diff --git a/DEPS b/DEPS
index 0f334e8..4a80940 100644
--- a/DEPS
+++ b/DEPS

@@ -318,7 +318,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling V8
   # and whatever else without interference from each other.
-  'v8_revision': 'ac29617dc7cd9f9a5e4c6f132c26277c4852c6c6',
+  'v8_revision': 'cbfc282edb990b16d1ec7f7f31b1603148be9d17',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling ANGLE
   # and whatever else without interference from each other.
@@ -389,7 +389,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling chromium_variations
   # and whatever else without interference from each other.
-  'chromium_variations_revision': '0a810b0e1d045c6ad20f63b3ff2d992f4238394e',
+  'chromium_variations_revision': 'e8462fa1881743917c3a5cfab581211defad39da',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling CrossBench
   # and whatever else without interference from each other.
@@ -405,7 +405,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling devtools-frontend
   # and whatever else without interference from each other.
-  'devtools_frontend_revision': '9df727893527f021532d052df359a741c7fe7c0c',
+  'devtools_frontend_revision': '4e41c1c367239f5d2aec4fe63b2600a0ecd38604',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling libprotobuf-mutator
   # and whatever else without interference from each other.
@@ -445,7 +445,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling feed
   # and whatever else without interference from each other.
-  'dawn_revision': '5b0d338a1e33424c341d811cc42718d147e7a0f3',
+  'dawn_revision': '5d3173ac9a2249dff582ed4f9ab6962e00737ea8',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling feed
   # and whatever else without interference from each other.
@@ -845,7 +845,7 @@
 
   'src/clank': {
     'url': Var('chrome_git') + '/clank/internal/apps.git' + '@' +
-    '119cbb42a2f9366f4c5edd6bbb401cef3c40a63f',
+    '7d2ace2d1f10eb333f695f18832d8083c2ff885f',
     'condition': 'checkout_android and checkout_src_internal',
   },
 
@@ -1051,7 +1051,7 @@
     'packages': [
       {
           'package': 'chromium/third_party/androidx',
-          'version': 'l1aQ3x4WHPee1WDaKNyiN3zopCdZq7O3SJL6AQdgleAC',
+          'version': 'bl8kJNxJrZ69JjDS2Jmlex7NRMWGrBoAZfrbs7U_GksC',
       },
     ],
     'condition': 'checkout_android',
@@ -1301,7 +1301,7 @@
     Var('chromium_git') + '/devtools/devtools-frontend' + '@' + Var('devtools_frontend_revision'),
 
   'src/third_party/devtools-frontend-internal': {
-      'url': Var('chrome_git') + '/devtools/devtools-internal.git' + '@' + '687558bb7ec6c7bfc732a54c884e6f7788c5ba53',
+      'url': Var('chrome_git') + '/devtools/devtools-internal.git' + '@' + '63bda74f4350a6a59e38983a14d35a6eece12805',
     'condition': 'checkout_src_internal',
   },
 
@@ -2098,7 +2098,7 @@
     'packages': [
       {
         'package': 'chromeos_internal/apps/help_app/app',
-        'version': 'jJuftiwnSsqxaOhsHl-BLAl66AFxrWKNbdiDAmBxKlUC',
+        'version': 'gEiAsr96TT9QM2IE0-34ZGeU6Nbu3cFAITDuWlcJErUC',
       },
     ],
     'condition': 'checkout_chromeos and checkout_src_internal',
@@ -2109,7 +2109,7 @@
     'packages': [
       {
         'package': 'chromeos_internal/apps/media_app/app',
-        'version': '6R0wmq0IPre8DD5soLPn6NqqGzb5o_n89vrkFYl_sAsC',
+        'version': 'nCS9qowrYZljzco4s3wL6-p8O-ZTylGZeYi9tmTcmbEC',
       },
     ],
     'condition': 'checkout_chromeos and checkout_src_internal',
@@ -2142,7 +2142,7 @@
     'packages': [
       {
         'package': 'chromeos_internal/apps/projector_app/app',
-        'version': 'FuR_sPYoyvglEYFOR-0DoQsMMkrlyPzV5Kjv3NgDzaIC',
+        'version': 'mAPcfvCOFi2zP9MHXaTMy2x1F8CWmfWi9WpnxfKMIAEC',
       },
     ],
     'condition': 'checkout_chromeos and checkout_src_internal',
@@ -4269,7 +4269,7 @@
 
   'src/ios_internal':  {
       'url': Var('chrome_git') + '/chrome/ios_internal.git' + '@' +
-        '88c25fe97419c9814b168f5b0b8d0fa3f8f85e9e',
+        '09f751a1a2dfd719ca4c2a41af3cab4e45c08969',
       'condition': 'checkout_ios and checkout_src_internal',
   },
 

diff --git a/ash/constants/ash_features.cc b/ash/constants/ash_features.cc
index 00ec849..0d5f7b7 100644
--- a/ash/constants/ash_features.cc
+++ b/ash/constants/ash_features.cc

@@ -890,7 +890,7 @@
 // find some issue with the policy processing.
 BASE_FEATURE(kEphemeralNetworkPoliciesEnabledPolicy,
              "EphemeralNetworkPoliciesEnabledPolicy",
-             base::FEATURE_DISABLED_BY_DEFAULT);
+             base::FEATURE_ENABLED_BY_DEFAULT);
 
 // Enables Device End Of Lifetime warning notifications.
 BASE_FEATURE(kEolWarningNotifications,

diff --git a/ash/webui/common/resources/network/network_config.html b/ash/webui/common/resources/network/network_config.html
index e1f23e0..ae29a89 100644
--- a/ash/webui/common/resources/network/network_config.html
+++ b/ash/webui/common/resources/network/network_config.html

@@ -264,13 +264,20 @@
   </template>
 
   <!-- Share (WiFi) -->
-  <template is="dom-if" if="[[shareIsVisible_(managedProperties_)]]"
-      restamp>
-    <network-config-toggle id="share" label="[[i18n('networkConfigShare')]]"
-        checked="{{shareNetwork_}}" on-change="onShareChanged_"
-        disabled="[[!shareIsEnabled_(configProperties_.*,
-                  eapProperties_.*, shareAllowEnable)]]">
-    </network-config-toggle>
+  <template is="dom-if" if="[[shareIsVisible_(managedProperties_, globalPolicy_)]]" restamp>
+    <!-- TODO: b/302726243 - Reuse just one network-config-toggle -->
+    <template is="dom-if" if="[[!networkIsEphemeral_(managedProperties_, globalPolicy_)]]" restamp>
+      <network-config-toggle id="share" label="[[i18n('networkConfigShare')]]"
+          checked="{{shareNetwork_}}" on-change="onShareChanged_"
+          disabled="[[!shareIsEnabled_(configProperties_.*,
+                    eapProperties_.*, shareAllowEnable)]]">
+      </network-config-toggle>
+    </template>
+    <template is="dom-if" if="[[networkIsEphemeral_(managedProperties_, globalPolicy_)]]" restamp>
+      <network-config-toggle id="shareEphemeralDisabled" label="[[i18n('networkConfigShare')]]"
+          property="{{shareNetworkEphemeralDisabled_}}">
+      </network-config-toggle>
+    </template>
   </template>
 
   <!-- AutoConnect (WiFi) -->

diff --git a/ash/webui/common/resources/network/network_config.js b/ash/webui/common/resources/network/network_config.js
index 19fa7b0..54d2a7b 100644
--- a/ash/webui/common/resources/network/network_config.js
+++ b/ash/webui/common/resources/network/network_config.js

@@ -264,6 +264,21 @@
     },
 
     /**
+     * This is a ManagedBoolean that represents a device-policy-enforced false
+     * value. It is used to present a policy-disabled toggle for "Share network"
+     * when user-created networks are ephemeral. It is never mutated.
+     * @private {!ManagedBoolean}
+     */
+    shareNetworkEphemeralDisabled_: {
+      type: Object,
+      value: {
+        activeValue: false,
+        policySource: PolicySource.kDevicePolicyEnforced,
+        policyValue: false,
+      },
+    },
+
+    /**
      * Whether the device should automatically connect to the network.
      * @private
      */
@@ -906,7 +921,7 @@
       return;
     }
     if (!this.shareIsVisible_()) {
-      this.shareNetwork_ = false;
+      this.shareNetwork_ = this.shareDefault;
       return;
     }
     if (this.shareAllowEnable) {
@@ -1826,6 +1841,27 @@
   },
 
   /**
+   * Returns true if the network configured by this UI element is ephemeral
+   * according to enterprise policy.
+   * @return {boolean}
+   * @private
+   */
+  networkIsEphemeral_() {
+    if (!loadTimeData.getBoolean('ephemeralNetworkPoliciesEnabled')) {
+      return false;
+    }
+    if (!this.globalPolicy_ ||
+        !this.globalPolicy_.userCreatedNetworkConfigurationsAreEphemeral) {
+      return false;
+    }
+    if (!this.managedProperties_) {
+      return false;
+    }
+    // Only user-created networks are ephemeral with this policy.
+    return this.managedProperties_.source === OncSource.kNone;
+  },
+
+  /**
    * @return {boolean}
    * @private
    */

diff --git a/build/fuchsia/linux_internal.sdk.sha1 b/build/fuchsia/linux_internal.sdk.sha1
index 404a62f..e994746 100644
--- a/build/fuchsia/linux_internal.sdk.sha1
+++ b/build/fuchsia/linux_internal.sdk.sha1

@@ -1 +1 @@
-15.20230923.3.1
+15.20231001.0.1

diff --git a/chrome/VERSION b/chrome/VERSION
index 33e94ed..3dfa97f 100644
--- a/chrome/VERSION
+++ b/chrome/VERSION

@@ -1,4 +1,4 @@
 MAJOR=119
 MINOR=0
-BUILD=6041
+BUILD=6043
 PATCH=0

diff --git a/chrome/android/junit/src/org/chromium/chrome/browser/download/service/DownloadBackgroundTaskTest.java b/chrome/android/junit/src/org/chromium/chrome/browser/download/service/DownloadBackgroundTaskTest.java
index dfe035a..41cc95b 100644
--- a/chrome/android/junit/src/org/chromium/chrome/browser/download/service/DownloadBackgroundTaskTest.java
+++ b/chrome/android/junit/src/org/chromium/chrome/browser/download/service/DownloadBackgroundTaskTest.java

@@ -35,6 +35,7 @@
 import org.chromium.chrome.browser.flags.ChromeFeatureList;
 import org.chromium.chrome.browser.profiles.ProfileKey;
 import org.chromium.chrome.test.util.browser.Features;
+import org.chromium.chrome.test.util.browser.Features.DisableFeatures;
 import org.chromium.chrome.test.util.browser.Features.EnableFeatures;
 import org.chromium.components.background_task_scheduler.BackgroundTask.TaskFinishedCallback;
 import org.chromium.components.background_task_scheduler.BackgroundTaskScheduler;
@@ -186,13 +187,12 @@
     }
     @Test
     @Feature({"Download"})
+    @DisableFeatures(ChromeFeatureList.DOWNLOADS_MIGRATE_TO_JOBS_API)
     public void testIsUserInitiatedJobForDisabledFeature() {
-        // TODO(crbug.com/1487364): This should use
-        // @DisableFeatures(ChromeFeatureList.DOWNLOADS_MIGRATE_TO_JOBS_API).
         DownloadUtils.setMinSdkVersionForUserInitiatedJobsForTesting(33);
-        Assert.assertTrue(DownloadUtils.isUserInitiatedJob(
+        Assert.assertFalse(DownloadUtils.isUserInitiatedJob(
                 TaskIds.DOWNLOAD_AUTO_RESUMPTION_UNMETERED_JOB_ID));
-        Assert.assertTrue(DownloadUtils.isUserInitiatedJob(
+        Assert.assertFalse(DownloadUtils.isUserInitiatedJob(
                 TaskIds.DOWNLOAD_AUTO_RESUMPTION_ANY_NETWORK_JOB_ID));
         Assert.assertFalse(
                 DownloadUtils.isUserInitiatedJob(TaskIds.DOWNLOAD_AUTO_RESUMPTION_JOB_ID));

diff --git a/chrome/browser/ash/policy/networking/network_policy_application_browsertest.cc b/chrome/browser/ash/policy/networking/network_policy_application_browsertest.cc
index c77a678..fd820fc 100644
--- a/chrome/browser/ash/policy/networking/network_policy_application_browsertest.cc
+++ b/chrome/browser/ash/policy/networking/network_policy_application_browsertest.cc

@@ -34,6 +34,7 @@
 #include "chromeos/ash/components/dbus/shill/shill_profile_client.h"
 #include "chromeos/ash/components/dbus/shill/shill_property_changed_observer.h"
 #include "chromeos/ash/components/dbus/shill/shill_service_client.h"
+#include "chromeos/ash/components/install_attributes/stub_install_attributes.h"
 #include "chromeos/ash/components/network/managed_network_configuration_handler.h"
 #include "chromeos/ash/components/network/network_cert_loader.h"
 #include "chromeos/ash/components/network/network_handler.h"
@@ -88,6 +89,9 @@
 
 constexpr char kUserIdentity[] = "user_identity";
 
+constexpr char kTestDomain[] = "test_domain";
+constexpr char kTestDeviceId[] = "test_device_id";
+
 constexpr char kOncRecommendedFieldsWorkaroundActionHistogram[] =
     "Network.Ethernet.Policy.OncRecommendedFieldsWorkaroundAction";
 
@@ -437,6 +441,7 @@
 class NetworkPolicyApplicationTest : public ash::LoginManagerTest {
  public:
   NetworkPolicyApplicationTest() : LoginManagerTest() {
+    MarkEnterpriseEnrolled();
     login_mixin_.AppendRegularUsers(1);
     test_account_id_ = login_mixin_.users()[0].account_id;
   }
@@ -502,6 +507,10 @@
     LoginManagerTest::TearDownOnMainThread();
   }
 
+  void MarkEnterpriseEnrolled() {
+    stub_install_attributes_.Get()->SetCloudManaged(kTestDomain, kTestDeviceId);
+  }
+
   // Sets the DeviceEphemeralNetworkPoliciesEnabled policy to `value`.
   void SetDeviceEphemeralNetworkPoliciesEnabledPolicy(bool value) {
     current_policy_.Set(key::kDeviceEphemeralNetworkPoliciesEnabled,
@@ -805,6 +814,8 @@
           DanglingUntriaged | ExperimentalAsh>
       shill_device_client_test_ = nullptr;
 
+  ash::ScopedStubInstallAttributes stub_install_attributes_;
+
   AccountId test_account_id_;
 
   std::unique_ptr<ash::network_config::CrosNetworkConfig> cros_network_config_;
@@ -875,6 +886,22 @@
   base::test::ScopedFeatureList scoped_feature_list_;
 };
 
+// A variant of NetworkPolicyApplicationTest which enables the
+// EphemeralNetworkPolicies feature and the device is not enterprise enrolled at
+// startup.
+class NetworkPolicyApplicationEphemeralActionsEnabledUnenrolledTest
+    : public NetworkPolicyApplicationTest {
+ public:
+  NetworkPolicyApplicationEphemeralActionsEnabledUnenrolledTest() {
+    scoped_feature_list_.InitAndEnableFeature(
+        ash::features::kEphemeralNetworkPolicies);
+    stub_install_attributes_.Get()->Clear();
+  }
+
+ private:
+  base::test::ScopedFeatureList scoped_feature_list_;
+};
+
 // A variant of NetworkPolicyApplicationTest which disables the
 // EphemeralNetworkPolicies and EphemeralNetworkPoliciesEnabledPolicy feature.
 class NetworkPolicyApplicationEphemeralActionsKillSwitchTest
@@ -2715,6 +2742,63 @@
   }
 }
 
+IN_PROC_BROWSER_TEST_F(
+    NetworkPolicyApplicationEphemeralActionsEnabledUnenrolledTest,
+    EphemeralActions_NoWipeOnEnterpriseEnrollment) {
+  constexpr char kGuidWifi1[] = "guid_wifi_1";
+  AddSharedDevicePolicyMschapv2Service(kServiceWifi1, kGuidWifi1, "wifi1",
+                                       kUserIdentity);
+  AddPskWifiService(kServiceWifi2, "unmanaged_wifi2_guid", "UnmanagedWifi2",
+                    shill::kStateIdle);
+  shill_profile_client_test_->AddService(kSharedProfilePath, kServiceWifi2);
+
+  // The device changes state to enterprise-enrolled here, simulating enterprise
+  // enrollment with incoming device policy.
+  MarkEnterpriseEnrolled();
+  const std::string kDeviceONC = base::StringPrintf(
+      R"(
+      {
+        "GlobalNetworkConfiguration": {
+          "RecommendedValuesAreEphemeral": true,
+          "UserCreatedNetworkConfigurationsAreEphemeral": true
+        },
+        "NetworkConfigurations": [
+          {
+            "GUID": "%s",
+            "Type": "WiFi",
+            "Name": "Managed wifi1",
+            "WiFi": {
+              "HexSSID": "7769666931", // "wifi1"
+              "SSID": "wifi1",
+              "Security": "WPA-EAP",
+              "EAP": {
+                "Outer": "PEAP",
+                "Inner": "MSCHAPv2",
+                "SaveCredentials": true,
+                "Recommended": ["Identity", "Password"]
+              }
+            }
+          }
+        ],
+        "Type": "UnencryptedConfiguration"
+      })",
+      kGuidWifi1);
+  SetDeviceOpenNetworkConfiguration(kDeviceONC,
+                                    /*wait_applied=*/true);
+
+  // Verify that the unmanaged wifi service has not been wiped.
+  EXPECT_TRUE(shill_profile_client_test_->HasService(kServiceWifi2));
+
+  // Simulate that the device goes to sleep and wakes up, and check that the
+  // unmanaged wifi gets wiped then.
+  ScopedNetworkPolicyApplicationObserver network_policy_application_observer;
+  chromeos::FakePowerManagerClient::Get()->SendSuspendDone(base::Minutes(10));
+  network_policy_application_observer.WaitPoliciesApplied(
+      /*userhash=*/std::string());
+
+  EXPECT_FALSE(shill_profile_client_test_->HasService(kServiceWifi2));
+}
+
 IN_PROC_BROWSER_TEST_F(NetworkPolicyApplicationEphemeralActionsDisabledTest,
                        EphemeralActions_ActiveByPolicy) {
   constexpr char kGuidWifi1[] = "guid_wifi_1";

diff --git a/chrome/browser/media/webrtc/chrome_screen_enumerator.cc b/chrome/browser/media/webrtc/chrome_screen_enumerator.cc
index f0d57cd..ceeb25b1 100644
--- a/chrome/browser/media/webrtc/chrome_screen_enumerator.cc
+++ b/chrome/browser/media/webrtc/chrome_screen_enumerator.cc

@@ -141,7 +141,6 @@
     blink::mojom::MediaStreamType stream_type,
     ScreensCallback screens_callback) const {
   DCHECK_CURRENTLY_ON(content::BrowserThread::IO);
-  DCHECK(base::FeatureList::IsEnabled(blink::features::kGetAllScreensMedia));
 
 #if BUILDFLAG(IS_CHROMEOS) || BUILDFLAG(IS_LINUX)
   content::GetUIThreadTaskRunner({})->PostTaskAndReplyWithResult(

diff --git a/chrome/browser/metrics/chrome_metrics_service_accessor.h b/chrome/browser/metrics/chrome_metrics_service_accessor.h
index d4ae837..f885d4e 100644
--- a/chrome/browser/metrics/chrome_metrics_service_accessor.h
+++ b/chrome/browser/metrics/chrome_metrics_service_accessor.h

@@ -97,6 +97,10 @@
 }  // namespace settings
 }  // namespace ash
 
+namespace tpcd::experiment {
+class ExperimentManagerImpl;
+}
+
 // This class limits and documents access to metrics service helper methods.
 // Since these methods are private, each user has to be explicitly declared
 // as a 'friend' below.
@@ -156,6 +160,7 @@
   friend class feed::WebFeedSubscriptionCoordinator;
   friend class HttpsFirstModeService;
   friend class ash::DemoSession;
+  friend class tpcd::experiment::ExperimentManagerImpl;
 
 #if BUILDFLAG(IS_CHROMEOS_ASH)
   friend class ChromeCameraAppUIDelegate;

diff --git a/chrome/browser/resources/ash/settings/os_a11y_page/select_to_speak_subpage.html b/chrome/browser/resources/ash/settings/os_a11y_page/select_to_speak_subpage.html
index 7ec65ed..6ce4912 100644
--- a/chrome/browser/resources/ash/settings/os_a11y_page/select_to_speak_subpage.html
+++ b/chrome/browser/resources/ash/settings/os_a11y_page/select_to_speak_subpage.html

@@ -176,7 +176,7 @@
       pref="[[enhancedNetworkVoicesVirtualPref_]]"
       label="$i18n{selectToSpeakOptionsEnhancedNetworkVoicesDescription}"
       sub-label="$i18n{selectToSpeakOptionsEnhancedNetworkVoicesSubtitle}"
-      learn-more-url="$i18n{selectToSpeakLearnMoreUrl}"
+      learn-more-url="[[selectToSpeakLearnMoreUrl_]]"
       on-settings-boolean-control-change="onEnhancedNetworkVoicesToggleChanged_"
       deep-link-focus-id$="[[Setting.kSelectToSpeakEnhancedNetworkVoices]]"
       disabled="[[prefs.settings.a11y.select_to_speak_voice_switching.value]]"

diff --git a/chrome/browser/resources/ash/settings/os_a11y_page/select_to_speak_subpage.ts b/chrome/browser/resources/ash/settings/os_a11y_page/select_to_speak_subpage.ts
index b43a7bec..1820d93 100644
--- a/chrome/browser/resources/ash/settings/os_a11y_page/select_to_speak_subpage.ts
+++ b/chrome/browser/resources/ash/settings/os_a11y_page/select_to_speak_subpage.ts

@@ -204,6 +204,15 @@
         },
       },
 
+      selectToSpeakLearnMoreUrl_: {
+        type: String,
+        value() {
+          return loadTimeData.getBoolean('isKioskModeActive') ?
+              '' :
+              loadTimeData.getString('selectToSpeakLearnMoreUrl');
+        },
+      },
+
       /**
        * Used by DeepLinkingMixin to focus this page's deep links.
        */
@@ -239,6 +248,7 @@
   private localVoicesMenuOptions_: DropdownMenuOptionList;
   private networkVoicesMenuOptions_: DropdownMenuOptionList;
   private voicePreviewText_: string;
+  private selectToSpeakLearnMoreUrl_: string;
   private enhancedNetworkVoicePreviewText_: string;
   private appLocale_ = '';
   private selectToSpeakBrowserProxy_: SelectToSpeakSubpageBrowserProxy;

diff --git a/chrome/browser/tpcd/experiment/experiment_manager_impl.cc b/chrome/browser/tpcd/experiment/experiment_manager_impl.cc
index 0d61bbb..987861f 100644
--- a/chrome/browser/tpcd/experiment/experiment_manager_impl.cc
+++ b/chrome/browser/tpcd/experiment/experiment_manager_impl.cc

@@ -4,6 +4,7 @@
 
 #include "chrome/browser/tpcd/experiment/experiment_manager_impl.h"
 
