path.block_type);
 +    }
 +
 +    return block_path_rules;

patches/chromium/refactor_unfilter_unresponsive_events.patch

@@ -15,10 +15,10 @@ This CL removes these filters so the unresponsive event can still be
 accessed from our JS event. The filtering is moved into Electron's code.
 
 diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
-index 09346abdd2df2f672b1c3cc1757fa375eb6e0c72..1ef2411d03c041367e59bf9b3af2b1a6cb45dcee 100644
+index e12758010f5c243d2fb9c733b74bcb0eea89f5da..6910e1e54995027933abc5724afac9129df7519c 100644
 --- a/content/browser/web_contents/web_contents_impl.cc
 +++ b/content/browser/web_contents/web_contents_impl.cc
-@@ -10582,25 +10582,13 @@ void WebContentsImpl::RendererUnresponsive(
+@@ -10589,25 +10589,13 @@ void WebContentsImpl::RendererUnresponsive(
      base::RepeatingClosure hang_monitor_restarter) {
    OPTIONAL_TRACE_EVENT1("content", "WebContentsImpl::RendererUnresponsive",
                          "render_widget_host", render_widget_host);

patches/chromium/revert_partial_remove_unused_prehandlemouseevent.patch

@@ -39,10 +39,10 @@ index 6c7ec195fa64e3a1a718811192c9f6fdbf9463c6..c11744d2246c3df138cdb91f1d4459c6
    // event before sending it to the renderer. See enum for details on return
    // value.
 diff --git a/content/browser/renderer_host/render_widget_host_impl.cc b/content/browser/renderer_host/render_widget_host_impl.cc
-index 903b731a9cd58e418c26099044da62f7a23bd6ea..54d51fc916e1d2819d4e5dca0c5dd3d25790cd72 100644
+index fe26e2aeba6fc03201373693d4afa2b78c89e54a..ab880a04a9638b348192a4c85785bc769e7dd83b 100644
 --- a/content/browser/renderer_host/render_widget_host_impl.cc
 +++ b/content/browser/renderer_host/render_widget_host_impl.cc
-@@ -1554,6 +1554,10 @@ void RenderWidgetHostImpl::ForwardMouseEventWithLatencyInfo(
+@@ -1562,6 +1562,10 @@ void RenderWidgetHostImpl::ForwardMouseEventWithLatencyInfo(
    CHECK_GE(mouse_event.GetType(), WebInputEvent::Type::kMouseTypeFirst);
    CHECK_LE(mouse_event.GetType(), WebInputEvent::Type::kMouseTypeLast);
  
@@ -54,7 +54,7 @@ index 903b731a9cd58e418c26099044da62f7a23bd6ea..54d51fc916e1d2819d4e5dca0c5dd3d2
      if (mouse_event_callback.Run(mouse_event)) {
        return;
 diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
-index 1ef2411d03c041367e59bf9b3af2b1a6cb45dcee..bd505514fe1aa90b1f61f50c875bfe62abb9d85a 100644
+index 6910e1e54995027933abc5724afac9129df7519c..8011e752e23f62162cb2fff2461dfe5948af6dad 100644
 --- a/content/browser/web_contents/web_contents_impl.cc
 +++ b/content/browser/web_contents/web_contents_impl.cc
 @@ -4586,6 +4586,12 @@ void WebContentsImpl::RenderWidgetWasResized(

patches/chromium/revert_views_remove_desktopwindowtreehostwin_window_enlargement.patch

@@ -10,10 +10,10 @@ on Windows.  We should refactor our code so that this patch isn't
 necessary.
 
 diff --git a/testing/variations/fieldtrial_testing_config.json b/testing/variations/fieldtrial_testing_config.json
-index d40db208ccc9955d38bab1c37e1c86a55ad7acf7..51c44e48902e44e7e1d6bda134a8f90e4bea3e81 100644
+index 988866d79a5d1dbd366ebdbff0e8eb2c0c498168..5761ac48be0a64618be0a94606149dd944e46e27 100644
 --- a/testing/variations/fieldtrial_testing_config.json
 +++ b/testing/variations/fieldtrial_testing_config.json
-@@ -22559,6 +22559,21 @@
+@@ -22626,6 +22626,21 @@
              ]
          }
      ],
@@ -36,10 +36,10 @@ index d40db208ccc9955d38bab1c37e1c86a55ad7acf7..51c44e48902e44e7e1d6bda134a8f90e
          {
              "platforms": [
 diff --git a/ui/views/views_features.cc b/ui/views/views_features.cc
-index c74cf661f64e60ad6740e011f372e53426ce0c4d..77ce34e4f47a54f7ecabbd6e6d4d19555af248ff 100644
+index 47077e16870889ef8f8c8b2adf58015bd5aff7fa..ba59e6e1609e61579bf49aca095490b083d72051 100644
 --- a/ui/views/views_features.cc
 +++ b/ui/views/views_features.cc
-@@ -34,6 +34,14 @@ BASE_FEATURE(kEnableInputProtection, base::FEATURE_DISABLED_BY_DEFAULT);
+@@ -30,6 +30,14 @@ BASE_FEATURE(kEnableInputProtection, base::FEATURE_DISABLED_BY_DEFAULT);
  // crbug.com/370856871.
  BASE_FEATURE(kEnableTouchDragCursorSync, base::FEATURE_ENABLED_BY_DEFAULT);
  
@@ -55,10 +55,10 @@ index c74cf661f64e60ad6740e011f372e53426ce0c4d..77ce34e4f47a54f7ecabbd6e6d4d1955
  // to kKeyboardAccessibleTooltip in //ui/base/ui_base_features.cc.
  BASE_FEATURE(kKeyboardAccessibleTooltipInViews,
 diff --git a/ui/views/views_features.h b/ui/views/views_features.h
-index 092e51509d4adccb8adbe2481909068e3e6836aa..5093a4c08bf6675ed1e5cb944c1bcb8251bdb033 100644
+index 888a16fb6213eceb131ae636dc643d7f2d5bcad9..6077412165081cd4abeaf0b061feb2f795ee8131 100644
 --- a/ui/views/views_features.h
 +++ b/ui/views/views_features.h
-@@ -16,6 +16,7 @@ VIEWS_EXPORT BASE_DECLARE_FEATURE(kAnnounceTextAdditionalAttributes);
+@@ -15,6 +15,7 @@ namespace views::features {
  VIEWS_EXPORT BASE_DECLARE_FEATURE(kApplyInitialUrlToWebContents);
  VIEWS_EXPORT BASE_DECLARE_FEATURE(kEnableInputProtection);
  VIEWS_EXPORT BASE_DECLARE_FEATURE(kEnableTouchDragCursorSync);

patches/chromium/web_contents.patch

@@ -9,7 +9,7 @@ is needed for OSR.
 Originally landed in https://github.com/electron/libchromiumcontent/pull/226.
 
 diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
-index 1a45bab9c0e4e429bb338c757cdc49d64f337b88..462a05f830906518366182140c36ae73e96d6fc0 100644
+index 8cd59445bae73ff0193e4512d7c36740cbad847f..ba7c3966f2c079bcec329f8f4a724c561969f33f 100644
 --- a/content/browser/web_contents/web_contents_impl.cc
 +++ b/content/browser/web_contents/web_contents_impl.cc
 @@ -4305,6 +4305,13 @@ void WebContentsImpl::Init(const WebContents::CreateParams& params,

patches/chromium/webview_fullscreen.patch

@@ -15,10 +15,10 @@ Note that we also need to manually update embedder's
 `api::WebContents::IsFullscreenForTabOrPending` value.
 
 diff --git a/content/browser/renderer_host/render_frame_host_impl.cc b/content/browser/renderer_host/render_frame_host_impl.cc
-index b898ebdd18bfefb4c6d8fa62e3e128a5154b049c..7c3a56dd43cfb10986a28b5d9bedb4ed75b89ca7 100644
+index e4ff8f11bed9e53f3134068492ac94b4c9bb4df2..17c3b5c78c3ef08e0b901f3ace8bb07ee78e4cab 100644
 --- a/content/browser/renderer_host/render_frame_host_impl.cc
 +++ b/content/browser/renderer_host/render_frame_host_impl.cc
-@@ -9259,6 +9259,17 @@ void RenderFrameHostImpl::EnterFullscreen(
+@@ -9260,6 +9260,17 @@ void RenderFrameHostImpl::EnterFullscreen(
      }
    }
  
