diff --git a/BUILD.gn b/BUILD.gn
index 7b5bd9b..017e595e 100644
--- a/BUILD.gn
+++ b/BUILD.gn

@@ -927,8 +927,8 @@
       "//sandbox/linux:chrome_sandbox",
       "//sandbox/linux:sandbox_linux_unittests",
       "//third_party/breakpad:minidump_stackwalk($host_toolchain)",
-      "//third_party/dawn:dawn_end2end_tests",
-      "//third_party/dawn:dawn_unittests",
+      "//third_party/dawn:dawn_end2end_tests_temp_group",
+      "//third_party/dawn:dawn_unittests_temp_group",
 
       # Blocked on https://github.com/catapult-project/catapult/issues/2297
       #"//third_party/catapult/telemetry:bitmaptools",

diff --git a/DEPS b/DEPS
index 76162316..f01777fd 100644
--- a/DEPS
+++ b/DEPS

@@ -156,7 +156,7 @@
   # luci-go CIPD package version.
   # Make sure the revision is uploaded by infra-packagers builder.
   # https://ci.chromium.org/p/infra-internal/g/infra-packagers/console
-  'luci_go': 'git_revision:dad957de715bbe7e8b0f382488ff7af75cf600a5',
+  'luci_go': 'git_revision:513b1319d7d855f6c42bc01471562df910fd61b3',
 
   # This can be overridden, e.g. with custom_vars, to build clang from HEAD
   # instead of downloading the prebuilt pinned revision.
@@ -175,11 +175,11 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling Skia
   # and whatever else without interference from each other.
-  'skia_revision': '48d345fd83fd8860661cf3a3f5e57c5a61b471e7',
+  'skia_revision': '2faa33772be498c21e014155608036a903647891',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling V8
   # and whatever else without interference from each other.
-  'v8_revision': 'f3470cbf3c469e16a0adf36fa044fdc542a9016a',
+  'v8_revision': '0bb2b3008e7530eb4ac3f4c68d328649ff662e30',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling swarming_client
   # and whatever else without interference from each other.
@@ -187,7 +187,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling ANGLE
   # and whatever else without interference from each other.
-  'angle_revision': 'c68dfaf3a529d8a85793ae2951fc8207b2b621cf',
+  'angle_revision': 'cf2c8e6068c8d009c5ef9ec2d2094d05aa1c1a46',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling SwiftShader
   # and whatever else without interference from each other.
@@ -195,7 +195,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling PDFium
   # and whatever else without interference from each other.
-  'pdfium_revision': '595e98f8751373b20ab56a30fcf46028db300fad',
+  'pdfium_revision': '8cc69b1037252e46883624efe239017dfdca5676',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling BoringSSL
   # and whatever else without interference from each other.
@@ -238,7 +238,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling catapult
   # and whatever else without interference from each other.
-  'catapult_revision': '90ff937ff645b5dde74f2fa75937e5b7f3ead7d5',
+  'catapult_revision': '0780cae6bf8dac024f8101a2b691fcb7cd205652',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling libFuzzer
   # and whatever else without interference from each other.
@@ -246,7 +246,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling devtools-frontend
   # and whatever else without interference from each other.
-  'devtools_frontend_revision': 'b60df8ed2de8c9521e04a2f4a6f3597e7d156c29',
+  'devtools_frontend_revision': 'cf9ec0ae80a4f3c850ae2c9b80e5043bcdc1f49a',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling libprotobuf-mutator
   # and whatever else without interference from each other.
@@ -286,7 +286,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling feed
   # and whatever else without interference from each other.
-  'spv_tools_revision': '538512e8e8980cc01ab6501cd1cbd402d54f8491',
+  'spv_tools_revision': '34be23373b9e73694c3b214ba857283bad65aedb',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling feed
   # and whatever else without interference from each other.
@@ -525,7 +525,7 @@
   },
 
   'src/ios/third_party/material_components_ios/src': {
-      'url': Var('chromium_git') + '/external/github.com/material-components/material-components-ios.git' + '@' + '8c27dcf2e53f038ba97e4e6452143a8f223c35b7',
+      'url': Var('chromium_git') + '/external/github.com/material-components/material-components-ios.git' + '@' + '969f6f55460312e5f16236ad0e06c3e725f1fb74',
       'condition': 'checkout_ios',
   },
 
@@ -856,7 +856,7 @@
 
   # Build tools for Chrome OS. Note: This depends on third_party/pyelftools.
   'src/third_party/chromite': {
-      'url': Var('chromium_git') + '/chromiumos/chromite.git' + '@' + 'a5c914b63a0c343d08222e1fe2ad056c5218fece',
+      'url': Var('chromium_git') + '/chromiumos/chromite.git' + '@' + '97d7f070200a8a25cda75289a4f20d28b9fd00b5',
       'condition': 'checkout_linux',
   },
 
@@ -937,7 +937,7 @@
     Var('chromium_git') + '/codecs/libgav1.git' + '@' + '638ef84819f8b3cd614dcf63378fe4814aa4cb2a',
 
   'src/third_party/glslang/src':
-    Var('chromium_git') + '/external/github.com/KhronosGroup/glslang.git' + '@' + '75de196cecab0d37faa0e3de30c5bf85ab4e43f6',
+    Var('chromium_git') + '/external/github.com/KhronosGroup/glslang.git' + '@' + 'fd593d5f08343b44302c3a018a8bb734f550be9e',
 
   'src/third_party/google_toolbox_for_mac/src': {
       'url': Var('chromium_git') + '/external/github.com/google/google-toolbox-for-mac.git' + '@' + Var('google_toolbox_for_mac_revision'),
@@ -1218,7 +1218,7 @@
     Var('chromium_git') + '/external/github.com/cisco/openh264' + '@' + '6f26bce0b1c4e8ce0e13332f7c0083788def5fdf',
 
   'src/third_party/openscreen/src':
-    Var('chromium_git') + '/openscreen' + '@' + '8277ecb30334efbf1d828776f3d04a151180201b',
+    Var('chromium_git') + '/openscreen' + '@' + 'c2dcb3eec9ad96225ffdd6d2b749565b5916b64b',
 
   'src/third_party/openxr/src': {
     'url': Var('chromium_git') + '/external/github.com/KhronosGroup/OpenXR-SDK' + '@' + '9e97b73e7dd2bfc07745489d728f6a36665c648f',
@@ -1313,7 +1313,7 @@
       'packages': [
           {
               'package': 'fuchsia/third_party/aemu/linux-amd64',
-              'version': 'PanIUxGAhJjJ7ZNere-l6Bgp8nRJbkRFU-2ZV-nU8BwC'
+              'version': 'e-tS4uMBlsgvKWGSNFqpxxPNCoeRRmSFZ5gyRLGq1KcC'
           },
       ],
       'condition': 'host_os == "linux" and checkout_fuchsia',
@@ -1465,7 +1465,7 @@
   },
 
   'src/third_party/webrtc':
-    Var('webrtc_git') + '/src.git' + '@' + '059c1b75eb67739a78b38e3d1dad5c0b19c0759a',
+    Var('webrtc_git') + '/src.git' + '@' + '9f0b36c4610de8e0fe4bde2f57c8bc487e3a1005',
 
   'src/third_party/libgifcodec':
      Var('skia_git') + '/libgifcodec' + '@'+  Var('libgifcodec_revision'),
@@ -1540,7 +1540,7 @@
     Var('chromium_git') + '/v8/v8.git' + '@' +  Var('v8_revision'),
 
   'src-internal': {
-    'url': 'https://chrome-internal.googlesource.com/chrome/src-internal.git@bb2c6c02536697ef66e2f530275fe8878e9a15cb',
+    'url': 'https://chrome-internal.googlesource.com/chrome/src-internal.git@647a242debd9e5254b96aa42211ff406f32e38a6',
     'condition': 'checkout_src_internal',
   },
 

diff --git a/android_webview/docs/cors-and-webview-api.md b/android_webview/docs/cors-and-webview-api.md
index d728e05..6a291aa 100644
--- a/android_webview/docs/cors-and-webview-api.md
+++ b/android_webview/docs/cors-and-webview-api.md

@@ -12,6 +12,15 @@
 behaviors and implementation details to give WebView and chromium developers
 hints to keep consistent behaviors among making code changes.
 
+## TL;DR for new developers
+If you are working on new WebView applications and finding a way to load local
+resources, we recommend that you use [WebViewAssetLoader](https://developer.android.com/reference/androidx/webkit/WebViewAssetLoader)
+as using other Android specific schemes is not covered by the open web platform
+standards, and behavior details for new web features might be undefined or
+changed. Using the WebViewAssetLoader API to load local resource on virtual
+http/https URLs avoids these compatibility issues and allows the standard web
+security model to apply.
+
 ## Android or WebView specific features
 
 ### intent:// URLs

diff --git a/android_webview/docs/developer-ui.md b/android_webview/docs/developer-ui.md
index 434c9f8..ffbd1acf 100644
--- a/android_webview/docs/developer-ui.md
+++ b/android_webview/docs/developer-ui.md

@@ -118,3 +118,32 @@
 ### See also
 
 - [Design doc](http://go/webview-dev-ui-flags-design) (Google-only)
+
+## More cool stuff
+
+### Switching WebView provider
+
+Since Android 7 (Nougat), Android supports installing [multiple WebView
+packages](prerelease.md) side by side and switching between them. After
+installing the WebView channel you want, launch WebView DevTools, open the
+three-dotted menu, and select "Change WebView Provider." This launches the
+system UI where you can select your new WebView channel.
+
+### Filing a bug report
+
+*** aside
+This was [added in M84](https://chromiumdash.appspot.com/commit/874adae46ba404dfec1660ef239899eef47d72bc).
+***
+
+You can file general bug reports for the WebView engineering team. Launch
+WebView DevTools, open the three-dotted menu, and select "Report WebView Bug."
+Similar to filing bug reports for crashes, this will open the system browser to
+[our bug
+tracker](https://bugs.chromium.org/p/chromium/issues/entry?template=Webview+Bugs&labels=Via-WebView-DevTools)
+(requires sign-in), where you can describe the issue.
+
+## Looking for Chrome DevTools?
+
+You can debug WebView even more with Chrome DevTools! For detailed instructions,
+check out [Remote Debugging
+WebViews](https://developers.google.com/web/tools/chrome-devtools/remote-debugging/webviews).

diff --git a/android_webview/javatests/src/org/chromium/android_webview/test/AndroidViewIntegrationTest.java b/android_webview/javatests/src/org/chromium/android_webview/test/AndroidViewIntegrationTest.java
index 5e19c38..fba9f0f 100644
--- a/android_webview/javatests/src/org/chromium/android_webview/test/AndroidViewIntegrationTest.java
+++ b/android_webview/javatests/src/org/chromium/android_webview/test/AndroidViewIntegrationTest.java

@@ -202,8 +202,7 @@
     @Feature({"AndroidWebView"})
     public void testDisconnectedViewLoadsContent() throws Throwable {
         final TestAwContentsClient contentsClient = new TestAwContentsClient();
-        final AwTestContainerView mTestContainerView =
-                createDetachedTestContainerViewOnMainSync(contentsClient);
+        mTestContainerView = createDetachedTestContainerViewOnMainSync(contentsClient);
         assertZeroHeight(mTestContainerView);
 
         final int contentSizeChangeCallCount = mOnContentSizeChangedHelper.getCallCount();

diff --git a/android_webview/javatests/src/org/chromium/android_webview/test/VisualStateTest.java b/android_webview/javatests/src/org/chromium/android_webview/test/VisualStateTest.java
index 206cd18..8e7da63d 100644
--- a/android_webview/javatests/src/org/chromium/android_webview/test/VisualStateTest.java
+++ b/android_webview/javatests/src/org/chromium/android_webview/test/VisualStateTest.java

@@ -64,6 +64,7 @@
     private static final String ENTER_FULLSCREEN_CONTROL_ID = "enterFullscreenControl";
 
     private TestAwContentsClient mContentsClient = new TestAwContentsClient();
+    private AwTestContainerView mTestView;
 
     private static class DelayedInputStream extends FilterInputStream {
         private CountDownLatch mLatch = new CountDownLatch(1);
@@ -120,9 +121,8 @@
     @Feature({"AndroidWebView"})
     @SmallTest
     public void testVisualStateCallbackIsReceived() throws Throwable {
-        AwTestContainerView testContainer =
-                mActivityTestRule.createAwTestContainerViewOnMainSync(mContentsClient);
-        final AwContents awContents = testContainer.getAwContents();
+        mTestView = mActivityTestRule.createAwTestContainerViewOnMainSync(mContentsClient);
+        final AwContents awContents = mTestView.getAwContents();
         mActivityTestRule.loadDataSync(awContents, mContentsClient.getOnPageFinishedHelper(),
                 CommonResources.ABOUT_HTML, "text/html", false);
         final CallbackHelper ch = new CallbackHelper();
@@ -153,7 +153,7 @@
         final CountDownLatch testFinishedSignal = new CountDownLatch(1);
 
         final AtomicReference<AwContents> awContentsRef = new AtomicReference<>();
-        final AwTestContainerView testView =
+        mTestView =
                 mActivityTestRule.createAwTestContainerViewOnMainSync(new TestAwContentsClient() {
                     @Override
                     public void onPageFinished(String url) {
@@ -175,7 +175,7 @@
                         }
                     }
                 });
-        final AwContents awContents = testView.getAwContents();
+        final AwContents awContents = mTestView.getAwContents();
         awContentsRef.set(awContents);
 
         InstrumentationRegistry.getInstrumentation().runOnMainSync(() -> {
@@ -207,7 +207,7 @@
         final CountDownLatch pageCommitCallbackOccurred = new CountDownLatch(1);
 
         final AtomicReference<AwContents> awContentsRef = new AtomicReference<>();
-        final AwTestContainerView testView =
+        mTestView =
                 mActivityTestRule.createAwTestContainerViewOnMainSync(new TestAwContentsClient() {
                     @Override
                     public void onPageCommitVisible(String url) {
@@ -246,7 +246,7 @@
                     }
                 });
 
-        final AwContents awContents = testView.getAwContents();
+        final AwContents awContents = mTestView.getAwContents();
         awContentsRef.set(awContents);
 
         InstrumentationRegistry.getInstrumentation().runOnMainSync(() -> {
@@ -297,11 +297,10 @@
                         });
             }
         };
-        final AwTestContainerView testView =
-                mActivityTestRule.createAwTestContainerViewOnMainSync(awContentsClient);
-        final AwContents awContents = testView.getAwContents();
+        mTestView = mActivityTestRule.createAwTestContainerViewOnMainSync(awContentsClient);
+        final AwContents awContents = mTestView.getAwContents();
         awContentsRef.set(awContents);
-        final WebContents webContents = testView.getWebContents();
+        final WebContents webContents = mTestView.getWebContents();
         AwActivityTestRule.enableJavaScriptOnUiThread(awContents);
 
         // JS will notify this observer once it has changed the background color of the page.
@@ -364,11 +363,10 @@
                                 });
                     }
                 };
-        final AwTestContainerView testView =
-                mActivityTestRule.createAwTestContainerViewOnMainSync(awContentsClient);
-        final AwContents awContents = testView.getAwContents();
+        mTestView = mActivityTestRule.createAwTestContainerViewOnMainSync(awContentsClient);
+        final AwContents awContents = mTestView.getAwContents();
         awContentsRef.set(awContents);
-        final WebContents webContents = testView.getWebContents();
+        final WebContents webContents = mTestView.getWebContents();
         AwActivityTestRule.enableJavaScriptOnUiThread(awContents);
         awContents.getSettings().setFullscreenSupported(true);
 
@@ -421,9 +419,8 @@
         final CountDownLatch testFinishedSignal = new CountDownLatch(1);
 
         final TestAwContentsClient awContentsClient = new TestAwContentsClient();
-        final AwTestContainerView testView =
-                createDetachedTestContainerViewOnMainSync(awContentsClient);
-        final AwContents awContents = testView.getAwContents();
+        mTestView = createDetachedTestContainerViewOnMainSync(awContentsClient);
+        final AwContents awContents = mTestView.getAwContents();
 
         AwActivityTestRule.enableJavaScriptOnUiThread(awContents);
 

diff --git a/ash/system/status_area_widget.cc b/ash/system/status_area_widget.cc
index c85c87a5..e8f76979 100644
--- a/ash/system/status_area_widget.cc
+++ b/ash/system/status_area_widget.cc

@@ -424,11 +424,13 @@
 }
 
 StatusAreaWidget::LayoutInputs StatusAreaWidget::GetLayoutInputs() const {
-  long child_visibility_bitmask = 0;
+  unsigned int child_visibility_bitmask = 0;
   DCHECK(tray_buttons_.size() <
          std::numeric_limits<decltype(child_visibility_bitmask)>::digits);
-  for (unsigned int i = 0; i < tray_buttons_.size(); ++i)
-    child_visibility_bitmask |= (tray_buttons_[i]->GetVisible() ? 1 : 0) << i;
+  for (unsigned int i = 0; i < tray_buttons_.size(); ++i) {
+    if (tray_buttons_[i]->GetVisible())
+      child_visibility_bitmask |= 1 << i;
+  }
   return {target_bounds_, CalculateCollapseState(),
           shelf_->shelf_layout_manager()->GetOpacity(),
           child_visibility_bitmask};

diff --git a/ash/system/status_area_widget.h b/ash/system/status_area_widget.h
index 21f81d8..5b6e1df 100644
--- a/ash/system/status_area_widget.h
+++ b/ash/system/status_area_widget.h

@@ -138,7 +138,7 @@
     CollapseState collapse_state = CollapseState::NOT_COLLAPSIBLE;
     float opacity = 0.0f;
     // Each bit keep track of one child's visibility.
-    long child_visibility_bitmask = 0;
+    unsigned int child_visibility_bitmask = 0;
 
     bool operator==(const LayoutInputs& other) const {
       return bounds == other.bounds && collapse_state == other.collapse_state &&

diff --git a/ash/wm/overview/overview_item.cc b/ash/wm/overview/overview_item.cc
index 92ba6709..ec24a910 100644
--- a/ash/wm/overview/overview_item.cc
+++ b/ash/wm/overview/overview_item.cc

@@ -281,8 +281,9 @@
 void OverviewItem::SetBounds(const gfx::RectF& target_bounds,
                              OverviewAnimationType animation_type) {
   if (in_bounds_update_ ||
-      !Shell::Get()->overview_controller()->InOverviewSession())
+      !Shell::Get()->overview_controller()->InOverviewSession()) {
     return;
+  }
 
   // Do not animate if the resulting bounds does not change. The original
   // window may change bounds so we still need to call SetItemBounds to update
@@ -398,6 +399,8 @@
     SetItemBounds(inset_bounds, new_animation_type, is_first_update);
     UpdateHeaderLayout(is_first_update ? OVERVIEW_ANIMATION_NONE
                                        : new_animation_type);
+    if (is_first_update && !should_animate_when_entering_)
+      transform_window_.ClipHeaderIfNeeded(/*animate=*/false);
   }
 
   // Shadow is normally set after an animation is finished. In the case of no
@@ -760,9 +763,7 @@
     overview_item_view_->UpdatePreviewRoundedCorners(
         should_show_rounded_corners);
   } else {
-    transform_window_.UpdateRoundedCorners(
-        should_show_rounded_corners,
-        /*update_clip=*/should_show_rounded_corners);
+    transform_window_.UpdateRoundedCornersAndClip(should_show_rounded_corners);
   }
 
   // In addition, the shadow should be hidden if

diff --git a/ash/wm/overview/scoped_overview_transform_window.cc b/ash/wm/overview/scoped_overview_transform_window.cc
index c4dcea0..21cd57d 100644
--- a/ash/wm/overview/scoped_overview_transform_window.cc
+++ b/ash/wm/overview/scoped_overview_transform_window.cc

@@ -148,11 +148,10 @@
     event_targeting_blocker_map_.erase(transient);
   }
 
-  // No need to update the clip since we're about to restore it to
-  // `original_clip_rect_`.
-  UpdateRoundedCorners(/*show=*/false, /*update_clip=*/false);
-  aura::client::GetTransientWindowClient()->RemoveObserver(this);
+  // Remove rounded corners and clipping.
+  UpdateRoundedCornersAndClip(/*show=*/false);
   window_->layer()->SetClipRect(original_clip_rect_);
+  aura::client::GetTransientWindowClient()->RemoveObserver(this);
 }
 
 // static
@@ -396,8 +395,7 @@
   type_ = GetWindowDimensionsType(window_->bounds().size());
 }
 
-void ScopedOverviewTransformWindow::UpdateRoundedCorners(bool show,
-                                                         bool update_clip) {
+void ScopedOverviewTransformWindow::UpdateRoundedCornersAndClip(bool show) {
   // Hide the corners if minimized, OverviewItemView will handle showing the
   // rounded corners on the UI.
   const bool show_corners = show && !IsMinimized();
@@ -411,21 +409,38 @@
   layer->SetRoundedCornerRadius(radii);
   layer->SetIsFastRoundedCorner(true);
 
-  if (!update_clip || layer->GetAnimator()->is_animating() || IsMinimized())
+  if (!show || layer->GetAnimator()->is_animating() || IsMinimized())
     return;
 
+  ClipHeaderIfNeeded(true);
+}
+
+void ScopedOverviewTransformWindow::ClipHeaderIfNeeded(bool animate) {
   const int top_inset = GetTopInset();
-  if (!has_aspect_ratio_clipping_ && top_inset > 0) {
-    gfx::Rect clip_rect(window_->bounds().size());
-    // We add 1 to the top_inset, because in some cases, the header is not
-    // clipped fully due to what seems to be a rounding error.
-    // TODO(afakhry|sammiequon): Investigate a proper fix for this.
-    clip_rect.Inset(0, top_inset + 1, 0, 0);
-    ScopedOverviewAnimationSettings settings(
+  if (top_inset <= 0)
+    return;
+
+  // Clipping a window to preserve aspect ratios will account for the header, so
+  // no need to clip here.
+  if (has_aspect_ratio_clipping_)
+    return;
+
+  gfx::Rect clip_rect(window_->bounds().size());
+  // We add 1 to the top_inset, because in some cases, the header is not
+  // clipped fully due to what seems to be a rounding error.
+  // TODO(afakhry|sammiequon): Investigate a proper fix for this.
+  clip_rect.Inset(0, top_inset + 1, 0, 0);
+
+  if (overview_clip_rect_ == clip_rect)
+    return;
+
+  std::unique_ptr<ScopedOverviewAnimationSettings> settings;
+  if (animate) {
+    settings = std::make_unique<ScopedOverviewAnimationSettings>(
         OVERVIEW_ANIMATION_FRAME_HEADER_CLIP, window_);
-    layer->SetClipRect(clip_rect);
-    overview_clip_rect_ = clip_rect;
   }
+  window_->layer()->SetClipRect(clip_rect);
+  overview_clip_rect_ = clip_rect;
 }
 
 void ScopedOverviewTransformWindow::OnTransientChildWindowAdded(

diff --git a/ash/wm/overview/scoped_overview_transform_window.h b/ash/wm/overview/scoped_overview_transform_window.h
index b7b3fd90..ed60b639 100644
--- a/ash/wm/overview/scoped_overview_transform_window.h
+++ b/ash/wm/overview/scoped_overview_transform_window.h

@@ -123,11 +123,14 @@
   // change. Must be called before PositionWindows in OverviewGrid.
   void UpdateWindowDimensionsType();
 
-  // Updates the rounded corners on the window. Makes the rounded corners if
-  // |show| is true, otherwise removes it. If |update_clip| is true, it will
-  // clip the top portion of the window that normally contains the caption (if
-  // any), otherwise it will skip updating that clip.
-  void UpdateRoundedCorners(bool show, bool update_clip);
+  // Updates the rounded corners and clipping on the window. Note that the
+  // rounded corners can be hidden with |show| set to false, but the clipping
+  // stays for the duration of overview once applied.
+  void UpdateRoundedCornersAndClip(bool show);
+
+  // Clip the top portion of the window that normally contains the caption (if
+  // any).
+  void ClipHeaderIfNeeded(bool animate);
 
   // aura::client::TransientWindowClientObserver:
   void OnTransientChildWindowAdded(aura::Window* parent,

diff --git a/base/allocator/partition_allocator/partition_alloc.cc b/base/allocator/partition_allocator/partition_alloc.cc
index 1160260..99ddb5cb 100644
--- a/base/allocator/partition_allocator/partition_alloc.cc
+++ b/base/allocator/partition_allocator/partition_alloc.cc

@@ -19,6 +19,18 @@
 
 namespace base {
 
+namespace {
+
+bool InitializeOnce() {
+  // We mark the sentinel bucket/page as free to make sure it is skipped by our
+  // logic to find a new active page.
+  internal::PartitionBucket::get_sentinel_bucket()->active_pages_head =
+      internal::PartitionPage::get_sentinel_page();
+  return true;
+}
+
+}  // namespace
+
 // Two partition pages are used as guard / metadata page so make sure the super
 // page size is bigger.
 static_assert(kPartitionPageSize * 4 <= kSuperPageSize, "ok super page size");
@@ -57,12 +69,6 @@
 PartitionRootGeneric::~PartitionRootGeneric() = default;
 PartitionAllocatorGeneric::PartitionAllocatorGeneric() = default;
 
-Lock& GetLock() {
-  static NoDestructor<Lock> s_initialized_lock;
-  return *s_initialized_lock;
-}
-static bool g_initialized = false;
-
 Lock& GetHooksLock() {
   static NoDestructor<Lock> lock;
   return *lock;
@@ -175,21 +181,12 @@
 
 static void PartitionAllocBaseInit(internal::PartitionRootBase* root) {
   DCHECK(!root->initialized);
-  {
-    AutoLock guard(GetLock());
-    if (!g_initialized) {
-      g_initialized = true;
-      // We mark the sentinel bucket/page as free to make sure it is skipped by
-      // our logic to find a new active page.
-      internal::PartitionBucket::get_sentinel_bucket()->active_pages_head =
-          internal::PartitionPage::get_sentinel_page();
-    }
-  }
-
-  root->initialized = true;
+  static bool initialized = InitializeOnce();
+  static_cast<void>(initialized);
 
   // This is a "magic" value so we can test if a root pointer is valid.
   root->inverted_self = ~reinterpret_cast<uintptr_t>(root);
+  root->initialized = true;
 }
 
 void PartitionAllocGlobalInit(OomFunction on_out_of_memory) {

diff --git a/base/files/file_util_win.cc b/base/files/file_util_win.cc
index a39fc4c..47b9fbe 100644
--- a/base/files/file_util_win.cc
+++ b/base/files/file_util_win.cc

@@ -629,8 +629,6 @@
   const DWORD fileattr = ::GetFileAttributes(full_path_str);
   if (fileattr != INVALID_FILE_ATTRIBUTES) {
     if ((fileattr & FILE_ATTRIBUTE_DIRECTORY) != 0) {
-      DVLOG(1) << "CreateDirectory(" << full_path_str << "), "
-               << "directory already exists.";
       return true;
     }
     DLOG(WARNING) << "CreateDirectory(" << full_path_str << "), "

diff --git a/base/util/type_safety/id_type.h b/base/util/type_safety/id_type.h
index 78748790..2177f4b 100644
--- a/base/util/type_safety/id_type.h
+++ b/base/util/type_safety/id_type.h

@@ -6,6 +6,7 @@
 #define BASE_UTIL_TYPE_SAFETY_ID_TYPE_H_
 
 #include <cstdint>
+#include <type_traits>
 
 #include "base/util/type_safety/strong_alias.h"
 
@@ -49,9 +50,10 @@
 template <typename TypeMarker, typename WrappedType, WrappedType kInvalidValue>
 class IdType : public StrongAlias<TypeMarker, WrappedType> {
  public:
-  static_assert(kInvalidValue <= 0,
-                "The invalid value should be negative or equal to zero to "
-                "avoid overflow issues.");
+  static_assert(
+      std::is_unsigned<WrappedType>::value || kInvalidValue <= 0,
+      "If signed, the invalid value should be negative or equal to zero to "
+      "avoid overflow issues.");
 
   using StrongAlias<TypeMarker, WrappedType>::StrongAlias;
 

diff --git a/base/util/type_safety/id_type_unittest.cc b/base/util/type_safety/id_type_unittest.cc
index 04be50f..a8e3b8a 100644
--- a/base/util/type_safety/id_type_unittest.cc
+++ b/base/util/type_safety/id_type_unittest.cc

@@ -40,6 +40,18 @@
     EXPECT_EQ(test_id_generator.GenerateNextId(), TestId::FromUnsafeValue(i));
 }
 
+TEST(IdType, GeneratorWithBigUnsignedInvalidValue) {
+  using TestId =
+      IdType<class TestIdTag, uint32_t, std::numeric_limits<uint32_t>::max()>;
+
+  TestId::Generator test_id_generator;
+  for (int i = 0; i < 10; i++) {
+    TestId id = test_id_generator.GenerateNextId();
+    EXPECT_FALSE(id.is_null());
+    EXPECT_EQ(id, TestId::FromUnsafeValue(i));
+  }
+}
+
 class IdTypeSpecificValueTest : public ::testing::TestWithParam<int> {
  protected:
   FooId test_id() { return FooId::FromUnsafeValue(GetParam()); }

diff --git a/build/vs_toolchain.py b/build/vs_toolchain.py
index 97600e7..f3557ad 100755
--- a/build/vs_toolchain.py
+++ b/build/vs_toolchain.py

@@ -151,14 +151,22 @@
       for k,v in MSVS_VERSIONS.items())
   available_versions = []
   for version in supported_versions:
-    for path in (
-        os.environ.get('vs%s_install' % version),
-        os.path.expandvars('%ProgramFiles(x86)%' +
-                           '/Microsoft Visual Studio/%s' % version)):
-      if path and any(os.path.exists(os.path.join(path, edition)) for edition in
-          ('Enterprise', 'Professional', 'Community', 'Preview')):
-        available_versions.append(version)
-        break
+    # Checking vs%s_install environment variables.
+    # For example, vs2019_install could have the value
+    # "C:\Program Files (x86)\Microsoft Visual Studio\2019\Community".
+    # Only vs2017_install and vs2019_install are supported.
+    path = os.environ.get('vs%s_install' % version)
+    if path and os.path.exists(path):
+      available_versions.append(version)
+      break
+    # Detecting VS under possible paths.
+    path = os.path.expandvars('%ProgramFiles(x86)%' +
+                              '/Microsoft Visual Studio/%s' % version)
+    if path and any(
+        os.path.exists(os.path.join(path, edition))
+        for edition in ('Enterprise', 'Professional', 'Community', 'Preview')):
+      available_versions.append(version)
+      break
 
   if not available_versions:
     raise Exception('No supported Visual Studio can be found.'

diff --git a/chrome/android/chrome_java_sources.gni b/chrome/android/chrome_java_sources.gni
index 88f98a5..f6a60f47 100644
--- a/chrome/android/chrome_java_sources.gni
+++ b/chrome/android/chrome_java_sources.gni

@@ -1573,7 +1573,9 @@
   "java/src/org/chromium/chrome/browser/tab/AuthenticatorNavigationInterceptor.java",
   "java/src/org/chromium/chrome/browser/tab/AuthenticatorNavigationInterceptorTabHelper.java",
   "java/src/org/chromium/chrome/browser/tab/EmptyTabObserver.java",
+  "java/src/org/chromium/chrome/browser/tab/InterceptNavigationDelegateClientImpl.java",
   "java/src/org/chromium/chrome/browser/tab/InterceptNavigationDelegateImpl.java",
+  "java/src/org/chromium/chrome/browser/tab/InterceptNavigationDelegateTabHelper.java",
   "java/src/org/chromium/chrome/browser/tab/RedirectHandlerTabHelper.java",
   "java/src/org/chromium/chrome/browser/tab/SadTab.java",
   "java/src/org/chromium/chrome/browser/tab/SadTabView.java",
@@ -1751,7 +1753,6 @@
   "java/src/org/chromium/chrome/browser/translate/TranslateUtils.java",
   "java/src/org/chromium/chrome/browser/ui/BottomContainer.java",
   "java/src/org/chromium/chrome/browser/ui/BottomSheetManager.java",
-  "java/src/org/chromium/chrome/browser/ui/ImmersiveModeManager.java",
   "java/src/org/chromium/chrome/browser/ui/RootUiCoordinator.java",
   "java/src/org/chromium/chrome/browser/ui/TabObscuringHandler.java",
   "java/src/org/chromium/chrome/browser/ui/system/StatusBarColorController.java",

diff --git a/chrome/android/feed/core/javatests/src/org/chromium/chrome/browser/feed/FeedNewTabPageTest.java b/chrome/android/feed/core/javatests/src/org/chromium/chrome/browser/feed/FeedNewTabPageTest.java
index c7b750a..36281659 100644
--- a/chrome/android/feed/core/javatests/src/org/chromium/chrome/browser/feed/FeedNewTabPageTest.java
+++ b/chrome/android/feed/core/javatests/src/org/chromium/chrome/browser/feed/FeedNewTabPageTest.java

@@ -171,8 +171,10 @@
         onView(withId(R.id.signin_promo_view_container)).check(matches(isDisplayed()));
 
         // Reset states.
-        TestThreadUtils.runOnUiThreadBlocking(
-                () -> recyclerView.setDescendantFocusability(descendantFocusability));
+        TestThreadUtils.runOnUiThreadBlocking(() -> {
+            mNtp.getMediatorForTesting().destroy();
+            recyclerView.setDescendantFocusability(descendantFocusability);
+        });
     }
 
     @Test

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/AppHooks.java b/chrome/android/java/src/org/chromium/chrome/browser/AppHooks.java
index 5fd8764e..bbf7409 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/AppHooks.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/AppHooks.java

@@ -6,7 +6,6 @@
 
 import android.content.pm.PackageInfo;
 import android.content.pm.PackageManager;
-import android.view.View;
 
 import androidx.annotation.Nullable;
 import androidx.annotation.VisibleForTesting;
@@ -45,9 +44,7 @@
 import org.chromium.chrome.browser.signin.GoogleActivityController;
 import org.chromium.chrome.browser.survey.SurveyController;
 import org.chromium.chrome.browser.sync.TrustedVaultClient;
-import org.chromium.chrome.browser.tab.AuthenticatorNavigationInterceptor;
 import org.chromium.chrome.browser.tab.Tab;
-import org.chromium.chrome.browser.ui.ImmersiveModeManager;
 import org.chromium.chrome.browser.usage_stats.DigitalWellbeingClient;
 import org.chromium.chrome.browser.webapps.GooglePlayWebApkInstallDelegate;
 import org.chromium.chrome.browser.webauth.Fido2ApiHandler;
@@ -111,8 +108,22 @@
     /**
      * Return a {@link AuthenticatorNavigationInterceptor} for the given {@link Tab}.
      * This can be null if there are no applicable interceptor to be built.
+     * NOTE: This method will be transitioned to talk in terms of the //components-level interface
+     * once downstream has been transitioned.
      */
-    public AuthenticatorNavigationInterceptor createAuthenticatorNavigationInterceptor(Tab tab) {
+    public org.chromium.chrome.browser.tab.AuthenticatorNavigationInterceptor
+    createAuthenticatorNavigationInterceptor(Tab tab) {
+        return null;
+    }
+
+    /**
+     * Return a {@link AuthenticatorNavigationInterceptor} for the given {@link Tab}.
+     * This can be null if there are no applicable interceptor to be built.
+     * NOTE: This method exists only to allow downstream to transition to talking in terms of the
+     * //components-level interface. It will be deleted once the transition is complete.
+     */
+    public org.chromium.components.external_intents.AuthenticatorNavigationInterceptor
+    createAuthenticatorNavigationInterceptorV2(Tab tab) {
         return null;
     }
 
@@ -348,14 +359,6 @@
     }
 
     /**
-     * @param contentView The root content view for the containing activity.
-     * @return A new {@link ImmersiveModeManager} or null if there isn't one.
-     */
-    public @Nullable ImmersiveModeManager createImmersiveModeManager(View contentView) {
-        return null;
-    }
-
-    /**
      * Returns a new {@link TrustedVaultClient.Backend} instance.
      */
     public TrustedVaultClient.Backend createSyncTrustedVaultClientBackend() {

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tab/AuthenticatorNavigationInterceptor.java b/chrome/android/java/src/org/chromium/chrome/browser/tab/AuthenticatorNavigationInterceptor.java
index fc9ef28..7a200c5 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/tab/AuthenticatorNavigationInterceptor.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/tab/AuthenticatorNavigationInterceptor.java

@@ -6,6 +6,9 @@
 
 /**
  * Handles intercepting navigation requests for an external authenticator application.
+ * NOTE: DO NOT CHANGE ANYTHING IN THIS INTERFACE. It will be removed in favor of the identical one
+ * in //components once downstream has been transitioned to use the //components-level one rather
+ * than this one.
  */
 public interface AuthenticatorNavigationInterceptor {
     /**

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tab/AuthenticatorNavigationInterceptorTabHelper.java b/chrome/android/java/src/org/chromium/chrome/browser/tab/AuthenticatorNavigationInterceptorTabHelper.java
index 9a6dddf6..c9acc9a 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/tab/AuthenticatorNavigationInterceptorTabHelper.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/tab/AuthenticatorNavigationInterceptorTabHelper.java

@@ -13,6 +13,7 @@
  */
 public class AuthenticatorNavigationInterceptorTabHelper {
     public static AuthenticatorNavigationInterceptor getInterceptorForTab(Tab tab) {
-        return InterceptNavigationDelegateImpl.get(tab).getAuthenticatorNavigationInterceptor();
+        return InterceptNavigationDelegateTabHelper.get(tab)
+                .getAuthenticatorNavigationInterceptor();
     }
 }

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tab/InterceptNavigationDelegateClientImpl.java b/chrome/android/java/src/org/chromium/chrome/browser/tab/InterceptNavigationDelegateClientImpl.java
new file mode 100644
index 0000000..12504ef
--- /dev/null
+++ b/chrome/android/java/src/org/chromium/chrome/browser/tab/InterceptNavigationDelegateClientImpl.java

@@ -0,0 +1,25 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+package org.chromium.chrome.browser.tab;
+
+import org.chromium.components.external_intents.InterceptNavigationDelegateClient;
+import org.chromium.content_public.browser.WebContents;
+
+/**
+ * Class that provides embedder-level information to InterceptNavigationDelegateImpl based off a
+ * Tab.
+ */
+public class InterceptNavigationDelegateClientImpl implements InterceptNavigationDelegateClient {
+    private TabImpl mTab;
+
+    InterceptNavigationDelegateClientImpl(Tab tab) {
+        mTab = (TabImpl) tab;
+    }
+
+    @Override
+    public WebContents getWebContents() {
+        return mTab.getWebContents();
+    }
+}

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tab/InterceptNavigationDelegateImpl.java b/chrome/android/java/src/org/chromium/chrome/browser/tab/InterceptNavigationDelegateImpl.java
index cda9516..1d70597 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/tab/InterceptNavigationDelegateImpl.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/tab/InterceptNavigationDelegateImpl.java

@@ -8,7 +8,6 @@
 import androidx.annotation.VisibleForTesting;
 
 import org.chromium.base.ContextUtils;
-import org.chromium.base.UserData;
 import org.chromium.base.annotations.NativeMethods;
 import org.chromium.base.metrics.RecordHistogram;
 import org.chromium.base.task.PostTask;
@@ -19,6 +18,7 @@
 import org.chromium.components.external_intents.ExternalNavigationHandler;
 import org.chromium.components.external_intents.ExternalNavigationHandler.OverrideUrlLoadingResult;
 import org.chromium.components.external_intents.ExternalNavigationParams;
+import org.chromium.components.external_intents.InterceptNavigationDelegateClient;
 import org.chromium.components.external_intents.RedirectHandlerImpl;
 import org.chromium.components.navigation_interception.InterceptNavigationDelegate;
 import org.chromium.components.navigation_interception.NavigationParams;
@@ -37,12 +37,10 @@
  * hence can cause UAF error. It should be done in an asynchronous fashion to avoid it.
  * See https://crbug.com/732260.
  */
-public class InterceptNavigationDelegateImpl implements InterceptNavigationDelegate, UserData {
-    private static final Class<InterceptNavigationDelegateImpl> USER_DATA_KEY =
-            InterceptNavigationDelegateImpl.class;
-
+public class InterceptNavigationDelegateImpl implements InterceptNavigationDelegate {
     private final TabImpl mTab;
     private final AuthenticatorNavigationInterceptor mAuthenticatorHelper;
+    private InterceptNavigationDelegateClient mClient;
     private @OverrideUrlLoadingResult int mLastOverrideUrlLoadingResult =
             OverrideUrlLoadingResult.NO_OVERRIDE;
     private final TabObserver mDelegateObserver;
@@ -55,21 +53,13 @@
     private boolean mClearAllForwardHistoryRequired;
     private boolean mShouldClearRedirectHistoryForTabClobbering;
 
-    public static void createForTab(Tab tab) {
-        assert get(tab) == null;
-        tab.getUserDataHost().setUserData(USER_DATA_KEY, new InterceptNavigationDelegateImpl(tab));
-    }
-
-    public static InterceptNavigationDelegateImpl get(Tab tab) {
-        return tab.getUserDataHost().getUserData(USER_DATA_KEY);
-    }
-
     /**
      * Default constructor of {@link InterceptNavigationDelegateImpl}.
      */
     @VisibleForTesting
-    InterceptNavigationDelegateImpl(Tab tab) {
+    InterceptNavigationDelegateImpl(Tab tab, InterceptNavigationDelegateClient client) {
         mTab = (TabImpl) tab;
+        mClient = client;
         mAuthenticatorHelper = AppHooks.get().createAuthenticatorNavigationInterceptor(mTab);
         mDelegateObserver = new EmptyTabObserver() {
             @Override
@@ -97,10 +87,9 @@
             }
         };
         mTab.addObserver(mDelegateObserver);
-        associateWithWebContents(mTab.getWebContents());
+        associateWithWebContents(mClient.getWebContents());
     }
 
-    @Override
     public void destroy() {
         mTab.removeObserver(mDelegateObserver);
     }
@@ -241,7 +230,7 @@
      * entries from the navigation history. See crbug.com/426679
      */
     public void maybeUpdateNavigationHistory() {
-        WebContents webContents = mTab.getWebContents();
+        WebContents webContents = mClient.getWebContents();
         if (mClearAllForwardHistoryRequired && webContents != null) {
             webContents.getNavigationController().pruneForwardEntries();
         } else if (mShouldClearRedirectHistoryForTabClobbering
@@ -269,13 +258,13 @@
     }
 
     private int getLastCommittedEntryIndex() {
-        if (mTab.getWebContents() == null) return -1;
-        return mTab.getWebContents().getNavigationController().getLastCommittedEntryIndex();
+        if (mClient.getWebContents() == null) return -1;
+        return mClient.getWebContents().getNavigationController().getLastCommittedEntryIndex();
     }
 
     private boolean shouldCloseContentsOnOverrideUrlLoadingAndLaunchIntent() {
-        if (mTab.getWebContents() == null) return false;
-        if (!mTab.getWebContents().getNavigationController().canGoToOffset(0)) return true;
+        if (mClient.getWebContents() == null) return false;
+        if (!mClient.getWebContents().getNavigationController().canGoToOffset(0)) return true;
 
         // http://crbug/415948 : if the last committed entry index which was saved before this
         // navigation is invalid, it means that this navigation is the first one since this tab was
@@ -295,7 +284,7 @@
      * @param shouldCloseTab
      */
     private void onOverrideUrlLoadingAndLaunchIntent(boolean shouldCloseTab) {
-        if (mTab.getWebContents() == null) return;
+        if (mClient.getWebContents() == null) return;
 
         // Before leaving Chrome, close the empty child tab.
         // If a new tab is created through JavaScript open to load this
@@ -325,7 +314,7 @@
                 // was saved before this navigation, and remove the empty entries from the
                 // navigation history.
                 mClearAllForwardHistoryRequired = true;
-                mTab.getWebContents().getNavigationController().goToNavigationIndex(
+                mClient.getWebContents().getNavigationController().goToNavigationIndex(
                         lastCommittedEntryIndexBeforeNavigation);
             }
         }
@@ -335,14 +324,13 @@
         int resId = mExternalNavHandler.canExternalAppHandleUrl(url)
                 ? R.string.blocked_navigation_warning
                 : R.string.unreachable_navigation_warning;
-        mTab.getWebContents().addMessageToDevToolsConsole(ConsoleMessageLevel.WARNING,
+        mClient.getWebContents().addMessageToDevToolsConsole(ConsoleMessageLevel.WARNING,
                 ContextUtils.getApplicationContext().getString(resId, url));
     }
 
     @VisibleForTesting
     static void initDelegateForTesting(Tab tab, InterceptNavigationDelegateImpl delegate) {
         delegate.associateWithWebContents(tab.getWebContents());
-        tab.getUserDataHost().setUserData(USER_DATA_KEY, delegate);
     }
 
     @NativeMethods

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tab/InterceptNavigationDelegateTabHelper.java b/chrome/android/java/src/org/chromium/chrome/browser/tab/InterceptNavigationDelegateTabHelper.java
new file mode 100644
index 0000000..a944ddb3
--- /dev/null
+++ b/chrome/android/java/src/org/chromium/chrome/browser/tab/InterceptNavigationDelegateTabHelper.java

@@ -0,0 +1,40 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+package org.chromium.chrome.browser.tab;
+
+import org.chromium.base.UserData;
+
+/**
+ * Class that glues InterceptNavigationDelegateImpl objects to Tabs.
+ */
+public class InterceptNavigationDelegateTabHelper implements UserData {
+    private static final Class<InterceptNavigationDelegateTabHelper> USER_DATA_KEY =
+            InterceptNavigationDelegateTabHelper.class;
+
+    private final InterceptNavigationDelegateImpl mInterceptNavigationDelegate;
+
+    public static void createForTab(Tab tab) {
+        assert get(tab) == null;
+        tab.getUserDataHost().setUserData(
+                USER_DATA_KEY, new InterceptNavigationDelegateTabHelper(tab));
+    }
+
+    public static InterceptNavigationDelegateImpl get(Tab tab) {
+        InterceptNavigationDelegateTabHelper helper =
+                tab.getUserDataHost().getUserData(USER_DATA_KEY);
+        if (helper == null) return null;
+        return helper.mInterceptNavigationDelegate;
+    }
+
+    InterceptNavigationDelegateTabHelper(Tab tab) {
+        mInterceptNavigationDelegate = new InterceptNavigationDelegateImpl(
+                tab, new InterceptNavigationDelegateClientImpl(tab));
+    }
+
+    @Override
+    public void destroy() {
+        mInterceptNavigationDelegate.destroy();
+    }
+}

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tab/TabHelpers.java b/chrome/android/java/src/org/chromium/chrome/browser/tab/TabHelpers.java
index a5ee3e7..33779b9 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/tab/TabHelpers.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/tab/TabHelpers.java

@@ -28,7 +28,7 @@
         TabUma.createForTab(tab);
         TabDistillabilityProvider.createForTab(tab);
         TabThemeColorHelper.createForTab(tab);
-        InterceptNavigationDelegateImpl.createForTab(tab);
+        InterceptNavigationDelegateTabHelper.createForTab(tab);
         ContextualSearchTabHelper.createForTab(tab);
         MediaSessionTabHelper.createForTab(tab);
         TaskTabHelper.createForTab(tab, parentTab);

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedNavigationBarColorController.java b/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedNavigationBarColorController.java
index 916407a..6339b466 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedNavigationBarColorController.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedNavigationBarColorController.java

@@ -9,7 +9,6 @@
 import android.content.res.Resources;
 import android.graphics.Color;
 import android.os.Build;
-import android.view.View;
 import android.view.ViewGroup;
 import android.view.Window;
 
@@ -29,7 +28,6 @@
 import org.chromium.chrome.browser.tabmodel.TabModelSelector;
 import org.chromium.chrome.browser.tabmodel.TabModelSelectorObserver;
 import org.chromium.chrome.browser.tasks.tab_management.TabUiFeatureUtilities;
-import org.chromium.chrome.browser.ui.ImmersiveModeManager;
 import org.chromium.chrome.browser.vr.VrModuleProvider;
 import org.chromium.ui.UiUtils;
 import org.chromium.ui.vr.VrModeObserver;
@@ -59,12 +57,10 @@
      * @param window The {@link Window} this controller should operate on.
      * @param tabModelSelector The {@link TabModelSelector} used to determine which tab model is
      *                         selected.
-     * @param immersiveModeManager The {@link ImmersiveModeManager} for the containing activity.
      * @param overviewModeBehaviorSupplier An {@link ObservableSupplier} for the
      *         {@link OverviewModeBehavior} associated with the containing activity.
      */
     TabbedNavigationBarColorController(Window window, TabModelSelector tabModelSelector,
-            @Nullable ImmersiveModeManager immersiveModeManager,
             ObservableSupplier<OverviewModeBehavior> overviewModeBehaviorSupplier) {
         assert Build.VERSION.SDK_INT >= Build.VERSION_CODES.O_MR1;
 
@@ -72,22 +68,6 @@
         mRootView = (ViewGroup) mWindow.getDecorView().getRootView();
         mResources = mRootView.getResources();
 
-        if (immersiveModeManager != null && immersiveModeManager.isImmersiveModeSupported()) {
-            // TODO(https://crbug.com/937946): Hook up immersive mode observer.
-            mTabModelSelector = null;
-            mTabModelSelectorObserver = null;
-
-            window.setNavigationBarColor(Color.TRANSPARENT);
-            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.P) {
-                window.setNavigationBarDividerColor(Color.TRANSPARENT);
-            }
-            int visibility =
-                    mRootView.getSystemUiVisibility() & ~View.SYSTEM_UI_FLAG_LIGHT_NAVIGATION_BAR;
-            mRootView.setSystemUiVisibility(visibility);
-
-            return;
-        }
-
         // If we're not using a light navigation bar, it will always be black so there's no need
         // to register observers and manipulate coloring.
         if (!mResources.getBoolean(R.bool.window_light_navigation_bar)) {
@@ -169,7 +149,6 @@
     public void onExitVr() {
         // The platform ignores the light navigation bar system UI flag when launching an Activity
         // in VR mode, so we need to restore it when VR is exited.
-        // TODO(https://crbug.com/937946): How does this interact with immersive mode?
         UiUtils.setNavigationBarIconColor(mRootView, mUseLightNavigation);
     }
 

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedRootUiCoordinator.java b/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedRootUiCoordinator.java
index 4c102b0e..fab06e2 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedRootUiCoordinator.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedRootUiCoordinator.java

@@ -20,7 +20,6 @@
 import org.chromium.base.task.PostTask;
 import org.chromium.chrome.R;
 import org.chromium.chrome.browser.ActivityTabProvider;
-import org.chromium.chrome.browser.AppHooks;
 import org.chromium.chrome.browser.ChromeActivity;
 import org.chromium.chrome.browser.compositor.bottombar.ephemeraltab.EphemeralTabCoordinator;
 import org.chromium.chrome.browser.compositor.layouts.LayoutManager;
@@ -44,7 +43,6 @@
 import org.chromium.chrome.browser.tasks.tab_management.TabUiFeatureUtilities;
 import org.chromium.chrome.browser.toolbar.ToolbarButtonInProductHelpController;
 import org.chromium.chrome.browser.toolbar.bottom.BottomToolbarConfiguration;
-import org.chromium.chrome.browser.ui.ImmersiveModeManager;
 import org.chromium.chrome.browser.ui.RootUiCoordinator;
 import org.chromium.chrome.browser.ui.appmenu.AppMenuHandler;
 import org.chromium.chrome.browser.ui.tablet.emptybackground.EmptyBackgroundViewWrapper;
@@ -62,7 +60,6 @@
     private static final int STATUS_INDICATOR_WAIT_BEFORE_HIDE_DURATION_MS = 2000;
 
     private final ObservableSupplierImpl<EphemeralTabCoordinator> mEphemeralTabCoordinatorSupplier;
-    private @Nullable ImmersiveModeManager mImmersiveModeManager;
     private TabbedSystemUiCoordinator mSystemUiCoordinator;
     private @Nullable EmptyBackgroundViewWrapper mEmptyBackgroundViewWrapper;
 
@@ -94,7 +91,6 @@
 
     @Override
     public void destroy() {
-        if (mImmersiveModeManager != null) mImmersiveModeManager.destroy();
         if (mSystemUiCoordinator != null) mSystemUiCoordinator.destroy();
         if (mEmptyBackgroundViewWrapper != null) mEmptyBackgroundViewWrapper.destroy();
 
@@ -115,15 +111,8 @@
     public void onPostInflationStartup() {
         super.onPostInflationStartup();
 
-        mImmersiveModeManager = AppHooks.get().createImmersiveModeManager(
-                mActivity.getWindow().getDecorView().findViewById(android.R.id.content));
         mSystemUiCoordinator = new TabbedSystemUiCoordinator(mActivity.getWindow(),
-                mActivity.getTabModelSelector(), mImmersiveModeManager,
-                mActivity.getOverviewModeBehaviorSupplier());
-
-        if (mImmersiveModeManager != null) {
-            getToolbarManager().setImmersiveModeManager(mImmersiveModeManager);
-        }
+                mActivity.getTabModelSelector(), mActivity.getOverviewModeBehaviorSupplier());
     }
 
     @Override

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedSystemUiCoordinator.java b/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedSystemUiCoordinator.java
index ec7c4207..7740450 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedSystemUiCoordinator.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedSystemUiCoordinator.java

@@ -12,7 +12,6 @@
 import org.chromium.base.supplier.ObservableSupplier;
 import org.chromium.chrome.browser.compositor.layouts.OverviewModeBehavior;
 import org.chromium.chrome.browser.tabmodel.TabModelSelector;
-import org.chromium.chrome.browser.ui.ImmersiveModeManager;
 
 /**
  * A UI coordinator that manages the system status bar and bottom navigation bar for
@@ -29,17 +28,15 @@
      *
      * @param window The {@link Window} associated with the containing activity.
      * @param tabModelSelector The {@link TabModelSelector} for the containing activity.
-     * @param immersiveModeManager The {@link ImmersiveModeManager} for the containing activity.
      * @param overviewModeBehaviorSupplier An {@link ObservableSupplier} for the
      *         {@link OverviewModeBehavior} associated with the containing activity.
      */
     public TabbedSystemUiCoordinator(Window window, TabModelSelector tabModelSelector,
-            @Nullable ImmersiveModeManager immersiveModeManager,
             @Nullable ObservableSupplier<OverviewModeBehavior> overviewModeBehaviorSupplier) {
         if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O_MR1) {
             assert overviewModeBehaviorSupplier != null;
             mNavigationBarColorController = new TabbedNavigationBarColorController(
-                    window, tabModelSelector, immersiveModeManager, overviewModeBehaviorSupplier);
+                    window, tabModelSelector, overviewModeBehaviorSupplier);
         }
     }
 

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/TabModelImpl.java b/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/TabModelImpl.java
index 341289e7..a74a388 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/TabModelImpl.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/TabModelImpl.java

@@ -12,6 +12,7 @@
 import org.chromium.chrome.browser.homepage.HomepageManager;
 import org.chromium.chrome.browser.ntp.RecentlyClosedBridge;
 import org.chromium.chrome.browser.tab.InterceptNavigationDelegateImpl;
+import org.chromium.chrome.browser.tab.InterceptNavigationDelegateTabHelper;
 import org.chromium.chrome.browser.tab.Tab;
 import org.chromium.chrome.browser.tab.TabCreationState;
 import org.chromium.chrome.browser.tab.TabLaunchType;
@@ -813,7 +814,7 @@
 
         // If shouldIgnoreNewTab returns true, the intent is handled by another
         // activity. As a result, don't launch a new tab to open the URL.
-        InterceptNavigationDelegateImpl delegate = InterceptNavigationDelegateImpl.get(parent);
+        InterceptNavigationDelegateImpl delegate = InterceptNavigationDelegateTabHelper.get(parent);
         if (delegate != null && delegate.shouldIgnoreNewTab(url, incognito)) return;
 
         LoadUrlParams loadUrlParams = new LoadUrlParams(url);

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/toolbar/ToolbarManager.java b/chrome/android/java/src/org/chromium/chrome/browser/toolbar/ToolbarManager.java
index 2430766283..f6666d3d 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/toolbar/ToolbarManager.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/toolbar/ToolbarManager.java

@@ -94,7 +94,6 @@
 import org.chromium.chrome.browser.toolbar.top.ToolbarLayout;
 import org.chromium.chrome.browser.toolbar.top.TopToolbarCoordinator;
 import org.chromium.chrome.browser.toolbar.top.ViewShiftingActionBarDelegate;
-import org.chromium.chrome.browser.ui.ImmersiveModeManager;
 import org.chromium.chrome.browser.ui.TabObscuringHandler;
 import org.chromium.chrome.browser.ui.appmenu.AppMenuButtonHelper;
 import org.chromium.chrome.browser.ui.appmenu.AppMenuCoordinator;
@@ -1578,15 +1577,6 @@
     }
 