+#include <string>
 #include <utility>
 
 #include "base/check.h"
@@ -16,17 +17,25 @@
 #include "base/sequence_checker.h"
 #include "base/task/single_thread_task_runner.h"
 #include "chrome/browser/browser_process.h"
+#include "chrome/browser/metrics/chrome_metrics_service_accessor.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/tpcd/experiment/tpcd_experiment_features.h"
 #include "chrome/browser/tpcd/experiment/tpcd_pref_names.h"
 #include "chrome/browser/tpcd/experiment/tpcd_utils.h"
 #include "components/metrics/metrics_pref_names.h"
 #include "components/prefs/pref_service.h"
+#include "components/variations/synthetic_trials.h"
 #include "content/public/common/content_features.h"
 #include "third_party/abseil-cpp/absl/types/optional.h"
 
 namespace tpcd::experiment {
 
+// TODO(b/302798031): This flag is needed to deflake
+// ExperimentManagerImplSyntheticTrialTest on CQ. Remove once test is fixed.
+const base::FeatureParam<bool> kForceProfilesEligibleForTesting{
+    &features::kCookieDeprecationFacilitatedTesting, "force_profiles_eligible",
+    false};
+
 // static
 ExperimentManagerImpl* ExperimentManagerImpl::GetForProfile(Profile* profile) {
   if (!base::FeatureList::IsEnabled(
@@ -52,11 +61,6 @@
   CHECK(base::FeatureList::IsEnabled(
       features::kCookieDeprecationFacilitatedTesting));
 
-  // If in force eligible mode, there's no work for the manager to do.
-  if (kForceEligibleForTesting.Get()) {
-    return;
-  }
-
   PrefService* local_state = g_browser_process->local_state();
   CHECK(local_state);
 
@@ -68,9 +72,10 @@
     local_state->ClearPref(prefs::kTPCDExperimentClientState);
   }
 
-  // If client eligibility is already known, there's no work for the manager to
-  // do.
+  // If client eligibility is already known, do not recompute it.
   if (IsClientEligible().has_value()) {
+    // The user must be re-registered to the synthetic trial on restart.
+    UpdateSyntheticTrialRegistration();
     return;
   }
 
@@ -101,23 +106,46 @@
 
   // Wait to run callback when decision is made in
   // `CaptureEligibilityInLocalStatePref`
-  client_is_eligible_ = client_is_eligible_ && is_eligible;
+  if (!kForceProfilesEligibleForTesting.Get()) {
+    client_is_eligible_ = client_is_eligible_ && is_eligible;
+  }
   callbacks_.push_back(std::move(on_eligibility_decision_callback));
 }
 
 void ExperimentManagerImpl::CaptureEligibilityInLocalStatePref() {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+
+  // Update kTPCDExperimentClientState in the local state prefs.
   g_browser_process->local_state()->SetInteger(
       prefs::kTPCDExperimentClientState,
       client_is_eligible_
           ? static_cast<int>(utils::ExperimentState::kEligible)
           : static_cast<int>(utils::ExperimentState::kIneligible));
+
+  // Register or unregister for the synthetic trial based on the new
+  // eligibility local state pref.
+  UpdateSyntheticTrialRegistration();
+
+  // Run the EligibilityDecisionCallback for every profile that marked its
+  // eligibility.
   for (auto& callback : callbacks_) {
     std::move(callback).Run(client_is_eligible_);
   }
   callbacks_.clear();
 }
 
+void ExperimentManagerImpl::UpdateSyntheticTrialRegistration() {
+  absl::optional<bool> is_client_eligible = IsClientEligible();
+  CHECK(is_client_eligible.has_value());
+
+  std::string group_name = *is_client_eligible
+                               ? features::kCookieDeprecationLabel.Get()
+                               : kSyntheticTrialInvalidGroupName;
+  ChromeMetricsServiceAccessor::RegisterSyntheticFieldTrial(
+      kSyntheticTrialName, group_name,
+      variations::SyntheticTrialAnnotationMode::kCurrentLog);
+}
+
 absl::optional<bool> ExperimentManagerImpl::IsClientEligible() const {
   if (kForceEligibleForTesting.Get()) {
     return true;

diff --git a/chrome/browser/tpcd/experiment/experiment_manager_impl.h b/chrome/browser/tpcd/experiment/experiment_manager_impl.h
index 501aea9..5aec1f4 100644
--- a/chrome/browser/tpcd/experiment/experiment_manager_impl.h
+++ b/chrome/browser/tpcd/experiment/experiment_manager_impl.h

@@ -18,6 +18,9 @@
 
 namespace tpcd::experiment {
 
+inline constexpr char kSyntheticTrialName[] = "ChromeTPCDExperiment";
+inline constexpr char kSyntheticTrialInvalidGroupName[] = "invalid";
+
 // Can only be used on the main thread.
 class ExperimentManagerImpl : public ExperimentManager {
  public:
@@ -40,12 +43,20 @@
 
  private:
   friend base::NoDestructor<ExperimentManagerImpl>;
+
   bool client_is_eligible_ GUARDED_BY_CONTEXT(sequence_checker_) = true;
   std::vector<EligibilityDecisionCallback> callbacks_
       GUARDED_BY_CONTEXT(sequence_checker_);
   SEQUENCE_CHECKER(sequence_checker_);
 
+  // Commit the computed eligibility to the local state pref, once the timer
+  // expires. This function is called at most once per global runtime - never if
+  // the local state pref already exists on startup.
   void CaptureEligibilityInLocalStatePref();
+  // Register for the synthetic trial (or unregister using the "invalid" group).
+  // Uses IsClientEligible() to determine eligibility, so the local state pref
+  // must be set when this function is called.
+  void UpdateSyntheticTrialRegistration();
 };
 
 }  // namespace tpcd::experiment

diff --git a/chrome/browser/tpcd/experiment/experiment_manager_impl_browsertest.cc b/chrome/browser/tpcd/experiment/experiment_manager_impl_browsertest.cc
new file mode 100644
index 0000000..db93b01
--- /dev/null
+++ b/chrome/browser/tpcd/experiment/experiment_manager_impl_browsertest.cc

@@ -0,0 +1,177 @@
+// Copyright 2023 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/tpcd/experiment/experiment_manager_impl.h"
+
+#include <string>
+#include <vector>
+
+#include "base/location.h"
+#include "base/run_loop.h"
+#include "base/task/single_thread_task_runner.h"
+#include "base/task/task_runner.h"
+#include "base/test/scoped_feature_list.h"
+#include "base/threading/platform_thread.h"
+#include "base/time/time.h"
+#include "build/build_config.h"
+#include "build/buildflag.h"
+#include "chrome/browser/browser_process.h"
+#include "chrome/browser/profiles/profile.h"
+#include "chrome/browser/tpcd/experiment/tpcd_experiment_features.h"
+#include "chrome/browser/tpcd/experiment/tpcd_pref_names.h"
+#include "chrome/browser/tpcd/experiment/tpcd_utils.h"
+#include "chrome/browser/ui/browser.h"
+#include "chrome/test/base/in_process_browser_test.h"
+#include "components/metrics/metrics_pref_names.h"
+#include "components/metrics/metrics_service.h"
+#include "components/prefs/pref_service.h"
+#include "components/privacy_sandbox/privacy_sandbox_prefs.h"
+#include "components/variations/active_field_trials.h"
+#include "components/variations/hashing.h"
+#include "components/variations/synthetic_trial_registry.h"
+#include "components/variations/synthetic_trials.h"
+#include "content/public/common/content_features.h"
+#include "content/public/test/browser_test.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace tpcd::experiment {
+
+using ::variations::HashName;
+
+struct SyntheticTrialTestCase {
+  utils::ExperimentState prev_state;
+  bool new_state_eligible;
+  std::string expected_group_name;
+};
+
+constexpr char kEligibleGroupName[] = "eligible";
+
+class ExperimentManagerImplBrowserTest : public InProcessBrowserTest {
+ public:
+  explicit ExperimentManagerImplBrowserTest(
+      bool force_profiles_eligible_chromeos = false) {
+    // Force profile eligibility on ChromeOS. There is a flaky issue where
+    // `SetClientEligibility` is sometimes called twice, the second time with an
+    // ineligible profile even if the first was eligible.
+#if !BUILDFLAG(IS_CHROMEOS)
+    force_profiles_eligible_chromeos = false;
+#endif  // !BUILDFLAG(IS_ANDROID)
+    std::string force_profiles_eligible_str =
+        force_profiles_eligible_chromeos ? "true" : "false";
+
+    feature_list_.InitAndEnableFeatureWithParameters(
+        features::kCookieDeprecationFacilitatedTesting,
+        {{"disable_3p_cookies", "true"},
+         {"use_profile_filtering", "true"},
+         {"label", kEligibleGroupName},
+         {"force_profiles_eligible", force_profiles_eligible_str}});
+  }
+
+  void Wait() {
+    base::RunLoop run_loop;
+    base::SingleThreadTaskRunner::GetCurrentDefault()->PostDelayedTask(
+        FROM_HERE, run_loop.QuitClosure(), kDecisionDelayTime.Get());
+    run_loop.Run();
+  }
+
+ private:
+  base::test::ScopedFeatureList feature_list_;
+};
+
+// Android does not support PRE_ tests.
+#if !BUILDFLAG(IS_ANDROID)
+class ExperimentManagerImplSyntheticTrialTest
+    : public ExperimentManagerImplBrowserTest,
+      public testing::WithParamInterface<SyntheticTrialTestCase> {
+ public:
+  ExperimentManagerImplSyntheticTrialTest()
+      : ExperimentManagerImplBrowserTest(
+            /*force_profiles_eligible_chromeos=*/GetParam()
+                .new_state_eligible) {}
+};
+
+IN_PROC_BROWSER_TEST_P(ExperimentManagerImplSyntheticTrialTest,
+                       PRE_RegistersSyntheticTrial) {
+  Wait();
+
+  // Set up the previous state in the local state prefs.
+  g_browser_process->local_state()->SetInteger(
+      prefs::kTPCDExperimentClientState,
+      static_cast<int>(GetParam().prev_state));
+
+  // Set up preconditions for the profile to be eligible.
+  if (GetParam().new_state_eligible) {
+    browser()->profile()->GetPrefs()->SetBoolean(
+        ::prefs::kPrivacySandboxM1RowNoticeAcknowledged,
+        GetParam().new_state_eligible);
+    g_browser_process->local_state()->SetInt64(
+        metrics::prefs::kInstallDate,
+        (base::Time::Now() - base::Days(31)).ToTimeT());
+  }
+}
+
+IN_PROC_BROWSER_TEST_P(ExperimentManagerImplSyntheticTrialTest,
+                       RegistersSyntheticTrial) {
+  // Delay to make sure `CaptureEligibilityInLocalStatePref` has run.
+  Wait();
+
+  // Verify that the user has been registered with the correct synthetic
+  // trial group.
+  std::vector<variations::ActiveGroupId> synthetic_trials;
+  g_browser_process->metrics_service()
+      ->GetSyntheticTrialRegistry()
+      ->GetSyntheticFieldTrialsOlderThan(base::TimeTicks::Now(),
+                                         &synthetic_trials);
+  uint32_t group_name_hash = 0u;
+  for (const auto& trial : synthetic_trials) {
+    if (trial.name == HashName(kSyntheticTrialName)) {
+      group_name_hash = trial.group;
+    }
+  }
+  ASSERT_NE(group_name_hash, 0u);
+  EXPECT_EQ(group_name_hash, HashName(GetParam().expected_group_name));
+}
+
+// Test every combination of (initial_state, new_state). If the prev_state is
+// set, use that eligibility and ignore the new one. If the prev_state is
+// unknown, use the new eligibility value.
+const SyntheticTrialTestCase kTestCases[] = {
+    {
+        .prev_state = utils::ExperimentState::kUnknownEligibility,
+        .new_state_eligible = false,
+        .expected_group_name = kSyntheticTrialInvalidGroupName,
+    },
+    {
+        .prev_state = utils::ExperimentState::kUnknownEligibility,
+        .new_state_eligible = true,
+        .expected_group_name = kEligibleGroupName,
+    },
+    {
+        .prev_state = utils::ExperimentState::kIneligible,
+        .new_state_eligible = false,
+        .expected_group_name = kSyntheticTrialInvalidGroupName,
+    },
+    {
+        .prev_state = utils::ExperimentState::kIneligible,
+        .new_state_eligible = true,
+        .expected_group_name = kSyntheticTrialInvalidGroupName,
+    },
+    {
+        .prev_state = utils::ExperimentState::kEligible,
+        .new_state_eligible = false,
+        .expected_group_name = kEligibleGroupName,
+    },
+    {
+        .prev_state = utils::ExperimentState::kEligible,
+        .new_state_eligible = true,
+        .expected_group_name = kEligibleGroupName,
+    },
+};
+
+INSTANTIATE_TEST_CASE_P(All,
+                        ExperimentManagerImplSyntheticTrialTest,
+                        testing::ValuesIn(kTestCases));
+#endif  // !BUILDFLAG(IS_ANDROID)
+
+}  // namespace tpcd::experiment

diff --git a/chrome/browser/tpcd/experiment/tpcd_experiment_features.cc b/chrome/browser/tpcd/experiment/tpcd_experiment_features.cc
index 61787494..fa7ada3 100644
--- a/chrome/browser/tpcd/experiment/tpcd_experiment_features.cc
+++ b/chrome/browser/tpcd/experiment/tpcd_experiment_features.cc

@@ -4,8 +4,6 @@
 
 #include "chrome/browser/tpcd/experiment/tpcd_experiment_features.h"
 
-#include <string>
-
 #include "base/metrics/field_trial_params.h"
 #include "base/time/time.h"
 #include "content/public/common/content_features.h"

diff --git a/chrome/build/android-arm32.pgo.txt b/chrome/build/android-arm32.pgo.txt
index c2f0f002..3623f73 100644
--- a/chrome/build/android-arm32.pgo.txt
+++ b/chrome/build/android-arm32.pgo.txt

@@ -1 +1 @@
-chrome-android32-main-1696073368-7b4ba6eed6bb4575327de51ebd7aa397b66c7384.profdata
+chrome-android32-main-1696183092-8f595a577bf2283e95b0c44612329401ef11659b.profdata

diff --git a/chrome/build/android-arm64.pgo.txt b/chrome/build/android-arm64.pgo.txt
index e2941606..9e90406 100644
--- a/chrome/build/android-arm64.pgo.txt
+++ b/chrome/build/android-arm64.pgo.txt

@@ -1 +1 @@
-chrome-android64-main-1696073368-f73bba6817a335cf78202c7457cd3554ce048b97.profdata
+chrome-android64-main-1696183092-920087c904b0e843faaae46943ef5c9e87c97979.profdata

diff --git a/chrome/build/lacros64.pgo.txt b/chrome/build/lacros64.pgo.txt
index 073588e..f5cf1d5 100644
--- a/chrome/build/lacros64.pgo.txt
+++ b/chrome/build/lacros64.pgo.txt

@@ -1 +1 @@
-chrome-chromeos-amd64-generic-main-1696075220-3b54077950fcaa9935f0604a387ce8c395c4e075.profdata
+chrome-chromeos-amd64-generic-main-1696160940-5fd8e4ad849535469666a908df1777e1b59b369e.profdata

diff --git a/chrome/build/linux.pgo.txt b/chrome/build/linux.pgo.txt
index 3f38023..f993fbc 100644
--- a/chrome/build/linux.pgo.txt
+++ b/chrome/build/linux.pgo.txt

@@ -1 +1 @@
-chrome-linux-main-1696073368-1e59bfa35a4571435d42939cc31c168896b39b9f.profdata
+chrome-linux-main-1696183092-0edbb677680afe003dbda60b68eebfda5d841328.profdata

diff --git a/chrome/build/mac-arm.pgo.txt b/chrome/build/mac-arm.pgo.txt
index 4b8918a..03843d9 100644
--- a/chrome/build/mac-arm.pgo.txt
+++ b/chrome/build/mac-arm.pgo.txt

@@ -1 +1 @@
-chrome-mac-arm-main-1696089552-464d2d67a0e5344733a313951b6a358fea1a3b3e.profdata
+chrome-mac-arm-main-1696190210-77149f85ec0851675dfb35c8e79800a8751a6347.profdata

diff --git a/chrome/build/mac.pgo.txt b/chrome/build/mac.pgo.txt
index 761cef2..ef79002 100644
--- a/chrome/build/mac.pgo.txt
+++ b/chrome/build/mac.pgo.txt

@@ -1 +1 @@
-chrome-mac-main-1696073368-19fca08667d3976727cb501b490532d7cf88f52d.profdata
+chrome-mac-main-1696183092-2bf9d1d533cf88e06a9cc1a3192983e886c71ef6.profdata

diff --git a/chrome/build/win-arm64.pgo.txt b/chrome/build/win-arm64.pgo.txt
index 51f86651..f69d33d 100644
--- a/chrome/build/win-arm64.pgo.txt
+++ b/chrome/build/win-arm64.pgo.txt

@@ -1 +1 @@
-chrome-win-arm64-main-1696073368-2f9ce8ee069a3846c6c590b325bacf60c1fd8b6b.profdata
+chrome-win-arm64-main-1696183092-dee634e72594ae7846ee5e44c905185ffcee0014.profdata

diff --git a/chrome/build/win32.pgo.txt b/chrome/build/win32.pgo.txt
index d88e76e..14912219 100644
--- a/chrome/build/win32.pgo.txt
+++ b/chrome/build/win32.pgo.txt

@@ -1 +1 @@
-chrome-win32-main-1696073368-98faf6cc618428c3e92553c5992d28e38da695cb.profdata
+chrome-win32-main-1696183092-5e378a727679363d937e948838ad6be84e598665.profdata

diff --git a/chrome/build/win64.pgo.txt b/chrome/build/win64.pgo.txt
index ca09d30f..1677db31 100644
--- a/chrome/build/win64.pgo.txt
+++ b/chrome/build/win64.pgo.txt

@@ -1 +1 @@
-chrome-win64-main-1696085292-2540968d144b60b2e49b7057696646466dc75cc2.profdata
+chrome-win64-main-1696183092-56426cda6ad7354a3881b200e4c1e3f16686ba5a.profdata

diff --git a/chrome/test/BUILD.gn b/chrome/test/BUILD.gn
index 1ea2068..3742394 100644
--- a/chrome/test/BUILD.gn
+++ b/chrome/test/BUILD.gn

@@ -2461,6 +2461,7 @@
       "../browser/themes/theme_service_browsertest.cc",
       "../browser/top_level_storage_access_api/request_storage_access_for_browsertest.cc",
       "../browser/tpcd/experiment/eligibility_service_browsertest.cc",
+      "../browser/tpcd/experiment/experiment_manager_impl_browsertest.cc",
       "../browser/tracing/chrome_tracing_delegate_browsertest.cc",
       "../browser/translate/language_detection_service_browsertest.cc",
       "../browser/translate/translate_frame_binder_browsertest.cc",

diff --git a/chrome/test/data/webui/cr_components/chromeos/network/network_config_test.js b/chrome/test/data/webui/cr_components/chromeos/network/network_config_test.js
index a3ba3c3d..14ddb59b 100644
--- a/chrome/test/data/webui/cr_components/chromeos/network/network_config_test.js
+++ b/chrome/test/data/webui/cr_components/chromeos/network/network_config_test.js

@@ -88,9 +88,9 @@
 
   function flushAsync() {
     flush();
-    return new Promise(resolve => {
-      networkConfig.async(resolve);
-    });
+
+    // Use setTimeout to wait for the next macrotask.
+    return new Promise(resolve => setTimeout(resolve));
   }
 
   /**
@@ -1101,6 +1101,14 @@
       networkConfig.shareDefault = false;
     }
 
+    async function setUserCreatedNetworkConfigurationsAreEphemeral() {
+      const globalPolicy = {
+        userCreatedNetworkConfigurationsAreEphemeral: true,
+      };
+      mojoApi_.setGlobalPolicy(globalPolicy);
+      await flushAsync();
+    }
+
     test('New Config: Login or guest', function() {
       // Insecure networks are always shared so test a secure config.
       setNetworkType(NetworkType.kWiFi, SecurityType.kWepPsk);
@@ -1114,6 +1122,54 @@
       });
     });
 
+    test(
+        'New Config: Login or guest ephemeral user network configs',
+        async function() {
+          loadTimeData.overrideValues({
+            'ephemeralNetworkPoliciesEnabled': true,
+          });
+
+          // Insecure networks are always shared so test a secure config.
+          setUserCreatedNetworkConfigurationsAreEphemeral();
+          setNetworkType(NetworkType.kWiFi, SecurityType.kWepPsk);
+          setLoginOrGuest();
+          initNetworkConfig();
+
+          await flushAsync();
+
+          assertFalse(!!networkConfig.$$('#share'));
+
+          const shareEphemeralDisabled =
+              networkConfig.$$('#shareEphemeralDisabled');
+          assertTrue(!!shareEphemeralDisabled);
+          assertFalse(shareEphemeralDisabled.checked);
+          assertTrue(!!shareEphemeralDisabled.shadowRoot.querySelector(
+              'cr-policy-network-indicator-mojo'));
+
+          // Still, as we're on the login screen, the network config should be
+          // persisted in the shared profile.
+          assertTrue(networkConfig.shareNetwork_);
+        });
+
+    test(
+        'New Config: Login or guest disabled ephemeral user network configs',
+        async function() {
+          loadTimeData.overrideValues({
+            'ephemeralNetworkPoliciesEnabled': false,
+          });
+
+          // Insecure networks are always shared so test a secure config.
+          setUserCreatedNetworkConfigurationsAreEphemeral();
+          setNetworkType(NetworkType.kWiFi, SecurityType.kWepPsk);
+          setLoginOrGuest();
+          initNetworkConfig();
+
+          await flushAsync();
+
+          assertTrue(!!networkConfig.$$('#share'));
+          assertFalse(!!networkConfig.$$('#shareEphemeralDisabled'));
+        });
+
     test('New Config: Kiosk', function() {
       // Insecure networks are always shared so test a secure config.
       setNetworkType(NetworkType.kWiFi, SecurityType.kWepPsk);
@@ -1151,6 +1207,56 @@
       });
     });
 
+    test('New Config: Authenticated, Secure, ephemeral', async function() {
+      loadTimeData.overrideValues({
+        'ephemeralNetworkPoliciesEnabled': true,
+      });
+      setUserCreatedNetworkConfigurationsAreEphemeral();
+      setNetworkType(NetworkType.kWiFi, SecurityType.kWepPsk);
+      setAuthenticated();
+      initNetworkConfig();
+
+      await flushAsync();
+
+      assertFalse(!!networkConfig.$$('#share'));
+
+      const shareEphemeralDisabled =
+          networkConfig.$$('#shareEphemeralDisabled');
+      assertTrue(!!shareEphemeralDisabled);
+      assertFalse(shareEphemeralDisabled.checked);
+      assertTrue(!!shareEphemeralDisabled.shadowRoot.querySelector(
+          'cr-policy-network-indicator-mojo'));
+
+      // When creating an secure wifi config in a user session, it should be
+      // persisted in the user's profile.
+      assertFalse(networkConfig.shareNetwork_);
+    });
+
+    test('New Config: Authenticated, Not secure, ephemeral', async function() {
+      loadTimeData.overrideValues({
+        'ephemeralNetworkPoliciesEnabled': true,
+      });
+      setUserCreatedNetworkConfigurationsAreEphemeral();
+      setNetworkType(NetworkType.kWiFi);
+      setAuthenticated();
+      initNetworkConfig();
+
+      await flushAsync();
+
+      assertFalse(!!networkConfig.$$('#share'));
+
+      const shareEphemeralDisabled =
+          networkConfig.$$('#shareEphemeralDisabled');
+      assertTrue(!!shareEphemeralDisabled);
+      assertFalse(shareEphemeralDisabled.checked);
+      assertTrue(!!shareEphemeralDisabled.shadowRoot.querySelector(
+          'cr-policy-network-indicator-mojo'));
+
+      // When creating an insecure wifi config in a user session, it is
+      // persisted in the shared profile by default.
+      assertTrue(networkConfig.shareNetwork_);
+    });
+
     test(
         'New Config: Authenticated, Not secure to secure to not secure',
         async function() {

diff --git a/chromeos/CHROMEOS_LKGM b/chromeos/CHROMEOS_LKGM
index 5d7bbbe..3f5223d 100644
--- a/chromeos/CHROMEOS_LKGM
+++ b/chromeos/CHROMEOS_LKGM