@@ -37,7 +37,7 @@ index b898ebdd18bfefb4c6d8fa62e3e128a5154b049c..7c3a56dd43cfb10986a28b5d9bedb4ed
    if (had_fullscreen_token && !GetView()->HasFocus()) {
      GetView()->Focus();
 diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
-index 462a05f830906518366182140c36ae73e96d6fc0..8f98cd136d73d5ff795fd3c62a696cc7d2fd3c84 100644
+index ba7c3966f2c079bcec329f8f4a724c561969f33f..e039e2c82ad75ca4b95763414f7aafb6d3a3dbf2 100644
 --- a/content/browser/web_contents/web_contents_impl.cc
 +++ b/content/browser/web_contents/web_contents_impl.cc
 @@ -4603,21 +4603,25 @@ KeyboardEventProcessingResult WebContentsImpl::PreHandleKeyboardEvent(

patches/chromium/worker_context_will_destroy.patch

@@ -26,7 +26,7 @@ index 1f6c015c361b3146db760643e3670a110634d75b..d4d9c10d3420a5ff998aeb593ea6a255
    // An empty URL is returned if the URL is not overriden.
    virtual GURL OverrideFlashEmbedWithHTML(const GURL& url);
 diff --git a/content/renderer/renderer_blink_platform_impl.cc b/content/renderer/renderer_blink_platform_impl.cc
-index efe0b36d0ff8ff12fd39ea72c036dba42be8d0fe..8c98620a6eb83283516a3fbe186c94c0ba75aac3 100644
+index 416d53d0cce178de992074b0c0371bca2e4ed900..cd0e4d7ea77ffe9fd09982ef2d9f5d57df8e2995 100644
 --- a/content/renderer/renderer_blink_platform_impl.cc
 +++ b/content/renderer/renderer_blink_platform_impl.cc
 @@ -935,6 +935,12 @@ void RendererBlinkPlatformImpl::WillStopWorkerThread() {

patches/chromium/worker_feat_add_hook_to_notify_script_ready.patch

@@ -35,7 +35,7 @@ index d4d9c10d3420a5ff998aeb593ea6a25556d1215e..d64fef6bfc37264dcdc1bbea22eb5c4e
    // from the worker thread.
    virtual void WillDestroyWorkerContextOnWorkerThread(
 diff --git a/content/renderer/renderer_blink_platform_impl.cc b/content/renderer/renderer_blink_platform_impl.cc
-index 8c98620a6eb83283516a3fbe186c94c0ba75aac3..cfa6fb6d66529081bb24a29bd9affa148bea3a1f 100644
+index cd0e4d7ea77ffe9fd09982ef2d9f5d57df8e2995..3a96f5f084061c30344552a01b3d3a7260dad65e 100644
 --- a/content/renderer/renderer_blink_platform_impl.cc
 +++ b/content/renderer/renderer_blink_platform_impl.cc
 @@ -947,6 +947,12 @@ void RendererBlinkPlatformImpl::WorkerContextCreated(

patches/devtools_frontend/chore_expose_ui_to_allow_electron_to_set_dock_side.patch

@@ -10,10 +10,10 @@ to handle this without patching, but this is fairly clean for now and no longer
 patching legacy devtools code.
 
 diff --git a/front_end/entrypoints/main/MainImpl.ts b/front_end/entrypoints/main/MainImpl.ts
-index 9432286fb380145a0ef2c92f14be6083812ccd81..5929b1c30277c480886a2951a330c83ad97da6dd 100644
+index 5b82adb6600fd4ec3df1976cd6d23880c57f114c..d70f30fa82578365434d4338fb49f654858ac012 100644
 --- a/front_end/entrypoints/main/MainImpl.ts
 +++ b/front_end/entrypoints/main/MainImpl.ts
-@@ -780,6 +780,8 @@ export class MainImpl {
+@@ -779,6 +779,8 @@ export class MainImpl {
  globalThis.Main = globalThis.Main || {};
  // @ts-expect-error Exported for Tests.js
  globalThis.Main.Main = MainImpl;

patches/v8/build_warn_instead_of_abort_on_builtin_pgo_profile_mismatch.patch

@@ -15,7 +15,7 @@ Rather than disabling builtins PGO entirely, warn and skip mismatched
 builtins so all other builtins still benefit from PGO.
 
 diff --git a/BUILD.gn b/BUILD.gn
-index b9fd222a47342e6b0617a2d4e9d88ad25be09ed8..751265ba83c04f0c545248a71b35e46034bfc90a 100644
+index 382c7d3ed44eab5df1f33082d0d0ef85121bc47c..7b6a68379b81f317b3e2da868e9665239c60ffbe 100644
 --- a/BUILD.gn
 +++ b/BUILD.gn
 @@ -2821,9 +2821,11 @@ template("run_mksnapshot") {

script/build-stats.mjs

@@ -164,9 +164,10 @@ async function main () {
     const currentVersion = getChromiumVersionFromDEPS(depsContent);
 
     // Calculate the SHA256 for each object file under `outDir`
-    const objectFiles = await fs.readdir(outDir, { encoding: 'utf8', recursive: true });
+    const files = await fs.readdir(outDir, { encoding: 'utf8', recursive: true });
+    const objectFiles = files.filter(file => file.endsWith('.o') || file.endsWith('.obj'));
     const checksums = {};
-    for (const file of objectFiles.filter(f => f.endsWith('.o'))) {
+    for (const file of objectFiles) {
       const content = await fs.readFile(resolve(outDir, file));
       checksums[file] = createHash('sha256').update(content).digest('hex');
     }

shell/browser/api/electron_api_app.cc

@@ -77,6 +77,7 @@
 #include "shell/common/gin_helper/dictionary.h"
 #include "shell/common/gin_helper/error_thrower.h"
 #include "shell/common/gin_helper/object_template_builder.h"
+#include "shell/common/gin_helper/promise.h"
 #include "shell/common/language_util.h"
 #include "shell/common/node_includes.h"
 #include "shell/common/options_switches.h"

shell/browser/api/electron_api_app_mac.mm

@@ -8,7 +8,6 @@
 
 #include "base/path_service.h"
 #include "shell/common/electron_paths.h"
-#include "shell/common/node_includes.h"
 #include "shell/common/process_util.h"
 #include "shell/common/thread_restrictions.h"
 

shell/browser/api/electron_api_menu.cc

@@ -18,6 +18,7 @@
 #include "shell/common/gin_converters/gurl_converter.h"
 #include "shell/common/gin_converters/image_converter.h"
 #include "shell/common/gin_converters/optional_converter.h"
+#include "shell/common/gin_helper/dictionary.h"
 #include "shell/common/gin_helper/object_template_builder.h"
 #include "shell/common/node_includes.h"
 #include "ui/base/models/image_model.h"
@@ -27,7 +28,6 @@
 namespace gin {
 
 using SharingItem = electron::ElectronMenuModel::SharingItem;
-using Badge = electron::ElectronMenuModel::Badge;
 
 template <>
 struct Converter<SharingItem> {
@@ -44,28 +44,6 @@ struct Converter<SharingItem> {
   }
 };
 
-template <>
-struct Converter<Badge> {
-  static bool FromV8(v8::Isolate* isolate,
-                     v8::Local<v8::Value> val,
-                     Badge* out) {
-    gin_helper::Dictionary dict;
-    if (!ConvertFromV8(isolate, val, &dict))
-      return false;
-
-    std::string type_str;
-    if (dict.Get("type", &type_str)) {
-      out->type = base::UTF8ToUTF16(type_str);
-    } else {
-      out->type = u"none";
-    }
-
-    dict.GetOptional("count", &(out->count));
-    dict.GetOptional("content", &(out->content));
-    return true;
-  }
-};
-
 }  // namespace gin
 
 #endif
@@ -274,21 +252,6 @@ void Menu::SetCustomType(int index, const std::u16string& customType) {
   model_->SetCustomType(index, customType);
 }
 