     /**
-     * @param immersiveModeManager The {@link ImmersiveModeManager} for the containing activity.
-     */
-    public void setImmersiveModeManager(ImmersiveModeManager immersiveModeManager) {
-        if (mBottomControlsCoordinator != null) {
-            mBottomControlsCoordinator.setImmersiveModeManager(immersiveModeManager);
-        }
-    }
-
-    /**
      * Reverts any pending edits of the location bar and reset to the page state.  This does not
      * change the focus state of the location bar.
      */

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/toolbar/bottom/BottomControlsCoordinator.java b/chrome/android/java/src/org/chromium/chrome/browser/toolbar/bottom/BottomControlsCoordinator.java
index f3b72d0..9c176c9b 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/toolbar/bottom/BottomControlsCoordinator.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/toolbar/bottom/BottomControlsCoordinator.java

@@ -30,7 +30,6 @@
 import org.chromium.chrome.browser.toolbar.IncognitoStateProvider;
 import org.chromium.chrome.browser.toolbar.TabCountProvider;
 import org.chromium.chrome.browser.toolbar.bottom.BottomControlsViewBinder.ViewHolder;
-import org.chromium.chrome.browser.ui.ImmersiveModeManager;
 import org.chromium.chrome.browser.ui.appmenu.AppMenuButtonHelper;
 import org.chromium.ui.base.WindowAndroid;
 import org.chromium.ui.modelutil.PropertyModel;
@@ -91,22 +90,18 @@
                 model, new ViewHolder(root), BottomControlsViewBinder::bind);
 
         int bottomToolbarHeightId;
-        int bottomToolbarHeightWithShadowId;
 
         if (BottomToolbarConfiguration.isLabeledBottomToolbarEnabled()) {
             bottomToolbarHeightId = R.dimen.labeled_bottom_toolbar_height;
-            bottomToolbarHeightWithShadowId = R.dimen.labeled_bottom_toolbar_height_with_shadow;
         } else {
             bottomToolbarHeightId = R.dimen.bottom_toolbar_height;
-            bottomToolbarHeightWithShadowId = R.dimen.bottom_toolbar_height_with_shadow;
         }
 
         View toolbar = root.findViewById(R.id.bottom_container_slot);
         ViewGroup.LayoutParams params = toolbar.getLayoutParams();
         params.height = root.getResources().getDimensionPixelOffset(bottomToolbarHeightId);
         mMediator = new BottomControlsMediator(model, fullscreenManager,
-                root.getResources().getDimensionPixelOffset(bottomToolbarHeightId),
-                root.getResources().getDimensionPixelOffset(bottomToolbarHeightWithShadowId));
+                root.getResources().getDimensionPixelOffset(bottomToolbarHeightId));
 
         if (TabManagementModuleProvider.getDelegate() != null
                 && TabUiFeatureUtilities.isTabGroupsAndroidEnabled()
@@ -128,13 +123,6 @@
     }
 
     /**
-     * @param immersiveModeManager The {@link ImmersiveModeManager} for the containing activity.
-     */
-    public void setImmersiveModeManager(ImmersiveModeManager immersiveModeManager) {
-        mMediator.setImmersiveModeManager(immersiveModeManager);
-    }
-
-    /**
      * Initialize the bottom controls with the components that had native initialization
      * dependencies.
      * <p>

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/toolbar/bottom/BottomControlsMediator.java b/chrome/android/java/src/org/chromium/chrome/browser/toolbar/bottom/BottomControlsMediator.java
index 29c3d548..f5b87a5 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/toolbar/bottom/BottomControlsMediator.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/toolbar/bottom/BottomControlsMediator.java

@@ -4,8 +4,6 @@
 
 package org.chromium.chrome.browser.toolbar.bottom;
 
-import androidx.annotation.Nullable;
-
 import org.chromium.chrome.browser.compositor.bottombar.OverlayPanelManager;
 import org.chromium.chrome.browser.compositor.layouts.Layout;
 import org.chromium.chrome.browser.compositor.layouts.LayoutManager;
@@ -13,7 +11,6 @@
 import org.chromium.chrome.browser.compositor.layouts.ToolbarSwipeLayout;
 import org.chromium.chrome.browser.compositor.layouts.eventfilter.EdgeSwipeHandler;
 import org.chromium.chrome.browser.fullscreen.ChromeFullscreenManager;
-import org.chromium.chrome.browser.ui.ImmersiveModeManager;
 import org.chromium.ui.KeyboardVisibilityDelegate;
 import org.chromium.ui.base.WindowAndroid;
 import org.chromium.ui.modelutil.PropertyModel;
@@ -27,8 +24,7 @@
 class BottomControlsMediator implements ChromeFullscreenManager.FullscreenListener,
                                         KeyboardVisibilityDelegate.KeyboardVisibilityListener,
                                         SceneChangeObserver,
-                                        OverlayPanelManager.OverlayPanelManagerObserver,
-                                        ImmersiveModeManager.ImmersiveModeObserver {
+                                        OverlayPanelManager.OverlayPanelManagerObserver {
     /** The model for the bottom controls component that holds all of its view state. */
     private final PropertyModel mModel;
 
@@ -36,23 +32,10 @@
     private final ChromeFullscreenManager mFullscreenManager;
 
     /**
-     * The height of the bottom bar in pixels including any adjustments for immersive mode, but not
-     * including the top shadow.
+     * The height of the bottom bar in pixels, not including the top shadow.
      */
     private int mBottomControlsHeight;
 
-    /**
-     * The base height of the bottom bar in pixels not including adjustments for immersive mode or
-     * the top shadow.
-     */
-    private final int mBottomControlsBaseHeight;
-
-    /**
-     * The height of the bottom bar container (which includes the top shadow) in pixels not
-     * including any offset for immersive mode.
-     */
-    private final int mBottomControlsContainerBaseHeight;
-
     /** A {@link WindowAndroid} for watching keyboard visibility events. */
     private WindowAndroid mWindowAndroid;
 
@@ -68,9 +51,6 @@
     /** Whether the soft keyboard is visible. */
     private boolean mIsKeyboardVisible;
 
-    /** The {@link ImmersiveModeManager} for the containing activity.*/
-    private @Nullable ImmersiveModeManager mImmersiveModeManager;
-
     /**
      * Build a new mediator that handles events from outside the bottom controls component.
      * @param model The {@link BottomControlsProperties} that holds all the view state for the
@@ -78,20 +58,15 @@
      * @param fullscreenManager A {@link ChromeFullscreenManager} for events related to the browser
      *                          controls.
      * @param bottomControlsHeight The height of the bottom bar in pixels.
-     * @param bottomControlsContainerHeight The height of the bottom bar container in px. This
-     *                                      should be the height of {@code bottomControlsHeight}
-     *                                      plus the height of the top shadow.
      */
     BottomControlsMediator(PropertyModel model, ChromeFullscreenManager fullscreenManager,
-            int bottomControlsHeight, int bottomControlsContainerHeight) {
+            int bottomControlsHeight) {
         mModel = model;
 
         mFullscreenManager = fullscreenManager;
         mFullscreenManager.addListener(this);
 
-        mBottomControlsBaseHeight = bottomControlsHeight;
-        mBottomControlsHeight = mBottomControlsBaseHeight;
-        mBottomControlsContainerBaseHeight = bottomControlsContainerHeight;
+        mBottomControlsHeight = bottomControlsHeight;
     }
 
     /**
@@ -129,20 +104,6 @@
     }
 
     /**
-     * @param immersiveModeManager The {@link ImmersiveModeManager} for the containing activity.
-     */
-    void setImmersiveModeManager(ImmersiveModeManager immersiveModeManager) {
-        if (!immersiveModeManager.isImmersiveModeSupported()) return;
-
-        mImmersiveModeManager = immersiveModeManager;
-        mImmersiveModeManager.addObserver(this);
-
-        if (mImmersiveModeManager.getBottomUiInsetPx() != 0) {
-            onBottomUiInsetChanged(mImmersiveModeManager.getBottomUiInsetPx());
-        }
-    }
-
-    /**
      * Clean up anything that needs to be when the bottom controls component is destroyed.
      */
     void destroy() {
@@ -156,8 +117,6 @@
             manager.getOverlayPanelManager().removeObserver(this);
             manager.removeSceneChangeObserver(this);
         }
-
-        if (mImmersiveModeManager != null) mImmersiveModeManager.removeObserver(this);
     }
 
     @Override
@@ -238,17 +197,4 @@
                         && !mIsInSwipeLayout && mFullscreenManager.getBottomControlOffset() == 0
                         && !isInFullscreenMode());
     }
-
-    @Override
-    public void onImmersiveModeChanged(boolean inImmersiveMode) {}
-
-    @Override
-    public void onBottomUiInsetChanged(int bottomUiInsetPx) {
-        mBottomControlsHeight = mBottomControlsBaseHeight + bottomUiInsetPx;
-        mModel.set(BottomControlsProperties.BOTTOM_CONTROLS_HEIGHT_PX, mBottomControlsHeight);
-        mModel.set(BottomControlsProperties.BOTTOM_CONTROLS_CONTAINER_HEIGHT_PX,
-                mBottomControlsContainerBaseHeight + bottomUiInsetPx);
-
-        updateCompositedViewVisibility();
-    }
 }
\ No newline at end of file

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ui/ImmersiveModeManager.java b/chrome/android/java/src/org/chromium/chrome/browser/ui/ImmersiveModeManager.java
deleted file mode 100644
index 1daf1eee..0000000
--- a/chrome/android/java/src/org/chromium/chrome/browser/ui/ImmersiveModeManager.java
+++ /dev/null

@@ -1,59 +0,0 @@
-// Copyright 2019 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-package org.chromium.chrome.browser.ui;
-
-/**
- * Manages drawing an immersive UI mode. The lifecycle of the immersive mode manager is tied
- * to the activity. There is exactly one per activity and once created it lives until the activity
- * is destroyed.
- */
-public interface ImmersiveModeManager {
-    /**
-     * An observer to be notified about changes related to immersive UI mode.
-     */
-    interface ImmersiveModeObserver {
-        /**
-         * Called when entering or exiting immersive mode.
-         * @param inImmersiveMode Whether the UI is currently in immersive mode.
-         */
-        void onImmersiveModeChanged(boolean inImmersiveMode);
-
-        /**
-         * Called when the inset to apply to bottom anchored UI elements changes.
-         * @param bottomUiInsetPx The inset to apply in pixels.
-         */
-        void onBottomUiInsetChanged(int bottomUiInsetPx);
-    }
-
-    /**
-     * @return Whether immersive UI mode is supported. If not supported, observers may still be
-     *         registered, but they will never be called.
-     */
-    boolean isImmersiveModeSupported();
-
-    /**
-     * @return The inset to apply to bottom anchored UI elements in pixels.
-     */
-    default int getBottomUiInsetPx() {
-        return 0;
-    }
-
-    /**
-     * Add an observer to be notified of changes related to immersive UI mode.
-     * @param observer The observer to add.
-     */
-    void addObserver(ImmersiveModeObserver observer);
-
-    /**
-     * Remove a previously registered observer.
-     * @param observer The observer to remove.
-     */
-    void removeObserver(ImmersiveModeObserver observer);
-
-    /**
-     * Called when the containing activity is destroyed to clean up state.
-     */
-    void destroy();
-}

diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/customtabs/CustomTabFromChromeExternalNavigationTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/customtabs/CustomTabFromChromeExternalNavigationTest.java
index ca8bbc3..cb23b30 100644
--- a/chrome/android/javatests/src/org/chromium/chrome/browser/customtabs/CustomTabFromChromeExternalNavigationTest.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/customtabs/CustomTabFromChromeExternalNavigationTest.java

@@ -29,6 +29,7 @@
 import org.chromium.chrome.browser.customtabs.CustomTabDelegateFactory.CustomTabNavigationDelegate;
 import org.chromium.chrome.browser.flags.ChromeSwitches;
 import org.chromium.chrome.browser.tab.InterceptNavigationDelegateImpl;
+import org.chromium.chrome.browser.tab.InterceptNavigationDelegateTabHelper;
 import org.chromium.chrome.browser.tab.Tab;
 import org.chromium.chrome.browser.tab.TabDelegateFactory;
 import org.chromium.chrome.browser.tab.TabTestUtils;
@@ -129,7 +130,8 @@
 
         CriteriaHelper.pollUiThread(() -> {
             Tab tab = mActivityRule.getActivity().getActivityTab();
-            InterceptNavigationDelegateImpl delegate = InterceptNavigationDelegateImpl.get(tab);
+            InterceptNavigationDelegateImpl delegate =
+                    InterceptNavigationDelegateTabHelper.get(tab);
             if (delegate == null) return false;
             navigationDelegate.set(delegate);
             return true;

diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/externalnav/UrlOverridingTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/externalnav/UrlOverridingTest.java
index eae9785f..cd3671cc 100644
--- a/chrome/android/javatests/src/org/chromium/chrome/browser/externalnav/UrlOverridingTest.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/externalnav/UrlOverridingTest.java

@@ -33,6 +33,7 @@
 import org.chromium.chrome.browser.flags.ChromeSwitches;
 import org.chromium.chrome.browser.tab.EmptyTabObserver;
 import org.chromium.chrome.browser.tab.InterceptNavigationDelegateImpl;
+import org.chromium.chrome.browser.tab.InterceptNavigationDelegateTabHelper;
 import org.chromium.chrome.browser.tab.Tab;
 import org.chromium.chrome.browser.tab.TabCreationState;
 import org.chromium.chrome.browser.tabmodel.EmptyTabModelSelectorObserver;
@@ -289,7 +290,7 @@
 
     private static InterceptNavigationDelegateImpl getInterceptNavigationDelegate(Tab tab) {
         return TestThreadUtils.runOnUiThreadBlockingNoException(
-                () -> InterceptNavigationDelegateImpl.get(tab));
+                () -> InterceptNavigationDelegateTabHelper.get(tab));
     }
 
     @Test

diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/password_manager/settings/PasswordViewingTypeTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/password_manager/settings/PasswordViewingTypeTest.java
index 4a543f0..1dfedc8 100644
--- a/chrome/android/javatests/src/org/chromium/chrome/browser/password_manager/settings/PasswordViewingTypeTest.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/password_manager/settings/PasswordViewingTypeTest.java

@@ -25,6 +25,7 @@
 import org.chromium.chrome.browser.settings.SettingsActivity;
 import org.chromium.chrome.browser.settings.SettingsLauncher;
 import org.chromium.chrome.browser.sync.ProfileSyncService;
+import org.chromium.chrome.test.util.ApplicationTestUtils;
 import org.chromium.components.browser_ui.settings.ChromeBasePreference;
 import org.chromium.components.signin.AccountUtils;
 import org.chromium.components.signin.test.util.AccountHolder;
@@ -78,8 +79,9 @@
     }
 
     @After
-    public void tearDown() {
-        TestThreadUtils.runOnUiThreadBlocking(() -> ProfileSyncService.resetForTests());
+    public void tearDown() throws Exception {
+        ApplicationTestUtils.finishActivity(mMainSettings.getActivity());
+        TestThreadUtils.runOnUiThreadBlocking(ProfileSyncService::resetForTests);
     }
 
     /**

diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/signin/AccountPickerDialogFragmentTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/signin/AccountPickerDialogFragmentTest.java
index badba0f..a77dc891 100644
--- a/chrome/android/javatests/src/org/chromium/chrome/browser/signin/AccountPickerDialogFragmentTest.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/signin/AccountPickerDialogFragmentTest.java

@@ -20,6 +20,7 @@
 import androidx.test.filters.LargeTest;
 import androidx.test.filters.MediumTest;
 
+import org.junit.After;
 import org.junit.Before;
 import org.junit.Rule;
 import org.junit.Test;
@@ -87,6 +88,11 @@
         mDialog.show(fragmentManager, null);
     }
 
+    @After
+    public void tearDown() {
+        if (mDialog.getDialog() != null) mDialog.dismiss();
+    }
+
     @Test
     @MediumTest
     public void testTitle() {

diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/signin/SigninHelperTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/signin/SigninHelperTest.java
index 1da1ad5..8c73387b 100644
--- a/chrome/android/javatests/src/org/chromium/chrome/browser/signin/SigninHelperTest.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/signin/SigninHelperTest.java

@@ -7,7 +7,6 @@
 import android.accounts.Account;
 import android.support.test.filters.SmallTest;
 
-import org.junit.After;
 import org.junit.Assert;
 import org.junit.Before;
 import org.junit.Rule;
@@ -17,7 +16,6 @@
 import org.chromium.base.test.util.RetryOnFailure;
 import org.chromium.chrome.test.ChromeJUnit4ClassRunner;
 import org.chromium.chrome.test.util.browser.signin.MockChangeEventChecker;
-import org.chromium.components.signin.AccountManagerFacadeProvider;
 import org.chromium.components.signin.AccountUtils;
 import org.chromium.components.signin.ChromeSigninController;
 import org.chromium.components.signin.test.util.AccountHolder;
@@ -38,11 +36,6 @@
         mEventChecker = new MockChangeEventChecker();
     }
 
-    @After
-    public void tearDown() {
-        AccountManagerFacadeProvider.resetInstanceForTests();
-    }
-
     @Test
     @SmallTest
     @RetryOnFailure

diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/tab/InterceptNavigationDelegateTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/tab/InterceptNavigationDelegateTest.java
index 6af59a5e..f06fbaec 100644
--- a/chrome/android/javatests/src/org/chromium/chrome/browser/tab/InterceptNavigationDelegateTest.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/tab/InterceptNavigationDelegateTest.java

@@ -100,7 +100,8 @@
         mActivity = mActivityTestRule.getActivity();
         final Tab tab = mActivity.getActivityTab();
         TestThreadUtils.runOnUiThreadBlocking(() -> {
-            InterceptNavigationDelegateImpl delegate = new InterceptNavigationDelegateImpl(tab) {
+            InterceptNavigationDelegateImpl delegate = new InterceptNavigationDelegateImpl(
+                    tab, new InterceptNavigationDelegateClientImpl(tab)) {
                 @Override
                 public boolean shouldIgnoreNavigation(NavigationParams navigationParams) {
                     mNavParamHistory.add(navigationParams);

diff --git a/chrome/android/profiles/newest.txt b/chrome/android/profiles/newest.txt
index 4463820..9bcaeb0 100644
--- a/chrome/android/profiles/newest.txt
+++ b/chrome/android/profiles/newest.txt

@@ -1 +1 @@
-chromeos-chrome-amd64-84.0.4108.0_rc-r1-merged.afdo.bz2
\ No newline at end of file
+chromeos-chrome-amd64-84.0.4109.0_rc-r1-merged.afdo.bz2
\ No newline at end of file

diff --git a/chrome/app/settings_chromium_strings.grdp b/chrome/app/settings_chromium_strings.grdp
index 0c71911..8100034 100644
--- a/chrome/app/settings_chromium_strings.grdp
+++ b/chrome/app/settings_chromium_strings.grdp

@@ -43,6 +43,27 @@
   <message name="IDS_SETTINGS_GOOGLE_PAYMENTS_CACHED" desc="Label that will be used to show that a credit card comes from Google Pay and is saved locally. This should follow the casing of the 'Google Pay' and 'Chrome' brands. 'Copied to Chromium' is short for 'The credit card is copied to Chromium'. 'Google Pay' should not be translated as it is the product name.">
     Google Pay (copied to Chromium)
   </message>
+  <message name="IDS_SETTINGS_CHECK_PASSWORDS_ERROR_OFFLINE" desc="Error message when the password check can't be completed because the user is offline.">
+    Chromium can't check your passwords. Try checking your internet connection.
+  </message>
+  <message name="IDS_SETTINGS_CHECK_PASSWORDS_ERROR_SIGNED_OUT" desc="Error message when the password check can't be completed because the user is not signed in.">
+    Chromium can check your passwords when you sign in with your Google Account
+  </message>
+  <message name="IDS_SETTINGS_CHECK_PASSWORDS_ERROR_NO_PASSWORDS" desc="Error message when the password check can't be completed since no passwords could be checked.">
+    No saved passwords. Chromium can check your passwords when you save them.
+  </message>
+  <message name="IDS_SETTINGS_CHECK_PASSWORDS_ERROR_QUOTA_LIMIT_GOOGLE_ACCOUNT" desc="Error message when the password check can't be completed since the user hit the quota limit, but the user is able to check their passwords in their Google account.">
+    Chromium can't check your passwords. Try again after 24 hours or <ph name="BEGIN_LINK">&lt;a href="$1" target="_blank"&gt;</ph>check passwords in your Google Account<ph name="END_LINK">&lt;/a&gt;</ph>.
+  </message>
+  <message name="IDS_SETTINGS_CHECK_PASSWORDS_ERROR_QUOTA_LIMIT" desc="Error message when the password check can't be completed since the user hit the quota limit.">
+    Chromium can't check your passwords. Try again after 24 hours.
+  </message>
+  <message name="IDS_SETTINGS_CHECK_PASSWORDS_ERROR_GENERIC" desc="Error message when the password check can't be completed for an unspecified reason.">
+    Chromium can't check your passwords. Try again later.
+  </message>
+  <message name="IDS_SETTINGS_NO_COMPROMISED_CREDENTIALS_LABEL" desc="Label which is shown when there were no compromised passwords detected.">
+    Chromium will notify you when you sign in with a compromised password
+  </message>
 
   <!-- Default Browser Page -->
   <if expr="not chromeos">

diff --git a/chrome/app/settings_strings_grdp/IDS_SETTINGS_CHECK_PASSWORDS_ERROR_GENERIC.png.sha1 b/chrome/app/settings_chromium_strings_grdp/IDS_SETTINGS_CHECK_PASSWORDS_ERROR_GENERIC.png.sha1
similarity index 100%
rename from chrome/app/settings_strings_grdp/IDS_SETTINGS_CHECK_PASSWORDS_ERROR_GENERIC.png.sha1
rename to chrome/app/settings_chromium_strings_grdp/IDS_SETTINGS_CHECK_PASSWORDS_ERROR_GENERIC.png.sha1


diff --git a/chrome/app/settings_strings_grdp/IDS_SETTINGS_CHECK_PASSWORDS_ERROR_NO_PASSWORDS.png.sha1 b/chrome/app/settings_chromium_strings_grdp/IDS_SETTINGS_CHECK_PASSWORDS_ERROR_NO_PASSWORDS.png.sha1
similarity index 100%
rename from chrome/app/settings_strings_grdp/IDS_SETTINGS_CHECK_PASSWORDS_ERROR_NO_PASSWORDS.png.sha1
rename to chrome/app/settings_chromium_strings_grdp/IDS_SETTINGS_CHECK_PASSWORDS_ERROR_NO_PASSWORDS.png.sha1


diff --git a/chrome/app/settings_strings_grdp/IDS_SETTINGS_CHECK_PASSWORDS_ERROR_OFFLINE.png.sha1 b/chrome/app/settings_chromium_strings_grdp/IDS_SETTINGS_CHECK_PASSWORDS_ERROR_OFFLINE.png.sha1
similarity index 100%
rename from chrome/app/settings_strings_grdp/IDS_SETTINGS_CHECK_PASSWORDS_ERROR_OFFLINE.png.sha1
rename to chrome/app/settings_chromium_strings_grdp/IDS_SETTINGS_CHECK_PASSWORDS_ERROR_OFFLINE.png.sha1


diff --git a/chrome/app/settings_strings_grdp/IDS_SETTINGS_CHECK_PASSWORDS_ERROR_QUOTA_LIMIT.png.sha1 b/chrome/app/settings_chromium_strings_grdp/IDS_SETTINGS_CHECK_PASSWORDS_ERROR_QUOTA_LIMIT.png.sha1
similarity index 100%
rename from chrome/app/settings_strings_grdp/IDS_SETTINGS_CHECK_PASSWORDS_ERROR_QUOTA_LIMIT.png.sha1
rename to chrome/app/settings_chromium_strings_grdp/IDS_SETTINGS_CHECK_PASSWORDS_ERROR_QUOTA_LIMIT.png.sha1


diff --git a/chrome/app/settings_strings_grdp/IDS_SETTINGS_CHECK_PASSWORDS_ERROR_QUOTA_LIMIT_GOOGLE_ACCOUNT.png.sha1 b/chrome/app/settings_chromium_strings_grdp/IDS_SETTINGS_CHECK_PASSWORDS_ERROR_QUOTA_LIMIT_GOOGLE_ACCOUNT.png.sha1
similarity index 100%
rename from chrome/app/settings_strings_grdp/IDS_SETTINGS_CHECK_PASSWORDS_ERROR_QUOTA_LIMIT_GOOGLE_ACCOUNT.png.sha1
rename to chrome/app/settings_chromium_strings_grdp/IDS_SETTINGS_CHECK_PASSWORDS_ERROR_QUOTA_LIMIT_GOOGLE_ACCOUNT.png.sha1


diff --git a/chrome/app/settings_strings_grdp/IDS_SETTINGS_CHECK_PASSWORDS_ERROR_SIGNED_OUT.png.sha1 b/chrome/app/settings_chromium_strings_grdp/IDS_SETTINGS_CHECK_PASSWORDS_ERROR_SIGNED_OUT.png.sha1
similarity index 100%
rename from chrome/app/settings_strings_grdp/IDS_SETTINGS_CHECK_PASSWORDS_ERROR_SIGNED_OUT.png.sha1
rename to chrome/app/settings_chromium_strings_grdp/IDS_SETTINGS_CHECK_PASSWORDS_ERROR_SIGNED_OUT.png.sha1


diff --git a/chrome/app/settings_strings_grdp/IDS_SETTINGS_NO_COMPROMISED_CREDENTIALS_LABEL.png.sha1 b/chrome/app/settings_chromium_strings_grdp/IDS_SETTINGS_NO_COMPROMISED_CREDENTIALS_LABEL.png.sha1
similarity index 100%
rename from chrome/app/settings_strings_grdp/IDS_SETTINGS_NO_COMPROMISED_CREDENTIALS_LABEL.png.sha1
rename to chrome/app/settings_chromium_strings_grdp/IDS_SETTINGS_NO_COMPROMISED_CREDENTIALS_LABEL.png.sha1


diff --git a/chrome/app/settings_google_chrome_strings.grdp b/chrome/app/settings_google_chrome_strings.grdp
index b413e3e..f0c809f 100644
--- a/chrome/app/settings_google_chrome_strings.grdp
+++ b/chrome/app/settings_google_chrome_strings.grdp

@@ -43,6 +43,27 @@
   <message name="IDS_SETTINGS_GOOGLE_PAYMENTS_CACHED" desc="Label that will be used to show that a credit card comes from Google Pay and is saved locally. This should follow the casing of the 'Google Pay' and 'Chrome' brands. 'Copied to Chrome' is short for 'The credit card is copied to Chrome'. 'Google Pay' should not be translated as it is the product name.">
     Google Pay (copied to Chrome)
   </message>
+  <message name="IDS_SETTINGS_CHECK_PASSWORDS_ERROR_OFFLINE" desc="Error message when the password check can't be completed because the user is offline.">
+    Chrome can't check your passwords. Try checking your internet connection.
+  </message>
+  <message name="IDS_SETTINGS_CHECK_PASSWORDS_ERROR_SIGNED_OUT" desc="Error message when the password check can't be completed because the user is not signed in.">
+    Chrome can check your passwords when you sign in with your Google Account
+  </message>
+  <message name="IDS_SETTINGS_CHECK_PASSWORDS_ERROR_NO_PASSWORDS" desc="Error message when the password check can't be completed since no passwords could be checked.">
+    No saved passwords. Chrome can check your passwords when you save them.
+  </message>
+  <message name="IDS_SETTINGS_CHECK_PASSWORDS_ERROR_QUOTA_LIMIT_GOOGLE_ACCOUNT" desc="Error message when the password check can't be completed since the user hit the quota limit, but the user is able to check their passwords in their Google account.">
+    Chrome can't check your passwords. Try again after 24 hours or <ph name="BEGIN_LINK">&lt;a href="$1" target="_blank"&gt;</ph>check passwords in your Google Account<ph name="END_LINK">&lt;/a&gt;</ph>.
+  </message>
+  <message name="IDS_SETTINGS_CHECK_PASSWORDS_ERROR_QUOTA_LIMIT" desc="Error message when the password check can't be completed since the user hit the quota limit.">
+    Chrome can't check your passwords. Try again after 24 hours.
+  </message>
+  <message name="IDS_SETTINGS_CHECK_PASSWORDS_ERROR_GENERIC" desc="Error message when the password check can't be completed for an unspecified reason.">
+    Chrome can't check your passwords. Try again later.
+  </message>
+  <message name="IDS_SETTINGS_NO_COMPROMISED_CREDENTIALS_LABEL" desc="Label which is shown when there were no compromised passwords detected.">
+    Chrome will notify you when you sign in with a compromised password
+  </message>
 
   <!-- Default Browser Page -->
   <if expr="not chromeos">

diff --git a/chrome/app/settings_strings_grdp/IDS_SETTINGS_CHECK_PASSWORDS_ERROR_GENERIC.png.sha1 b/chrome/app/settings_google_chrome_strings_grdp/IDS_SETTINGS_CHECK_PASSWORDS_ERROR_GENERIC.png.sha1
similarity index 100%
copy from chrome/app/settings_strings_grdp/IDS_SETTINGS_CHECK_PASSWORDS_ERROR_GENERIC.png.sha1
copy to chrome/app/settings_google_chrome_strings_grdp/IDS_SETTINGS_CHECK_PASSWORDS_ERROR_GENERIC.png.sha1


diff --git a/chrome/app/settings_strings_grdp/IDS_SETTINGS_CHECK_PASSWORDS_ERROR_NO_PASSWORDS.png.sha1 b/chrome/app/settings_google_chrome_strings_grdp/IDS_SETTINGS_CHECK_PASSWORDS_ERROR_NO_PASSWORDS.png.sha1
similarity index 100%
copy from chrome/app/settings_strings_grdp/IDS_SETTINGS_CHECK_PASSWORDS_ERROR_NO_PASSWORDS.png.sha1
copy to chrome/app/settings_google_chrome_strings_grdp/IDS_SETTINGS_CHECK_PASSWORDS_ERROR_NO_PASSWORDS.png.sha1


diff --git a/chrome/app/settings_strings_grdp/IDS_SETTINGS_CHECK_PASSWORDS_ERROR_OFFLINE.png.sha1 b/chrome/app/settings_google_chrome_strings_grdp/IDS_SETTINGS_CHECK_PASSWORDS_ERROR_OFFLINE.png.sha1
similarity index 100%
copy from chrome/app/settings_strings_grdp/IDS_SETTINGS_CHECK_PASSWORDS_ERROR_OFFLINE.png.sha1
copy to chrome/app/settings_google_chrome_strings_grdp/IDS_SETTINGS_CHECK_PASSWORDS_ERROR_OFFLINE.png.sha1


diff --git a/chrome/app/settings_strings_grdp/IDS_SETTINGS_CHECK_PASSWORDS_ERROR_QUOTA_LIMIT.png.sha1 b/chrome/app/settings_google_chrome_strings_grdp/IDS_SETTINGS_CHECK_PASSWORDS_ERROR_QUOTA_LIMIT.png.sha1
similarity index 100%
copy from chrome/app/settings_strings_grdp/IDS_SETTINGS_CHECK_PASSWORDS_ERROR_QUOTA_LIMIT.png.sha1
copy to chrome/app/settings_google_chrome_strings_grdp/IDS_SETTINGS_CHECK_PASSWORDS_ERROR_QUOTA_LIMIT.png.sha1


diff --git a/chrome/app/settings_strings_grdp/IDS_SETTINGS_CHECK_PASSWORDS_ERROR_QUOTA_LIMIT_GOOGLE_ACCOUNT.png.sha1 b/chrome/app/settings_google_chrome_strings_grdp/IDS_SETTINGS_CHECK_PASSWORDS_ERROR_QUOTA_LIMIT_GOOGLE_ACCOUNT.png.sha1
similarity index 100%
copy from chrome/app/settings_strings_grdp/IDS_SETTINGS_CHECK_PASSWORDS_ERROR_QUOTA_LIMIT_GOOGLE_ACCOUNT.png.sha1
copy to chrome/app/settings_google_chrome_strings_grdp/IDS_SETTINGS_CHECK_PASSWORDS_ERROR_QUOTA_LIMIT_GOOGLE_ACCOUNT.png.sha1


diff --git a/chrome/app/settings_strings_grdp/IDS_SETTINGS_CHECK_PASSWORDS_ERROR_SIGNED_OUT.png.sha1 b/chrome/app/settings_google_chrome_strings_grdp/IDS_SETTINGS_CHECK_PASSWORDS_ERROR_SIGNED_OUT.png.sha1
similarity index 100%
copy from chrome/app/settings_strings_grdp/IDS_SETTINGS_CHECK_PASSWORDS_ERROR_SIGNED_OUT.png.sha1
copy to chrome/app/settings_google_chrome_strings_grdp/IDS_SETTINGS_CHECK_PASSWORDS_ERROR_SIGNED_OUT.png.sha1


diff --git a/chrome/app/settings_strings_grdp/IDS_SETTINGS_NO_COMPROMISED_CREDENTIALS_LABEL.png.sha1 b/chrome/app/settings_google_chrome_strings_grdp/IDS_SETTINGS_NO_COMPROMISED_CREDENTIALS_LABEL.png.sha1
similarity index 100%
copy from chrome/app/settings_strings_grdp/IDS_SETTINGS_NO_COMPROMISED_CREDENTIALS_LABEL.png.sha1
copy to chrome/app/settings_google_chrome_strings_grdp/IDS_SETTINGS_NO_COMPROMISED_CREDENTIALS_LABEL.png.sha1


diff --git a/chrome/app/settings_strings.grdp b/chrome/app/settings_strings.grdp
index 7a4a3fc..15df5261 100644
--- a/chrome/app/settings_strings.grdp
+++ b/chrome/app/settings_strings.grdp

@@ -301,24 +301,6 @@
   <message name="IDS_SETTINGS_CHECK_PASSWORDS_DESCRIPTION" desc="Explanation of the passwords bulk check feature found within the password settings.">
     Keep your passwords safe from data breaches and other security issues
   </message>
-  <message name="IDS_SETTINGS_CHECK_PASSWORDS_ERROR_OFFLINE" desc="Error message when the password check can't be completed because the user is offline.">
-    <ph name="IDS_SHORT_PRODUCT_NAME">$1<ex>Chrome</ex></ph> can't check your passwords. Try checking your internet connection.
-  </message>
-  <message name="IDS_SETTINGS_CHECK_PASSWORDS_ERROR_SIGNED_OUT" desc="Error message when the password check can't be completed because the user is not signed in.">
-    <ph name="IDS_SHORT_PRODUCT_NAME">$1<ex>Chrome</ex></ph> can check your passwords when you sign in with your Google Account
-  </message>
-  <message name="IDS_SETTINGS_CHECK_PASSWORDS_ERROR_NO_PASSWORDS" desc="Error message when the password check can't be completed since no passwords could be checked.">
-    No saved passwords. <ph name="IDS_SHORT_PRODUCT_NAME">$1<ex>Chrome</ex></ph> can check your passwords when you save them.
-  </message>
-  <message name="IDS_SETTINGS_CHECK_PASSWORDS_ERROR_QUOTA_LIMIT_GOOGLE_ACCOUNT" desc="Error message when the password check can't be completed since the user hit the quota limit, but the user is able to check their passwords in their Google account.">
-    <ph name="IDS_SHORT_PRODUCT_NAME">$1<ex>Chrome</ex></ph> can't check your passwords. Try again after 24 hours or <ph name="BEGIN_LINK">&lt;a href="$2" target="_blank"&gt;</ph>check passwords in your Google Account<ph name="END_LINK">&lt;/a&gt;</ph>.
-  </message>
-  <message name="IDS_SETTINGS_CHECK_PASSWORDS_ERROR_QUOTA_LIMIT" desc="Error message when the password check can't be completed since the user hit the quota limit.">
-    <ph name="IDS_SHORT_PRODUCT_NAME">$1<ex>Chrome</ex></ph> can't check your passwords. Try again after 24 hours.
-  </message>
-  <message name="IDS_SETTINGS_CHECK_PASSWORDS_ERROR_GENERIC" desc="Error message when the password check can't be completed for an unspecified reason.">
-    <ph name="IDS_SHORT_PRODUCT_NAME">$1<ex>Chrome</ex></ph> can't check your passwords. Try again later.
-  </message>
   <message name="IDS_SETTINGS_COMPROMISED_PASSWORDS_COUNT" desc="Number of compromised passwords present in the database">
     {COUNT, plural,
       =0 {No compromised passwords found}
@@ -361,9 +343,6 @@
   <message name="IDS_SETTINGS_COMPROMISED_PASSWORD_REASON_PHISHED_AND_LEAKED" desc="Password compromise reason shown when a password was reused on a phishing site and found in a data breach.">
     Entered on deceptive site and found in data breach
   </message>
-  <message name="IDS_SETTINGS_NO_COMPROMISED_CREDENTIALS_LABEL" desc="Label which is shown when there were no compromised passwords detected.">
-    <ph name="IDS_SHORT_PRODUCT_NAME">$1<ex>Chrome</ex></ph> will notify you when you sign in with a compromised password
-  </message>
   <message name="IDS_SETTINGS_COMPROMISED_PASSWORD_SHOW" desc="Action menu item for a row which displays a compromised password. The password value, which is initialy obfuscated, will be show in plain text.">
     Show password
   </message>

diff --git a/chrome/browser/about_flags.cc b/chrome/browser/about_flags.cc
index b4f803e..e2bfce05 100644
--- a/chrome/browser/about_flags.cc
+++ b/chrome/browser/about_flags.cc

@@ -3987,6 +3987,11 @@
     {"use-multilogin-endpoint", flag_descriptions::kUseMultiloginEndpointName,
      flag_descriptions::kUseMultiloginEndpointDescription,
      kOsMac | kOsWin | kOsLinux, FEATURE_VALUE_TYPE(kUseMultiloginEndpoint)},
+
+    {"enable-new-profile-picker", flag_descriptions::kNewProfilePickerName,
+     flag_descriptions::kNewProfilePickerDescription,
+     kOsMac | kOsWin | kOsLinux,
+     FEATURE_VALUE_TYPE(features::kNewProfilePicker)},
 #endif
 
 #if defined(OS_CHROMEOS)

diff --git a/chrome/browser/accessibility/accessibility_permission_context.cc b/chrome/browser/accessibility/accessibility_permission_context.cc
index 6c3a121..ce2689e 100644
--- a/chrome/browser/accessibility/accessibility_permission_context.cc
+++ b/chrome/browser/accessibility/accessibility_permission_context.cc

@@ -3,6 +3,7 @@
 // found in the LICENSE file.
 
 #include "chrome/browser/accessibility/accessibility_permission_context.h"
+#include "third_party/blink/public/mojom/feature_policy/feature_policy.mojom.h"
 
 AccessibilityPermissionContext::AccessibilityPermissionContext(
     content::BrowserContext* browser_context)

diff --git a/chrome/browser/background_sync/background_sync_permission_context.cc b/chrome/browser/background_sync/background_sync_permission_context.cc
index 305488c..a2ae76d 100644
--- a/chrome/browser/background_sync/background_sync_permission_context.cc
+++ b/chrome/browser/background_sync/background_sync_permission_context.cc

@@ -6,6 +6,7 @@
 
 #include "base/logging.h"
 #include "components/content_settings/core/common/content_settings_types.h"
+#include "third_party/blink/public/mojom/feature_policy/feature_policy.mojom.h"
 
 BackgroundSyncPermissionContext::BackgroundSyncPermissionContext(
     content::BrowserContext* browser_context)

diff --git a/chrome/browser/background_sync/periodic_background_sync_permission_context.cc b/chrome/browser/background_sync/periodic_background_sync_permission_context.cc
index 80d15f9c..749fc653 100644
--- a/chrome/browser/background_sync/periodic_background_sync_permission_context.cc
+++ b/chrome/browser/background_sync/periodic_background_sync_permission_context.cc

@@ -10,6 +10,7 @@
 #include "components/content_settings/core/browser/host_content_settings_map.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/browser_thread.h"
+#include "third_party/blink/public/mojom/feature_policy/feature_policy.mojom.h"
 
 #if defined(OS_ANDROID)
 #include "base/android/jni_string.h"

diff --git a/chrome/browser/browsing_data/chrome_browsing_data_remover_delegate.cc b/chrome/browser/browsing_data/chrome_browsing_data_remover_delegate.cc
index 8b97feb..d55fe24 100644
--- a/chrome/browser/browsing_data/chrome_browsing_data_remover_delegate.cc
+++ b/chrome/browser/browsing_data/chrome_browsing_data_remover_delegate.cc

@@ -92,7 +92,7 @@
 #include "components/nacl/browser/nacl_browser.h"
 #include "components/nacl/browser/pnacl_host.h"
 #include "components/ntp_snippets/content_suggestions_service.h"
-#include "components/omnibox/browser/omnibox_pref_names.h"
+#include "components/omnibox/browser/omnibox_prefs.h"
 #include "components/open_from_clipboard/clipboard_recent_content.h"
 #include "components/password_manager/core/browser/password_store.h"
 #include "components/password_manager/core/common/password_manager_features.h"

diff --git a/chrome/browser/browsing_data/chrome_browsing_data_remover_delegate_unittest.cc b/chrome/browser/browsing_data/chrome_browsing_data_remover_delegate_unittest.cc
index 69ef37f4..7381bbb 100644
--- a/chrome/browser/browsing_data/chrome_browsing_data_remover_delegate_unittest.cc
+++ b/chrome/browser/browsing_data/chrome_browsing_data_remover_delegate_unittest.cc

@@ -81,7 +81,7 @@
 #include "components/favicon/core/favicon_service.h"
 #include "components/history/core/browser/history_service.h"
 #include "components/language/core/browser/url_language_histogram.h"
-#include "components/omnibox/browser/omnibox_pref_names.h"
+#include "components/omnibox/browser/omnibox_prefs.h"
 #include "components/os_crypt/os_crypt_mocker.h"
 #include "components/password_manager/core/browser/mock_password_store.h"
 #include "components/password_manager/core/browser/password_manager_test_utils.h"

diff --git a/chrome/browser/chromeos/login/screens/fingerprint_setup_browsertest.cc b/chrome/browser/chromeos/login/screens/fingerprint_setup_browsertest.cc
index c446ec7..c97caf27 100644
--- a/chrome/browser/chromeos/login/screens/fingerprint_setup_browsertest.cc
+++ b/chrome/browser/chromeos/login/screens/fingerprint_setup_browsertest.cc

@@ -33,6 +33,7 @@
     // Override the screen exit callback with our own method.
     FingerprintSetupScreen* fingerprint_screen = FingerprintSetupScreen::Get(
         WizardController::default_controller()->screen_manager());
+    original_callback_ = fingerprint_screen->get_exit_callback_for_testing();
     fingerprint_screen->set_exit_callback_for_testing(
         base::BindRepeating(&FingerprintSetupTest::OnFingerprintSetupScreenExit,
                             base::Unretained(this)));
@@ -55,8 +56,10 @@
     run_loop.Run();
   }
 
-  void OnFingerprintSetupScreenExit() {
+  void OnFingerprintSetupScreenExit(FingerprintSetupScreen::Result result) {
     screen_exit_ = true;
+    screen_result_ = result;
+    original_callback_.Run(result);
     if (screen_exit_callback_) {
       std::move(screen_exit_callback_).Run();
     }
@@ -84,8 +87,12 @@
         {"fingerprint-setup-impl", "fingerprintAddAnother"});
   }
 
+  base::Optional<FingerprintSetupScreen::Result> screen_result_;
+  base::HistogramTester histogram_tester_;
+
  private:
   bool screen_exit_ = false;
+  FingerprintSetupScreen::ScreenExitCallback original_callback_;
   base::RepeatingClosure screen_exit_callback_;
 };
 
@@ -104,6 +111,11 @@
   test::OobeJS().TapOnPath({"fingerprint-setup-impl", "skipFingerprintEnroll"});
 
   WaitForScreenExit();
+  EXPECT_EQ(screen_result_.value(), FingerprintSetupScreen::Result::NEXT);
+  histogram_tester_.ExpectTotalCount(
+      "OOBE.StepCompletionTimeByExitReason.Fingerprint-setup.Next", 1);
+  histogram_tester_.ExpectTotalCount(
+      "OOBE.StepCompletionTime.Fingerprint-setup", 1);
 }
 
 IN_PROC_BROWSER_TEST_F(FingerprintSetupTest, FingerprintEnrollFull) {
@@ -115,6 +127,11 @@
   test::OobeJS().TapOnPath({"fingerprint-setup-impl", "fingerprintEnrollDone"});
 
   WaitForScreenExit();
+  EXPECT_EQ(screen_result_.value(), FingerprintSetupScreen::Result::NEXT);
+  histogram_tester_.ExpectTotalCount(
+      "OOBE.StepCompletionTimeByExitReason.Fingerprint-setup.Next", 1);
+  histogram_tester_.ExpectTotalCount(
+      "OOBE.StepCompletionTime.Fingerprint-setup", 1);
 }
 
 IN_PROC_BROWSER_TEST_F(FingerprintSetupTest, FingerprintEnrollLimit) {
@@ -133,6 +150,11 @@
   test::OobeJS().TapOnPath({"fingerprint-setup-impl", "fingerprintEnrollDone"});
 
   WaitForScreenExit();
+  EXPECT_EQ(screen_result_.value(), FingerprintSetupScreen::Result::NEXT);
+  histogram_tester_.ExpectTotalCount(
+      "OOBE.StepCompletionTimeByExitReason.Fingerprint-setup.Next", 1);
+  histogram_tester_.ExpectTotalCount(
+      "OOBE.StepCompletionTime.Fingerprint-setup", 1);
 }
 
 IN_PROC_BROWSER_TEST_F(FingerprintSetupTest, FingerprintDisabled) {
@@ -143,6 +165,12 @@
       FingerprintSetupScreenView::kScreenId);
 
   WaitForScreenExit();
+  EXPECT_EQ(screen_result_.value(),
+            FingerprintSetupScreen::Result::NOT_APPLICABLE);
+  histogram_tester_.ExpectTotalCount(
+      "OOBE.StepCompletionTimeByExitReason.Fingerprint-setup.Next", 0);
+  histogram_tester_.ExpectTotalCount(
+      "OOBE.StepCompletionTime.Fingerprint-setup", 0);
 }
 
 IN_PROC_BROWSER_TEST_F(FingerprintSetupTest, FingerprintSetupScreenElements) {
@@ -161,6 +189,11 @@
   test::OobeJS().TapOnPath({"fingerprint-setup-impl", "skipFingerprintSetup"});
 
   WaitForScreenExit();
+  EXPECT_EQ(screen_result_.value(), FingerprintSetupScreen::Result::NEXT);
+  histogram_tester_.ExpectTotalCount(
+      "OOBE.StepCompletionTimeByExitReason.Fingerprint-setup.Next", 1);
+  histogram_tester_.ExpectTotalCount(
+      "OOBE.StepCompletionTime.Fingerprint-setup", 1);
 }
 
 IN_PROC_BROWSER_TEST_F(FingerprintSetupTest, FingerprintSetupNext) {
@@ -192,6 +225,11 @@
   test::OobeJS().TapOnPath({"fingerprint-setup-impl", "setupFingerprintLater"});
 
   WaitForScreenExit();
+  EXPECT_EQ(screen_result_.value(), FingerprintSetupScreen::Result::NEXT);
+  histogram_tester_.ExpectTotalCount(
+      "OOBE.StepCompletionTimeByExitReason.Fingerprint-setup.Next", 1);
+  histogram_tester_.ExpectTotalCount(
+      "OOBE.StepCompletionTime.Fingerprint-setup", 1);
 }
 
 }  // namespace chromeos

diff --git a/chrome/browser/chromeos/login/screens/fingerprint_setup_screen.cc b/chrome/browser/chromeos/login/screens/fingerprint_setup_screen.cc
index 58928b1..313ebf0 100644
--- a/chrome/browser/chromeos/login/screens/fingerprint_setup_screen.cc
+++ b/chrome/browser/chromeos/login/screens/fingerprint_setup_screen.cc

@@ -3,6 +3,7 @@
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/login/screens/fingerprint_setup_screen.h"
+
 #include "chrome/browser/chromeos/login/quick_unlock/quick_unlock_utils.h"
 #include "chrome/browser/chromeos/login/users/chrome_user_manager_util.h"
 #include "chrome/browser/profiles/profile_manager.h"
@@ -15,6 +16,16 @@
 
 }  // namespace
 
+// static
+std::string FingerprintSetupScreen::GetResultString(Result result) {
+  switch (result) {
+    case Result::NEXT:
+      return "Next";
+    case Result::NOT_APPLICABLE:
+      return BaseScreen::kNotApplicable;
+  }
+}
+
 FingerprintSetupScreen* FingerprintSetupScreen::Get(ScreenManager* manager) {
   return static_cast<FingerprintSetupScreen*>(
       manager->GetScreen(FingerprintSetupScreenView::kScreenId));
@@ -22,7 +33,7 @@
 
 FingerprintSetupScreen::FingerprintSetupScreen(
     FingerprintSetupScreenView* view,
-    const base::RepeatingClosure& exit_callback)
+    const ScreenExitCallback& exit_callback)
     : BaseScreen(FingerprintSetupScreenView::kScreenId,
                  OobeScreenPriority::DEFAULT),
       view_(view),
@@ -35,13 +46,17 @@
   view_->Bind(nullptr);
 }
 
-void FingerprintSetupScreen::ShowImpl() {
+bool FingerprintSetupScreen::MaybeSkip() {
   if (!chromeos::quick_unlock::IsFingerprintEnabled(
           ProfileManager::GetActiveUserProfile()) ||
       chrome_user_manager_util::IsPublicSessionOrEphemeralLogin()) {
-    exit_callback_.Run();
-    return;
+    exit_callback_.Run(Result::NOT_APPLICABLE);
+    return true;
   }
+  return false;
+}
+
+void FingerprintSetupScreen::ShowImpl() {
   view_->Show();
 }
 
@@ -51,7 +66,7 @@
 
 void FingerprintSetupScreen::OnUserAction(const std::string& action_id) {
   if (action_id == kUserActionClose) {
-    exit_callback_.Run();
+    exit_callback_.Run(Result::NEXT);
     return;
   }
   BaseScreen::OnUserAction(action_id);

diff --git a/chrome/browser/chromeos/login/screens/fingerprint_setup_screen.h b/chrome/browser/chromeos/login/screens/fingerprint_setup_screen.h
index 0123e995..fa46a6d 100644
--- a/chrome/browser/chromeos/login/screens/fingerprint_setup_screen.h
+++ b/chrome/browser/chromeos/login/screens/fingerprint_setup_screen.h

@@ -20,17 +20,28 @@
 // user to enroll fingerprint on the device.
 class FingerprintSetupScreen : public BaseScreen {
  public:
+  enum class Result { NEXT, NOT_APPLICABLE };
+
+  static std::string GetResultString(Result result);
+
+  using ScreenExitCallback = base::RepeatingCallback<void(Result result)>;
   FingerprintSetupScreen(FingerprintSetupScreenView* view,
-                         const base::RepeatingClosure& exit_callback);
+                         const ScreenExitCallback& exit_callback);
   ~FingerprintSetupScreen() override;
 
   static FingerprintSetupScreen* Get(ScreenManager* manager);
 
-  void set_exit_callback_for_testing(
-      const base::RepeatingClosure& exit_callback) {
+  void set_exit_callback_for_testing(const ScreenExitCallback& exit_callback) {
     exit_callback_ = exit_callback;
   }
 
+  const ScreenExitCallback& get_exit_callback_for_testing() {
+    return exit_callback_;
+  }
+
+  // BaseScreen:
+  bool MaybeSkip() override;
+
  protected:
   // BaseScreen:
   void ShowImpl() override;
@@ -39,7 +50,7 @@
 
  private:
   FingerprintSetupScreenView* const view_;
-  base::RepeatingClosure exit_callback_;
+  ScreenExitCallback exit_callback_;
 
   DISALLOW_COPY_AND_ASSIGN(FingerprintSetupScreen);
 };

diff --git a/chrome/browser/chromeos/login/ui/user_adding_screen_browsertest.cc b/chrome/browser/chromeos/login/ui/user_adding_screen_browsertest.cc
index be795fc..393d574 100644
--- a/chrome/browser/chromeos/login/ui/user_adding_screen_browsertest.cc
+++ b/chrome/browser/chromeos/login/ui/user_adding_screen_browsertest.cc

@@ -113,78 +113,105 @@
 IN_PROC_BROWSER_TEST_F(UserAddingScreenTest, CancelAdding) {
   const auto& users = login_mixin_.users();
   EXPECT_EQ(users.size(), user_manager::UserManager::Get()->GetUsers().size());
-  EXPECT_EQ(0u, user_manager::UserManager::Get()->GetLoggedInUsers().size());
-  EXPECT_EQ(session_manager::SessionState::LOGIN_PRIMARY,
-            session_manager::SessionManager::Get()->session_state());
+  EXPECT_EQ(user_manager::UserManager::Get()->GetLoggedInUsers().size(), 0u);
+  EXPECT_EQ(session_manager::SessionManager::Get()->session_state(),
+            session_manager::SessionState::LOGIN_PRIMARY);
 
   LoginUser(users[0].account_id);
-  EXPECT_EQ(1u, user_manager::UserManager::Get()->GetLoggedInUsers().size());
-  EXPECT_EQ(session_manager::SessionState::ACTIVE,
-            session_manager::SessionManager::Get()->session_state());
+  EXPECT_EQ(user_manager::UserManager::Get()->GetLoggedInUsers().size(), 1u);
+  EXPECT_EQ(session_manager::SessionManager::Get()->session_state(),
+            session_manager::SessionState::ACTIVE);
 
+  base::HistogramTester histogram_tester;
   UserAddingScreen::Get()->Start();
-  content::RunAllPendingInMessageLoop();
-  EXPECT_EQ(1, user_adding_started());
-  EXPECT_EQ(session_manager::SessionState::LOGIN_SECONDARY,
-            session_manager::SessionManager::Get()->session_state());
+  OobeScreenWaiter(OobeScreen::SCREEN_ACCOUNT_PICKER).Wait();
+
+  EXPECT_EQ(user_adding_started(), 1);
+  EXPECT_EQ(session_manager::SessionManager::Get()->session_state(),
+            session_manager::SessionState::LOGIN_SECONDARY);
 
   EXPECT_TRUE(ash::LoginScreenTestApi::IsCancelButtonShown());
   EXPECT_TRUE(ash::LoginScreenTestApi::ClickCancelButton());
-
   WaitUntilUserAddingFinishedOrCancelled();
-  content::RunAllPendingInMessageLoop();
-  EXPECT_EQ(1, user_adding_finished());
-  EXPECT_EQ(session_manager::SessionState::ACTIVE,
-            session_manager::SessionManager::Get()->session_state());
+
+  histogram_tester.ExpectTotalCount("ChromeOS.UserAddingScreen.LoadTime", 1);
+
+  EXPECT_EQ(user_adding_finished(), 1);
+  EXPECT_EQ(session_manager::SessionManager::Get()->session_state(),
+            session_manager::SessionState::ACTIVE);
 
   EXPECT_TRUE(LoginDisplayHost::default_host() == nullptr);
-  EXPECT_EQ(1u, user_manager::UserManager::Get()->GetLoggedInUsers().size());
-  EXPECT_EQ(users[0].account_id,
-            user_manager::UserManager::Get()->GetActiveUser()->GetAccountId());
+  EXPECT_EQ(user_manager::UserManager::Get()->GetLoggedInUsers().size(), 1u);
+  EXPECT_EQ(user_manager::UserManager::Get()->GetActiveUser()->GetAccountId(),
+            users[0].account_id);
 }
 
-// TODO(crbug.com/1067461): Flakes on ASAN and MSAN
-#if defined(ADDRESS_SANITIZER) || defined(MEMORY_SANITIZER)
-#define MAYBE_AddingSeveralUsers DISABLED_AddingSeveralUsers
-#else
-#define MAYBE_AddingSeveralUsers AddingSeveralUsers
-#endif
-IN_PROC_BROWSER_TEST_F(UserAddingScreenTest, MAYBE_AddingSeveralUsers) {
+IN_PROC_BROWSER_TEST_F(UserAddingScreenTest, UILogin) {
   const auto& users = login_mixin_.users();
-  EXPECT_EQ(session_manager::SessionState::LOGIN_PRIMARY,
-            session_manager::SessionManager::Get()->session_state());
+  EXPECT_EQ(session_manager::SessionManager::Get()->session_state(),
+            session_manager::SessionState::LOGIN_PRIMARY);
 