@@ -1 +1 @@
-15629.0.0
\ No newline at end of file
+15632.0.0
\ No newline at end of file

diff --git a/chromeos/ash/components/network/BUILD.gn b/chromeos/ash/components/network/BUILD.gn
index ad8258aa..fdf68d0 100644
--- a/chromeos/ash/components/network/BUILD.gn
+++ b/chromeos/ash/components/network/BUILD.gn

@@ -18,6 +18,7 @@
     "//chromeos/ash/components/dbus/hermes",
     "//chromeos/ash/components/dbus/shill",
     "//chromeos/ash/components/feature_usage",
+    "//chromeos/ash/components/install_attributes",
     "//chromeos/ash/components/login/login_state",
     "//chromeos/ash/components/network/metrics",
     "//chromeos/ash/components/network/onc",
@@ -29,6 +30,7 @@
     "//chromeos/dbus/common",
     "//chromeos/dbus/permission_broker",
     "//chromeos/dbus/power",
+    "//chromeos/dbus/power:power_manager_proto",
     "//chromeos/services/network_config/public/mojom",
     "//components/account_id",
     "//components/device_event_log",
@@ -228,6 +230,7 @@
     "//base",
     "//chromeos:test_utils",
     "//chromeos/ash/components/dbus/shill",
+    "//chromeos/ash/components/install_attributes:test_support",
     "//chromeos/components/onc:test_support",
     "//chromeos/services/network_config/public/mojom",
     "//components/onc",
@@ -301,6 +304,7 @@
     "//chromeos/components/onc:test_support",
     "//chromeos/dbus/permission_broker",
     "//chromeos/dbus/power",
+    "//chromeos/dbus/power:power_manager_proto",
     "//components/onc",
     "//components/prefs",
     "//components/prefs:test_support",

diff --git a/chromeos/ash/components/network/DEPS b/chromeos/ash/components/network/DEPS
index ddca732..fe964e0 100644
--- a/chromeos/ash/components/network/DEPS
+++ b/chromeos/ash/components/network/DEPS

@@ -5,6 +5,7 @@
   "+base",
   "+base/component_export.h",
   "+chromeos/ash/components/feature_usage",
+  "+chromeos/ash/components/install_attributes",
   "+chromeos/ash/components/login/login_state",
   "+chromeos/ash/components/dbus",
   "+chromeos/ash/services/hotspot_config/public",

diff --git a/chromeos/ash/components/network/ephemeral_network_configuration_handler.cc b/chromeos/ash/components/network/ephemeral_network_configuration_handler.cc
index d79deda..3eec580 100644
--- a/chromeos/ash/components/network/ephemeral_network_configuration_handler.cc
+++ b/chromeos/ash/components/network/ephemeral_network_configuration_handler.cc

@@ -13,13 +13,16 @@
 #include "chromeos/ash/components/network/network_policy_observer.h"
 #include "chromeos/ash/components/network/policy_util.h"
 #include "chromeos/dbus/power/power_manager_client.h"
+#include "chromeos/dbus/power_manager/idle.pb.h"
 
 namespace ash {
 
 EphemeralNetworkConfigurationHandler::EphemeralNetworkConfigurationHandler(
-    ManagedNetworkConfigurationHandler* managed_network_configuration_handler)
+    ManagedNetworkConfigurationHandler* managed_network_configuration_handler,
+    bool was_enterprise_managed_at_startup)
     : managed_network_configuration_handler_(
-          managed_network_configuration_handler) {
+          managed_network_configuration_handler),
+      was_enterprise_managed_at_startup_(was_enterprise_managed_at_startup) {
   DCHECK(policy_util::AreEphemeralNetworkPoliciesEnabled());
 
   CHECK(LoginState::IsInitialized());
@@ -86,14 +89,19 @@
   CHECK(power_manager_client);
   power_manager_client_observation_.Observe(power_manager_client);
 
-  // Trigger initial wiping of ephemeral network data if this is the first
-  // policy application where ephemeral actions should be active.
+  // Trigger initial wiping of ephemeral network data if the device was already
+  // enterprise-enrolled and this is the first policy application where
+  // ephemeral actions should be active.
+  //
+  // Wiping on enterprise enrollment is skipped to avoid a disruptive network
+  // change when enterprise enrollment is performed on a user-created network
+  // configuration.
   //
   // Note that if another one of the policies becomes active after this already
   // happened, its enforcement will not be re-triggered on the policy change but
   // only on the next regular trigger (ash-chrome start / wake up from sleep).
   // This could be changed in the future.
-  if (!has_applied_ephemeral_policies_) {
+  if (was_enterprise_managed_at_startup_ && !has_applied_ephemeral_policies_) {
     has_applied_ephemeral_policies_ = true;
     managed_network_configuration_handler_
         ->TriggerEphemeralNetworkConfigActions();
@@ -122,4 +130,17 @@
       ->TriggerEphemeralNetworkConfigActions();
 }
 
+void EphemeralNetworkConfigurationHandler::ScreenIdleStateChanged(
+    const power_manager::ScreenIdleState& screen_idle_state) {
+  if (!screen_idle_state.off()) {
+    return;
+  }
+  if (!active_) {
+    return;
+  }
+  has_applied_ephemeral_policies_ = true;
+  managed_network_configuration_handler_
+      ->TriggerEphemeralNetworkConfigActions();
+}
+
 }  // namespace ash

diff --git a/chromeos/ash/components/network/ephemeral_network_configuration_handler.h b/chromeos/ash/components/network/ephemeral_network_configuration_handler.h
index 0c8ddf8f..3aa4c79 100644
--- a/chromeos/ash/components/network/ephemeral_network_configuration_handler.h
+++ b/chromeos/ash/components/network/ephemeral_network_configuration_handler.h

@@ -15,8 +15,19 @@
 #include "chromeos/ash/components/network/network_policy_observer.h"
 #include "chromeos/dbus/power/power_manager_client.h"
 
+namespace power_manager {
+class ScreenIdleState;
+}  // namespace power_manager
+
 namespace ash {
 
+// Triggers ephemeral network configuration actions on the sign-in screen when
+// one of the ephemeral network policies is set to true and a one of the
+// following triggers happen:
+// - Initial policy application on startup IFF the device had already been
+//   enterprise enrolled,
+// - Device comes back from sleep,
+// - Screen is turned off due to inactivity.
 class COMPONENT_EXPORT(CHROMEOS_NETWORK) EphemeralNetworkConfigurationHandler
     : public LoginState::Observer,
       public NetworkPolicyObserver,
@@ -24,9 +35,11 @@
  public:
   // `managed_network_configuration_handler` must outlive the lifetime of this
   // object.
+  // `was_enterprise_managed_at_startup` should be true if the device was
+  // already enterprise-enrolled at ash-chrome startup time.
   explicit EphemeralNetworkConfigurationHandler(
-      ManagedNetworkConfigurationHandler*
-          managed_network_configuration_handler);
+      ManagedNetworkConfigurationHandler* managed_network_configuration_handler,
+      bool was_enterprise_managed_at_startup);
 
   ~EphemeralNetworkConfigurationHandler() override;
 
@@ -59,6 +72,8 @@
 
   // chromeos::PowerManagerClient::Observer:
   void SuspendDone(base::TimeDelta sleep_duration) override;
+  void ScreenIdleStateChanged(
+      const power_manager::ScreenIdleState& screen_idle_state) override;
 
   // Unowned.
   raw_ptr<ManagedNetworkConfigurationHandler>
@@ -73,6 +88,8 @@
                           chromeos::PowerManagerClient::Observer>
       power_manager_client_observation_{this};
 
+  const bool was_enterprise_managed_at_startup_;
+
   // This is true when any ephemeral network settings are active - i.e. the
   // device is not in a user session and one of the ephemeral network
   // configuration ONC policies is enabled.

diff --git a/chromeos/ash/components/network/ephemeral_network_configuration_handler_unittest.cc b/chromeos/ash/components/network/ephemeral_network_configuration_handler_unittest.cc
index e881ec0c..9cf3d5c 100644
--- a/chromeos/ash/components/network/ephemeral_network_configuration_handler_unittest.cc
+++ b/chromeos/ash/components/network/ephemeral_network_configuration_handler_unittest.cc

@@ -13,6 +13,7 @@
 #include "chromeos/ash/components/network/policy_util.h"
 #include "chromeos/dbus/power/fake_power_manager_client.h"
 #include "chromeos/dbus/power/power_manager_client.h"
+#include "chromeos/dbus/power_manager/idle.pb.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
@@ -41,6 +42,12 @@
       const EphemeralNetworkConfigurationHandlerTest&) = delete;
 
  protected:
+  void NotifyScreenIdleOffChanged(bool off) {
+    power_manager::ScreenIdleState proto;
+    proto.set_off(off);
+    fake_power_manager_client_.SendScreenIdleStateChanged(proto);
+  }
+
   MockManagedNetworkConfigurationHandler
       mock_managed_network_configuration_handler_;
   chromeos::FakePowerManagerClient fake_power_manager_client_;
@@ -65,7 +72,8 @@
 
   ephemeral_network_configuration_handler_ =
       std::make_unique<EphemeralNetworkConfigurationHandler>(
-          &mock_managed_network_configuration_handler_);
+          &mock_managed_network_configuration_handler_,
+          /*was_enterprise_managed_at_startup=*/true);
 
   testing::Mock::VerifyAndClearExpectations(
       &mock_managed_network_configuration_handler_);
@@ -96,7 +104,8 @@
 
   ephemeral_network_configuration_handler_ =
       std::make_unique<EphemeralNetworkConfigurationHandler>(
-          &mock_managed_network_configuration_handler_);
+          &mock_managed_network_configuration_handler_,
+          /*was_enterprise_managed_at_startup=*/true);
 
   // Apply policies enabling ephemeral network policy actions.
   EXPECT_CALL(mock_managed_network_configuration_handler_,
@@ -120,6 +129,50 @@
       /*userhash=*/std::string());
 }
 
+// If the device enterprise-enrolls on the sign-in screen, no ephemeral network
+// config actions are triggered even if the ephemeral network policies are
+// enabled according to the newly applied device policy.
+TEST_F(EphemeralNetworkConfigurationHandlerTest,
+       InitialPolicyChange_SignInScreen_Enrollment) {
+  LoginState::Get()->SetLoggedInState(LoginState::LOGGED_IN_NONE,
+                                      LoginState::LOGGED_IN_USER_NONE);
+
+  // At EphemeralNetworkConfigurationHandler construction time the policies have
+  // not been applied yet.
+  EXPECT_CALL(mock_managed_network_configuration_handler_,
+              RecommendedValuesAreEphemeral())
+      .WillRepeatedly(Return(false));
+
+  ephemeral_network_configuration_handler_ =
+      std::make_unique<EphemeralNetworkConfigurationHandler>(
+          &mock_managed_network_configuration_handler_,
+          /*was_enterprise_managed_at_startup=*/false);
+
+  EXPECT_CALL(mock_managed_network_configuration_handler_,
+              TriggerEphemeralNetworkConfigActions())
+      .Times(0);
+
+  // Mark as enterprise-enrolled and apply policies enabling ephemeral network
+  // policy actions.
+  EXPECT_CALL(mock_managed_network_configuration_handler_,
+              RecommendedValuesAreEphemeral())
+      .WillRepeatedly(Return(true));
+
+  ephemeral_network_configuration_handler_->TriggerPoliciesChangedForTesting(
+      /*userhash=*/std::string());
+
+  testing::Mock::VerifyAndClearExpectations(
+      &mock_managed_network_configuration_handler_);
+
+  // A follow-up policy change also doesn't trigger
+  // TriggerEphemeralNetworkConfigActions.
+  EXPECT_CALL(mock_managed_network_configuration_handler_,
+              TriggerEphemeralNetworkConfigActions())
+      .Times(0);
+  ephemeral_network_configuration_handler_->TriggerPoliciesChangedForTesting(
+      /*userhash=*/std::string());
+}
+
 // The device is not on the sign-in screen, so the
 // EphemeralNetworkConfigurationHandler does not triggrer
 // TriggerEphemeralNetworkConfigActions on network policy application.
@@ -136,7 +189,8 @@
 
   ephemeral_network_configuration_handler_ =
       std::make_unique<EphemeralNetworkConfigurationHandler>(
-          &mock_managed_network_configuration_handler_);
+          &mock_managed_network_configuration_handler_,
+          /*was_enterprise_managed_at_startup=*/true);
 
   EXPECT_CALL(mock_managed_network_configuration_handler_,
               RecommendedValuesAreEphemeral())
@@ -165,7 +219,8 @@
 
   ephemeral_network_configuration_handler_ =
       std::make_unique<EphemeralNetworkConfigurationHandler>(
-          &mock_managed_network_configuration_handler_);
+          &mock_managed_network_configuration_handler_,
+          /*was_enterprise_managed_at_startup=*/true);
 
   EXPECT_CALL(mock_managed_network_configuration_handler_,
               TriggerEphemeralNetworkConfigActions())
@@ -184,7 +239,8 @@
 
   ephemeral_network_configuration_handler_ =
       std::make_unique<EphemeralNetworkConfigurationHandler>(
-          &mock_managed_network_configuration_handler_);
+          &mock_managed_network_configuration_handler_,
+          /*was_enterprise_managed_at_startup=*/true);
 
   EXPECT_CALL(mock_managed_network_configuration_handler_,
               RecommendedValuesAreEphemeral())
@@ -230,7 +286,8 @@
 
   ephemeral_network_configuration_handler_ =
       std::make_unique<EphemeralNetworkConfigurationHandler>(
-          &mock_managed_network_configuration_handler_);
+          &mock_managed_network_configuration_handler_,
+          /*was_enterprise_managed_at_startup=*/true);
 
   EXPECT_CALL(mock_managed_network_configuration_handler_,
               UserCreatedNetworkConfigurationsAreEphemeral())
@@ -274,7 +331,8 @@
 
   ephemeral_network_configuration_handler_ =
       std::make_unique<EphemeralNetworkConfigurationHandler>(
-          &mock_managed_network_configuration_handler_);
+          &mock_managed_network_configuration_handler_,
+          /*was_enterprise_managed_at_startup=*/true);
 
   EXPECT_CALL(mock_managed_network_configuration_handler_,
               RecommendedValuesAreEphemeral())
@@ -296,7 +354,8 @@
 
   ephemeral_network_configuration_handler_ =
       std::make_unique<EphemeralNetworkConfigurationHandler>(
-          &mock_managed_network_configuration_handler_);
+          &mock_managed_network_configuration_handler_,
+          /*was_enterprise_managed_at_startup=*/true);
 
   EXPECT_CALL(mock_managed_network_configuration_handler_,
               RecommendedValuesAreEphemeral())
@@ -321,7 +380,8 @@
 
   ephemeral_network_configuration_handler_ =
       std::make_unique<EphemeralNetworkConfigurationHandler>(
-          &mock_managed_network_configuration_handler_);
+          &mock_managed_network_configuration_handler_,
+          /*was_enterprise_managed_at_startup=*/true);
 
   EXPECT_CALL(mock_managed_network_configuration_handler_,
               TriggerEphemeralNetworkConfigActions())
@@ -329,4 +389,95 @@
   fake_power_manager_client_.SendSuspendDone(base::Minutes(10));
 }
 
+// When the screen is turned off and a "ephemeral network config"
+// (RecommendedValuesAreEphemeral) policy is active,
+// TriggerEphemeralNetworkConfigActions is triggered.
+TEST_F(EphemeralNetworkConfigurationHandlerTest, ScreenIdleState_Active) {
+  LoginState::Get()->SetLoggedInState(LoginState::LOGGED_IN_NONE,
+                                      LoginState::LOGGED_IN_USER_NONE);
+
+  ephemeral_network_configuration_handler_ =
+      std::make_unique<EphemeralNetworkConfigurationHandler>(
+          &mock_managed_network_configuration_handler_,
+          /*was_enterprise_managed_at_startup=*/true);
+
+  EXPECT_CALL(mock_managed_network_configuration_handler_,
+              RecommendedValuesAreEphemeral())
+      .WillRepeatedly(Return(true));
+
+  // Initial policy application
+  EXPECT_CALL(mock_managed_network_configuration_handler_,
+              TriggerEphemeralNetworkConfigActions())
+      .Times(1);
+  ephemeral_network_configuration_handler_->TriggerPoliciesChangedForTesting(
+      /*userhash=*/std::string());
+
+  testing::Mock::VerifyAndClearExpectations(
+      &mock_managed_network_configuration_handler_);
+
+  // Screen turns off due to inactivity.
+  EXPECT_CALL(mock_managed_network_configuration_handler_,
+              TriggerEphemeralNetworkConfigActions())
+      .Times(1);
+  NotifyScreenIdleOffChanged(/*off=*/true);
+
+  testing::Mock::VerifyAndClearExpectations(
+      &mock_managed_network_configuration_handler_);
+
+  // Other notifications (such as turn screen on) don't have an effect.
+  EXPECT_CALL(mock_managed_network_configuration_handler_,
+              TriggerEphemeralNetworkConfigActions())
+      .Times(0);
+
+  NotifyScreenIdleOffChanged(/*off=*/false);
+
+  testing::Mock::VerifyAndClearExpectations(
+      &mock_managed_network_configuration_handler_);
+
+  // But turning screen off on the sign-in screen has a repeated effect.
+  EXPECT_CALL(mock_managed_network_configuration_handler_,
+              TriggerEphemeralNetworkConfigActions())
+      .Times(1);
+  NotifyScreenIdleOffChanged(/*off=*/true);
+
+  testing::Mock::VerifyAndClearExpectations(
+      &mock_managed_network_configuration_handler_);
+
+  // After entering an active session, the screen turning off does not trigger
+  // TriggerEphemeralNetworkConfigActions - it should only happen on the sign-in
+  // screen.
+  LoginState::Get()->SetLoggedInState(
+      LoginState::LOGGED_IN_ACTIVE, LoginState::LOGGED_IN_USER_PUBLIC_ACCOUNT);
+  EXPECT_CALL(mock_managed_network_configuration_handler_,
+              TriggerEphemeralNetworkConfigActions())
+      .Times(0);
+  NotifyScreenIdleOffChanged(/*off=*/true);
+}
+
+// When the screen is turned off due to inactivity no "ephemeral network config"
+// policy is active, TriggerEphemeralNetworkConfigActions is not triggered.
+TEST_F(EphemeralNetworkConfigurationHandlerTest, ScreenIdleState_NotActive) {
+  LoginState::Get()->SetLoggedInState(LoginState::LOGGED_IN_NONE,
+                                      LoginState::LOGGED_IN_USER_NONE);
+
+  ephemeral_network_configuration_handler_ =
+      std::make_unique<EphemeralNetworkConfigurationHandler>(
+          &mock_managed_network_configuration_handler_,
+          /*was_enterprise_managed_at_startup=*/true);
+
+  EXPECT_CALL(mock_managed_network_configuration_handler_,
+              RecommendedValuesAreEphemeral())
+      .WillRepeatedly(Return(false));
+  EXPECT_CALL(mock_managed_network_configuration_handler_,
+              UserCreatedNetworkConfigurationsAreEphemeral())
+      .WillRepeatedly(Return(false));
+  ephemeral_network_configuration_handler_->TriggerPoliciesChangedForTesting(
+      /*userhash=*/std::string());
+
+  EXPECT_CALL(mock_managed_network_configuration_handler_,
+              TriggerEphemeralNetworkConfigActions())
+      .Times(0);
+  NotifyScreenIdleOffChanged(/*off=*/true);
+}
+
 }  // namespace ash

diff --git a/chromeos/ash/components/network/network_handler.cc b/chromeos/ash/components/network/network_handler.cc
index 144e945..dd9e2b8 100644
--- a/chromeos/ash/components/network/network_handler.cc
+++ b/chromeos/ash/components/network/network_handler.cc

@@ -8,6 +8,7 @@
 
 #include "ash/constants/ash_features.h"
 #include "base/task/single_thread_task_runner.h"
+#include "chromeos/ash/components/install_attributes/install_attributes.h"
 #include "chromeos/ash/components/network/auto_connect_handler.h"
 #include "chromeos/ash/components/network/cellular_connection_handler.h"
 #include "chromeos/ash/components/network/cellular_esim_installer.h"
@@ -61,7 +62,10 @@
 static NetworkHandler* g_network_handler = NULL;
 
 NetworkHandler::NetworkHandler()
-    : task_runner_(base::SingleThreadTaskRunner::GetCurrentDefault()),
+    : was_enterprise_managed_at_startup_(
+          InstallAttributes::IsInitialized() &&
+          InstallAttributes::Get()->IsEnterpriseManaged()),
+      task_runner_(base::SingleThreadTaskRunner::GetCurrentDefault()),
       network_state_handler_(new NetworkStateHandler()) {
   network_device_handler_.reset(new NetworkDeviceHandlerImpl());
   cellular_inhibitor_.reset(new CellularInhibitor());
@@ -444,7 +448,8 @@
   DCHECK(policy_util::AreEphemeralNetworkPoliciesEnabled());
   ephemeral_network_configuration_handler_ =
       std::make_unique<EphemeralNetworkConfigurationHandler>(
-          managed_network_configuration_handler_.get());
+          managed_network_configuration_handler_.get(),
+          was_enterprise_managed_at_startup_);
 }
 
 }  // namespace ash

diff --git a/chromeos/ash/components/network/network_handler.h b/chromeos/ash/components/network/network_handler.h
index 46e35a1..a8a8cbe 100644
--- a/chromeos/ash/components/network/network_handler.h
+++ b/chromeos/ash/components/network/network_handler.h

@@ -152,6 +152,11 @@
   // Called when ephemeral network policies become enabled.
   void OnEphemeralNetworkPoliciesEnabled();
 
+  // True when the device was manged by device policy at initialization time.
+  // TODO: b/302726243 - Introduce
+  // InstallAttributes::WasEnterpriseManagedAtStartup to avoid this.
+  const bool was_enterprise_managed_at_startup_;
+
   // The order of these determines the (inverse) destruction order.
   scoped_refptr<base::SingleThreadTaskRunner> task_runner_;
   const std::unique_ptr<NetworkStateHandler> network_state_handler_;

diff --git a/clank b/clank
index 119cbb4..7d2ace2 160000
--- a/clank
+++ b/clank

@@ -1 +1 @@
-Subproject commit 119cbb42a2f9366f4c5edd6bbb401cef3c40a63f
+Subproject commit 7d2ace2d1f10eb333f695f18832d8083c2ff885f

diff --git a/components/certificate_transparency/data/log_list.json b/components/certificate_transparency/data/log_list.json
index 3e22dc2..8344927c 100644
--- a/components/certificate_transparency/data/log_list.json
+++ b/components/certificate_transparency/data/log_list.json

@@ -1,6 +1,6 @@
 {
-  "version": "25.12",
-  "log_list_timestamp": "2023-09-30T13:30:10Z",
+  "version": "25.13",
+  "log_list_timestamp": "2023-10-01T12:57:43Z",
   "operators": [
     {
       "name": "Google",

diff --git a/components/exo/client_controlled_shell_surface.cc b/components/exo/client_controlled_shell_surface.cc
index 441f7a3..0917071e 100644
--- a/components/exo/client_controlled_shell_surface.cc
+++ b/components/exo/client_controlled_shell_surface.cc