-#if BUILDFLAG(IS_MAC)
-void Menu::SetBadge(int index, const gin_helper::Dictionary& badge_dict) {
-  ElectronMenuModel::Badge badge;
-  std::string type_str;
-  if (badge_dict.Get("type", &type_str)) {
-    badge.type = base::UTF8ToUTF16(type_str);
-  } else {
-    badge.type = u"none";
-  }
-  badge_dict.GetOptional("count", &badge.count);
-  badge_dict.GetOptional("content", &badge.content);
-  model_->SetBadge(index, std::move(badge));
-}
-#endif
-
 void Menu::Clear() {
   model_->Clear();
 }
@@ -313,6 +276,7 @@ void Menu::OnMenuWillClose() {
 }
 
 void Menu::OnMenuWillShow() {
+  keep_alive_ = this;
   Emit("menu-will-show");
 }
 
@@ -329,12 +293,8 @@ void Menu::FillObjectTemplate(v8::Isolate* isolate,
       .SetMethod("setToolTip", &Menu::SetToolTip)
       .SetMethod("setRole", &Menu::SetRole)
       .SetMethod("setCustomType", &Menu::SetCustomType)
-#if BUILDFLAG(IS_MAC)
-      .SetMethod("setBadge", &Menu::SetBadge)
-#endif
       .SetMethod("clear", &Menu::Clear)
       .SetMethod("getItemCount", &Menu::GetItemCount)
-      .SetMethod("getIndexOfCommandId", &Menu::GetIndexOfCommandId)
       .SetMethod("popupAt", &Menu::PopupAt)
       .SetMethod("closePopupAt", &Menu::ClosePopupAt)
       .SetMethod("_getAcceleratorTextAt", &Menu::GetAcceleratorTextAtForTesting)

shell/browser/api/electron_api_menu.h

@@ -13,7 +13,6 @@
 #include "shell/browser/event_emitter_mixin.h"
 #include "shell/browser/ui/electron_menu_model.h"
 #include "shell/common/gin_helper/constructible.h"
-#include "shell/common/gin_helper/dictionary.h"
 #include "shell/common/gin_helper/self_keep_alive.h"
 #include "ui/base/mojom/menu_source_type.mojom-forward.h"
 
@@ -129,14 +128,11 @@ class Menu : public gin::Wrappable<Menu>,
   void SetToolTip(int index, const std::u16string& toolTip);
   void SetRole(int index, const std::u16string& role);
   void SetCustomType(int index, const std::u16string& customType);
-#if BUILDFLAG(IS_MAC)
-  void SetBadge(int index, const gin_helper::Dictionary& badge);
-#endif
   void Clear();
   int GetIndexOfCommandId(int command_id) const;
   int GetItemCount() const;
 
-  gin_helper::SelfKeepAlive<Menu> keep_alive_{this};
+  gin_helper::SelfKeepAlive<Menu> keep_alive_{nullptr};
 };
 
 }  // namespace electron::api

shell/browser/api/electron_api_menu_mac.mm

@@ -19,7 +19,6 @@
 #include "shell/browser/api/electron_api_web_frame_main.h"
 #include "shell/browser/native_window.h"
 #include "shell/common/keyboard_util.h"
-#include "shell/common/node_includes.h"
 #include "ui/base/cocoa/menu_utils.h"
 #include "v8/include/cppgc/allocation.h"
 #include "v8/include/v8-cppgc.h"

shell/browser/api/electron_api_system_preferences_mac.mm

@@ -26,7 +26,6 @@
 #include "shell/common/gin_converters/gurl_converter.h"
 #include "shell/common/gin_converters/value_converter.h"
 #include "shell/common/gin_helper/promise.h"
-#include "shell/common/node_includes.h"
 #include "shell/common/process_util.h"
 #include "skia/ext/skia_utils_mac.h"
 

shell/browser/api/electron_api_web_contents.cc

@@ -47,11 +47,13 @@
 #include "content/browser/renderer_host/render_widget_host_impl.h"  // nogncheck
 #include "content/browser/renderer_host/render_widget_host_view_base.h"  // nogncheck
 #include "content/browser/web_contents/web_contents_impl.h"  // nogncheck
+#include "content/public/browser/browser_thread.h"
 #include "content/public/browser/child_process_security_policy.h"
 #include "content/public/browser/context_menu_params.h"
 #include "content/public/browser/desktop_media_id.h"
 #include "content/public/browser/desktop_streams_registry.h"
 #include "content/public/browser/devtools_agent_host.h"
+#include "content/public/browser/download_manager.h"
 #include "content/public/browser/download_request_utils.h"
 #include "content/public/browser/favicon_status.h"
 #include "content/public/browser/file_select_listener.h"
@@ -90,9 +92,11 @@
 #include "services/service_manager/public/cpp/interface_provider.h"
 #include "shell/browser/api/electron_api_browser_window.h"
 #include "shell/browser/api/electron_api_debugger.h"
+#include "shell/browser/api/electron_api_session.h"
 #include "shell/browser/api/electron_api_web_frame_main.h"
 #include "shell/browser/api/frame_subscriber.h"
 #include "shell/browser/api/message_port.h"
+#include "shell/browser/api/save_page_handler.h"
 #include "shell/browser/browser.h"
 #include "shell/browser/child_web_contents_tracker.h"
 #include "shell/browser/electron_autofill_driver_factory.h"

shell/browser/api/electron_api_web_contents.h

@@ -22,8 +22,6 @@
 #include "chrome/browser/ui/exclusive_access/exclusive_access_context.h"  // nogncheck
 #include "chrome/browser/ui/exclusive_access/exclusive_access_manager.h"
 #include "content/common/frame.mojom-forward.h"
-#include "content/public/browser/browser_thread.h"
-#include "content/public/browser/devtools_agent_host.h"
 #include "content/public/browser/frame_tree_node_id.h"
 #include "content/public/browser/global_routing_id.h"
 #include "content/public/browser/javascript_dialog_manager.h"
@@ -33,9 +31,6 @@
 #include "content/public/common/stop_find_action.h"
 #include "electron/buildflags/buildflags.h"
 #include "printing/buildflags/buildflags.h"
-#include "shell/browser/api/electron_api_debugger.h"
-#include "shell/browser/api/electron_api_session.h"
-#include "shell/browser/api/save_page_handler.h"
 #include "shell/browser/background_throttling_source.h"
 #include "shell/browser/event_emitter_mixin.h"
 #include "shell/browser/extended_web_contents_observer.h"
@@ -43,13 +38,10 @@
 #include "shell/browser/preload_script.h"
 #include "shell/browser/ui/inspectable_web_contents_delegate.h"
 #include "shell/browser/ui/inspectable_web_contents_view_delegate.h"
-#include "shell/common/api/api.mojom.h"
 #include "shell/common/gin_helper/cleaned_up_at_exit.h"
 #include "shell/common/gin_helper/constructible.h"
-#include "shell/common/gin_helper/handle.h"
 #include "shell/common/gin_helper/pinnable.h"
 #include "shell/common/gin_helper/wrappable.h"
-#include "shell/common/web_contents_utility.mojom.h"
 #include "ui/base/models/image_model.h"
 #include "v8/include/cppgc/persistent.h"
 
@@ -66,8 +58,14 @@ struct DeviceEmulationParams;
 // enum class PermissionType;
 }  // namespace blink
 
+namespace base {
+class FilePath;
+class Value;
+}  // namespace base
+
 namespace content {
 enum class KeyboardEventProcessingResult;
+class DevToolsAgentHost;
 class WebContents;
 }  // namespace content
 
@@ -79,6 +77,8 @@ namespace gin_helper {
 class Dictionary;
 class ErrorThrower;
 template <typename T>
+class Handle;
+template <typename T>
 class Promise;
 }  // namespace gin_helper
 
@@ -110,7 +110,9 @@ class OffScreenWebContentsView;
 namespace api {
 
 class BaseWindow;
+class Debugger;
 class FrameSubscriber;
+class Session;
 