   LoginUser(users[0].account_id);
-  users_in_session_order_.push_back(users[0].account_id);
-  EXPECT_EQ(session_manager::SessionState::ACTIVE,
-            session_manager::SessionManager::Get()->session_state());
+  EXPECT_EQ(session_manager::SessionManager::Get()->session_state(),
+            session_manager::SessionState::ACTIVE);
 
   user_manager::UserManager* user_manager = user_manager::UserManager::Get();
 
   base::HistogramTester histogram_tester;
+  UserAddingScreen::Get()->Start();
+  OobeScreenWaiter(OobeScreen::SCREEN_ACCOUNT_PICKER).Wait();
+  EXPECT_EQ(user_adding_started(), 1);
+  EXPECT_EQ(session_manager::SessionManager::Get()->session_state(),
+            session_manager::SessionState::LOGIN_SECONDARY);
+  EXPECT_TRUE(ash::LoginScreenTestApi::IsCancelButtonShown());
+
+  UILoginUser(users.back().account_id, kPassword);
+
+  EXPECT_EQ(user_adding_finished(), 1);
+  EXPECT_EQ(session_manager::SessionManager::Get()->session_state(),
+            session_manager::SessionState::ACTIVE);
+  EXPECT_TRUE(LoginDisplayHost::default_host() == nullptr);
+  ASSERT_EQ(user_manager->GetLoggedInUsers().size(), 2u);
+
+  histogram_tester.ExpectTotalCount("ChromeOS.UserAddingScreen.LoadTime", 1);
+
+  EXPECT_EQ(session_manager::SessionManager::Get()->session_state(),
+            session_manager::SessionState::ACTIVE);
+}
+
+IN_PROC_BROWSER_TEST_F(UserAddingScreenTest, AddingSeveralUsers) {
+  const auto& users = login_mixin_.users();
+  EXPECT_EQ(session_manager::SessionManager::Get()->session_state(),
+            session_manager::SessionState::LOGIN_PRIMARY);
+
+  LoginUser(users[0].account_id);
+  users_in_session_order_.push_back(users[0].account_id);
+  EXPECT_EQ(session_manager::SessionManager::Get()->session_state(),
+            session_manager::SessionState::ACTIVE);
+
+  user_manager::UserManager* user_manager = user_manager::UserManager::Get();
+
   const int n = users.size();
   for (int i = 1; i < n; ++i) {
     UserAddingScreen::Get()->Start();
-    OobeScreenWaiter(OobeScreen::SCREEN_ACCOUNT_PICKER).Wait();
-    EXPECT_EQ(i, user_adding_started());
-    EXPECT_EQ(session_manager::SessionState::LOGIN_SECONDARY,
-              session_manager::SessionManager::Get()->session_state());
-    EXPECT_TRUE(ash::LoginScreenTestApi::IsCancelButtonShown());
+    EXPECT_EQ(user_adding_started(), i);
+    EXPECT_EQ(session_manager::SessionManager::Get()->session_state(),
+              session_manager::SessionState::LOGIN_SECONDARY);
 
-    UILoginUser(users[n - i].account_id, kPassword);
+    AddUser(users[n - i].account_id);
     users_in_session_order_.push_back(users[n - i].account_id);
+    WaitUntilUserAddingFinishedOrCancelled();
 
-    EXPECT_EQ(i, user_adding_finished());
-    EXPECT_EQ(session_manager::SessionState::ACTIVE,
-              session_manager::SessionManager::Get()->session_state());
+    EXPECT_EQ(user_adding_finished(), i);
+    EXPECT_EQ(session_manager::SessionManager::Get()->session_state(),
+              session_manager::SessionState::ACTIVE);
     EXPECT_TRUE(LoginDisplayHost::default_host() == nullptr);
-    ASSERT_EQ(unsigned(i + 1), user_manager->GetLoggedInUsers().size());
+    ASSERT_EQ(user_manager->GetLoggedInUsers().size(),
+              static_cast<size_t>(i + 1));
   }
-  histogram_tester.ExpectTotalCount("ChromeOS.UserAddingScreen.LoadTime",
-                                    n - 1);
 
-  EXPECT_EQ(session_manager::SessionState::ACTIVE,
-            session_manager::SessionManager::Get()->session_state());
+  EXPECT_EQ(session_manager::SessionManager::Get()->session_state(),
+            session_manager::SessionState::ACTIVE);
 
   // Now check how unlock policy works for these users.
   PrefService* prefs1 =
@@ -216,33 +243,33 @@
   prefs3->SetString(prefs::kMultiProfileUserBehavior,
                     MultiProfileUserController::kBehaviorUnrestricted);
   user_manager::UserList unlock_users = user_manager->GetUnlockUsers();
-  ASSERT_EQ(1UL, unlock_users.size());
+  ASSERT_EQ(unlock_users.size(), 1u);
   EXPECT_EQ(users[0].account_id, unlock_users[0]->GetAccountId());
 
   prefs1->SetBoolean(ash::prefs::kEnableAutoScreenLock, false);
   unlock_users = user_manager->GetUnlockUsers();
-  ASSERT_EQ(1UL, unlock_users.size());
+  ASSERT_EQ(unlock_users.size(), 1u);
   EXPECT_EQ(users[0].account_id, unlock_users[0]->GetAccountId());
 
   // If all users have unrestricted policy then anyone can perform unlock.
   prefs1->SetString(prefs::kMultiProfileUserBehavior,
                     MultiProfileUserController::kBehaviorUnrestricted);
   unlock_users = user_manager->GetUnlockUsers();
-  ASSERT_EQ(3UL, unlock_users.size());
+  ASSERT_EQ(unlock_users.size(), 3u);
   for (int i = 0; i < 3; ++i)
     EXPECT_EQ(users_in_session_order_[i], unlock_users[i]->GetAccountId());
 
   // This preference doesn't affect list of unlock users.
   prefs2->SetBoolean(ash::prefs::kEnableAutoScreenLock, true);
   unlock_users = user_manager->GetUnlockUsers();
-  ASSERT_EQ(3UL, unlock_users.size());
+  ASSERT_EQ(unlock_users.size(), 3u);
   for (int i = 0; i < 3; ++i)
     EXPECT_EQ(users_in_session_order_[i], unlock_users[i]->GetAccountId());
 
   // Now one of the users is unable to unlock.
   SetUserCanLock(user_manager->GetLoggedInUsers()[2], false);
   unlock_users = user_manager->GetUnlockUsers();
-  ASSERT_EQ(2UL, unlock_users.size());
+  ASSERT_EQ(unlock_users.size(), 2u);
   for (int i = 0; i < 2; ++i)
     EXPECT_EQ(users_in_session_order_[i], unlock_users[i]->GetAccountId());
   SetUserCanLock(user_manager->GetLoggedInUsers()[2], true);
@@ -254,30 +281,15 @@
   prefs3->SetString(prefs::kMultiProfileUserBehavior,
                     MultiProfileUserController::kBehaviorNotAllowed);
   unlock_users = user_manager->GetUnlockUsers();
-  ASSERT_EQ(2UL, unlock_users.size());
+  ASSERT_EQ(unlock_users.size(), 2u);
   for (int i = 0; i < 2; ++i)
     EXPECT_EQ(users_in_session_order_[i], unlock_users[i]->GetAccountId());
 }
 
-// crbug.com/1067461: Flakes on ASAN and MSAN
-#if defined(ADDRESS_SANITIZER) || defined(MEMORY_SANITIZER)
-#define MAYBE_ScreenVisibility DISABLED_ScreenVisibility
-#else
-#define MAYBE_ScreenVisibility ScreenVisibility
-#endif
-IN_PROC_BROWSER_TEST_F(UserAddingScreenTest, MAYBE_ScreenVisibility) {
+IN_PROC_BROWSER_TEST_F(UserAddingScreenTest, ScreenVisibilityAfterLock) {
   const auto& users = login_mixin_.users();
   LoginUser(users[0].account_id);
 
-  UserAddingScreen::Get()->Start();
-  OobeScreenWaiter(OobeScreen::SCREEN_ACCOUNT_PICKER).Wait();
-
-  EXPECT_TRUE(ash::LoginScreenTestApi::IsCancelButtonShown());
-  EXPECT_TRUE(ash::LoginScreenTestApi::ClickCancelButton());
-
-  WaitUntilUserAddingFinishedOrCancelled();
-  content::RunAllPendingInMessageLoop();
-
   {
     content::WindowedNotificationObserver observer(
         chrome::NOTIFICATION_SCREEN_LOCK_STATE_CHANGED,
@@ -296,12 +308,14 @@
 
   UserAddingScreen::Get()->Start();
   OobeScreenWaiter(OobeScreen::SCREEN_ACCOUNT_PICKER).Wait();
+  EXPECT_EQ(user_adding_started(), 1);
+  EXPECT_EQ(session_manager::SessionManager::Get()->session_state(),
+            session_manager::SessionState::LOGIN_SECONDARY);
 
   EXPECT_TRUE(ash::LoginScreenTestApi::IsCancelButtonShown());
   EXPECT_TRUE(ash::LoginScreenTestApi::ClickCancelButton());
 
   WaitUntilUserAddingFinishedOrCancelled();
-  content::RunAllPendingInMessageLoop();
 }
 
 }  // namespace chromeos

diff --git a/chrome/browser/chromeos/login/wizard_controller.cc b/chrome/browser/chromeos/login/wizard_controller.cc
index bb8e35f6..8a18910 100644
--- a/chrome/browser/chromeos/login/wizard_controller.cc
+++ b/chrome/browser/chromeos/login/wizard_controller.cc

@@ -1124,8 +1124,10 @@
   ShowFingerprintSetupScreen();
 }
 
-void WizardController::OnFingerprintSetupScreenExit() {
-  OnScreenExit(FingerprintSetupScreenView::kScreenId, kDefaultExitReason);
+void WizardController::OnFingerprintSetupScreenExit(
+    FingerprintSetupScreen::Result result) {
+  OnScreenExit(FingerprintSetupScreenView::kScreenId,
+               FingerprintSetupScreen::GetResultString(result));
 
   ShowDiscoverScreen();
 }

diff --git a/chrome/browser/chromeos/login/wizard_controller.h b/chrome/browser/chromeos/login/wizard_controller.h
index 0c731472..7daa25d7 100644
--- a/chrome/browser/chromeos/login/wizard_controller.h
+++ b/chrome/browser/chromeos/login/wizard_controller.h

@@ -28,6 +28,7 @@
 #include "chrome/browser/chromeos/login/screens/enable_adb_sideloading_screen.h"
 #include "chrome/browser/chromeos/login/screens/enable_debugging_screen.h"
 #include "chrome/browser/chromeos/login/screens/eula_screen.h"
+#include "chrome/browser/chromeos/login/screens/fingerprint_setup_screen.h"
 #include "chrome/browser/chromeos/login/screens/gesture_navigation_screen.h"
 #include "chrome/browser/chromeos/login/screens/kiosk_autolaunch_screen.h"
 #include "chrome/browser/chromeos/login/screens/network_screen.h"
@@ -240,7 +241,7 @@
   void OnTermsOfServiceAccepted();
   void OnSyncConsentScreenExit();
   void OnSyncConsentFinished();
-  void OnFingerprintSetupScreenExit();
+  void OnFingerprintSetupScreenExit(FingerprintSetupScreen::Result result);
   void OnDiscoverScreenExit();
   void OnArcTermsOfServiceScreenExit(ArcTermsOfServiceScreen::Result result);
   void OnArcTermsOfServiceSkipped();

diff --git a/chrome/browser/extensions/api/settings_private/prefs_util.cc b/chrome/browser/extensions/api/settings_private/prefs_util.cc
index 6bdd0d0..4e5d602 100644
--- a/chrome/browser/extensions/api/settings_private/prefs_util.cc
+++ b/chrome/browser/extensions/api/settings_private/prefs_util.cc

@@ -24,7 +24,7 @@
 #include "components/drive/drive_pref_names.h"
 #include "components/embedder_support/pref_names.h"
 #include "components/language/core/browser/pref_names.h"
-#include "components/omnibox/browser/omnibox_pref_names.h"
+#include "components/omnibox/browser/omnibox_prefs.h"
 #include "components/password_manager/core/common/password_manager_pref_names.h"
 #include "components/payments/core/payment_prefs.h"
 #include "components/prefs/pref_service.h"

diff --git a/chrome/browser/extensions/api/web_navigation/web_navigation_apitest.cc b/chrome/browser/extensions/api/web_navigation/web_navigation_apitest.cc
index f98b1272..4915e80 100644
--- a/chrome/browser/extensions/api/web_navigation/web_navigation_apitest.cc
+++ b/chrome/browser/extensions/api/web_navigation/web_navigation_apitest.cc

@@ -246,20 +246,6 @@
 }
 
 IN_PROC_BROWSER_TEST_F(WebNavigationApiTest, ServerRedirectSingleProcess) {
-  // TODO(lukasza): https://crbug.com/671734: In the long-term, //chrome-layer
-  // tests should only be run with site-per-process - remove the early return
-  // below when fixing https://crbug.com/870761 and removing the
-  // not_site_per_process_browser_tests step.
-  //
-  // This test has its expectations in
-  // serverRedirectSingleProcess/test_serverRedirectSingleProcess.js.  The
-  // expectations include exact |processId| ("exact" meaning that one cannot use
-  // a wildcard - the verification is done via chrome.test.checkDeepEq).
-  // Inclusion of |processId| means that the expectation change in
-  // site-per-process mode.
-  if (!content::AreAllSitesIsolatedForTesting())
-    return;
-
   ASSERT_TRUE(StartEmbeddedTestServer());
 
   // Set max renderers to 1 to force running out of processes.

diff --git a/chrome/browser/flag-metadata.json b/chrome/browser/flag-metadata.json
index b10b02f9..b766aa3 100644
--- a/chrome/browser/flag-metadata.json
+++ b/chrome/browser/flag-metadata.json

@@ -1714,6 +1714,11 @@
     "expiry_milestone": 86
   },
   {
+    "name": "enable-new-profile-picker",
+    "owners": [ "msalama"],
+    "expiry_milestone": 90
+  },
+  {
     "name": "enable-noscript-previews",
     "owners": [ "//components/data_reduction_proxy/OWNERS" ],
     // This flag is used for frequent manual testing and should not be removed.

diff --git a/chrome/browser/flag_descriptions.cc b/chrome/browser/flag_descriptions.cc
index c25a8d9..1a918a8f 100644
--- a/chrome/browser/flag_descriptions.cc
+++ b/chrome/browser/flag_descriptions.cc

@@ -1192,6 +1192,10 @@
 const char kNearbySharingDescription[] =
     "Enables Nearby Sharing for sharing content between devices.";
 
+const char kNewProfilePickerName[] = "New profile picker";
+const char kNewProfilePickerDescription[] =
+    "Enables new profile picker implementation.";
+
 const char kNewUsbBackendName[] = "Enable new USB backend";
 const char kNewUsbBackendDescription[] =
     "Enables the new experimental USB backend for Windows.";

diff --git a/chrome/browser/flag_descriptions.h b/chrome/browser/flag_descriptions.h
index b6669c3..49e9616 100644
--- a/chrome/browser/flag_descriptions.h
+++ b/chrome/browser/flag_descriptions.h

@@ -714,6 +714,9 @@
 extern const char kUsernameFirstFlowName[];
 extern const char kUsernameFirstFlowDescription[];
 
+extern const char kNewProfilePickerName[];
+extern const char kNewProfilePickerDescription[];
+
 extern const char kNewUsbBackendName[];
 extern const char kNewUsbBackendDescription[];
 

diff --git a/chrome/browser/media/midi_permission_context.cc b/chrome/browser/media/midi_permission_context.cc
index 128f801..937e4a97 100644
--- a/chrome/browser/media/midi_permission_context.cc
+++ b/chrome/browser/media/midi_permission_context.cc

@@ -3,6 +3,7 @@
 // found in the LICENSE file.
 
 #include "chrome/browser/media/midi_permission_context.h"
+#include "third_party/blink/public/mojom/feature_policy/feature_policy.mojom.h"
 
 MidiPermissionContext::MidiPermissionContext(
     content::BrowserContext* browser_context)

diff --git a/chrome/browser/media/offscreen_tab.cc b/chrome/browser/media/offscreen_tab.cc
index 8213e72..c7fc64fa 100644
--- a/chrome/browser/media/offscreen_tab.cc
+++ b/chrome/browser/media/offscreen_tab.cc

@@ -15,9 +15,9 @@
 #include "chrome/browser/ui/web_contents_sizer.h"
 #include "content/public/browser/keyboard_event_processing_result.h"
 #include "content/public/browser/navigation_handle.h"
+#include "content/public/browser/presentation_receiver_flags.h"
 #include "content/public/browser/render_widget_host_view.h"
 #include "content/public/browser/web_contents.h"
-#include "third_party/blink/public/common/presentation/presentation_receiver_flags.h"
 
 #if defined(USE_AURA)
 #include "base/threading/thread_task_runner_handle.h"
@@ -151,7 +151,7 @@
   // Create the WebContents to contain the off-screen tab's page.
   WebContents::CreateParams params(otr_profile_registration_->profile());
   if (!optional_presentation_id.empty())
-    params.starting_sandbox_flags = blink::kPresentationReceiverSandboxFlags;
+    params.starting_sandbox_flags = content::kPresentationReceiverSandboxFlags;
 
   offscreen_tab_web_contents_ = WebContents::Create(params);
   offscreen_tab_web_contents_->SetDelegate(this);

diff --git a/chrome/browser/media/webrtc/media_stream_device_permission_context.cc b/chrome/browser/media/webrtc/media_stream_device_permission_context.cc
index b0cb4719..97bcc9e 100644
--- a/chrome/browser/media/webrtc/media_stream_device_permission_context.cc
+++ b/chrome/browser/media/webrtc/media_stream_device_permission_context.cc

@@ -11,6 +11,7 @@
 #include "content/public/common/content_features.h"
 #include "content/public/common/url_constants.h"
 #include "extensions/common/constants.h"
+#include "third_party/blink/public/mojom/feature_policy/feature_policy.mojom.h"
 
 namespace {
 

diff --git a/chrome/browser/page_load_metrics/observers/foreground_duration_ukm_observer.cc b/chrome/browser/page_load_metrics/observers/foreground_duration_ukm_observer.cc
index f19663e..01e665d 100644
--- a/chrome/browser/page_load_metrics/observers/foreground_duration_ukm_observer.cc
+++ b/chrome/browser/page_load_metrics/observers/foreground_duration_ukm_observer.cc

@@ -13,7 +13,8 @@
 #include "services/metrics/public/cpp/ukm_recorder.h"
 #include "services/metrics/public/cpp/ukm_source.h"
 
-ForegroundDurationUKMObserver::ForegroundDurationUKMObserver() {}
+ForegroundDurationUKMObserver::ForegroundDurationUKMObserver()
+    : last_page_input_timing_(page_load_metrics::mojom::InputTiming()) {}
 
 ForegroundDurationUKMObserver::~ForegroundDurationUKMObserver() {}
 
@@ -77,9 +78,27 @@
   if (!currently_in_foreground_)
     return;
   base::TimeDelta foreground_duration = end_time - last_time_shown_;
+  ukm::builders::PageForegroundSession ukm_builder(source_id_);
   ukm::UkmRecorder* ukm_recorder = ukm::UkmRecorder::Get();
-  ukm::builders::PageForegroundSession(source_id_)
-      .SetForegroundDuration(foreground_duration.InMilliseconds())
-      .Record(ukm_recorder);
+  ukm_builder.SetForegroundDuration(foreground_duration.InMilliseconds());
+  RecordInputTimingMetrics(&ukm_builder);
+  ukm_builder.Record(ukm_recorder);
   currently_in_foreground_ = false;
 }
+
+void ForegroundDurationUKMObserver::RecordInputTimingMetrics(
+    ukm::builders::PageForegroundSession* ukm_builder) {
+  ukm_builder
+      ->SetForegroundNumInputEvents(
+          GetDelegate().GetPageInputTiming().num_input_events -
+          last_page_input_timing_.num_input_events)
+      .SetForegroundTotalInputDelay(
+          (GetDelegate().GetPageInputTiming().total_input_delay -
+           last_page_input_timing_.total_input_delay)
+              .InMilliseconds())
+      .SetForegroundTotalAdjustedInputDelay(
+          (GetDelegate().GetPageInputTiming().total_adjusted_input_delay -
+           last_page_input_timing_.total_adjusted_input_delay)
+              .InMilliseconds());
+  last_page_input_timing_ = GetDelegate().GetPageInputTiming();
+}
\ No newline at end of file

diff --git a/chrome/browser/page_load_metrics/observers/foreground_duration_ukm_observer.h b/chrome/browser/page_load_metrics/observers/foreground_duration_ukm_observer.h
index 1eaa142..0296e14f 100644
--- a/chrome/browser/page_load_metrics/observers/foreground_duration_ukm_observer.h
+++ b/chrome/browser/page_load_metrics/observers/foreground_duration_ukm_observer.h

@@ -7,6 +7,8 @@
 
 #include "base/time/time.h"
 #include "components/page_load_metrics/browser/page_load_metrics_observer.h"
+#include "components/page_load_metrics/common/page_load_metrics.mojom.h"
+#include "services/metrics/public/cpp/ukm_builders.h"
 #include "services/metrics/public/cpp/ukm_source_id.h"
 
 // Observer responsible for appending previews information to the PLM UKM
@@ -35,7 +37,10 @@
   bool currently_in_foreground_ = false;
   base::TimeTicks last_time_shown_;
   ukm::SourceId source_id_ = ukm::kInvalidSourceId;
+  page_load_metrics::mojom::InputTiming last_page_input_timing_;
   void RecordUkmIfInForeground(base::TimeTicks end_time);
+  void RecordInputTimingMetrics(
+      ukm::builders::PageForegroundSession* ukm_builder);
 
   DISALLOW_COPY_AND_ASSIGN(ForegroundDurationUKMObserver);
 };

diff --git a/chrome/browser/page_load_metrics/observers/foreground_duration_ukm_observer_browsertest.cc b/chrome/browser/page_load_metrics/observers/foreground_duration_ukm_observer_browsertest.cc
index 0377e4e..dc7e932 100644
--- a/chrome/browser/page_load_metrics/observers/foreground_duration_ukm_observer_browsertest.cc
+++ b/chrome/browser/page_load_metrics/observers/foreground_duration_ukm_observer_browsertest.cc

@@ -47,8 +47,8 @@
     for (auto* entry :
          test_ukm_recorder_->GetEntriesByName(UkmEntry::kEntryName)) {
       auto* source = test_ukm_recorder_->GetSourceForSourceId(entry->source_id);
-      if (source && source->url() == url) {
-        test_ukm_recorder_->EntryHasMetric(entry, metric_name);
+      if (source && source->url() == url &&
+          test_ukm_recorder_->EntryHasMetric(entry, metric_name)) {
         count++;
       }
     }
@@ -80,6 +80,9 @@
   ui_test_utils::NavigateToURL(browser(), url);
   CloseAllTabs();
   ExpectMetricCountForUrl(url, "ForegroundDuration", 1);
+  ExpectMetricCountForUrl(url, "ForegroundNumInputEvents", 1);
+  ExpectMetricCountForUrl(url, "ForegroundTotalInputDelay", 1);
+  ExpectMetricCountForUrl(url, "ForegroundTotalAdjustedInputDelay", 1);
 }
 
 IN_PROC_BROWSER_TEST_F(ForegroundDurationUKMObserverBrowserTest, TabSwitching) {
@@ -102,5 +105,11 @@
   tab_strip_model->ActivateTabAt(1, {TabStripModel::GestureType::kOther});
   tab_strip_model->CloseAllTabs();
   ExpectMetricCountForUrl(url1, "ForegroundDuration", 3);
+  ExpectMetricCountForUrl(url1, "ForegroundNumInputEvents", 3);
+  ExpectMetricCountForUrl(url1, "ForegroundTotalInputDelay", 3);
+  ExpectMetricCountForUrl(url1, "ForegroundTotalAdjustedInputDelay", 3);
   ExpectMetricCountForUrl(url2, "ForegroundDuration", 3);
+  ExpectMetricCountForUrl(url2, "ForegroundNumInputEvents", 3);
+  ExpectMetricCountForUrl(url2, "ForegroundTotalInputDelay", 3);
+  ExpectMetricCountForUrl(url2, "ForegroundTotalAdjustedInputDelay", 3);
 }

diff --git a/chrome/browser/pdf/pdf_extension_test.cc b/chrome/browser/pdf/pdf_extension_test.cc
index 4c38e10..dd9539f 100644
--- a/chrome/browser/pdf/pdf_extension_test.cc
+++ b/chrome/browser/pdf/pdf_extension_test.cc

@@ -2384,8 +2384,10 @@
 
   void SetUpCommandLine(base::CommandLine* command_line) override {
     PDFExtensionTest::SetUpCommandLine(command_line);
-    feature_list_.InitAndEnableFeature(
-        chrome_pdf::features::kAccessiblePDFHighlight);
+    std::vector<base::Feature> enabled_features = {
+        chrome_pdf::features::kAccessiblePDFHighlight,
+        chrome_pdf::features::kAccessiblePDFForm};
+    feature_list_.InitWithFeatures(enabled_features, /*disabled_features=*/{});
   }
 
   void RunTextExtractionTest(const base::FilePath::CharType* pdf_file) {
@@ -2549,6 +2551,12 @@
   RunTextExtractionTest(FILE_PATH_LITERAL("highlights.pdf"));
 }
 
+// Test data of inline text boxes for PDF with text fields.
+IN_PROC_BROWSER_TEST_F(PDFExtensionAccessibilityTextExtractionTest,
+                       TextFields) {
+  RunTextExtractionTest(FILE_PATH_LITERAL("text_fields.pdf"));
+}
+
 // Test data of inline text boxes for PDF with multi-line and various font-sized
 // text.
 IN_PROC_BROWSER_TEST_F(PDFExtensionAccessibilityTextExtractionTest,
@@ -2581,8 +2589,11 @@
 
   void SetUpCommandLine(base::CommandLine* command_line) override {
     PDFExtensionTest::SetUpCommandLine(command_line);
-    feature_list_.InitAndEnableFeature(
-        chrome_pdf::features::kAccessiblePDFHighlight);
+    std::vector<base::Feature> enabled_features = {
+        chrome_pdf::features::kAccessiblePDFHighlight,
+        chrome_pdf::features::kAccessiblePDFForm};
+    feature_list_.InitWithFeatures(enabled_features, /*disabled_features=*/{});
+
     // Each test pass might require custom command-line setup
     if (test_pass_.set_up_command_line)
       test_pass_.set_up_command_line(command_line);
@@ -2782,6 +2793,10 @@
   RunPDFTest(FILE_PATH_LITERAL("highlights.pdf"));
 }
 
+IN_PROC_BROWSER_TEST_P(PDFExtensionAccessibilityTreeDumpTest, TextFields) {
+  RunPDFTest(FILE_PATH_LITERAL("text_fields.pdf"));
+}
+
 IN_PROC_BROWSER_TEST_P(PDFExtensionAccessibilityTreeDumpTest, Images) {
   RunPDFTest(FILE_PATH_LITERAL("image_alt_text.pdf"));
 }

diff --git a/chrome/browser/policy/configuration_policy_handler_list_factory.cc b/chrome/browser/policy/configuration_policy_handler_list_factory.cc
index 2362f304..9f31a0e 100644
--- a/chrome/browser/policy/configuration_policy_handler_list_factory.cc
+++ b/chrome/browser/policy/configuration_policy_handler_list_factory.cc

@@ -1577,8 +1577,6 @@
       std::make_unique<PrintingAllowedDuplexModesPolicyHandler>());
   handlers->AddHandler(
       std::make_unique<PrintingAllowedPinModesPolicyHandler>());
-  handlers->AddHandler(
-      std::make_unique<PrintingAllowedPageSizesPolicyHandler>());
   handlers->AddHandler(std::make_unique<PrintingColorDefaultPolicyHandler>());
   handlers->AddHandler(std::make_unique<PrintingDuplexDefaultPolicyHandler>());
   handlers->AddHandler(std::make_unique<PrintingPinDefaultPolicyHandler>());

diff --git a/chrome/browser/policy/printing_restrictions_policy_handler.cc b/chrome/browser/policy/printing_restrictions_policy_handler.cc
index 439120b..412bd8b 100644
--- a/chrome/browser/policy/printing_restrictions_policy_handler.cc
+++ b/chrome/browser/policy/printing_restrictions_policy_handler.cc

@@ -140,28 +140,6 @@
 
 PrintingPinDefaultPolicyHandler::~PrintingPinDefaultPolicyHandler() = default;
 
-PrintingAllowedPageSizesPolicyHandler::PrintingAllowedPageSizesPolicyHandler()
-    : ListPolicyHandler(key::kPrintingAllowedPageSizes,
-                        base::Value::Type::DICTIONARY) {}
-
-PrintingAllowedPageSizesPolicyHandler::
-    ~PrintingAllowedPageSizesPolicyHandler() {}
-
-bool PrintingAllowedPageSizesPolicyHandler::CheckListEntry(
-    const base::Value& value) {
-  if (!value.is_dict())
-    return false;
-  const base::Value* width = value.FindKey(printing::kPageWidthUm);
-  const base::Value* height = value.FindKey(printing::kPageHeightUm);
-  return width && height && width->is_int() && height->is_int();
-}
-
-void PrintingAllowedPageSizesPolicyHandler::ApplyList(base::Value filtered_list,
-                                                      PrefValueMap* prefs) {
-  DCHECK(filtered_list.is_list());
-  prefs->SetValue(prefs::kPrintingAllowedPageSizes, std::move(filtered_list));
-}
-
 PrintingSizeDefaultPolicyHandler::PrintingSizeDefaultPolicyHandler()
     : TypeCheckingPolicyHandler(key::kPrintingSizeDefault,
                                 base::Value::Type::DICTIONARY) {}

diff --git a/chrome/browser/policy/printing_restrictions_policy_handler.h b/chrome/browser/policy/printing_restrictions_policy_handler.h
index bb388bd1..8cfde62a 100644
--- a/chrome/browser/policy/printing_restrictions_policy_handler.h
+++ b/chrome/browser/policy/printing_restrictions_policy_handler.h

@@ -89,16 +89,6 @@
   ~PrintingPinDefaultPolicyHandler() override;
 };
 
-class PrintingAllowedPageSizesPolicyHandler : public ListPolicyHandler {
- public:
-  PrintingAllowedPageSizesPolicyHandler();
-  ~PrintingAllowedPageSizesPolicyHandler() override;
-
-  // ListPolicyHandler implementation:
-  bool CheckListEntry(const base::Value& value) override;
-  void ApplyList(base::Value filtered_list, PrefValueMap* prefs) override;
-};
-
 class PrintingSizeDefaultPolicyHandler : public TypeCheckingPolicyHandler {
  public:
   PrintingSizeDefaultPolicyHandler();

diff --git a/chrome/browser/prefs/browser_prefs.cc b/chrome/browser/prefs/browser_prefs.cc
index ed8ff10..36f5806 100644
--- a/chrome/browser/prefs/browser_prefs.cc
+++ b/chrome/browser/prefs/browser_prefs.cc

@@ -116,6 +116,7 @@
 #include "components/ntp_tiles/most_visited_sites.h"
 #include "components/offline_pages/buildflags/buildflags.h"
 #include "components/omnibox/browser/document_provider.h"
+#include "components/omnibox/browser/omnibox_prefs.h"
 #include "components/omnibox/browser/zero_suggest_provider.h"
 #include "components/optimization_guide/optimization_guide_prefs.h"
 #include "components/password_manager/core/browser/password_bubble_experiment.h"
@@ -517,6 +518,9 @@
 #if defined(OS_CHROMEOS)
 // Deprecated 4/2020
 const char kAmbientModeTopicSource[] = "settings.ambient_mode.topic_source";
+
+// Deprecated 4/2020
+const char kPrintingAllowedPageSizes[] = "printing.allowed_page_sizes";
 #endif  // defined(OS_CHROMEOS)
 
 // Register local state used only for migration (clearing or moving to a new
@@ -609,6 +613,7 @@
 
 #if defined(OS_CHROMEOS)
   registry->RegisterIntegerPref(kAmbientModeTopicSource, 0);
+  registry->RegisterListPref(kPrintingAllowedPageSizes);
 #endif  // defined(OS_CHROMEOS)
 }
 
@@ -858,6 +863,7 @@
   web_components_prefs::RegisterProfilePrefs(registry);
   TemplateURLPrepopulateData::RegisterProfilePrefs(registry);
   translate::TranslatePrefs::RegisterProfilePrefs(registry);
+  omnibox::RegisterProfilePrefs(registry);
   ZeroSuggestProvider::RegisterProfilePrefs(registry);
 
 #if BUILDFLAG(ENABLE_EXTENSIONS)
@@ -1209,5 +1215,8 @@
 #if defined(OS_CHROMEOS)
   // Added 4/2020.
   profile_prefs->ClearPref(kAmbientModeTopicSource);
+
+  // Added 4/2020.
+  profile_prefs->ClearPref(kPrintingAllowedPageSizes);
 #endif
 }

diff --git a/chrome/browser/resources/chromeos/camera/utils/cca.py b/chrome/browser/resources/chromeos/camera/utils/cca.py
index b378eda..1dc305a 100755
--- a/chrome/browser/resources/chromeos/camera/utils/cca.py
+++ b/chrome/browser/resources/chromeos/camera/utils/cca.py

@@ -90,14 +90,17 @@
     ]
     run(precompile_cmd)
 
-    parse_cmd = [
-        generator,
-        '-o',
-        'build/mojo',
-        '--use_bundled_pylibs',
-        'parse',
-        '-d',
+    parser = os.path.join(
         get_chromium_root(),
+        'mojo/public/tools/mojom/mojom_parser.py')
+
+    parse_cmd = [
+        parser,
+        '--output-root',
+        'build/mojo',
+        '--input-root',
+        get_chromium_root(),
+        '--mojoms',
     ] + list(mojom_paths)
     run(parse_cmd)
 

diff --git a/chrome/browser/resources/new_tab_page/BUILD.gn b/chrome/browser/resources/new_tab_page/BUILD.gn
index 6d38bbc..c049ce4 100644
--- a/chrome/browser/resources/new_tab_page/BUILD.gn
+++ b/chrome/browser/resources/new_tab_page/BUILD.gn

@@ -11,6 +11,7 @@
     ":app",
     ":browser_proxy",
     ":customize_dialog",
+    ":doodle_share_dialog",
     ":fakebox",
     ":grid",
     ":logo",
@@ -128,11 +129,22 @@
 
 js_library("logo") {
   deps = [
+    ":doodle_share_dialog",
     "//third_party/polymer/v3_0/components-chromium/polymer:polymer_bundled",
     "//ui/webui/resources/cr_elements/cr_button:cr_button.m",
   ]
 }
 
+js_library("doodle_share_dialog") {
+  deps = [
+    "//third_party/polymer/v3_0/components-chromium/polymer:polymer_bundled",
+    "//ui/webui/resources/cr_elements/cr_button:cr_button.m",
+    "//ui/webui/resources/cr_elements/cr_dialog:cr_dialog.m",
+    "//ui/webui/resources/cr_elements/cr_icon_button:cr_icon_button.m",
+    "//ui/webui/resources/cr_elements/cr_input:cr_input.m",
+  ]
+}
+
 polymer_modulizer("app") {
   js_file = "app.js"
   html_file = "app.html"
@@ -211,6 +223,12 @@
   html_type = "v3-ready"
 }
 
+polymer_modulizer("doodle_share_dialog") {
+  js_file = "doodle_share_dialog.js"
+  html_file = "doodle_share_dialog.html"
+  html_type = "v3-ready"
+}
+
 group("polymer3_elements") {
   public_deps = [
     ":app_module",
@@ -218,6 +236,7 @@
     ":customize_dialog_module",
     ":customize_shortcuts_module",
     ":customize_themes_module",
+    ":doodle_share_dialog_module",
     ":fakebox_module",
     ":grid_module",
     ":logo_module",

diff --git a/chrome/browser/resources/new_tab_page/app.html b/chrome/browser/resources/new_tab_page/app.html
index 566c675..9423a2a0 100644
--- a/chrome/browser/resources/new_tab_page/app.html
+++ b/chrome/browser/resources/new_tab_page/app.html

@@ -162,9 +162,8 @@
         --ntp-theme-text-color: [[rgbOrInherit_(theme_.shortcutTextColor)]];
         --ntp-theme-shortcut-background-color:
               [[rgbOrInherit_(theme_.shortcutBackgroundColor)]];
-        --ntp-logo-color: [[rgbOrInherit_(theme_.logoColor)]];">
-  <ntp-untrusted-iframe id="backgroundImage" path="[[backgroundImagePath_]]"
-      hidden="[[!showBackgroundImage_]]">
+        --ntp-logo-color: [[rgbOrInherit_(logoColor_)]];">
+  <ntp-untrusted-iframe id="backgroundImage" hidden="[[!showBackgroundImage_]]">
   </ntp-untrusted-iframe>
   <div id="backgroundGradient" hidden="[[!showBackgroundImage_]]"></div>
   <div id="content">

diff --git a/chrome/browser/resources/new_tab_page/app.js b/chrome/browser/resources/new_tab_page/app.js
index 0007f518..96ca7f0 100644
--- a/chrome/browser/resources/new_tab_page/app.js
+++ b/chrome/browser/resources/new_tab_page/app.js

@@ -18,7 +18,7 @@
 
 import {BrowserProxy} from './browser_proxy.js';
 import {BackgroundSelection, BackgroundSelectionType} from './customize_dialog.js';
-import {skColorToRgb} from './utils.js';
+import {hexColorToSkColor, skColorToRgb} from './utils.js';
 
 class AppElement extends PolymerElement {
   static get is() {
@@ -44,7 +44,10 @@
       },
 
       /** @private {!newTabPage.mojom.Theme} */
-      theme_: Object,
+      theme_: {
+        type: Object,
+        observer: 'updateBackgroundImagePath_',
+      },
 
       /** @private */
       showCustomizeDialog_: Boolean,
@@ -63,6 +66,7 @@
       backgroundSelection_: {
         type: Object,
         value: () => ({type: BackgroundSelectionType.NO_SELECTION}),
+        observer: 'updateBackgroundImagePath_',
       },
 
       /** @private */
@@ -87,20 +91,20 @@
       },
 
       /** @private */
-      backgroundImagePath_: {
-        computed: 'computeBackgroundImagePath_(theme_, backgroundSelection_)',
-        type: String,
-      },
-
-      /** @private */
       doodleAllowed_: {
         computed: 'computeDoodleAllowed_(showBackgroundImage_, theme_)',
         type: Boolean,
       },
 
       /** @private */
+      logoColor_: {
+        type: String,
+        computed: 'computeLogoColor_(theme_, backgroundSelection_)',
+      },
+
+      /** @private */
       singleColoredLogo_: {
-        computed: 'computeSingleColoredLogo_(theme_)',
+        computed: 'computeSingleColoredLogo_(theme_, backgroundSelection_)',
         type: Boolean,
       },
     };
@@ -247,22 +251,43 @@
   }
 
   /**
-   * @return {string}
+   * Set the #backgroundImage |path| only when different and non-empty. Reset
+   * the customize dialog background selection if the dialog is closed.
+   *
+   * The ntp-untrusted-iframe |path| is set directly. When using a data binding
+   * instead, the quick updates to the |path| result in iframe loading an error
+   * page.
    * @private
    */
-  computeBackgroundImagePath_() {
+  updateBackgroundImagePath_() {
+    // The |backgroundSelection_| is retained after the dialog commits the
+    // change to the theme. Since |backgroundSelection_| has precendence over
+    // the theme background, the |backgroundSelection_| needs to be reset when
+    // the theme is updated. This is only necessary when the dialog is closed.
+    // If the dialog is open, it will either commit the |backgroundSelection_|
+    // or reset |backgroundSelection_| on cancel.
+    if (!this.showCustomizeDialog_ &&
+        this.backgroundSelection_.type !==
+            BackgroundSelectionType.NO_SELECTION) {
+      this.backgroundSelection_ = {type: BackgroundSelectionType.NO_SELECTION};
+    }
+    let path;
     switch (this.backgroundSelection_.type) {
       case BackgroundSelectionType.NO_SELECTION:
-        return this.theme_ && this.theme_.backgroundImageUrl ?
-            `background_image?${this.theme_.backgroundImageUrl.url}` :
-            '';
+        path = this.theme_ && this.theme_.backgroundImageUrl &&
+            `background_image?${this.theme_.backgroundImageUrl.url}`;
+        break;
       case BackgroundSelectionType.IMAGE:
-        return `background_image?${
-            this.backgroundSelection_.image.imageUrl.url}`;
+        path =
+            `background_image?${this.backgroundSelection_.image.imageUrl.url}`;
+        break;
       case BackgroundSelectionType.NO_BACKGROUND:
       case BackgroundSelectionType.DAILY_REFRESH:
       default:
-        return '';
+        path = '';
+    }
+    if (path && this.$.backgroundImage.path !== path) {
+      this.$.backgroundImage.path = path;
     }
   }
 
@@ -277,11 +302,37 @@
   }
 
   /**
+   * @return {skia.mojom.SkColor}
+   * @private
+   */
+  computeLogoColor_() {
+    switch (this.backgroundSelection_.type) {
+      case BackgroundSelectionType.NO_SELECTION:
+        return this.theme_ && this.theme_.logoColor || null;
+      case BackgroundSelectionType.IMAGE:
+        return hexColorToSkColor('#ffffff');
+      case BackgroundSelectionType.NO_BACKGROUND:
+      case BackgroundSelectionType.DAILY_REFRESH:
+      default:
+        return null;
+    }
+  }
+
+  /**
    * @return {boolean}
    * @private
    */
   computeSingleColoredLogo_() {
-    return this.theme_ && !!this.theme_.logoColor;
+    switch (this.backgroundSelection_.type) {
+      case BackgroundSelectionType.NO_SELECTION:
+        return this.theme_ && !!this.theme_.logoColor;
+      case BackgroundSelectionType.IMAGE:
+        return true;
+      case BackgroundSelectionType.NO_BACKGROUND:
+      case BackgroundSelectionType.DAILY_REFRESH:
+      default:
+        return false;
+    }
   }
 
   /**

diff --git a/chrome/browser/resources/new_tab_page/customize_dialog.js b/chrome/browser/resources/new_tab_page/customize_dialog.js
index 019d012..e3dd7d74 100644
--- a/chrome/browser/resources/new_tab_page/customize_dialog.js
+++ b/chrome/browser/resources/new_tab_page/customize_dialog.js

@@ -61,7 +61,6 @@
        */
       backgroundSelection: {
         type: Object,
-        value: () => ({type: BackgroundSelectionType.NO_SELECTION}),
         notify: true,
       },
 
@@ -101,12 +100,12 @@
     this.pageHandler_ = BrowserProxy.getInstance().handler;
     /** @private {!Array<!IntersectionObserver>} */
     this.intersectionObservers_ = [];
+    this.backgroundSelection = {type: BackgroundSelectionType.NO_SELECTION};
   }
 
   /** @override */
   disconnectedCallback() {
     super.disconnectedCallback();
-    this.backgroundSelection = {type: BackgroundSelectionType.NO_SELECTION};
     this.intersectionObservers_.forEach(observer => {
       observer.disconnect();
     });
@@ -133,7 +132,16 @@
     this.$.dialog.cancel();
   }
 
-  /** @private */
+  /**
+   * The |backgroundSelection| is used in ntp-app to preview the image and has
+   * precedence over the theme background setting. |backgroundSelection| is not
+   * reset because it takes time for the theme to update, and after the update
+   * the theme and |backgroundSelection| are the same. By not resetting the
+   * value here, ntp-app can reset it if needed (other theme update). This
+   * prevents a flicker between |backgroundSelection| and the previous theme
+   * background setting.
+   * @private
+   */
   onDoneClick_() {
     this.pageHandler_.confirmThemeChanges();
     this.shadowRoot.querySelector('ntp-customize-shortcuts').apply();
@@ -151,7 +159,6 @@
         this.pageHandler_.setDailyRefreshCollectionId(
             assert(this.backgroundSelection.dailyRefreshCollectionId));
     }
-    this.backgroundSelection = {type: BackgroundSelectionType.NO_SELECTION};
     this.$.dialog.close();
   }
 

diff --git a/chrome/browser/resources/new_tab_page/doodle_share_dialog.html b/chrome/browser/resources/new_tab_page/doodle_share_dialog.html
new file mode 100644
index 0000000..c41b624
--- /dev/null
+++ b/chrome/browser/resources/new_tab_page/doodle_share_dialog.html

@@ -0,0 +1,81 @@
+<style>
+  #dialog::part(dialog) {
+    max-width: 300px;
+  }
+
+  #buttons {
+    display: flex;
+    flex-direction: row;
+    justify-content: center;
+    margin-bottom: 28px;
+    margin-top: 20px;
+  }
+
+  #buttons cr-button {
+    background-position: center;
+    background-repeat: no-repeat;
+    background-size: cover;
+    border: none;
+    height: 48px;
+    min-width: 48px;
+    width: 48px;
+  }
+
+  #buttons cr-button:hover {
+    opacity: 0.8;
+  }
+
+  #buttons > :not(:last-child) {
+    margin-inline-end: 12px;
+  }
+
+  #facebookButton {
+    background-image: url(icons/facebook.svg);
+  }
+
+  #twitterButton {
+    background-image: url(icons/twitter.svg);
+  }
+
+  #emailButton {
+    background-image: url(icons/mail.svg);
+  }
+
+  #url {
+    --cr-input-error-display: none;
+  }
+
+  #copyButton {
+    --cr-icon-image: url(icons/copy.svg);
+    margin-inline-start: 2px;
+  }
+</style>
+<cr-dialog id="dialog" show-on-attach>
+  <div id="title" slot="title">
+    [[title]]
+  </div>
+  <div slot="body">
+    <div id="buttons">
+      <cr-button id="facebookButton" title="$i18n{facebook}"
+          on-click="onFacebookClick_">
+      </cr-button>
+      <cr-button id="twitterButton" title="$i18n{twitter}"
+          on-click="onTwitterClick_">
+      </cr-button>
+      <cr-button id="emailButton" title="$i18n{email}"
+          on-click="onEmailClick_">
+      </cr-button>
+    </div>
+    <cr-input readonly label="$i18n{doodleLink}" id="url"
+        value="[[url.url]]">
+      <cr-icon-button id="copyButton" slot="suffix" title="$i18n{copyLink}"
+          on-click="onCopyClick_">
+      </cr-icon-button>
+    </cr-input>
+  </div>
+  <div slot="button-container">
+    <cr-button id="doneButton" class="action-button" on-click="onCloseClick_">
+      $i18n{doneButton}
+    </cr-button>
+  </div>
+</cr-dialog>

diff --git a/chrome/browser/resources/new_tab_page/doodle_share_dialog.js b/chrome/browser/resources/new_tab_page/doodle_share_dialog.js
new file mode 100644
index 0000000..0769090b
--- /dev/null
+++ b/chrome/browser/resources/new_tab_page/doodle_share_dialog.js

@@ -0,0 +1,80 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+import 'chrome://resources/cr_elements/cr_button/cr_button.m.js';
+import 'chrome://resources/cr_elements/cr_dialog/cr_dialog.m.js';
+import 'chrome://resources/cr_elements/cr_input/cr_input.m.js';
+import 'chrome://resources/cr_elements/cr_icon_button/cr_icon_button.m.js';
+
+import {html, PolymerElement} from 'chrome://resources/polymer/v3_0/polymer/polymer_bundled.min.js';
+import {BrowserProxy} from './browser_proxy.js';
+
+/**
+ * The ID of the doodle app for Facebook. Used to share doodles to Facebook.
+ * @type {number}
+ */
+const FACEBOOK_APP_ID = 738026486351791;
+
+// Dialog that lets the user share the doodle.
+class DoodleShareDialogElement extends PolymerElement {
+  static get is() {
+    return 'ntp-doodle-share-dialog';
+  }
+
+  static get template() {
+    return html`{__html_template__}`;
+  }
+
+  static get properties() {
+    return {
+      /**
+       * Title shown on the dialog.
+       * @type {string}
+       */
+      title: String,
+
+      /**
+       * Share URL provided to the user.
+       * @type {url.mojom.Url}
+       */
+      url: Object,
+    };
+  }
+
+  /** @private */
+  onFacebookClick_() {
+    const url = 'https://www.facebook.com/dialog/share' +
+        `?app_id=${FACEBOOK_APP_ID}` +
+        `&href=${encodeURIComponent(this.url.url)}` +
+        `&hashtag=${encodeURIComponent('#GoogleDoodle')}`;
+    BrowserProxy.getInstance().open(url);
+  }
+
+  /** @private */
+  onTwitterClick_() {
+    const url = 'https://twitter.com/intent/tweet' +
+        `?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;
+    BrowserProxy.getInstance().open(url);
+  }
+
+  /** @private */
+  onEmailClick_() {
+    const url = `mailto:?subject=${encodeURIComponent(this.title)}` +
+        `&body=${encodeURIComponent(this.url.url)}`;
+    BrowserProxy.getInstance().navigate(url);
+  }
+
+  /** @private */
+  onCopyClick_() {
+    this.$.url.select();
+    navigator.clipboard.writeText(this.url.url);
+  }
+
+  /** @private */
+  onCloseClick_() {
+    this.$.dialog.close();
+  }
+}
+
+customElements.define(DoodleShareDialogElement.is, DoodleShareDialogElement);

diff --git a/chrome/browser/resources/new_tab_page/icons/copy.svg b/chrome/browser/resources/new_tab_page/icons/copy.svg
new file mode 100644
index 0000000..fd4c870
--- /dev/null
+++ b/chrome/browser/resources/new_tab_page/icons/copy.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="48" height="48"><path d="M35.25 14a.76.76 0 0 1 .75.75v25.5a.76.76 0 0 1-.75.75h-16.5a.76.76 0 0 1-.75-.75v-25.5a.76.76 0 0 1 .75-.75h16.5m0-4h-16.5A4.77 4.77 0 0 0 14 14.75v25.5A4.77 4.77 0 0 0 18.75 45h16.5A4.77 4.77 0 0 0 40 40.25v-25.5A4.77 4.77 0 0 0 35.25 10z" fill="#666"/><path d="M9 38V9.75A4.77 4.77 0 0 1 13.75 5h19.16" fill="none" stroke="#666" stroke-miterlimit="10" stroke-width="4"/></svg>
\ No newline at end of file

diff --git a/chrome/browser/resources/new_tab_page/icons/facebook.svg b/chrome/browser/resources/new_tab_page/icons/facebook.svg
new file mode 100644
index 0000000..dbf2fd8
--- /dev/null
+++ b/chrome/browser/resources/new_tab_page/icons/facebook.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="48" height="48"><path d="M43.5 48h-39C2 48 0 46 0 43.5v-39C0 2 2 0 4.5 0h39C46 0 48 2 48 4.5v39c0 2.5-2 4.5-4.5 4.5z" fill="#3a589b"/><path d="M39.4 29.4l.9-7.3h-7.2v-4.7c0-2.1.6-3.5 3.6-3.5h3.8V7.5c-.7-.1-2.9-.3-5.6-.3-5.5 0-9.3 3.4-9.3 9.6v5.3h-6.2v7.3h6.2V48h7.5V29.4h6.3z" fill="#fff"/></svg>
\ No newline at end of file

diff --git a/chrome/browser/resources/new_tab_page/icons/mail.svg b/chrome/browser/resources/new_tab_page/icons/mail.svg
new file mode 100644
index 0000000..8851e42
--- /dev/null
+++ b/chrome/browser/resources/new_tab_page/icons/mail.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="48" height="48"><path d="M43.5 48h-39C2 48 0 46 0 43.5v-39C0 2 2 0 4.5 0h39C46 0 48 2 48 4.5v39c0 2.5-2 4.5-4.5 4.5z" fill="#9da6aa"/><path d="M35.9 12.8H12.1c-2.2 0-4 1.8-4 4v14.4c0 2.2 1.8 4 4 4h23.8c2.2 0 4-1.8 4-4V16.8c0-2.2-1.8-4-4-4z" fill="#fff"/><path fill="none" stroke="#9da6aa" stroke-width="3" stroke-linecap="round" stroke-linejoin="round" stroke-miterlimit="10" d="M35.4 17.2L24 26.1l-11.4-8.9"/></svg>
\ No newline at end of file

diff --git a/chrome/browser/resources/new_tab_page/icons/twitter.svg b/chrome/browser/resources/new_tab_page/icons/twitter.svg
new file mode 100644
index 0000000..4aeae35
--- /dev/null
+++ b/chrome/browser/resources/new_tab_page/icons/twitter.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="48" height="48"><path d="M43.5 48h-39C2 48 0 46 0 43.5v-39C0 2 2 0 4.5 0h39C46 0 48 2 48 4.5v39c0 2.5-2 4.5-4.5 4.5z" fill="#3aaae1"/><path d="M39.3 15.5c-1.1.5-2.3.8-3.5.9 1.2-.7 2.2-1.9 2.6-3.3-1.1.7-2.5 1.2-3.8 1.5-1.1-1.1-2.6-1.9-4.4-1.9-3.3 0-6 2.7-6 6 0 .5.1.9.1 1.3-4.9-.3-9.4-2.6-12.4-6.3-.5.9-.8 1.9-.8 3 0 2 1.1 3.9 2.7 5-1 0-1.9-.3-2.7-.8v.1c0 2.9 2 5.3 4.8 5.9-.5.1-1.1.2-1.6.2-.4 0-.8-.1-1.1-.1.8 2.4 3 4.1 5.6 4.2-2 1.6-4.7 2.5-7.4 2.5-.5 0-1 0-1.4-.1 2.7 1.7 5.8 2.7 9.2 2.7 11 0 17-9.1 17-17v-.8c1.3-.8 2.3-1.8 3.1-3z" fill="#fff"/></svg>
\ No newline at end of file

diff --git a/chrome/browser/resources/new_tab_page/logo.html b/chrome/browser/resources/new_tab_page/logo.html
index 28e7e90..0c4726ef 100644
--- a/chrome/browser/resources/new_tab_page/logo.html
+++ b/chrome/browser/resources/new_tab_page/logo.html

@@ -80,7 +80,7 @@
     <div id="singleColoredLogo" hidden="[[!singleColored]]"></div>
     <div id="multiColoredLogo" hidden="[[singleColored]]"></div>
   </div>
-  <div id="doodle">
+  <div id="doodle" title="[[doodle_.description]]">
     <div id="imageContainer" hidden="[[!doodle_.content.imageDoodle]]"
         tabindex="1" on-click="onImageClick_" on-keydown="onImageKeydown_">
       <!-- The static image is always visible and the animated image is stacked
@@ -91,13 +91,11 @@
       <ntp-untrusted-iframe id="animation" path="[[animationUrl_]]"
           hidden="[[!showAnimation_]]">
       </ntp-untrusted-iframe>
-      <!-- TODO(crbug.com/1039910): Set focus ring that works for both dark and
-                                    light doodles.
-           TODO(crbug.com/1039910): Open share dialog on click. -->
       <cr-button id="shareButton" title="$i18n{shareDoodle}"
-        style="background-color: [[rgbOrUnset_(doodle_.content.imageDoodle.shareButton.backgroundColor)]];
-               left: [[doodle_.content.imageDoodle.shareButton.x]]px;
-               top: [[doodle_.content.imageDoodle.shareButton.y]]px;">
+          on-click="onShareButtonClick_"
+          style="background-color: [[rgbOrUnset_(doodle_.content.imageDoodle.shareButton.backgroundColor)]];
+                 left: [[doodle_.content.imageDoodle.shareButton.x]]px;
+                 top: [[doodle_.content.imageDoodle.shareButton.y]]px;">
         <img id="shareButtonImage"
             src="[[doodle_.content.imageDoodle.shareButton.iconUrl.url]]">
         </img>
@@ -111,3 +109,11 @@
     </ntp-untrusted-iframe>
   </div>
 </iron-pages>
+<dom-if if="[[showShareDialog_]]" restamp>
+  <template>
+    <ntp-doodle-share-dialog title="[[doodle_.description]]"
+        url="[[doodle_.content.imageDoodle.shareUrl]]"
+        on-close="onShareDialogClose_">
+    </ntp-doodle-share-dialog>
+  </template>
+</dom-if>

diff --git a/chrome/browser/resources/new_tab_page/logo.js b/chrome/browser/resources/new_tab_page/logo.js
index 7f4d003a..952a783b4 100644
--- a/chrome/browser/resources/new_tab_page/logo.js
+++ b/chrome/browser/resources/new_tab_page/logo.js

@@ -6,6 +6,7 @@
 import 'chrome://resources/cr_elements/hidden_style_css.m.js';
 import 'chrome://resources/polymer/v3_0/iron-pages/iron-pages.js';
 import './untrusted_iframe.js';
+import './doodle_share_dialog.js';
 
 import {assert} from 'chrome://resources/js/assert.m.js';
 import {EventTracker} from 'chrome://resources/js/event_tracker.m.js';
@@ -98,6 +99,9 @@
         type: String,
         value: null,
       },
+
+      /** @private */
+      showShareDialog_: Boolean,
     };
   }
 