@@ -1216,7 +1216,6 @@
                                                pending_window_state_)) {
     client_controlled_state_->set_next_bounds_change_animation_type(
         animation_type);
-    UpdateCornerRadius();
   }
 
   if (wasPip && !window_state->IsMinimized()) {

diff --git a/components/exo/client_controlled_shell_surface_unittest.cc b/components/exo/client_controlled_shell_surface_unittest.cc
index 4148dc9..4abded9bb 100644
--- a/components/exo/client_controlled_shell_surface_unittest.cc
+++ b/components/exo/client_controlled_shell_surface_unittest.cc

@@ -27,6 +27,7 @@
 #include "base/memory/raw_ptr.h"
 #include "base/test/scoped_feature_list.h"
 #include "cc/paint/display_item_list.h"
+#include "chromeos/constants/chromeos_features.h"
 #include "chromeos/ui/base/window_pin_type.h"
 #include "chromeos/ui/base/window_properties.h"
 #include "chromeos/ui/frame/caption_buttons/caption_button_model.h"
@@ -595,6 +596,46 @@
             frame_view->GetClientBoundsForWindowBounds(normal_window_bounds));
 }
 
+TEST_P(ClientControlledShellSurfaceTest,
+       ShadowRoundedCornersWithPipTransition) {
+  constexpr gfx::Point kOrigin(20, 20);
+  constexpr int kPipCornerRadius = 8;
+
+  base::test::ScopedFeatureList scoped_feature_list(
+      chromeos::features::kRoundedWindows);
+
+  std::unique_ptr<ClientControlledShellSurface> shell_surface =
+      test::ShellSurfaceBuilder({256, 256})
+          .SetOrigin(kOrigin)
+          .SetWindowState(chromeos::WindowStateType::kNormal)
+          .SetFrame(SurfaceFrameType::NORMAL)
+          .BuildClientControlledShellSurface();
+
+  Surface* root_surface = shell_surface->root_surface();
+
+  root_surface->Commit();
+  views::Widget* widget = shell_surface->GetWidget();
+  ASSERT_TRUE(widget);
+
+  aura::Window* window = widget->GetNativeWindow();
+  ui::Shadow* shadow = wm::ShadowController::GetShadowForWindow(window);
+  ASSERT_TRUE(shadow);
+  EXPECT_EQ(shadow->rounded_corner_radius_for_testing(), 0);
+
+  shell_surface->SetPip();
+  root_surface->Commit();
+
+  shadow = wm::ShadowController::GetShadowForWindow(window);
+  ASSERT_TRUE(shadow);
+  EXPECT_EQ(shadow->rounded_corner_radius_for_testing(), kPipCornerRadius);
+
+  shell_surface->UnsetPip();
+  root_surface->Commit();
+
+  ASSERT_TRUE(shadow);
+  EXPECT_EQ(shadow->rounded_corner_radius_for_testing(), 0);
+}
+
 namespace {
 
 class TestEventHandler : public ui::EventHandler {

diff --git a/components/exo/layer_tree_frame_sink_holder.cc b/components/exo/layer_tree_frame_sink_holder.cc
index 8d5d982..85914f0 100644
--- a/components/exo/layer_tree_frame_sink_holder.cc
+++ b/components/exo/layer_tree_frame_sink_holder.cc

@@ -30,7 +30,7 @@
 
 BASE_FEATURE(kExoAutoNeedsBeginFrame,
              "ExoAutoNeedsBeginFrame",
-             base::FEATURE_DISABLED_BY_DEFAULT);
+             base::FEATURE_ENABLED_BY_DEFAULT);
 
 ////////////////////////////////////////////////////////////////////////////////
 // LayerTreeFrameSinkHolder, public:

diff --git a/components/exo/shell_surface_base.cc b/components/exo/shell_surface_base.cc
index abb8f96..82e38e5 100644
--- a/components/exo/shell_surface_base.cc
+++ b/components/exo/shell_surface_base.cc

@@ -10,7 +10,6 @@
 #include "ash/frame/non_client_frame_view_ash.h"
 #include "ash/metrics/login_unlock_throughput_recorder.h"
 #include "ash/public/cpp/rounded_corner_utils.h"
-#include "ash/public/cpp/shell_window_ids.h"
 #include "ash/public/cpp/window_properties.h"
 #include "ash/shell.h"
 #include "ash/wm/desks/desks_controller.h"
@@ -78,6 +77,12 @@
 namespace exo {
 namespace {
 
+bool IsRadiiUniform(const gfx::RoundedCornersF& radii) {
+  return radii.upper_left() == radii.upper_right() &&
+         radii.lower_left() == radii.lower_right() &&
+         radii.upper_left() == radii.lower_left();
+}
+
 // The accelerator keys used to close ShellSurfaces.
 const struct {
   ui::KeyboardCode keycode;
@@ -143,29 +148,57 @@
 
   // Overridden from views::NonClientFrameView:
   void UpdateWindowRoundedCorners() override {
-    if (!GetFrameEnabled()) {
+    if (!chromeos::features::IsRoundedWindowsEnabled() && GetFrameEnabled()) {
+      header_view_->SetHeaderCornerRadius(
+          chromeos::GetFrameCornerRadius(frame()->GetNativeWindow()));
+    }
+
+    if (!GetWidget()) {
       return;
     }
 
-    if (!chromeos::features::IsRoundedWindowsEnabled()) {
-      header_view_->SetHeaderCornerRadius(
-          chromeos::GetFrameCornerRadius(frame()->GetNativeWindow()));
+    // TODO(b/302034956): Use `ApplyRoundedCornersToSurfaceTree()` to round pip
+    // window as well.
+    // Round a pip window. Pip windows are rounded by applying rounded corner
+    // to host window using ui::Layer API.
+    const ash::WindowState* window_state =
+        ash::WindowState::Get(GetWidget()->GetNativeWindow());
+
+    // When un-pipped (window state changed from pip), we must undo the
+    // rounded corners from the host_window.
+    const int pip_corner_radius =
+        window_state->IsPip() ? chromeos::kPipRoundedCornerRadius : 0;
+    const gfx::RoundedCornersF pip_radii(pip_corner_radius);
+
+    ui::Layer* layer = shell_surface_->host_window()->layer();
+    if (layer->rounded_corner_radii() != pip_radii) {
+      layer->SetRoundedCornerRadius(pip_radii);
+      layer->SetIsFastRoundedCorner(/*enable=*/!pip_radii.IsEmpty());
+    }
+
+    // If we have a pip window, ignore `window_radii`.
+    if (window_state->IsPip()) {
       return;
     }
 
     absl::optional<gfx::RoundedCornersF> window_radii =
         shell_surface_->window_corners_radii();
 
-    if (!window_radii) {
+    if (!chromeos::features::IsRoundedWindowsEnabled() || !window_radii) {
       return;
     }
 
-    // TODO(crbug.com/1415486): Support variable radius corner for header_view.
-    DCHECK_EQ(window_radii->upper_left(), window_radii->upper_right());
-    header_view_->SetHeaderCornerRadius(window_radii->upper_left());
+    // TODO(crbug.com/1415486): Support variable window radii.
+    DCHECK(IsRadiiUniform(window_radii.value()));
+
+    if (GetFrameEnabled()) {
+      header_view_->SetHeaderCornerRadius(window_radii->upper_left());
+    }
 
     const gfx::RoundedCornersF root_surface_radii = {
-        0, 0, window_radii->lower_right(), window_radii->lower_left()};
+        GetFrameEnabled() ? 0 : window_radii->upper_left(),
+        GetFrameEnabled() ? 0 : window_radii->upper_right(),
+        window_radii->lower_right(), window_radii->lower_left()};
 
     Surface* root_surface = shell_surface_->root_surface();
     DCHECK(root_surface);
@@ -1919,21 +1952,36 @@
     if (!CanActivate())
       shadow->SetElevation(wm::kShadowElevationMenuOrTooltip);
 
-    UpdateCornerRadius();
+    UpdateShadowRoundedCorners();
   }
 }
 
-void ShellSurfaceBase::UpdateCornerRadius() {
-  if (!widget_)
+void ShellSurfaceBase::UpdateShadowRoundedCorners() {
+  if (!widget_) {
     return;
-
-  ash::WindowState* window_state =
-      ash::WindowState::Get(widget_->GetNativeWindow());
-  if (window_state) {
-    ash::SetCornerRadius(
-        window_state->window(), host_window()->layer(),
-        window_state->IsPip() ? chromeos::kPipRoundedCornerRadius : 0);
   }
+
+  aura::Window* window = widget_->GetNativeWindow();
+  ui::Shadow* shadow = wm::ShadowController::GetShadowForWindow(window);
+
+  if (!shadow) {
+    return;
+  }
+
+  int shadow_radius = 0;
+
+  const ash::WindowState* window_state = ash::WindowState::Get(window);
+  if (window_state && window_state->IsPip()) {
+    shadow_radius = chromeos::kPipRoundedCornerRadius;
+  } else if (chromeos::features::IsRoundedWindowsEnabled() &&
+             window_corners_radii_dp_) {
+    // TODO(crbug.com/1415486): Support shadow with variable radius corners.
+    // We expect to have windows with same rounded corners.
+    DCHECK(IsRadiiUniform(window_corners_radii_dp_.value()));
+    shadow_radius = window_corners_radii_dp_->upper_left();
+  }
+
+  shadow->SetRoundedCornerRadius(shadow_radius);
 }
 
 void ShellSurfaceBase::UpdateFrameType() {
@@ -1942,7 +1990,7 @@
 }
 
 void ShellSurfaceBase::UpdateWindowRoundedCorners() {
-  // If non_client_view is not avaliable, it means that widget_ is neither a
+  // If non_client_view is not available, it means that widget_ is neither a
   // normal window or a bubble. Therefore it should not have any decorations
   // including a rounded window.
   if (!widget_ || !widget_->non_client_view()) {
@@ -2111,12 +2159,6 @@
   UpdateFrameType();
   UpdateWidgetBounds();
   UpdateHostWindowSizeAndRootSurfaceOrigin();
-  gfx::Rect bounds = geometry_;
-  if (!bounds.IsEmpty() && !widget_->GetNativeWindow()->GetProperty(
-                               aura::client::kUseWindowBoundsForShadow)) {
-    SetBoundsForShadows(absl::make_optional(bounds));
-  }
-  UpdateShadow();
 
   // System modal container is used by clients to implement overlay
   // windows using a single ShellSurface instance.  If hit-test
@@ -2144,7 +2186,17 @@
 
   UpdateHostWindowOrigin();
   UpdateShape();
+
+  gfx::Rect bounds = geometry_;
+  if (!bounds.IsEmpty() && !widget_->GetNativeWindow()->GetProperty(
+                               aura::client::kUseWindowBoundsForShadow)) {
+    SetBoundsForShadows(absl::make_optional(bounds));
+  }
+
+  // The calling order matters. Updated window radius is need to correctly
+  // update the radius of the shadow.
   UpdateWindowRoundedCorners();
+  UpdateShadow();
 
   // Don't show yet if the shell surface doesn't have content or is minimized
   // while waiting for content.

diff --git a/components/exo/shell_surface_base.h b/components/exo/shell_surface_base.h
index 8ab1a6a..6dcb7fd7 100644
--- a/components/exo/shell_surface_base.h
+++ b/components/exo/shell_surface_base.h

@@ -395,10 +395,6 @@
   // |shadow_bounds_|.
   void UpdateShadow();
 
-  // Updates the corner radius depending on whether the |widget_| is in pip or
-  // not.
-  void UpdateCornerRadius();
-
   virtual void UpdateFrameType();
 
   void UpdateWindowRoundedCorners();
@@ -509,6 +505,9 @@
       LocalSurfaceIdUpdatedOnHostWindowOriginChangedWithScaleFactor);
   FRIEND_TEST_ALL_PREFIXES(ShellSurfaceTest, SubpixelPositionOffset);
 
+  // Updates the shadow's rounded corner associated with the `widget_`.
+  void UpdateShadowRoundedCorners();
+
   // Called on widget creation to initialize its window state.
   // TODO(reveman): Remove virtual functions below to avoid FBC problem.
   virtual void InitializeWindowState(ash::WindowState* window_state) = 0;

diff --git a/components/exo/shell_surface_unittest.cc b/components/exo/shell_surface_unittest.cc
index 1f48efe2..9217cac 100644
--- a/components/exo/shell_surface_unittest.cc
+++ b/components/exo/shell_surface_unittest.cc

@@ -7,10 +7,8 @@
 #include <sstream>
 #include <vector>
 
-#include "ash/accessibility/accessibility_delegate.h"
 #include "ash/constants/ash_constants.h"
 #include "ash/frame/non_client_frame_view_ash.h"
-#include "ash/public/cpp/shell_window_ids.h"
 #include "ash/public/cpp/test/shell_test_api.h"
 #include "ash/public/cpp/window_properties.h"
 #include "ash/shell.h"
@@ -21,12 +19,13 @@
 #include "ash/wm/wm_event.h"
 #include "ash/wm/workspace_controller_test_api.h"
 #include "base/functional/bind.h"
-#include "base/functional/callback.h"
-#include "base/strings/utf_string_conversions.h"
 #include "base/test/bind.h"
 #include "base/test/mock_callback.h"
+#include "base/test/scoped_feature_list.h"
+#include "chromeos/constants/chromeos_features.h"
 #include "components/app_restore/window_properties.h"
 #include "components/exo/buffer.h"
+#include "components/exo/client_controlled_shell_surface.h"
 #include "components/exo/permission.h"
 #include "components/exo/security_delegate.h"
 #include "components/exo/shell_surface_util.h"
@@ -59,6 +58,7 @@
 #include "ui/display/types/display_constants.h"
 #include "ui/events/base_event_utils.h"
 #include "ui/events/event.h"
+#include "ui/gfx/geometry/rounded_corners_f.h"
 #include "ui/views/controls/textfield/textfield.h"
 #include "ui/views/widget/widget.h"
 #include "ui/wm/core/shadow_controller.h"
@@ -2806,6 +2806,51 @@
   EXPECT_EQ(gfx::Rect(0, 0, 256, 256), shadow->content_bounds());
 }
 
+TEST_F(ShellSurfaceTest, ShadowRoundedCornersForRoundedWindows) {
+  constexpr gfx::Point kOrigin(20, 20);
+  constexpr int kWindowCornerRadius = 12;
+
+  base::test::ScopedFeatureList scoped_feature_list(
+      chromeos::features::kRoundedWindows);
+
+  std::unique_ptr<ShellSurface> shell_surface =
+      test::ShellSurfaceBuilder({256, 256})
+          .SetOrigin(kOrigin)
+          .SetWindowState(chromeos::WindowStateType::kNormal)
+          .SetFrame(SurfaceFrameType::NORMAL)
+          .BuildShellSurface();
+
+  Surface* root_surface = shell_surface->root_surface();
+
+  root_surface->Commit();
+  views::Widget* widget = shell_surface->GetWidget();
+  ASSERT_TRUE(widget);
+
+  aura::Window* window = widget->GetNativeWindow();
+  ui::Shadow* shadow = wm::ShadowController::GetShadowForWindow(window);
+  ASSERT_TRUE(shadow);
+
+  // Window shadow radius needs to match the window radius.
+  EXPECT_EQ(shadow->rounded_corner_radius_for_testing(), 0);
+
+  // Have a window with radius of 12dp.
+  shell_surface->SetWindowCornerRadii(
+      gfx::RoundedCornersF(kWindowCornerRadius));
+  root_surface->Commit();
+
+  shadow = wm::ShadowController::GetShadowForWindow(window);
+  ASSERT_TRUE(shadow);
+  EXPECT_EQ(shadow->rounded_corner_radius_for_testing(), kWindowCornerRadius);
+
+  // Have a window with radius of 0dp.
+  shell_surface->SetWindowCornerRadii(gfx::RoundedCornersF());
+  root_surface->Commit();
+
+  shadow = wm::ShadowController::GetShadowForWindow(window);
+  ASSERT_TRUE(shadow);
+  EXPECT_EQ(shadow->rounded_corner_radius_for_testing(), 0);
+}
+
 // Make sure that resize shadow does not update until commit when the window
 // property |aura::client::kUseWindowBoundsForShadow| is false.
 TEST_F(ShellSurfaceTest, ResizeShadowIndependentBounds) {

diff --git a/components/keyed_service/core/keyed_service_factory.cc b/components/keyed_service/core/keyed_service_factory.cc
index 8f07990..bfdf29b 100644
--- a/components/keyed_service/core/keyed_service_factory.cc
+++ b/components/keyed_service/core/keyed_service_factory.cc

@@ -99,7 +99,10 @@
 KeyedService* KeyedServiceFactory::Associate(
     void* context,
     std::unique_ptr<KeyedService> service) {
-  DCHECK(!base::Contains(mapping_, context));
+  // If `context` is already in `mapping_`, then something has gone wrong in
+  // initializing services.
+  // TODO(crbug.com/1487955): convert to CHECK
+  DUMP_WILL_BE_CHECK(!base::Contains(mapping_, context));
   // Only count non-null services
   if (service)
     GetKeyedServicesCount()[context]++;

diff --git a/components/keyed_service/core/refcounted_keyed_service_factory.cc b/components/keyed_service/core/refcounted_keyed_service_factory.cc
index 77a3b66b..36d4956 100644
--- a/components/keyed_service/core/refcounted_keyed_service_factory.cc
+++ b/components/keyed_service/core/refcounted_keyed_service_factory.cc

@@ -96,7 +96,11 @@
 scoped_refptr<RefcountedKeyedService> RefcountedKeyedServiceFactory::Associate(
     void* context,
     scoped_refptr<RefcountedKeyedService> service) {
-  DCHECK(!base::Contains(mapping_, context));
+  // If `context` is already in `mapping_`, then something has gone wrong in
+  // initializing services. This can lead to a service being freed without
+  // calling `Shutdown`, which can lead to undefined behavior.
+  // TODO(crbug.com/1487955): convert to CHECK
+  DUMP_WILL_BE_CHECK(!base::Contains(mapping_, context));
   // Only count non-null services
   if (service)
     GetRefcountedKeyedServicesCount()[context]++;

diff --git a/components/policy/resources/policy_templates_th.xtb b/components/policy/resources/policy_templates_th.xtb
index 2d2afce8..1c063b9 100644
--- a/components/policy/resources/policy_templates_th.xtb
+++ b/components/policy/resources/policy_templates_th.xtb

@@ -3374,6 +3374,7 @@
 <translation id="3870300103958000506">หากไม่ตั้งค่า <ph name="SAFE_BROWSING_ENABLED_POLICY_NAME" /> เป็น "เท็จ" การตั้งค่า <ph name="ADS_SETTINGS_FOR_INTRUSIVE_ADS_SITES_POLICY_NAME" /> เป็น 1 หรือไม่ได้ตั้งค่าจะอนุญาตให้แสดงโฆษณาในทุกเว็บไซต์
 
       การตั้งค่านโยบายเป็น 2 จะบล็อกโฆษณาในเว็บไซต์ซึ่งมีโฆษณาที่แทรก</translation>
+<translation id="3876564097829884243">เปิดใช้ฟีเจอร์ EphemeralNetworkPolicies</translation>
 <translation id="3877517141460819966">โหมดการตรวจสอบสิทธิ์จากปัจจัยที่สองที่ผสานรวม</translation>
 <translation id="3877908683993837673">นโยบายนี้ควบคุมกลุ่มซอฟต์แวร์ที่จะใช้ในการสื่อสารกับเซิร์ฟเวอร์ DNS ซึ่งได้แก่ ไคลเอ็นต์ DNS ของระบบปฏิบัติการ หรือไคลเอ็นต์ DNS ในตัวของ <ph name="PRODUCT_NAME" /> นโยบายนี้ไม่มีผลกับเซิร์ฟเวอร์ DNS ที่จะใช้ เช่น หากมีการกำหนดค่าให้ระบบปฏิบัติการใช้เซิร์ฟเวอร์ DNS ขององค์กร ไคลเอ็นต์ DNS ในตัวก็จะใช้เซิร์ฟเวอร์เดียวกันนี้ด้วย นอกจากนี้ นโยบายยังไม่ได้ควบคุมว่าจะใช้ DNS-over-HTTPS หรือไม่ <ph name="PRODUCT_NAME" /> จะใช้รีโซลเวอร์ในตัวเมื่อมีคำขอ DNS-over-HTTPS เสมอ โปรดดูข้อมูลเกี่ยวกับการควบคุม DNS-over-HTTPS ในนโยบาย <ph name="DNS_OVER_HTTPS_MODE_POLICY_NAME" />
 
@@ -4741,6 +4742,14 @@
       แม้จะไม่มีนโยบายที่มีความสำคัญเหนือกว่า แต่ให้ดู <ph name="COOKIES_BLOCKED_FOR_URLS_POLICY_NAME" /> และ <ph name="COOKIES_ALLOWED_FOR_URLS_POLICY_NAME" /> รูปแบบ URL ใน 3 นโยบายนี้ต้องไม่ขัดแย้งกัน
 
       ดูข้อมูลโดยละเอียดเกี่ยวกับรูปแบบ <ph name="URL_LABEL" /> ที่ถูกต้องได้ที่ https://cloud.google.com/docs/chrome-enterprise/policies/url-patterns <ph name="WILDCARD_VALUE" /> ไม่ใช่ค่าที่ยอมรับสำหรับนโยบายนี้</translation>
+<translation id="5174547204575752627">นโยบายนี้ควบคุมการเปลี่ยนโครงสร้างภายในโค้ดล่าสุดสำหรับ VideoDecoder API ในปลั๊กอิน PPAPI
+
+การย้ายข้อมูลจะส่งผลต่อรายละเอียดการใช้งานภายในเท่านั้น และไม่ควรเปลี่ยนลักษณะการทำงานใดๆ อย่างไรก็ตาม คุณจะใช้นโยบายนี้ได้ในกรณีที่แอปพลิเคชัน PPAPI ไม่ทำงานตามที่คาดไว้
+
+เมื่อไม่ได้ตั้งค่านโยบายหรือตั้งค่าเป็น "เปิดใช้" เบราว์เซอร์จะตัดสินใจว่าจะใช้การติดตั้งใช้งานรายการใด
+เมื่อตั้งค่านโยบายเป็น "ปิดใช้" เบราว์เซอร์จะใช้การใช้งานเดิมจนกว่านโยบายจะหมดอายุ
+
+หมายเหตุ: เฉพาะกระบวนการแสดงผลที่เพิ่งเริ่มใหม่เท่านั้นที่จะแสดงการเปลี่ยนแปลงนโยบายนี้ขณะที่เบราว์เซอร์ทำงานอยู่</translation>
 <translation id="5177260184597743704">นโยบายการกำหนดค่าสำหรับเครื่องมือเชื่อมต่อ Chrome Enterprise OnSecurityEvent</translation>
 <translation id="5178479074002209469">ธงบูลีนที่ระบุว่าเซสชันผู้ใช้ที่ไม่มีการจัดการควรได้รับการแจ้งเตือนและจะถูกบังคับให้ออกจากระบบหรือไม่หากต้องมีการอัปเดตตามนโยบายนี้</translation>
 <translation id="5179853299156742425">URL ที่ไปดาวน์โหลดเทมเพลตเดสก์ได้</translation>
@@ -4758,6 +4767,7 @@
 <translation id="519247340330463721">กำหนดค่านโยบายที่เกี่ยวข้องกับ Safe Browsing</translation>
 <translation id="5194683382395300627">อนุญาตให้ใช้ "<ph name="ASSISTANT_PRODUCT_NAME" />" บนเว็บ เช่น เพื่อเปิดใช้การเปลี่ยนรหัสผ่านโดยอัตโนมัติ</translation>
 <translation id="5196630732055960309">อนุญาตให้ใช้ File Handling API ในเว็บแอปเหล่านี้</translation>
+<translation id="5205352023880027050">อย่าเปิดใช้ฟีเจอร์ EphemeralNetworkPolicies</translation>
 <translation id="5206454085187851382">หากมีการเลือก <ph name="PRINTERS_ALLOWLIST" /> ไว้สำหรับ <ph name="PRINTERS_BULK_ACCESS_MODE_POLICY_NAME" /> การตั้งค่า <ph name="PRINTERS_BULK_ALLOWLIST_POLICY_NAME" /> จะระบุเครื่องพิมพ์ที่ผู้ใช้จะใช้ได้ จะมีเฉพาะเครื่องพิมพ์ที่มีรหัสตรงกับค่าในนโยบายนี้เท่านั้นที่พร้อมใช้งานสำหรับผู้ใช้ รหัสดังกล่าวต้องตรงกับช่อง <ph name="ID_FIELD" /> หรือ <ph name="GUID_FIELD" /> ในไฟล์ที่ระบุไว้ใน <ph name="PRINTERS_BULK_CONFIGURATION_POLICY_NAME" /></translation>
 <translation id="5207543664699568887">กำหนดค่าว่าจะให้ <ph name="PRODUCT_NAME" /> ใน Linux ใช้การแจ้งเตือนของระบบหรือไม่
 