 // Wrapper around the content::WebContents.
 class WebContents final : public ExclusiveAccessContext,

shell/browser/browser.cc

@@ -22,6 +22,7 @@
 #include "shell/browser/window_list.h"
 #include "shell/common/application_info.h"
 #include "shell/common/gin_converters/login_item_settings_converter.h"
+#include "shell/common/gin_helper/promise.h"
 #include "shell/common/thread_restrictions.h"
 
 namespace electron {

shell/browser/browser.h

@@ -15,7 +15,6 @@
 #include "base/task/cancelable_task_tracker.h"
 #include "base/values.h"
 #include "shell/browser/window_list_observer.h"
-#include "shell/common/gin_helper/promise.h"
 
 #if BUILDFLAG(IS_WIN)
 #include <windows.h>
@@ -35,7 +34,17 @@ class Arguments;
 
 namespace gin_helper {
 class Arguments;
-}
+template <typename T>
+class Promise;
+}  // namespace gin_helper
+
+namespace v8 {
+template <typename T>
+class Local;
+class Isolate;
+class Promise;
+class Value;
+}  // namespace v8
 
 namespace electron {
 

shell/browser/browser_win.cc

@@ -42,6 +42,7 @@
 #include "shell/common/gin_converters/image_converter.h"
 #include "shell/common/gin_converters/login_item_settings_converter.h"
 #include "shell/common/gin_helper/dictionary.h"
+#include "shell/common/gin_helper/promise.h"
 #include "shell/common/skia_util.h"
 #include "shell/common/thread_restrictions.h"
 #include "skia/ext/font_utils.h"

shell/browser/javascript_environment.cc

@@ -17,12 +17,15 @@
 #include "base/task/single_thread_task_runner.h"
 #include "base/task/thread_pool/initialization_util.h"
 #include "gin/array_buffer.h"
+#include "gin/public/isolate_holder.h"
 #include "gin/v8_initializer.h"
 #include "shell/browser/microtasks_runner.h"
 #include "shell/common/gin_helper/cleaned_up_at_exit.h"
 #include "shell/common/node_includes.h"
 #include "third_party/blink/public/common/switches.h"
 #include "third_party/electron_node/src/node_wasm_web_api.h"
+#include "v8/include/v8-isolate.h"
+#include "v8/include/v8-locker.h"
 
 namespace {
 v8::Isolate* g_isolate;
@@ -137,6 +140,10 @@ v8::Isolate* JavascriptEnvironment::Initialize(uv_loop_t* event_loop,
   return isolate;
 }
 
+v8::Isolate* JavascriptEnvironment::isolate() const {
+  return isolate_holder_->isolate();
+}
+
 // static
 v8::Isolate* JavascriptEnvironment::GetIsolate() {
   CHECK(g_isolate);

shell/browser/javascript_environment.h

@@ -7,15 +7,22 @@
 
 #include <memory>
 
-#include "gin/public/isolate_holder.h"
 #include "uv.h"  // NOLINT(build/include_directory)
-#include "v8/include/v8-locker.h"
+
+namespace gin {
+class IsolateHolder;
+}  // namespace gin
 
 namespace node {
 class Environment;
 class MultiIsolatePlatform;
 }  // namespace node
 
+namespace v8 {
+class Isolate;
+class Locker;
+}  // namespace v8
+
 namespace electron {
 
 class MicrotasksRunner;
@@ -34,14 +41,13 @@ class JavascriptEnvironment {
   void DestroyMicrotasksRunner();
 
   node::MultiIsolatePlatform* platform() const { return platform_.get(); }
-  [[nodiscard]] v8::Isolate* isolate() const {
-    return isolate_holder_->isolate();
-  }
+
   size_t max_young_generation_size_in_bytes() const {
     return max_young_generation_size_;
   }
 
-  static v8::Isolate* GetIsolate();
+  [[nodiscard]] v8::Isolate* isolate() const;
+  [[nodiscard]] static v8::Isolate* GetIsolate();
 
  private:
   v8::Isolate* Initialize(uv_loop_t* event_loop, bool setup_wasm_streaming);

shell/browser/login_handler.cc

@@ -7,6 +7,7 @@
 #include <utility>
 
 #include "base/task/sequenced_task_runner.h"
+#include "content/public/browser/browser_thread.h"
 #include "gin/arguments.h"
 #include "gin/dictionary.h"
 #include "shell/browser/api/electron_api_app.h"

shell/browser/ui/cocoa/electron_menu_controller.mm

@@ -117,30 +117,6 @@ NSArray* ConvertSharingItemToNS(const SharingItem& item) {
   return result;
 }
 
-// Convert a Badge to an NSMenuItemBadge.
-NSMenuItemBadge* CreateBadge(const electron::ElectronMenuModel::Badge& badge)
-    API_AVAILABLE(macos(14.0)) {
-  NSString* badgeType = base::SysUTF16ToNSString(badge.type);
-
-  if ([badgeType isEqualToString:@"alerts"]) {
-    if (badge.count.has_value())
-      return [NSMenuItemBadge alertsWithCount:badge.count.value()];
-  } else if ([badgeType isEqualToString:@"updates"]) {
-    if (badge.count.has_value())
-      return [NSMenuItemBadge updatesWithCount:badge.count.value()];
-  } else if ([badgeType isEqualToString:@"new-items"]) {
-    if (badge.count.has_value())
-      return [NSMenuItemBadge newItemsWithCount:badge.count.value()];
-  } else if ([badgeType isEqualToString:@"none"]) {
-    if (badge.content.has_value()) {
-      NSString* content = base::SysUTF8ToNSString(badge.content.value());
-      return [[NSMenuItemBadge alloc] initWithString:content];
-    }
-  }
-
-  return nil;
-}
-
 }  // namespace
 
 // This class stores a base::WeakPtr<electron::ElectronMenuModel> as an
@@ -365,12 +341,14 @@ NSMenuItemBadge* CreateBadge(const electron::ElectronMenuModel::Badge& badge)
   electron::ElectronMenuModel::ItemType type = model->GetTypeAt(index);
   std::u16string customType = model->GetCustomTypeAt(index);
 
+  // The sectionHeaderWithTitle menu item is only available in macOS 14.0+.
   if (@available(macOS 14, *)) {
     if (customType == u"header") {
       item = [NSMenuItem sectionHeaderWithTitle:label];
     }
   }
 
+  // If the menu item has an icon, set it.
   ui::ImageModel icon = model->GetIconAt(index);
   if (icon.IsImage())
     item.image = icon.GetImage().ToNSImage();
@@ -378,15 +356,6 @@ NSMenuItemBadge* CreateBadge(const electron::ElectronMenuModel::Badge& badge)
   std::u16string toolTip = model->GetToolTipAt(index);
   item.toolTip = base::SysUTF16ToNSString(toolTip);
 
-  if (@available(macOS 14, *)) {
-    electron::ElectronMenuModel::Badge badge;
-    if (model->GetBadgeAt(index, &badge)) {
-      NSMenuItemBadge* nsBadge = CreateBadge(badge);
-      if (nsBadge)
-        item.badge = nsBadge;
-    }
-  }
-
   if (role == u"services") {
     std::u16string title = u"Services";
     NSString* sub_label = l10n_util::FixUpWindowsStyleLabel(title);
@@ -548,15 +517,6 @@ NSMenuItemBadge* CreateBadge(const electron::ElectronMenuModel::Badge& badge)
   } else {
     item.image = nil;
   }
-
-  if (@available(macOS 14, *)) {
-    electron::ElectronMenuModel::Badge badge;
-    if (model->GetBadgeAt(index, &badge)) {
-      item.badge = CreateBadge(badge);
-    } else {
-      item.badge = nil;
-    }
-  }
 }
 