@@ -224,6 +228,20 @@
   rgbOrUnset_(skColor) {
     return skColor ? skColorToRgb(skColor) : 'unset';
   }
+
+  /**
+   * @param {!Event} e
+   * @private
+   */
+  onShareButtonClick_(e) {
+    e.stopPropagation();
+    this.showShareDialog_ = true;
+  }
+
+  /** @private */
+  onShareDialogClose_() {
+    this.showShareDialog_ = false;
+  }
 }
 
 customElements.define(LogoElement.is, LogoElement);

diff --git a/chrome/browser/resources/new_tab_page/new_tab_page_resources.grd b/chrome/browser/resources/new_tab_page/new_tab_page_resources.grd
index 0124cea..2bab512 100644
--- a/chrome/browser/resources/new_tab_page/new_tab_page_resources.grd
+++ b/chrome/browser/resources/new_tab_page/new_tab_page_resources.grd

@@ -78,6 +78,14 @@
           file="icons/mic.svg" type="BINDATA" compress="gzip" />
       <include name="IDR_NEW_TAB_PAGE_LINK_SVG"
           file="icons/link.svg" type="BINDATA" compress="gzip" />
+      <include name="IDR_NEW_TAB_PAGE_COPY_SVG"
+          file="icons/copy.svg" type="BINDATA" compress="gzip" />
+      <include name="IDR_NEW_TAB_PAGE_FACEBOOK_SVG"
+          file="icons/facebook.svg" type="BINDATA" compress="gzip" />
+      <include name="IDR_NEW_TAB_PAGE_TWITTER_SVG"
+          file="icons/twitter.svg" type="BINDATA" compress="gzip" />
+      <include name="IDR_NEW_TAB_PAGE_MAIL_SVG"
+          file="icons/mail.svg" type="BINDATA" compress="gzip" />
       <include name="IDR_NEW_TAB_PAGE_MINI_PAGE_JS"
           file="${root_gen_dir}/chrome/browser/resources/new_tab_page/mini_page.js"
           use_base_dir="false" type="BINDATA" compress="gzip" />
@@ -87,6 +95,9 @@
       <include name="IDR_NEW_TAB_PAGE_LOGO_JS"
           file="${root_gen_dir}/chrome/browser/resources/new_tab_page/logo.js"
           use_base_dir="false" type="BINDATA" compress="gzip" />
+      <include name="IDR_NEW_TAB_PAGE_DOODLE_SHARE_DIALOG_JS"
+          file="${root_gen_dir}/chrome/browser/resources/new_tab_page/doodle_share_dialog.js"
+          use_base_dir="false" type="BINDATA" compress="gzip" />
     </includes>
     <structures>
       <structure name="IDR_NEW_TAB_PAGE_NEW_TAB_PAGE_HTML"

diff --git a/chrome/browser/sync/test/integration/two_client_extension_apps_sync_test.cc b/chrome/browser/sync/test/integration/two_client_extension_apps_sync_test.cc
index f2490b20..e323b63 100644
--- a/chrome/browser/sync/test/integration/two_client_extension_apps_sync_test.cc
+++ b/chrome/browser/sync/test/integration/two_client_extension_apps_sync_test.cc

@@ -108,7 +108,9 @@
 // Install some apps on both clients, some on only one client, some on only the
 // other, and sync.  Both clients should end up with all apps, and the app and
 // page ordinals should be identical.
-IN_PROC_BROWSER_TEST_P(TwoClientExtensionAppsSyncTest, StartWithDifferentApps) {
+// Disabled due to flake: https://crbug.com/1069843
+IN_PROC_BROWSER_TEST_P(TwoClientExtensionAppsSyncTest,
+                       DISABLED_StartWithDifferentApps) {
   ASSERT_TRUE(SetupClients());
 
   int i = 0;

diff --git a/chrome/browser/ui/browser_commands.cc b/chrome/browser/ui/browser_commands.cc
index b2b19044..042a4239 100644
--- a/chrome/browser/ui/browser_commands.cc
+++ b/chrome/browser/ui/browser_commands.cc

@@ -85,7 +85,7 @@
 #include "components/find_in_page/find_tab_helper.h"
 #include "components/find_in_page/find_types.h"
 #include "components/google/core/common/google_util.h"
-#include "components/omnibox/browser/omnibox_pref_names.h"
+#include "components/omnibox/browser/omnibox_prefs.h"
 #include "components/prefs/pref_service.h"
 #include "components/services/app_service/public/mojom/types.mojom.h"
 #include "components/sessions/core/live_tab_context.h"

diff --git a/chrome/browser/ui/media_router/presentation_receiver_window_controller.cc b/chrome/browser/ui/media_router/presentation_receiver_window_controller.cc
index 98fa082..c01bf6f 100644
--- a/chrome/browser/ui/media_router/presentation_receiver_window_controller.cc
+++ b/chrome/browser/ui/media_router/presentation_receiver_window_controller.cc

@@ -15,8 +15,8 @@
 #include "chrome/browser/ui/media_router/presentation_receiver_window.h"
 #include "content/public/browser/navigation_controller.h"
 #include "content/public/browser/navigation_entry.h"
+#include "content/public/browser/presentation_receiver_flags.h"
 #include "content/public/browser/web_contents.h"
-#include "third_party/blink/public/common/presentation/presentation_receiver_flags.h"
 #include "ui/views/widget/widget.h"
 
 using content::WebContents;
@@ -25,7 +25,7 @@
 
 WebContents::CreateParams CreateWebContentsParams(Profile* profile) {
   WebContents::CreateParams params(profile);
-  params.starting_sandbox_flags = blink::kPresentationReceiverSandboxFlags;
+  params.starting_sandbox_flags = content::kPresentationReceiverSandboxFlags;
   return params;
 }
 

diff --git a/chrome/browser/ui/startup/startup_browser_creator.cc b/chrome/browser/ui/startup/startup_browser_creator.cc
index ed9376c9..921c9d2 100644
--- a/chrome/browser/ui/startup/startup_browser_creator.cc
+++ b/chrome/browser/ui/startup/startup_browser_creator.cc

@@ -45,12 +45,14 @@
 #include "chrome/browser/profiles/profile_observer.h"
 #include "chrome/browser/profiles/profiles_state.h"
 #include "chrome/browser/search_engines/template_url_service_factory.h"
+#include "chrome/browser/signin/signin_util.h"
 #include "chrome/browser/ui/browser.h"
 #include "chrome/browser/ui/browser_finder.h"
 #include "chrome/browser/ui/browser_list.h"
 #include "chrome/browser/ui/browser_list_observer.h"
 #include "chrome/browser/ui/browser_window.h"
 #include "chrome/browser/ui/startup/startup_browser_creator_impl.h"
+#include "chrome/browser/ui/ui_features.h"
 #include "chrome/common/buildflags.h"
 #include "chrome/common/chrome_constants.h"
 #include "chrome/common/chrome_features.h"
@@ -261,7 +263,12 @@
 #endif
 }
 
-void ShowUserManagerOnStartup(const base::CommandLine& command_line) {
+bool ShouldShowProfilePicker() {
+  return !signin_util::IsForceSigninEnabled() &&
+         base::FeatureList::IsEnabled(features::kNewProfilePicker);
+}
+
+void ShowUserManagerOnStartup() {
 #if !defined(OS_CHROMEOS)
   UserManager::Show(base::FilePath(),
                     profiles::USER_MANAGER_SELECT_PROFILE_NO_ACTION);
@@ -790,6 +797,12 @@
     bool process_startup,
     Profile* last_used_profile,
     const Profiles& last_opened_profiles) {
+  if (ShouldShowProfilePicker()) {
+    // TODO(crbug.com/1063856): Adjust to show the profile picker.
+    ShowUserManagerOnStartup();
+    return true;
+  }
+
   chrome::startup::IsProcessStartup is_process_startup = process_startup ?
       chrome::startup::IS_PROCESS_STARTUP :
       chrome::startup::IS_NOT_PROCESS_STARTUP;
@@ -825,7 +838,7 @@
     }
 
     // Show UserManager if |last_used_profile| can't be auto opened.
-    ShowUserManagerOnStartup(command_line);
+    ShowUserManagerOnStartup();
     return true;
   }
   return ProcessLastOpenedProfiles(command_line, cur_dir, is_process_startup,
@@ -891,7 +904,7 @@
 // activation this one.
 #if !defined(OS_CHROMEOS)
   if (is_process_startup == chrome::startup::IS_PROCESS_STARTUP)
-    ShowUserManagerOnStartup(command_line);
+    ShowUserManagerOnStartup();
   else
 #endif
     profile_launch_observer.Get().set_profile_to_activate(last_used_profile);

diff --git a/chrome/browser/ui/toolbar/chrome_location_bar_model_delegate.cc b/chrome/browser/ui/toolbar/chrome_location_bar_model_delegate.cc
index a453cfa7..0219f97 100644
--- a/chrome/browser/ui/toolbar/chrome_location_bar_model_delegate.cc
+++ b/chrome/browser/ui/toolbar/chrome_location_bar_model_delegate.cc

@@ -18,7 +18,7 @@
 #include "components/google/core/common/google_util.h"
 #include "components/offline_pages/buildflags/buildflags.h"
 #include "components/omnibox/browser/autocomplete_input.h"
-#include "components/omnibox/browser/omnibox_pref_names.h"
+#include "components/omnibox/browser/omnibox_prefs.h"
 #include "components/pref_registry/pref_registry_syncable.h"
 #include "components/prefs/pref_service.h"
 #include "components/security_interstitials/content/security_interstitial_tab_helper.h"

diff --git a/chrome/browser/ui/ui_features.cc b/chrome/browser/ui/ui_features.cc
index 98c9887..6e7ab68c 100644
--- a/chrome/browser/ui/ui_features.cc
+++ b/chrome/browser/ui/ui_features.cc

@@ -20,6 +20,11 @@
 const base::Feature kMixBrowserTypeTabs{"MixBrowserTypeTabs",
                                         base::FEATURE_DISABLED_BY_DEFAULT};
 
+// Enables the new profile picker.
+// https:://crbug.com/1063856
+const base::Feature kNewProfilePicker{"NewProfilePicker",
+                                      base::FEATURE_DISABLED_BY_DEFAULT};
+
 // Enables updated tabstrip animations, required for a scrollable tabstrip.
 // https://crbug.com/958173
 const base::Feature kNewTabstripAnimation{"NewTabstripAnimation",

diff --git a/chrome/browser/ui/ui_features.h b/chrome/browser/ui/ui_features.h
index b3696ff..241dec7 100644
--- a/chrome/browser/ui/ui_features.h
+++ b/chrome/browser/ui/ui_features.h

@@ -23,6 +23,8 @@
 
 extern const base::Feature kMixBrowserTypeTabs;
 
+extern const base::Feature kNewProfilePicker;
+
 extern const base::Feature kNewTabstripAnimation;
 
 extern const base::Feature kProminentDarkModeActiveTabTitle;

diff --git a/chrome/browser/ui/views/frame/browser_frame_mac.mm b/chrome/browser/ui/views/frame/browser_frame_mac.mm
index 7d1f44f..339af1d 100644
--- a/chrome/browser/ui/views/frame/browser_frame_mac.mm
+++ b/chrome/browser/ui/views/frame/browser_frame_mac.mm

@@ -22,7 +22,7 @@
 #include "chrome/common/pref_names.h"
 #include "chrome/grit/generated_resources.h"
 #include "components/bookmarks/common/bookmark_pref_names.h"
-#include "components/omnibox/browser/omnibox_pref_names.h"
+#include "components/omnibox/browser/omnibox_prefs.h"
 #import "components/remote_cocoa/app_shim/native_widget_mac_nswindow.h"
 #import "components/remote_cocoa/app_shim/native_widget_ns_window_bridge.h"
 #import "components/remote_cocoa/app_shim/window_touch_bar_delegate.h"

diff --git a/chrome/browser/ui/views/omnibox/omnibox_result_view.cc b/chrome/browser/ui/views/omnibox/omnibox_result_view.cc
index 862cef5..83dfcc9d 100644
--- a/chrome/browser/ui/views/omnibox/omnibox_result_view.cc
+++ b/chrome/browser/ui/views/omnibox/omnibox_result_view.cc

@@ -146,6 +146,23 @@
 
 OmniboxResultView::~OmniboxResultView() {}
 
+// static
+std::unique_ptr<views::Background> OmniboxResultView::GetPopupCellBackground(
+    views::View* view,
+    OmniboxPartState part_state) {
+  DCHECK(view);
+
+  bool high_contrast = view->GetNativeTheme() &&
+                       view->GetNativeTheme()->UsesHighContrastColors();
+  // TODO(tapted): Consider using background()->SetNativeControlColor() and
+  // always have a background.
+  if ((part_state == OmniboxPartState::NORMAL && !high_contrast))
+    return nullptr;
+
+  return views::CreateSolidBackground(GetOmniboxColor(
+      view->GetThemeProvider(), OmniboxPart::RESULTS_BACKGROUND, part_state));
+}
+
 SkColor OmniboxResultView::GetColor(OmniboxPart part) const {
   return GetOmniboxColor(GetThemeProvider(), part, GetThemeState());
 }
@@ -203,14 +220,7 @@
 }
 
 void OmniboxResultView::ApplyThemeAndRefreshIcons(bool force_reapply_styles) {
-  bool high_contrast =
-      GetNativeTheme() && GetNativeTheme()->UsesHighContrastColors();
-  // TODO(tapted): Consider using background()->SetNativeControlColor() and
-  // always have a background.
-  SetBackground((GetThemeState() == OmniboxPartState::NORMAL && !high_contrast)
-                    ? nullptr
-                    : views::CreateSolidBackground(
-                          GetColor(OmniboxPart::RESULTS_BACKGROUND)));
+  SetBackground(GetPopupCellBackground(this, GetThemeState()));
 
   // Reapply the dim color to account for the highlight state.
   suggestion_view_->separator()->ApplyTextColor(
@@ -231,6 +241,8 @@
       omnibox::kKeywordSearchIcon, GetLayoutConstant(LOCATION_BAR_ICON_SIZE),
       GetColor(OmniboxPart::RESULTS_ICON)));
 
+  bool high_contrast =
+      GetNativeTheme() && GetNativeTheme()->UsesHighContrastColors();
   if (match_.answer) {
     suggestion_view_->content()->ApplyTextColor(
         OmniboxPart::RESULTS_TEXT_DEFAULT);

diff --git a/chrome/browser/ui/views/omnibox/omnibox_result_view.h b/chrome/browser/ui/views/omnibox/omnibox_result_view.h
index b9cd8598..145157b 100644
--- a/chrome/browser/ui/views/omnibox/omnibox_result_view.h
+++ b/chrome/browser/ui/views/omnibox/omnibox_result_view.h

@@ -19,6 +19,7 @@
 #include "ui/gfx/font_list.h"
 #include "ui/gfx/geometry/rect.h"
 #include "ui/views/animation/animation_delegate_views.h"
+#include "ui/views/background.h"
 #include "ui/views/controls/button/button.h"
 #include "ui/views/controls/button/image_button.h"
 #include "ui/views/controls/image_view.h"
@@ -48,6 +49,11 @@
                     size_t model_index);
   ~OmniboxResultView() override;
 
+  // Static method to share logic about how to set backgrounds of popup cells.
+  static std::unique_ptr<views::Background> GetPopupCellBackground(
+      views::View* view,
+      OmniboxPartState part_state);
+
   // Helper to get the color for |part| using the current state.
   SkColor GetColor(OmniboxPart part) const;
 

diff --git a/chrome/browser/ui/views/omnibox/omnibox_row_view.cc b/chrome/browser/ui/views/omnibox/omnibox_row_view.cc
index 1b07e54..d390b8f 100644
--- a/chrome/browser/ui/views/omnibox/omnibox_row_view.cc
+++ b/chrome/browser/ui/views/omnibox/omnibox_row_view.cc

@@ -29,6 +29,7 @@
     // TODO(tommycli): Add a focus ring.
     hide_button_ = AddChildView(views::CreateVectorToggleImageButton(this));
     views::InstallCircleHighlightPathGenerator(hide_button_);
+    hide_button_->SetVisible(false);
   }
 
   void SetHeader(int suggestion_group_id, const base::string16& header_text) {
@@ -37,17 +38,24 @@
   }
 
   // views::View:
+  gfx::Insets GetInsets() const override { return gfx::Insets(8, 16); }
+  void OnMouseEntered(const ui::MouseEvent& event) override {
+    UpdateUIForHoverState();
+  }
+  void OnMouseExited(const ui::MouseEvent& event) override {
+    UpdateUIForHoverState();
+  }
   void OnThemeChanged() override {
     views::View::OnThemeChanged();
 
-    int dip_size = GetLayoutConstant(LOCATION_BAR_ICON_SIZE);
-    OmniboxPartState part_state =
-        IsMouseHovered() ? OmniboxPartState::HOVERED : OmniboxPartState::NORMAL;
-
-    SkColor color = GetOmniboxColor(GetThemeProvider(),
-                                    OmniboxPart::RESULTS_ICON, part_state);
+    // Since the hide button is only visible when the part is hovered, base the
+    // icon color on the hover state.
+    SkColor color =
+        GetOmniboxColor(GetThemeProvider(), OmniboxPart::RESULTS_ICON,
+                        OmniboxPartState::HOVERED);
     hide_button_->set_ink_drop_base_color(color);
 
+    int dip_size = GetLayoutConstant(LOCATION_BAR_ICON_SIZE);
     const gfx::ImageSkia arrow_down =
         gfx::CreateVectorIcon(omnibox::kChevronIcon, dip_size, color);
     const gfx::ImageSkia arrow_up =
@@ -58,6 +66,9 @@
     // The "toggled" button state corresponds with the group being hidden.
     hide_button_->SetImage(views::Button::STATE_NORMAL, arrow_up);
     hide_button_->SetToggledImage(views::Button::STATE_NORMAL, &arrow_down);
+
+    // When the theme is updated, also refresh the hover-specific UI.
+    UpdateUIForHoverState();
   }
 
   // views::ButtonListener:
@@ -68,6 +79,20 @@
   }
 
  private:
+  // Some UI changes on-hover, and this function effects those changes.
+  void UpdateUIForHoverState() {
+    bool is_hovered = IsMouseHovered();
+    hide_button_->SetVisible(is_hovered);
+
+    OmniboxPartState part_state =
+        is_hovered ? OmniboxPartState::HOVERED : OmniboxPartState::NORMAL;
+
+    // It's a little hokey that we're stealing the logic for the background
+    // color from OmniboxResultView. If we start doing this is more than just
+    // one place, we should introduce a more elegant abstraction here.
+    SetBackground(OmniboxResultView::GetPopupCellBackground(this, part_state));
+  }
+
   // The Label containing the header text. This is never nullptr.
   views::Label* header_text_;
 

diff --git a/chrome/browser/ui/views/omnibox/omnibox_view_views.cc b/chrome/browser/ui/views/omnibox/omnibox_view_views.cc
index 8e05b13..1d1f644 100644
--- a/chrome/browser/ui/views/omnibox/omnibox_view_views.cc
+++ b/chrome/browser/ui/views/omnibox/omnibox_view_views.cc

@@ -38,7 +38,7 @@
 #include "components/omnibox/browser/omnibox_edit_model.h"
 #include "components/omnibox/browser/omnibox_field_trial.h"
 #include "components/omnibox/browser/omnibox_popup_model.h"
-#include "components/omnibox/browser/omnibox_pref_names.h"
+#include "components/omnibox/browser/omnibox_prefs.h"
 #include "components/omnibox/common/omnibox_features.h"
 #include "components/security_state/core/security_state.h"
 #include "components/strings/grit/components_strings.h"

diff --git a/chrome/browser/ui/views/session_crashed_bubble_view.cc b/chrome/browser/ui/views/session_crashed_bubble_view.cc
index cfb0c41..e99e5c64 100644
--- a/chrome/browser/ui/views/session_crashed_bubble_view.cc
+++ b/chrome/browser/ui/views/session_crashed_bubble_view.cc

@@ -158,7 +158,7 @@
 }
 
 ax::mojom::Role SessionCrashedBubbleView::GetAccessibleWindowRole() {
-  return ax::mojom::Role::kAlert;
+  return ax::mojom::Role::kAlertDialog;
 }
 
 SessionCrashedBubbleView::SessionCrashedBubbleView(views::View* anchor_view,

diff --git a/chrome/browser/ui/webui/new_tab_page/new_tab_page.mojom b/chrome/browser/ui/webui/new_tab_page/new_tab_page.mojom
index d665c9a..e885ce3 100644
--- a/chrome/browser/ui/webui/new_tab_page/new_tab_page.mojom
+++ b/chrome/browser/ui/webui/new_tab_page/new_tab_page.mojom

@@ -132,6 +132,8 @@
   url.mojom.Url? animation_url;
   // Specification of the share button.
   DoodleShareButton share_button;
+  // URL displayed to users, which they can use to share the doodle.
+  url.mojom.Url share_url;
 };
 
 // The contents of a doodle.
@@ -146,6 +148,8 @@
 struct Doodle {
   // The doodle content.
   DoodleContent content;
+  // Localized description of the doodle.
+  string description;
 };
 
 // Used by the WebUI page to bootstrap bidirectional communication.

diff --git a/chrome/browser/ui/webui/new_tab_page/new_tab_page_handler.cc b/chrome/browser/ui/webui/new_tab_page/new_tab_page_handler.cc
index 3cdf9627..6f29605 100644
--- a/chrome/browser/ui/webui/new_tab_page/new_tab_page_handler.cc
+++ b/chrome/browser/ui/webui/new_tab_page/new_tab_page_handler.cc

@@ -449,6 +449,7 @@
         "data:image/png;base64,%s", logo->metadata.share_button_icon.c_str()));
     image_doodle_content->share_button->background_color =
         SkColorSetA(doodle_share_button_background_color, 255);
+    image_doodle_content->share_url = logo->metadata.short_link;
     doodle->content = new_tab_page::mojom::DoodleContent::NewImageDoodle(
         std::move(image_doodle_content));
   } else if (logo->metadata.type ==
@@ -459,5 +460,6 @@
     std::move(callback).Run(nullptr);
     return;
   }
+  doodle->description = logo->metadata.alt_text;
   std::move(callback).Run(std::move(doodle));
 }

diff --git a/chrome/browser/ui/webui/new_tab_page/new_tab_page_ui.cc b/chrome/browser/ui/webui/new_tab_page/new_tab_page_ui.cc
index 775ab1e..0204852e 100644
--- a/chrome/browser/ui/webui/new_tab_page/new_tab_page_ui.cc
+++ b/chrome/browser/ui/webui/new_tab_page/new_tab_page_ui.cc

@@ -52,6 +52,7 @@
                         .spec());
 
   static constexpr webui::LocalizedString kStrings[] = {
+      {"doneButton", IDS_DONE},
       {"title", IDS_NEW_TAB_TITLE},
       {"undo", IDS_NEW_TAB_UNDO_THUMBNAIL_REMOVE},
 
@@ -80,7 +81,6 @@
       {"customizeButton", IDS_NTP_CUSTOMIZE_BUTTON_LABEL},
       {"customizeThisPage", IDS_NTP_CUSTOM_BG_CUSTOMIZE_NTP_LABEL},
       {"defaultThemeLabel", IDS_NTP_CUSTOMIZE_DEFAULT_LABEL},
-      {"doneButton", IDS_DONE},
       {"hideShortcuts", IDS_NTP_CUSTOMIZE_HIDE_SHORTCUTS_LABEL},
       {"hideShortcutsDesc", IDS_NTP_CUSTOMIZE_HIDE_SHORTCUTS_DESC},
       {"mostVisited", IDS_NTP_CUSTOMIZE_MOST_VISITED_LABEL},
@@ -115,7 +115,12 @@
       {"searchBoxHint", IDS_GOOGLE_SEARCH_BOX_EMPTY_HINT_MD},
 
       // Logo/doodle.
+      {"copyLink", IDS_NTP_DOODLE_SHARE_DIALOG_COPY_LABEL},
+      {"doodleLink", IDS_NTP_DOODLE_SHARE_DIALOG_LINK_LABEL},
+      {"email", IDS_NTP_DOODLE_SHARE_DIALOG_MAIL_LABEL},
+      {"facebook", IDS_NTP_DOODLE_SHARE_DIALOG_FACEBOOK_LABEL},
       {"shareDoodle", IDS_NTP_DOODLE_SHARE_LABEL},
+      {"twitter", IDS_NTP_DOODLE_SHARE_DIALOG_TWITTER_LABEL},
   };
   AddLocalizedStringsBulk(source, kStrings);
 

diff --git a/chrome/browser/ui/webui/print_preview/policy_settings.cc b/chrome/browser/ui/webui/print_preview/policy_settings.cc
index 55818d2d..dc34659 100644
--- a/chrome/browser/ui/webui/print_preview/policy_settings.cc
+++ b/chrome/browser/ui/webui/print_preview/policy_settings.cc

@@ -21,7 +21,6 @@
   registry->RegisterIntegerPref(prefs::kPrintingAllowedColorModes, 0);
   registry->RegisterIntegerPref(prefs::kPrintingAllowedDuplexModes, 0);
   registry->RegisterIntegerPref(prefs::kPrintingAllowedPinModes, 0);
-  registry->RegisterListPref(prefs::kPrintingAllowedPageSizes);
   registry->RegisterIntegerPref(prefs::kPrintingColorDefault, 0);
   registry->RegisterIntegerPref(prefs::kPrintingDuplexDefault, 0);
   registry->RegisterIntegerPref(prefs::kPrintingPinDefault, 0);

diff --git a/chrome/browser/ui/webui/settings/safety_check_handler.cc b/chrome/browser/ui/webui/settings/safety_check_handler.cc
index 7e5487e..ea863b1 100644
--- a/chrome/browser/ui/webui/settings/safety_check_handler.cc
+++ b/chrome/browser/ui/webui/settings/safety_check_handler.cc

@@ -368,8 +368,6 @@
     Compromised compromised,
     Done done,
     Total total) {
-  const base::string16 short_product_name =
-      l10n_util::GetStringUTF16(IDS_SHORT_PRODUCT_NAME);
   switch (status) {
     case PasswordsStatus::kChecking: {
       // Unable to get progress for some reason.
@@ -387,20 +385,20 @@
       return l10n_util::GetPluralStringFUTF16(
           IDS_SETTINGS_COMPROMISED_PASSWORDS_COUNT, compromised.value());
     case PasswordsStatus::kOffline:
-      return l10n_util::GetStringFUTF16(
-          IDS_SETTINGS_CHECK_PASSWORDS_ERROR_OFFLINE, short_product_name);
+      return l10n_util::GetStringUTF16(
+          IDS_SETTINGS_CHECK_PASSWORDS_ERROR_OFFLINE);
     case PasswordsStatus::kNoPasswords:
-      return l10n_util::GetStringFUTF16(
-          IDS_SETTINGS_CHECK_PASSWORDS_ERROR_NO_PASSWORDS, short_product_name);
+      return l10n_util::GetStringUTF16(
+          IDS_SETTINGS_CHECK_PASSWORDS_ERROR_NO_PASSWORDS);
     case PasswordsStatus::kSignedOut:
       return l10n_util::GetStringUTF16(
           IDS_SETTINGS_SAFETY_CHECK_PASSWORDS_SIGNED_OUT);
     case PasswordsStatus::kQuotaLimit:
-      return l10n_util::GetStringFUTF16(
-          IDS_SETTINGS_CHECK_PASSWORDS_ERROR_QUOTA_LIMIT, short_product_name);
+      return l10n_util::GetStringUTF16(
+          IDS_SETTINGS_CHECK_PASSWORDS_ERROR_QUOTA_LIMIT);
     case PasswordsStatus::kError:
-      return l10n_util::GetStringFUTF16(
-          IDS_SETTINGS_CHECK_PASSWORDS_ERROR_GENERIC, short_product_name);
+      return l10n_util::GetStringUTF16(
+          IDS_SETTINGS_CHECK_PASSWORDS_ERROR_GENERIC);
   }
 }
 

diff --git a/chrome/browser/ui/webui/settings/settings_localized_strings_provider.cc b/chrome/browser/ui/webui/settings/settings_localized_strings_provider.cc
index 731b35b..3b5ca59 100644
--- a/chrome/browser/ui/webui/settings/settings_localized_strings_provider.cc
+++ b/chrome/browser/ui/webui/settings/settings_localized_strings_provider.cc

@@ -735,6 +735,18 @@
       {"checkPasswordsCanceled", IDS_SETTINGS_CHECK_PASSWORDS_CANCELED},
       {"checkedPasswords", IDS_SETTINGS_CHECKED_PASSWORDS},
       {"checkPasswordsDescription", IDS_SETTINGS_CHECK_PASSWORDS_DESCRIPTION},
+      {"checkPasswordsErrorOffline",
+       IDS_SETTINGS_CHECK_PASSWORDS_ERROR_OFFLINE},
+      {"checkPasswordsErrorSignedOut",
+       IDS_SETTINGS_CHECK_PASSWORDS_ERROR_SIGNED_OUT},
+      {"checkPasswordsErrorNoPasswords",
+       IDS_SETTINGS_CHECK_PASSWORDS_ERROR_NO_PASSWORDS},
+      {"checkPasswordsErrorQuota",
+       IDS_SETTINGS_CHECK_PASSWORDS_ERROR_QUOTA_LIMIT},
+      {"checkPasswordsErrorGeneric",
+       IDS_SETTINGS_CHECK_PASSWORDS_ERROR_GENERIC},
+      {"noCompromisedCredentials",
+       IDS_SETTINGS_NO_COMPROMISED_CREDENTIALS_LABEL},
       {"checkPasswordsAgain", IDS_SETTINGS_CHECK_PASSWORDS_AGAIN},
       {"checkPasswordsAgainAfterError",
        IDS_SETTINGS_CHECK_PASSWORDS_AGAIN_AFTER_ERROR},
@@ -859,33 +871,6 @@
       {"savedToThisDeviceOnly",
        IDS_SETTINGS_PAYMENTS_SAVED_TO_THIS_DEVICE_ONLY}};
 
-  const base::string16 short_product_name =
-      l10n_util::GetStringUTF16(IDS_SHORT_PRODUCT_NAME);
-  html_source->AddString(
-      "checkPasswordsErrorOffline",
-      l10n_util::GetStringFUTF16(IDS_SETTINGS_CHECK_PASSWORDS_ERROR_OFFLINE,
-                                 short_product_name));
-  html_source->AddString(
-      "checkPasswordsErrorSignedOut",
-      l10n_util::GetStringFUTF16(IDS_SETTINGS_CHECK_PASSWORDS_ERROR_SIGNED_OUT,
-                                 short_product_name));
-  html_source->AddString(
-      "checkPasswordsErrorNoPasswords",
-      l10n_util::GetStringFUTF16(
-          IDS_SETTINGS_CHECK_PASSWORDS_ERROR_NO_PASSWORDS, short_product_name));
-  html_source->AddString(
-      "checkPasswordsErrorQuota",
-      l10n_util::GetStringFUTF16(IDS_SETTINGS_CHECK_PASSWORDS_ERROR_QUOTA_LIMIT,
-                                 short_product_name));
-  html_source->AddString(
-      "checkPasswordsErrorGeneric",
-      l10n_util::GetStringFUTF16(IDS_SETTINGS_CHECK_PASSWORDS_ERROR_GENERIC,
-                                 short_product_name));
-  html_source->AddString(
-      "noCompromisedCredentials",
-      l10n_util::GetStringFUTF16(IDS_SETTINGS_NO_COMPROMISED_CREDENTIALS_LABEL,
-                                 short_product_name));
-
   GURL google_password_manager_url = GetGooglePasswordManagerURL(
       password_manager::ManagePasswordsReferrer::kChromeSettings);
 
@@ -898,7 +883,6 @@
       "checkPasswordsErrorQuotaGoogleAccount",
       l10n_util::GetStringFUTF16(
           IDS_SETTINGS_CHECK_PASSWORDS_ERROR_QUOTA_LIMIT_GOOGLE_ACCOUNT,
-          short_product_name,
           base::UTF8ToUTF16(
               password_manager::GetPasswordCheckupURL(
                   password_manager::PasswordCheckupReferrer::kPasswordCheck)

diff --git a/chrome/browser/upboarding/query_tiles/BUILD.gn b/chrome/browser/upboarding/query_tiles/BUILD.gn
index 26d7d6f..619a33e 100644
--- a/chrome/browser/upboarding/query_tiles/BUILD.gn
+++ b/chrome/browser/upboarding/query_tiles/BUILD.gn

@@ -71,7 +71,9 @@
       "android/java/src/org/chromium/chrome/browser/query_tiles/list/TileListProperties.java",
       "android/java/src/org/chromium/chrome/browser/query_tiles/list/TileListPropertyViewBinder.java",
       "android/java/src/org/chromium/chrome/browser/query_tiles/list/TileListView.java",
+      "android/java/src/org/chromium/chrome/browser/query_tiles/list/TileSizeSupplier.java",
       "android/java/src/org/chromium/chrome/browser/query_tiles/list/TileViewHolder.java",
+      "android/java/src/org/chromium/chrome/browser/query_tiles/list/TileViewHolderFactory.java",
     ]
 
     deps = [
@@ -92,7 +94,12 @@
   }
 
   android_resources("chrome_upboarding_query_tiles_java_resources") {
-    sources = [ "android/java/res/layout/query_tile_view.xml" ]
+    sources = [
+      "android/java/res/drawable/query_tile_overlay.xml",
+      "android/java/res/layout/query_tile_view.xml",
+      "android/java/res/values/dimens.xml",
+      "android/java/res/values/styles.xml",
+    ]
     custom_package = "org.chromium.chrome.query_tiles"
   }
 

diff --git a/chrome/browser/upboarding/query_tiles/android/java/res/drawable/query_tile_overlay.xml b/chrome/browser/upboarding/query_tiles/android/java/res/drawable/query_tile_overlay.xml
new file mode 100644
index 0000000..810276c
--- /dev/null
+++ b/chrome/browser/upboarding/query_tiles/android/java/res/drawable/query_tile_overlay.xml

@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright 2020 The Chromium Authors. All rights reserved.
+     Use of this source code is governed by a BSD-style license that can be
+     found in the LICENSE file. -->
+<shape
+    xmlns:android="http://schemas.android.com/apk/res/android"
+    android:shape="rectangle" >
+
+    <gradient
+        android:angle="270"
+        android:endColor="#99000000"
+        android:startColor="#00000000"
+        android:type="linear" />
+    <corners
+        android:radius="@dimen/tile_corner_radius"/>
+</shape>

diff --git a/chrome/browser/upboarding/query_tiles/android/java/res/layout/query_tile_view.xml b/chrome/browser/upboarding/query_tiles/android/java/res/layout/query_tile_view.xml
index 647198c..ae0b1c0 100644
--- a/chrome/browser/upboarding/query_tiles/android/java/res/layout/query_tile_view.xml
+++ b/chrome/browser/upboarding/query_tiles/android/java/res/layout/query_tile_view.xml

@@ -9,18 +9,31 @@
     android:layout_height="86dp"
     android:orientation="vertical">
 
-    <org.chromium.ui.widget.ChromeImageView
+    <org.chromium.components.browser_ui.widget.RoundedCornerImageView
         android:id="@+id/thumbnail"
         android:layout_width="match_parent"
         android:layout_height="match_parent"
         android:layout_gravity="center_horizontal"
         android:scaleType="centerCrop"
-        android:src="@drawable/chrome_sync_logo"
-        android:importantForAccessibility="no"/>
+        android:importantForAccessibility="no"
+        app:cornerRadiusBottomStart="@dimen/tile_corner_radius"
+        app:cornerRadiusBottomEnd="@dimen/tile_corner_radius"
+        app:cornerRadiusTopStart="@dimen/tile_corner_radius"
+        app:cornerRadiusTopEnd="@dimen/tile_corner_radius" />
+
+    <ImageView
+        android:id="@+id/gradient_overlay"
+        android:layout_width="match_parent"
+        android:layout_height="match_parent"
+        android:importantForAccessibility="no"
+        app:srcCompat="@drawable/query_tile_overlay"/>
 
     <TextView
         android:id="@+id/title"
         android:layout_width="wrap_content"
         android:layout_height="wrap_content"
-        android:layout_centerInParent="true"/>
+        android:layout_alignParentBottom="true"
+        android:layout_marginBottom="12dp"
+        android:layout_marginStart="16dp"
+        android:textAppearance="@style/TextAppearance.WhiteText"/>
 </RelativeLayout>
\ No newline at end of file

diff --git a/chrome/browser/upboarding/query_tiles/android/java/res/values/dimens.xml b/chrome/browser/upboarding/query_tiles/android/java/res/values/dimens.xml
new file mode 100644
index 0000000..15f870d3
--- /dev/null
+++ b/chrome/browser/upboarding/query_tiles/android/java/res/values/dimens.xml

@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright 2020 The Chromium Authors. All rights reserved.
+     Use of this source code is governed by a BSD-style license that can be
+     found in the LICENSE file. -->
+
+<resources xmlns:tools="http://schemas.android.com/tools">
+
+  <!-- Tile dimensions -->
+  <dimen name="tile_corner_radius">8dp</dimen>
+  <dimen name="tile_ideal_width">86dp</dimen>
+
+  <!-- Tile container dimensions -->
+  <dimen name="tile_grid_inter_tile_padding">12dp</dimen>
+  <dimen name="recycler_view_start_margin">16dp</dimen>
+</resources>

diff --git a/chrome/browser/upboarding/query_tiles/android/java/res/values/styles.xml b/chrome/browser/upboarding/query_tiles/android/java/res/values/styles.xml
new file mode 100644
index 0000000..735cc78
--- /dev/null
+++ b/chrome/browser/upboarding/query_tiles/android/java/res/values/styles.xml

@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright 2020 The Chromium Authors. All rights reserved.
+     Use of this source code is governed by a BSD-style license that can be
+     found in the LICENSE file. -->
+
+<resources xmlns:tools="http://schemas.android.com/tools">
+    <style name="TextAppearance.WhiteText">
+        <item name="android:textColor">@android:color/white</item>
+        <item name="android:textSize">@dimen/text_size_medium</item>
+    </style>
+</resources>

diff --git a/chrome/browser/upboarding/query_tiles/android/java/src/org/chromium/chrome/browser/query_tiles/list/TileListView.java b/chrome/browser/upboarding/query_tiles/android/java/src/org/chromium/chrome/browser/query_tiles/list/TileListView.java
index 1be04cb..6c55e76 100644
--- a/chrome/browser/upboarding/query_tiles/android/java/src/org/chromium/chrome/browser/query_tiles/list/TileListView.java
+++ b/chrome/browser/upboarding/query_tiles/android/java/src/org/chromium/chrome/browser/query_tiles/list/TileListView.java

@@ -5,12 +5,18 @@
 package org.chromium.chrome.browser.query_tiles.list;
 
 import android.content.Context;
+import android.content.res.Configuration;
+import android.graphics.Rect;
 import android.view.View;
 
+import androidx.annotation.NonNull;
 import androidx.annotation.Nullable;
 import androidx.recyclerview.widget.LinearLayoutManager;
 import androidx.recyclerview.widget.RecyclerView;
+import androidx.recyclerview.widget.RecyclerView.ItemDecoration;
+import androidx.recyclerview.widget.RecyclerView.State;
 
+import org.chromium.chrome.query_tiles.R;
 import org.chromium.ui.modelutil.ForwardingListObservable;
 import org.chromium.ui.modelutil.PropertyModelChangeProcessor;
 import org.chromium.ui.modelutil.RecyclerViewAdapter;
@@ -22,25 +28,39 @@
 class TileListView {
     private final TileListModel mModel;
     private final RecyclerView mView;
+    private final RecyclerViewAdapter<TileViewHolder, Void> mAdapter;
     private final LinearLayoutManager mLayoutManager;
+    private final TileSizeSupplier mTileSizeSupplier;
 
     /** Constructor. */
     public TileListView(Context context, TileListModel model) {
         mModel = model;
-        mView = new RecyclerView(context);
+        mView = new RecyclerView(context) {
+            @Override
+            protected void onConfigurationChanged(Configuration newConfig) {
+                super.onConfigurationChanged(newConfig);
+
+                // Reset the adapter to ensure that any cached views are recreated.
+                setAdapter(null);
+                setAdapter(mAdapter);
+                mTileSizeSupplier.recompute();
+            }
+        };
+
         mView.setHasFixedSize(true);
 
         mLayoutManager = new LinearLayoutManager(context, LinearLayoutManager.HORIZONTAL, false);
         mView.setLayoutManager(mLayoutManager);
+        mView.addItemDecoration(new ItemDecorationImpl(context));
+        mTileSizeSupplier = new TileSizeSupplier(context);
 
         PropertyModelChangeProcessor.create(
                 mModel.getProperties(), mView, new TileListPropertyViewBinder());
 
-        RecyclerViewAdapter<TileViewHolder, Void> adapter =
-                new RecyclerViewAdapter<TileViewHolder, Void>(
-                        new ModelChangeProcessor(mModel), TileViewHolder::create);
-        mView.setAdapter(adapter);
-        mView.post(adapter::notifyDataSetChanged);
+        mAdapter = new RecyclerViewAdapter<>(
+                new ModelChangeProcessor(mModel), new TileViewHolderFactory(mTileSizeSupplier));
+        mView.setAdapter(mAdapter);
+        mView.post(mAdapter::notifyDataSetChanged);
     }
 
     /** @return The Android {@link View} representing this widget. */
@@ -48,6 +68,23 @@
         return mView;
     }
 
+    private class ItemDecorationImpl extends ItemDecoration {
+        private final int mInterCellPadding;
+
+        public ItemDecorationImpl(Context context) {
+            mInterCellPadding = context.getResources().getDimensionPixelOffset(
+                    R.dimen.tile_grid_inter_tile_padding);
+        }
+
+        @Override
+        public void getItemOffsets(@NonNull Rect outRect, @NonNull View view,
+                @NonNull RecyclerView parent, @NonNull State state) {
+            int position = parent.getChildAdapterPosition(view);
+            if (position != 0) outRect.left = mInterCellPadding / 2;
+            if (position != mModel.size() - 1) outRect.right = mInterCellPadding / 2;
+        }
+    }
+
     private static class ModelChangeProcessor extends ForwardingListObservable<Void>
             implements RecyclerViewAdapter.Delegate<TileViewHolder, Void> {
         private final TileListModel mModel;

diff --git a/chrome/browser/upboarding/query_tiles/android/java/src/org/chromium/chrome/browser/query_tiles/list/TileSizeSupplier.java b/chrome/browser/upboarding/query_tiles/android/java/src/org/chromium/chrome/browser/query_tiles/list/TileSizeSupplier.java
new file mode 100644
index 0000000..ee18401
--- /dev/null
+++ b/chrome/browser/upboarding/query_tiles/android/java/src/org/chromium/chrome/browser/query_tiles/list/TileSizeSupplier.java

@@ -0,0 +1,70 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+package org.chromium.chrome.browser.query_tiles.list;
+import android.content.Context;
+import android.content.res.Resources;
+
+import org.chromium.base.supplier.Supplier;
+import org.chromium.chrome.browser.query_tiles.list.TileSizeSupplier.TileSize;
+import org.chromium.chrome.query_tiles.R;
+
+/**
+ * A helper class to compute dimensions for the carousel layout.
+ */
+class TileSizeSupplier implements Supplier<TileSize> {
+    /**
+     * Contains details to be used by the grid layout when placing items.
+     */
+    public static class TileSize {
+        public int width;
+        public int interTilePadding;
+    }
+
+    private final TileSize mComputedTileSize;
+    private final Resources mResources;
+    private final int mIdealTileWidth;
+    private final int mInterTilePadding;
+
+    /** Constructor. */
+    public TileSizeSupplier(Context context) {
+        mComputedTileSize = new TileSize();
+        mResources = context.getResources();
+        mIdealTileWidth = mResources.getDimensionPixelOffset(R.dimen.tile_ideal_width);
+        mInterTilePadding =
+                mResources.getDimensionPixelOffset(R.dimen.tile_grid_inter_tile_padding);
+        recompute();
+    }
+
+    @Override
+    public TileSize get() {
+        return mComputedTileSize;
+    }
+
+    /**
+     * Given a desired cell width, computes the actual item width feasible. Should be
+     * invoked after a orientation change as well.
+     * @return The {@link TileSize} containing results of the computation.
+     */
+    public void recompute() {
+        double idealSpanCount =
+                (double) getAvailableWidth() / (mIdealTileWidth + mInterTilePadding);
+        double adjustedSpanCount = Math.round(idealSpanCount);
+
+        // For carousel, we need to have the last cell peeking out of the screen.
+        adjustedSpanCount += 0.5f;
+
+        double tileWidthToUse = (getAvailableWidth() - mInterTilePadding * (idealSpanCount - 1))
+                / adjustedSpanCount;
+
+        mComputedTileSize.interTilePadding = mInterTilePadding;
+        mComputedTileSize.width = (int) tileWidthToUse;
+    }
+
+    private int getAvailableWidth() {
+        // TODO(shaktisahu): Cap this for tablet and landscape to 600dp.
+        return mResources.getDisplayMetrics().widthPixels
+                - 2 * mResources.getDimensionPixelOffset(R.dimen.recycler_view_start_margin);
+    }
+}

diff --git a/chrome/browser/upboarding/query_tiles/android/java/src/org/chromium/chrome/browser/query_tiles/list/TileViewHolder.java b/chrome/browser/upboarding/query_tiles/android/java/src/org/chromium/chrome/browser/query_tiles/list/TileViewHolder.java
index 7c2c90f..b8a018b8 100644
--- a/chrome/browser/upboarding/query_tiles/android/java/src/org/chromium/chrome/browser/query_tiles/list/TileViewHolder.java
+++ b/chrome/browser/upboarding/query_tiles/android/java/src/org/chromium/chrome/browser/query_tiles/list/TileViewHolder.java

@@ -4,9 +4,7 @@
 
 package org.chromium.chrome.browser.query_tiles.list;
 
-import android.view.LayoutInflater;
 import android.view.View;
-import android.view.ViewGroup;
 import android.widget.ImageView;
 import android.widget.TextView;
 
@@ -26,16 +24,6 @@
     }
 
     /**
-     * Used as a method reference for ViewHolderFactory.
-     * @see RecyclerViewAdapter.ViewHolderFactory#createViewHolder
-     */
-    public static TileViewHolder create(ViewGroup parent, int viewType) {
-        View view = LayoutInflater.from(parent.getContext())
-                            .inflate(R.layout.query_tile_view, parent, false);
-        return new TileViewHolder(view);
-    }
-
-    /**
      * Binds the currently held {@link View} to {@code item}.
      * @param properties The shared {@link PropertyModel} all items can access.
      * @param tile       The {@link ListItem} to visually represent in this {@link ViewHolder}.

diff --git a/chrome/browser/upboarding/query_tiles/android/java/src/org/chromium/chrome/browser/query_tiles/list/TileViewHolderFactory.java b/chrome/browser/upboarding/query_tiles/android/java/src/org/chromium/chrome/browser/query_tiles/list/TileViewHolderFactory.java
new file mode 100644
index 0000000..fc30e17
--- /dev/null
+++ b/chrome/browser/upboarding/query_tiles/android/java/src/org/chromium/chrome/browser/query_tiles/list/TileViewHolderFactory.java

@@ -0,0 +1,37 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+package org.chromium.chrome.browser.query_tiles.list;
+import android.view.LayoutInflater;
+import android.view.View;
+import android.view.ViewGroup;
+
+import org.chromium.base.supplier.Supplier;
+import org.chromium.chrome.browser.query_tiles.list.TileSizeSupplier.TileSize;
+import org.chromium.chrome.query_tiles.R;
+import org.chromium.ui.modelutil.RecyclerViewAdapter;
+
+/**
+ * A factory class to create view holders for the query tiles.
+ */
+class TileViewHolderFactory implements RecyclerViewAdapter.ViewHolderFactory<TileViewHolder> {
+    private final Supplier<TileSize> mTileSizeSupplier;
+
+    /**
+     * Constructor.
+     * @param tileSizeSupplier The {@link TileSize} to provide width and height for the view.
+     */
+    public TileViewHolderFactory(Supplier<TileSize> tileSizeSupplier) {
+        mTileSizeSupplier = tileSizeSupplier;
+    }
+
+    @Override
+    public TileViewHolder createViewHolder(ViewGroup parent, int viewType) {
+        View view = LayoutInflater.from(parent.getContext())
+                            .inflate(R.layout.query_tile_view, parent, false);
+        view.getLayoutParams().width = mTileSizeSupplier.get().width;
+        view.getLayoutParams().height = mTileSizeSupplier.get().width;
+        return new TileViewHolder(view);
+    }
+}

diff --git a/chrome/common/pref_names.cc b/chrome/common/pref_names.cc
index b5e5a0c2..87c316c3 100644
--- a/chrome/common/pref_names.cc
+++ b/chrome/common/pref_names.cc

@@ -1418,10 +1418,6 @@
 // A pref holding the allowed PIN printing modes.
 const char kPrintingAllowedPinModes[] = "printing.allowed_pin_modes";
 
-// A pref holding the list of allowed printing duplex mode.
-// Empty list is no restriction.
-const char kPrintingAllowedPageSizes[] = "printing.allowed_page_sizes";
-
 // A pref holding the default color mode.
 const char kPrintingColorDefault[] = "printing.color_default";
 

diff --git a/chrome/common/pref_names.h b/chrome/common/pref_names.h
index 53cf03d..df514ad0 100644
--- a/chrome/common/pref_names.h
+++ b/chrome/common/pref_names.h

@@ -446,7 +446,6 @@
 extern const char kPrintingAllowedColorModes[];
 extern const char kPrintingAllowedDuplexModes[];
 extern const char kPrintingAllowedPinModes[];
-extern const char kPrintingAllowedPageSizes[];
 extern const char kPrintingColorDefault[];
 extern const char kPrintingDuplexDefault[];
 extern const char kPrintingPinDefault[];

diff --git a/chrome/installer/util/util_constants.cc b/chrome/installer/util/util_constants.cc
index e3f9cc4..0621a06 100644
--- a/chrome/installer/util/util_constants.cc
+++ b/chrome/installer/util/util_constants.cc

@@ -64,6 +64,9 @@
 // confirmation from user.
 const char kForceUninstall[] = "force-uninstall";
 
+// See description for kPatch.
+const char kInputFile[] = "input-file";
+
 // Specify the path to the compressed Chrome archive for install. If not
 // specified, chrome.packed.7z or chrome.7z in the same directory as setup.exe
 // is used (the packed file is preferred; see kUncompressedArchive to force use
@@ -92,6 +95,14 @@
 // Notify the installer that the OS has been upgraded.
 const char kOnOsUpgrade[] = "on-os-upgrade";
 
+// Applies a binary patch to a file. The input, patch, and the output file are
+// specified as command line arguments following the --patch switch.
+// Ex: --patch=courgette --input_file='input' --patch_file='patch'
+//        --output_file='output'
+const char kOutputFile[] = "output-file";
+const char kPatch[] = "patch";
+const char kPatchFile[] = "patch-file";
+
 // Provide the previous version that patch is for.
 const char kPreviousVersion[] = "previous-version";
 
@@ -119,30 +130,37 @@
 // in addition to the standard set of protocols.
 const char kRegisterURLProtocol[] = "register-url-protocol";
 
+// Removes Chrome registration from current machine. Requires admin rights.
+const char kRemoveChromeRegistration[] = "remove-chrome-registration";
+
 // Renames chrome.exe to old_chrome.exe and renames new_chrome.exe to chrome.exe
 // to support in-use updates. Also deletes opv key.
 const char kRenameChromeExe[] = "rename-chrome-exe";
 
-// Removes Chrome registration from current machine. Requires admin rights.
-const char kRemoveChromeRegistration[] = "remove-chrome-registration";
-
 // When we try to relaunch setup.exe as admin on Vista, we append this command
 // line flag so that we try the launch only once.
 const char kRunAsAdmin[] = "run-as-admin";
 
-// Saves the specified device management token to the registry.
-const char kStoreDMToken[] = "store-dmtoken";
-
 // Combined with --uninstall, signals to setup.exe that this uninstall was
 // triggered by a self-destructing Chrome.
 const char kSelfDestruct[] = "self-destruct";
 
+// Show the embedded EULA dialog.
+const char kShowEula[] = "show-eula";
+
+// Saves the specified device management token to the registry.
+const char kStoreDMToken[] = "store-dmtoken";
+
 // Install Chrome to system wise location. The default is per user install.
 const char kSystemLevel[] = "system-level";
 
 // Signals to setup.exe that it should trigger the active setup command.
 const char kTriggerActiveSetup[] = "trigger-active-setup";
 
+// Use the given uncompressed chrome.7z archive as the source of files to
+// install.
+const char kUncompressedArchive[] = "uncompressed-archive";
+
 // If present, setup will uninstall chrome.
 const char kUninstall[] = "uninstall";
 
@@ -151,25 +169,9 @@
 // path given by --new-setup-exe.
 const char kUpdateSetupExe[] = "update-setup-exe";
 
-// Use the given uncompressed chrome.7z archive as the source of files to
-// install.
-const char kUncompressedArchive[] = "uncompressed-archive";
-
 // Enable verbose logging (info level).
 const char kVerboseLogging[] = "verbose-logging";
 
-// Show the embedded EULA dialog.
-const char kShowEula[] = "show-eula";
-
-// Applies a binary patch to a file. The input, patch, and the output file are
-// specified as command line arguments following the --patch switch.
-// Ex: --patch=courgette --input_file='input' --patch_file='patch'
-//        --output_file='output'
-const char kPatch[] = "patch";
-const char kInputFile[] = "input-file";
-const char kPatchFile[] = "patch-file";
-const char kOutputFile[] = "output-file";
-
 }  // namespace switches
 
 namespace env_vars {
@@ -191,8 +193,8 @@
 // TODO(gab): Rename setup.exe itself altogether and use the same binary for
 // Active Setup.
 const wchar_t kActiveSetupExe[] = L"chrmstp.exe";
-const wchar_t kChromeDll[] = L"chrome.dll";
 const wchar_t kChromeChildDll[] = L"chrome_child.dll";
+const wchar_t kChromeDll[] = L"chrome.dll";
 const wchar_t kChromeExe[] = L"chrome.exe";
 const wchar_t kChromeNewExe[] = L"new_chrome.exe";
 const wchar_t kChromeOldExe[] = L"old_chrome.exe";

diff --git a/chrome/installer/util/util_constants.h b/chrome/installer/util/util_constants.h
index b1f54209..2c10f8ed 100644
--- a/chrome/installer/util/util_constants.h
+++ b/chrome/installer/util/util_constants.h

@@ -161,6 +161,7 @@
 extern const char kEnableLogging[];
 extern const char kForceConfigureUserSettings[];
 extern const char kForceUninstall[];
+extern const char kInputFile[];
 extern const char kInstallArchive[];
 extern const char kInstallerData[];
 extern const char kLogFile[];
@@ -168,28 +169,27 @@
 extern const char kMsi[];
 extern const char kNewSetupExe[];
 extern const char kOnOsUpgrade[];
+extern const char kOutputFile[];
+extern const char kPatch[];
+extern const char kPatchFile[];
 extern const char kPreviousVersion[];
 extern const char kReenableAutoupdates[];
 extern const char kRegisterChromeBrowser[];
 extern const char kRegisterChromeBrowserSuffix[];
 extern const char kRegisterDevChrome[];
 extern const char kRegisterURLProtocol[];
-extern const char kRenameChromeExe[];
 extern const char kRemoveChromeRegistration[];
+extern const char kRenameChromeExe[];
 extern const char kRunAsAdmin[];
-extern const char kStoreDMToken[];
 extern const char kSelfDestruct[];
+extern const char kShowEula[];
+extern const char kStoreDMToken[];
 extern const char kSystemLevel[];
 extern const char kTriggerActiveSetup[];
+extern const char kUncompressedArchive[];
 extern const char kUninstall[];
 extern const char kUpdateSetupExe[];
-extern const char kUncompressedArchive[];
 extern const char kVerboseLogging[];
-extern const char kShowEula[];
-extern const char kPatch[];
-extern const char kInputFile[];
-extern const char kPatchFile[];
-extern const char kOutputFile[];
 
 }  // namespace switches
 
@@ -200,8 +200,8 @@
 }  // namespace env_vars
 
 extern const wchar_t kActiveSetupExe[];
-extern const wchar_t kChromeDll[];
 extern const wchar_t kChromeChildDll[];
+extern const wchar_t kChromeDll[];
 extern const wchar_t kChromeExe[];
 extern const wchar_t kChromeNewExe[];
 extern const wchar_t kChromeOldExe[];

diff --git a/chrome/renderer/subresource_redirect/subresource_redirect_url_loader_throttle_unittest.cc b/chrome/renderer/subresource_redirect/subresource_redirect_url_loader_throttle_unittest.cc
index e3e26cc..8c47660 100644
--- a/chrome/renderer/subresource_redirect/subresource_redirect_url_loader_throttle_unittest.cc
+++ b/chrome/renderer/subresource_redirect/subresource_redirect_url_loader_throttle_unittest.cc