@@ -5276,6 +5286,31 @@
 <translation id="5622924058222112599">เปิดใช้กระบวนการเปิดตัวเริ่มต้นของ CECPQ2</translation>
 <translation id="5623304306796942802">ข้อความแจ้งที่แสดงเมื่อมีใบรับรองที่ตรงกันหลายรายการ</translation>
 <translation id="5625771176514429288">แอป Chrome จะได้รับอนุญาตให้ทำงานในแพลตฟอร์มเหล่านี้</translation>
+<translation id="5627094573311711592">กำหนดค่ารายการกฎการควบคุมข้อมูลเพื่อป้องกันข้อมูลรั่วไหล ข้อมูลรั่วไหลอาจเกิดขึ้นจากการคัดลอกและวางข้อมูล การแนบไฟล์ไปยังหน้าเว็บ การพิมพ์ การดาวน์โหลด และอื่นๆ
+
+      กฎแต่ละข้อประกอบด้วยข้อมูลต่อไปนี้
+      - คุณสมบัติของแหล่งที่มาของการดำเนินการ กฎจะทริกเกอร์ก็ต่อเมื่อการดำเนินการของผู้ใช้ตรงกับทุกช่องที่มีการป้อนข้อมูลไว้ในช่อง <ph name="DATA_CONTROLS_SOURCES" /> สำหรับช่องย่อยของรายการ จะต้องจับคู่เพียง 1 รายการเท่านั้น เช่น ต้องจับคู่รูปแบบ URL เพียง 1 รายการจึงจะทริกเกอร์กฎได้
+      - คุณสมบัติของปลายทางของการดำเนินการ กฎจะทริกเกอร์ก็ต่อเมื่อการดำเนินการของผู้ใช้ตรงกับทุกช่องที่มีการป้อนข้อมูลไว้ในช่อง <ph name="DATA_CONTROLS_DESTINATIONS" /> สำหรับช่องย่อยของรายการ จะต้องจับคู่เพียง 1 รายการเท่านั้น เช่น ต้องจับคู่รูปแบบ URL เพียง 1 รายการจึงจะทริกเกอร์กฎได้
+      - รายการการจำกัดที่จะใช้กับข้อมูลของแหล่งที่มา
+
+      คุณจะเพิ่มกฎเพื่อดำเนินการต่อไปนี้ได้
+      - ควบคุมข้อมูลในคลิปบอร์ดที่แชร์ระหว่างแหล่งที่มาและปลายทาง
+      - ควบคุมการพิมพ์จากแหล่งที่มาใดก็ตาม
+      - ควบคุมไฟล์ที่แนบไปยังปลายทางใดก็ตาม
+      - ควบคุมไฟล์ที่ดาวน์โหลดจากแหล่งที่มาใดก็ตาม
+
+      หากตั้งค่านโยบาย <ph name="ON_SECURITY_EVENT_ENTERPRISE_CONNECTOR" /> เป็น "จริง" ระบบจะรายงานกฎที่ทริกเกอร์ไปยังผู้ดูแลระบบ
+      ระดับการจำกัดอาจตั้งค่าเป็น "ALLOW", "BLOCK", "WARN" หรือ "REPORT"
+      - หากตั้งค่าระดับการจำกัดเป็น "ALLOW" ระบบจะอนุญาตให้ดำเนินการ ซึ่งจะลบล้างการจำกัดที่บังคับใช้โดยกฎอื่นๆ ด้วย
+      - หากตั้งค่าระดับการจำกัดเป็น "BLOCK" ระบบจะไม่อนุญาตให้ดำเนินการ
+      - หากตั้งค่าระดับการจำกัดเป็น "WARN" ผู้ใช้จะได้รับคำเตือนและอาจเลือกดำเนินการต่อหรือยกเลิกการดำเนินการก็ได้
+      - หากตั้งค่าระดับการจำกัดเป็น "REPORT" การดำเนินการของผู้ใช้จะไม่ถูกขัดจังหวะ แต่ระบบจะส่งรายงานหากเปิดใช้นโยบาย <ph name="ON_SECURITY_EVENT_ENTERPRISE_CONNECTOR" />
+
+      หมายเหตุ:
+      - จัดรูปแบบ URL ตามรูปแบบนี้ ( https://support.google.com/chrome/a?p=url_blocklist_filter_format )
+      - สำหรับกฎการป้องกันข้อมูลรั่วไหลของ <ph name="PRODUCT_OS_NAME" /> โดยเฉพาะ โปรดดูนโยบาย <ph name="DATA_LEAK_PREVENTION_RULES_LIST" /> ด้วย
+
+      หากไม่ได้ตั้งค่านโยบาย ระบบจะไม่จำกัดการใช้งาน</translation>
 <translation id="5630352020869108293">คืนค่าเซสชันล่าสุด</translation>
 <translation id="5633871703004128675">เปิดใช้ฟีเจอร์การช่วยเหลือพิเศษสำหรับการไฮไลต์เคอร์เซอร์ข้อความ</translation>
 <translation id="5634032995857968056">เปิดใช้แซนด์บ็อกซ์ของคอนเทนเนอร์แอปตัวแสดงผล</translation>
@@ -5964,6 +5999,7 @@
 <translation id="6299554629216555326">การตั้งค่าการจัดการหน้าต่าง</translation>
 <translation id="6302021021024941085">ปิดใช้เครื่องมือแก้ปัญหาคีออสก์</translation>
 <translation id="6303118494824248488">URL ของอิมเมจดิสก์ที่จะดาวน์โหลด</translation>
+<translation id="6303278429164386663">ควบคุมการเปิดใช้ฟีเจอร์ EphemeralNetworkPolicies</translation>
 <translation id="6305373713165475629">การตั้งค่านโยบายนี้จะลบล้างโหมดการพิมพ์สีเริ่มต้น หากโหมดนี้ไม่พร้อมใช้งาน ระบบจะเพิกเฉยต่อนโยบายนี้</translation>
 <translation id="6308109234708949641">นโยบายนี้เปิดใช้ฟีเจอร์ Screencast สำหรับผู้ใช้ Family Link และให้สิทธิ์ในการสร้างและถอดเสียงการบันทึกหน้าจอและอัปโหลดไปยังไดรฟ์
       นโยบายนี้ไม่มีผลต่อผู้ใช้ประเภทอื่นๆ
@@ -6764,6 +6800,7 @@
 หากตั้งค่าเป็น "เท็จ" หรือไม่ได้ตั้งค่า เลย์เอาต์จะใช้งานไม่ได้ ต้องรีบูตเพื่อให้มีผล</translation>
 <translation id="685769593149966548">บังคับใช้โหมดที่จำกัดเข้มงวดใน YouTube</translation>
 <translation id="686079137349561371">Microsoft Windows 7 ขึ้นไป</translation>
+<translation id="6866755486434471318">อนุญาตให้ <ph name="PEPPER_NAME" /> ใช้รูปภาพที่แชร์ในการถอดรหัสวิดีโอ</translation>
 <translation id="6881447940489194100">แฮช SHA-256 ที่เข้ารหัสเลขฐานสิบหกของข้อมูล</translation>
 <translation id="68818134518270542">การตั้งค่านโยบายจะระบุแอปที่ผู้ใช้เปิดเป็นแอปจดโน้ตในหน้าจอล็อกของ <ph name="PRODUCT_OS_NAME" /> ได้
 
@@ -7119,6 +7156,10 @@
 
       หากไม่ได้ตั้งค่านโยบายนี้ เบราว์เซอร์อาจส่งคำขอ DNS-over-HTTPS ไปยังรีโซลเวอร์ที่เกี่ยวข้องกับรีโซลเวอร์ระบบของผู้ใช้ซึ่งมีการกำหนดค่าไว้</translation>
 <translation id="7152640356717355643">เปิดใช้การรายงานอินเทอร์เฟซเครือข่ายของอุปกรณ์</translation>
+<translation id="7153786895642570081">นโยบายนี้ควบคุมการเปิดใช้ฟีเจอร์ EphemeralNetworkPolicies
+เมื่อตั้งค่านโยบายนี้เป็น "จริง" ระบบจะดำเนินการตาม DeviceOpenNetworkConfiguration entries RecommendedValuesAreEphemeral และ UserCreatedNetworkConfigurationsAreEphemeral
+เมื่อไม่ได้ตั้งค่านโยบายนี้หรือตั้งค่าเป็น "เท็จ" ระบบจะดำเนินการตามนโยบายเครือข่ายที่กล่าวถึงต่อเมื่อฟีเจอร์ EphemeralNetworkPolicies เปิดใช้อยู่
+เราจะนำนโยบายนี้ออกเมื่อฟีเจอร์ EphemeralNetworkPolicies เปิดใช้อยู่โดยค่าเริ่มต้น</translation>
 <translation id="7157329428182136164">เปิดใช้การรองรับ API ของกราฟิก 3 มิติ</translation>
 <translation id="7158358621906236999">การตั้งค่าเซ็นเซอร์เริ่มต้น</translation>
 <translation id="7161568070244869726">บังคับเปิดใช้ AppCache</translation>
@@ -8889,6 +8930,7 @@
       หากคุณตั้งค่านโยบายนี้ ผู้ใช้จะเปลี่ยนฟังก์ชันนี้ไม่ได้ การไม่ตั้งค่าจะให้ผู้ใช้เปลี่ยนการตั้งค่าได้</translation>
 <translation id="8707790573162457301">เรียกใช้การทำความสะอาดดิสก์อัตโนมัติในระหว่างเข้าสู่ระบบ</translation>
 <translation id="8713535263782304771">ปิดใช้ Google Safe Browsing</translation>
+<translation id="8714556680280715750">URL สำหรับให้ผู้ใช้เข้าชมเพื่อดูข้อมูลเพิ่มเติม หากไม่ได้ตั้งค่าไว้ จะไม่มี URL สำหรับ "ดูข้อมูลเพิ่มเติม" ในโปรแกรมติดตั้ง หากมี ก็ต้องใช้รูปแบบ HTTPS</translation>
 <translation id="8715181294371649277">อนุญาตการป้องกันการดาวน์โหลดแบบเรียลไทม์ของ Google Safe Browsing</translation>
 <translation id="8715885991031124968">อนุญาตกล่องโต้ตอบ JavaScript ที่เกิดจากเฟรมย่อยที่เป็นต้นทางเฟรมอื่น</translation>
 <translation id="8720547069538712402">อนุญาตให้ผู้ใช้เปิดใช้หรือปิดใช้การตรวจตัวสะกด</translation>

diff --git a/components/variations/synthetic_trial_registry.h b/components/variations/synthetic_trial_registry.h
index c155135..c12e90e 100644
--- a/components/variations/synthetic_trial_registry.h
+++ b/components/variations/synthetic_trial_registry.h

@@ -19,6 +19,11 @@
 class MetricsServiceAccessor;
 }  // namespace metrics
 
+namespace tpcd::experiment {
+FORWARD_DECLARE_TEST(ExperimentManagerImplSyntheticTrialTest,
+                     RegistersSyntheticTrial);
+}  // namespace tpcd::experiment
+
 namespace variations {
 
 struct ActiveGroupId;
@@ -89,8 +94,11 @@
                            GetSyntheticFieldTrialsOlderThanSuffix);
   FRIEND_TEST_ALL_PREFIXES(SyntheticTrialRegistryTest,
                            GetSyntheticFieldTrialActiveGroups);
-  FRIEND_TEST_ALL_PREFIXES(VariationsCrashKeysTest, BasicFunctionality);
   FRIEND_TEST_ALL_PREFIXES(SyntheticTrialRegistryTest, NotifyObserver);
+  FRIEND_TEST_ALL_PREFIXES(VariationsCrashKeysTest, BasicFunctionality);
+  FRIEND_TEST_ALL_PREFIXES(
+      ::tpcd::experiment::ExperimentManagerImplSyntheticTrialTest,
+      RegistersSyntheticTrial);
 
   // Registers a field trial name and group to be used to annotate UMA and UKM
   // reports with a particular Chrome configuration state.

diff --git a/content/browser/attribution_reporting/attribution_debug_report_unittest.cc b/content/browser/attribution_reporting/attribution_debug_report_unittest.cc
index 6214a92..7db0a32f 100644
--- a/content/browser/attribution_reporting/attribution_debug_report_unittest.cc
+++ b/content/browser/attribution_reporting/attribution_debug_report_unittest.cc

@@ -15,6 +15,7 @@
 #include "content/browser/attribution_reporting/os_registration.h"
 #include "content/browser/attribution_reporting/storable_source.h"
 #include "content/browser/attribution_reporting/store_source_result.h"
+#include "content/public/browser/global_routing_id.h"
 #include "net/base/schemeful_site.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/abseil-cpp/absl/types/optional.h"

diff --git a/content/browser/attribution_reporting/attribution_internals_browsertest.cc b/content/browser/attribution_reporting/attribution_internals_browsertest.cc
index 8f881aa..136ff77b 100644
--- a/content/browser/attribution_reporting/attribution_internals_browsertest.cc
+++ b/content/browser/attribution_reporting/attribution_internals_browsertest.cc

@@ -45,6 +45,7 @@
 #include "content/browser/storage_partition_impl.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/browsing_data_filter_builder.h"
+#include "content/public/browser/global_routing_id.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/test/browser_test.h"

diff --git a/content/browser/attribution_reporting/attribution_interop_parser_unittest.cc b/content/browser/attribution_reporting/attribution_interop_parser_unittest.cc
index 957bc9f..5ebb8db4 100644
--- a/content/browser/attribution_reporting/attribution_interop_parser_unittest.cc
+++ b/content/browser/attribution_reporting/attribution_interop_parser_unittest.cc

@@ -479,144 +479,98 @@
                          ::testing::ValuesIn(kParseErrorTestCases));
 
 TEST(AttributionInteropParserTest, ValidConfig) {
+  typedef void (*MakeExpectedFunc)(AttributionConfig&);
+
   const struct {
     const char* json;
     bool required;
-    AttributionConfig expected;
+    MakeExpectedFunc make_expected;
   } kTestCases[] = {
-      {R"json({})json", false, AttributionConfig()},
+      {R"json({})json", false, [](AttributionConfig&) {}},
       {R"json({"max_sources_per_origin":"100"})json", false,
-       AttributionConfigWith(
-           [](AttributionConfig& c) { c.max_sources_per_origin = 100; })},
+       [](AttributionConfig& c) { c.max_sources_per_origin = 100; }},
       {R"json({"max_destinations_per_source_site_reporting_site":"100"})json",
-       false, AttributionConfigWith([](AttributionConfig& c) {
+       false,
+       [](AttributionConfig& c) {
          c.max_destinations_per_source_site_reporting_site = 100;
-       })},
+       }},
       {R"json({"max_destinations_per_rate_limit_window_reporting_site":"100"})json",
-       false, AttributionConfigWith([](AttributionConfig& c) {
+       false,
+       [](AttributionConfig& c) {
          c.destination_rate_limit = {.max_per_reporting_site = 100};
-       })},
+       }},
       {R"json({"max_destinations_per_rate_limit_window":"100"})json", false,
-       AttributionConfigWith([](AttributionConfig& c) {
+       [](AttributionConfig& c) {
          c.destination_rate_limit = {.max_total = 100};
-       })},
+       }},
       {R"json({"destination_rate_limit_window_in_minutes":"5"})json", false,
-       AttributionConfigWith([](AttributionConfig& c) {
+       [](AttributionConfig& c) {
          c.destination_rate_limit = {.rate_limit_window = base::Minutes(5)};
-       })},
+       }},
       {R"json({"rate_limit_time_window_in_days":"30"})json", false,
-       AttributionConfigWith([](AttributionConfig& c) {
-         c.rate_limit =
-             RateLimitWith([](AttributionConfig::RateLimitConfig& r) {
-               r.time_window = base::Days(30);
-             });
-       })},
+       [](AttributionConfig& c) { c.rate_limit.time_window = base::Days(30); }},
       {R"json({"rate_limit_max_source_registration_reporting_origins":"10"})json",
-       false, AttributionConfigWith([](AttributionConfig& c) {
-         c.rate_limit =
-             RateLimitWith([](AttributionConfig::RateLimitConfig& r) {
-               r.max_source_registration_reporting_origins = 10;
-             });
-       })},
+       false,
+       [](AttributionConfig& c) {
+         c.rate_limit.max_source_registration_reporting_origins = 10;
+       }},
       {R"json({"rate_limit_max_attribution_reporting_origins":"10"})json",
-       false, AttributionConfigWith([](AttributionConfig& c) {
-         c.rate_limit =
-             RateLimitWith([](AttributionConfig::RateLimitConfig& r) {
-               r.max_attribution_reporting_origins = 10;
-             });
-       })},
+       false,
+       [](AttributionConfig& c) {
+         c.rate_limit.max_attribution_reporting_origins = 10;
+       }},
       {R"json({"rate_limit_max_attributions":"10"})json", false,
-       AttributionConfigWith([](AttributionConfig& c) {
-         c.rate_limit =
-             RateLimitWith([](AttributionConfig::RateLimitConfig& r) {
-               r.max_attributions = 10;
-             });
-       })},
+       [](AttributionConfig& c) { c.rate_limit.max_attributions = 10; }},
       {R"json({"rate_limit_max_reporting_origins_per_source_reporting_site":"2"})json",
-       false, AttributionConfigWith([](AttributionConfig& c) {
-         c.rate_limit =
-             RateLimitWith([](AttributionConfig::RateLimitConfig& r) {
-               r.max_reporting_origins_per_source_reporting_site = 2;
-             });
-       })},
+       false,
+       [](AttributionConfig& c) {
+         c.rate_limit.max_reporting_origins_per_source_reporting_site = 2;
+       }},
       {R"json({"rate_limit_origins_per_site_window_in_days":"2"})json", false,
-       AttributionConfigWith([](AttributionConfig& c) {
-         c.rate_limit =
-             RateLimitWith([](AttributionConfig::RateLimitConfig& r) {
-               r.origins_per_site_window = base::Days(2);
-             });
-       })},
+       [](AttributionConfig& c) {
+         c.rate_limit.origins_per_site_window = base::Days(2);
+       }},
       {R"json({"navigation_source_trigger_data_cardinality":"10"})json", false,
-       AttributionConfigWith([](AttributionConfig& c) {
-         c.event_level_limit =
-             EventLevelLimitWith([](AttributionConfig::EventLevelLimit& e) {
-               e.navigation_source_trigger_data_cardinality = 10;
-             });
-       })},
+       [](AttributionConfig& c) {
+         c.event_level_limit.navigation_source_trigger_data_cardinality = 10;
+       }},
       {R"json({"event_source_trigger_data_cardinality":"10"})json", false,
-       AttributionConfigWith([](AttributionConfig& c) {
-         c.event_level_limit =
-             EventLevelLimitWith([](AttributionConfig::EventLevelLimit& e) {
-               e.event_source_trigger_data_cardinality = 10;
-             });
-       })},
+       [](AttributionConfig& c) {
+         c.event_level_limit.event_source_trigger_data_cardinality = 10;
+       }},
       {R"json({"randomized_response_epsilon":"inf"})json", false,
-       AttributionConfigWith([](AttributionConfig& c) {
-         c.event_level_limit =
-             EventLevelLimitWith([](AttributionConfig::EventLevelLimit& e) {
-               e.randomized_response_epsilon =
-                   std::numeric_limits<double>::infinity();
-             });
-       })},
+       [](AttributionConfig& c) {
+         c.event_level_limit.randomized_response_epsilon =
+             std::numeric_limits<double>::infinity();
+       }},
       {R"json({"max_event_level_reports_per_destination":"10"})json", false,
-       AttributionConfigWith([](AttributionConfig& c) {
-         c.event_level_limit =
-             EventLevelLimitWith([](AttributionConfig::EventLevelLimit& e) {
-               e.max_reports_per_destination = 10;
-             });
-       })},
+       [](AttributionConfig& c) {
+         c.event_level_limit.max_reports_per_destination = 10;
+       }},
       {R"json({"max_navigation_info_gain":"0.2"})json", false,
-       AttributionConfigWith([](AttributionConfig& c) {
-         c.event_level_limit =
-             EventLevelLimitWith([](AttributionConfig::EventLevelLimit& e) {
-               e.max_navigation_info_gain = 0.2;
-             });
-       })},
+       [](AttributionConfig& c) {
+         c.event_level_limit.max_navigation_info_gain = 0.2;
+       }},
       {R"json({"max_event_info_gain":"0.2"})json", false,
-       AttributionConfigWith([](AttributionConfig& c) {
-         c.event_level_limit =
-             EventLevelLimitWith([](AttributionConfig::EventLevelLimit& e) {
-               e.max_event_info_gain = 0.2;
-             });
-       })},
+       [](AttributionConfig& c) {
+         c.event_level_limit.max_event_info_gain = 0.2;
+       }},
       {R"json({"max_aggregatable_reports_per_destination":"10"})json", false,
-       AttributionConfigWith([](AttributionConfig& c) {
-         c.aggregate_limit =
-             AggregateLimitWith([](AttributionConfig::AggregateLimit& a) {
-               a.max_reports_per_destination = 10;
-             });
-       })},
+       [](AttributionConfig& c) {
+         c.aggregate_limit.max_reports_per_destination = 10;
+       }},
       {R"json({"aggregatable_budget_per_source":"100"})json", false,
-       AttributionConfigWith([](AttributionConfig& c) {
-         c.aggregate_limit =
-             AggregateLimitWith([](AttributionConfig::AggregateLimit& a) {
-               a.aggregatable_budget_per_source = 100;
-             });
-       })},
+       [](AttributionConfig& c) {
+         c.aggregate_limit.aggregatable_budget_per_source = 100;
+       }},
       {R"json({"aggregatable_report_min_delay":"0"})json", false,
-       AttributionConfigWith([](AttributionConfig& c) {
-         c.aggregate_limit =
-             AggregateLimitWith([](AttributionConfig::AggregateLimit& a) {
-               a.min_delay = base::TimeDelta();
-             });
-       })},
+       [](AttributionConfig& c) {
+         c.aggregate_limit.min_delay = base::TimeDelta();
+       }},
       {R"json({"aggregatable_report_delay_span":"0"})json", false,
-       AttributionConfigWith([](AttributionConfig& c) {
-         c.aggregate_limit =
-             AggregateLimitWith([](AttributionConfig::AggregateLimit& a) {
-               a.delay_span = base::TimeDelta();
-             });
-       })},
+       [](AttributionConfig& c) {
+         c.aggregate_limit.delay_span = base::TimeDelta();
+       }},
       {R"json({
         "max_sources_per_origin":"10",
         "max_destinations_per_source_site_reporting_site":"10",
@@ -640,49 +594,46 @@
         "aggregatable_report_min_delay":"10",
         "aggregatable_report_delay_span":"20"
       })json",
-       true, AttributionConfigWith([](AttributionConfig& c) {
+       true, [](AttributionConfig& c) {
          c.max_sources_per_origin = 10;
          c.max_destinations_per_source_site_reporting_site = 10;
-         c.rate_limit =
-             RateLimitWith([](AttributionConfig::RateLimitConfig& r) {
-               r.time_window = base::Days(10);
-               r.max_source_registration_reporting_origins = 20;
-               r.max_attribution_reporting_origins = 15;
-               r.max_attributions = 10;
-               r.max_reporting_origins_per_source_reporting_site = 5;
-               r.origins_per_site_window = base::Days(5);
-             });
-         c.event_level_limit =
-             EventLevelLimitWith([](AttributionConfig::EventLevelLimit& e) {
-               e.navigation_source_trigger_data_cardinality = 100;
-               e.event_source_trigger_data_cardinality = 10;
-               e.randomized_response_epsilon = 0.2;
-               e.max_reports_per_destination = 10;
-               e.max_navigation_info_gain = 5.5;
-               e.max_event_info_gain = 0.5;
-             });
-         c.aggregate_limit =
-             AggregateLimitWith([](AttributionConfig::AggregateLimit& a) {
-               a.max_reports_per_destination = 10;
-               a.aggregatable_budget_per_source = 1000;
-               a.min_delay = base::Minutes(10);
-               a.delay_span = base::Minutes(20);
-             });
+
+         c.rate_limit.time_window = base::Days(10);
+         c.rate_limit.max_source_registration_reporting_origins = 20;
+         c.rate_limit.max_attribution_reporting_origins = 15;
+         c.rate_limit.max_attributions = 10;
+         c.rate_limit.max_reporting_origins_per_source_reporting_site = 5;
+         c.rate_limit.origins_per_site_window = base::Days(5);
+
+         c.event_level_limit.navigation_source_trigger_data_cardinality = 100;
+         c.event_level_limit.event_source_trigger_data_cardinality = 10;
+         c.event_level_limit.randomized_response_epsilon = 0.2;
+         c.event_level_limit.max_reports_per_destination = 10;
+         c.event_level_limit.max_navigation_info_gain = 5.5;
+         c.event_level_limit.max_event_info_gain = 0.5;
+
+         c.aggregate_limit.max_reports_per_destination = 10;
+         c.aggregate_limit.aggregatable_budget_per_source = 1000;
+         c.aggregate_limit.min_delay = base::Minutes(10);
+         c.aggregate_limit.delay_span = base::Minutes(20);
+
          c.destination_rate_limit = {.max_total = 2,
                                      .max_per_reporting_site = 1,
                                      .rate_limit_window = base::Minutes(10)};
-       })}};
+       }}};
 