 - (void)refreshMenuTree:(NSMenu*)menu {

shell/browser/ui/electron_menu_model.cc

@@ -12,15 +12,6 @@ namespace electron {
 ElectronMenuModel::SharingItem::SharingItem() = default;
 ElectronMenuModel::SharingItem::SharingItem(SharingItem&&) = default;
 ElectronMenuModel::SharingItem::~SharingItem() = default;
-
-ElectronMenuModel::Badge::Badge() = default;
-ElectronMenuModel::Badge::Badge(Badge&&) = default;
-ElectronMenuModel::Badge::Badge(const Badge&) = default;
-ElectronMenuModel::Badge& ElectronMenuModel::Badge::operator=(const Badge&) =
-    default;
-ElectronMenuModel::Badge& ElectronMenuModel::Badge::operator=(Badge&&) =
-    default;
-ElectronMenuModel::Badge::~Badge() = default;
 #endif
 
 bool ElectronMenuModel::Delegate::GetAcceleratorForCommandId(
@@ -124,21 +115,6 @@ bool ElectronMenuModel::GetSharingItemAt(size_t index,
 void ElectronMenuModel::SetSharingItem(SharingItem item) {
   sharing_item_.emplace(std::move(item));
 }
-
-void ElectronMenuModel::SetBadge(size_t index, Badge badge) {
-  int command_id = GetCommandIdAt(index);
-  badges_[command_id] = std::move(badge);
-}
-
-bool ElectronMenuModel::GetBadgeAt(size_t index, Badge* badge) const {
-  int command_id = GetCommandIdAt(index);
-  const auto iter = badges_.find(command_id);
-  if (iter != badges_.end()) {
-    *badge = iter->second;
-    return true;
-  }
-  return false;
-}
 #endif
 
 void ElectronMenuModel::MenuWillClose() {

shell/browser/ui/electron_menu_model.h

@@ -33,19 +33,6 @@ class ElectronMenuModel : public ui::SimpleMenuModel {
     std::optional<std::vector<GURL>> urls;
     std::optional<std::vector<base::FilePath>> file_paths;
   };
-
-  struct Badge {
-    Badge();
-    Badge(Badge&&);
-    Badge(const Badge&);
-    Badge& operator=(const Badge&);
-    Badge& operator=(Badge&&);
-    ~Badge();
-
-    std::u16string type;  // "alerts", "updates", "new-items", or "none"
-    std::optional<int> count;
-    std::optional<std::string> content;
-  };
 #endif
 
   class Delegate : public ui::SimpleMenuModel::Delegate {
@@ -118,9 +105,6 @@ class ElectronMenuModel : public ui::SimpleMenuModel {
     return sharing_item_;
   }
 
-  // Set/Get the Badge of a menu item.
-  void SetBadge(size_t index, Badge badge);
-  bool GetBadgeAt(size_t index, Badge* badge) const;
 #endif
 
   // ui::SimpleMenuModel:
@@ -139,7 +123,6 @@ class ElectronMenuModel : public ui::SimpleMenuModel {
 
 #if BUILDFLAG(IS_MAC)
   std::optional<SharingItem> sharing_item_;
-  base::flat_map<int, Badge> badges_;  // command id -> badge
 #endif
 
   base::flat_map<int, std::u16string> toolTips_;  // command id -> tooltip

shell/browser/ui/inspectable_web_contents.cc

@@ -402,7 +402,7 @@ void InspectableWebContents::SetDockState(const std::string& state) {
     can_dock_ = false;
   } else {
     can_dock_ = true;
-    dock_state_ = IsValidDockState(state) ? state : "right";
+    dock_state_ = (state.empty() || IsValidDockState(state)) ? state : "right";
   }
 }
 

shell/common/application_info.cc

@@ -6,6 +6,7 @@
 
 #include "base/i18n/rtl.h"
 #include "base/no_destructor.h"
+#include "base/strings/string_util.h"
 #include "chrome/browser/browser_process.h"
 #include "chrome/common/chrome_version.h"
 #include "components/embedder_support/user_agent_utils.h"

shell/common/gin_helper/callback.h

@@ -13,6 +13,7 @@
 #include "shell/common/gin_helper/function_template.h"
 #include "shell/common/gin_helper/locker.h"
 #include "v8/include/cppgc/persistent.h"
+#include "v8/include/v8-context.h"
 #include "v8/include/v8-function.h"
 #include "v8/include/v8-microtask-queue.h"
 // Implements safe conversions between JS functions and base::RepeatingCallback.

shell/common/gin_helper/function_template.h

@@ -16,7 +16,6 @@
 #include "gin/public/gin_embedders.h"
 #include "shell/common/gin_helper/destroyable.h"
 #include "shell/common/gin_helper/error_thrower.h"
-#include "v8/include/v8-context.h"
 #include "v8/include/v8-external.h"
 #include "v8/include/v8-microtask-queue.h"
 #include "v8/include/v8-template.h"

shell/common/node_bindings.cc

@@ -529,14 +529,7 @@ NodeBindings::NodeBindings(BrowserEnvironment browser_env)
       uv_loop_{InitEventLoop(browser_env, &worker_loop_)} {}
 
 NodeBindings::~NodeBindings() {
-  // Quit the embed thread.
-  embed_closed_ = true;
-  uv_sem_post(&embed_sem_);
-
-  WakeupEmbedThread();
-
-  // Wait for everything to be done.
-  uv_thread_join(&embed_thread_);
+  StopPolling();
 
   // Clear uv.
   uv_sem_destroy(&embed_sem_);
@@ -547,6 +540,26 @@ NodeBindings::~NodeBindings() {
     stop_and_close_uv_loop(uv_loop_);
 }
 
+void NodeBindings::StopPolling() {
+  if (!initialized_)
+    return;
+
+  // Tell the embed thread to quit.
+  embed_closed_ = true;
+
+  // The embed thread alternates between uv_sem_wait (waiting for UvRunOnce
+  // to finish) and PollEvents (waiting for I/O). Wake it from both.
+  uv_sem_post(&embed_sem_);
+  WakeupEmbedThread();
+
+  // Wait for it to exit.
+  uv_thread_join(&embed_thread_);
+
+  // Allow PrepareEmbedThread + StartPolling to restart.
+  embed_closed_ = false;
+  initialized_ = false;
+}
+
 node::IsolateData* NodeBindings::isolate_data(
     v8::Local<v8::Context> context) const {
   if (context->GetNumberOfEmbedderDataFields() <=
@@ -933,12 +946,21 @@ void NodeBindings::PrepareEmbedThread() {
   if (initialized_)
     return;
 
-  // Add dummy handle for libuv, otherwise libuv would quit when there is
-  // nothing to do.
-  uv_async_init(uv_loop_, dummy_uv_handle_.get(), nullptr);
+  // The async handle and semaphore live for the lifetime of this
+  // NodeBindings instance (destroyed in ~NodeBindings), but the embed
+  // thread itself may be stopped and restarted via StopPolling /
+  // PrepareEmbedThread for pooled worklet contexts. Only init the
+  // handles once.
+  if (!embed_thread_prepared_) {
+    // Add dummy handle for libuv, otherwise libuv would quit when there is
+    // nothing to do.
+    uv_async_init(uv_loop_, dummy_uv_handle_.get(), nullptr);
+
+    // Start worker that will interrupt main loop when having uv events.
+    uv_sem_init(&embed_sem_, 0);
+    embed_thread_prepared_ = true;
+  }
 
-  // Start worker that will interrupt main loop when having uv events.
-  uv_sem_init(&embed_sem_, 0);
   uv_thread_create(&embed_thread_, EmbedThreadRunner, this);
 }
 

shell/common/node_bindings.h

@@ -157,6 +157,12 @@ class NodeBindings {
   // Notify embed thread to start polling after environment is loaded.
   void StartPolling();
 
+  // Stop the embed thread and polling without destroying handles or the loop.
+  // After this call, PrepareEmbedThread + StartPolling can restart them.
+  // Used by pooled worklets that need to pause the embed thread during
+  // environment teardown but reuse the same NodeBindings for the next context.
+  void StopPolling();
+
   node::IsolateData* isolate_data(v8::Local<v8::Context> context) const;
 
   // Gets/sets the environment to wrap uv loop.
@@ -225,6 +231,11 @@ class NodeBindings {
   // Indicates whether polling thread has been created.
   bool initialized_ = false;
 
+  // Whether PrepareEmbedThread has initialized the semaphore and async handle.
+  // Unlike |initialized_|, this is never reset — the handles live until the
+  // destructor.
+  bool embed_thread_prepared_ = false;
+
   // Indicates whether the app code has finished loading
   // for ESM this is async after the module is loaded
   bool app_code_loaded_ = false;

shell/renderer/api/electron_api_web_frame.cc

@@ -624,7 +624,7 @@ class WebFrameRenderer final
     blink::WebFrame* web_frame = render_frame->GetWebFrame();
     if (web_frame->IsWebLocalFrame()) {
       web_frame->ToWebLocalFrame()->GetDocument().RemoveInsertedStyleSheet(
-          blink::WebString::FromUTF16(key));
+          blink::WebString::FromUtf16(key));
     }
   }
 