@@ -74,10 +74,6 @@
       {true, true, network::mojom::RequestDestination::kImage,
        content::PreviewsTypes::SUBRESOURCE_REDIRECT_ON,
        "https://www.test.com/test.jpg", true},
-      {true, true, network::mojom::RequestDestination::kImage,
-       content::PreviewsTypes::SUBRESOURCE_REDIRECT_ON |
-           content::PreviewsTypes::LAZY_IMAGE_AUTO_RELOAD,
-       "https://www.test.com/test.jpg", true},
 
       // Failure cases
       {false, true, network::mojom::RequestDestination::kImage,
@@ -157,11 +153,6 @@
           GURL("https://www.test.com/public_img.jpg&private_arg1=foo"),
           GURL(),
       },
-      {
-          content::PreviewsTypes::LAZY_IMAGE_AUTO_RELOAD,
-          GURL("https://www.test.com/public_img.jpg"),
-          GURL(),
-      },
   };
   blink::WebNetworkStateNotifier::SetSaveDataEnabled(true);
   base::test::ScopedFeatureList scoped_feature_list;

diff --git a/chrome/test/data/ad_tagging/ad_script.js b/chrome/test/data/ad_tagging/ad_script.js
index d5b487f7..22ba6e2 100644
--- a/chrome/test/data/ad_tagging/ad_script.js
+++ b/chrome/test/data/ad_tagging/ad_script.js

@@ -65,16 +65,21 @@
   document.body.appendChild(frame);
   frame.contentWindow.stop();
 
-  // We load the scripts in frame_factory.html to allow subframe creation.
+  // We load the scripts in frame_factory.html to allow subframe creation. We
+  // set the async attribute to false to ensure that these scripts are loaded in
+  // insertion order.
   let script1 = document.createElement('script');
+  script1.async = false;
   script1.src = 'create_frame.js';
   frame.contentDocument.head.appendChild(script1);
 
   let script2 = document.createElement('script');
+  script2.async = false;
   script2.src = 'ad_script.js';
   frame.contentDocument.head.appendChild(script2);
 
   let script3 = document.createElement('script');
+  script3.async = false;
   script3.src = 'ad_script_2.js';
   // Set title so we know when all scripts have loaded.
   script3.onload = function() {

diff --git a/chrome/test/data/pdf/accessibility/text_fields-expected-auralinux.txt b/chrome/test/data/pdf/accessibility/text_fields-expected-auralinux.txt
new file mode 100644
index 0000000..7b7b150
--- /dev/null
+++ b/chrome/test/data/pdf/accessibility/text_fields-expected-auralinux.txt

@@ -0,0 +1,17 @@
+[embedded component]
+++[document frame] name='PDF document containing 1 page'
+++++[landmark] name='Page 1'
+++++++[paragraph]
+++++++++[static] name='Test Form<newline>'
+++++++[paragraph]
+++++++++[static] name='Read Only:<newline>'
+++++++[paragraph]
+++++++++[static] name='Sample Text<newline>'
+++++++[paragraph]
+++++++++[static] name='*required field<newline>'
+++++++[paragraph]
+++++++++[static] name='Password:'
+++++++++[entry] name='Text Box' selectable-text
+++++++++[entry] name='ReadOnly' selectable-text
+++++++++[entry] name='Required' selectable-text
+++++++++[password text] name='Password' selectable-text

diff --git a/chrome/test/data/pdf/accessibility/text_fields-expected-blink.txt b/chrome/test/data/pdf/accessibility/text_fields-expected-blink.txt
new file mode 100644
index 0000000..2bbc7cf
--- /dev/null
+++ b/chrome/test/data/pdf/accessibility/text_fields-expected-blink.txt

@@ -0,0 +1,22 @@
+embeddedObject
+++document name='PDF document containing 1 page' restriction=readOnly
+++++region name='Page 1' restriction=readOnly isPageBreakingObject=true
+++++++paragraph restriction=readOnly
+++++++++staticText name='Test Form<newline>' restriction=readOnly
+++++++++++inlineTextBox name='Test Form<newline>' restriction=readOnly
+++++++paragraph restriction=readOnly
+++++++++staticText name='Read Only:<newline>' restriction=readOnly
+++++++++++inlineTextBox name='Read Only:<newline>' restriction=readOnly
+++++++paragraph restriction=readOnly
+++++++++staticText name='Sample Text<newline>' restriction=readOnly
+++++++++++inlineTextBox name='Sample Text<newline>' restriction=readOnly
+++++++paragraph restriction=readOnly
+++++++++staticText name='*required field<newline>' restriction=readOnly
+++++++++++inlineTextBox name='*required field<newline>' restriction=readOnly
+++++++paragraph restriction=readOnly
+++++++++staticText name='Password:' restriction=readOnly
+++++++++++inlineTextBox name='Password:' restriction=readOnly
+++++++++textField name='Text Box' value='Text'
+++++++++textField name='ReadOnly' value='Elephant' restriction=readOnly
+++++++++textField required name='Required' value='Required Field'
+++++++++textField protected name='Password'

diff --git a/chrome/test/data/pdf/accessibility/text_fields-expected-mac.txt b/chrome/test/data/pdf/accessibility/text_fields-expected-mac.txt
new file mode 100644
index 0000000..3355a32
--- /dev/null
+++ b/chrome/test/data/pdf/accessibility/text_fields-expected-mac.txt

@@ -0,0 +1,17 @@
+AXGroup AXDescription='PDF document containing 1 page'
+++AXGroup AXDescription='PDF document containing 1 page'
+++++AXGroup AXDescription='Page 1'
+++++++AXGroup
+++++++++AXStaticText AXValue='Test Form<newline>'
+++++++AXGroup
+++++++++AXStaticText AXValue='Read Only:<newline>'
+++++++AXGroup
+++++++++AXStaticText AXValue='Sample Text<newline>'
+++++++AXGroup
+++++++++AXStaticText AXValue='*required field<newline>'
+++++++AXGroup
+++++++++AXStaticText AXValue='Password:'
+++++++++AXTextField AXValue='Text' AXDescription='Text Box'
+++++++++AXTextField AXValue='Elephant' AXDescription='ReadOnly'
+++++++++AXTextField AXValue='Required Field' AXDescription='Required'
+++++++++AXTextField AXDescription='Password'

diff --git a/chrome/test/data/pdf/accessibility/text_fields-expected-uia-win.txt b/chrome/test/data/pdf/accessibility/text_fields-expected-uia-win.txt
new file mode 100644
index 0000000..128af85f
--- /dev/null
+++ b/chrome/test/data/pdf/accessibility/text_fields-expected-uia-win.txt

@@ -0,0 +1,17 @@
+Pane
+++Document Name='PDF document containing 1 page'
+++++Group Name='Page 1'
+++++++Group IsControlElement=false
+++++++++Text Name='Test Form<newline>'
+++++++Group IsControlElement=false
+++++++++Text Name='Read Only:<newline>'
+++++++Group IsControlElement=false
+++++++++Text Name='Sample Text<newline>'
+++++++Group IsControlElement=false
+++++++++Text Name='*required field<newline>'
+++++++Group IsControlElement=false
+++++++++Text Name='Password:'
+++++++++Edit Name='Text Box' Value.Value='Text'
+++++++++Edit Name='ReadOnly' Value.Value='Elephant'
+++++++++Edit Name='Required' IsRequiredForForm=true Value.Value='Required Field'
+++++++++Edit Name='Password' IsPassword=true

diff --git a/chrome/test/data/pdf/accessibility/text_fields-expected-win.txt b/chrome/test/data/pdf/accessibility/text_fields-expected-win.txt
new file mode 100644
index 0000000..7cd6a352
--- /dev/null
+++ b/chrome/test/data/pdf/accessibility/text_fields-expected-win.txt

@@ -0,0 +1,17 @@
+IA2_ROLE_SECTION UNAVAILABLE FOCUSABLE
+++ROLE_SYSTEM_DOCUMENT name='PDF document containing 1 page' READONLY FOCUSABLE
+++++IA2_ROLE_LANDMARK name='Page 1' READONLY
+++++++IA2_ROLE_PARAGRAPH READONLY
+++++++++ROLE_SYSTEM_STATICTEXT name='Test Form<newline>' READONLY
+++++++IA2_ROLE_PARAGRAPH READONLY
+++++++++ROLE_SYSTEM_STATICTEXT name='Read Only:<newline>' READONLY
+++++++IA2_ROLE_PARAGRAPH READONLY
+++++++++ROLE_SYSTEM_STATICTEXT name='Sample Text<newline>' READONLY
+++++++IA2_ROLE_PARAGRAPH READONLY
+++++++++ROLE_SYSTEM_STATICTEXT name='*required field<newline>' READONLY
+++++++IA2_ROLE_PARAGRAPH READONLY
+++++++++ROLE_SYSTEM_STATICTEXT name='Password:' READONLY
+++++++++ROLE_SYSTEM_TEXT name='Text Box' value='Text' FOCUSABLE
+++++++++ROLE_SYSTEM_TEXT name='ReadOnly' value='Elephant' READONLY FOCUSABLE
+++++++++ROLE_SYSTEM_TEXT name='Required' value='Required Field' FOCUSABLE IA2_STATE_REQUIRED
+++++++++ROLE_SYSTEM_TEXT name='Password' FOCUSABLE PROTECTED

diff --git a/chrome/test/data/pdf/accessibility/text_fields-expected.txt b/chrome/test/data/pdf/accessibility/text_fields-expected.txt
new file mode 100644
index 0000000..404c7998
--- /dev/null
+++ b/chrome/test/data/pdf/accessibility/text_fields-expected.txt

@@ -0,0 +1,9 @@
+Test Form
+¶
+Read Only:
+¶
+Sample Text
+¶
+*required field
+¶
+Password:

diff --git a/chrome/test/data/pdf/accessibility/text_fields.in b/chrome/test/data/pdf/accessibility/text_fields.in
new file mode 100644
index 0000000..120c6a3
--- /dev/null
+++ b/chrome/test/data/pdf/accessibility/text_fields.in

@@ -0,0 +1,105 @@
+{{header}}
+{{object 1 0}} <<
+  /Type /Catalog
+  /Pages 2 0 R
+  /AcroForm <<
+    /Fields [ 7 0 R 8 0 R 9 0 R 10 0 R ]
+    /DR 4 0 R
+  >>
+>>
+endobj
+{{object 2 0}} <<
+  /Count 1
+  /Kids [ 3 0 R ]
+  /Type /Pages
+>>
+endobj
+{{object 3 0}} <<
+  /Type /Page
+  /Parent 2 0 R
+  /Resources 4 0 R
+  /MediaBox [ 0 0 300 300 ]
+  /Contents 6 0 R
+  /Annots [ 7 0 R 8 0 R 9 0 R 10 0 R ]
+>>
+endobj
+{{object 4 0}} <<
+  /Font <<
+    /F1 5 0 R
+  >>
+>>
+endobj
+{{object 5 0}} <<
+  /Type /Font
+  /Subtype /Type1
+  /BaseFont /Helvetica
+>>
+endobj
+{{object 6 0}} <<
+  {{streamlen}}
+>>
+stream
+BT
+/F1 12 Tf
+100 200 Td
+(Test Form) Tj
+/F1 12 Tf
+-80 -40 Td
+(Read Only:) Tj
+/F1 12 Tf
+0 -50 Td
+(Sample Text) Tj
+/F1 12 Tf
+200 -55 Td
+(*required field) Tj
+/F1 12 Tf
+-200 -35 Td
+(Password:) Tj
+ET
+endstream
+endobj
+{{object 7 0}} <<
+  /Type /Annot
+  /Subtype /Widget
+  /FT /Tx
+  /T (Text Box)
+  /V (Text)
+  /DA (0 0 0 rg /F1 12 Tf)
+  /Rect [ 100 100 200 130 ]
+>>
+endobj
+{{object 8 0}} <<
+  /Type /Annot
+  /Subtype /Widget
+  /FT /Tx
+  /Ff 1
+  /T (ReadOnly)
+  /V (Elephant)
+  /DA (0 0 0 rg /F1 12 Tf)
+  /Rect [ 100 150 200 180 ]
+>>
+endobj
+{{object 9 0}} <<
+  /Type /Annot
+  /Subtype /Widget
+  /FT /Tx
+  /Ff 2
+  /T (Required)
+  /V (Required Field)
+  /DA (0 0 0 rg /F1 12 Tf)
+  /Rect [ 100 50 200 75 ]
+>>
+{{object 10 0}} <<
+  /Type /Annot
+  /Subtype /Widget
+  /FT /Tx
+  /Ff 8192
+  /T (Password)
+  /DA (0 0 0 rg /F1 12 Tf)
+  /Rect [ 100 10 200 35 ]
+>>
+endobj
+{{xref}}
+{{trailer}}
+{{startxref}}
+%%EOF

diff --git a/chrome/test/data/pdf/accessibility/text_fields.pdf b/chrome/test/data/pdf/accessibility/text_fields.pdf
new file mode 100644
index 0000000..1217ca09
--- /dev/null
+++ b/chrome/test/data/pdf/accessibility/text_fields.pdf

@@ -0,0 +1,122 @@
+%PDF-1.7
+% ò¤ô
+1 0 obj <<
+  /Type /Catalog
+  /Pages 2 0 R
+  /AcroForm <<
+    /Fields [ 7 0 R 8 0 R 9 0 R 10 0 R ]
+    /DR 4 0 R
+  >>
+>>
+endobj
+2 0 obj <<
+  /Count 1
+  /Kids [ 3 0 R ]
+  /Type /Pages
+>>
+endobj
+3 0 obj <<
+  /Type /Page
+  /Parent 2 0 R
+  /Resources 4 0 R
+  /MediaBox [ 0 0 300 300 ]
+  /Contents 6 0 R
+  /Annots [ 7 0 R 8 0 R 9 0 R 10 0 R ]
+>>
+endobj
+4 0 obj <<
+  /Font <<
+    /F1 5 0 R
+  >>
+>>
+endobj
+5 0 obj <<
+  /Type /Font
+  /Subtype /Type1
+  /BaseFont /Helvetica
+>>
+endobj
+6 0 obj <<
+  /Length 194
+>>
+stream
+BT
+/F1 12 Tf
+100 200 Td
+(Test Form) Tj
+/F1 12 Tf
+-80 -40 Td
+(Read Only:) Tj
+/F1 12 Tf
+0 -50 Td
+(Sample Text) Tj
+/F1 12 Tf
+200 -55 Td
+(*required field) Tj
+/F1 12 Tf
+-200 -35 Td
+(Password:) Tj
+ET
+endstream
+endobj
+7 0 obj <<
+  /Type /Annot
+  /Subtype /Widget
+  /FT /Tx
+  /T (Text Box)
+  /V (Text)
+  /DA (0 0 0 rg /F1 12 Tf)
+  /Rect [ 100 100 200 130 ]
+>>
+endobj
+8 0 obj <<
+  /Type /Annot
+  /Subtype /Widget
+  /FT /Tx
+  /Ff 1
+  /T (ReadOnly)
+  /V (Elephant)
+  /DA (0 0 0 rg /F1 12 Tf)
+  /Rect [ 100 150 200 180 ]
+>>
+endobj
+9 0 obj <<
+  /Type /Annot
+  /Subtype /Widget
+  /FT /Tx
+  /Ff 2
+  /T (Required)
+  /V (Required Field)
+  /DA (0 0 0 rg /F1 12 Tf)
+  /Rect [ 100 50 200 75 ]
+>>
+10 0 obj <<
+  /Type /Annot
+  /Subtype /Widget
+  /FT /Tx
+  /Ff 8192
+  /T (Password)
+  /DA (0 0 0 rg /F1 12 Tf)
+  /Rect [ 100 10 200 35 ]
+>>
+endobj
+xref
+0 11
+0000000000 65535 f 
+0000000015 00000 n 
+0000000143 00000 n 
+0000000208 00000 n 
+0000000363 00000 n 
+0000000414 00000 n 
+0000000490 00000 n 
+0000000736 00000 n 
+0000000884 00000 n 
+0000001044 00000 n 
+0000001201 00000 n 
+trailer <<
+  /Root 1 0 R
+  /Size 11
+>>
+startxref
+1347
+%%EOF

diff --git a/chrome/test/data/policy/policy_test_cases.json b/chrome/test/data/policy/policy_test_cases.json
index b470957..d6f411c 100644
--- a/chrome/test/data/policy/policy_test_cases.json
+++ b/chrome/test/data/policy/policy_test_cases.json

@@ -403,16 +403,6 @@
     ]
   },
 
-  "PrintingAllowedPageSizes": {
-    "os": ["chromeos"],
-    "policy_pref_mapping_test": [
-      {
-        "policies": { "PrintingAllowedPageSizes": [{ "WidthUm": 210000, "HeightUm": 297000 }] },
-        "prefs": { "printing.allowed_page_sizes": {} }
-      }
-    ]
-  },
-
   "PrintingColorDefault": {
     "os": ["chromeos"],
     "policy_pref_mapping_test": [

diff --git a/chrome/test/data/webui/new_tab_page/app_test.js b/chrome/test/data/webui/new_tab_page/app_test.js
index e25f6295..4e50920 100644
--- a/chrome/test/data/webui/new_tab_page/app_test.js
+++ b/chrome/test/data/webui/new_tab_page/app_test.js

@@ -222,4 +222,38 @@
         'background_image?https://example.com/image.png',
         app.$.backgroundImage.path);
   });
+
+  test('theme update when dialog closed clears selection', async () => {
+    const theme = createTheme();
+    theme.backgroundImageUrl = {url: 'https://example.com/image.png'};
+    testProxy.callbackRouterRemote.setTheme(theme);
+    await testProxy.callbackRouterRemote.$.flushForTesting();
+    assertEquals(
+        'background_image?https://example.com/image.png',
+        app.$.backgroundImage.path);
+    app.$.customizeButton.click();
+    await flushTasks();
+    const dialog = app.shadowRoot.querySelector('ntp-customize-dialog');
+    dialog.backgroundSelection = {
+      type: BackgroundSelectionType.IMAGE,
+      image: {
+        attribution1: '1',
+        attribution2: '2',
+        attributionUrl: {url: 'https://example.com'},
+        imageUrl: {url: 'https://example.com/other.png'},
+      },
+    };
+    assertEquals(
+        'background_image?https://example.com/other.png',
+        app.$.backgroundImage.path);
+    dialog.dispatchEvent(new Event('close'));
+    assertEquals(
+        'background_image?https://example.com/other.png',
+        app.$.backgroundImage.path);
+    testProxy.callbackRouterRemote.setTheme(theme);
+    await testProxy.callbackRouterRemote.$.flushForTesting();
+    assertEquals(
+        'background_image?https://example.com/image.png',
+        app.$.backgroundImage.path);
+  });
 });

diff --git a/chrome/test/data/webui/new_tab_page/customize_dialog_test.js b/chrome/test/data/webui/new_tab_page/customize_dialog_test.js
index 84e518f..f129bae 100644
--- a/chrome/test/data/webui/new_tab_page/customize_dialog_test.js
+++ b/chrome/test/data/webui/new_tab_page/customize_dialog_test.js

@@ -145,6 +145,22 @@
       assertFalse(customizeDialog.$.refreshToggle.checked);
     });
 
+    test('clicking cancel', () => {
+      customizeDialog.backgroundSelection = {
+        type: BackgroundSelectionType.IMAGE,
+        image: {
+          attribution1: '1',
+          attribution2: '2',
+          attributionUrl: {url: 'https://example.com'},
+          imageUrl: {url: 'https://example.com/other.png'}
+        },
+      };
+      customizeDialog.shadowRoot.querySelector('.cancel-button').click();
+      assertDeepEquals(
+          {type: BackgroundSelectionType.NO_SELECTION},
+          customizeDialog.backgroundSelection);
+    });
+
     suite('clicking done', () => {
       function done() {
         customizeDialog.shadowRoot.querySelector('.action-button').click();
@@ -168,7 +184,15 @@
         assertEquals('https://example.com', attributionUrl.url);
         assertEquals('https://example.com/other.png', imageUrl.url);
         assertDeepEquals(
-            {type: BackgroundSelectionType.NO_SELECTION},
+            {
+              type: BackgroundSelectionType.IMAGE,
+              image: {
+                attribution1: '1',
+                attribution2: '2',
+                attributionUrl: {url: 'https://example.com'},
+                imageUrl: {url: 'https://example.com/other.png'}
+              },
+            },
             customizeDialog.backgroundSelection);
       });
 
@@ -180,7 +204,10 @@
             'abstract',
             await testProxy.handler.whenCalled('setDailyRefreshCollectionId'));
         assertDeepEquals(
-            {type: BackgroundSelectionType.NO_SELECTION},
+            {
+              type: BackgroundSelectionType.DAILY_REFRESH,
+              dailyRefreshCollectionId: 'abstract',
+            },
             customizeDialog.backgroundSelection);
       });
 
@@ -189,19 +216,16 @@
         customizeDialog.$.refreshToggle.click();
         done();
         await testProxy.handler.whenCalled('setNoBackgroundImage');
-        assertDeepEquals(
-            {type: BackgroundSelectionType.NO_SELECTION},
-            customizeDialog.backgroundSelection);
       });
 
       test('set no background', async () => {
         customizeDialog.backgroundSelection = {
-          type: BackgroundSelectionType.NO_BACKGROUND
+          type: BackgroundSelectionType.NO_BACKGROUND,
         };
         done();
         await testProxy.handler.whenCalled('setNoBackgroundImage');
         assertDeepEquals(
-            {type: BackgroundSelectionType.NO_SELECTION},
+            {type: BackgroundSelectionType.NO_BACKGROUND},
             customizeDialog.backgroundSelection);
       });
     });

diff --git a/chrome/test/data/webui/new_tab_page/doodle_share_dialog_focus_test.js b/chrome/test/data/webui/new_tab_page/doodle_share_dialog_focus_test.js
new file mode 100644
index 0000000..792d9550
--- /dev/null
+++ b/chrome/test/data/webui/new_tab_page/doodle_share_dialog_focus_test.js

@@ -0,0 +1,41 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+import 'chrome://new-tab-page/doodle_share_dialog.js';
+
+import {BrowserProxy} from 'chrome://new-tab-page/browser_proxy.js';
+import {createTestProxy} from 'chrome://test/new_tab_page/test_support.js';
+
+suite('NewTabPageDoodleShareDialogFocusTest', () => {
+  /** @type {!DoodleShareDialogElement} */
+  let doodleShareDialog;
+
+  /**
+   * @implements {BrowserProxy}
+   * @extends {TestBrowserProxy}
+   */
+  let testProxy;
+
+  setup(() => {
+    PolymerTest.clearBody();
+
+    testProxy = createTestProxy();
+    BrowserProxy.instance_ = testProxy;
+
+    doodleShareDialog = document.createElement('ntp-doodle-share-dialog');
+    document.body.appendChild(doodleShareDialog);
+  });
+
+  test('clicking copy copies URL', async () => {
+    // Arrange.
+    doodleShareDialog.url = {url: 'https://bar.com'};
+
+    // Act.
+    doodleShareDialog.$.copyButton.click();
+
+    // Assert.
+    const text = await navigator.clipboard.readText();
+    assertEquals(text, 'https://bar.com');
+  });
+});

diff --git a/chrome/test/data/webui/new_tab_page/doodle_share_dialog_test.js b/chrome/test/data/webui/new_tab_page/doodle_share_dialog_test.js
new file mode 100644
index 0000000..399cf7b
--- /dev/null
+++ b/chrome/test/data/webui/new_tab_page/doodle_share_dialog_test.js

@@ -0,0 +1,99 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+import 'chrome://new-tab-page/doodle_share_dialog.js';
+
+import {BrowserProxy} from 'chrome://new-tab-page/browser_proxy.js';
+import {createTestProxy} from 'chrome://test/new_tab_page/test_support.js';
+
+suite('NewTabPageDoodleShareDialogTest', () => {
+  /** @type {!DoodleShareDialogElement} */
+  let doodleShareDialog;
+
+  /**
+   * @implements {BrowserProxy}
+   * @extends {TestBrowserProxy}
+   */
+  let testProxy;
+
+  setup(() => {
+    PolymerTest.clearBody();
+
+    testProxy = createTestProxy();
+    BrowserProxy.instance_ = testProxy;
+
+    doodleShareDialog = document.createElement('ntp-doodle-share-dialog');
+    document.body.appendChild(doodleShareDialog);
+  });
+
+  test('creating doodle share dialog opens cr dialog', () => {
+    // Assert.
+    assertTrue(doodleShareDialog.$.dialog.open);
+  });
+
+  test('setting title, url shows title, url', () => {
+    // Act.
+    doodleShareDialog.title = 'foo';
+    doodleShareDialog.url = {url: 'https://bar.com'};
+
+    // Assert.
+    assertEquals(doodleShareDialog.$.title.innerText, 'foo');
+    assertEquals(doodleShareDialog.$.url.value, 'https://bar.com');
+  });
+
+  const testParams = [
+    {
+      label: 'Facebook',
+      buttonId: 'facebookButton',
+      url: 'https://www.facebook.com/dialog/share' +
+          '?app_id=738026486351791' +
+          `&href=${encodeURIComponent('https://bar.com')}` +
+          `&hashtag=${encodeURIComponent('#GoogleDoodle')}`,
+    },
+    {
+      label: 'Twitter',
+      buttonId: 'twitterButton',
+      url: 'https://twitter.com/intent/tweet' +
+          `?text=${encodeURIComponent('foo\nhttps://bar.com')}`,
+    },
+  ];
+
+  testParams.forEach(({label, buttonId, url}) => {
+    test(`clicking ${label} opens ${label}`, async () => {
+      // Arrange.
+      doodleShareDialog.title = 'foo';
+      doodleShareDialog.url = {url: 'https://bar.com'};
+
+      // Act.
+      doodleShareDialog.$[buttonId].click();
+
+      // Assert.
+      const openedUrl = await testProxy.whenCalled('open');
+      assertEquals(openedUrl, url);
+    });
+  });
+
+  test(`clicking email navigates to email`, async () => {
+    // Arrange.
+    doodleShareDialog.title = 'foo';
+    doodleShareDialog.url = {url: 'https://bar.com'};
+
+    // Act.
+    doodleShareDialog.$.emailButton.click();
+
+    // Assert.
+    const navigateUrl = await testProxy.whenCalled('navigate');
+    assertEquals(
+        navigateUrl,
+        `mailto:?subject=foo&body=${encodeURIComponent('https://bar.com')}`);
+  });
+
+  test('clicking done closes dialog', async () => {
+    // Act.
+    doodleShareDialog.$.doneButton.click();
+
+    // Assert.
+    assertFalse(doodleShareDialog.$.dialog.open);
+  });
+});

diff --git a/chrome/test/data/webui/new_tab_page/logo_test.js b/chrome/test/data/webui/new_tab_page/logo_test.js
index 1be5b4f8..0121edc 100644
--- a/chrome/test/data/webui/new_tab_page/logo_test.js
+++ b/chrome/test/data/webui/new_tab_page/logo_test.js

@@ -8,6 +8,27 @@
 import {assertNotStyle, assertStyle, createTestProxy, keydown} from 'chrome://test/new_tab_page/test_support.js';
 import {eventToPromise, flushTasks} from 'chrome://test/test_util.m.js';
 
+function createImageDoodle(config = {}) {
+  const doodle = {
+    content: {
+      imageDoodle: {
+        imageUrl: {url: config.imageUrl || 'data:foo'},
+        onClickUrl: {url: config.onClickUrl || 'https://foo.com'},
+        shareButton: {
+          backgroundColor: {value: config.backgroundColor || 0xFFFF0000},
+          x: config.x || 0,
+          y: config.y || 0,
+          iconUrl: {url: config.iconUrl || 'data:bar'},
+        },
+      }
+    }
+  };
+  if (config.animationUrl) {
+    doodle.content.imageDoodle.animationUrl = {url: config.animationUrl};
+  }
+  return doodle;
+}
+
 suite('NewTabPageLogoTest', () => {
   /**
    * @implements {BrowserProxy}
@@ -34,19 +55,13 @@
 
   test('setting simple doodle shows image', async () => {
     // Act.
-    const logo = await createLogo({
-      content: {
-        imageDoodle: {
-          imageUrl: {url: 'data:foo'},
-          shareButton: {
-            backgroundColor: {value: 0xFFFF0000},
-            x: 11,
-            y: 12,
-            iconUrl: {url: 'data:bar'},
-          },
-        }
-      }
-    });
+    const logo = await createLogo(createImageDoodle({
+      imageUrl: 'data:foo',
+      backgroundColor: 0xFFFF0000,
+      x: 11,
+      y: 12,
+      iconUrl: 'data:bar',
+    }));
 
     // Assert.
     assertNotStyle(logo.$.doodle, 'display', 'none');
@@ -64,14 +79,10 @@
 
   test('setting animated doodle shows image', async () => {
     // Act.
-    const logo = await createLogo({
-      content: {
-        imageDoodle: {
-          imageUrl: {url: 'data:foo'},
-          animationUrl: {url: 'https://foo.com'},
-        }
-      }
-    });
+    const logo = await createLogo(createImageDoodle({
+      imageUrl: 'data:foo',
+      animationUrl: 'https://foo.com',
+    }));
 
     // Assert.
     assertNotStyle(logo.$.doodle, 'display', 'none');
@@ -96,7 +107,7 @@
 
   test('disallowing doodle shows logo', async () => {
     // Act.
-    const logo = await await createLogo({content: {image: 'data:foo'}});
+    const logo = await createLogo(createImageDoodle());
     logo.doodleAllowed = false;
 
     // Assert.
@@ -201,14 +212,10 @@
 
   test('clicking simple doodle opens link', async () => {
     // Arrange.
-    const logo = await createLogo({
-      content: {
-        imageDoodle: {
-          imageUrl: {url: 'data:foo'},
-          onClickUrl: {url: 'https://foo.com'},
-        }
-      }
-    });
+    const logo = await createLogo(createImageDoodle({
+      imageUrl: 'data:foo',
+      onClickUrl: 'https://foo.com',
+    }));
 
     // Act.
     logo.$.image.click();
@@ -241,14 +248,10 @@
 
   test('clicking image of animated doodle starts animation', async () => {
     // Arrange.
-    const logo = await createLogo({
-      content: {
-        imageDoodle: {
-          imageUrl: {url: 'data:foo'},
-          animationUrl: {url: 'https://foo.com'},
-        }
-      }
-    });
+    const logo = await createLogo(createImageDoodle({
+      imageUrl: 'data:foo',
+      animationUrl: 'https://foo.com',
+    }));
 
     // Act.
     logo.$.image.click();
@@ -262,15 +265,11 @@
 
   test('clicking animation of animated doodle opens link', async () => {
     // Arrange.
-    const logo = await createLogo({
-      content: {
-        imageDoodle: {
-          imageUrl: {url: 'data:foo'},
-          animationUrl: {url: 'https://foo.com'},
-          onClickUrl: {url: 'https://bar.com'},
-        }
-      }
-    });
+    const logo = await createLogo(createImageDoodle({
+      imageUrl: 'data:foo',
+      animationUrl: 'https://foo.com',
+      onClickUrl: 'https://bar.com',
+    }));
     logo.$.image.click();
 
     // Act.
@@ -280,4 +279,39 @@
     // Assert.
     assertEquals(url, 'https://bar.com');
   });
+
+  test('share dialog removed on start', async () => {
+    // Arrange.
+    const logo = await createLogo(createImageDoodle());
+
+    // Assert.
+    assertFalse(!!logo.shadowRoot.querySelector('ntp-doodle-share-dialog'));
+  });
+
+  test('clicking share button adds share dialog', async () => {
+    // Arrange.
+    const logo = await createLogo(createImageDoodle());
+
+    // Act.
+    logo.$.shareButton.click();
+    await flushTasks();
+
+    // Assert.
+    assertTrue(!!logo.shadowRoot.querySelector('ntp-doodle-share-dialog'));
+  });
+
+  test('closing share dialog removes share dialog', async () => {
+    // Arrange.
+    const logo = await createLogo(createImageDoodle());
+    logo.$.shareButton.click();
+    await flushTasks();
+
+    // Act.
+    logo.shadowRoot.querySelector('ntp-doodle-share-dialog')
+        .dispatchEvent(new Event('close'));
+    await flushTasks();
+
+    // Assert.
+    assertFalse(!!logo.shadowRoot.querySelector('ntp-doodle-share-dialog'));
+  });
 });

diff --git a/chrome/test/data/webui/new_tab_page/new_tab_page_browsertest.js b/chrome/test/data/webui/new_tab_page/new_tab_page_browsertest.js
index 84a2abc..88ec9c4 100644
--- a/chrome/test/data/webui/new_tab_page/new_tab_page_browsertest.js
+++ b/chrome/test/data/webui/new_tab_page/new_tab_page_browsertest.js

@@ -158,3 +158,15 @@
 TEST_F('NewTabPageLogoTest', 'All', function() {
   mocha.run();
 });
+
+// eslint-disable-next-line no-var
+var NewTabPageDoodleShareDialogTest = class extends NewTabPageBrowserTest {
+  /** @override */
+  get browsePreload() {
+    return 'chrome://new-tab-page/test_loader.html?module=new_tab_page/doodle_share_dialog_test.js';
+  }
+};
+
+TEST_F('NewTabPageDoodleShareDialogTest', 'All', function() {
+  mocha.run();
+});

diff --git a/chrome/test/data/webui/new_tab_page/new_tab_page_interactive_test.js b/chrome/test/data/webui/new_tab_page/new_tab_page_interactive_test.js
index a5f19ea1..ab4952c0 100644
--- a/chrome/test/data/webui/new_tab_page/new_tab_page_interactive_test.js
+++ b/chrome/test/data/webui/new_tab_page/new_tab_page_interactive_test.js

@@ -63,3 +63,16 @@
 TEST_F('NewTabPageGridFocusTest', 'All', function() {
   mocha.run();
 });
+
+// eslint-disable-next-line no-var
+var NewTabPageDoodleShareDialogFocusTest =
+    class extends NewTabPageInteractiveTest {
+  /** @override */
+  get browsePreload() {
+    return 'chrome://new-tab-page/test_loader.html?module=new_tab_page/doodle_share_dialog_focus_test.js';
+  }
+};
+
+TEST_F('NewTabPageDoodleShareDialogFocusTest', 'All', function() {
+  mocha.run();
+});

diff --git a/chromeos/services/assistant/public/mojom/assistant.mojom b/chromeos/services/assistant/public/mojom/assistant.mojom
index b0fa0e1..5cb5ca144 100644
--- a/chromeos/services/assistant/public/mojom/assistant.mojom
+++ b/chromeos/services/assistant/public/mojom/assistant.mojom

@@ -69,6 +69,9 @@
 };
 
 // Interface to communicate with assistant backend.
+// The Assistant instance is held by chromeos::assistant::Service, which is
+// hosted in the browser process.
+// The callers are mostly in ash, and some are in autotest.
 interface Assistant {
   // Starts an interaction to edit the reminder uniquely identified by
   // |client_id|. In response to the request, LibAssistant will initiate
@@ -79,6 +82,7 @@
   // Starts a screen context interaction. Results related to the screen context
   // will be returned through the |AssistantInteractionSubscriber| interface to
   // registered subscribers.
+  // |assistant_screenshot| contains JPEG data.
   StartScreenContextInteraction(
       ax.mojom.AssistantStructure? assistant_structure,
       array<uint8> assistant_screenshot);

diff --git a/components/autofill/android/form_data_android.cc b/components/autofill/android/form_data_android.cc
index 6746368..c91a0c6 100644
--- a/components/autofill/android/form_data_android.cc
+++ b/components/autofill/android/form_data_android.cc

@@ -26,14 +26,7 @@
     field.bounds = callback.Run(field.bounds);
 }
 
-FormDataAndroid::~FormDataAndroid() {
-  JNIEnv* env = AttachCurrentThread();
-  ScopedJavaLocalRef<jobject> obj = java_ref_.get(env);
-  if (obj.is_null())
-    return;
-
-  Java_FormData_onNativeDestroyed(env, obj);
-}
+FormDataAndroid::~FormDataAndroid() = default;
 
 ScopedJavaLocalRef<jobject> FormDataAndroid::GetJavaPeer(
     const FormStructure* form_structure) {
@@ -65,9 +58,7 @@
   return form_;
 }
 
-ScopedJavaLocalRef<jobject> FormDataAndroid::GetNextFormFieldData(
-    JNIEnv* env,
-    const JavaParamRef<jobject>& jcaller) {
+ScopedJavaLocalRef<jobject> FormDataAndroid::GetNextFormFieldData(JNIEnv* env) {
   DCHECK(index_ <= fields_.size());
   if (index_ == fields_.size())
     return ScopedJavaLocalRef<jobject>();

diff --git a/components/autofill/android/form_data_android.h b/components/autofill/android/form_data_android.h
index bc612708..a2b33c8 100644
--- a/components/autofill/android/form_data_android.h
+++ b/components/autofill/android/form_data_android.h

@@ -33,9 +33,7 @@
   // Get autofill values from Java side and return FormData.
   const FormData& GetAutofillValues();
 
-  base::android::ScopedJavaLocalRef<jobject> GetNextFormFieldData(
-      JNIEnv* env,
-      const base::android::JavaParamRef<jobject>& jcaller);
+  base::android::ScopedJavaLocalRef<jobject> GetNextFormFieldData(JNIEnv* env);
 
   // Get index of given field, return True and index of focus field if found.
   bool GetFieldIndex(const FormFieldData& field, size_t* index);

diff --git a/components/autofill/android/java/src/org/chromium/components/autofill/FormData.java b/components/autofill/android/java/src/org/chromium/components/autofill/FormData.java
index 5c4db2d..23e5fed 100644
--- a/components/autofill/android/java/src/org/chromium/components/autofill/FormData.java
+++ b/components/autofill/android/java/src/org/chromium/components/autofill/FormData.java

@@ -19,39 +19,35 @@
     public final String mHost;
     public final ArrayList<FormFieldData> mFields;
 
-    private long mNativeObj;
-
     @CalledByNative
     private static FormData createFormData(
             long nativeObj, String name, String origin, int fieldCount) {
         return new FormData(nativeObj, name, origin, fieldCount);
     }
 
-    private FormData(long nativeObj, String name, String host, int fieldCount) {
-        mNativeObj = nativeObj;
+    private static ArrayList<FormFieldData> popupFormFields(long nativeObj, int fieldCount) {
+        FormFieldData formFieldData = FormDataJni.get().getNextFormFieldData(nativeObj);
+        ArrayList<FormFieldData> fields = new ArrayList<FormFieldData>(fieldCount);
+        while (formFieldData != null) {
+            fields.add(formFieldData);
+            formFieldData = FormDataJni.get().getNextFormFieldData(nativeObj);
+        }
+        assert fields.size() == fieldCount;
+        return fields;
+    }
+
+    private FormData(String name, String host, ArrayList<FormFieldData> fields) {
         mName = name;
         mHost = host;
-        mFields = new ArrayList<FormFieldData>(fieldCount);
-        popupFormFields(fieldCount);
+        mFields = fields;
     }
 
-    private void popupFormFields(int fieldCount) {
-        FormFieldData formFieldData =
-                FormDataJni.get().getNextFormFieldData(mNativeObj, FormData.this);
-        while (formFieldData != null) {
-            mFields.add(formFieldData);
-            formFieldData = FormDataJni.get().getNextFormFieldData(mNativeObj, FormData.this);
-        }
-        assert mFields.size() == fieldCount;
-    }
-
-    @CalledByNative
-    private void onNativeDestroyed() {
-        mNativeObj = 0;
+    private FormData(long nativeObj, String name, String host, int fieldCount) {
+        this(name, host, popupFormFields(nativeObj, fieldCount));
     }
 
     @NativeMethods
     interface Natives {
-        FormFieldData getNextFormFieldData(long nativeFormDataAndroid, FormData caller);
+        FormFieldData getNextFormFieldData(long nativeFormDataAndroid);
     }
 }

diff --git a/components/autofill/core/common/password_form.h b/components/autofill/core/common/password_form.h
index f6a0dc6..d11a279 100644
--- a/components/autofill/core/common/password_form.h
+++ b/components/autofill/core/common/password_form.h

@@ -173,6 +173,11 @@
   // When parsing an HTML form, this is typically empty.
   base::string16 password_value;
 
+  // The current encrypted password. Must be non-empty for PasswordForm
+  // instances retrieved from the password store or coming in a
+  // PasswordStoreChange that is not of type REMOVE.
+  std::string encrypted_password;
+
   // If the form was a sign-up or a change password form, the name of the input
   // element corresponding to the new password. Optional, and not persisted.
   base::string16 new_password_element;

diff --git a/components/browser_ui/widget/android/java/src/org/chromium/components/browser_ui/widget/RoundedCornerImageView.java b/components/browser_ui/widget/android/java/src/org/chromium/components/browser_ui/widget/RoundedCornerImageView.java
index ca6bc96e..cb39519 100644
--- a/components/browser_ui/widget/android/java/src/org/chromium/components/browser_ui/widget/RoundedCornerImageView.java
+++ b/components/browser_ui/widget/android/java/src/org/chromium/components/browser_ui/widget/RoundedCornerImageView.java

@@ -162,7 +162,8 @@
         if (drawable instanceof ColorDrawable) {
             mRoundedBackgroundPaint.setColor(((ColorDrawable) getDrawable()).getColor());
             mRoundedContentPaint = null;
-        } else if (drawable instanceof BitmapDrawable) {
+        } else if (drawable instanceof BitmapDrawable
+                && ((BitmapDrawable) drawable).getBitmap() != null) {
             mRoundedBackgroundPaint.setColor(mFillColor);
             mRoundedContentPaint = new Paint(Paint.ANTI_ALIAS_FLAG);
 
@@ -210,7 +211,6 @@
             Shader shader = mRoundedContentPaint.getShader();
             if (shader != null) {
                 Drawable drawable = getDrawable();
-
                 Bitmap bitmap = ((BitmapDrawable) drawable).getBitmap();
                 mTmpMatrix.set(getImageMatrix());
                 mTmpMatrix.preScale((float) drawable.getIntrinsicWidth() / bitmap.getWidth(),

diff --git a/components/external_intents/android/BUILD.gn b/components/external_intents/android/BUILD.gn
index 702433e..21f28ac6 100644
--- a/components/external_intents/android/BUILD.gn
+++ b/components/external_intents/android/BUILD.gn

@@ -6,11 +6,13 @@
 
 android_library("java") {
   sources = [
+    "java/src/org/chromium/components/external_intents/AuthenticatorNavigationInterceptor.java",
     "java/src/org/chromium/components/external_intents/ExternalIntentsFeatureList.java",
     "java/src/org/chromium/components/external_intents/ExternalIntentsSwitches.java",
     "java/src/org/chromium/components/external_intents/ExternalNavigationDelegate.java",
     "java/src/org/chromium/components/external_intents/ExternalNavigationHandler.java",
     "java/src/org/chromium/components/external_intents/ExternalNavigationParams.java",
+    "java/src/org/chromium/components/external_intents/InterceptNavigationDelegateClient.java",
     "java/src/org/chromium/components/external_intents/RedirectHandler.java",
     "java/src/org/chromium/components/external_intents/RedirectHandlerImpl.java",
   ]

diff --git a/components/external_intents/android/java/src/org/chromium/components/external_intents/AuthenticatorNavigationInterceptor.java b/components/external_intents/android/java/src/org/chromium/components/external_intents/AuthenticatorNavigationInterceptor.java
new file mode 100644
index 0000000..57e59cd
--- /dev/null
+++ b/components/external_intents/android/java/src/org/chromium/components/external_intents/AuthenticatorNavigationInterceptor.java

@@ -0,0 +1,23 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+package org.chromium.components.external_intents;
+
+/**
+ * Handles intercepting navigation requests for an external authenticator application.
+ * NOTE: DO NOT CHANGE ANYTHING IN THIS INTERFACE. It needs to stay identical to the one in //chrome
+ * until downstream has been transitioned to use this one, at which point this comment will be
+ * eliminated.
+ */
+public interface AuthenticatorNavigationInterceptor {
+    /**
+     * To be called by a Tab to check whether the passed in URL, which is about to be loaded,
+     * should be processed by an external Authenticator application.
+     *
+     * @param url the URL about to be loaded in the tab
+     * @return True if the URL has been handled by the Authenticator, false if it hasn't and
+     *         should be processed normally by the Tab.
+     */
+    boolean handleAuthenticatorUrl(String url);
+}

diff --git a/components/external_intents/android/java/src/org/chromium/components/external_intents/InterceptNavigationDelegateClient.java b/components/external_intents/android/java/src/org/chromium/components/external_intents/InterceptNavigationDelegateClient.java
new file mode 100644
index 0000000..f18b6c3
--- /dev/null
+++ b/components/external_intents/android/java/src/org/chromium/components/external_intents/InterceptNavigationDelegateClient.java

@@ -0,0 +1,15 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+package org.chromium.components.external_intents;
+
+import org.chromium.content_public.browser.WebContents;
+
+/**
+ * An interface via which the embedder provides the context information that
+ * InterceptNavigationDelegateImpl needs.
+ */
+public interface InterceptNavigationDelegateClient {
+    WebContents getWebContents();
+}

diff --git a/components/ntp_tiles/features.cc b/components/ntp_tiles/features.cc
index 6096def..e3840f31 100644
--- a/components/ntp_tiles/features.cc
+++ b/components/ntp_tiles/features.cc

@@ -21,15 +21,7 @@
 const base::Feature kUsePopularSitesSuggestions{
     "UsePopularSitesSuggestions", base::FEATURE_ENABLED_BY_DEFAULT};
 
-const base::FeatureState kDisplaySuggestionsServiceTilesDefaultState =
-#if defined(OS_ANDROID) || defined(OS_IOS)
-    base::FEATURE_DISABLED_BY_DEFAULT;
-#else
-    base::FEATURE_ENABLED_BY_DEFAULT;
-#endif
-
 const base::Feature kDisplaySuggestionsServiceTiles{
-    "DisplaySuggestionsServiceTiles",
-    kDisplaySuggestionsServiceTilesDefaultState};
+    "DisplaySuggestionsServiceTiles", base::FEATURE_DISABLED_BY_DEFAULT};
 
 }  // namespace ntp_tiles

diff --git a/components/omnibox/browser/BUILD.gn b/components/omnibox/browser/BUILD.gn
index e6d53cc..7853187b 100644
--- a/components/omnibox/browser/BUILD.gn
+++ b/components/omnibox/browser/BUILD.gn

@@ -167,8 +167,8 @@
     "omnibox_popup_model.cc",
     "omnibox_popup_model.h",
     "omnibox_popup_view.h",
-    "omnibox_pref_names.cc",
-    "omnibox_pref_names.h",
+    "omnibox_prefs.cc",
+    "omnibox_prefs.h",
     "omnibox_view.cc",
     "omnibox_view.h",
     "on_device_head_model.cc",
@@ -451,6 +451,7 @@
     "omnibox_pedal_provider_unittest.cc",
     "omnibox_pedal_unittest.cc",
     "omnibox_popup_model_unittest.cc",
+    "omnibox_prefs_unittest.cc",
     "omnibox_view_unittest.cc",
     "on_device_head_model_unittest.cc",
     "on_device_head_provider_unittest.cc",

diff --git a/components/omnibox/browser/autocomplete_controller.cc b/components/omnibox/browser/autocomplete_controller.cc
index 08378fa..4fbe6e9 100644
--- a/components/omnibox/browser/autocomplete_controller.cc
+++ b/components/omnibox/browser/autocomplete_controller.cc

@@ -772,10 +772,11 @@
   for (AutocompleteMatch& match : *result) {
     if (match.suggestion_group_id.has_value()) {
       int group_id = match.suggestion_group_id.value();
-      match.RecordAdditionalInfo("suggestion_group_id", group_id);
-      match.RecordAdditionalInfo(
-          "header string",
-          base::UTF16ToUTF8(result->GetHeaderForGroupId(group_id)));
+      const base::string16 header = result->GetHeaderForGroupId(group_id);
+      if (!header.empty()) {
+        match.RecordAdditionalInfo("suggestion_group_id", group_id);
+        match.RecordAdditionalInfo("header string", base::UTF16ToUTF8(header));
+      }
     }
   }
 }

diff --git a/components/omnibox/browser/autocomplete_match.cc b/components/omnibox/browser/autocomplete_match.cc
index abb2750..8bc21e01 100644
--- a/components/omnibox/browser/autocomplete_match.cc
+++ b/components/omnibox/browser/autocomplete_match.cc

@@ -916,7 +916,6 @@
 void AutocompleteMatch::RecordAdditionalInfo(const std::string& property,
                                              const std::string& value) {
   DCHECK(!property.empty());
-  DCHECK(!value.empty());
   additional_info[property] = value;
 }
 

diff --git a/components/omnibox/browser/autocomplete_provider_unittest.cc b/components/omnibox/browser/autocomplete_provider_unittest.cc
index ad04c3aa..73159b0f 100644
--- a/components/omnibox/browser/autocomplete_provider_unittest.cc
+++ b/components/omnibox/browser/autocomplete_provider_unittest.cc

@@ -29,9 +29,11 @@
 #include "components/omnibox/browser/autocomplete_provider_listener.h"
 #include "components/omnibox/browser/keyword_provider.h"
 #include "components/omnibox/browser/mock_autocomplete_provider_client.h"
+#include "components/omnibox/browser/omnibox_prefs.h"
 #include "components/omnibox/browser/search_provider.h"
 #include "components/omnibox/browser/zero_suggest_provider.h"
 #include "components/open_from_clipboard/fake_clipboard_recent_content.h"
+#include "components/prefs/testing_pref_service.h"
 #include "components/search_engines/search_engines_switches.h"
 #include "components/search_engines/template_url.h"
 #include "components/search_engines/template_url_service.h"
@@ -327,6 +329,8 @@
     provider_headers_map = headers_map;
   }
 
+  TestingPrefServiceSimple* GetPrefs() { return &pref_service_; }
+
   AutocompleteResult result_;
 
  private:
@@ -336,6 +340,7 @@
   void ResetControllerWithType(int type);
 
   base::test::TaskEnvironment task_environment_;
+  TestingPrefServiceSimple pref_service_;
   std::unique_ptr<AutocompleteController> controller_;
   // Owned by |controller_|.
   AutocompleteProviderClientWithClosure* client_;

diff --git a/components/omnibox/browser/autocomplete_result.h b/components/omnibox/browser/autocomplete_result.h
index 27501e3..77395cf 100644
--- a/components/omnibox/browser/autocomplete_result.h
+++ b/components/omnibox/browser/autocomplete_result.h

@@ -250,6 +250,7 @@
 
   ACMatches matches_;
 
+  // The map of suggestion group IDs to headers.
   SearchSuggestionParser::HeadersMap headers_map_;
 
   DISALLOW_COPY_AND_ASSIGN(AutocompleteResult);

diff --git a/components/omnibox/browser/document_provider.cc b/components/omnibox/browser/document_provider.cc
index 29b6b7a..05b25d7 100644
--- a/components/omnibox/browser/document_provider.cc
+++ b/components/omnibox/browser/document_provider.cc

@@ -39,7 +39,7 @@
 #include "components/omnibox/browser/in_memory_url_index_types.h"
 #include "components/omnibox/browser/keyword_provider.h"
 #include "components/omnibox/browser/omnibox_field_trial.h"
-#include "components/omnibox/browser/omnibox_pref_names.h"
+#include "components/omnibox/browser/omnibox_prefs.h"
 #include "components/omnibox/browser/search_provider.h"
 #include "components/omnibox/common/omnibox_features.h"
 #include "components/pref_registry/pref_registry_syncable.h"

diff --git a/components/omnibox/browser/document_provider_unittest.cc b/components/omnibox/browser/document_provider_unittest.cc
index e310688..b3ec8d8 100644
--- a/components/omnibox/browser/document_provider_unittest.cc
+++ b/components/omnibox/browser/document_provider_unittest.cc

@@ -16,7 +16,7 @@
 #include "components/omnibox/browser/autocomplete_provider.h"
 #include "components/omnibox/browser/autocomplete_provider_listener.h"
 #include "components/omnibox/browser/mock_autocomplete_provider_client.h"
-#include "components/omnibox/browser/omnibox_pref_names.h"
+#include "components/omnibox/browser/omnibox_prefs.h"
 #include "components/omnibox/browser/test_scheme_classifier.h"
 #include "components/omnibox/common/omnibox_features.h"
 #include "components/prefs/pref_registry_simple.h"

diff --git a/components/omnibox/browser/local_history_zero_suggest_provider.cc b/components/omnibox/browser/local_history_zero_suggest_provider.cc
index 8350aa6..10569f5 100644
--- a/components/omnibox/browser/local_history_zero_suggest_provider.cc
+++ b/components/omnibox/browser/local_history_zero_suggest_provider.cc

@@ -27,7 +27,7 @@
 #include "components/omnibox/browser/autocomplete_result.h"
 #include "components/omnibox/browser/base_search_provider.h"
 #include "components/omnibox/browser/omnibox_field_trial.h"
-#include "components/omnibox/browser/omnibox_pref_names.h"
+#include "components/omnibox/browser/omnibox_prefs.h"
 #include "components/omnibox/common/omnibox_features.h"
 #include "components/search_engines/template_url_service.h"
 #include "url/gurl.h"

diff --git a/components/omnibox/browser/omnibox_pref_names.cc b/components/omnibox/browser/omnibox_pref_names.cc
deleted file mode 100644
index 9bc17f2..0000000
--- a/components/omnibox/browser/omnibox_pref_names.cc
+++ /dev/null

@@ -1,19 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "components/omnibox/browser/omnibox_pref_names.h"
-
-namespace omnibox {
-
-// A client-side toggle for document (Drive) suggestions.
-// Also gated by a feature and server-side Admin Panel controls.
-const char kDocumentSuggestEnabled[] = "documentsuggest.enabled";
-
-// A cache of zero suggest results using JSON serialized into a string.
-const char kZeroSuggestCachedResults[] = "zerosuggest.cachedresults";
-
-// Boolean that specifies whether to always show full URLs in the omnibox.
-const char kPreventUrlElisionsInOmnibox[] = "omnibox.prevent_url_elisions";
-
-}  // namespace omnibox

diff --git a/components/omnibox/browser/omnibox_pref_names.h b/components/omnibox/browser/omnibox_pref_names.h
deleted file mode 100644
index f8d3f7d..0000000
--- a/components/omnibox/browser/omnibox_pref_names.h
+++ /dev/null

@@ -1,19 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef COMPONENTS_OMNIBOX_BROWSER_OMNIBOX_PREF_NAMES_H_
-#define COMPONENTS_OMNIBOX_BROWSER_OMNIBOX_PREF_NAMES_H_
-
-namespace omnibox {
-
-// Alphabetical list of preference names specific to the omnibox component.
-// Keep alphabetized, and document each in the .cc file.
-
-extern const char kDocumentSuggestEnabled[];
-extern const char kZeroSuggestCachedResults[];
-extern const char kPreventUrlElisionsInOmnibox[];
-
-}  // namespace omnibox
-
-#endif  // COMPONENTS_OMNIBOX_BROWSER_OMNIBOX_PREF_NAMES_H_

diff --git a/components/omnibox/browser/omnibox_prefs.cc b/components/omnibox/browser/omnibox_prefs.cc
new file mode 100644
index 0000000..08bf529
--- /dev/null
+++ b/components/omnibox/browser/omnibox_prefs.cc

@@ -0,0 +1,54 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "components/omnibox/browser/omnibox_prefs.h"
+
+#include "base/logging.h"
+#include "base/stl_util.h"
+#include "base/values.h"
+#include "components/prefs/pref_registry_simple.h"
+#include "components/prefs/pref_service.h"
+#include "components/prefs/scoped_user_pref_update.h"
+
+namespace omnibox {
+
+// A client-side toggle for document (Drive) suggestions.
+// Also gated by a feature and server-side Admin Panel controls.
+const char kDocumentSuggestEnabled[] = "documentsuggest.enabled";
+
+// A list of suggestion group IDs for zero suggest that are not allowed to
+// appear in the results.
+const char kOmniboxHiddenGroupIds[] = "omnibox.hiddenGroupIds";
+
+// Boolean that specifies whether to always show full URLs in the omnibox.
+const char kPreventUrlElisionsInOmnibox[] = "omnibox.prevent_url_elisions";
+
+// A cache of zero suggest results using JSON serialized into a string.
+const char kZeroSuggestCachedResults[] = "zerosuggest.cachedresults";
+
+void RegisterProfilePrefs(PrefRegistrySimple* registry) {
+  registry->RegisterListPref(omnibox::kOmniboxHiddenGroupIds,
+                             base::Value(base::Value::Type::LIST));
+}
+
+bool IsSuggestionGroupIdHidden(PrefService* prefs, int suggestion_group_id) {
+  DCHECK(prefs);
+  const base::ListValue* group_id_values =
+      prefs->GetList(kOmniboxHiddenGroupIds);
+  return std::find(group_id_values->begin(), group_id_values->end(),
+                   base::Value(suggestion_group_id)) != group_id_values->end();
+}
+
+void ToggleSuggestionGroupIdVisibility(PrefService* prefs,
+                                       int suggestion_group_id) {
+  DCHECK(prefs);
+  ListPrefUpdate update(prefs, kOmniboxHiddenGroupIds);
+  if (IsSuggestionGroupIdHidden(prefs, suggestion_group_id)) {
+    update->EraseListValue(base::Value(suggestion_group_id));
+  } else {
+    update->Append(suggestion_group_id);
+  }
+}
+
+}  // namespace omnibox

diff --git a/components/omnibox/browser/omnibox_prefs.h b/components/omnibox/browser/omnibox_prefs.h
new file mode 100644
index 0000000..b710d50
--- /dev/null
+++ b/components/omnibox/browser/omnibox_prefs.h