   for (const auto& test_case : kTestCases) {
+    AttributionConfig expected;
+    test_case.make_expected(expected);
+
     base::Value::Dict json = base::test::ParseJsonDict(test_case.json);
     if (test_case.required) {
-      EXPECT_THAT(ParseAttributionConfig(json),
-                  base::test::ValueIs(test_case.expected))
+      EXPECT_THAT(ParseAttributionConfig(json), base::test::ValueIs(expected))
           << json;
     } else {
       AttributionConfig config;
       EXPECT_EQ("", MergeAttributionConfig(json, config)) << json;
-      EXPECT_EQ(config, test_case.expected) << json;
+      EXPECT_EQ(config, expected) << json;
     }
   }
 }

diff --git a/content/browser/attribution_reporting/attribution_os_level_manager.h b/content/browser/attribution_reporting/attribution_os_level_manager.h
index 174421fd..a57ac98 100644
--- a/content/browser/attribution_reporting/attribution_os_level_manager.h
+++ b/content/browser/attribution_reporting/attribution_os_level_manager.h

@@ -11,7 +11,6 @@
 #include "base/functional/callback_forward.h"
 #include "content/common/content_export.h"
 #include "content/public/browser/browsing_data_filter_builder.h"
-#include "content/public/browser/global_routing_id.h"
 #include "services/network/public/mojom/attribution.mojom-forward.h"
 #include "third_party/abseil-cpp/absl/types/optional.h"
 

diff --git a/content/browser/attribution_reporting/attribution_os_level_manager_android.cc b/content/browser/attribution_reporting/attribution_os_level_manager_android.cc
index bc0389de..74fcb35 100644
--- a/content/browser/attribution_reporting/attribution_os_level_manager_android.cc
+++ b/content/browser/attribution_reporting/attribution_os_level_manager_android.cc

@@ -34,6 +34,7 @@
 #include "content/public/android/content_jni_headers/AttributionOsLevelManager_jni.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/browsing_data_filter_builder.h"
+#include "content/public/browser/global_routing_id.h"
 #include "url/android/gurl_android.h"
 #include "url/gurl.h"
 #include "url/origin.h"

diff --git a/content/browser/attribution_reporting/attribution_os_level_manager_android_unittest.cc b/content/browser/attribution_reporting/attribution_os_level_manager_android_unittest.cc
index 7bb9d46f..3dd16e07 100644
--- a/content/browser/attribution_reporting/attribution_os_level_manager_android_unittest.cc
+++ b/content/browser/attribution_reporting/attribution_os_level_manager_android_unittest.cc

@@ -18,6 +18,7 @@
 #include "content/browser/attribution_reporting/os_registration.h"
 #include "content/browser/attribution_reporting/test/mock_content_browser_client.h"
 #include "content/public/browser/browsing_data_filter_builder.h"
+#include "content/public/browser/global_routing_id.h"
 #include "content/public/test/browser_task_environment.h"
 #include "content/public/test/test_utils.h"
 #include "testing/gmock/include/gmock/gmock.h"

diff --git a/content/browser/attribution_reporting/attribution_storage_unittest.cc b/content/browser/attribution_reporting/attribution_storage_unittest.cc
index 6de5ba3..37ae732a 100644
--- a/content/browser/attribution_reporting/attribution_storage_unittest.cc
+++ b/content/browser/attribution_reporting/attribution_storage_unittest.cc

@@ -1283,15 +1283,15 @@
 }
 
 TEST_F(AttributionStorageTest, MaxAttributionsBetweenSites) {
-  delegate()->set_rate_limits(
-      RateLimitWith([](AttributionConfig::RateLimitConfig& r) {
-        r.time_window = base::TimeDelta::Max();
-        r.max_source_registration_reporting_origins =
-            std::numeric_limits<int64_t>::max();
-        r.max_attribution_reporting_origins =
-            std::numeric_limits<int64_t>::max();
-        r.max_attributions = 2;
-      }));
+  delegate()->set_rate_limits([]() {
+    AttributionConfig::RateLimitConfig r;
+    r.time_window = base::TimeDelta::Max();
+    r.max_source_registration_reporting_origins =
+        std::numeric_limits<int64_t>::max();
+    r.max_attribution_reporting_origins = std::numeric_limits<int64_t>::max();
+    r.max_attributions = 2;
+    return r;
+  }());
 
   SourceBuilder source_builder = TestAggregatableSourceProvider().GetBuilder();
   storage()->StoreSource(source_builder.Build());
@@ -1342,15 +1342,15 @@
 
 TEST_F(AttributionStorageTest,
        MaxAttributionReportsBetweenSites_IgnoresSourceType) {
-  delegate()->set_rate_limits(
-      RateLimitWith([](AttributionConfig::RateLimitConfig& r) {
-        r.time_window = base::TimeDelta::Max();
-        r.max_source_registration_reporting_origins =
-            std::numeric_limits<int64_t>::max();
-        r.max_attribution_reporting_origins =
-            std::numeric_limits<int64_t>::max();
-        r.max_attributions = 1;
-      }));
+  delegate()->set_rate_limits([]() {
+    AttributionConfig::RateLimitConfig r;
+    r.time_window = base::TimeDelta::Max();
+    r.max_source_registration_reporting_origins =
+        std::numeric_limits<int64_t>::max();
+    r.max_attribution_reporting_origins = std::numeric_limits<int64_t>::max();
+    r.max_attributions = 1;
+    return r;
+  }());
 
   storage()->StoreSource(
       SourceBuilder().SetSourceType(SourceType::kNavigation).Build());
@@ -1444,15 +1444,15 @@
 }
 
 TEST_F(AttributionStorageTest, NeverAttributeImpression_RateLimitsChanged) {
-  delegate()->set_rate_limits(
-      RateLimitWith([](AttributionConfig::RateLimitConfig& r) {
-        r.time_window = base::TimeDelta::Max();
-        r.max_source_registration_reporting_origins =
-            std::numeric_limits<int64_t>::max();
-        r.max_attribution_reporting_origins =
-            std::numeric_limits<int64_t>::max();
-        r.max_attributions = 1;
-      }));
+  delegate()->set_rate_limits([]() {
+    AttributionConfig::RateLimitConfig r;
+    r.time_window = base::TimeDelta::Max();
+    r.max_source_registration_reporting_origins =
+        std::numeric_limits<int64_t>::max();
+    r.max_attribution_reporting_origins = std::numeric_limits<int64_t>::max();
+    r.max_attributions = 1;
+    return r;
+  }());
 
   delegate()->set_randomized_response(
       std::vector<AttributionStorageDelegate::FakeReport>{});
@@ -1474,15 +1474,15 @@
 
 TEST_F(AttributionStorageTest,
        NeverAttributeSource_AggregatableReportStoredAndRateLimitsChanged) {
-  delegate()->set_rate_limits(
-      RateLimitWith([](AttributionConfig::RateLimitConfig& r) {
-        r.time_window = base::TimeDelta::Max();
-        r.max_source_registration_reporting_origins =
-            std::numeric_limits<int64_t>::max();
-        r.max_attribution_reporting_origins =
-            std::numeric_limits<int64_t>::max();
-        r.max_attributions = 2;
-      }));
+  delegate()->set_rate_limits([]() {
+    AttributionConfig::RateLimitConfig r;
+    r.time_window = base::TimeDelta::Max();
+    r.max_source_registration_reporting_origins =
+        std::numeric_limits<int64_t>::max();
+    r.max_attribution_reporting_origins = std::numeric_limits<int64_t>::max();
+    r.max_attributions = 2;
+    return r;
+  }());
 
   SourceBuilder builder = TestAggregatableSourceProvider().GetBuilder();
 
@@ -1890,15 +1890,15 @@
 }
 
 TEST_F(AttributionStorageTest, FalselyAttributeImpression_ReportStored) {
-  delegate()->set_rate_limits(
-      RateLimitWith([](AttributionConfig::RateLimitConfig& r) {
-        r.time_window = base::TimeDelta::Max();
-        r.max_source_registration_reporting_origins =
-            std::numeric_limits<int64_t>::max();
-        r.max_attribution_reporting_origins =
-            std::numeric_limits<int64_t>::max();
-        r.max_attributions = 2;
-      }));
+  delegate()->set_rate_limits([]() {
+    AttributionConfig::RateLimitConfig r;
+    r.time_window = base::TimeDelta::Max();
+    r.max_source_registration_reporting_origins =
+        std::numeric_limits<int64_t>::max();
+    r.max_attribution_reporting_origins = std::numeric_limits<int64_t>::max();
+    r.max_attributions = 2;
+    return r;
+  }());
 
   const base::Time fake_report_time = base::Time::Now() + kReportDelay;
   const base::Time fake_trigger_time = fake_report_time - base::Microseconds(1);
@@ -3067,14 +3067,14 @@
 // This is tested more thoroughly by the `RateLimitTable` unit tests. Here just
 // ensure that the rate limits are consulted at all.
 TEST_F(AttributionStorageTest, MaxReportingOriginsPerSource) {
-  delegate()->set_rate_limits(
-      RateLimitWith([](AttributionConfig::RateLimitConfig& r) {
-        r.time_window = base::TimeDelta::Max();
-        r.max_source_registration_reporting_origins = 2;
-        r.max_attribution_reporting_origins =
-            std::numeric_limits<int64_t>::max();
-        r.max_attributions = std::numeric_limits<int64_t>::max();
-      }));
+  delegate()->set_rate_limits([]() {
+    AttributionConfig::RateLimitConfig r;
+    r.time_window = base::TimeDelta::Max();
+    r.max_source_registration_reporting_origins = 2;
+    r.max_attribution_reporting_origins = std::numeric_limits<int64_t>::max();
+    r.max_attributions = std::numeric_limits<int64_t>::max();
+    return r;
+  }());
 
   auto result = storage()->StoreSource(
       SourceBuilder()
@@ -3104,14 +3104,15 @@
 // This is tested more thoroughly by the `RateLimitTable` unit tests. Here just
 // ensure that the rate limits are consulted at all.
 TEST_F(AttributionStorageTest, MaxReportingOriginsPerAttribution) {
-  delegate()->set_rate_limits(
-      RateLimitWith([](AttributionConfig::RateLimitConfig& r) {
-        r.time_window = base::TimeDelta::Max();
-        r.max_source_registration_reporting_origins =
-            std::numeric_limits<int64_t>::max();
-        r.max_attribution_reporting_origins = 2;
-        r.max_attributions = std::numeric_limits<int64_t>::max();
-      }));
+  delegate()->set_rate_limits([]() {
+    AttributionConfig::RateLimitConfig r;
+    r.time_window = base::TimeDelta::Max();
+    r.max_source_registration_reporting_origins =
+        std::numeric_limits<int64_t>::max();
+    r.max_attribution_reporting_origins = 2;
+    r.max_attributions = std::numeric_limits<int64_t>::max();
+    return r;
+  }());
 
   const auto origin1 = *SuitableOrigin::Deserialize("https://r1.test");
   const auto origin2 = *SuitableOrigin::Deserialize("https://r2.test");
@@ -3840,15 +3841,15 @@
 
 TEST_F(AttributionStorageTest, MaxAttributions_BoundedBySourceTimeWindow) {
   constexpr base::TimeDelta kTimeWindow = base::Days(1);
-  delegate()->set_rate_limits(
-      RateLimitWith([kTimeWindow](AttributionConfig::RateLimitConfig& r) {
-        r.time_window = kTimeWindow;
-        r.max_source_registration_reporting_origins =
-            std::numeric_limits<int64_t>::max();
-        r.max_attribution_reporting_origins =
-            std::numeric_limits<int64_t>::max();
-        r.max_attributions = 1;
-      }));
+  delegate()->set_rate_limits([kTimeWindow]() {
+    AttributionConfig::RateLimitConfig r;
+    r.time_window = kTimeWindow;
+    r.max_source_registration_reporting_origins =
+        std::numeric_limits<int64_t>::max();
+    r.max_attribution_reporting_origins = std::numeric_limits<int64_t>::max();
+    r.max_attributions = 1;
+    return r;
+  }());
 
   storage()->StoreSource(SourceBuilder().SetExpiry(base::Days(7)).Build());
 
@@ -4009,10 +4010,11 @@
 }
 
 TEST_F(AttributionStorageTest, MaxSourceReportingOriginsPerSite) {
-  delegate()->set_rate_limits(
-      RateLimitWith([](AttributionConfig::RateLimitConfig& r) {
-        r.max_reporting_origins_per_source_reporting_site = 1;
-      }));
+  delegate()->set_rate_limits([]() {
+    AttributionConfig::RateLimitConfig r;
+    r.max_reporting_origins_per_source_reporting_site = 1;
+    return r;
+  }());
 
   auto store_source = [&](std::string source, std::string reporting) {
     return storage()

diff --git a/content/browser/attribution_reporting/attribution_test_utils.cc b/content/browser/attribution_reporting/attribution_test_utils.cc
index 93c7dc2..efe7ed18 100644
--- a/content/browser/attribution_reporting/attribution_test_utils.cc
+++ b/content/browser/attribution_reporting/attribution_test_utils.cc

@@ -14,7 +14,6 @@
 #include "base/check.h"
 #include "base/functional/callback.h"
 #include "base/functional/callback_helpers.h"
-#include "base/functional/function_ref.h"
 #include "base/run_loop.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/test/bind.h"
@@ -30,7 +29,6 @@
 #include "components/attribution_reporting/suitable_origin.h"
 #include "components/attribution_reporting/test_utils.h"
 #include "components/attribution_reporting/trigger_registration.h"
-#include "content/browser/attribution_reporting/attribution_config.h"
 #include "content/browser/attribution_reporting/attribution_manager.h"
 #include "content/browser/attribution_reporting/attribution_observer.h"
 #include "content/browser/attribution_reporting/attribution_reporting.mojom.h"
@@ -81,34 +79,6 @@
   return source_time + *declared_window;
 }
 
-AttributionConfig::RateLimitConfig RateLimitWith(
-    base::FunctionRef<void(AttributionConfig::RateLimitConfig&)> f) {
-  AttributionConfig::RateLimitConfig limit;
-  f(limit);
-  return limit;
-}
-
-AttributionConfig::EventLevelLimit EventLevelLimitWith(
-    base::FunctionRef<void(content::AttributionConfig::EventLevelLimit&)> f) {
-  content::AttributionConfig::EventLevelLimit limit;
-  f(limit);
-  return limit;
-}
-
-AttributionConfig::AggregateLimit AggregateLimitWith(
-    base::FunctionRef<void(content::AttributionConfig::AggregateLimit&)> f) {
-  content::AttributionConfig::AggregateLimit limit;
-  f(limit);
-  return limit;
-}
-
-AttributionConfig AttributionConfigWith(
-    base::FunctionRef<void(AttributionConfig&)> f) {
-  AttributionConfig limit;
-  f(limit);
-  return limit;
-}
-
 // Builds an impression with default values. This is done as a builder because
 // all values needed to be provided at construction time.
 SourceBuilder::SourceBuilder(base::Time time)

diff --git a/content/browser/attribution_reporting/attribution_test_utils.h b/content/browser/attribution_reporting/attribution_test_utils.h
index 56f34c9..a24481eb 100644
--- a/content/browser/attribution_reporting/attribution_test_utils.h
+++ b/content/browser/attribution_reporting/attribution_test_utils.h

@@ -12,7 +12,6 @@
 #include <vector>
 
 #include "base/containers/flat_set.h"
-#include "base/functional/function_ref.h"
 #include "base/time/time.h"
 #include "base/uuid.h"
 #include "components/attribution_reporting/aggregatable_values.h"
@@ -24,7 +23,6 @@
 #include "components/attribution_reporting/test_utils.h"
 #include "components/attribution_reporting/trigger_registration.h"
 #include "content/browser/attribution_reporting/aggregatable_histogram_contribution.h"
-#include "content/browser/attribution_reporting/attribution_config.h"
 #include "content/browser/attribution_reporting/attribution_info.h"
 #include "content/browser/attribution_reporting/attribution_report.h"
 #include "content/browser/attribution_reporting/attribution_storage_delegate.h"
@@ -64,18 +62,6 @@
     absl::optional<base::TimeDelta> declared_window,
     base::Time source_time);
 
-AttributionConfig::RateLimitConfig RateLimitWith(
-    base::FunctionRef<void(AttributionConfig::RateLimitConfig&)> f);
-
-AttributionConfig::EventLevelLimit EventLevelLimitWith(
-    base::FunctionRef<void(content::AttributionConfig::EventLevelLimit&)> f);
-
-AttributionConfig::AggregateLimit AggregateLimitWith(
-    base::FunctionRef<void(content::AttributionConfig::AggregateLimit&)> f);
-
-AttributionConfig AttributionConfigWith(
-    base::FunctionRef<void(AttributionConfig&)> f);
-
 // Helper class to construct a StorableSource for tests using default data.
 // StorableSource members are not mutable after construction requiring a
 // builder pattern.

diff --git a/content/browser/attribution_reporting/rate_limit_table_unittest.cc b/content/browser/attribution_reporting/rate_limit_table_unittest.cc
index 7952f8e..28f0bf7 100644
--- a/content/browser/attribution_reporting/rate_limit_table_unittest.cc
+++ b/content/browser/attribution_reporting/rate_limit_table_unittest.cc

@@ -282,15 +282,15 @@
 TEST_F(RateLimitTableTest,
        AttributionAllowedForAttributionCountLimit_ScopedCorrectly) {
   constexpr base::TimeDelta kTimeWindow = base::Days(1);
-  delegate_.set_rate_limits(
-      RateLimitWith([kTimeWindow](AttributionConfig::RateLimitConfig& r) {
-        r.time_window = kTimeWindow;
-        r.max_source_registration_reporting_origins =
-            std::numeric_limits<int64_t>::max();
-        r.max_attribution_reporting_origins =
-            std::numeric_limits<int64_t>::max();
-        r.max_attributions = 2;
-      }));
+  delegate_.set_rate_limits([kTimeWindow]() {
+    AttributionConfig::RateLimitConfig r;
+    r.time_window = kTimeWindow;
+    r.max_source_registration_reporting_origins =
+        std::numeric_limits<int64_t>::max();
+    r.max_attribution_reporting_origins = std::numeric_limits<int64_t>::max();
+    r.max_attributions = 2;
+    return r;
+  }());
 
   const base::Time now = base::Time::Now();
 
@@ -362,15 +362,15 @@
 
 TEST_F(RateLimitTableTest,
        AttributionAllowedForAttributionCountLimit_SourceTypesCombined) {
-  delegate_.set_rate_limits(
-      RateLimitWith([](AttributionConfig::RateLimitConfig& r) {
-        r.time_window = base::Days(1);
-        r.max_source_registration_reporting_origins =
-            std::numeric_limits<int64_t>::max();
-        r.max_attribution_reporting_origins =
-            std::numeric_limits<int64_t>::max();
-        r.max_attributions = 2;
-      }));
+  delegate_.set_rate_limits([]() {
+    AttributionConfig::RateLimitConfig r;
+    r.time_window = base::Days(1);
+    r.max_source_registration_reporting_origins =
+        std::numeric_limits<int64_t>::max();
+    r.max_attribution_reporting_origins = std::numeric_limits<int64_t>::max();
+    r.max_attributions = 2;
+    return r;
+  }());
 
   const auto navigation_source =
       SourceBuilder()
@@ -450,14 +450,14 @@
 
 TEST_F(RateLimitTableTest, SourceAllowedForReportingOriginLimit) {
   constexpr base::TimeDelta kTimeWindow = base::Days(1);
-  delegate_.set_rate_limits(
-      RateLimitWith([kTimeWindow](AttributionConfig::RateLimitConfig& r) {
-        r.time_window = kTimeWindow;
-        r.max_source_registration_reporting_origins = 2;
-        r.max_attribution_reporting_origins =
-            std::numeric_limits<int64_t>::max();
-        r.max_attributions = std::numeric_limits<int64_t>::max();
-      }));
+  delegate_.set_rate_limits([kTimeWindow]() {
+    AttributionConfig::RateLimitConfig r;
+    r.time_window = kTimeWindow;
+    r.max_source_registration_reporting_origins = 2;
+    r.max_attribution_reporting_origins = std::numeric_limits<int64_t>::max();
+    r.max_attributions = std::numeric_limits<int64_t>::max();
+    return r;
+  }());
 
   const base::Time now = base::Time::Now();
 