@@ -652,7 +652,7 @@ class WebFrameRenderer final
       return handle;
     }
 
-    const blink::WebScriptSource source{blink::WebString::FromUTF16(code)};
+    const blink::WebScriptSource source{blink::WebString::FromUtf16(code)};
 
     bool has_user_gesture = false;
     if (auto next = args->PeekNext(); !next.IsEmpty() && next->IsBoolean()) {
@@ -731,7 +731,7 @@ class WebFrameRenderer final
         return handle;
       }
 
-      sources.emplace_back(blink::WebString::FromUTF16(code),
+      sources.emplace_back(blink::WebString::FromUtf16(code),
                            blink::WebURL(GURL(url)));
     }
 

shell/renderer/electron_api_service_impl.cc

@@ -15,7 +15,6 @@
 #include "shell/common/gin_converters/blink_converter.h"
 #include "shell/common/gin_converters/value_converter.h"
 #include "shell/common/heap_snapshot.h"
-#include "shell/common/node_includes.h"
 #include "shell/common/options_switches.h"
 #include "shell/common/thread_restrictions.h"
 #include "shell/common/v8_util.h"
@@ -27,6 +26,7 @@
 #include "third_party/blink/public/web/blink.h"
 #include "third_party/blink/public/web/web_local_frame.h"
 #include "third_party/blink/public/web/web_message_port_converter.h"
+#include "v8/include/v8-context.h"
 
 namespace electron {
 

shell/renderer/electron_autofill_agent.cc

@@ -206,7 +206,7 @@ void AutofillAgent::AcceptDataListSuggestion(const std::u16string& suggestion) {
     blink::WebInputElement input_element =
         element.DynamicTo<blink::WebInputElement>();
     if (!input_element.IsNull())
-      input_element.SetAutofillValue(blink::WebString::FromUTF16(suggestion));
+      input_element.SetAutofillValue(blink::WebString::FromUtf16(suggestion));
   }
 }
 

shell/renderer/electron_renderer_client.cc

@@ -25,6 +25,7 @@
 #include "third_party/blink/renderer/core/frame/web_local_frame_impl.h"  // nogncheck
 #include "third_party/blink/renderer/core/workers/worker_global_scope.h"  // nogncheck
 #include "third_party/blink/renderer/core/workers/worker_settings.h"  // nogncheck
+#include "third_party/blink/renderer/core/workers/worklet_global_scope.h"  // nogncheck
 
 namespace electron {
 
@@ -206,11 +207,20 @@ bool WorkerHasNodeIntegration(blink::ExecutionContext* ec) {
   // owing to an inability to customize sandbox policies in these workers
   // given that they're run out-of-process.
   // Also avoid creating a Node.js environment for worklet global scope
-  // created on the main thread.
+  // created on the main thread — those share the page's V8 context where
+  // Node is already wired up.
   if (ec->IsServiceWorkerGlobalScope() || ec->IsSharedWorkerGlobalScope() ||
       ec->IsMainThreadWorkletGlobalScope())
     return false;
 
+  // Off-main-thread worklets (AudioWorklet, PaintWorklet, AnimationWorklet,
+  // SharedStorageWorklet) have their own dedicated worker thread but do not
+  // derive from WorkerGlobalScope, so check for them separately and read the
+  // flag from WorkletGlobalScope, which copies it out of the same
+  // WorkerSettings as dedicated workers do.
+  if (auto* wlgs = blink::DynamicTo<blink::WorkletGlobalScope>(ec))
+    return wlgs->NodeIntegrationInWorker();
+
   auto* wgs = blink::DynamicTo<blink::WorkerGlobalScope>(ec);
   if (!wgs)
     return false;
@@ -233,9 +243,9 @@ void ElectronRendererClient::WorkerScriptReadyForEvaluationOnWorkerThread(
     return;
 
   auto* current = WebWorkerObserver::GetCurrent();
-  if (current)
-    return;
-  WebWorkerObserver::Create()->WorkerScriptReadyForEvaluation(context);
+  if (!current)
+    current = WebWorkerObserver::Create();
+  current->WorkerScriptReadyForEvaluation(context);
 }
 
 void ElectronRendererClient::WillDestroyWorkerContextOnWorkerThread(

shell/renderer/web_worker_observer.cc

@@ -10,11 +10,12 @@
 #include "base/no_destructor.h"
 #include "base/strings/strcat.h"
 #include "base/threading/thread_local.h"
+#include "gin/converter.h"
 #include "shell/common/api/electron_bindings.h"
-#include "shell/common/gin_helper/event_emitter_caller.h"
 #include "shell/common/node_bindings.h"
 #include "shell/common/node_includes.h"
 #include "shell/common/node_util.h"
+#include "third_party/blink/renderer/core/execution_context/execution_context.h"  // nogncheck
 
 namespace electron {
 
@@ -23,6 +24,23 @@ namespace {
 static base::NoDestructor<base::ThreadLocalOwnedPointer<WebWorkerObserver>>
     lazy_tls;
 
+// Returns true if `context` belongs to a worklet that runs on a thread
+// pooled by Blink's WorkletThreadHolder, where the worker thread can be
+// reused for multiple worklet contexts. For these scopes the
+// WebWorkerObserver and its NodeBindings must outlive the v8::Context so
+// the next pooled context can reuse them — Node.js cannot be re-initialized
+// on the same thread (the allocator shim only loads once). See callers of
+// blink::WorkletThreadHolder in third_party/blink for the authoritative
+// list.
+bool IsPooledWorkletContext(v8::Local<v8::Context> context) {
+  auto* ec = blink::ExecutionContext::From(context);
+  if (!ec)
+    return false;
+  return ec->IsAudioWorkletGlobalScope() || ec->IsPaintWorkletGlobalScope() ||
+         ec->IsAnimationWorkletGlobalScope() ||
+         ec->IsSharedStorageWorkletGlobalScope();
+}
+
 }  // namespace
 
 // static
@@ -48,6 +66,21 @@ WebWorkerObserver::~WebWorkerObserver() = default;
 
 void WebWorkerObserver::WorkerScriptReadyForEvaluation(
     v8::Local<v8::Context> worker_context) {
+  active_context_count_++;
+
+  if (environments_.empty()) {
+    // First context on this thread - do full Node.js initialization.
+    InitializeNewEnvironment(worker_context);
+  } else {
+    // Thread is being reused (AudioWorklet thread pooling). Share the
+    // existing Node.js environment with the new context instead of
+    // reinitializing, which would break existing contexts on this thread.
+    ShareEnvironmentWithContext(worker_context);
+  }
+}
+
+void WebWorkerObserver::InitializeNewEnvironment(
+    v8::Local<v8::Context> worker_context) {
   v8::Context::Scope context_scope(worker_context);
   v8::Isolate* const isolate = v8::Isolate::GetCurrent();
   v8::MicrotasksScope microtasks_scope(
@@ -106,26 +139,191 @@ void WebWorkerObserver::WorkerScriptReadyForEvaluation(
   environments_.insert(std::move(env));
 }
 