@@ -0,0 +1,37 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef COMPONENTS_OMNIBOX_BROWSER_OMNIBOX_PREFS_H_
+#define COMPONENTS_OMNIBOX_BROWSER_OMNIBOX_PREFS_H_
+
+#include <vector>
+
+class PrefRegistrySimple;
+class PrefService;
+
+namespace omnibox {
+
+// Alphabetical list of preference names specific to the omnibox component.
+// Keep alphabetized, and document each in the .cc file.
+
+extern const char kDocumentSuggestEnabled[];
+extern const char kOmniboxHiddenGroupIds[];
+extern const char kPreventUrlElisionsInOmnibox[];
+extern const char kZeroSuggestCachedResults[];
+
+void RegisterProfilePrefs(PrefRegistrySimple* registry);
+
+// Returns whether the given suggestion group ID is allowed to appear in the
+// results.
+bool IsSuggestionGroupIdHidden(PrefService* prefs, int suggestion_group_id);
+
+// Allows suggestions with the given suggestion group ID to appear in the
+// results if they currently are not allowed to or prevents them from
+// appearing in the results if they are currently permitted to.
+void ToggleSuggestionGroupIdVisibility(PrefService* prefs,
+                                       int suggestion_group_id);
+
+}  // namespace omnibox
+
+#endif  // COMPONENTS_OMNIBOX_BROWSER_OMNIBOX_PREFS_H_

diff --git a/components/omnibox/browser/omnibox_prefs_unittest.cc b/components/omnibox/browser/omnibox_prefs_unittest.cc
new file mode 100644
index 0000000..090ed1f2
--- /dev/null
+++ b/components/omnibox/browser/omnibox_prefs_unittest.cc

@@ -0,0 +1,45 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "components/omnibox/browser/omnibox_prefs.h"
+#include "components/prefs/testing_pref_service.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+using omnibox::IsSuggestionGroupIdHidden;
+using omnibox::ToggleSuggestionGroupIdVisibility;
+
+class OmniboxPrefsTest : public ::testing::Test {
+ public:
+  OmniboxPrefsTest() = default;
+
+  void SetUp() override {
+    omnibox::RegisterProfilePrefs(GetPrefs()->registry());
+  }
+
+  TestingPrefServiceSimple* GetPrefs() { return &pref_service_; }
+
+ private:
+  TestingPrefServiceSimple pref_service_;
+
+  DISALLOW_COPY_AND_ASSIGN(OmniboxPrefsTest);
+};
+
+TEST_F(OmniboxPrefsTest, SuggestionGroupId) {
+  const int kRecommendedForYouGroupId = 1;
+  const int kRecentSearchesGroupId = 2;
+
+  EXPECT_FALSE(
+      IsSuggestionGroupIdHidden(GetPrefs(), kRecommendedForYouGroupId));
+  EXPECT_FALSE(IsSuggestionGroupIdHidden(GetPrefs(), kRecentSearchesGroupId));
+
+  ToggleSuggestionGroupIdVisibility(GetPrefs(), kRecommendedForYouGroupId);
+  EXPECT_TRUE(IsSuggestionGroupIdHidden(GetPrefs(), kRecommendedForYouGroupId));
+  EXPECT_FALSE(IsSuggestionGroupIdHidden(GetPrefs(), kRecentSearchesGroupId));
+
+  ToggleSuggestionGroupIdVisibility(GetPrefs(), kRecommendedForYouGroupId);
+  ToggleSuggestionGroupIdVisibility(GetPrefs(), kRecentSearchesGroupId);
+  EXPECT_FALSE(
+      IsSuggestionGroupIdHidden(GetPrefs(), kRecommendedForYouGroupId));
+  EXPECT_TRUE(IsSuggestionGroupIdHidden(GetPrefs(), kRecentSearchesGroupId));
+}

diff --git a/components/omnibox/browser/zero_suggest_provider.cc b/components/omnibox/browser/zero_suggest_provider.cc
index b5768c3..ba0f7fb 100644
--- a/components/omnibox/browser/zero_suggest_provider.cc
+++ b/components/omnibox/browser/zero_suggest_provider.cc

@@ -32,7 +32,7 @@
 #include "components/omnibox/browser/autocomplete_provider_client.h"
 #include "components/omnibox/browser/autocomplete_provider_listener.h"
 #include "components/omnibox/browser/omnibox_field_trial.h"
-#include "components/omnibox/browser/omnibox_pref_names.h"
+#include "components/omnibox/browser/omnibox_prefs.h"
 #include "components/omnibox/browser/remote_suggestions_service.h"
 #include "components/omnibox/browser/search_provider.h"
 #include "components/omnibox/browser/search_suggestion_parser.h"
@@ -198,8 +198,7 @@
 }
 
 // static
-void ZeroSuggestProvider::RegisterProfilePrefs(
-    user_prefs::PrefRegistrySyncable* registry) {
+void ZeroSuggestProvider::RegisterProfilePrefs(PrefRegistrySimple* registry) {
   registry->RegisterStringPref(omnibox::kZeroSuggestCachedResults,
                                std::string());
 }

diff --git a/components/omnibox/browser/zero_suggest_provider.h b/components/omnibox/browser/zero_suggest_provider.h
index 29dbf87b..4520e23e 100644
--- a/components/omnibox/browser/zero_suggest_provider.h
+++ b/components/omnibox/browser/zero_suggest_provider.h

@@ -20,6 +20,7 @@
 #include "third_party/metrics_proto/omnibox_event.pb.h"
 
 class AutocompleteProviderListener;
+class PrefRegistrySimple;
 
 namespace base {
 class Value;
@@ -29,9 +30,6 @@
 class SimpleURLLoader;
 }
 
-namespace user_prefs {
-class PrefRegistrySyncable;
-}
 
 // Autocomplete provider for searches based on the current URL.
 //
@@ -57,7 +55,7 @@
                                      AutocompleteProviderListener* listener);
 
   // Registers a preference used to cache zero suggest results.
-  static void RegisterProfilePrefs(user_prefs::PrefRegistrySyncable* registry);
+  static void RegisterProfilePrefs(PrefRegistrySimple* registry);
 
   // AutocompleteProvider:
   void Start(const AutocompleteInput& input, bool minimal_changes) override;

diff --git a/components/omnibox/browser/zero_suggest_provider_unittest.cc b/components/omnibox/browser/zero_suggest_provider_unittest.cc
index ff97ca3..1052838 100644
--- a/components/omnibox/browser/zero_suggest_provider_unittest.cc
+++ b/components/omnibox/browser/zero_suggest_provider_unittest.cc

@@ -20,7 +20,7 @@
 #include "components/omnibox/browser/autocomplete_provider_listener.h"
 #include "components/omnibox/browser/mock_autocomplete_provider_client.h"
 #include "components/omnibox/browser/omnibox_field_trial.h"
-#include "components/omnibox/browser/omnibox_pref_names.h"
+#include "components/omnibox/browser/omnibox_prefs.h"
 #include "components/omnibox/browser/test_scheme_classifier.h"
 #include "components/omnibox/common/omnibox_features.h"
 #include "components/prefs/pref_registry_simple.h"

diff --git a/components/page_load_metrics/renderer/metrics_render_frame_observer.cc b/components/page_load_metrics/renderer/metrics_render_frame_observer.cc
index b37fcf3b..f793cf3 100644
--- a/components/page_load_metrics/renderer/metrics_render_frame_observer.cc
+++ b/components/page_load_metrics/renderer/metrics_render_frame_observer.cc

@@ -146,12 +146,10 @@
     // case. There should be a guarantee that DidStartProvisionalLoad be called
     // before DidStartResponse for the frame request.
     provisional_frame_resource_data_use_->DidStartResponse(
-        response_url, request_id, response_head, request_destination,
-        previews_state);
+        response_url, request_id, response_head, request_destination);
   } else if (page_timing_metrics_sender_) {
     page_timing_metrics_sender_->DidStartResponse(
-        response_url, request_id, response_head, request_destination,
-        previews_state);
+        response_url, request_id, response_head, request_destination);
     UpdateResourceMetadata(request_id);
   }
 }

diff --git a/components/page_load_metrics/renderer/page_resource_data_use.cc b/components/page_load_metrics/renderer/page_resource_data_use.cc
index a6f0cdef..cf3100c 100644
--- a/components/page_load_metrics/renderer/page_resource_data_use.cc
+++ b/components/page_load_metrics/renderer/page_resource_data_use.cc

@@ -13,61 +13,6 @@
 
 namespace page_load_metrics {
 
-namespace {
-
-// Returns true when the image is a placeholder for lazy load.
-bool IsPartialImageRequest(
-    network::mojom::RequestDestination request_destination,
-    content::PreviewsState previews_state) {
-  if (request_destination != network::mojom::RequestDestination::kImage)
-    return false;
-  return previews_state & content::PreviewsTypes::LAZY_IMAGE_LOAD_DEFERRED;
-}
-
-// Returns true if this resource was previously fetched as a placeholder.
-bool IsImageAutoReload(network::mojom::RequestDestination request_destination,
-                       content::PreviewsState previews_state) {
-  if (request_destination != network::mojom::RequestDestination::kImage)
-    return false;
-  return previews_state & content::PreviewsTypes::LAZY_IMAGE_AUTO_RELOAD;
-}
-
-// Returns the ratio of original data size (without applying interventions) to
-// actual data use for a placeholder.
-double EstimatePartialImageRequestSavings(
-    const network::mojom::URLResponseHead& response_head) {
-  if (!response_head.headers)
-    return 1.0;
-
-  if (response_head.headers->GetContentLength() <= 0)
-    return 1.0;
-
-  int64_t first, last, original_length;
-  if (!response_head.headers->GetContentRangeFor206(&first, &last,
-                                                    &original_length)) {
-    return 1.0;
-  }
-
-  if (original_length < response_head.headers->GetContentLength())
-    return 1.0;
-
-  return original_length / response_head.headers->GetContentLength();
-}
-
-// Returns a ratio of original data use to actual data use while factoring in
-// that this request was previously fetched as a placeholder, and therefore
-// recorded savings earlier.
-double EstimateAutoReloadImageRequestSavings(
-    const network::mojom::URLResponseHead& response_head) {
-  static const double kPlageholderContentInCache = 2048;
-
-  // Count the new network usage. For a reloaded placeholder image, 2KB will be
-  // in cache.
-  return kPlageholderContentInCache / response_head.headers->GetContentLength();
-}
-
-}  // namespace
-
 PageResourceDataUse::PageResourceDataUse()
     : resource_id_(-1),
       data_reduction_proxy_compression_ratio_estimate_(1.0),
@@ -91,21 +36,10 @@
     const GURL& response_url,
     int resource_id,
     const network::mojom::URLResponseHead& response_head,
-    network::mojom::RequestDestination request_destination,
-    content::PreviewsState previews_state) {
+    network::mojom::RequestDestination request_destination) {
   resource_id_ = resource_id;
-
-  if (IsPartialImageRequest(request_destination, previews_state)) {
-    data_reduction_proxy_compression_ratio_estimate_ =
-        EstimatePartialImageRequestSavings(response_head);
-  } else if (IsImageAutoReload(request_destination, previews_state)) {
-    data_reduction_proxy_compression_ratio_estimate_ =
-        EstimateAutoReloadImageRequestSavings(response_head);
-  } else {
-    data_reduction_proxy_compression_ratio_estimate_ =
-        data_reduction_proxy::EstimateCompressionRatioFromHeaders(
-            &response_head);
-  }
+  data_reduction_proxy_compression_ratio_estimate_ =
+      data_reduction_proxy::EstimateCompressionRatioFromHeaders(&response_head);
 
   proxy_used_ = !response_head.proxy_server.is_direct();
   mime_type_ = response_head.mime_type;

diff --git a/components/page_load_metrics/renderer/page_resource_data_use.h b/components/page_load_metrics/renderer/page_resource_data_use.h
index 98aeda2..0e72aa4b 100644
--- a/components/page_load_metrics/renderer/page_resource_data_use.h
+++ b/components/page_load_metrics/renderer/page_resource_data_use.h

@@ -31,8 +31,7 @@
   void DidStartResponse(const GURL& response_url,
                         int resource_id,
                         const network::mojom::URLResponseHead& response_head,
-                        network::mojom::RequestDestination request_destination,
-                        content::PreviewsState previews_state);
+                        network::mojom::RequestDestination request_destination);
 
   // Updates received bytes.
   void DidReceiveTransferSizeUpdate(int received_data_length);

diff --git a/components/page_load_metrics/renderer/page_timing_metrics_sender.cc b/components/page_load_metrics/renderer/page_timing_metrics_sender.cc
index a649d2f8..5cf2ec6 100644
--- a/components/page_load_metrics/renderer/page_timing_metrics_sender.cc
+++ b/components/page_load_metrics/renderer/page_timing_metrics_sender.cc

@@ -130,16 +130,14 @@
     const GURL& response_url,
     int resource_id,
     const network::mojom::URLResponseHead& response_head,
-    network::mojom::RequestDestination request_destination,
-    content::PreviewsState previews_state) {
+    network::mojom::RequestDestination request_destination) {
   DCHECK(!base::Contains(page_resource_data_use_, resource_id));
 
   auto resource_it = page_resource_data_use_.emplace(
       std::piecewise_construct, std::forward_as_tuple(resource_id),
       std::forward_as_tuple(std::make_unique<PageResourceDataUse>()));
   resource_it.first->second->DidStartResponse(
-      response_url, resource_id, response_head, request_destination,
-      previews_state);
+      response_url, resource_id, response_head, request_destination);
 }
 
 void PageTimingMetricsSender::DidReceiveTransferSizeUpdate(

diff --git a/components/page_load_metrics/renderer/page_timing_metrics_sender.h b/components/page_load_metrics/renderer/page_timing_metrics_sender.h
index 24df4c0..708ca11 100644
--- a/components/page_load_metrics/renderer/page_timing_metrics_sender.h
+++ b/components/page_load_metrics/renderer/page_timing_metrics_sender.h

@@ -59,8 +59,7 @@
   void DidStartResponse(const GURL& response_url,
                         int resource_id,
                         const network::mojom::URLResponseHead& response_head,
-                        network::mojom::RequestDestination request_destination,
-                        content::PreviewsState previews_state);
+                        network::mojom::RequestDestination request_destination);
   void DidReceiveTransferSizeUpdate(int resource_id, int received_data_length);
   void DidCompleteResponse(int resource_id,
                            const network::URLLoaderCompletionStatus& status);

diff --git a/components/password_manager/core/browser/login_database.cc b/components/password_manager/core/browser/login_database.cc
index c067230..311a692 100644
--- a/components/password_manager/core/browser/login_database.cc
+++ b/components/password_manager/core/browser/login_database.cc

@@ -160,16 +160,14 @@
   SQLTableBuilder* sync_model_metadata;
 };
 
-void BindAddStatement(const PasswordForm& form,
-                      const std::string& encrypted_password,
-                      sql::Statement* s) {
+void BindAddStatement(const PasswordForm& form, sql::Statement* s) {
   s->BindString(COLUMN_ORIGIN_URL, form.origin.spec());
   s->BindString(COLUMN_ACTION_URL, form.action.spec());
   s->BindString16(COLUMN_USERNAME_ELEMENT, form.username_element);
   s->BindString16(COLUMN_USERNAME_VALUE, form.username_value);
   s->BindString16(COLUMN_PASSWORD_ELEMENT, form.password_element);
-  s->BindBlob(COLUMN_PASSWORD_VALUE, encrypted_password.data(),
-              static_cast<int>(encrypted_password.length()));
+  s->BindBlob(COLUMN_PASSWORD_VALUE, form.encrypted_password.data(),
+              static_cast<int>(form.encrypted_password.length()));
   s->BindString16(COLUMN_SUBMIT_ELEMENT, form.submit_element);
   s->BindString(COLUMN_SIGNON_REALM, form.signon_realm);
   // The "preferred" column has been deprecated in M81.
@@ -1016,17 +1014,21 @@
     }
     return list;
   }
+  PasswordForm form_with_encrypted_password = form;
+  form_with_encrypted_password.encrypted_password = encrypted_password;
 
   DCHECK(!add_statement_.empty());
   sql::Statement s(
       db_.GetCachedStatement(SQL_FROM_HERE, add_statement_.c_str()));
-  BindAddStatement(form, encrypted_password, &s);
+  BindAddStatement(form_with_encrypted_password, &s);
   int sqlite_error_code;
   db_.set_error_callback(base::BindRepeating(&AddCallback, &sqlite_error_code));
   const bool success = s.Run();
   if (success) {
     // If success, the row never existed so password was not changed.
-    list.emplace_back(PasswordStoreChange::ADD, form, db_.GetLastInsertRowId(),
+    list.emplace_back(PasswordStoreChange::ADD,
+                      std::move(form_with_encrypted_password),
+                      db_.GetLastInsertRowId(),
                       /*password_changed=*/false);
     return list;
   }
@@ -1040,11 +1042,12 @@
   int old_primary_key = GetPrimaryKey(form);
   s.Assign(
       db_.GetCachedStatement(SQL_FROM_HERE, add_replace_statement_.c_str()));
-  BindAddStatement(form, encrypted_password, &s);
+  BindAddStatement(form_with_encrypted_password, &s);
   if (s.Run()) {
     list.emplace_back(PasswordStoreChange::REMOVE, form, old_primary_key);
-    list.emplace_back(PasswordStoreChange::ADD, form, db_.GetLastInsertRowId(),
-                      password_changed);
+    list.emplace_back(PasswordStoreChange::ADD,
+                      std::move(form_with_encrypted_password),
+                      db_.GetLastInsertRowId(), password_changed);
   } else if (error) {
     if (sqlite_error_code == 19 /*SQLITE_CONSTRAINT*/) {
       *error = AddLoginError::kConstraintViolation;
@@ -1056,25 +1059,6 @@
   return list;
 }
 
-PasswordStoreChangeList LoginDatabase::AddBlacklistedLoginForTesting(
-    const PasswordForm& form) {
-  DCHECK(form.blacklisted_by_user);
-  PasswordStoreChangeList list;
-
-  std::string encrypted_password;
-  if (EncryptedString(form.password_value, &encrypted_password) !=
-      ENCRYPTION_RESULT_SUCCESS)
-    return list;
-
-  DCHECK(!add_statement_.empty());
-  sql::Statement s(
-      db_.GetCachedStatement(SQL_FROM_HERE, add_statement_.c_str()));
-  BindAddStatement(form, encrypted_password, &s);
-  if (s.Run())
-    list.emplace_back(PasswordStoreChange::ADD, form, db_.GetLastInsertRowId());
-  return list;
-}
-
 PasswordStoreChangeList LoginDatabase::UpdateLogin(const PasswordForm& form,
                                                    UpdateLoginError* error) {
   TRACE_EVENT0("passwords", "LoginDatabase::UpdateLogin");
@@ -1152,8 +1136,11 @@
 
   PasswordStoreChangeList list;
   if (db_.GetLastChangeCount()) {
-    list.emplace_back(PasswordStoreChange::UPDATE, form, GetPrimaryKey(form),
-                      password_changed);
+    PasswordForm form_with_encrypted_password = form;
+    form_with_encrypted_password.encrypted_password = encrypted_password;
+    list.emplace_back(PasswordStoreChange::UPDATE,
+                      std::move(form_with_encrypted_password),
+                      GetPrimaryKey(form), password_changed);
   } else if (error) {
     *error = UpdateLoginError::kNoUpdatedRecords;
   }
@@ -1317,6 +1304,7 @@
   form->username_value = s.ColumnString16(COLUMN_USERNAME_VALUE);
   form->password_element = s.ColumnString16(COLUMN_PASSWORD_ELEMENT);
   form->password_value = decrypted_password;
+  form->encrypted_password = encrypted_password;
   form->submit_element = s.ColumnString16(COLUMN_SUBMIT_ELEMENT);
   tmp = s.ColumnString(COLUMN_SIGNON_REALM);
   form->signon_realm = tmp;

diff --git a/components/password_manager/core/browser/login_database.h b/components/password_manager/core/browser/login_database.h
index 2d06d3db..fb1042a1 100644
--- a/components/password_manager/core/browser/login_database.h
+++ b/components/password_manager/core/browser/login_database.h

@@ -84,12 +84,6 @@
                                    AddLoginError* error = nullptr)
       WARN_UNUSED_RESULT;
 
-  // This function does the same thing as AddLogin() with the difference that
-  // doesn't check if a site is already blacklisted before adding it. This is
-  // needed for tests that will require to have duplicates in the database.
-  PasswordStoreChangeList AddBlacklistedLoginForTesting(
-      const autofill::PasswordForm& form) WARN_UNUSED_RESULT;
-
   // Updates existing password form. Returns the list of applied changes ({},
   // {UPDATE}). The password is looked up by the tuple {origin,
   // username_element, username_value, password_element, signon_realm}. These

diff --git a/components/password_manager/core/browser/login_database_ios_unittest.cc b/components/password_manager/core/browser/login_database_ios_unittest.cc
index a59e5b5..e79dfc2 100644
--- a/components/password_manager/core/browser/login_database_ios_unittest.cc
+++ b/components/password_manager/core/browser/login_database_ios_unittest.cc

@@ -103,6 +103,37 @@
   }
 }
 
+TEST_F(LoginDatabaseIOSTest, AddLogin) {
+  ASSERT_EQ(0U, GetKeychainSize());
+
+  PasswordForm form;
+  form.origin = GURL("http://0.com");
+  form.signon_realm = "http://www.example.com/";
+  form.action = GURL("http://www.example.com/action");
+  form.password_element = base::ASCIIToUTF16("pwd");
+  form.password_value = base::ASCIIToUTF16("example");
+
+  password_manager::PasswordStoreChangeList changes = login_db_->AddLogin(form);
+  std::string encrypted_password = changes[0].form().encrypted_password;
+  ASSERT_FALSE(encrypted_password.empty());
+  ASSERT_EQ(1U, GetKeychainSize());
+
+  CFStringRef cf_encrypted_password = CFStringCreateWithCString(
+      kCFAllocatorDefault, encrypted_password.c_str(), kCFStringEncodingUTF8);
+
+  ScopedCFTypeRef<CFMutableDictionaryRef> query(
+      CFDictionaryCreateMutable(NULL, 4, &kCFTypeDictionaryKeyCallBacks,
+                                &kCFTypeDictionaryValueCallBacks));
+  CFDictionarySetValue(query, kSecClass, kSecClassGenericPassword);
+  CFDictionarySetValue(query, kSecReturnAttributes, kCFBooleanTrue);
+  CFDictionarySetValue(query, kSecAttrAccount, cf_encrypted_password);
+
+  CFTypeRef result;
+  EXPECT_EQ(errSecSuccess, SecItemCopyMatching(query, &result));
+  CFRelease(cf_encrypted_password);
+  CFRelease(result);
+}
+
 TEST_F(LoginDatabaseIOSTest, UpdateLogin) {
   PasswordForm form;
   form.origin = GURL("http://0.com");

diff --git a/components/password_manager/core/browser/login_database_unittest.cc b/components/password_manager/core/browser/login_database_unittest.cc
index 336c82e..cb77509 100644
--- a/components/password_manager/core/browser/login_database_unittest.cc
+++ b/components/password_manager/core/browser/login_database_unittest.cc

@@ -1442,14 +1442,12 @@
   password_form.origin = GURL("http://rsolomakhin.github.io/autofill/123");
   password_form.signon_realm = "http://rsolomakhin.github.io/";
   password_form.blacklisted_by_user = true;
-  EXPECT_EQ(AddChangeForForm(password_form),
-            db().AddBlacklistedLoginForTesting(password_form));
+  EXPECT_EQ(AddChangeForForm(password_form), db().AddLogin(password_form));
 
   password_form.origin = GURL("https://rsolomakhin.github.io/autofill/1234");
   password_form.signon_realm = "https://rsolomakhin.github.io/";
   password_form.blacklisted_by_user = true;
-  EXPECT_EQ(AddChangeForForm(password_form),
-            db().AddBlacklistedLoginForTesting(password_form));
+  EXPECT_EQ(AddChangeForForm(password_form), db().AddLogin(password_form));
 
   StatisticsTable& stats_table = db().stats_table();
   InteractionsStats stats;
@@ -2433,4 +2431,75 @@
   EXPECT_THAT(forms, UnorderedElementsAre(Pointee(form1), Pointee(form3)));
 }
 
+// Test encrypted passwords are present in add change lists.
+TEST_F(LoginDatabaseTest, EncryptedPasswordAdd) {
+  PasswordForm form;
+  form.origin = GURL("http://0.com");
+  form.signon_realm = "http://www.example.com/";
+  form.action = GURL("http://www.example.com/action");
+  form.password_element = base::ASCIIToUTF16("pwd");
+  form.password_value = base::ASCIIToUTF16("example");
+  password_manager::PasswordStoreChangeList changes = db().AddLogin(form);
+  ASSERT_EQ(1u, changes.size());
+  ASSERT_FALSE(changes[0].form().encrypted_password.empty());
+}
+
+// Test encrypted passwords are present in add change lists, when the password
+// is already in the DB.
+TEST_F(LoginDatabaseTest, EncryptedPasswordAddWithReplaceSemantics) {
+  PasswordForm form;
+  form.origin = GURL("http://0.com");
+  form.signon_realm = "http://www.example.com/";
+  form.action = GURL("http://www.example.com/action");
+  form.password_element = base::ASCIIToUTF16("pwd");
+  form.password_value = base::ASCIIToUTF16("example");
+
+  ignore_result(db().AddLogin(form));
+
+  form.password_value = base::ASCIIToUTF16("secret");
+
+  password_manager::PasswordStoreChangeList changes = db().AddLogin(form);
+  ASSERT_EQ(2u, changes.size());
+  ASSERT_EQ(password_manager::PasswordStoreChange::Type::ADD,
+            changes[1].type());
+  ASSERT_FALSE(changes[1].form().encrypted_password.empty());
+}
+
+// Test encrypted passwords are present in update change lists.
+TEST_F(LoginDatabaseTest, EncryptedPasswordUpdate) {
+  PasswordForm form;
+  form.origin = GURL("http://0.com");
+  form.signon_realm = "http://www.example.com/";
+  form.action = GURL("http://www.example.com/action");
+  form.password_element = base::ASCIIToUTF16("pwd");
+  form.password_value = base::ASCIIToUTF16("example");
+
+  ignore_result(db().AddLogin(form));
+
+  form.password_value = base::ASCIIToUTF16("secret");
+
+  password_manager::PasswordStoreChangeList changes = db().UpdateLogin(form);
+  ASSERT_EQ(1u, changes.size());
+  ASSERT_FALSE(changes[0].form().encrypted_password.empty());
+}
+
+// Test encrypted passwords are present when retrieving from DB.
+TEST_F(LoginDatabaseTest, GetLoginsEncryptedPassword) {
+  PasswordForm form;
+  form.origin = GURL("http://0.com");
+  form.signon_realm = "http://www.example.com/";
+  form.action = GURL("http://www.example.com/action");
+  form.password_element = base::ASCIIToUTF16("pwd");
+  form.password_value = base::ASCIIToUTF16("example");
+  password_manager::PasswordStoreChangeList changes = db().AddLogin(form);
+  ASSERT_EQ(1u, changes.size());
+  ASSERT_FALSE(changes[0].form().encrypted_password.empty());
+
+  std::vector<std::unique_ptr<PasswordForm>> forms;
+  EXPECT_TRUE(db().GetLogins(PasswordStore::FormDigest(form), &forms));
+
+  ASSERT_EQ(1U, forms.size());
+  ASSERT_FALSE(forms[0]->encrypted_password.empty());
+}
+
 }  // namespace password_manager

diff --git a/components/policy/proto/device_management_backend.proto b/components/policy/proto/device_management_backend.proto
index 30e7ad0b..d6669de 100644
--- a/components/policy/proto/device_management_backend.proto
+++ b/components/policy/proto/device_management_backend.proto

@@ -185,7 +185,16 @@
   // domain from token.
   optional string expected_enrollment_domain = 17;
 
-  // Next id: 18.
+  // Identification of the device that is not already available.
+  optional DeviceRegisterIdentification device_register_identification = 18;
+
+  // Next id: 19.
+}
+
+// Identification of a device used during its registration.
+message DeviceRegisterIdentification {
+  // The Zero-Touch SN if a device has one.
+  optional string zero_touch_sn = 1;
 }
 
 // Response from server to device register request.

diff --git a/components/policy/resources/policy_templates.json b/components/policy/resources/policy_templates.json
index 51f9d633..25e8c91 100644
--- a/components/policy/resources/policy_templates.json
+++ b/components/policy/resources/policy_templates.json

@@ -984,7 +984,6 @@
         'PrintingAllowedDuplexModes',
         'PrintingAllowedPinModes',
         'PrintingAllowedBackgroundGraphicsModes',
-        'PrintingAllowedPageSizes',
         'PrintingColorDefault',
         'PrintingDuplexDefault',
         'PrintingPinDefault',
@@ -2325,40 +2324,6 @@
       'desc': '''Restricts background graphics printing mode. Unset policy is treated as no restriction.''',
     },
     {
-      'name': 'PrintingAllowedPageSizes',
-      'owners': ['vkuzkokov@chromium.org'],
-      'type': 'dict',
-      'schema': {
-        'type': 'array',
-        'items': {
-          'type': 'object',
-          'properties': {
-            'WidthUm': {
-              'description': '''Width of the page in micrometers''',
-              'type': 'integer',
-            },
-            'HeightUm': {
-              'description': '''Height of the page in micrometers''',
-              'type': 'integer',
-            },
-          },
-          'required': ['WidthUm', 'HeightUm'],
-        },
-      },
-      'supported_on': ['chrome_os:72-'],
-      'future': True,
-      'features': {
-        'can_be_recommended': False,
-        'dynamic_refresh': True,
-        'per_profile': True,
-      },
-      'example_value': [{'WidthUm': 210000, 'HeightUm': 297000}],
-      'id': 476,
-      'caption': '''Restrict printing page size''',
-      'tags': [],
-      'desc': '''Restricts printing page size. Unset policy and empty set are treated as no restriction.''',
-    },
-    {
       'name': 'PrintingColorDefault',
       'owners': ['vkuzkokov@chromium.org'],
       'type': 'string-enum',
@@ -19530,7 +19495,7 @@
 
       For details on <ph name="CORS">CORS</ph>, visit: <ph name="CORS_HELP_URL">https://www.chromestatus.com/feature/5768642492891136</ph>.
 
-      Note that this policy will be removed in <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> version 82.'''
+      Note that this policy was announced to be removed in <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> version 82, but the plan was changed to be removed in version 84.'''
     },
     {
       'name': 'CorsLegacyModeEnabled',
@@ -19557,7 +19522,7 @@
 
       For details on <ph name="CORS">CORS</ph>, visit: <ph name="CORS_HELP_URL">https://www.chromestatus.com/feature/5768642492891136</ph>.
 
-      Note that this policy will be removed in <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> version 82.'''
+      Note that this policy was announced to be removed in <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> version 82, but the plan was changed to be removed in version 84.'''
     },
     {
       'name': 'ExternalPrintServersWhitelist',
@@ -21323,7 +21288,7 @@
     },
   ],
   'placeholders': [],
-  'deleted_policy_ids': [412, 546, 562, 569, 578],
+  'deleted_policy_ids': [412, 476, 546, 562, 569, 578],
   'highest_id_currently_used': 691,
   'highest_atomic_group_id_currently_used': 38
 }

diff --git a/components/printing/renderer/print_render_frame_helper.cc b/components/printing/renderer/print_render_frame_helper.cc
index 3eb237c..4b6ffad0 100644
--- a/components/printing/renderer/print_render_frame_helper.cc
+++ b/components/printing/renderer/print_render_frame_helper.cc

@@ -43,7 +43,6 @@
 #include "printing/units.h"
 #include "third_party/blink/public/common/associated_interfaces/associated_interface_registry.h"
 #include "third_party/blink/public/common/frame/frame_owner_element_type.h"
-#include "third_party/blink/public/common/frame/sandbox_flags.h"
 #include "third_party/blink/public/platform/platform.h"
 #include "third_party/blink/public/platform/web_data.h"
 #include "third_party/blink/public/platform/web_double_size.h"

diff --git a/components/services/storage/public/mojom/service_worker_storage_control.mojom b/components/services/storage/public/mojom/service_worker_storage_control.mojom
index ed47bedf..b8b2563 100644
--- a/components/services/storage/public/mojom/service_worker_storage_control.mojom
+++ b/components/services/storage/public/mojom/service_worker_storage_control.mojom

@@ -39,22 +39,35 @@
 // An interface that reads a service worker script (resource) to storage.
 interface ServiceWorkerResourceReader {
   // Reads the response head of the resource associated with this reader.
+  // |status| is the number of bytes read, or a //net error.
+  // Also returns metadata associated with the resource if it exists.
   ReadResponseHead() =>
-      (int32 status, network.mojom.URLResponseHead response_head);
+      (int32 status,
+       network.mojom.URLResponseHead response_head,
+       mojo_base.mojom.BigBuffer? metadata);
   // Reads the content of the resource associated with this reader.
   ReadData(int64 size) => (handle<data_pipe_consumer> pipe);
-  // TODO(crbug.com/1055677): Add ways to read the metadata of the script.
 };
 
 // An interface that writes a service worker script (resource) to storage.
 interface ServiceWorkerResourceWriter {
-  // Writes the response head to storage.
+  // Writes the response head to storage. Returns the number of bytes written,
+  // or a //net error.
   WriteResponseHead(network.mojom.URLResponseHead response_head)
       => (int32 status);
-  // Write the content of the resource to storage.
+  // Writes the content of the resource to storage. Returns the number of bytes
+  // written, or a //net error.
   WriteData(mojo_base.mojom.BigBuffer data) => (int32 status);
 };
 
+// An interface that writes a metadata (script cache) of a service worker script
+// to storage.
+interface ServiceWorkerResourceMetadataWriter {
+  // Writes the metadata of the resource associated with this writer. Returns
+  // the number of bytes written, or a //net error.
+  WriteMetadata(mojo_base.mojom.BigBuffer data) => (int32 status);
+};
+
 // Controls the state of service worker storage within a partition. This is a
 // privileged interface and must not be brokered to untrusted clients.
 //
@@ -105,4 +118,8 @@
   // Creates a resource writer for the given |resource_id|.
   CreateResourceWriter(int64 resource_id,
                        pending_receiver<ServiceWorkerResourceWriter> writer);
+  // Creates a metadata writer for the given |resource_id|.
+  CreateResourceMetadataWriter(
+      int64 resource_id,
+      pending_receiver<ServiceWorkerResourceMetadataWriter> writer);
 };

diff --git a/components/signin/core/browser/android/java/src/org/chromium/components/signin/AccountManagerFacadeProvider.java b/components/signin/core/browser/android/java/src/org/chromium/components/signin/AccountManagerFacadeProvider.java
index 75250faf..7c6c768 100644
--- a/components/signin/core/browser/android/java/src/org/chromium/components/signin/AccountManagerFacadeProvider.java
+++ b/components/signin/core/browser/android/java/src/org/chromium/components/signin/AccountManagerFacadeProvider.java

@@ -7,6 +7,7 @@
 import androidx.annotation.MainThread;
 import androidx.annotation.VisibleForTesting;
 
+import org.chromium.base.Log;
 import org.chromium.base.ThreadUtils;
 import org.chromium.base.annotations.CalledByNative;
 
@@ -17,6 +18,7 @@
  * AccountManagerFacade instance manipulation methods in one place.
  */
 public class AccountManagerFacadeProvider {
+    private static final String TAG = "AccManagerProvider";
     private static final AtomicReference<AccountManagerFacade> sAtomicInstance =
             new AtomicReference<>();
     private static AccountManagerFacade sInstance;
@@ -61,6 +63,7 @@
         ThreadUtils.runOnUiThreadBlocking(() -> {
             sTestingInstance = null;
             sAtomicInstance.set(sInstance);
+            Log.d(TAG, "reset AccountManagerFacade test instance");
         });
     }
 

diff --git a/components/signin/core/browser/android/javatests/src/org/chromium/components/signin/test/util/AccountManagerTestRule.java b/components/signin/core/browser/android/javatests/src/org/chromium/components/signin/test/util/AccountManagerTestRule.java
index 18395734..0a832aa 100644
--- a/components/signin/core/browser/android/javatests/src/org/chromium/components/signin/test/util/AccountManagerTestRule.java
+++ b/components/signin/core/browser/android/javatests/src/org/chromium/components/signin/test/util/AccountManagerTestRule.java

@@ -57,7 +57,11 @@
                     AccountManagerFacadeProvider.setInstanceForTests(
                             new AccountManagerFacade(mDelegate));
                 });
-                statement.evaluate();
+                try {
+                    statement.evaluate();
+                } finally {
+                    AccountManagerFacadeProvider.resetInstanceForTests();
+                }
             }
         };
     }

diff --git a/components/sync_bookmarks/bookmark_model_merger.cc b/components/sync_bookmarks/bookmark_model_merger.cc
index e6a75d9..b8ea3db0 100644
--- a/components/sync_bookmarks/bookmark_model_merger.cc
+++ b/components/sync_bookmarks/bookmark_model_merger.cc

@@ -15,7 +15,6 @@
 #include "components/bookmarks/browser/bookmark_model.h"
 #include "components/bookmarks/browser/bookmark_node.h"
 #include "components/sync/base/hash_util.h"
-#include "components/sync/base/unique_position.h"
 #include "components/sync/engine/engine_util.h"
 #include "components/sync_bookmarks/bookmark_specifics_conversions.h"
 #include "components/sync_bookmarks/switches.h"
@@ -626,22 +625,10 @@
   const base::Time creation_time = base::Time::Now();
   const std::string& suffix = syncer::GenerateSyncableBookmarkHash(
       bookmark_tracker_->model_type_state().cache_guid(), sync_id);
-  syncer::UniquePosition pos;
   // Locally created nodes aren't tracked and hence don't have a unique position
   // yet so we need to produce new ones.
-  if (index == 0) {
-    pos = syncer::UniquePosition::InitialPosition(suffix);
-  } else {
-    const SyncedBookmarkTracker::Entity* predecessor_entity =
-        bookmark_tracker_->GetEntityForBookmarkNode(
-            parent->children()[index - 1].get());
-    DCHECK(predecessor_entity);
-    pos = syncer::UniquePosition::After(
-        syncer::UniquePosition::FromProto(
-            predecessor_entity->metadata()->unique_position()),
-        suffix);
-  }
-
+  const syncer::UniquePosition pos =
+      GenerateUniquePositionForLocalCreation(parent, index, suffix);
   const sync_pb::EntitySpecifics specifics = CreateSpecificsFromBookmarkNode(
       node, bookmark_model_, /*force_favicon_load=*/true,
       /*include_guid=*/true);
@@ -704,4 +691,27 @@
   return it->second.local_node;
 }
 
+syncer::UniquePosition
+BookmarkModelMerger::GenerateUniquePositionForLocalCreation(
+    const bookmarks::BookmarkNode* parent,
+    size_t index,
+    const std::string& suffix) const {
+  // Try to find last tracked preceding entity. It is not always the previous
+  // one as it might be skipped if it has unprocessed remote matching by GUID
+  // update.
+  for (size_t i = index; i > 0; --i) {
+    const SyncedBookmarkTracker::Entity* predecessor_entity =
+        bookmark_tracker_->GetEntityForBookmarkNode(
+            parent->children()[i - 1].get());
+    if (predecessor_entity != nullptr) {
+      return syncer::UniquePosition::After(
+          syncer::UniquePosition::FromProto(
+              predecessor_entity->metadata()->unique_position()),
+          suffix);
+    }
+    DCHECK(FindMatchingRemoteNodeByGUID(parent->children()[i - 1].get()));
+  }
+  return syncer::UniquePosition::InitialPosition(suffix);
+}
+
 }  // namespace sync_bookmarks

diff --git a/components/sync_bookmarks/bookmark_model_merger.h b/components/sync_bookmarks/bookmark_model_merger.h
index 9758ee9..500df95 100644
--- a/components/sync_bookmarks/bookmark_model_merger.h
+++ b/components/sync_bookmarks/bookmark_model_merger.h

@@ -11,6 +11,7 @@
 #include <vector>
 
 #include "base/macros.h"
+#include "components/sync/base/unique_position.h"
 #include "components/sync/engine/non_blocking_sync_common.h"
 
 namespace bookmarks {
@@ -181,6 +182,13 @@
       const bookmarks::BookmarkNode* local_parent,
       size_t starting_child_index) const;
 
+  // Used to generate a unique position for the current locally created
+  // bookmark.
+  syncer::UniquePosition GenerateUniquePositionForLocalCreation(
+      const bookmarks::BookmarkNode* parent,
+      size_t index,
+      const std::string& suffix) const;
+
   bookmarks::BookmarkModel* const bookmark_model_;
   favicon::FaviconService* const favicon_service_;
   SyncedBookmarkTracker* const bookmark_tracker_;

diff --git a/components/sync_bookmarks/bookmark_model_merger_unittest.cc b/components/sync_bookmarks/bookmark_model_merger_unittest.cc
index c254246..2639e67 100644
--- a/components/sync_bookmarks/bookmark_model_merger_unittest.cc
+++ b/components/sync_bookmarks/bookmark_model_merger_unittest.cc

@@ -1515,4 +1515,133 @@
   EXPECT_THAT(tracker->GetEntityForBookmarkNode(merged_bookmark), NotNull());
 }
 
+// Regression test for crbug.com/1050776. Verifies that computing the unique
+// position does not crash when processing local creation of bookmark during
+// initial merge.
+TEST(BookmarkModelMergerTest,
+     ShouldProcessLocalCreationWithUntrackedPredecessorNode) {
+  base::test::ScopedFeatureList override_features;
+  override_features.InitAndEnableFeature(switches::kMergeBookmarksUsingGUIDs);
+
+  const std::string kFolder1Title = "folder1";
+  const std::string kFolder2Title = "folder2";
+
+  const std::string kUrl1Title = "url1";
+  const std::string kUrl2Title = "url2";
+
+  const std::string kUrl1 = "http://www.url1.com/";
+  const std::string kUrl2 = "http://www.url2.com/";
+
+  const std::string kFolder1Id = "Folder1Id";
+  const std::string kFolder2Id = "Folder2Id";
+  const std::string kUrl1Id = "Url1Id";
+
+  // It is needed to use at least two folders to reproduce the crash. It is
+  // needed because the bookmarks are processed in the order of remote entities
+  // on the same level of the tree. To start processing of locally created
+  // bookmarks while other remote bookmarks are not processed we need to use at
+  // least one local folder with several urls.
+  //
+  // -------- The local model --------
+  // bookmark_bar
+  //  |- folder 1
+  //    |- url1(http://www.url1.com)
+  //    |- url2(http://www.url2.com)
+
+  std::unique_ptr<bookmarks::BookmarkModel> bookmark_model =
+      bookmarks::TestBookmarkClient::CreateModel();
+
+  const bookmarks::BookmarkNode* bookmark_bar_node =
+      bookmark_model->bookmark_bar_node();
+  const bookmarks::BookmarkNode* folder1 = bookmark_model->AddFolder(
+      /*parent=*/bookmark_bar_node, /*index=*/0,
+      base::UTF8ToUTF16(kFolder1Title));
+  const bookmarks::BookmarkNode* folder1_url1_node = bookmark_model->AddURL(
+      /*parent=*/folder1, /*index=*/0, base::UTF8ToUTF16(kUrl1Title),
+      GURL(kUrl1));
+  bookmark_model->AddURL(
+      /*parent=*/folder1, /*index=*/1, base::UTF8ToUTF16(kUrl2Title),
+      GURL(kUrl2));
+
+  // The remote model contains two folders. The first one is the same as in
+  // local model, but it does not contain any urls. The second one has the url1
+  // from first folder with same GUID. This will cause skip local creation for
+  // |url1| while processing |folder1|.
+  //
+  // -------- The remote model --------
+  // bookmark_bar
+  //  |- folder 1
+  //  |- folder 2
+  //    |- url1(http://www.url1.com)
+
+  const std::string suffix = syncer::UniquePosition::RandomSuffix();
+  syncer::UniquePosition posFolder1 =
+      syncer::UniquePosition::InitialPosition(suffix);
+  syncer::UniquePosition posFolder2 =
+      syncer::UniquePosition::After(posFolder1, suffix);
+
+  syncer::UniquePosition posUrl1 =
+      syncer::UniquePosition::InitialPosition(suffix);
+
+  syncer::UpdateResponseDataList updates;
+  updates.push_back(CreateBookmarkBarNodeUpdateData());
+  updates.push_back(CreateUpdateResponseData(
+      /*server_id=*/kFolder1Id, /*parent_id=*/kBookmarkBarId, kFolder1Title,
+      /*url=*/std::string(),
+      /*is_folder=*/true, /*unique_position=*/posFolder1));
+  updates.push_back(CreateUpdateResponseData(
+      /*server_id=*/kFolder2Id, /*parent_id=*/kBookmarkBarId, kFolder2Title,
+      /*url=*/std::string(),
+      /*is_folder=*/true, /*unique_position=*/posFolder2));
+  updates.push_back(CreateUpdateResponseData(
+      /*server_id=*/kUrl1Id, /*parent_id=*/kFolder2Id, kUrl1Title, kUrl1,
+      /*is_folder=*/false, /*unique_position=*/posUrl1,
+      folder1_url1_node->guid()));
+
+  // -------- The expected merge outcome --------
+  // bookmark_bar
+  //  |- folder 1
+  //    |- url2(http://www.url2.com)
+  //  |- folder 2
+  //    |- url1(http://www.url1.com)
+
+  std::unique_ptr<SyncedBookmarkTracker> tracker =
+      Merge(std::move(updates), bookmark_model.get());
+  ASSERT_THAT(bookmark_bar_node->children().size(), Eq(2u));
+
+  // Verify Folder 1.
+  EXPECT_THAT(bookmark_bar_node->children()[0]->GetTitle(),
+              Eq(base::ASCIIToUTF16(kFolder1Title)));
+  ASSERT_THAT(bookmark_bar_node->children()[0]->children().size(), Eq(1u));
+
+  EXPECT_THAT(bookmark_bar_node->children()[0]->children()[0]->GetTitle(),
+              Eq(base::ASCIIToUTF16(kUrl2Title)));
+  EXPECT_THAT(bookmark_bar_node->children()[0]->children()[0]->url(),
+              Eq(GURL(kUrl2)));
+
+  // Verify Folder 2.
+  EXPECT_THAT(bookmark_bar_node->children()[1]->GetTitle(),
+              Eq(base::ASCIIToUTF16(kFolder2Title)));
+  ASSERT_THAT(bookmark_bar_node->children()[1]->children().size(), Eq(1u));
+
+  EXPECT_THAT(bookmark_bar_node->children()[1]->children()[0]->GetTitle(),
+              Eq(base::ASCIIToUTF16(kUrl1Title)));
+  EXPECT_THAT(bookmark_bar_node->children()[1]->children()[0]->url(),
+              Eq(GURL(kUrl1)));
+
+  // Verify the tracker contents.
+  EXPECT_THAT(tracker->TrackedEntitiesCountForTest(), Eq(5U));
+
+  const size_t kMaxEntries = 1000;
+  std::vector<const SyncedBookmarkTracker::Entity*> local_changes =
+      tracker->GetEntitiesWithLocalChanges(kMaxEntries);
+
+  ASSERT_THAT(local_changes.size(), Eq(1U));
+  EXPECT_THAT(local_changes[0]->bookmark_node(),
+              Eq(bookmark_bar_node->children()[0]->children()[0].get()));
+
+  // Verify positions in tracker.
+  EXPECT_TRUE(PositionsInTrackerMatchModel(bookmark_bar_node, *tracker));
+}
+
 }  // namespace sync_bookmarks

diff --git a/content/browser/accessibility/hit_testing_browsertest.cc b/content/browser/accessibility/hit_testing_browsertest.cc
index 4fe50c0..2e02745 100644
--- a/content/browser/accessibility/hit_testing_browsertest.cc
+++ b/content/browser/accessibility/hit_testing_browsertest.cc

@@ -624,8 +624,9 @@
 }
 
 #if !defined(OS_ANDROID) && !defined(OS_MACOSX)
+// Disabled due to flake: https://crbug.com/1069850
 IN_PROC_BROWSER_TEST_F(AccessibilityHitTestingBrowserTest,
-                       HitTestingWithPinchZoom) {
+                       DISABLED_HitTestingWithPinchZoom) {
   ASSERT_TRUE(embedded_test_server()->Start());
 
   EXPECT_TRUE(NavigateToURL(shell(), GURL(url::kAboutBlankURL)));

diff --git a/content/browser/cross_origin_opener_policy_browsertest.cc b/content/browser/cross_origin_opener_policy_browsertest.cc
index 5d6139ce..3deaa9d70 100644
--- a/content/browser/cross_origin_opener_policy_browsertest.cc
+++ b/content/browser/cross_origin_opener_policy_browsertest.cc

@@ -212,7 +212,7 @@
       "a.com", "/cross-origin-opener-policy_csp_sandboxed.html"));
   EXPECT_TRUE(NavigateToURL(shell(), starting_page));
   EXPECT_NE(current_frame_host()->active_sandbox_flags(),
-            blink::mojom::WebSandboxFlags::kNone)
+            network::mojom::WebSandboxFlags::kNone)
       << "Document should be sandboxed.";
 
   GURL next_page(https_server()->GetURL(

diff --git a/content/browser/frame_host/frame_tree_browsertest.cc b/content/browser/frame_host/frame_tree_browsertest.cc
index 925df36..091441d 100644
--- a/content/browser/frame_host/frame_tree_browsertest.cc
+++ b/content/browser/frame_host/frame_tree_browsertest.cc

@@ -29,7 +29,8 @@
 #include "content/test/content_browser_test_utils_internal.h"
 #include "net/dns/mock_host_resolver.h"
 #include "net/test/embedded_test_server/embedded_test_server.h"
-#include "third_party/blink/public/common/frame/sandbox_flags.h"
+#include "services/network/public/cpp/web_sandbox_flags.h"
+#include "services/network/public/mojom/web_sandbox_flags.mojom-shared.h"
 #include "third_party/blink/public/mojom/frame/user_activation_update_types.mojom.h"
 #include "url/url_constants.h"
 
@@ -567,11 +568,11 @@
 
   // Verify that sandbox flags are set properly for the root FrameTreeNode and
   // RenderFrameHost. Root frame is sandboxed with "allow-scripts".
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             root->effective_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kAll &
-                ~blink::mojom::WebSandboxFlags::kScripts &
-                ~blink::mojom::WebSandboxFlags::kAutomaticFeatures,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kAll &
+                ~network::mojom::WebSandboxFlags::kScripts &
+                ~network::mojom::WebSandboxFlags::kAutomaticFeatures,
             root->active_sandbox_flags());
   EXPECT_EQ(root->active_sandbox_flags(),
             root->current_frame_host()->active_sandbox_flags());
@@ -579,19 +580,19 @@
   // Verify that child frames inherit sandbox flags from the root. First frame
   // has no explicitly set flags of its own, and should inherit those from the
   // root. Second frame is completely sandboxed.
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kAll &
-                ~blink::mojom::WebSandboxFlags::kScripts &
-                ~blink::mojom::WebSandboxFlags::kAutomaticFeatures,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kAll &
+                ~network::mojom::WebSandboxFlags::kScripts &
+                ~network::mojom::WebSandboxFlags::kAutomaticFeatures,
             root->child_at(0)->effective_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kAll &
-                ~blink::mojom::WebSandboxFlags::kScripts &
-                ~blink::mojom::WebSandboxFlags::kAutomaticFeatures,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kAll &
+                ~network::mojom::WebSandboxFlags::kScripts &
+                ~network::mojom::WebSandboxFlags::kAutomaticFeatures,
             root->child_at(0)->active_sandbox_flags());
   EXPECT_EQ(root->child_at(0)->active_sandbox_flags(),
             root->child_at(0)->current_frame_host()->active_sandbox_flags());
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kAll,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kAll,
             root->child_at(1)->effective_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kAll,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kAll,
             root->child_at(1)->active_sandbox_flags());
   EXPECT_EQ(root->child_at(1)->active_sandbox_flags(),
             root->child_at(1)->current_frame_host()->active_sandbox_flags());
@@ -602,10 +603,11 @@
 
   // Verify that sandbox flags are cleared properly for the root FrameTreeNode
   // and RenderFrameHost.
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             root->effective_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone, root->active_sandbox_flags());
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
+            root->active_sandbox_flags());
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             root->current_frame_host()->active_sandbox_flags());
 }
 
@@ -624,18 +626,18 @@
   // which resets both SandboxFlags::Scripts and
   // SandboxFlags::AutomaticFeatures bits per blink::parseSandboxPolicy(), and
   // third frame has "allow-scripts allow-same-origin".
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             root->effective_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kAll,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kAll,
             root->child_at(0)->effective_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kAll &
-                ~blink::mojom::WebSandboxFlags::kScripts &
-                ~blink::mojom::WebSandboxFlags::kAutomaticFeatures,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kAll &
+                ~network::mojom::WebSandboxFlags::kScripts &
+                ~network::mojom::WebSandboxFlags::kAutomaticFeatures,
             root->child_at(1)->effective_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kAll &
-                ~blink::mojom::WebSandboxFlags::kScripts &
-                ~blink::mojom::WebSandboxFlags::kAutomaticFeatures &
-                ~blink::mojom::WebSandboxFlags::kOrigin,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kAll &
+                ~network::mojom::WebSandboxFlags::kScripts &
+                ~network::mojom::WebSandboxFlags::kAutomaticFeatures &
+                ~network::mojom::WebSandboxFlags::kOrigin,
             root->child_at(2)->effective_frame_policy().sandbox_flags);
 
   // Sandboxed frames should set a unique origin unless they have the
@@ -648,7 +650,7 @@
   // Navigating to a different URL should not clear sandbox flags.
   GURL frame_url(embedded_test_server()->GetURL("/title1.html"));
   NavigateFrameToURL(root->child_at(0), frame_url);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kAll,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kAll,
             root->child_at(0)->effective_frame_policy().sandbox_flags);
 }
 
@@ -673,31 +675,32 @@
   // "allow-orientation-lock", and the framed document is also served with a CSP
   // header which uses "allow-popups" and "allow-pointer-lock". The resulting
   // sandbox for the frame should only have "allow-pointer-lock".
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             root->effective_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone, root->active_sandbox_flags());
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
+            root->active_sandbox_flags());
   EXPECT_EQ(root->active_sandbox_flags(),
             root->current_frame_host()->active_sandbox_flags());
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             root->child_at(0)->effective_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kAll &
-                ~blink::mojom::WebSandboxFlags::kScripts &
-                ~blink::mojom::WebSandboxFlags::kAutomaticFeatures &
-                ~blink::mojom::WebSandboxFlags::kPopups &
-                ~blink::mojom::WebSandboxFlags::kPointerLock,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kAll &
+                ~network::mojom::WebSandboxFlags::kScripts &
+                ~network::mojom::WebSandboxFlags::kAutomaticFeatures &
+                ~network::mojom::WebSandboxFlags::kPopups &
+                ~network::mojom::WebSandboxFlags::kPointerLock,
             root->child_at(0)->active_sandbox_flags());
   EXPECT_EQ(root->child_at(0)->active_sandbox_flags(),
             root->child_at(0)->current_frame_host()->active_sandbox_flags());
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kAll &
-                ~blink::mojom::WebSandboxFlags::kScripts &
-                ~blink::mojom::WebSandboxFlags::kAutomaticFeatures &
-                ~blink::mojom::WebSandboxFlags::kPointerLock &
-                ~blink::mojom::WebSandboxFlags::kOrientationLock,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kAll &
+                ~network::mojom::WebSandboxFlags::kScripts &
+                ~network::mojom::WebSandboxFlags::kAutomaticFeatures &
+                ~network::mojom::WebSandboxFlags::kPointerLock &
+                ~network::mojom::WebSandboxFlags::kOrientationLock,
             root->child_at(1)->effective_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kAll &
-                ~blink::mojom::WebSandboxFlags::kScripts &
-                ~blink::mojom::WebSandboxFlags::kAutomaticFeatures &
-                ~blink::mojom::WebSandboxFlags::kPointerLock,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kAll &
+                ~network::mojom::WebSandboxFlags::kScripts &
+                ~network::mojom::WebSandboxFlags::kAutomaticFeatures &
+                ~network::mojom::WebSandboxFlags::kPointerLock,
             root->child_at(1)->active_sandbox_flags());
   EXPECT_EQ(root->child_at(1)->active_sandbox_flags(),
             root->child_at(1)->current_frame_host()->active_sandbox_flags());
@@ -707,25 +710,25 @@
   GURL frame_url(embedded_test_server()->GetURL("/title1.html"));
 