@@ -505,13 +505,13 @@
 TEST_F(RateLimitTableTest,
        SourceAllowedForReportingOriginPerSourceReportingSiteLimit) {
   constexpr base::TimeDelta kTimeWindow = base::Days(1);
-  delegate_.set_rate_limits(
-      RateLimitWith([kTimeWindow](AttributionConfig::RateLimitConfig& r) {
-        r.max_attribution_reporting_origins =
-            std::numeric_limits<int64_t>::max();
-        r.max_attributions = std::numeric_limits<int64_t>::max();
-        r.origins_per_site_window = kTimeWindow;
-      }));
+  delegate_.set_rate_limits([kTimeWindow]() {
+    AttributionConfig::RateLimitConfig r;
+    r.max_attribution_reporting_origins = std::numeric_limits<int64_t>::max();
+    r.max_attributions = std::numeric_limits<int64_t>::max();
+    r.origins_per_site_window = kTimeWindow;
+    return r;
+  }());
 
   const base::Time now = base::Time::Now();
 
@@ -575,14 +575,15 @@
 
 TEST_F(RateLimitTableTest, AttributionAllowedForReportingOriginLimit) {
   constexpr base::TimeDelta kTimeWindow = base::Days(1);
-  delegate_.set_rate_limits(
-      RateLimitWith([kTimeWindow](AttributionConfig::RateLimitConfig& r) {
-        r.time_window = kTimeWindow;
-        r.max_source_registration_reporting_origins =
-            std::numeric_limits<int64_t>::max();
-        r.max_attribution_reporting_origins = 2;
-        r.max_attributions = std::numeric_limits<int64_t>::max();
-      }));
+  delegate_.set_rate_limits([kTimeWindow]() {
+    AttributionConfig::RateLimitConfig r;
+    r.time_window = kTimeWindow;
+    r.max_source_registration_reporting_origins =
+        std::numeric_limits<int64_t>::max();
+    r.max_attribution_reporting_origins = 2;
+    r.max_attributions = std::numeric_limits<int64_t>::max();
+    return r;
+  }());
 
   const base::Time now = base::Time::Now();
 
@@ -613,13 +614,14 @@
 
 TEST_F(RateLimitTableTest,
        ReportingOriginLimits_IndependentForSourcesAndAttributions) {
-  delegate_.set_rate_limits(
-      RateLimitWith([](AttributionConfig::RateLimitConfig& r) {
-        r.time_window = base::Days(1);
-        r.max_source_registration_reporting_origins = 2;
-        r.max_attribution_reporting_origins = 1;
-        r.max_attributions = std::numeric_limits<int64_t>::max();
-      }));
+  delegate_.set_rate_limits([]() {
+    AttributionConfig::RateLimitConfig r;
+    r.time_window = base::Days(1);
+    r.max_source_registration_reporting_origins = 2;
+    r.max_attribution_reporting_origins = 1;
+    r.max_attributions = std::numeric_limits<int64_t>::max();
+    return r;
+  }());
 
   const base::Time now = base::Time::Now();
 
@@ -854,15 +856,15 @@
 }
 
 TEST_F(RateLimitTableTest, AddRateLimit_DeletesExpiredRows) {
-  delegate_.set_rate_limits(
-      RateLimitWith([](AttributionConfig::RateLimitConfig& r) {
-        r.time_window = base::Minutes(2);
-        r.max_source_registration_reporting_origins =
-            std::numeric_limits<int64_t>::max();
-        r.max_attribution_reporting_origins =
-            std::numeric_limits<int64_t>::max();
-        r.max_attributions = INT_MAX;
-      }));
+  delegate_.set_rate_limits([]() {
+    AttributionConfig::RateLimitConfig r;
+    r.time_window = base::Minutes(2);
+    r.max_source_registration_reporting_origins =
+        std::numeric_limits<int64_t>::max();
+    r.max_attribution_reporting_origins = std::numeric_limits<int64_t>::max();
+    r.max_attributions = INT_MAX;
+    return r;
+  }());
 
   delegate_.set_delete_expired_rate_limits_frequency(base::Minutes(4));
 
@@ -943,15 +945,15 @@
 }
 
 TEST_F(RateLimitTableTest, AddRateLimitSource_DeletesExpiredRows) {
-  delegate_.set_rate_limits(
-      RateLimitWith([](AttributionConfig::RateLimitConfig& r) {
-        r.time_window = base::Minutes(2);
-        r.max_source_registration_reporting_origins =
-            std::numeric_limits<int64_t>::max();
-        r.max_attribution_reporting_origins =
-            std::numeric_limits<int64_t>::max();
-        r.max_attributions = INT_MAX;
-      }));
+  delegate_.set_rate_limits([]() {
+    AttributionConfig::RateLimitConfig r;
+    r.time_window = base::Minutes(2);
+    r.max_source_registration_reporting_origins =
+        std::numeric_limits<int64_t>::max();
+    r.max_attribution_reporting_origins = std::numeric_limits<int64_t>::max();
+    r.max_attributions = INT_MAX;
+    return r;
+  }());
 
   delegate_.set_delete_expired_rate_limits_frequency(base::Minutes(4));
 
@@ -1395,13 +1397,13 @@
 TEST_F(RateLimitTableFieldTrialLimitsTest,
        SourceAllowedForReportingOriginPerSourceReportingSiteLimit) {
   constexpr base::TimeDelta kTimeWindow = base::Days(1);
-  delegate_.set_rate_limits(
-      RateLimitWith([kTimeWindow](AttributionConfig::RateLimitConfig& r) {
-        r.max_attribution_reporting_origins =
-            std::numeric_limits<int64_t>::max();
-        r.max_attributions = std::numeric_limits<int64_t>::max();
-        r.origins_per_site_window = kTimeWindow;
-      }));
+  delegate_.set_rate_limits([kTimeWindow]() {
+    AttributionConfig::RateLimitConfig r;
+    r.max_attribution_reporting_origins = std::numeric_limits<int64_t>::max();
+    r.max_attributions = std::numeric_limits<int64_t>::max();
+    r.origins_per_site_window = kTimeWindow;
+    return r;
+  }());
 
   const base::Time now = base::Time::Now();
 

diff --git a/content/browser/attribution_reporting/test/configurable_storage_delegate.cc b/content/browser/attribution_reporting/test/configurable_storage_delegate.cc
index 048ea5d..18518c8 100644
--- a/content/browser/attribution_reporting/test/configurable_storage_delegate.cc
+++ b/content/browser/attribution_reporting/test/configurable_storage_delegate.cc

@@ -28,43 +28,39 @@
 namespace content {
 
 ConfigurableStorageDelegate::ConfigurableStorageDelegate()
-    : AttributionStorageDelegate(
-          AttributionConfigWith([](AttributionConfig& c) {
-            c.max_sources_per_origin = std::numeric_limits<int>::max(),
-            c.max_destinations_per_source_site_reporting_site =
-                std::numeric_limits<int>::max();
-            c.rate_limit =
-                RateLimitWith([](AttributionConfig::RateLimitConfig& r) {
-                  r.time_window = base::TimeDelta::Max();
-                  r.max_source_registration_reporting_origins =
-                      std::numeric_limits<int64_t>::max();
-                  r.max_attribution_reporting_origins =
-                      std::numeric_limits<int64_t>::max();
-                  r.max_attributions = std::numeric_limits<int64_t>::max();
-                  r.max_reporting_origins_per_source_reporting_site =
-                      std::numeric_limits<int>::max();
-                }),
-            c.event_level_limit =
-                EventLevelLimitWith([](AttributionConfig::EventLevelLimit& e) {
-                  e.navigation_source_trigger_data_cardinality =
-                      std::numeric_limits<uint64_t>::max();
-                  e.event_source_trigger_data_cardinality =
-                      std::numeric_limits<uint64_t>::max();
-                  e.randomized_response_epsilon =
-                      std::numeric_limits<double>::infinity();
-                  e.max_reports_per_destination =
-                      std::numeric_limits<int>::max();
-                });
-            c.aggregate_limit =
-                AggregateLimitWith([](AttributionConfig::AggregateLimit& a) {
-                  a.max_reports_per_destination =
-                      std::numeric_limits<int>::max();
-                  a.aggregatable_budget_per_source =
-                      std::numeric_limits<int64_t>::max();
-                  a.min_delay = base::TimeDelta();
-                  a.delay_span = base::TimeDelta();
-                });
-          })) {}
+    : AttributionStorageDelegate([]() {
+        AttributionConfig c;
+        c.max_sources_per_origin = std::numeric_limits<int>::max(),
+        c.max_destinations_per_source_site_reporting_site =
+            std::numeric_limits<int>::max();
+
+        c.rate_limit.time_window = base::TimeDelta::Max();
+        c.rate_limit.max_source_registration_reporting_origins =
+            std::numeric_limits<int64_t>::max();
+        c.rate_limit.max_attribution_reporting_origins =
+            std::numeric_limits<int64_t>::max();
+        c.rate_limit.max_attributions = std::numeric_limits<int64_t>::max();
+        c.rate_limit.max_reporting_origins_per_source_reporting_site =
+            std::numeric_limits<int>::max();
+
+        c.event_level_limit.navigation_source_trigger_data_cardinality =
+            std::numeric_limits<uint64_t>::max();
+        c.event_level_limit.event_source_trigger_data_cardinality =
+            std::numeric_limits<uint64_t>::max();
+        c.event_level_limit.randomized_response_epsilon =
+            std::numeric_limits<double>::infinity();
+        c.event_level_limit.max_reports_per_destination =
+            std::numeric_limits<int>::max();
+
+        c.aggregate_limit.max_reports_per_destination =
+            std::numeric_limits<int>::max();
+        c.aggregate_limit.aggregatable_budget_per_source =
+            std::numeric_limits<int64_t>::max();
+        c.aggregate_limit.min_delay = base::TimeDelta();
+        c.aggregate_limit.delay_span = base::TimeDelta();
+
+        return c;
+      }()) {}
 
 ConfigurableStorageDelegate::~ConfigurableStorageDelegate() = default;
 

diff --git a/content/browser/attribution_reporting/test/mock_content_browser_client.h b/content/browser/attribution_reporting/test/mock_content_browser_client.h
index 3676bec..ee1a54b 100644
--- a/content/browser/attribution_reporting/test/mock_content_browser_client.h
+++ b/content/browser/attribution_reporting/test/mock_content_browser_client.h

@@ -36,12 +36,12 @@
 
   MOCK_METHOD(bool,
               ShouldUseOsWebSourceAttributionReporting,
-              (RenderFrameHost * rfh),
+              (RenderFrameHost*),
               (override));
 
   MOCK_METHOD(bool,
               ShouldUseOsWebTriggerAttributionReporting,
-              (RenderFrameHost * rfh),
+              (RenderFrameHost*),
               (override));
 
   MOCK_METHOD(bool,

diff --git a/content/browser/cookie_deprecation_label/cookie_deprecation_label_manager_impl.cc b/content/browser/cookie_deprecation_label/cookie_deprecation_label_manager_impl.cc
index 4af0ec83..72f301a 100644
--- a/content/browser/cookie_deprecation_label/cookie_deprecation_label_manager_impl.cc
+++ b/content/browser/cookie_deprecation_label/cookie_deprecation_label_manager_impl.cc

@@ -17,8 +17,8 @@
 
 namespace {
 
-const base::FeatureParam<std::string> kCookieDeprecationLabel{
-    &features::kCookieDeprecationFacilitatedTesting, "label", ""};
+const base::FeatureParam<bool> kSkipCookieDeprecationLabelForStoragePartitions{
+    &features::kCookieDeprecationFacilitatedTesting, "skip_label", false};
 
 }  // namespace
 
@@ -49,9 +49,14 @@
   return GetValueInternal();
 }
 
-std::string CookieDeprecationLabelManagerImpl::GetValueInternal() {
+absl::optional<std::string>
+CookieDeprecationLabelManagerImpl::GetValueInternal() {
+  if (kSkipCookieDeprecationLabelForStoragePartitions.Get()) {
+    return absl::nullopt;
+  }
+
   if (!label_value_.has_value()) {
-    label_value_ = kCookieDeprecationLabel.Get();
+    label_value_ = features::kCookieDeprecationLabel.Get();
   }
 
   return *label_value_;

diff --git a/content/browser/cookie_deprecation_label/cookie_deprecation_label_manager_impl.h b/content/browser/cookie_deprecation_label/cookie_deprecation_label_manager_impl.h
index 6af7423..a39d733 100644
--- a/content/browser/cookie_deprecation_label/cookie_deprecation_label_manager_impl.h
+++ b/content/browser/cookie_deprecation_label/cookie_deprecation_label_manager_impl.h

@@ -41,7 +41,9 @@
                                        const url::Origin& context_origin);
 
  private:
-  std::string GetValueInternal();
+  // Sets label_value_ to the feature param and returns. Returns absl::nullopt
+  // if `kSkipCookieDeprecationLabelForStoragePartitions` is true.
+  absl::optional<std::string> GetValueInternal();
 
   // `this` is owned by the `StoragePartitionImpl`, which itself is
   // owned by `browser_context_`.

diff --git a/content/browser/cookie_deprecation_label/cookie_deprecation_label_manager_impl_unittest.cc b/content/browser/cookie_deprecation_label/cookie_deprecation_label_manager_impl_unittest.cc
index 4f7853f5..0237d9e 100644
--- a/content/browser/cookie_deprecation_label/cookie_deprecation_label_manager_impl_unittest.cc
+++ b/content/browser/cookie_deprecation_label/cookie_deprecation_label_manager_impl_unittest.cc

@@ -19,10 +19,12 @@
 
 class CookieDeprecationLabelManagerImplTest : public testing::Test {
  public:
-  CookieDeprecationLabelManagerImplTest() : label_manager_(&browser_context_) {
+  explicit CookieDeprecationLabelManagerImplTest(bool skip_label = false)
+      : label_manager_(&browser_context_) {
+    std::string skip_label_str = skip_label ? "true" : "false";
     scoped_feature_list_.InitAndEnableFeatureWithParameters(
         features::kCookieDeprecationFacilitatedTesting,
-        {{"label", "label_test"}});
+        {{"label", "label_test"}, {"skip_label", skip_label_str}});
   }
 
  protected:
@@ -82,5 +84,23 @@
       "label_test");
 }
 
+class CookieDeprecationLabelManagerImplSkipLabelFlagTest
+    : public CookieDeprecationLabelManagerImplTest {
+ public:
+  CookieDeprecationLabelManagerImplSkipLabelFlagTest()
+      : CookieDeprecationLabelManagerImplTest(/*skip_label=*/true) {}
+};
+
+TEST_F(CookieDeprecationLabelManagerImplSkipLabelFlagTest,
+       SkipLabelFlagOn_NoLabelReturned) {
+  MockCookieDeprecationLabelContentBrowserClientBase<TestContentBrowserClient>
+      browser_client;
+  EXPECT_CALL(browser_client, IsCookieDeprecationLabelAllowed)
+      .WillOnce(testing::Return(true));
+  ScopedContentBrowserClientSetting setting(&browser_client);
+
+  EXPECT_FALSE(label_manager_.GetValue().has_value());
+}
+
 }  // namespace
 }  // namespace content

diff --git a/content/browser/renderer_host/media/media_stream_dispatcher_host.cc b/content/browser/renderer_host/media/media_stream_dispatcher_host.cc
index 28ff34e..a0933b9e 100644
--- a/content/browser/renderer_host/media/media_stream_dispatcher_host.cc
+++ b/content/browser/renderer_host/media/media_stream_dispatcher_host.cc

@@ -441,14 +441,6 @@
     return;
   }
 
-  // TODO(crbug/1379794): Move into ValidateControlsForGenerateStreams().
-  if (controls.video.stream_type ==
-          blink::mojom::MediaStreamType::DISPLAY_VIDEO_CAPTURE_SET &&
-      !base::FeatureList::IsEnabled(blink::features::kGetAllScreensMedia)) {
-    mojo::ReportBadMessage("This API has not been enabled");
-    return;
-  }
-
   if (audio_stream_selection_info_ptr->strategy ==
           blink::mojom::StreamSelectionStrategy::SEARCH_BY_SESSION_ID &&
       (!audio_stream_selection_info_ptr->session_id.has_value() ||

diff --git a/content/public/common/content_features.cc b/content/public/common/content_features.cc
index 0422c44..bbeff94 100644
--- a/content/public/common/content_features.cc
+++ b/content/public/common/content_features.cc

@@ -179,6 +179,10 @@
     kCookieDeprecationFacilitatedTestingEnableOTRProfiles{
         &kCookieDeprecationFacilitatedTesting, "enable_otr_profiles", false};
 
+// The experiment label for the cookie deprecation (Mode A/B) study.
+const base::FeatureParam<std::string> kCookieDeprecationLabel{
+    &kCookieDeprecationFacilitatedTesting, "label", ""};
+
 // Enables Blink cooperative scheduling.
 BASE_FEATURE(kCooperativeScheduling,
              "CooperativeScheduling",

diff --git a/content/public/common/content_features.h b/content/public/common/content_features.h
index ffc5424d..b9c7765 100644
--- a/content/public/common/content_features.h
+++ b/content/public/common/content_features.h

@@ -8,6 +8,8 @@
 #ifndef CONTENT_PUBLIC_COMMON_CONTENT_FEATURES_H_
 #define CONTENT_PUBLIC_COMMON_CONTENT_FEATURES_H_
 
+#include <string>
+
 #include "base/feature_list.h"
 #include "base/metrics/field_trial_params.h"
 #include "base/time/time.h"
@@ -52,6 +54,8 @@
 CONTENT_EXPORT BASE_DECLARE_FEATURE(kCookieDeprecationFacilitatedTesting);
 CONTENT_EXPORT extern const base::FeatureParam<bool>
     kCookieDeprecationFacilitatedTestingEnableOTRProfiles;
+CONTENT_EXPORT extern const base::FeatureParam<std::string>
+    kCookieDeprecationLabel;
 CONTENT_EXPORT BASE_DECLARE_FEATURE(kCooperativeScheduling);
 CONTENT_EXPORT BASE_DECLARE_FEATURE(kCrashReporting);
 CONTENT_EXPORT BASE_DECLARE_FEATURE(kDevicePosture);

diff --git a/content/test/gpu/gpu_tests/test_expectations/webgl2_conformance_expectations.txt b/content/test/gpu/gpu_tests/test_expectations/webgl2_conformance_expectations.txt
index 743bbb5..52de7b7 100644
--- a/content/test/gpu/gpu_tests/test_expectations/webgl2_conformance_expectations.txt
+++ b/content/test/gpu/gpu_tests/test_expectations/webgl2_conformance_expectations.txt

@@ -540,7 +540,6 @@
 crbug.com/1421437 [ mac amd-0x679e angle-metal ] conformance2/extensions/webgl-shader-pixel-local-storage.html [ Failure ]
 crbug.com/1487266 [ mac passthrough angle-metal amd release ] deqp/functional/gles3/texturefiltering/2d_array_combinations_05.html [ Failure ]
 
-crbug.com/1474883 [ mac amd angle-metal ] deqp/functional/gles3/texturespecification/teximage3d_depth.html [ Failure ]
 
 ## Metal Intel ##
 
@@ -848,7 +847,6 @@
 crbug.com/angleproject/7904 [ chromeos chromeos-board-amd64-generic passthrough ] WebglExtension_WEBGL_clip_cull_distance [ Failure ]
 
 # New extension tests failing on ChromeOS VM
-crbug.com/1473838 [ chromeos chromeos-board-amd64-generic passthrough ] conformance2/extensions/ext-render-snorm.html [ Failure ]
 crbug.com/1473838 [ chromeos chromeos-board-amd64-generic passthrough ] conformance2/extensions/oes-shader-multisample-interpolation.html [ Failure ]
 crbug.com/1473838 [ chromeos chromeos-board-amd64-generic passthrough ] conformance2/extensions/webgl-stencil-texturing.html [ Failure ]
 crbug.com/angleproject/8315 [ chromeos chromeos-board-amd64-generic passthrough ] WebglExtension_EXT_render_snorm [ Failure ]

diff --git a/infra/config/generated/testing/variants.pyl b/infra/config/generated/testing/variants.pyl
index 226ce9b..fa8466b 100644
--- a/infra/config/generated/testing/variants.pyl
+++ b/infra/config/generated/testing/variants.pyl

@@ -70,16 +70,16 @@
   },
   'LACROS_VERSION_SKEW_CANARY': {
     'identifier': 'Lacros version skew testing ash canary',
-    'description': 'Run with ash-chrome version 119.0.6039.0',
+    'description': 'Run with ash-chrome version 119.0.6042.0',
     'args': [
-      '--ash-chrome-path-override=../../lacros_version_skew_tests_v119.0.6039.0/test_ash_chrome',
+      '--ash-chrome-path-override=../../lacros_version_skew_tests_v119.0.6042.0/test_ash_chrome',
     ],
     'swarming': {
       'cipd_packages': [
         {
           'cipd_package': 'chromium/testing/linux-ash-chromium/x86_64/ash.zip',
-          'location': 'lacros_version_skew_tests_v119.0.6039.0',
-          'revision': 'version:119.0.6039.0',
+          'location': 'lacros_version_skew_tests_v119.0.6042.0',
+          'revision': 'version:119.0.6042.0',
         },
       ],
     },

diff --git a/infra/config/targets/lacros-version-skew-variants.json b/infra/config/targets/lacros-version-skew-variants.json
index be8d2b4..b993d061d 100644
--- a/infra/config/targets/lacros-version-skew-variants.json
+++ b/infra/config/targets/lacros-version-skew-variants.json

@@ -1,16 +1,16 @@
 {
   "LACROS_VERSION_SKEW_CANARY": {
     "args": [
-      "--ash-chrome-path-override=../../lacros_version_skew_tests_v119.0.6039.0/test_ash_chrome"
+      "--ash-chrome-path-override=../../lacros_version_skew_tests_v119.0.6042.0/test_ash_chrome"
     ],
-    "description": "Run with ash-chrome version 119.0.6039.0",
+    "description": "Run with ash-chrome version 119.0.6042.0",
     "identifier": "Lacros version skew testing ash canary",
     "swarming": {
       "cipd_packages": [
         {
           "cipd_package": "chromium/testing/linux-ash-chromium/x86_64/ash.zip",
-          "location": "lacros_version_skew_tests_v119.0.6039.0",
-          "revision": "version:119.0.6039.0"
+          "location": "lacros_version_skew_tests_v119.0.6042.0",
+          "revision": "version:119.0.6042.0"
         }
       ]
     }

diff --git a/ios_internal b/ios_internal
index 88c25fe..09f751a 160000
--- a/ios_internal
+++ b/ios_internal

@@ -1 +1 @@
-Subproject commit 88c25fe97419c9814b168f5b0b8d0fa3f8f85e9e
+Subproject commit 09f751a1a2dfd719ca4c2a41af3cab4e45c08969

diff --git a/net/http/transport_security_state_static.pins b/net/http/transport_security_state_static.pins
index b8b37b73..dc6ee2e 100644
--- a/net/http/transport_security_state_static.pins
+++ b/net/http/transport_security_state_static.pins

@@ -43,9 +43,9 @@
 #   hash function for preloaded entries again (we have already done so once).
 #
 
-# Last updated: 2023-09-30 13:30 UTC
+# Last updated: 2023-10-01 12:57 UTC
 PinsListTimestamp
-1696080610
+1696165063
 
 TestSPKI
 sha256/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

diff --git a/net/http/transport_security_state_static_pins.json b/net/http/transport_security_state_static_pins.json
index a0aa118d..9e7121d5 100644
--- a/net/http/transport_security_state_static_pins.json
+++ b/net/http/transport_security_state_static_pins.json

@@ -31,7 +31,7 @@
 // the 'static_spki_hashes' and 'bad_static_spki_hashes' fields in 'pinsets'
 // refer to, and the timestamp at which the pins list was last updated.
 //
-// Last updated: 2023-09-30 13:30 UTC
+// Last updated: 2023-10-01 12:57 UTC
 //
 {
   "pinsets": [

diff --git a/testing/buildbot/chromium.chromiumos.json b/testing/buildbot/chromium.chromiumos.json
index 167b49d..f4846b89 100644
--- a/testing/buildbot/chromium.chromiumos.json
+++ b/testing/buildbot/chromium.chromiumos.json