+void WebWorkerObserver::ShareEnvironmentWithContext(
+    v8::Local<v8::Context> worker_context) {
+  v8::Context::Scope context_scope(worker_context);
+  v8::Isolate* const isolate = v8::Isolate::GetCurrent();
+  v8::MicrotasksScope microtasks_scope(
+      worker_context, v8::MicrotasksScope::kDoNotRunMicrotasks);
+
+  // Get the existing environment from the first context on this thread.
+  DCHECK(!environments_.empty());
+  node::Environment* env = environments_.begin()->get();
+
+  // Initialize the V8 context for Node.js use.
+  v8::Maybe<bool> initialized = node::InitializeContext(worker_context);
+  CHECK(!initialized.IsNothing() && initialized.FromJust());
+
+  // Assign the existing Node.js environment to this new context so that
+  // node::Environment::GetCurrent(context) returns the shared environment.
+  env->AssignToContext(worker_context, env->principal_realm(),
+                       node::ContextInfo("electron_worker"));
+
+  // Get process and require from the original context to make Node.js
+  // APIs available in the new context.
+  v8::Local<v8::Context> original_context = env->context();
+  v8::Local<v8::Object> original_global = original_context->Global();
+  v8::Local<v8::Object> new_global = worker_context->Global();
+
+  v8::Local<v8::Value> process_value;
+  CHECK(original_global
+            ->Get(original_context, gin::StringToV8(isolate, "process"))
+            .ToLocal(&process_value));
+
+  v8::Local<v8::Value> require_value;
+  CHECK(original_global
+            ->Get(original_context, gin::StringToV8(isolate, "require"))
+            .ToLocal(&require_value));
+
+  // Set up 'global' as an alias for globalThis. Node.js bootstrapping normally
+  // does this during LoadEnvironment, but we skip full bootstrap for shared
+  // contexts.
+  new_global
+      ->Set(worker_context, gin::StringToV8(isolate, "global"), new_global)
+      .Check();
+
+  new_global
+      ->Set(worker_context, gin::StringToV8(isolate, "process"), process_value)
+      .Check();
+  new_global
+      ->Set(worker_context, gin::StringToV8(isolate, "require"), require_value)
+      .Check();
+
+  // Copy Buffer from the original context if it exists.
+  v8::Local<v8::Value> buffer_value;
+  if (original_global->Get(original_context, gin::StringToV8(isolate, "Buffer"))
+          .ToLocal(&buffer_value) &&
+      !buffer_value->IsUndefined()) {
+    new_global
+        ->Set(worker_context, gin::StringToV8(isolate, "Buffer"), buffer_value)
+        .Check();
+  }
+
+  // Restore the Blink implementations of web APIs that Node.js may
+  // have deleted. For first-context init this is done by the node_init script
+  // but we can't run that for shared contexts (it calls internalBinding).
+  // Instead, copy the blink-prefixed values set during first init.
+  for (const std::string_view key :
+       {"fetch", "Response", "FormData", "Request", "Headers", "EventSource"}) {
+    // First, check if the new context has a working Blink version.
+    v8::MaybeLocal<v8::Value> blink_value =
+        new_global->Get(worker_context, gin::StringToV8(isolate, key));
+    if (!blink_value.IsEmpty() && !blink_value.ToLocalChecked()->IsUndefined())
+      continue;
+    // If not, copy from the original context.
+    std::string blink_key = base::StrCat({"blink", key});
+    v8::Local<v8::Value> orig_value;
+    if (original_global->Get(original_context, gin::StringToV8(isolate, key))
+            .ToLocal(&orig_value) &&
+        !orig_value->IsUndefined()) {
+      new_global->Set(worker_context, gin::StringToV8(isolate, key), orig_value)
+          .Check();
+    }
+  }
+}
+
 void WebWorkerObserver::ContextWillDestroy(v8::Local<v8::Context> context) {
   node::Environment* env = node::Environment::GetCurrent(context);
-  if (env) {
-    v8::Context::Scope context_scope(env->context());
-    gin_helper::EmitEvent(env->isolate(), env->process_object(), "exit");
+  if (!env)
+    return;
+
+  const bool is_pooled_worklet = IsPooledWorkletContext(context);
+
+  active_context_count_--;
+
+  if (active_context_count_ == 0) {
+    // Last context on this thread — full cleanup.
+    {
+      v8::Context::Scope context_scope(env->context());
+
+      // Emit the "exit" event on the process object. We avoid using
+      // gin_helper::EmitEvent here because it goes through
+      // CallMethodWithArgs, which creates a node::CallbackScope. During
+      // worker shutdown (PrepareForShutdownOnWorkerThread), the
+      // CallbackScope destructor's InternalCallbackScope::Close() tries to
+      // process ticks and microtask checkpoints, which can SEGV because the
+      // worker context is being torn down by Blink.
+      v8::Isolate* isolate = env->isolate();
+      v8::HandleScope handle_scope(isolate);
+      v8::Local<v8::Context> ctx = env->context();
+      v8::Local<v8::Value> emit_v;
+      if (env->process_object()
+              ->Get(ctx, gin::StringToV8(isolate, "emit"))
+              .ToLocal(&emit_v) &&
+          emit_v->IsFunction()) {
+        v8::Local<v8::Value> args[] = {gin::StringToV8(isolate, "exit")};
+        v8::TryCatch try_catch(isolate);
+        emit_v.As<v8::Function>()
+            ->Call(ctx, env->process_object(), 1, args)
+            .FromMaybe(v8::Local<v8::Value>());
+        // We are mid-teardown and about to destroy the worker's
+        // node::Environment, so we cannot let an exception thrown by an
+        // 'exit' listener propagate back into Blink (it would assert in
+        // V8::FromJustIsNothing on the next call into V8). Log it and
+        // explicitly reset the TryCatch so the destructor doesn't rethrow.
+        if (try_catch.HasCaught()) {
+          if (auto message = try_catch.Message(); !message.IsEmpty()) {
+            std::string str;
+            if (gin::ConvertFromV8(isolate, message->Get(), &str))
+              LOG(ERROR) << "Exception thrown from worker 'exit' handler: "
+                         << str;
+          }
+          try_catch.Reset();
+        }
+      }
+    }
+
+    // Prevent UvRunOnce from using the environment after it's destroyed.
+    node_bindings_->set_uv_env(nullptr);
+
+    // Stop the embed thread before destroying environments. The embed
+    // thread's PollEvents and FreeEnvironment's uv_run both compete for
+    // completions on the same libuv event loop; on Windows (IOCP) this
+    // race can deadlock. Joining the embed thread first eliminates the
+    // contention so FreeEnvironment's uv_run can drain handles cleanly.
+    // For pooled worklets the thread is restarted in
+    // InitializeNewEnvironment via PrepareEmbedThread + StartPolling.
+    node_bindings_->StopPolling();
+
+    // Destroying the node environment will also run the uv loop.
+    {
+      util::ExplicitMicrotasksScope microtasks_scope(
+          context->GetMicrotaskQueue());
+      environments_.clear();
+    }
+
+    // ElectronBindings is tracking node environments.
+    electron_bindings_->EnvironmentDestroyed(env);
+
+    // For non-pooled worker contexts (e.g., dedicated workers) Blink does
+    // not reuse the worker thread, so tear down the observer completely.
+    //
+    // For pooled worklet contexts (AudioWorklet, PaintWorklet,
+    // AnimationWorklet, SharedStorageWorklet — see
+    // blink::WorkletThreadHolder) the same NodeBindings must be reused
+    // for the next context on the thread because Node.js cannot be
+    // re-initialized on the same thread. Keep the observer alive and let
+    // the next WorkerScriptReadyForEvaluation call
+    // InitializeNewEnvironment, which restarts the embed thread via
+    // PrepareEmbedThread + StartPolling.
+    if (!is_pooled_worklet) {
+      lazy_tls->Set(nullptr);  // destroys *this; do not access members below
+      return;
+    }
+  } else {
+    // Other contexts still use the shared environment. Just unassign
+    // this context from the environment if it's not the primary context
+    // (the primary context must stay assigned because env->context()
+    // references it, and UvRunOnce enters that context scope).
+    if (context != env->context()) {
+      env->UnassignFromContext(context);
+    }
+    // If the destroyed context IS the primary context, we leave the env
+    // assigned to it. The env's PrincipalRealm holds a Global<Context>
+    // reference that keeps the V8 context alive even though Blink has
+    // torn down its side. This is safe because UvRunOnce only needs
+    // the V8 context scope, not Blink-side objects.
   }
-
-  // Destroying the node environment will also run the uv loop.
-  {
-    util::ExplicitMicrotasksScope microtasks_scope(
-        context->GetMicrotaskQueue());
-    base::EraseIf(environments_,
-                  [env](auto const& item) { return item.get() == env; });
-  }
-
-  // ElectronBindings is tracking node environments.
-  electron_bindings_->EnvironmentDestroyed(env);
-
-  if (lazy_tls->Get())
-    lazy_tls->Set(nullptr);
 }
 