   NavigateFrameToURL(root->child_at(0), frame_url);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             root->child_at(0)->effective_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             root->child_at(0)->active_sandbox_flags());
   EXPECT_EQ(root->child_at(0)->active_sandbox_flags(),
             root->child_at(0)->current_frame_host()->active_sandbox_flags());
 
   NavigateFrameToURL(root->child_at(1), frame_url);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kAll &
-                ~blink::mojom::WebSandboxFlags::kScripts &
-                ~blink::mojom::WebSandboxFlags::kAutomaticFeatures &
-                ~blink::mojom::WebSandboxFlags::kPointerLock &
-                ~blink::mojom::WebSandboxFlags::kOrientationLock,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kAll &
+                ~network::mojom::WebSandboxFlags::kScripts &
+                ~network::mojom::WebSandboxFlags::kAutomaticFeatures &
+                ~network::mojom::WebSandboxFlags::kPointerLock &
+                ~network::mojom::WebSandboxFlags::kOrientationLock,
             root->child_at(1)->effective_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kAll &
-                ~blink::mojom::WebSandboxFlags::kScripts &
-                ~blink::mojom::WebSandboxFlags::kAutomaticFeatures &
-                ~blink::mojom::WebSandboxFlags::kPointerLock &
-                ~blink::mojom::WebSandboxFlags::kOrientationLock,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kAll &
+                ~network::mojom::WebSandboxFlags::kScripts &
+                ~network::mojom::WebSandboxFlags::kAutomaticFeatures &
+                ~network::mojom::WebSandboxFlags::kPointerLock &
+                ~network::mojom::WebSandboxFlags::kOrientationLock,
             root->child_at(1)->active_sandbox_flags());
   EXPECT_EQ(root->child_at(1)->active_sandbox_flags(),
             root->child_at(1)->current_frame_host()->active_sandbox_flags());
@@ -1178,13 +1181,13 @@
   // flags. Main frame sets allow-popups, allow-pointer-lock and allow-scripts.
   FrameTreeNode* popup_root =
       static_cast<WebContentsImpl*>(new_contents)->GetFrameTree()->root();
-  blink::mojom::WebSandboxFlags main_frame_sandbox_flags =
+  network::mojom::WebSandboxFlags main_frame_sandbox_flags =
       root->current_frame_host()->active_sandbox_flags();
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kAll &
-                ~blink::mojom::WebSandboxFlags::kPopups &
-                ~blink::mojom::WebSandboxFlags::kPointerLock &
-                ~blink::mojom::WebSandboxFlags::kScripts &
-                ~blink::mojom::WebSandboxFlags::kAutomaticFeatures,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kAll &
+                ~network::mojom::WebSandboxFlags::kPopups &
+                ~network::mojom::WebSandboxFlags::kPointerLock &
+                ~network::mojom::WebSandboxFlags::kScripts &
+                ~network::mojom::WebSandboxFlags::kAutomaticFeatures,
             main_frame_sandbox_flags);
 
   EXPECT_EQ(main_frame_sandbox_flags,

diff --git a/content/browser/frame_host/frame_tree_node.cc b/content/browser/frame_host/frame_tree_node.cc
index 2e2e142..5adc109 100644
--- a/content/browser/frame_host/frame_tree_node.cc
+++ b/content/browser/frame_host/frame_tree_node.cc

@@ -29,7 +29,8 @@
 #include "content/public/browser/browser_thread.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/navigation_policy.h"
-#include "third_party/blink/public/common/frame/sandbox_flags.h"
+#include "services/network/public/cpp/web_sandbox_flags.h"
+#include "services/network/public/mojom/web_sandbox_flags.mojom-shared.h"
 #include "third_party/blink/public/mojom/frame/user_activation_update_types.mojom.h"
 #include "third_party/blink/public/mojom/security_context/insecure_request_policy.mojom.h"
 
@@ -231,7 +232,7 @@
 
   // Clear any CSP-set sandbox flags, and the declared feature policy for the
   // frame.
-  UpdateFramePolicyHeaders(blink::mojom::WebSandboxFlags::kNone, {});
+  UpdateFramePolicyHeaders(network::mojom::WebSandboxFlags::kNone, {});
 
   // This frame has had its user activation bits cleared in the renderer
   // before arriving here. We just need to clear them here and in the other
@@ -687,7 +688,7 @@
 }
 
 void FrameTreeNode::UpdateFramePolicyHeaders(
-    blink::mojom::WebSandboxFlags sandbox_flags,
+    network::mojom::WebSandboxFlags sandbox_flags,
     const blink::ParsedFeaturePolicy& parsed_header) {
   bool changed = false;
   if (replication_state_.feature_policy_header != parsed_header) {
@@ -696,7 +697,7 @@
   }
   // TODO(iclelland): Kill the renderer if sandbox flags is not a subset of the
   // currently effective sandbox flags from the frame. https://crbug.com/740556
-  blink::mojom::WebSandboxFlags updated_flags =
+  network::mojom::WebSandboxFlags updated_flags =
       sandbox_flags | effective_frame_policy().sandbox_flags;
   if (replication_state_.active_sandbox_flags != updated_flags) {
     replication_state_.active_sandbox_flags = updated_flags;

diff --git a/content/browser/frame_host/frame_tree_node.h b/content/browser/frame_host/frame_tree_node.h
index 89ba68e8..5b85f3b7 100644
--- a/content/browser/frame_host/frame_tree_node.h
+++ b/content/browser/frame_host/frame_tree_node.h

@@ -343,7 +343,7 @@
   // pending_frame_policy() for those. To see the flags which will take effect
   // on navigation (which does not include the CSP-set flags), use
   // effective_frame_policy().
-  blink::mojom::WebSandboxFlags active_sandbox_flags() const {
+  network::mojom::WebSandboxFlags active_sandbox_flags() const {
     return replication_state_.active_sandbox_flags;
   }
 
@@ -354,7 +354,7 @@
   // will be cleared, and the flags in the pending frame policy will be applied
   // to the frame.
   void UpdateFramePolicyHeaders(
-      blink::mojom::WebSandboxFlags sandbox_flags,
+      network::mojom::WebSandboxFlags sandbox_flags,
       const blink::ParsedFeaturePolicy& parsed_header);
 
   // Returns whether the frame received a user gesture.

diff --git a/content/browser/frame_host/navigation_request.cc b/content/browser/frame_host/navigation_request.cc
index 5b22d00..a59d8e7 100644
--- a/content/browser/frame_host/navigation_request.cc
+++ b/content/browser/frame_host/navigation_request.cc

@@ -99,10 +99,11 @@
 #include "services/network/public/cpp/features.h"
 #include "services/network/public/cpp/resource_request_body.h"
 #include "services/network/public/cpp/url_loader_completion_status.h"
+#include "services/network/public/cpp/web_sandbox_flags.h"
 #include "services/network/public/mojom/fetch_api.mojom.h"
 #include "services/network/public/mojom/url_response_head.mojom.h"
+#include "services/network/public/mojom/web_sandbox_flags.mojom.h"
 #include "third_party/blink/public/common/blob/blob_utils.h"
-#include "third_party/blink/public/common/frame/sandbox_flags.h"
 #include "third_party/blink/public/mojom/appcache/appcache.mojom.h"
 #include "third_party/blink/public/mojom/fetch/fetch_api_request.mojom.h"
 #include "third_party/blink/public/mojom/renderer_preferences.mojom.h"
@@ -1896,7 +1897,7 @@
     if (response_head_->cross_origin_opener_policy !=
             network::mojom::CrossOriginOpenerPolicy::kUnsafeNone &&
         (frame_tree_node_->pending_frame_policy().sandbox_flags !=
-         blink::mojom::WebSandboxFlags::kNone)) {
+         network::mojom::WebSandboxFlags::kNone)) {
       OnRequestFailedInternal(
           network::URLLoaderCompletionStatus(
               network::BlockedByResponseReason::
@@ -2285,8 +2286,8 @@
   // for this frame.
   bool can_create_service_worker =
       (frame_tree_node_->pending_frame_policy().sandbox_flags &
-       blink::mojom::WebSandboxFlags::kOrigin) !=
-      blink::mojom::WebSandboxFlags::kOrigin;
+       network::mojom::WebSandboxFlags::kOrigin) !=
+      network::mojom::WebSandboxFlags::kOrigin;
   if (can_create_service_worker) {
     ServiceWorkerContextWrapper* service_worker_context =
         static_cast<ServiceWorkerContextWrapper*>(
@@ -2484,7 +2485,7 @@
     CHECK_EQ(ShouldKeepErrorPageInCurrentProcess(old_net_error),
              ShouldKeepErrorPageInCurrentProcess(net_error_))
         << " Unsupported error code change in WillFailRequest(): from "
-        << net_error_ << " to " << result.net_error_code();
+        << old_net_error << " to " << net_error_;
   }
 
   CommitErrorPage(result.error_page_content());

diff --git a/content/browser/frame_host/render_frame_host_feature_policy_unittest.cc b/content/browser/frame_host/render_frame_host_feature_policy_unittest.cc
index 2fdfc52..a0bf1759 100644
--- a/content/browser/frame_host/render_frame_host_feature_policy_unittest.cc
+++ b/content/browser/frame_host/render_frame_host_feature_policy_unittest.cc

@@ -11,7 +11,6 @@
 #include "content/test/test_render_frame_host.h"
 #include "third_party/blink/public/common/feature_policy/feature_policy.h"
 #include "third_party/blink/public/common/frame/frame_policy.h"
-#include "third_party/blink/public/common/frame/sandbox_flags.h"
 #include "url/gurl.h"
 #include "url/origin.h"
 
@@ -64,7 +63,7 @@
     RenderFrameHost* current = *rfh;
     SimulateNavigation(&current, current->GetLastCommittedURL());
     static_cast<TestRenderFrameHost*>(current)->DidSetFramePolicyHeaders(
-        blink::mojom::WebSandboxFlags::kNone, CreateFPHeader(feature, values),
+        network::mojom::WebSandboxFlags::kNone, CreateFPHeader(feature, values),
         {} /* document_policy_header */);
     *rfh = current;
   }
@@ -75,7 +74,7 @@
       blink::mojom::FeaturePolicyFeature feature,
       const std::map<std::string, blink::PolicyValue>& values) {
     static_cast<TestRenderFrameHost*>(parent)->OnDidChangeFramePolicy(
-        child->GetRoutingID(), {blink::mojom::WebSandboxFlags::kNone,
+        child->GetRoutingID(), {network::mojom::WebSandboxFlags::kNone,
                                 CreateFPHeader(feature, values),
                                 {} /* required_document_policy */});
   }

diff --git a/content/browser/frame_host/render_frame_host_impl.cc b/content/browser/frame_host/render_frame_host_impl.cc
index 7654ea72..aa7828d6 100644
--- a/content/browser/frame_host/render_frame_host_impl.cc
+++ b/content/browser/frame_host/render_frame_host_impl.cc

@@ -188,8 +188,10 @@
 #include "services/device/public/mojom/wake_lock_context.mojom.h"
 #include "services/network/public/cpp/features.h"
 #include "services/network/public/cpp/is_potentially_trustworthy.h"
+#include "services/network/public/cpp/web_sandbox_flags.h"
 #include "services/network/public/cpp/wrapper_shared_url_loader_factory.h"
 #include "services/network/public/mojom/network_service.mojom.h"
+#include "services/network/public/mojom/web_sandbox_flags.mojom-shared.h"
 #include "services/service_manager/public/cpp/connector.h"
 #include "services/service_manager/public/cpp/interface_provider.h"
 #include "storage/browser/blob/blob_storage_context.h"
@@ -760,7 +762,7 @@
           nullptr,
           base::OnTaskRunnerDeleter(base::CreateSequencedTaskRunner(
               {ServiceWorkerContext::GetCoreThreadId()}))),
-      active_sandbox_flags_(blink::mojom::WebSandboxFlags::kNone),
+      active_sandbox_flags_(network::mojom::WebSandboxFlags::kNone),
       keep_alive_timeout_(base::TimeDelta::FromSeconds(30)),
       subframe_unload_timeout_(base::TimeDelta::FromMilliseconds(
           RenderViewHostImpl::kUnloadTimeoutMS)),
@@ -1373,7 +1375,7 @@
   }
 }
 
-bool RenderFrameHostImpl::IsSandboxed(blink::mojom::WebSandboxFlags flags) {
+bool RenderFrameHostImpl::IsSandboxed(network::mojom::WebSandboxFlags flags) {
   if (base::FeatureList::IsEnabled(features::kFeaturePolicyForSandbox)) {
     blink::mojom::FeaturePolicyFeature feature =
         blink::FeaturePolicy::FeatureForSandboxFlag(flags);
@@ -2332,9 +2334,9 @@
 
   // Calculate and set |new_frame_origin|.
   bool new_frame_should_be_sandboxed =
-      blink::mojom::WebSandboxFlags::kOrigin ==
+      network::mojom::WebSandboxFlags::kOrigin ==
       (frame_tree_node()->active_sandbox_flags() &
-       blink::mojom::WebSandboxFlags::kOrigin);
+       network::mojom::WebSandboxFlags::kOrigin);
   url::Origin new_frame_origin = new_frame_should_be_sandboxed
                                      ? new_frame_creator.DeriveNewOpaqueOrigin()
                                      : new_frame_creator;
@@ -3473,7 +3475,7 @@
 }
 
 void RenderFrameHostImpl::DidSetFramePolicyHeaders(
-    blink::mojom::WebSandboxFlags sandbox_flags,
+    network::mojom::WebSandboxFlags sandbox_flags,
     const blink::ParsedFeaturePolicy& feature_policy_header,
     const blink::DocumentPolicy::FeatureState& document_policy_header) {
   if (!is_active())

diff --git a/content/browser/frame_host/render_frame_host_impl.h b/content/browser/frame_host/render_frame_host_impl.h
index b222465..489e3d1b 100644
--- a/content/browser/frame_host/render_frame_host_impl.h
+++ b/content/browser/frame_host/render_frame_host_impl.h

@@ -346,7 +346,7 @@
   void MarkIsolatedWorldsAsRequiringSeparateURLLoaderFactory(
       base::flat_set<url::Origin> isolated_world_origins,
       bool push_to_renderer_now) override;
-  bool IsSandboxed(blink::mojom::WebSandboxFlags flags) override;
+  bool IsSandboxed(network::mojom::WebSandboxFlags flags) override;
   void FlushNetworkAndNavigationInterfacesForTesting() override;
   void PrepareForInnerWebContentsAttach(
       PrepareForInnerWebContentsAttachCallback callback) override;
@@ -961,7 +961,7 @@
   }
   void SetKeepAliveTimeoutForTesting(base::TimeDelta timeout);
 
-  blink::mojom::WebSandboxFlags active_sandbox_flags() {
+  network::mojom::WebSandboxFlags active_sandbox_flags() {
     return active_sandbox_flags_;
   }
 
@@ -1714,7 +1714,7 @@
   void DidChangeName(const std::string& name,
                      const std::string& unique_name) override;
   void DidSetFramePolicyHeaders(
-      blink::mojom::WebSandboxFlags sandbox_flags,
+      network::mojom::WebSandboxFlags sandbox_flags,
       const blink::ParsedFeaturePolicy& feature_policy_header,
       const blink::DocumentPolicy::FeatureState& document_policy_header)
       override;
@@ -2526,7 +2526,7 @@
   // copy of the active sandbox flags which are stored in the FrameTreeNode for
   // this RenderFrameHost, but may diverge if this RenderFrameHost is pending
   // deletion.
-  blink::mojom::WebSandboxFlags active_sandbox_flags_;
+  network::mojom::WebSandboxFlags active_sandbox_flags_;
 
   // Tracks the document policy which has been set on this frame.
   std::unique_ptr<blink::DocumentPolicy> document_policy_;

diff --git a/content/browser/frame_host/render_frame_host_manager_unittest.cc b/content/browser/frame_host/render_frame_host_manager_unittest.cc
index 617e66d8..b3a9275 100644
--- a/content/browser/frame_host/render_frame_host_manager_unittest.cc
+++ b/content/browser/frame_host/render_frame_host_manager_unittest.cc

@@ -3241,7 +3241,7 @@
   TestRenderFrameHost* initial_rfh = main_test_rfh();
 
   // The RFH should start out with an empty frame policy.
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             initial_rfh->frame_tree_node()->active_sandbox_flags());
 
   // Navigate cross-site but don't commit the navigation.
@@ -3250,16 +3250,16 @@
   navigation_to_kUrl2->ReadyToCommit();
 
   // Now send the frame policy for the initial page.
-  initial_rfh->SendFramePolicy(blink::mojom::WebSandboxFlags::kAll,
+  initial_rfh->SendFramePolicy(network::mojom::WebSandboxFlags::kAll,
                                {} /* feature_policy_header */,
                                {} /* document_policy_header */);
   // Verify that the policy landed in the frame tree.
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kAll,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kAll,
             initial_rfh->frame_tree_node()->active_sandbox_flags());
 
   // Commit the naviagation; the new frame should have a clear frame policy.
   navigation_to_kUrl2->Commit();
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             main_test_rfh()->frame_tree_node()->active_sandbox_flags());
 }
 

diff --git a/content/browser/frame_host/render_frame_proxy_host.cc b/content/browser/frame_host/render_frame_proxy_host.cc
index a252e1b..13004be04 100644
--- a/content/browser/frame_host/render_frame_proxy_host.cc
+++ b/content/browser/frame_host/render_frame_proxy_host.cc

@@ -32,6 +32,7 @@
 #include "content/public/common/content_features.h"
 #include "ipc/ipc_message.h"
 #include "mojo/public/cpp/bindings/pending_associated_receiver.h"
+#include "services/network/public/cpp/web_sandbox_flags.h"
 #include "third_party/blink/public/common/associated_interfaces/associated_interface_provider.h"
 #include "third_party/blink/public/mojom/frame/frame_owner_properties.mojom.h"
 #include "third_party/blink/public/mojom/scroll/scroll_into_view_params.mojom.h"
@@ -423,8 +424,8 @@
       current_rfh, params.user_gesture, &download_policy);
 
   if ((frame_tree_node_->pending_frame_policy().sandbox_flags &
-       blink::mojom::WebSandboxFlags::kDownloads) !=
-      blink::mojom::WebSandboxFlags::kNone) {
+       network::mojom::WebSandboxFlags::kDownloads) !=
+      network::mojom::WebSandboxFlags::kNone) {
     if (download_policy.blocking_downloads_in_sandbox_enabled) {
       download_policy.SetDisallowed(content::NavigationDownloadType::kSandbox);
     } else {

diff --git a/content/browser/frame_host/sandbox_flags.md b/content/browser/frame_host/sandbox_flags.md
new file mode 100644
index 0000000..e65f317e
--- /dev/null
+++ b/content/browser/frame_host/sandbox_flags.md

@@ -0,0 +1,29 @@
+The sandbox policy
+------------------
+
+The sandbox policy determines a set of capabilities a document will have.
+It is defined in two types of objects:
+- The frame.
+- The document.
+
+The frame policy is parsed from the <iframe>’s sandbox attribute.
+Example: <iframe sandbox="allow-script allow-origin">
+
+The document policy is parsed from the HTTP Content-Security-Policy header.
+Example: Content-Security-Policy: sandbox allow-script allow-origin
+
+On top of that, the sandbox policy is inherited from:
+- The frame to its document.
+- The document to its children frames.
+- The document to its opened windows’s main frame.
+
+The distinction between a frame and a document is important. The document is
+replaced after navigations, but the frame stays.
+
+The sandbox policy is bit field. The sandbox flags are defined by:
+/services/network/public/mojom/web_sandbox_flags.mojom
+Multiple sandbox policy are combined using a bitwise AND in the bitfield. This
+way, the policy can only be further restricted.
+
+Specification:
+- http://www.whatwg.org/specs/web-apps/current-work/#attr-iframe-sandbox

diff --git a/content/browser/media/session/media_session_impl_visibility_browsertest.cc b/content/browser/media/session/media_session_impl_visibility_browsertest.cc
index 799bb554..8e9edce 100644
--- a/content/browser/media/session/media_session_impl_visibility_browsertest.cc
+++ b/content/browser/media/session/media_session_impl_visibility_browsertest.cc

@@ -94,10 +94,8 @@
 
     VisibilityTestData params = GetVisibilityTestData();
 
-    if (params.media_suspend == MediaSuspend::ENABLED)
-      command_line->AppendSwitch(switches::kEnableMediaSuspend);
-    else
-      command_line->AppendSwitch(switches::kDisableMediaSuspend);
+    if (params.media_suspend == MediaSuspend::DISABLED)
+      command_line->AppendSwitch(switches::kDisableBackgroundMediaSuspend);
   }
 
   const VisibilityTestData& GetVisibilityTestData() {

diff --git a/content/browser/renderer_host/render_process_host_impl.cc b/content/browser/renderer_host/render_process_host_impl.cc
index 8d00b84..54026247 100644
--- a/content/browser/renderer_host/render_process_host_impl.cc
+++ b/content/browser/renderer_host/render_process_host_impl.cc

@@ -3228,7 +3228,7 @@
     switches::kDisableHistogramCustomizer,
     switches::kDisableLCDText,
     switches::kDisableLogging,
-    switches::kDisableMediaSuspend,
+    switches::kDisableBackgroundMediaSuspend,
     switches::kDisableNotifications,
     switches::kDisableOopRasterization,
     switches::kEnableDeJelly,
@@ -3259,7 +3259,6 @@
     switches::kEnableGpuMemoryBufferVideoFrames,
     switches::kEnableGPUServiceLogging,
     switches::kEnableLowResTiling,
-    switches::kEnableMediaSuspend,
     switches::kEnableLCDText,
     switches::kEnableLogging,
     switches::kEnableNetworkInformationDownlinkMax,

diff --git a/content/browser/service_worker/service_worker_resource_ops.cc b/content/browser/service_worker/service_worker_resource_ops.cc
index eec4a701..c8bcb5b 100644
--- a/content/browser/service_worker/service_worker_resource_ops.cc
+++ b/content/browser/service_worker/service_worker_resource_ops.cc

@@ -48,7 +48,8 @@
   const net::HttpResponseInfo* http_info = buffer->http_info.get();
   if (!http_info) {
     DCHECK_LT(status, 0);
-    std::move(callback).Run(status, /*response_head=*/nullptr);
+    std::move(callback).Run(status, /*response_head=*/nullptr,
+                            /*metadata=*/base::nullopt);
     return;
   }
 
@@ -73,7 +74,13 @@
   head->cert_status = http_info->ssl_info.cert_status;
   head->ssl_info = http_info->ssl_info;
 
-  std::move(callback).Run(status, std::move(head));
+  base::Optional<mojo_base::BigBuffer> metadata;
+  if (http_info->metadata) {
+    metadata = mojo_base::BigBuffer(base::as_bytes(base::make_span(
+        http_info->metadata->data(), http_info->metadata->size())));
+  }
+
+  std::move(callback).Run(status, std::move(head), std::move(metadata));
 }
 
 }  // namespace
@@ -254,4 +261,22 @@
   writer_->WriteData(buffer.get(), buf_len, std::move(callback));
 }
 
+ServiceWorkerResourceMetadataWriterImpl::
+    ServiceWorkerResourceMetadataWriterImpl(
+        std::unique_ptr<ServiceWorkerResponseMetadataWriter> writer)
+    : writer_(std::move(writer)) {
+  DCHECK(writer_);
+}
+
+ServiceWorkerResourceMetadataWriterImpl::
+    ~ServiceWorkerResourceMetadataWriterImpl() = default;
+
+void ServiceWorkerResourceMetadataWriterImpl::WriteMetadata(
+    mojo_base::BigBuffer data,
+    WriteMetadataCallback callback) {
+  int buf_len = data.size();
+  auto buffer = base::MakeRefCounted<BigIOBuffer>(std::move(data));
+  writer_->WriteMetadata(buffer.get(), buf_len, std::move(callback));
+}
+
 }  // namespace content

diff --git a/content/browser/service_worker/service_worker_resource_ops.h b/content/browser/service_worker/service_worker_resource_ops.h
index 5584550c..3a45fa8b 100644
--- a/content/browser/service_worker/service_worker_resource_ops.h
+++ b/content/browser/service_worker/service_worker_resource_ops.h

@@ -72,6 +72,32 @@
   const std::unique_ptr<ServiceWorkerResponseWriter> writer_;
 };
 
+// The implementation of storage::mojom::ServiceWorkerResourceMetadataWriter.
+// Currently this class is an adaptor that uses
+// ServiceWorkerResponseMetadataWriter internally.
+// TODO(crbug.com/1055677): Fork the implementation of
+// ServiceWorkerResponseMetadataWriter and stop using it.
+class ServiceWorkerResourceMetadataWriterImpl
+    : public storage::mojom::ServiceWorkerResourceMetadataWriter {
+ public:
+  explicit ServiceWorkerResourceMetadataWriterImpl(
+      std::unique_ptr<ServiceWorkerResponseMetadataWriter> writer);
+
+  ServiceWorkerResourceMetadataWriterImpl(
+      const ServiceWorkerResourceMetadataWriterImpl&) = delete;
+  ServiceWorkerResourceMetadataWriterImpl& operator=(
+      const ServiceWorkerResourceMetadataWriterImpl&) = delete;
+
+  ~ServiceWorkerResourceMetadataWriterImpl() override;
+
+ private:
+  // storage::mojom::ServiceWorkerResourceMetadataWriter implementations:
+  void WriteMetadata(mojo_base::BigBuffer data,
+                     WriteMetadataCallback callback) override;
+
+  const std::unique_ptr<ServiceWorkerResponseMetadataWriter> writer_;
+};
+
 }  // namespace content
 
 #endif  // CONTENT_BROWSER_SERVICE_WORKER_SERVICE_WORKER_RESOURCE_OPS_H_

diff --git a/content/browser/service_worker/service_worker_storage_control_impl.cc b/content/browser/service_worker/service_worker_storage_control_impl.cc
index a1ddd99..f990c01 100644
--- a/content/browser/service_worker/service_worker_storage_control_impl.cc
+++ b/content/browser/service_worker/service_worker_storage_control_impl.cc

@@ -163,4 +163,15 @@
                               std::move(writer));
 }
 
+void ServiceWorkerStorageControlImpl::CreateResourceMetadataWriter(
+    int64_t resource_id,
+    mojo::PendingReceiver<storage::mojom::ServiceWorkerResourceMetadataWriter>
+        writer) {
+  DCHECK_NE(resource_id, blink::mojom::kInvalidServiceWorkerResourceId);
+  mojo::MakeSelfOwnedReceiver(
+      std::make_unique<ServiceWorkerResourceMetadataWriterImpl>(
+          storage_->CreateResponseMetadataWriter(resource_id)),
+      std::move(writer));
+}
+
 }  // namespace content

diff --git a/content/browser/service_worker/service_worker_storage_control_impl.h b/content/browser/service_worker/service_worker_storage_control_impl.h
index 058180a1..77a455f 100644
--- a/content/browser/service_worker/service_worker_storage_control_impl.h
+++ b/content/browser/service_worker/service_worker_storage_control_impl.h

@@ -65,6 +65,10 @@
       int64_t resource_id,
       mojo::PendingReceiver<storage::mojom::ServiceWorkerResourceWriter> writer)
       override;
+  void CreateResourceMetadataWriter(
+      int64_t resource_id,
+      mojo::PendingReceiver<storage::mojom::ServiceWorkerResourceMetadataWriter>
+          writer) override;
 
   const std::unique_ptr<ServiceWorkerStorage> storage_;
 };

diff --git a/content/browser/service_worker/service_worker_storage_control_impl_unittest.cc b/content/browser/service_worker/service_worker_storage_control_impl_unittest.cc
index 771d8f5b..82ec1bd5 100644
--- a/content/browser/service_worker/service_worker_storage_control_impl_unittest.cc
+++ b/content/browser/service_worker/service_worker_storage_control_impl_unittest.cc

@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include <string.h>
+
 #include "content/browser/service_worker/service_worker_storage_control_impl.h"
 
 #include "base/containers/span.h"
@@ -29,13 +31,16 @@
 namespace {
 
 int ReadResponseHead(storage::mojom::ServiceWorkerResourceReader* reader,
-                     network::mojom::URLResponseHeadPtr& out_response_head) {
+                     network::mojom::URLResponseHeadPtr& out_response_head,
+                     base::Optional<mojo_base::BigBuffer>& out_metadata) {
   int return_value;
   base::RunLoop loop;
   reader->ReadResponseHead(base::BindLambdaForTesting(
-      [&](int result, network::mojom::URLResponseHeadPtr response_head) {
+      [&](int result, network::mojom::URLResponseHeadPtr response_head,
+          base::Optional<mojo_base::BigBuffer> metadata) {
         return_value = result;
         out_response_head = std::move(response_head);
+        out_metadata = std::move(metadata);
         loop.Quit();
       }));
   loop.Run();
@@ -83,6 +88,20 @@
   return return_value;
 }
 
+int WriteResponseMetadata(
+    storage::mojom::ServiceWorkerResourceMetadataWriter* writer,
+    mojo_base::BigBuffer metadata) {
+  int return_value;
+  base::RunLoop loop;
+  writer->WriteMetadata(std::move(metadata),
+                        base::BindLambdaForTesting([&](int result) {
+                          return_value = result;
+                          loop.Quit();
+                        }));
+  loop.Run();
+  return return_value;
+}
+
 }  // namespace
 
 class ServiceWorkerStorageControlImplTest : public testing::Test {
@@ -271,6 +290,14 @@
     return writer;
   }
 
+  mojo::Remote<storage::mojom::ServiceWorkerResourceMetadataWriter>
+  CreateResourceMetadataWriter(int64_t resource_id) {
+    mojo::Remote<storage::mojom::ServiceWorkerResourceMetadataWriter> writer;
+    storage()->CreateResourceMetadataWriter(
+        resource_id, writer.BindNewPipeAndPassReceiver());
+    return writer;
+  }
+
  private:
   base::ScopedTempDir user_data_directory_;
   BrowserTaskEnvironment task_environment_;
@@ -472,10 +499,12 @@
   mojo::Remote<storage::mojom::ServiceWorkerResourceReader> reader =
       CreateResourceReader(resource_id);
 
-  // Read the response head and the content.
+  // Read the response head, metadata and the content.
   {
     network::mojom::URLResponseHeadPtr response_head;
-    int result = ReadResponseHead(reader.get(), response_head);
+    base::Optional<mojo_base::BigBuffer> response_metadata;
+    int result =
+        ReadResponseHead(reader.get(), response_head, response_metadata);
     ASSERT_GT(result, 0);
 
     EXPECT_EQ(response_head->mime_type, "application/javascript");
@@ -483,12 +512,37 @@
     EXPECT_TRUE(response_head->ssl_info->is_valid());
     EXPECT_EQ(response_head->ssl_info->cert->serial_number(),
               ssl_info.cert->serial_number());
+    EXPECT_EQ(response_metadata, base::nullopt);
 
     std::string data = ReadResponseData(reader.get(), data_size);
     EXPECT_EQ(data, kData);
   }
 
-  // TODO(crbug.com/1055677): Write metadata, read it then check the metadata.
+  const auto kMetadata = base::as_bytes(base::make_span("metadata"));
+  int metadata_size = kMetadata.size();
+
+  // Write metadata.
+  {
+    mojo::Remote<storage::mojom::ServiceWorkerResourceMetadataWriter>
+        metadata_writer = CreateResourceMetadataWriter(resource_id);
+    int result = WriteResponseMetadata(metadata_writer.get(),
+                                       mojo_base::BigBuffer(kMetadata));
+    ASSERT_EQ(result, metadata_size);
+  }
+
+  // Read the response head again. This time metadata should be read.
+  {
+    network::mojom::URLResponseHeadPtr response_head;
+    base::Optional<mojo_base::BigBuffer> response_metadata;
+    int result =
+        ReadResponseHead(reader.get(), response_head, response_metadata);
+    ASSERT_GT(result, 0);
+    ASSERT_TRUE(response_metadata.has_value());
+    EXPECT_EQ(response_metadata->size(), kMetadata.size());
+    EXPECT_EQ(
+        memcmp(response_metadata->data(), kMetadata.data(), kMetadata.size()),
+        0);
+  }
 }
 
 }  // namespace content

diff --git a/content/browser/site_per_process_browsertest.cc b/content/browser/site_per_process_browsertest.cc
index 40485a6..cc00046 100644
--- a/content/browser/site_per_process_browsertest.cc
+++ b/content/browser/site_per_process_browsertest.cc

@@ -117,12 +117,13 @@
 #include "net/test/embedded_test_server/http_response.h"
 #include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
 #include "services/network/public/cpp/features.h"
+#include "services/network/public/cpp/web_sandbox_flags.h"
+#include "services/network/public/mojom/web_sandbox_flags.mojom-shared.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/blink/public/common/feature_policy/feature_policy.h"
 #include "third_party/blink/public/common/feature_policy/policy_value.h"
 #include "third_party/blink/public/common/features.h"
-#include "third_party/blink/public/common/frame/sandbox_flags.h"
 #include "third_party/blink/public/common/input/web_input_event.h"
 #include "third_party/blink/public/mojom/frame/frame.mojom-test-utils.h"
 #include "third_party/blink/public/mojom/security_context/insecure_request_policy.mojom.h"
@@ -4321,13 +4322,13 @@
   EXPECT_EQ(baz_url, observer.last_navigation_url());
 
   // Both frames should not be sandboxed to start with.
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             root->child_at(0)->pending_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             root->child_at(0)->effective_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             root->child_at(1)->pending_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             root->child_at(1)->effective_frame_policy().sandbox_flags);
 
   // Dynamically update sandbox flags for the first frame.
@@ -4340,13 +4341,13 @@
   // flags, because sandbox flag updates take place only after navigations.
   // "allow-scripts" resets both SandboxFlags::Scripts and
   // SandboxFlags::AutomaticFeatures bits per blink::parseSandboxPolicy().
-  blink::mojom::WebSandboxFlags expected_flags =
-      blink::mojom::WebSandboxFlags::kAll &
-      ~blink::mojom::WebSandboxFlags::kScripts &
-      ~blink::mojom::WebSandboxFlags::kAutomaticFeatures;
+  network::mojom::WebSandboxFlags expected_flags =
+      network::mojom::WebSandboxFlags::kAll &
+      ~network::mojom::WebSandboxFlags::kScripts &
+      ~network::mojom::WebSandboxFlags::kAutomaticFeatures;
   EXPECT_EQ(expected_flags,
             root->child_at(0)->pending_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             root->child_at(0)->effective_frame_policy().sandbox_flags);
 
   // Navigate the first frame to a page on the same site.  The new sandbox
@@ -4438,13 +4439,13 @@
 
   // Check that the current sandbox flags are updated but the effective
   // sandbox flags are not.
-  blink::mojom::WebSandboxFlags expected_flags =
-      blink::mojom::WebSandboxFlags::kAll &
-      ~blink::mojom::WebSandboxFlags::kScripts &
-      ~blink::mojom::WebSandboxFlags::kAutomaticFeatures;
+  network::mojom::WebSandboxFlags expected_flags =
+      network::mojom::WebSandboxFlags::kAll &
+      ~network::mojom::WebSandboxFlags::kScripts &
+      ~network::mojom::WebSandboxFlags::kAutomaticFeatures;
   EXPECT_EQ(expected_flags,
             root->child_at(1)->pending_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             root->child_at(1)->effective_frame_policy().sandbox_flags);
 
   // Navigate the second subframe to a page on bar.com.  This will trigger a
@@ -4491,9 +4492,9 @@
             root->child_at(0)->current_url());
 
   // The frame should not be sandboxed to start with.
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             root->child_at(0)->pending_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             root->child_at(0)->effective_frame_policy().sandbox_flags);
 
   // Dynamically update the frame's sandbox flags.
@@ -4506,13 +4507,13 @@
   // because sandbox flag updates take place only after navigations.
   // "allow-scripts" resets both SandboxFlags::Scripts and
   // SandboxFlags::AutomaticFeatures bits per blink::parseSandboxPolicy().
-  blink::mojom::WebSandboxFlags expected_flags =
-      blink::mojom::WebSandboxFlags::kAll &
-      ~blink::mojom::WebSandboxFlags::kScripts &
-      ~blink::mojom::WebSandboxFlags::kAutomaticFeatures;
+  network::mojom::WebSandboxFlags expected_flags =
+      network::mojom::WebSandboxFlags::kAll &
+      ~network::mojom::WebSandboxFlags::kScripts &
+      ~network::mojom::WebSandboxFlags::kAutomaticFeatures;
   EXPECT_EQ(expected_flags,
             root->child_at(0)->pending_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             root->child_at(0)->effective_frame_policy().sandbox_flags);
 
   // Perform a renderer-initiated same-site navigation in the first frame. The
@@ -4599,13 +4600,14 @@
             EvalJs(bottom_child, "Array.from(location.ancestorOrigins);"));
 
   // Check that the sandbox flags in the browser process are correct.
-  // "allow-scripts" resets both WebSandboxFlags::Scripts and
-  // WebSandboxFlags::AutomaticFeatures bits per blink::parseSandboxPolicy().
-  blink::mojom::WebSandboxFlags expected_flags =
-      blink::mojom::WebSandboxFlags::kAll &
-      ~blink::mojom::WebSandboxFlags::kScripts &
-      ~blink::mojom::WebSandboxFlags::kAutomaticFeatures &
-      ~blink::mojom::WebSandboxFlags::kOrigin;
+  // "allow-scripts" resets both network::mojom::WebSandboxFlags::Scripts and
+  // network::mojom::WebSandboxFlags::AutomaticFeatures bits per
+  // blink::parseSandboxPolicy().
+  network::mojom::WebSandboxFlags expected_flags =
+      network::mojom::WebSandboxFlags::kAll &
+      ~network::mojom::WebSandboxFlags::kScripts &
+      ~network::mojom::WebSandboxFlags::kAutomaticFeatures &
+      ~network::mojom::WebSandboxFlags::kOrigin;
   EXPECT_EQ(expected_flags,
             root->child_at(1)->effective_frame_policy().sandbox_flags);
 
@@ -6642,15 +6644,16 @@
       root, "document.querySelector('iframe').sandbox = 'allow-scripts';"));
 
   // Calculate expected flags.  Note that "allow-scripts" resets both
-  // WebSandboxFlags::Scripts and WebSandboxFlags::AutomaticFeatures bits per
+  // network::mojom::WebSandboxFlags::Scripts and
+  // network::mojom::WebSandboxFlags::AutomaticFeatures bits per
   // blink::parseSandboxPolicy().
-  blink::mojom::WebSandboxFlags expected_flags =
-      blink::mojom::WebSandboxFlags::kAll &
-      ~blink::mojom::WebSandboxFlags::kScripts &
-      ~blink::mojom::WebSandboxFlags::kAutomaticFeatures;
+  network::mojom::WebSandboxFlags expected_flags =
+      network::mojom::WebSandboxFlags::kAll &
+      ~network::mojom::WebSandboxFlags::kScripts &
+      ~network::mojom::WebSandboxFlags::kAutomaticFeatures;
   EXPECT_EQ(expected_flags,
             root->child_at(0)->pending_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             root->child_at(0)->effective_frame_policy().sandbox_flags);
 
   // Navigate child frame so that the sandbox flags take effect.  Use a page
@@ -6697,13 +6700,13 @@
 
   // These flags should be pending but not take effect, since there's been no
   // navigation.
-  blink::mojom::WebSandboxFlags expected_flags =
-      blink::mojom::WebSandboxFlags::kAll &
-      ~blink::mojom::WebSandboxFlags::kScripts &
-      ~blink::mojom::WebSandboxFlags::kAutomaticFeatures;
+  network::mojom::WebSandboxFlags expected_flags =
+      network::mojom::WebSandboxFlags::kAll &
+      ~network::mojom::WebSandboxFlags::kScripts &
+      ~network::mojom::WebSandboxFlags::kAutomaticFeatures;
   FrameTreeNode* child = root->child_at(0);
   EXPECT_EQ(expected_flags, child->pending_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             child->effective_frame_policy().sandbox_flags);
 
   // Add a new grandchild frame and navigate it cross-site.
@@ -6720,9 +6723,9 @@
 
   // Since the update flags haven't yet taken effect in its parent, this
   // grandchild frame should not be sandboxed.
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             grandchild->pending_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             grandchild->effective_frame_policy().sandbox_flags);
 
   // Check that the grandchild frame isn't sandboxed on the renderer side.  If
@@ -6749,13 +6752,14 @@
                      "    'allow-scripts allow-popups';"));
 
   // Calculate expected flags.  Note that "allow-scripts" resets both
-  // WebSandboxFlags::Scripts and WebSandboxFlags::AutomaticFeatures bits per
+  // network::mojom::WebSandboxFlags::Scripts and
+  // network::mojom::WebSandboxFlags::AutomaticFeatures bits per
   // blink::parseSandboxPolicy().
-  blink::mojom::WebSandboxFlags expected_flags =
-      blink::mojom::WebSandboxFlags::kAll &
-      ~blink::mojom::WebSandboxFlags::kScripts &
-      ~blink::mojom::WebSandboxFlags::kAutomaticFeatures &
-      ~blink::mojom::WebSandboxFlags::kPopups;
+  network::mojom::WebSandboxFlags expected_flags =
+      network::mojom::WebSandboxFlags::kAll &
+      ~network::mojom::WebSandboxFlags::kScripts &
+      ~network::mojom::WebSandboxFlags::kAutomaticFeatures &
+      ~network::mojom::WebSandboxFlags::kPopups;
   EXPECT_EQ(expected_flags,
             root->child_at(0)->pending_frame_policy().sandbox_flags);
 
@@ -6859,14 +6863,15 @@
       "    'allow-scripts allow-popups allow-popups-to-escape-sandbox';"));
 
   // Set expected flags for the child frame.  Note that "allow-scripts" resets
-  // both WebSandboxFlags::Scripts and WebSandboxFlags::AutomaticFeatures bits
-  // per blink::parseSandboxPolicy().
-  blink::mojom::WebSandboxFlags expected_flags =
-      blink::mojom::WebSandboxFlags::kAll &
-      ~blink::mojom::WebSandboxFlags::kScripts &
-      ~blink::mojom::WebSandboxFlags::kAutomaticFeatures &
-      ~blink::mojom::WebSandboxFlags::kPopups &
-      ~blink::mojom::WebSandboxFlags::kPropagatesToAuxiliaryBrowsingContexts;
+  // both network::mojom::WebSandboxFlags::Scripts and
+  // network::mojom::WebSandboxFlags::AutomaticFeatures bits per
+  // blink::parseSandboxPolicy().
+  network::mojom::WebSandboxFlags expected_flags =
+      network::mojom::WebSandboxFlags::kAll &
+      ~network::mojom::WebSandboxFlags::kScripts &
+      ~network::mojom::WebSandboxFlags::kAutomaticFeatures &
+      ~network::mojom::WebSandboxFlags::kPopups &
+      ~network::mojom::WebSandboxFlags::kPropagatesToAuxiliaryBrowsingContexts;
   EXPECT_EQ(expected_flags,
             root->child_at(0)->pending_frame_policy().sandbox_flags);
 
@@ -6890,7 +6895,7 @@
 
   // Check that the sandbox flags for new popup are correct in the browser
   // process.  They should not have been inherited.
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             foo_root->effective_frame_policy().sandbox_flags);
 
   // The popup's origin should match |b_url|, since it's not sandboxed.
@@ -7204,7 +7209,7 @@
     // navigation.
     EXPECT_EQ(c_url.GetOrigin().spec(),
               root->child_at(0)->current_origin().Serialize() + "/");
-    EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+    EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
               root->child_at(0)->effective_frame_policy().sandbox_flags);
   }
 }
@@ -11251,38 +11256,38 @@
 
   // Main page is served with a CSP header applying sandbox flags allow-popups,
   // allow-pointer-lock and allow-scripts.
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             root->pending_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             root->effective_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kAll &
-                ~blink::mojom::WebSandboxFlags::kPopups &
-                ~blink::mojom::WebSandboxFlags::kPointerLock &
-                ~blink::mojom::WebSandboxFlags::kScripts &
-                ~blink::mojom::WebSandboxFlags::kAutomaticFeatures,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kAll &
+                ~network::mojom::WebSandboxFlags::kPopups &
+                ~network::mojom::WebSandboxFlags::kPointerLock &
+                ~network::mojom::WebSandboxFlags::kScripts &
+                ~network::mojom::WebSandboxFlags::kAutomaticFeatures,
             root->active_sandbox_flags());
 
   // Child frame has iframe sandbox flags allow-popups, allow-scripts, and
   // allow-orientation-lock. It should receive the intersection of those with
   // the parent sandbox flags: allow-popups and allow-scripts.
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kAll &
-                ~blink::mojom::WebSandboxFlags::kPopups &
-                ~blink::mojom::WebSandboxFlags::kScripts &
-                ~blink::mojom::WebSandboxFlags::kAutomaticFeatures,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kAll &
+                ~network::mojom::WebSandboxFlags::kPopups &
+                ~network::mojom::WebSandboxFlags::kScripts &
+                ~network::mojom::WebSandboxFlags::kAutomaticFeatures,
             root->child_at(0)->pending_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kAll &
-                ~blink::mojom::WebSandboxFlags::kPopups &
-                ~blink::mojom::WebSandboxFlags::kScripts &
-                ~blink::mojom::WebSandboxFlags::kAutomaticFeatures,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kAll &
+                ~network::mojom::WebSandboxFlags::kPopups &
+                ~network::mojom::WebSandboxFlags::kScripts &
+                ~network::mojom::WebSandboxFlags::kAutomaticFeatures,
             root->child_at(0)->effective_frame_policy().sandbox_flags);
 
   // Document in child frame is served with a CSP header giving sandbox flags
   // allow-scripts, allow-popups and allow-pointer-lock. The final effective
   // flags should only include allow-scripts and allow-popups.
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kAll &
-                ~blink::mojom::WebSandboxFlags::kPopups &
-                ~blink::mojom::WebSandboxFlags::kScripts &
-                ~blink::mojom::WebSandboxFlags::kAutomaticFeatures,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kAll &
+                ~network::mojom::WebSandboxFlags::kPopups &
+                ~network::mojom::WebSandboxFlags::kScripts &
+                ~network::mojom::WebSandboxFlags::kAutomaticFeatures,
             root->child_at(0)->active_sandbox_flags());
 
   // Navigate the child frame to a new page. This should clear any CSP-applied
@@ -11295,20 +11300,20 @@
 
   // Navigating should reset the sandbox flags to the frame owner flags:
   // allow-popups and allow-scripts.
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kAll &
-                ~blink::mojom::WebSandboxFlags::kPopups &
-                ~blink::mojom::WebSandboxFlags::kScripts &
-                ~blink::mojom::WebSandboxFlags::kAutomaticFeatures,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kAll &
+                ~network::mojom::WebSandboxFlags::kPopups &
+                ~network::mojom::WebSandboxFlags::kScripts &
+                ~network::mojom::WebSandboxFlags::kAutomaticFeatures,
             root->child_at(0)->active_sandbox_flags());
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kAll &
-                ~blink::mojom::WebSandboxFlags::kPopups &
-                ~blink::mojom::WebSandboxFlags::kScripts &
-                ~blink::mojom::WebSandboxFlags::kAutomaticFeatures,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kAll &
+                ~network::mojom::WebSandboxFlags::kPopups &
+                ~network::mojom::WebSandboxFlags::kScripts &
+                ~network::mojom::WebSandboxFlags::kAutomaticFeatures,
             root->child_at(0)->pending_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kAll &
-                ~blink::mojom::WebSandboxFlags::kPopups &
-                ~blink::mojom::WebSandboxFlags::kScripts &
-                ~blink::mojom::WebSandboxFlags::kAutomaticFeatures,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kAll &
+                ~network::mojom::WebSandboxFlags::kPopups &
+                ~network::mojom::WebSandboxFlags::kScripts &
+                ~network::mojom::WebSandboxFlags::kAutomaticFeatures,
             root->child_at(0)->effective_frame_policy().sandbox_flags);
 }
 
@@ -11328,11 +11333,11 @@
       static_cast<WebContentsImpl*>(shell()->web_contents())->GetMainFrame();
 
   // Check sandbox flags on RFH before navigating away.
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kAll &
-                ~blink::mojom::WebSandboxFlags::kPopups &
-                ~blink::mojom::WebSandboxFlags::kPointerLock &
-                ~blink::mojom::WebSandboxFlags::kScripts &
-                ~blink::mojom::WebSandboxFlags::kAutomaticFeatures,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kAll &
+                ~network::mojom::WebSandboxFlags::kPopups &
+                ~network::mojom::WebSandboxFlags::kPointerLock &
+                ~network::mojom::WebSandboxFlags::kScripts &
+                ~network::mojom::WebSandboxFlags::kAutomaticFeatures,
             rfh->active_sandbox_flags());
 
   // Set up a slow unload handler to force the RFH to linger in the unloaded but
@@ -11357,15 +11362,15 @@
   ASSERT_FALSE(rfh_observer.deleted());
 
   // Check sandbox flags on old RFH -- they should be unchanged.
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kAll &
-                ~blink::mojom::WebSandboxFlags::kPopups &
-                ~blink::mojom::WebSandboxFlags::kPointerLock &
-                ~blink::mojom::WebSandboxFlags::kScripts &
-                ~blink::mojom::WebSandboxFlags::kAutomaticFeatures,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kAll &
+                ~network::mojom::WebSandboxFlags::kPopups &
+                ~network::mojom::WebSandboxFlags::kPointerLock &
+                ~network::mojom::WebSandboxFlags::kScripts &
+                ~network::mojom::WebSandboxFlags::kAutomaticFeatures,
             rfh->active_sandbox_flags());
 
   // The FrameTreeNode should have flags which represent the new state.
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             root->effective_frame_policy().sandbox_flags);
 }
 
@@ -11432,9 +11437,9 @@
   // The child of the sandboxed frame should've inherited sandbox flags, so it
   // should not be able to create popups.
   EXPECT_EQ(
-      blink::mojom::WebSandboxFlags::kAll &
-          ~blink::mojom::WebSandboxFlags::kScripts &
-          ~blink::mojom::WebSandboxFlags::kAutomaticFeatures,
+      network::mojom::WebSandboxFlags::kAll &
+          ~network::mojom::WebSandboxFlags::kScripts &
+          ~network::mojom::WebSandboxFlags::kAutomaticFeatures,
       root->child_at(0)->child_at(0)->effective_frame_policy().sandbox_flags);
   EXPECT_EQ(
       root->child_at(0)->child_at(0)->active_sandbox_flags(),
@@ -11467,9 +11472,9 @@
   // The child of the sandboxed frame should've inherited sandbox flags, so it
   // should not be able to create popups.
   EXPECT_EQ(
-      blink::mojom::WebSandboxFlags::kAll &
-          ~blink::mojom::WebSandboxFlags::kScripts &
-          ~blink::mojom::WebSandboxFlags::kAutomaticFeatures,
+      network::mojom::WebSandboxFlags::kAll &
+          ~network::mojom::WebSandboxFlags::kScripts &
+          ~network::mojom::WebSandboxFlags::kAutomaticFeatures,
       root->child_at(0)->child_at(0)->effective_frame_policy().sandbox_flags);
   EXPECT_EQ(
       root->child_at(0)->child_at(0)->active_sandbox_flags(),
@@ -11520,9 +11525,9 @@
   // The child of the sandboxed frame should've inherited sandbox flags, so it
   // should not be able to create popups.
   EXPECT_EQ(
-      blink::mojom::WebSandboxFlags::kAll &
-          ~blink::mojom::WebSandboxFlags::kScripts &
-          ~blink::mojom::WebSandboxFlags::kAutomaticFeatures,
+      network::mojom::WebSandboxFlags::kAll &
+          ~network::mojom::WebSandboxFlags::kScripts &
+          ~network::mojom::WebSandboxFlags::kAutomaticFeatures,
       root->child_at(0)->child_at(0)->effective_frame_policy().sandbox_flags);
   EXPECT_EQ(
       root->child_at(0)->child_at(0)->active_sandbox_flags(),
@@ -11548,9 +11553,9 @@
   NavigateFrameToURL(root->child_at(0)->child_at(0),
                      embedded_test_server()->GetURL("foo.com", "/title2.html"));
   EXPECT_EQ(
-      blink::mojom::WebSandboxFlags::kAll &
-          ~blink::mojom::WebSandboxFlags::kScripts &
-          ~blink::mojom::WebSandboxFlags::kAutomaticFeatures,
+      network::mojom::WebSandboxFlags::kAll &
+          ~network::mojom::WebSandboxFlags::kScripts &
+          ~network::mojom::WebSandboxFlags::kAutomaticFeatures,
       root->child_at(0)->child_at(0)->effective_frame_policy().sandbox_flags);
   EXPECT_EQ(
       root->child_at(0)->child_at(0)->active_sandbox_flags(),
@@ -11581,31 +11586,31 @@
 
   // The second child has both iframe-attribute sandbox flags and CSP-set flags.
   // Verify that it the flags are combined correctly in the frame tree.
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kAll &
-                ~blink::mojom::WebSandboxFlags::kPointerLock &
-                ~blink::mojom::WebSandboxFlags::kOrientationLock &
-                ~blink::mojom::WebSandboxFlags::kScripts &
-                ~blink::mojom::WebSandboxFlags::kAutomaticFeatures,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kAll &
+                ~network::mojom::WebSandboxFlags::kPointerLock &
+                ~network::mojom::WebSandboxFlags::kOrientationLock &
+                ~network::mojom::WebSandboxFlags::kScripts &
+                ~network::mojom::WebSandboxFlags::kAutomaticFeatures,
             root->child_at(1)->effective_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kAll &
-                ~blink::mojom::WebSandboxFlags::kPointerLock &
-                ~blink::mojom::WebSandboxFlags::kScripts &
-                ~blink::mojom::WebSandboxFlags::kAutomaticFeatures,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kAll &
+                ~network::mojom::WebSandboxFlags::kPointerLock &
+                ~network::mojom::WebSandboxFlags::kScripts &
+                ~network::mojom::WebSandboxFlags::kAutomaticFeatures,
             root->child_at(1)->active_sandbox_flags());
 
   NavigateFrameToURL(
       root->child_at(1),
       embedded_test_server()->GetURL("bar.com", "/sandboxed_child_frame.html"));
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kAll &
-                ~blink::mojom::WebSandboxFlags::kPointerLock &
-                ~blink::mojom::WebSandboxFlags::kOrientationLock &
-                ~blink::mojom::WebSandboxFlags::kScripts &
-                ~blink::mojom::WebSandboxFlags::kAutomaticFeatures,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kAll &
+                ~network::mojom::WebSandboxFlags::kPointerLock &
+                ~network::mojom::WebSandboxFlags::kOrientationLock &
+                ~network::mojom::WebSandboxFlags::kScripts &
+                ~network::mojom::WebSandboxFlags::kAutomaticFeatures,
             root->child_at(1)->effective_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kAll &
-                ~blink::mojom::WebSandboxFlags::kPointerLock &
-                ~blink::mojom::WebSandboxFlags::kScripts &
-                ~blink::mojom::WebSandboxFlags::kAutomaticFeatures,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kAll &
+                ~network::mojom::WebSandboxFlags::kPointerLock &
+                ~network::mojom::WebSandboxFlags::kScripts &
+                ~network::mojom::WebSandboxFlags::kAutomaticFeatures,
             root->child_at(1)->active_sandbox_flags());
 
   // Remove the sandbox attribute from the child frame.
@@ -11624,14 +11629,14 @@
           "bar.com", "/cross_site_iframe_factory.html?bar(foo)"));
 
   // Check the sandbox flags on the child frame in the browser process.
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             root->child_at(1)->effective_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             root->child_at(1)->active_sandbox_flags());
 
   // Check the sandbox flags on the grandchid frame in the browser process.
   EXPECT_EQ(
-      blink::mojom::WebSandboxFlags::kNone,
+      network::mojom::WebSandboxFlags::kNone,
       root->child_at(1)->child_at(0)->effective_frame_policy().sandbox_flags);
   EXPECT_EQ(
       root->child_at(1)->child_at(0)->active_sandbox_flags(),
@@ -13928,9 +13933,9 @@
   FrameTreeNode* subframe = root->child_at(0);
 
   // The subframe should not be sandboxed.
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             subframe->pending_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             subframe->effective_frame_policy().sandbox_flags);
 