@@ -5176,9 +5176,9 @@
       {
         "args": [
           "--test-launcher-filter-file=../../testing/buildbot/filters/linux-lacros.interactive_ui_tests.skew.filter",
-          "--ash-chrome-path-override=../../lacros_version_skew_tests_v119.0.6039.0/test_ash_chrome"
+          "--ash-chrome-path-override=../../lacros_version_skew_tests_v119.0.6042.0/test_ash_chrome"
         ],
-        "description": "Run with ash-chrome version 119.0.6039.0",
+        "description": "Run with ash-chrome version 119.0.6042.0",
         "isolate_profile_data": true,
         "merge": {
           "script": "//testing/merge_scripts/standard_gtest_merge.py"
@@ -5188,8 +5188,8 @@
           "cipd_packages": [
             {
               "cipd_package": "chromium/testing/linux-ash-chromium/x86_64/ash.zip",
-              "location": "lacros_version_skew_tests_v119.0.6039.0",
-              "revision": "version:119.0.6039.0"
+              "location": "lacros_version_skew_tests_v119.0.6042.0",
+              "revision": "version:119.0.6042.0"
             }
           ],
           "dimensions": {
@@ -5330,9 +5330,9 @@
       {
         "args": [
           "--test-launcher-filter-file=../../testing/buildbot/filters/linux-lacros.lacros_chrome_browsertests.skew.filter",
-          "--ash-chrome-path-override=../../lacros_version_skew_tests_v119.0.6039.0/test_ash_chrome"
+          "--ash-chrome-path-override=../../lacros_version_skew_tests_v119.0.6042.0/test_ash_chrome"
         ],
-        "description": "Run with ash-chrome version 119.0.6039.0",
+        "description": "Run with ash-chrome version 119.0.6042.0",
         "isolate_profile_data": true,
         "merge": {
           "script": "//testing/merge_scripts/standard_gtest_merge.py"
@@ -5342,8 +5342,8 @@
           "cipd_packages": [
             {
               "cipd_package": "chromium/testing/linux-ash-chromium/x86_64/ash.zip",
-              "location": "lacros_version_skew_tests_v119.0.6039.0",
-              "revision": "version:119.0.6039.0"
+              "location": "lacros_version_skew_tests_v119.0.6042.0",
+              "revision": "version:119.0.6042.0"
             }
           ],
           "dimensions": {
@@ -5467,9 +5467,9 @@
       {
         "args": [
           "--test-launcher-filter-file=../../testing/buildbot/filters/linux-lacros.lacros_chrome_browsertests.skew.filter",
-          "--ash-chrome-path-override=../../lacros_version_skew_tests_v119.0.6039.0/test_ash_chrome"
+          "--ash-chrome-path-override=../../lacros_version_skew_tests_v119.0.6042.0/test_ash_chrome"
         ],
-        "description": "Run with ash-chrome version 119.0.6039.0",
+        "description": "Run with ash-chrome version 119.0.6042.0",
         "isolate_profile_data": true,
         "merge": {
           "script": "//testing/merge_scripts/standard_gtest_merge.py"
@@ -5479,8 +5479,8 @@
           "cipd_packages": [
             {
               "cipd_package": "chromium/testing/linux-ash-chromium/x86_64/ash.zip",
-              "location": "lacros_version_skew_tests_v119.0.6039.0",
-              "revision": "version:119.0.6039.0"
+              "location": "lacros_version_skew_tests_v119.0.6042.0",
+              "revision": "version:119.0.6042.0"
             }
           ],
           "dimensions": {

diff --git a/testing/buildbot/chromium.coverage.json b/testing/buildbot/chromium.coverage.json
index 01cf8fcb..204fe77 100644
--- a/testing/buildbot/chromium.coverage.json
+++ b/testing/buildbot/chromium.coverage.json

@@ -25384,9 +25384,9 @@
       {
         "args": [
           "--test-launcher-filter-file=../../testing/buildbot/filters/linux-lacros.interactive_ui_tests.skew.filter",
-          "--ash-chrome-path-override=../../lacros_version_skew_tests_v119.0.6039.0/test_ash_chrome"
+          "--ash-chrome-path-override=../../lacros_version_skew_tests_v119.0.6042.0/test_ash_chrome"
         ],
-        "description": "Run with ash-chrome version 119.0.6039.0",
+        "description": "Run with ash-chrome version 119.0.6042.0",
         "isolate_profile_data": true,
         "merge": {
           "script": "//testing/merge_scripts/standard_gtest_merge.py"
@@ -25396,8 +25396,8 @@
           "cipd_packages": [
             {
               "cipd_package": "chromium/testing/linux-ash-chromium/x86_64/ash.zip",
-              "location": "lacros_version_skew_tests_v119.0.6039.0",
-              "revision": "version:119.0.6039.0"
+              "location": "lacros_version_skew_tests_v119.0.6042.0",
+              "revision": "version:119.0.6042.0"
             }
           ],
           "dimensions": {
@@ -25532,9 +25532,9 @@
       {
         "args": [
           "--test-launcher-filter-file=../../testing/buildbot/filters/linux-lacros.lacros_chrome_browsertests.skew.filter",
-          "--ash-chrome-path-override=../../lacros_version_skew_tests_v119.0.6039.0/test_ash_chrome"
+          "--ash-chrome-path-override=../../lacros_version_skew_tests_v119.0.6042.0/test_ash_chrome"
         ],
-        "description": "Run with ash-chrome version 119.0.6039.0",
+        "description": "Run with ash-chrome version 119.0.6042.0",
         "isolate_profile_data": true,
         "merge": {
           "script": "//testing/merge_scripts/standard_gtest_merge.py"
@@ -25544,8 +25544,8 @@
           "cipd_packages": [
             {
               "cipd_package": "chromium/testing/linux-ash-chromium/x86_64/ash.zip",
-              "location": "lacros_version_skew_tests_v119.0.6039.0",
-              "revision": "version:119.0.6039.0"
+              "location": "lacros_version_skew_tests_v119.0.6042.0",
+              "revision": "version:119.0.6042.0"
             }
           ],
           "dimensions": {
@@ -25664,9 +25664,9 @@
       {
         "args": [
           "--test-launcher-filter-file=../../testing/buildbot/filters/linux-lacros.lacros_chrome_browsertests.skew.filter",
-          "--ash-chrome-path-override=../../lacros_version_skew_tests_v119.0.6039.0/test_ash_chrome"
+          "--ash-chrome-path-override=../../lacros_version_skew_tests_v119.0.6042.0/test_ash_chrome"
         ],
-        "description": "Run with ash-chrome version 119.0.6039.0",
+        "description": "Run with ash-chrome version 119.0.6042.0",
         "isolate_profile_data": true,
         "merge": {
           "script": "//testing/merge_scripts/standard_gtest_merge.py"
@@ -25676,8 +25676,8 @@
           "cipd_packages": [
             {
               "cipd_package": "chromium/testing/linux-ash-chromium/x86_64/ash.zip",
-              "location": "lacros_version_skew_tests_v119.0.6039.0",
-              "revision": "version:119.0.6039.0"
+              "location": "lacros_version_skew_tests_v119.0.6042.0",
+              "revision": "version:119.0.6042.0"
             }
           ],
           "dimensions": {

diff --git a/testing/buildbot/chromium.fyi.json b/testing/buildbot/chromium.fyi.json
index 450e1e1..36d2296 100644
--- a/testing/buildbot/chromium.fyi.json
+++ b/testing/buildbot/chromium.fyi.json

@@ -43572,9 +43572,9 @@
       {
         "args": [
           "--test-launcher-filter-file=../../testing/buildbot/filters/linux-lacros.interactive_ui_tests.skew.filter",
-          "--ash-chrome-path-override=../../lacros_version_skew_tests_v119.0.6039.0/test_ash_chrome"
+          "--ash-chrome-path-override=../../lacros_version_skew_tests_v119.0.6042.0/test_ash_chrome"
         ],
-        "description": "Run with ash-chrome version 119.0.6039.0",
+        "description": "Run with ash-chrome version 119.0.6042.0",
         "merge": {
           "script": "//testing/merge_scripts/standard_gtest_merge.py"
         },
@@ -43583,8 +43583,8 @@
           "cipd_packages": [
             {
               "cipd_package": "chromium/testing/linux-ash-chromium/x86_64/ash.zip",
-              "location": "lacros_version_skew_tests_v119.0.6039.0",
-              "revision": "version:119.0.6039.0"
+              "location": "lacros_version_skew_tests_v119.0.6042.0",
+              "revision": "version:119.0.6042.0"
             }
           ],
           "dimensions": {
@@ -43720,9 +43720,9 @@
       {
         "args": [
           "--test-launcher-filter-file=../../testing/buildbot/filters/linux-lacros.lacros_chrome_browsertests.skew.filter",
-          "--ash-chrome-path-override=../../lacros_version_skew_tests_v119.0.6039.0/test_ash_chrome"
+          "--ash-chrome-path-override=../../lacros_version_skew_tests_v119.0.6042.0/test_ash_chrome"
         ],
-        "description": "Run with ash-chrome version 119.0.6039.0",
+        "description": "Run with ash-chrome version 119.0.6042.0",
         "merge": {
           "script": "//testing/merge_scripts/standard_gtest_merge.py"
         },
@@ -43731,8 +43731,8 @@
           "cipd_packages": [
             {
               "cipd_package": "chromium/testing/linux-ash-chromium/x86_64/ash.zip",
-              "location": "lacros_version_skew_tests_v119.0.6039.0",
-              "revision": "version:119.0.6039.0"
+              "location": "lacros_version_skew_tests_v119.0.6042.0",
+              "revision": "version:119.0.6042.0"
             }
           ],
           "dimensions": {
@@ -43852,9 +43852,9 @@
       {
         "args": [
           "--test-launcher-filter-file=../../testing/buildbot/filters/linux-lacros.lacros_chrome_browsertests.skew.filter",
-          "--ash-chrome-path-override=../../lacros_version_skew_tests_v119.0.6039.0/test_ash_chrome"
+          "--ash-chrome-path-override=../../lacros_version_skew_tests_v119.0.6042.0/test_ash_chrome"
         ],
-        "description": "Run with ash-chrome version 119.0.6039.0",
+        "description": "Run with ash-chrome version 119.0.6042.0",
         "merge": {
           "script": "//testing/merge_scripts/standard_gtest_merge.py"
         },
@@ -43863,8 +43863,8 @@
           "cipd_packages": [
             {
               "cipd_package": "chromium/testing/linux-ash-chromium/x86_64/ash.zip",
-              "location": "lacros_version_skew_tests_v119.0.6039.0",
-              "revision": "version:119.0.6039.0"
+              "location": "lacros_version_skew_tests_v119.0.6042.0",
+              "revision": "version:119.0.6042.0"
             }
           ],
           "dimensions": {
@@ -45176,9 +45176,9 @@
       {
         "args": [
           "--test-launcher-filter-file=../../testing/buildbot/filters/linux-lacros.interactive_ui_tests.skew.filter",
-          "--ash-chrome-path-override=../../lacros_version_skew_tests_v119.0.6039.0/test_ash_chrome"
+          "--ash-chrome-path-override=../../lacros_version_skew_tests_v119.0.6042.0/test_ash_chrome"
         ],
-        "description": "Run with ash-chrome version 119.0.6039.0",
+        "description": "Run with ash-chrome version 119.0.6042.0",
         "merge": {
           "script": "//testing/merge_scripts/standard_gtest_merge.py"
         },
@@ -45187,8 +45187,8 @@
           "cipd_packages": [
             {
               "cipd_package": "chromium/testing/linux-ash-chromium/x86_64/ash.zip",
-              "location": "lacros_version_skew_tests_v119.0.6039.0",
-              "revision": "version:119.0.6039.0"
+              "location": "lacros_version_skew_tests_v119.0.6042.0",
+              "revision": "version:119.0.6042.0"
             }
           ],
           "dimensions": {
@@ -45324,9 +45324,9 @@
       {
         "args": [
           "--test-launcher-filter-file=../../testing/buildbot/filters/linux-lacros.lacros_chrome_browsertests.skew.filter",
-          "--ash-chrome-path-override=../../lacros_version_skew_tests_v119.0.6039.0/test_ash_chrome"
+          "--ash-chrome-path-override=../../lacros_version_skew_tests_v119.0.6042.0/test_ash_chrome"
         ],
-        "description": "Run with ash-chrome version 119.0.6039.0",
+        "description": "Run with ash-chrome version 119.0.6042.0",
         "merge": {
           "script": "//testing/merge_scripts/standard_gtest_merge.py"
         },
@@ -45335,8 +45335,8 @@
           "cipd_packages": [
             {
               "cipd_package": "chromium/testing/linux-ash-chromium/x86_64/ash.zip",
-              "location": "lacros_version_skew_tests_v119.0.6039.0",
-              "revision": "version:119.0.6039.0"
+              "location": "lacros_version_skew_tests_v119.0.6042.0",
+              "revision": "version:119.0.6042.0"
             }
           ],
           "dimensions": {
@@ -45456,9 +45456,9 @@
       {
         "args": [
           "--test-launcher-filter-file=../../testing/buildbot/filters/linux-lacros.lacros_chrome_browsertests.skew.filter",
-          "--ash-chrome-path-override=../../lacros_version_skew_tests_v119.0.6039.0/test_ash_chrome"
+          "--ash-chrome-path-override=../../lacros_version_skew_tests_v119.0.6042.0/test_ash_chrome"
         ],
-        "description": "Run with ash-chrome version 119.0.6039.0",
+        "description": "Run with ash-chrome version 119.0.6042.0",
         "merge": {
           "script": "//testing/merge_scripts/standard_gtest_merge.py"
         },
@@ -45467,8 +45467,8 @@
           "cipd_packages": [
             {
               "cipd_package": "chromium/testing/linux-ash-chromium/x86_64/ash.zip",
-              "location": "lacros_version_skew_tests_v119.0.6039.0",
-              "revision": "version:119.0.6039.0"
+              "location": "lacros_version_skew_tests_v119.0.6042.0",
+              "revision": "version:119.0.6042.0"
             }
           ],
           "dimensions": {
@@ -46166,9 +46166,9 @@
       {
         "args": [
           "--test-launcher-filter-file=../../testing/buildbot/filters/linux-lacros.interactive_ui_tests.skew.filter",
-          "--ash-chrome-path-override=../../lacros_version_skew_tests_v119.0.6039.0/test_ash_chrome"
+          "--ash-chrome-path-override=../../lacros_version_skew_tests_v119.0.6042.0/test_ash_chrome"
         ],
-        "description": "Run with ash-chrome version 119.0.6039.0",
+        "description": "Run with ash-chrome version 119.0.6042.0",
         "merge": {
           "script": "//testing/merge_scripts/standard_gtest_merge.py"
         },
@@ -46177,8 +46177,8 @@
           "cipd_packages": [
             {
               "cipd_package": "chromium/testing/linux-ash-chromium/x86_64/ash.zip",
-              "location": "lacros_version_skew_tests_v119.0.6039.0",
-              "revision": "version:119.0.6039.0"
+              "location": "lacros_version_skew_tests_v119.0.6042.0",
+              "revision": "version:119.0.6042.0"
             }
           ],
           "dimensions": {

diff --git a/testing/buildbot/chromium.memory.json b/testing/buildbot/chromium.memory.json
index 563b6652..1fb094a 100644
--- a/testing/buildbot/chromium.memory.json
+++ b/testing/buildbot/chromium.memory.json

@@ -16538,12 +16538,12 @@
       {
         "args": [
           "--test-launcher-filter-file=../../testing/buildbot/filters/linux-lacros.interactive_ui_tests.skew.filter",
-          "--ash-chrome-path-override=../../lacros_version_skew_tests_v119.0.6039.0/test_ash_chrome",
+          "--ash-chrome-path-override=../../lacros_version_skew_tests_v119.0.6042.0/test_ash_chrome",
           "--test-launcher-print-test-stdio=always",
           "--combine-ash-logs-on-bots",
           "--asan-symbolize-output"
         ],
-        "description": "Run with ash-chrome version 119.0.6039.0",
+        "description": "Run with ash-chrome version 119.0.6042.0",
         "isolate_profile_data": true,
         "merge": {
           "script": "//testing/merge_scripts/standard_gtest_merge.py"
@@ -16553,8 +16553,8 @@
           "cipd_packages": [
             {
               "cipd_package": "chromium/testing/linux-ash-chromium/x86_64/ash.zip",
-              "location": "lacros_version_skew_tests_v119.0.6039.0",
-              "revision": "version:119.0.6039.0"
+              "location": "lacros_version_skew_tests_v119.0.6042.0",
+              "revision": "version:119.0.6042.0"
             }
           ],
           "dimensions": {
@@ -16706,12 +16706,12 @@
       {
         "args": [
           "--test-launcher-filter-file=../../testing/buildbot/filters/linux-lacros.lacros_chrome_browsertests.skew.filter",
-          "--ash-chrome-path-override=../../lacros_version_skew_tests_v119.0.6039.0/test_ash_chrome",
+          "--ash-chrome-path-override=../../lacros_version_skew_tests_v119.0.6042.0/test_ash_chrome",
           "--test-launcher-print-test-stdio=always",
           "--combine-ash-logs-on-bots",
           "--asan-symbolize-output"
         ],
-        "description": "Run with ash-chrome version 119.0.6039.0",
+        "description": "Run with ash-chrome version 119.0.6042.0",
         "isolate_profile_data": true,
         "merge": {
           "script": "//testing/merge_scripts/standard_gtest_merge.py"
@@ -16721,8 +16721,8 @@
           "cipd_packages": [
             {
               "cipd_package": "chromium/testing/linux-ash-chromium/x86_64/ash.zip",
-              "location": "lacros_version_skew_tests_v119.0.6039.0",
-              "revision": "version:119.0.6039.0"
+              "location": "lacros_version_skew_tests_v119.0.6042.0",
+              "revision": "version:119.0.6042.0"
             }
           ],
           "dimensions": {
@@ -16853,12 +16853,12 @@
       {
         "args": [
           "--test-launcher-filter-file=../../testing/buildbot/filters/linux-lacros.lacros_chrome_browsertests.skew.filter",
-          "--ash-chrome-path-override=../../lacros_version_skew_tests_v119.0.6039.0/test_ash_chrome",
+          "--ash-chrome-path-override=../../lacros_version_skew_tests_v119.0.6042.0/test_ash_chrome",
           "--test-launcher-print-test-stdio=always",
           "--combine-ash-logs-on-bots",
           "--asan-symbolize-output"
         ],
-        "description": "Run with ash-chrome version 119.0.6039.0",
+        "description": "Run with ash-chrome version 119.0.6042.0",
         "isolate_profile_data": true,
         "merge": {
           "script": "//testing/merge_scripts/standard_gtest_merge.py"
@@ -16868,8 +16868,8 @@
           "cipd_packages": [
             {
               "cipd_package": "chromium/testing/linux-ash-chromium/x86_64/ash.zip",
-              "location": "lacros_version_skew_tests_v119.0.6039.0",
-              "revision": "version:119.0.6039.0"
+              "location": "lacros_version_skew_tests_v119.0.6042.0",
+              "revision": "version:119.0.6042.0"
             }
           ],
           "dimensions": {

diff --git a/testing/buildbot/variants.pyl b/testing/buildbot/variants.pyl
index 226ce9b..fa8466b 100644
--- a/testing/buildbot/variants.pyl
+++ b/testing/buildbot/variants.pyl

@@ -70,16 +70,16 @@
   },
   'LACROS_VERSION_SKEW_CANARY': {
     'identifier': 'Lacros version skew testing ash canary',
-    'description': 'Run with ash-chrome version 119.0.6039.0',
+    'description': 'Run with ash-chrome version 119.0.6042.0',
     'args': [
-      '--ash-chrome-path-override=../../lacros_version_skew_tests_v119.0.6039.0/test_ash_chrome',
+      '--ash-chrome-path-override=../../lacros_version_skew_tests_v119.0.6042.0/test_ash_chrome',
     ],
     'swarming': {
       'cipd_packages': [
         {
           'cipd_package': 'chromium/testing/linux-ash-chromium/x86_64/ash.zip',
-          'location': 'lacros_version_skew_tests_v119.0.6039.0',
-          'revision': 'version:119.0.6039.0',
+          'location': 'lacros_version_skew_tests_v119.0.6042.0',
+          'revision': 'version:119.0.6042.0',
         },
       ],
     },

diff --git a/third_party/chromium-variations b/third_party/chromium-variations
index 0a810b0..e8462fa 160000
--- a/third_party/chromium-variations
+++ b/third_party/chromium-variations

@@ -1 +1 @@
-Subproject commit 0a810b0e1d045c6ad20f63b3ff2d992f4238394e
+Subproject commit e8462fa1881743917c3a5cfab581211defad39da

diff --git a/third_party/dawn b/third_party/dawn
index 5b0d338..5d3173a 160000
--- a/third_party/dawn
+++ b/third_party/dawn

@@ -1 +1 @@
-Subproject commit 5b0d338a1e33424c341d811cc42718d147e7a0f3
+Subproject commit 5d3173ac9a2249dff582ed4f9ab6962e00737ea8

diff --git a/third_party/devtools-frontend-internal b/third_party/devtools-frontend-internal
index 687558b..63bda74 160000
--- a/third_party/devtools-frontend-internal
+++ b/third_party/devtools-frontend-internal

@@ -1 +1 @@
-Subproject commit 687558bb7ec6c7bfc732a54c884e6f7788c5ba53
+Subproject commit 63bda74f4350a6a59e38983a14d35a6eece12805

diff --git a/third_party/devtools-frontend/src b/third_party/devtools-frontend/src
index 9df7278..4e41c1c 160000
--- a/third_party/devtools-frontend/src
+++ b/third_party/devtools-frontend/src

@@ -1 +1 @@
-Subproject commit 9df727893527f021532d052df359a741c7fe7c0c
+Subproject commit 4e41c1c367239f5d2aec4fe63b2600a0ecd38604

diff --git a/ui/chromeos/strings/network/network_element_localized_strings_provider.cc b/ui/chromeos/strings/network/network_element_localized_strings_provider.cc
index f12dfe87..5893d07 100644
--- a/ui/chromeos/strings/network/network_element_localized_strings_provider.cc
+++ b/ui/chromeos/strings/network/network_element_localized_strings_provider.cc

@@ -10,6 +10,7 @@
 #include "build/build_config.h"
 #include "chromeos/ash/components/login/login_state/login_state.h"
 #include "chromeos/ash/components/network/network_connection_handler.h"
+#include "chromeos/ash/components/network/policy_util.h"
 #include "chromeos/strings/grit/chromeos_strings.h"
 #include "components/login/localized_values_builder.h"
 #include "components/strings/grit/components_strings.h"
@@ -549,6 +550,10 @@
   html_source->AddBoolean(
       "eapDefaultCasWithoutSubjectVerificationAllowed",
       ash::features::IsEapDefaultCasWithoutSubjectVerificationAllowed());
+
+  html_source->AddBoolean(
+      "ephemeralNetworkPoliciesEnabled",
+      ash::policy_util::AreEphemeralNetworkPoliciesEnabled());
 }
 
 void AddErrorLocalizedStrings(content::WebUIDataSource* html_source) {

diff --git a/v8 b/v8
index ac29617..cbfc282e 160000
--- a/v8
+++ b/v8

@@ -1 +1 @@
-Subproject commit ac29617dc7cd9f9a5e4c6f132c26277c4852c6c6
+Subproject commit cbfc282edb990b16d1ec7f7f31b1603148be9d17