 }  // namespace electron

shell/renderer/web_worker_observer.h

@@ -40,9 +40,17 @@ class WebWorkerObserver {
   void ContextWillDestroy(v8::Local<v8::Context> context);
 
  private:
+  // Full initialization for the first context on a thread.
+  void InitializeNewEnvironment(v8::Local<v8::Context> context);
+  // Share existing environment with a new context on a reused thread.
+  void ShareEnvironmentWithContext(v8::Local<v8::Context> context);
+
   std::unique_ptr<NodeBindings> node_bindings_;
   std::unique_ptr<ElectronBindings> electron_bindings_;
   base::flat_set<std::shared_ptr<node::Environment>> environments_;
+
+  // Number of active contexts using the environment on this thread.
+  size_t active_context_count_ = 0;
 };
 
 }  // namespace electron

spec/api-desktop-capturer-spec.ts

@@ -15,7 +15,7 @@ function getSourceTypes (): ('window' | 'screen')[] {
   return ['window', 'screen'];
 }
 
-ifdescribe(!process.arch.includes('arm') && process.platform !== 'win32')('desktopCapturer', () => {
+describe('desktopCapturer', () => {
   it('should return a non-empty array of sources', async () => {
     const sources = await desktopCapturer.getSources({ types: getSourceTypes() });
     expect(sources).to.be.an('array').that.is.not.empty();
@@ -254,4 +254,61 @@ ifdescribe(!process.arch.includes('arm') && process.platform !== 'win32')('deskt
       destroyWindows();
     }
   });
+
+  // Linux doesn't return any window sources.
+  ifdescribe(process.platform !== 'linux')('fetchWindowIcons', function () {
+    // Tests are sequentially dependent
+    this.bail(true);
+    let w: BrowserWindow;
+    let testSource: Electron.DesktopCapturerSource | undefined;
+    let appIcon: Electron.NativeImage | undefined;
+
+    before(async () => {
+      w = new BrowserWindow({
+        width: 200,
+        height: 200,
+        show: true,
+        title: 'desktop-capturer-test-window'
+      });
+      await w.loadURL('about:blank');
+      const sources = await desktopCapturer.getSources({
+        types: ['window'],
+        fetchWindowIcons: true
+      });
+      testSource = sources.find(
+        s => s.name === 'desktop-capturer-test-window'
+      );
+      appIcon = testSource?.appIcon;
+    });
+
+    after(() => {
+      if (w) w.destroy();
+    });
+
+    it('should find the test window in the list of captured sources', () => {
+      expect(testSource, `The ${w.getTitle()} window was not found by desktopCapturer`).to.exist();
+    });
+
+    it('should return a non-null appIcon for the captured window', () => {
+      expect(appIcon, 'appIcon property is null or undefined').to.exist();
+    });
+
+    it('should return an appIcon that is not an empty image', () => {
+      expect(appIcon?.isEmpty()).to.be.false();
+    });
+
+    it('should return an appIcon that encodes to a valid PNG data URL', () => {
+      const url = appIcon?.toDataURL();
+      expect(url).to.be.a('string');
+      // This is header 'data:image/png;base64,' length;
+      expect(url?.length).to.be.greaterThan(22);
+      expect(url?.startsWith('data:image/png;base64,')).to.be.true();
+    });
+
+    it('should return an appIcon with dimensions greater than 0x0 pixels', () => {
+      const { width, height } = appIcon?.getSize() || { width: 0, height: 0 };
+      expect(width).to.be.greaterThan(0);
+      expect(height).to.be.greaterThan(0);
+    });
+  });
 });

spec/chromium-spec.ts

@@ -1625,6 +1625,27 @@ describe('chromium features', () => {
       expect(data).to.equal('function function function function function');
     });
 
+    it('AudioWorklet keeps node integration across pooled worker threads', async () => {
+      // Regression test for https://github.com/electron/electron/issues/41263.
+      // Blink pools the AudioWorklet backing thread (Chromium CL:5270028) so
+      // the Nth+ AudioWorklet on a page reuses the same thread; the page
+      // creates several AudioWorklet contexts in sequence and asserts node
+      // integration is wired up in every one of them.
+      const w = new BrowserWindow({
+        show: false,
+        webPreferences: {
+          nodeIntegration: true,
+          nodeIntegrationInWorker: true,
+          contextIsolation: false
+        }
+      });
+
+      w.loadURL(`file://${fixturesPath}/pages/audio-worklet.html`);
+      const [, results] = await once(ipcMain, 'audio-worklet-result');
+      expect(results).to.be.an('array').with.length.greaterThan(0);
+      for (const r of results) expect(r).to.equal('ok');
+    });
+
     describe('SharedWorker', () => {
       it('can work', async () => {
         const w = new BrowserWindow({ show: false });

spec/fixtures/pages/audio-worklet.html

@@ -0,0 +1,44 @@
+<html>
+<body>
+<script type="text/javascript" charset="utf-8">
+  const { ipcRenderer } = require('electron');
+
+  // Create a number of AudioContext + AudioWorklet pairs in sequence so
+  // that Blink's WorkletThreadHolder pools and reuses the underlying
+  // worker thread (Chromium CL:5270028). For each context we ask the
+  // worklet to report whether `require` is a function and post that back
+  // via its MessagePort. The bug being guarded is that the Nth+ pooled
+  // worklet would silently lose its Node.js environment, so the test
+  // must run enough iterations to exercise thread reuse.
+  const NUM_CONTEXTS = 6;
+
+  async function runOne(index) {
+    const audioCtx = new AudioContext();
+    try {
+      await audioCtx.audioWorklet.addModule('../workers/audio_worklet_node.js');
+      const node = new AudioWorkletNode(audioCtx, 'node-integration-probe');
+      const reply = new Promise((resolve) => {
+        node.port.onmessage = (e) => resolve(e.data);
+      });
+      node.port.postMessage('probe');
+      node.connect(audioCtx.destination);
+      return await reply;
+    } finally {
+      await audioCtx.close();
+    }
+  }
+
+  (async () => {
+    const results = [];
+    for (let i = 0; i < NUM_CONTEXTS; i++) {
+      try {
+        results.push(await runOne(i));
+      } catch (err) {
+        results.push(`error: ${err && err.message ? err.message : err}`);
+      }
+    }
+    ipcRenderer.send('audio-worklet-result', results);
+  })();
+</script>
+</body>
+</html>

spec/fixtures/workers/audio_worklet_node.js

@@ -0,0 +1,28 @@
+// Reports whether the Node.js environment is wired up inside this
+// AudioWorklet's global scope. Used by spec/fixtures/pages/audio-worklet.html
+// to verify that nodeIntegrationInWorker keeps working when Blink reuses a
+// pooled worker thread for multiple AudioWorklet contexts.
+class NodeIntegrationProbeProcessor extends AudioWorkletProcessor {
+  constructor () {
+    super();
+    this.port.onmessage = () => {
+      let info;
+      try {
+        // require should be a function and `node:timers` should resolve.
+        const ok = typeof require === 'function' &&
+          typeof require('node:timers').setImmediate === 'function' &&
+          typeof process === 'object';
+        info = ok ? 'ok' : 'missing';
+      } catch (err) {
+        info = `throw: ${err && err.message ? err.message : err}`;
+      }
+      this.port.postMessage(info);
+    };
+  }
+
+  process () {
+    return true;
+  }
+}
+
+registerProcessor('node-integration-probe', NodeIntegrationProbeProcessor);

typings/internal-electron.d.ts

@@ -166,7 +166,6 @@ declare namespace Electron {
     commandsMap: Record<string, MenuItem>;
     groupsMap: Record<string, MenuItem[]>;
     getItemCount(): number;
-    getIndexOfCommandId(commandId: number): number;
     popupAt(window: BaseWindow, frame: WebFrameMain | undefined, x: number, y: number, positioning: number, sourceType: Required<Electron.PopupOptions>['sourceType'], callback: () => void): void;
     closePopupAt(id: number): void;
     setSublabel(index: number, label: string): void;
@@ -174,7 +173,6 @@ declare namespace Electron {
     setIcon(index: number, image: string | NativeImage): void;
     setRole(index: number, role: string): void;
     setCustomType(index: number, customType: string): void;
-    setBadge(index: number, badge: MenuItemBadge): void;
     insertItem(index: number, commandId: number, label: string): void;
     insertCheckItem(index: number, commandId: number, label: string): void;
     insertRadioItem(index: number, commandId: number, label: string, groupId: number): void;