   // Set the "sandbox" attribute on the subframe; pending policy should update.
@@ -13938,12 +13943,12 @@
       root, "document.querySelector('iframe').sandbox = 'allow-scripts';"));
   // "allow-scripts" resets both SandboxFlags::Scripts and
   // SandboxFlags::AutomaticFeatures bits per blink::ParseSandboxPolicy().
-  blink::mojom::WebSandboxFlags expected_flags =
-      blink::mojom::WebSandboxFlags::kAll &
-      ~blink::mojom::WebSandboxFlags::kScripts &
-      ~blink::mojom::WebSandboxFlags::kAutomaticFeatures;
+  network::mojom::WebSandboxFlags expected_flags =
+      network::mojom::WebSandboxFlags::kAll &
+      ~network::mojom::WebSandboxFlags::kScripts &
+      ~network::mojom::WebSandboxFlags::kAutomaticFeatures;
   EXPECT_EQ(expected_flags, subframe->pending_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             subframe->effective_frame_policy().sandbox_flags);
 
   // Commit a same-document navigation with replaceState.  The new sandbox
@@ -13954,7 +13959,7 @@
   replace_state_observer.Wait();
 
   EXPECT_EQ(expected_flags, subframe->pending_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             subframe->effective_frame_policy().sandbox_flags);
 
   // Also try a same-document navigation to a fragment, which also shouldn't
@@ -13969,7 +13974,7 @@
   }
 
   EXPECT_EQ(expected_flags, subframe->pending_frame_policy().sandbox_flags);
-  EXPECT_EQ(blink::mojom::WebSandboxFlags::kNone,
+  EXPECT_EQ(network::mojom::WebSandboxFlags::kNone,
             subframe->effective_frame_policy().sandbox_flags);
 }
 
@@ -15177,18 +15182,18 @@
           "a.com",
           "/cross_site_iframe_factory.html?a(b{sandbox-allow-scripts})")));
   FrameTreeNode* root = web_contents()->GetFrameTree()->root();
-  blink::mojom::WebSandboxFlags expected_flags =
-      blink::mojom::WebSandboxFlags::kAll &
-      ~blink::mojom::WebSandboxFlags::kScripts &
-      ~blink::mojom::WebSandboxFlags::kAutomaticFeatures;
+  network::mojom::WebSandboxFlags expected_flags =
+      network::mojom::WebSandboxFlags::kAll &
+      ~network::mojom::WebSandboxFlags::kScripts &
+      ~network::mojom::WebSandboxFlags::kAutomaticFeatures;
   // Validate sandbox flags bit-by-bit. This is equivalent to an equality check
   // when FeaturePolicyForSandbox is disabled, but when that feature is enabled,
   // this will check the appropriate policy-controlled feature for each expected
   // sandbox flag.
-  for (unsigned bit = 0; bit < sizeof(blink::mojom::WebSandboxFlags) * 8;
+  for (unsigned bit = 0; bit < sizeof(network::mojom::WebSandboxFlags) * 8;
        bit++) {
-    blink::mojom::WebSandboxFlags flag =
-        static_cast<blink::mojom::WebSandboxFlags>(1 << bit);
+    network::mojom::WebSandboxFlags flag =
+        static_cast<network::mojom::WebSandboxFlags>(1 << bit);
     if (static_cast<unsigned>(expected_flags) & (1 << bit)) {
       EXPECT_TRUE(root->child_at(0)->current_frame_host()->IsSandboxed(flag));
     } else {
@@ -15205,17 +15210,17 @@
           "a.com",
           "/cross_site_iframe_factory.html?a(b{sandbox,allow-scripts})")));
   FrameTreeNode* root = web_contents()->GetFrameTree()->root();
-  blink::mojom::WebSandboxFlags expected_flags =
-      blink::mojom::WebSandboxFlags::kAll &
-      ~blink::mojom::WebSandboxFlags::kScripts &
-      ~blink::mojom::WebSandboxFlags::kAutomaticFeatures;
+  network::mojom::WebSandboxFlags expected_flags =
+      network::mojom::WebSandboxFlags::kAll &
+      ~network::mojom::WebSandboxFlags::kScripts &
+      ~network::mojom::WebSandboxFlags::kAutomaticFeatures;
   // Validate sandbox flags bit-by-bit. This is equivalent to an equality check
   // when FeaturePolicyForSandbox is disabled, but when that feature is enabled,
   // this will check the appropriate policy-controlled feature for each expected
   // sandbox flag.
   for (int bit = 0; bit < 32; bit++) {
-    blink::mojom::WebSandboxFlags flag =
-        static_cast<blink::mojom::WebSandboxFlags>(1 << bit);
+    network::mojom::WebSandboxFlags flag =
+        static_cast<network::mojom::WebSandboxFlags>(1 << bit);
     if (static_cast<unsigned>(expected_flags) & (1 << bit)) {
       EXPECT_TRUE(root->child_at(0)->current_frame_host()->IsSandboxed(flag));
     } else {

diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
index f59b9b6..2d26f144 100644
--- a/content/browser/web_contents/web_contents_impl.cc
+++ b/content/browser/web_contents/web_contents_impl.cc

@@ -149,9 +149,10 @@
 #include "ppapi/buildflags/buildflags.h"
 #include "services/metrics/public/cpp/ukm_recorder.h"
 #include "services/network/public/cpp/features.h"
+#include "services/network/public/cpp/web_sandbox_flags.h"
+#include "services/network/public/mojom/web_sandbox_flags.mojom.h"
 #include "services/service_manager/public/cpp/interface_provider.h"
 #include "third_party/blink/public/common/associated_interfaces/associated_interface_provider.h"
-#include "third_party/blink/public/common/frame/sandbox_flags.h"
 #include "third_party/blink/public/common/mime_util/mime_util.h"
 #include "third_party/blink/public/common/page/page_zoom.h"
 #include "third_party/blink/public/common/security/security_style.h"
@@ -766,17 +767,17 @@
   // See https://html.spec.whatwg.org/#attr-iframe-sandbox.
   FrameTreeNode* new_root = new_contents->GetFrameTree()->root();
   if (opener) {
-    blink::mojom::WebSandboxFlags opener_flags =
+    network::mojom::WebSandboxFlags opener_flags =
         opener_rfh->active_sandbox_flags();
-    const blink::mojom::WebSandboxFlags inherit_flag =
-        blink::mojom::WebSandboxFlags::kPropagatesToAuxiliaryBrowsingContexts;
+    const network::mojom::WebSandboxFlags inherit_flag =
+        network::mojom::WebSandboxFlags::kPropagatesToAuxiliaryBrowsingContexts;
     bool sandbox_propagates_to_auxilary_context =
         (opener_flags & inherit_flag) == inherit_flag;
     if (sandbox_propagates_to_auxilary_context)
       new_root->SetPendingFramePolicy({opener_flags,
                                        {} /* container_policy */,
                                        {} /* required_document_policy */});
-    if (opener_flags == blink::mojom::WebSandboxFlags::kNone ||
+    if (opener_flags == network::mojom::WebSandboxFlags::kNone ||
         sandbox_propagates_to_auxilary_context) {
       // TODO(ekaramad, iclelland): Do not propagate feature policies from non-
       // sandboxed disowned openers (rel=noopener).
@@ -4978,7 +4979,7 @@
 
   // All frames are allowed to navigate the global history.
   if (!delegate_ || delegate_->OnGoToEntryOffset(offset)) {
-    if (source->IsSandboxed(blink::mojom::WebSandboxFlags::kTopNavigation)) {
+    if (source->IsSandboxed(network::mojom::WebSandboxFlags::kTopNavigation)) {
       // Keep track of whether this is a session history from a sandboxed iframe
       // with top level navigation disallowed.
       controller_.GoToOffsetInSandboxedFrame(offset,

diff --git a/content/browser/web_contents/web_contents_impl_unittest.cc b/content/browser/web_contents/web_contents_impl_unittest.cc
index cb2f1d1..a1e9a2b 100644
--- a/content/browser/web_contents/web_contents_impl_unittest.cc
+++ b/content/browser/web_contents/web_contents_impl_unittest.cc

@@ -66,9 +66,9 @@
 #include "content/test/test_web_contents.h"
 #include "net/test/cert_test_util.h"
 #include "net/test/test_data_directory.h"
+#include "services/network/public/cpp/web_sandbox_flags.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
-#include "third_party/blink/public/common/frame/sandbox_flags.h"
 #include "third_party/blink/public/mojom/favicon/favicon_url.mojom.h"
 #include "third_party/blink/public/mojom/frame/fullscreen.mojom.h"
 #include "third_party/skia/include/core/SkColor.h"
@@ -3524,18 +3524,18 @@
 
 TEST_F(WebContentsImplTest, StartingSandboxFlags) {
   WebContents::CreateParams params(browser_context());
-  const blink::mojom::WebSandboxFlags expected_flags =
-      blink::mojom::WebSandboxFlags::kPopups |
-      blink::mojom::WebSandboxFlags::kModals |
-      blink::mojom::WebSandboxFlags::kTopNavigation;
+  network::mojom::WebSandboxFlags expected_flags =
+      network::mojom::WebSandboxFlags::kPopups |
+      network::mojom::WebSandboxFlags::kModals |
+      network::mojom::WebSandboxFlags::kTopNavigation;
   params.starting_sandbox_flags = expected_flags;
   std::unique_ptr<WebContentsImpl> new_contents(
       WebContentsImpl::CreateWithOpener(params, nullptr));
   FrameTreeNode* root = new_contents->GetFrameTree()->root();
-  blink::mojom::WebSandboxFlags pending_flags =
+  network::mojom::WebSandboxFlags pending_flags =
       root->pending_frame_policy().sandbox_flags;
   EXPECT_EQ(pending_flags, expected_flags);
-  blink::mojom::WebSandboxFlags effective_flags =
+  network::mojom::WebSandboxFlags effective_flags =
       root->effective_frame_policy().sandbox_flags;
   EXPECT_EQ(effective_flags, expected_flags);
 }

diff --git a/content/common/frame.mojom b/content/common/frame.mojom
index edf716bc..ce836b66 100644
--- a/content/common/frame.mojom
+++ b/content/common/frame.mojom

@@ -18,6 +18,7 @@
 import "mojo/public/mojom/base/unguessable_token.mojom";
 import "mojo/public/mojom/base/values.mojom";
 import "services/network/public/mojom/content_security_policy.mojom";
+import "services/network/public/mojom/web_sandbox_flags.mojom";
 import "services/network/public/mojom/url_loader.mojom";
 import "services/network/public/mojom/url_loader_factory.mojom";
 import "services/network/public/mojom/url_response_head.mojom";
@@ -473,7 +474,7 @@
   // |feature_policy_header| is a list of an origin whitelist for each feature
   // in the policy.
   DidSetFramePolicyHeaders(
-      blink.mojom.WebSandboxFlags sandbox_flags,
+      network.mojom.WebSandboxFlags sandbox_flags,
       array<blink.mojom.ParsedFeaturePolicyDeclaration> feature_policy_header,
       map<blink.mojom.DocumentPolicyFeature, blink.mojom.PolicyValue>
         document_policy_header);

diff --git a/content/common/frame_messages.h b/content/common/frame_messages.h
index a22941e..e10d11cd 100644
--- a/content/common/frame_messages.h
+++ b/content/common/frame_messages.h

@@ -57,6 +57,7 @@
 #include "third_party/blink/public/mojom/devtools/console_message.mojom.h"
 #include "third_party/blink/public/mojom/favicon/favicon_url.mojom.h"
 #include "third_party/blink/public/mojom/feature_policy/document_policy_feature.mojom.h"
+#include "third_party/blink/public/mojom/feature_policy/feature_policy_feature.mojom-shared.h"
 #include "third_party/blink/public/mojom/feature_policy/policy_disposition.mojom.h"
 #include "third_party/blink/public/mojom/fetch/fetch_api_request.mojom.h"
 #include "third_party/blink/public/mojom/frame/blocked_navigation_types.mojom.h"
@@ -115,7 +116,7 @@
                           blink::mojom::ScrollbarMode::kMaxValue)
 IPC_ENUM_TRAITS_MAX_VALUE(content::StopFindAction,
                           content::STOP_FIND_ACTION_LAST)
-IPC_ENUM_TRAITS(blink::mojom::WebSandboxFlags)  // Bitmask
+IPC_ENUM_TRAITS(network::mojom::WebSandboxFlags)  // Bitmask.
 IPC_ENUM_TRAITS_MAX_VALUE(blink::WebTreeScopeType,
                           blink::WebTreeScopeType::kMaxValue)
 IPC_ENUM_TRAITS_MAX_VALUE(ui::MenuSourceType, ui::MENU_SOURCE_TYPE_LAST)

diff --git a/content/common/frame_replication_state.cc b/content/common/frame_replication_state.cc
index abae9b0b..ac6b2497 100644
--- a/content/common/frame_replication_state.cc
+++ b/content/common/frame_replication_state.cc

@@ -4,14 +4,14 @@
 
 #include "content/common/frame_replication_state.h"
 
-#include "third_party/blink/public/common/frame/sandbox_flags.h"
+#include "services/network/public/mojom/web_sandbox_flags.mojom-shared.h"
 #include "third_party/blink/public/mojom/security_context/insecure_request_policy.mojom.h"
 #include "third_party/blink/public/web/web_tree_scope_type.h"
 
 namespace content {
 
 FrameReplicationState::FrameReplicationState()
-    : active_sandbox_flags(blink::mojom::WebSandboxFlags::kNone),
+    : active_sandbox_flags(network::mojom::WebSandboxFlags::kNone),
       scope(blink::WebTreeScopeType::kDocument),
       insecure_request_policy(
           blink::mojom::InsecureRequestPolicy::kLeaveInsecureRequestsAlone),
@@ -29,10 +29,9 @@
     bool has_received_user_gesture,
     bool has_received_user_gesture_before_nav,
     blink::FrameOwnerElementType owner_type)
-    : origin(),
-      name(name),
+    : name(name),
       unique_name(unique_name),
-      active_sandbox_flags(blink::mojom::WebSandboxFlags::kNone),
+      active_sandbox_flags(network::mojom::WebSandboxFlags::kNone),
       scope(scope),
       insecure_request_policy(insecure_request_policy),
       insecure_navigations_set(insecure_navigations_set),

diff --git a/content/common/frame_replication_state.h b/content/common/frame_replication_state.h
index 98226da..08e4c557 100644
--- a/content/common/frame_replication_state.h
+++ b/content/common/frame_replication_state.h

@@ -19,7 +19,6 @@
 
 namespace blink {
 enum class WebTreeScopeType;
-enum class WebSandboxFlags;
 }
 
 namespace content {
@@ -86,7 +85,7 @@
   // inherited from parent frames, the currently active flags from the <iframe>
   // element hosting this frame, as well as any flags set from a
   // Content-Security-Policy HTTP header.
-  blink::mojom::WebSandboxFlags active_sandbox_flags;
+  network::mojom::WebSandboxFlags active_sandbox_flags;
 
   // Iframe sandbox flags and container policy currently in effect for the
   // frame. Container policy may be empty if this is the top-level frame.

diff --git a/content/public/browser/BUILD.gn b/content/public/browser/BUILD.gn
index 97db0f71..fe690f1c 100644
--- a/content/public/browser/BUILD.gn
+++ b/content/public/browser/BUILD.gn

@@ -267,6 +267,7 @@
     "picture_in_picture_window_controller.h",
     "platform_notification_context.h",
     "platform_notification_service.h",
+    "presentation_receiver_flags.h",
     "presentation_request.cc",
     "presentation_request.h",
     "presentation_screen_availability_listener.h",

diff --git a/content/public/browser/presentation_receiver_flags.h b/content/public/browser/presentation_receiver_flags.h
new file mode 100644
index 0000000..bfb058a
--- /dev/null
+++ b/content/public/browser/presentation_receiver_flags.h

@@ -0,0 +1,22 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_PRESENTATION_RECEIVER_FLAGS_H_
+#define CONTENT_PUBLIC_BROWSER_PRESENTATION_RECEIVER_FLAGS_H_
+
+#include "services/network/public/cpp/web_sandbox_flags.h"
+
+namespace content {
+
+// Disable popups, modals, and top-level navigation for presentation receivers.
+// See:
+// https://w3c.github.io/presentation-api/#creating-a-receiving-browsing-context
+constexpr network::mojom::WebSandboxFlags kPresentationReceiverSandboxFlags =
+    network::mojom::WebSandboxFlags::kModals |
+    network::mojom::WebSandboxFlags::kPopups |
+    network::mojom::WebSandboxFlags::kTopNavigation;
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_BROWSER_PRESENTATION_RECEIVER_FLAGS_H_

diff --git a/content/public/browser/render_frame_host.h b/content/public/browser/render_frame_host.h
index 6552048..84b611b 100644
--- a/content/public/browser/render_frame_host.h
+++ b/content/public/browser/render_frame_host.h

@@ -26,7 +26,6 @@
 #include "third_party/blink/public/common/feature_policy/document_policy.h"
 #include "third_party/blink/public/common/feature_policy/feature_policy.h"
 #include "third_party/blink/public/common/frame/frame_owner_element_type.h"
-#include "third_party/blink/public/common/frame/sandbox_flags.h"
 #include "third_party/blink/public/common/scheduler/web_scheduler_tracked_feature.h"
 #include "third_party/blink/public/mojom/ad_tagging/ad_frame.mojom-forward.h"
 #include "third_party/blink/public/mojom/devtools/console_message.mojom.h"
@@ -452,7 +451,7 @@
   // The effective flags include those which have been set by a
   // Content-Security-Policy header, in addition to those which are set by the
   // embedding frame.
-  virtual bool IsSandboxed(blink::mojom::WebSandboxFlags flags) = 0;
+  virtual bool IsSandboxed(network::mojom::WebSandboxFlags flags) = 0;
 
   // Calls |FlushForTesting()| on Network Service and FrameNavigationControl
   // related interfaces to make sure all in-flight mojo messages have been

diff --git a/content/public/browser/web_contents.cc b/content/public/browser/web_contents.cc
index d1d8ff8..f1dcf53e 100644
--- a/content/public/browser/web_contents.cc
+++ b/content/public/browser/web_contents.cc

@@ -8,6 +8,7 @@
 
 #include "content/public/common/child_process_host.h"
 #include "ipc/ipc_message.h"
+#include "services/network/public/mojom/web_sandbox_flags.mojom-shared.h"
 
 namespace content {
 
@@ -27,7 +28,7 @@
       context(nullptr),
       renderer_initiated_creation(false),
       desired_renderer_state(kOkayToHaveRendererProcess),
-      starting_sandbox_flags(blink::mojom::WebSandboxFlags::kNone),
+      starting_sandbox_flags(network::mojom::WebSandboxFlags::kNone),
       is_never_visible(false) {}
 
 WebContents::CreateParams::CreateParams(const CreateParams& other) = default;

diff --git a/content/public/browser/web_contents.h b/content/public/browser/web_contents.h
index deafffd..4133778 100644
--- a/content/public/browser/web_contents.h
+++ b/content/public/browser/web_contents.h

@@ -36,7 +36,6 @@
 #include "mojo/public/cpp/bindings/remote.h"
 #include "services/data_decoder/public/mojom/web_bundler.mojom.h"
 #include "services/metrics/public/cpp/ukm_source_id.h"
-#include "third_party/blink/public/common/frame/sandbox_flags.h"
 #include "third_party/blink/public/mojom/frame/find_in_page.mojom-forward.h"
 #include "third_party/blink/public/mojom/input/pointer_lock_result.mojom.h"
 #include "third_party/blink/public/mojom/loader/pause_subresource_loading_handle.mojom-forward.h"
@@ -212,7 +211,7 @@
     } desired_renderer_state;
 
     // Sandboxing flags set on the new WebContents.
-    blink::mojom::WebSandboxFlags starting_sandbox_flags;
+    network::mojom::WebSandboxFlags starting_sandbox_flags;
 
     // Value used to set the last time the WebContents was made active, this is
     // the value that'll be returned by GetLastActiveTime(). If this is left

diff --git a/content/public/common/navigation_policy.h b/content/public/common/navigation_policy.h
index d5068bc..22f65741 100644
--- a/content/public/common/navigation_policy.h
+++ b/content/public/common/navigation_policy.h

@@ -39,7 +39,7 @@
   kAdFrame = 10,
 
   // The navigation was initiated from or occurred in an iframe with
-  // |WebSandboxFlags::kDownloads| flag set.
+  // |network::mojom::WebSandboxFlags::kDownloads| flag set.
   kSandbox = 11,
 
   // The navigation was initiated without user activation.

diff --git a/content/public/common/previews_state.cc b/content/public/common/previews_state.cc
index 02e00399..94e6eb0 100644
--- a/content/public/common/previews_state.cc
+++ b/content/public/common/previews_state.cc

@@ -30,10 +30,6 @@
                             blink::WebURLRequest::kOfflinePageOn);
 STATIC_ASSERT_PREVIEWS_ENUM(LITE_PAGE_REDIRECT_ON,
                             blink::WebURLRequest::kLitePageRedirectOn);
-STATIC_ASSERT_PREVIEWS_ENUM(LAZY_IMAGE_LOAD_DEFERRED,
-                            blink::WebURLRequest::kLazyImageLoadDeferred);
-STATIC_ASSERT_PREVIEWS_ENUM(LAZY_IMAGE_AUTO_RELOAD,
-                            blink::WebURLRequest::kLazyImageAutoReload);
 STATIC_ASSERT_PREVIEWS_ENUM(SUBRESOURCE_REDIRECT_ON,
                             blink::WebURLRequest::kSubresourceRedirectOn);
 STATIC_ASSERT_PREVIEWS_ENUM(PREVIEWS_STATE_LAST,

diff --git a/content/public/common/previews_state.h b/content/public/common/previews_state.h
index 888cb7a..a2375f5 100644
--- a/content/public/common/previews_state.h
+++ b/content/public/common/previews_state.h

@@ -39,14 +39,10 @@
       1 << 8,  // Request that an offline page be used if one is stored.
   LITE_PAGE_REDIRECT_ON = 1 << 9,  // Allow the browser to redirect the resource
                                    // to a Lite Page server.
-  LAZY_IMAGE_LOAD_DEFERRED = 1 << 10,  // Request the placeholder version of an
-                                       // image that was deferred by lazyload.
-  LAZY_IMAGE_AUTO_RELOAD = 1 << 11,  // Request the full image after previously
-                                     // getting a lazy load placeholder.
-  DEFER_ALL_SCRIPT_ON = 1 << 12,  // Request that script execution be deferred
-                                  // until parsing completes.
+  DEFER_ALL_SCRIPT_ON = 1 << 10,   // Request that script execution be deferred
+                                   // until parsing completes.
   SUBRESOURCE_REDIRECT_ON =
-      1 << 13,  // Allow the subresources in the page to be redirected to
+      1 << 11,  // Allow the subresources in the page to be redirected to
                 // serve better optimized resources. Set on subresources.
   PREVIEWS_STATE_LAST = SUBRESOURCE_REDIRECT_ON
 };

diff --git a/content/public/test/fake_remote_frame.h b/content/public/test/fake_remote_frame.h
index b2525b6d..44b0cdf 100644
--- a/content/public/test/fake_remote_frame.h
+++ b/content/public/test/fake_remote_frame.h

@@ -77,7 +77,7 @@
   void IntrinsicSizingInfoOfChildChanged(
       blink::mojom::IntrinsicSizingInfoPtr sizing_info) override;
   void DidSetFramePolicyHeaders(
-      blink::mojom::WebSandboxFlags sandbox_flags,
+      network::mojom::WebSandboxFlags sandbox_flags,
       const std::vector<blink::ParsedFeaturePolicyDeclaration>&
           parsed_feature_policy) override {}
   void DidUpdateFramePolicy(const blink::FramePolicy& frame_policy) override {}

diff --git a/content/public/test/mock_render_thread.h b/content/public/test/mock_render_thread.h
index 8b7bcab9..971c945b 100644
--- a/content/public/test/mock_render_thread.h
+++ b/content/public/test/mock_render_thread.h

@@ -29,7 +29,6 @@
 }
 
 namespace blink {
-enum class WebSandboxFlags;
 enum class WebTreeScopeType;
 }
 

diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
index 8f514c11..fbe2aab2 100644
--- a/content/renderer/render_frame_impl.cc
+++ b/content/renderer/render_frame_impl.cc

@@ -162,7 +162,6 @@
 #include "services/viz/public/cpp/gpu/context_provider_command_buffer.h"
 #include "third_party/blink/public/common/associated_interfaces/associated_interface_provider.h"
 #include "third_party/blink/public/common/features.h"
-#include "third_party/blink/public/common/frame/sandbox_flags.h"
 #include "third_party/blink/public/common/input/web_keyboard_event.h"
 #include "third_party/blink/public/common/loader/url_loader_throttle.h"
 #include "third_party/blink/public/common/logging/logging_utils.h"
@@ -4141,13 +4140,13 @@
 }
 
 void RenderFrameImpl::DidSetFramePolicyHeaders(
-    blink::mojom::WebSandboxFlags flags,
+    network::mojom::WebSandboxFlags flags,
     const blink::ParsedFeaturePolicy& fp_header,
     const blink::DocumentPolicy::FeatureState& dp_header) {
   // If any of Feature Policy or Sandbox Flags or Document Policy are different
   // from the default (empty) values, then send them to the browser.
   if (!dp_header.empty() || !fp_header.empty() ||
-      flags != blink::mojom::WebSandboxFlags::kNone) {
+      flags != network::mojom::WebSandboxFlags::kNone) {
     GetFrameHost()->DidSetFramePolicyHeaders(flags, fp_header, dp_header);
   }
 }

diff --git a/content/renderer/render_frame_impl.h b/content/renderer/render_frame_impl.h
index dd2e5ed..1ea217b3 100644
--- a/content/renderer/render_frame_impl.h
+++ b/content/renderer/render_frame_impl.h

@@ -684,7 +684,7 @@
   void DidChangeFramePolicy(blink::WebFrame* child_frame,
                             const blink::FramePolicy& frame_policy) override;
   void DidSetFramePolicyHeaders(
-      blink::mojom::WebSandboxFlags flags,
+      network::mojom::WebSandboxFlags flags,
       const blink::ParsedFeaturePolicy& fp_header,
       const blink::DocumentPolicy::FeatureState& dp_header) override;
   void DidChangeFrameOwnerProperties(

diff --git a/content/renderer/render_view_browsertest.cc b/content/renderer/render_view_browsertest.cc
index 490db5a..fd28a18 100644
--- a/content/renderer/render_view_browsertest.cc
+++ b/content/renderer/render_view_browsertest.cc

@@ -1041,7 +1041,7 @@
   blink::WebView* new_web_view = view()->CreateView(
       GetMainFrame(), popup_request, blink::WebWindowFeatures(), "foo",
       blink::kWebNavigationPolicyNewForegroundTab,
-      blink::mojom::WebSandboxFlags::kNone,
+      network::mojom::WebSandboxFlags::kNone,
       blink::FeaturePolicy::FeatureState(),
       blink::AllocateSessionStorageNamespaceId());
   RenderViewImpl* new_view = RenderViewImpl::FromWebView(new_web_view);

diff --git a/content/renderer/render_view_impl.cc b/content/renderer/render_view_impl.cc
index 67918380..7f7ffb7 100644
--- a/content/renderer/render_view_impl.cc
+++ b/content/renderer/render_view_impl.cc

@@ -1210,7 +1210,7 @@
     const WebWindowFeatures& features,
     const WebString& frame_name,
     WebNavigationPolicy policy,
-    blink::mojom::WebSandboxFlags sandbox_flags,
+    network::mojom::WebSandboxFlags sandbox_flags,
     const blink::FeaturePolicy::FeatureState& opener_feature_state,
     const blink::SessionStorageNamespaceId& session_storage_namespace_id) {
   RenderFrameImpl* creator_frame = RenderFrameImpl::FromWebFrame(creator);

diff --git a/content/renderer/render_view_impl.h b/content/renderer/render_view_impl.h
index fea22125..19921b2 100644
--- a/content/renderer/render_view_impl.h
+++ b/content/renderer/render_view_impl.h

@@ -216,7 +216,7 @@
       const blink::WebWindowFeatures& features,
       const blink::WebString& frame_name,
       blink::WebNavigationPolicy policy,
-      blink::mojom::WebSandboxFlags sandbox_flags,
+      network::mojom::WebSandboxFlags sandbox_flags,
       const blink::FeaturePolicy::FeatureState& opener_feature_state,
       const blink::SessionStorageNamespaceId& session_storage_namespace_id)
       override;

diff --git a/content/shell/browser/shell.cc b/content/shell/browser/shell.cc
index e9c1fd9..dc1e3b2 100644
--- a/content/shell/browser/shell.cc
+++ b/content/shell/browser/shell.cc

@@ -26,6 +26,7 @@
 #include "content/public/browser/navigation_controller.h"
 #include "content/public/browser/navigation_entry.h"
 #include "content/public/browser/picture_in_picture_window_controller.h"
+#include "content/public/browser/presentation_receiver_flags.h"
 #include "content/public/browser/render_process_host.h"
 #include "content/public/browser/render_view_host.h"
 #include "content/public/browser/render_widget_host.h"
@@ -45,7 +46,6 @@
 #include "content/shell/common/web_test/web_test_switches.h"
 #include "media/media_buildflags.h"
 #include "third_party/blink/public/common/peerconnection/webrtc_ip_handling_policy.h"
-#include "third_party/blink/public/common/presentation/presentation_receiver_flags.h"
 #include "third_party/blink/public/mojom/renderer_preferences.mojom.h"
 
 namespace content {
@@ -223,7 +223,7 @@
   if (base::CommandLine::ForCurrentProcess()->HasSwitch(
           switches::kForcePresentationReceiverForTesting)) {
     create_params.starting_sandbox_flags =
-        blink::kPresentationReceiverSandboxFlags;
+        content::kPresentationReceiverSandboxFlags;
   }
   std::unique_ptr<WebContents> web_contents =
       WebContents::Create(create_params);
@@ -245,7 +245,7 @@
   if (base::CommandLine::ForCurrentProcess()->HasSwitch(
           switches::kForcePresentationReceiverForTesting)) {
     create_params.starting_sandbox_flags =
-        blink::kPresentationReceiverSandboxFlags;
+        content::kPresentationReceiverSandboxFlags;
   }
   std::map<std::string, scoped_refptr<SessionStorageNamespace>>
       session_storages;

diff --git a/content/shell/test_runner/web_view_test_proxy.cc b/content/shell/test_runner/web_view_test_proxy.cc
index 1d4b9a9..9430587 100644
--- a/content/shell/test_runner/web_view_test_proxy.cc
+++ b/content/shell/test_runner/web_view_test_proxy.cc

@@ -34,7 +34,7 @@
     const blink::WebWindowFeatures& features,
     const blink::WebString& frame_name,
     blink::WebNavigationPolicy policy,
-    blink::mojom::WebSandboxFlags sandbox_flags,
+    network::mojom::WebSandboxFlags sandbox_flags,
     const blink::FeaturePolicy::FeatureState& opener_feature_state,
     const blink::SessionStorageNamespaceId& session_storage_namespace_id) {
   if (GetTestRunner()->ShouldDumpNavigationPolicy()) {

diff --git a/content/shell/test_runner/web_view_test_proxy.h b/content/shell/test_runner/web_view_test_proxy.h
index a505db43..becea73 100644
--- a/content/shell/test_runner/web_view_test_proxy.h
+++ b/content/shell/test_runner/web_view_test_proxy.h

@@ -72,7 +72,7 @@
                              const blink::WebWindowFeatures& features,
                              const blink::WebString& frame_name,
                              blink::WebNavigationPolicy policy,
-                             blink::mojom::WebSandboxFlags sandbox_flags,
+                             network::mojom::WebSandboxFlags sandbox_flags,
                              const blink::FeaturePolicy::FeatureState&,
                              const blink::SessionStorageNamespaceId&
                                  session_storage_namespace_id) override;

diff --git a/content/test/data/accessibility/aria/aria-alert-expected-auralinux.txt b/content/test/data/accessibility/aria/aria-alert-expected-auralinux.txt
index 10cf607..ed19405e 100644
--- a/content/test/data/accessibility/aria/aria-alert-expected-auralinux.txt
+++ b/content/test/data/accessibility/aria/aria-alert-expected-auralinux.txt

@@ -1,3 +1,3 @@
 [document web]
-++[alert]
+++[notification]
 ++++[static] name='This test is for aria role="alert"' member-of

diff --git a/content/test/data/accessibility/aria/aria-alertdialog-expected-auralinux.txt b/content/test/data/accessibility/aria/aria-alertdialog-expected-auralinux.txt
index 540ee69..8d6e819f 100644
--- a/content/test/data/accessibility/aria/aria-alertdialog-expected-auralinux.txt
+++ b/content/test/data/accessibility/aria/aria-alertdialog-expected-auralinux.txt

@@ -1,2 +1,2 @@
 [document web]
-++[dialog] xml-roles:alertdialog
+++[alert] xml-roles:alertdialog

diff --git a/content/test/data/accessibility/aria/aria-atomic-expected-auralinux.txt b/content/test/data/accessibility/aria/aria-atomic-expected-auralinux.txt
index d4586549..b7b07a2 100644
--- a/content/test/data/accessibility/aria/aria-atomic-expected-auralinux.txt
+++ b/content/test/data/accessibility/aria/aria-atomic-expected-auralinux.txt

@@ -3,7 +3,7 @@
 ++++[static] name='This test is for aria-atomic="false"' atomic:false container-atomic:false
 ++[log] atomic:true container-atomic:true live:polite
 ++++[static] name='This test is for aria-atomic="true"' member-of atomic:false container-atomic:true
-++[alert] atomic:true container-atomic:true live:assertive
+++[notification] atomic:true container-atomic:true live:assertive
 ++++[static] name='This test is for alert.' member-of atomic:false container-atomic:true
 ++[statusbar] atomic:true container-atomic:true live:polite
 ++++[static] name='This test is for status.' member-of atomic:false container-atomic:true

diff --git a/content/test/data/accessibility/aria/aria-live-expected-auralinux.txt b/content/test/data/accessibility/aria/aria-live-expected-auralinux.txt
index 79631eec..b4485014 100644
--- a/content/test/data/accessibility/aria/aria-live-expected-auralinux.txt
+++ b/content/test/data/accessibility/aria/aria-live-expected-auralinux.txt

@@ -2,4 +2,4 @@
 ++[marquee] container-atomic:false container-busy:false container-live:off container-relevant:additions text live:off
 ++[marquee] container-atomic:false container-busy:false container-live:polite container-relevant:additions text live:polite
 ++[marquee] container-atomic:false container-busy:false container-live:assertive container-relevant:additions text live:assertive
-++[alert] container-atomic:true container-busy:false container-live:assertive container-relevant:additions text live:assertive
+++[notification] container-atomic:true container-busy:false container-live:assertive container-relevant:additions text live:assertive

diff --git a/content/test/gpu/gpu_tests/test_expectations/pixel_expectations.txt b/content/test/gpu/gpu_tests/test_expectations/pixel_expectations.txt
index a357d19..96dd67bf 100644
--- a/content/test/gpu/gpu_tests/test_expectations/pixel_expectations.txt
+++ b/content/test/gpu/gpu_tests/test_expectations/pixel_expectations.txt

@@ -214,6 +214,7 @@
 crbug.com/1028975 [ linux ] Pixel_PrecisionRoundedCorner [ RetryOnFailure ]
 crbug.com/1028975 [ mac ] Pixel_PrecisionRoundedCorner [ RetryOnFailure ]
 crbug.com/1028975 [ win ] Pixel_PrecisionRoundedCorner [ RetryOnFailure ]
+crbug.com/1069339 [ mac intel-0xd26 ] Pixel_OffscreenCanvasIBRCWebGLHighPerfWorker [ RetryOnFailure ]
 
 # VP9 appears to not recover correctly after GPU process crashes on Windows.
 crbug.com/1033982 [ win nvidia ] Pixel_Video_Context_Loss_VP9 [ RetryOnFailure ]

diff --git a/content/test/gpu/run_gpu_integration_test_fuchsia.py b/content/test/gpu/run_gpu_integration_test_fuchsia.py
index a8b64ff7..dc90893 100755
--- a/content/test/gpu/run_gpu_integration_test_fuchsia.py
+++ b/content/test/gpu/run_gpu_integration_test_fuchsia.py

@@ -8,14 +8,17 @@
 import argparse
 import logging
 import os
+import shutil
 import subprocess
 import sys
+import tempfile
 import time
 from gpu_tests import path_util
 
 sys.path.insert(0, os.path.join(path_util.GetChromiumSrcDir(),
     'build', 'fuchsia'))
 from common_args import AddCommonArgs, ConfigureLogging, GetDeploymentTargetForArgs
+from symbolizer import RunSymbolizer
 
 def main():
   parser = argparse.ArgumentParser()
@@ -28,29 +31,53 @@
   if not args.output_directory:
     args.output_directory = os.getcwd()
 
+  # Create a temporary log file that Telemetry will look to use to build
+  # an artifact when tests fail.
+  temp_log_file = False
+  if not args.system_log_file:
+    args.system_log_file = os.path.join(tempfile.mkdtemp(), 'system-log')
+    temp_log_file = True
+
+  package_names = ['web_engine', 'web_engine_shell']
+  web_engine_dir = os.path.join(args.output_directory, 'gen',
+        'fuchsia', 'engine')
   gpu_script = [os.path.join(path_util.GetChromiumSrcDir(), 'content',
                 'test', 'gpu', 'run_gpu_integration_test.py')]
 
   # Pass all other arguments to the gpu integration tests.
   gpu_script.extend(gpu_test_args)
-  with GetDeploymentTargetForArgs(args) as target:
-    target.Start()
-    _, fuchsia_ssh_port = target._GetEndpoint()
-    gpu_script.extend(['--fuchsia-ssh-config-dir', args.output_directory])
-    gpu_script.extend(['--fuchsia-ssh-port', str(fuchsia_ssh_port)])
+  try:
+    with GetDeploymentTargetForArgs(args) as target:
+      target.Start()
+      _, fuchsia_ssh_port = target._GetEndpoint()
+      gpu_script.extend(['--fuchsia-ssh-config-dir', args.output_directory])
+      gpu_script.extend(['--fuchsia-ssh-port', str(fuchsia_ssh_port)])
+      gpu_script.extend(['--fuchsia-system-log-file', args.system_log_file])
 
-    web_engine_dir = os.path.join(args.output_directory, 'gen',
-        'fuchsia', 'engine')
+      # Set up logging of WebEngine
+      listener = target.RunCommandPiped(['log_listener'],
+                                        stdout=subprocess.PIPE,
+                                        stderr=subprocess.STDOUT)
+      build_ids_paths = map(
+          lambda package_name: os.path.join(
+              web_engine_dir, package_name, 'ids.txt'),
+          package_names)
+      symbolizer = RunSymbolizer(listener.stdout,
+                                 open(args.system_log_file,'w'),
+                                 build_ids_paths)
 
-    # Keep the Amber repository live while the test runs.
-    with target.GetAmberRepo():
-      # Install necessary packages on the device.
-      target.InstallPackage([
-          os.path.join(web_engine_dir, 'web_engine', 'web_engine.far'),
-          os.path.join(web_engine_dir, 'web_engine_shell',
-                       'web_engine_shell.far')
-      ])
-      return subprocess.call(gpu_script)
+      # Keep the Amber repository live while the test runs.
+      with target.GetAmberRepo():
+        # Install necessary packages on the device.
+        far_files = map(
+            lambda package_name: os.path.join(
+                web_engine_dir, package_name, package_name + '.far'),
+            package_names)
+        target.InstallPackage(far_files)
+        return subprocess.call(gpu_script)
+  finally:
+    if temp_log_file:
+      shutil.rmtree(os.path.dirname(args.system_log_file))
 
 if __name__ == '__main__':
   sys.exit(main())

diff --git a/content/test/test_render_frame.cc b/content/test/test_render_frame.cc
index 4fc1fd5..6c7bb370 100644
--- a/content/test/test_render_frame.cc
+++ b/content/test/test_render_frame.cc

@@ -203,7 +203,7 @@
                      const std::string& unique_name) override {}
 
   void DidSetFramePolicyHeaders(
-      blink::mojom::WebSandboxFlags sandbox_flags,
+      network::mojom::WebSandboxFlags sandbox_flags,
       const blink::ParsedFeaturePolicy& feature_policy_header,
       const blink::DocumentPolicy::FeatureState& document_policy_header)
       override {}

diff --git a/content/test/test_render_frame_host.cc b/content/test/test_render_frame_host.cc
index 88d81d98..5066668 100644
--- a/content/test/test_render_frame_host.cc
+++ b/content/test/test_render_frame_host.cc

@@ -229,7 +229,7 @@
     header[0].values.insert(std::pair<url::Origin, blink::PolicyValue>(
         origin, blink::PolicyValue(true)));
   }
-  DidSetFramePolicyHeaders(blink::mojom::WebSandboxFlags::kNone, header,
+  DidSetFramePolicyHeaders(network::mojom::WebSandboxFlags::kNone, header,
                            {} /* dp_header */);
 }
 
@@ -490,7 +490,7 @@
 }
 
 void TestRenderFrameHost::SendFramePolicy(
-    blink::mojom::WebSandboxFlags sandbox_flags,
+    network::mojom::WebSandboxFlags sandbox_flags,
     const blink::ParsedFeaturePolicy& fp_header,
     const blink::DocumentPolicy::FeatureState& dp_header) {
   DidSetFramePolicyHeaders(sandbox_flags, fp_header, dp_header);

diff --git a/content/test/test_render_frame_host.h b/content/test/test_render_frame_host.h
index b9d7bab..7a4b1fe4 100644
--- a/content/test/test_render_frame_host.h
+++ b/content/test/test_render_frame_host.h

@@ -160,7 +160,7 @@
       bool same_document);
 
   // Send a message with the sandbox flags and feature policy
-  void SendFramePolicy(blink::mojom::WebSandboxFlags sandbox_flags,
+  void SendFramePolicy(network::mojom::WebSandboxFlags sandbox_flags,
                        const blink::ParsedFeaturePolicy& fp_header,
                        const blink::DocumentPolicy::FeatureState& dp_header);
 

diff --git a/docs/android_dynamic_feature_modules.md b/docs/android_dynamic_feature_modules.md
index e0ae421..bf8eb059 100644
--- a/docs/android_dynamic_feature_modules.md
+++ b/docs/android_dynamic_feature_modules.md

@@ -107,7 +107,7 @@
 <!--- TODO(tiborg): Add info about install UI. -->
 Lastly, give your module a title that Chrome and Play can use for the install
 UI. To do this, add a string to
-`//chrome/android/java/strings/android_chrome_strings.grd`:
+`//chrome/browser/ui/android/strings/android_chrome_strings.grd`:
 
 ```xml
 ...

diff --git a/extensions/browser/guest_view/mime_handler_view/mime_handler_view_embedder.cc b/extensions/browser/guest_view/mime_handler_view/mime_handler_view_embedder.cc
index 626a85bc..6ee5205d 100644
--- a/extensions/browser/guest_view/mime_handler_view/mime_handler_view_embedder.cc
+++ b/extensions/browser/guest_view/mime_handler_view/mime_handler_view_embedder.cc

@@ -18,9 +18,9 @@
 #include "extensions/browser/guest_view/mime_handler_view/mime_handler_view_constants.h"
 #include "extensions/browser/guest_view/mime_handler_view/mime_handler_view_guest.h"
 #include "extensions/common/mojom/guest_view.mojom.h"
+#include "services/network/public/mojom/web_sandbox_flags.mojom-shared.h"
 #include "third_party/blink/public/common/associated_interfaces/associated_interface_provider.h"
 #include "third_party/blink/public/common/frame/frame_owner_element_type.h"
-#include "third_party/blink/public/common/frame/sandbox_flags.h"
 
 namespace extensions {
 
@@ -229,7 +229,7 @@
   // NavigationRequest, DidFinishNavigation is called before FrameDeleted (see
   // https://crbug.com/969840).
   if (render_frame_host_ && !render_frame_host_->IsSandboxed(
-                                blink::mojom::WebSandboxFlags::kPlugins)) {
+                                network::mojom::WebSandboxFlags::kPlugins)) {
     return;
   }
   if (render_frame_host_) {

diff --git a/extensions/renderer/api/automation/automation_internal_custom_bindings.cc b/extensions/renderer/api/automation/automation_internal_custom_bindings.cc
index e6a2ff0..572a50cd 100644
--- a/extensions/renderer/api/automation/automation_internal_custom_bindings.cc
+++ b/extensions/renderer/api/automation/automation_internal_custom_bindings.cc

@@ -803,7 +803,7 @@
   RouteNodeIDFunction(
       "GetRole", [](v8::Isolate* isolate, v8::ReturnValue<v8::Value> result,
                     AutomationAXTreeWrapper* tree_wrapper, ui::AXNode* node) {
-        std::string role_name = ui::ToString(node->data().role);
+        const std::string& role_name = ui::ToString(node->data().role);
         result.Set(v8::String::NewFromUtf8(isolate, role_name.c_str(),
                                            v8::NewStringType::kNormal)
                        .ToLocalChecked());
@@ -936,7 +936,7 @@
         gfx::RectF local_bounds(0, 0,
                                 node->data().relative_bounds.bounds.width(),
                                 node->data().relative_bounds.bounds.height());
-        std::string name =
+        const std::string& name =
             node->data().GetStringAttribute(ax::mojom::StringAttribute::kName);
         std::vector<int> character_offsets = node->data().GetIntListAttribute(
             ax::mojom::IntListAttribute::kCharacterOffsets);
@@ -1001,15 +1001,17 @@
          const std::string& attribute_name) {
         ax::mojom::StringAttribute attribute =
             ui::ParseStringAttribute(attribute_name.c_str());
-        std::string attr_value;
+        const char* attr_value;
         if (attribute == ax::mojom::StringAttribute::kFontFamily ||
             attribute == ax::mojom::StringAttribute::kLanguage) {
-          attr_value = node->GetInheritedStringAttribute(attribute);
-        } else if (!node->data().GetStringAttribute(attribute, &attr_value)) {
+          attr_value = node->GetInheritedStringAttribute(attribute).c_str();
+        } else if (!node->data().HasStringAttribute(attribute)) {
           return;
+        } else {
+          attr_value = node->data().GetStringAttribute(attribute).c_str();
         }
 
-        result.Set(v8::String::NewFromUtf8(isolate, attr_value.c_str(),
+        result.Set(v8::String::NewFromUtf8(isolate, attr_value,
                                            v8::NewStringType::kNormal)
                        .ToLocalChecked());
       });
@@ -1132,11 +1134,12 @@
       [](v8::Isolate* isolate, v8::ReturnValue<v8::Value> result,
          ui::AXTree* tree, ui::AXNode* node,
          const std::string& attribute_name) {
-        std::string attr_value;
-        if (!node->data().GetHtmlAttribute(attribute_name.c_str(), &attr_value))
+        std::string attribute_value;
+        if (!node->data().GetHtmlAttribute(attribute_name.c_str(),
+                                           &attribute_value))
           return;
 
-        result.Set(v8::String::NewFromUtf8(isolate, attr_value.c_str(),
+        result.Set(v8::String::NewFromUtf8(isolate, attribute_value.c_str(),
                                            v8::NewStringType::kNormal)
                        .ToLocalChecked());
       });
@@ -1146,7 +1149,7 @@
          AutomationAXTreeWrapper* tree_wrapper, ui::AXNode* node) {
         ax::mojom::NameFrom name_from = static_cast<ax::mojom::NameFrom>(
             node->data().GetIntAttribute(ax::mojom::IntAttribute::kNameFrom));
-        std::string name_from_str = ui::ToString(name_from);
+        const std::string& name_from_str = ui::ToString(name_from);
         result.Set(v8::String::NewFromUtf8(isolate, name_from_str.c_str(),
                                            v8::NewStringType::kNormal)
                        .ToLocalChecked());
@@ -1188,7 +1191,7 @@
       "GetImageAnnotation",
       [this](v8::Isolate* isolate, v8::ReturnValue<v8::Value> result,
              AutomationAXTreeWrapper* tree_wrapper, ui::AXNode* node) {
-        std::string status_string;
+        std::string status_string = std::string();
         auto status = node->data().GetImageAnnotationStatus();
         switch (status) {
           case ax::mojom::ImageAnnotationStatus::kNone:
@@ -1265,7 +1268,7 @@
       "GetDetectedLanguage",
       [](v8::Isolate* isolate, v8::ReturnValue<v8::Value> result,
          AutomationAXTreeWrapper* tree_wrapper, ui::AXNode* node) {
-        std::string detectedLanguage = node->GetLanguage();
+        const std::string& detectedLanguage = node->GetLanguage();
         result.Set(v8::String::NewFromUtf8(isolate, detectedLanguage.c_str(),
                                            v8::NewStringType::kNormal)
                        .ToLocalChecked());
@@ -1379,9 +1382,8 @@
 
         // Increment and decrement are available when the role is a slider or
         // spin button.
-        std::string role_string;
-        node->GetStringAttribute(ax::mojom::StringAttribute::kRole,
-                                 &role_string);
+        const std::string& role_string =
+            node->GetStringAttribute(ax::mojom::StringAttribute::kRole);
         ax::mojom::Role role = ui::ParseRole(role_string.c_str());
         if (role == ax::mojom::Role::kSlider ||
             role == ax::mojom::Role::kSpinButton) {
@@ -1415,7 +1417,7 @@
             static_cast<ax::mojom::CheckedState>(node->data().GetIntAttribute(
                 ax::mojom::IntAttribute::kCheckedState));
         if (checked_state != ax::mojom::CheckedState::kNone) {
-          const std::string checked_str = ui::ToString(checked_state);
+          const std::string& checked_str = ui::ToString(checked_state);
           result.Set(v8::String::NewFromUtf8(isolate, checked_str.c_str(),
                                              v8::NewStringType::kNormal)
                          .ToLocalChecked());
@@ -1428,7 +1430,7 @@
         const ax::mojom::Restriction restriction =
             node->data().GetRestriction();
         if (restriction != ax::mojom::Restriction::kNone) {
-          const std::string restriction_str = ui::ToString(restriction);
+          const std::string& restriction_str = ui::ToString(restriction);
           result.Set(v8::String::NewFromUtf8(isolate, restriction_str.c_str(),
                                              v8::NewStringType::kNormal)
                          .ToLocalChecked());
@@ -1442,7 +1444,8 @@
             static_cast<ax::mojom::DefaultActionVerb>(
                 node->data().GetIntAttribute(
                     ax::mojom::IntAttribute::kDefaultActionVerb));
-        std::string default_action_verb_str = ui::ToString(default_action_verb);
+        const std::string& default_action_verb_str =
+            ui::ToString(default_action_verb);
         result.Set(v8::String::NewFromUtf8(isolate,
                                            default_action_verb_str.c_str(),
                                            v8::NewStringType::kNormal)
@@ -1453,7 +1456,7 @@
       [](v8::Isolate* isolate, v8::ReturnValue<v8::Value> result,
          AutomationAXTreeWrapper* tree_wrapper, ui::AXNode* node) {
         ax::mojom::HasPopup has_popup = node->data().GetHasPopup();
-        std::string has_popup_str = ui::ToString(has_popup);
+        const std::string& has_popup_str = ui::ToString(has_popup);
         result.Set(v8::String::NewFromUtf8(isolate, has_popup_str.c_str(),
                                            v8::NewStringType::kNormal)
                        .ToLocalChecked());

diff --git a/infra/config/consoles/main.star b/infra/config/consoles/main.star
deleted file mode 100644
index 5f6500e..0000000
--- a/infra/config/consoles/main.star
+++ /dev/null

@@ -1,3 +0,0 @@
-exec('//versioned/milestones/m80/consoles/main.star')
-exec('//versioned/milestones/m81/consoles/main.star')
-exec('//versioned/milestones/m83/consoles/main.star')

diff --git a/infra/config/generated/luci-milo.cfg b/infra/config/generated/luci-milo.cfg
index 2126f897..6afd39f 100644
--- a/infra/config/generated/luci-milo.cfg
+++ b/infra/config/generated/luci-milo.cfg

@@ -11328,44 +11328,19 @@
   refs: "regexp:refs/branch-heads/3987"
   manifest_name: "REVISION"
   builders: <
-    name: "buildbucket/luci.chromium.ci-m80/Linux Builder"
-    category: "chromium.linux|release"
-    short_name: "bld"
+    name: "buildbucket/luci.chromium.ci-m80/Win x64 Builder"
+    category: "chromium.win|release|builder"
+    short_name: "64"
   >
   builders: <
-    name: "buildbucket/luci.chromium.ci-m80/Linux Ozone Tester (Headless)"
-    category: "linux"
-    short_name: "loh"
+    name: "buildbucket/luci.chromium.ci-m80/Win 7 Tests x64 (1)"
+    category: "chromium.win|release|tester"
+    short_name: "64"
   >
   builders: <
-    name: "buildbucket/luci.chromium.ci-m80/Linux Ozone Tester (Wayland)"
-    category: "linux"
-    short_name: "low"
-  >
-  builders: <
-    name: "buildbucket/luci.chromium.ci-m80/Linux Ozone Tester (X11)"
-    category: "linux"
-    short_name: "lox"
-  >
-  builders: <
-    name: "buildbucket/luci.chromium.ci-m80/Linux Tests"
-    category: "chromium.linux|release"
-    short_name: "tst"
-  >
-  builders: <
-    name: "buildbucket/luci.chromium.ci-m80/linux-chromeos-rel"
-    category: "chromium.chromiumos|default"
-    short_name: "rel"
-  >
-  builders: <
-    name: "buildbucket/luci.chromium.ci-m80/linux-ozone-rel"
-    category: "chromium.linux|release"
-    short_name: "ozo"
-  >
-  builders: <
-    name: "buildbucket/luci.chromium.ci-m80/chromeos-amd64-generic-rel"
-    category: "chromium.chromiumos|simple|release|x64"
-    short_name: "rel"
+    name: "buildbucket/luci.chromium.ci-m80/Win10 Tests x64"
+    category: "chromium.win|release|tester"
+    short_name: "w10"
   >
   builders: <
     name: "buildbucket/luci.chromium.ci-m80/Mac Builder"
@@ -11408,71 +11383,96 @@
     short_name: "sim"
   >
   builders: <
-    name: "buildbucket/luci.chromium.ci-m80/Win x64 Builder"
-    category: "chromium.win|release|builder"
-    short_name: "64"
+    name: "buildbucket/luci.chromium.ci-m80/Linux Builder"
+    category: "chromium.linux|release"
+    short_name: "bld"
   >
   builders: <
-    name: "buildbucket/luci.chromium.ci-m80/Win 7 Tests x64 (1)"
-    category: "chromium.win|release|tester"
-    short_name: "64"
+    name: "buildbucket/luci.chromium.ci-m80/Linux Tests"
+    category: "chromium.linux|release"
+    short_name: "tst"
   >
   builders: <
-    name: "buildbucket/luci.chromium.ci-m80/Win10 Tests x64"
-    category: "chromium.win|release|tester"
-    short_name: "w10"
+    name: "buildbucket/luci.chromium.ci-m80/linux-ozone-rel"
+    category: "chromium.linux|release"
+    short_name: "ozo"
+  >
+  builders: <
+    name: "buildbucket/luci.chromium.ci-m80/linux-chromeos-rel"
+    category: "chromium.chromiumos|default"
+    short_name: "rel"
+  >
+  builders: <
+    name: "buildbucket/luci.chromium.ci-m80/chromeos-amd64-generic-rel"
+    category: "chromium.chromiumos|simple|release|x64"
+    short_name: "rel"
   >
   builders: <
     name: "buildbucket/luci.chromium.ci-m80/android-kitkat-arm-rel"
-    category: "chromium.android"
-    short_name: "k"
+    category: "chromium.android|on_cq"
+    short_name: "K"
   >
   builders: <
     name: "buildbucket/luci.chromium.ci-m80/android-marshmallow-arm64-rel"
-    category: "chromium.android"
-    short_name: "m"
+    category: "chromium.android|on_cq"
+    short_name: "M"
+  >
+  builders: <
+    name: "buildbucket/luci.chromium.ci-m80/GPU Win x64 Builder"
+    category: "chromium.gpu|Windows"
+  >
+  builders: <
+    name: "buildbucket/luci.chromium.ci-m80/Win10 x64 Release (NVIDIA)"
+    category: "chromium.gpu|Windows"
+  >
+  builders: <
+    name: "buildbucket/luci.chromium.ci-m80/GPU Mac Builder"
+    category: "chromium.gpu|Mac"
+  >
+  builders: <
+    name: "buildbucket/luci.chromium.ci-m80/Mac Release (Intel)"
+    category: "chromium.gpu|Mac"
+  >
+  builders: <
+    name: "buildbucket/luci.chromium.ci-m80/Mac Retina Release (AMD)"
+    category: "chromium.gpu|Mac"
+  >
+  builders: <
+    name: "buildbucket/luci.chromium.ci-m80/GPU Linux Builder"
+    category: "chromium.gpu|Linux"
+  >
+  builders: <
+    name: "buildbucket/luci.chromium.ci-m80/Linux Release (NVIDIA)"
+    category: "chromium.gpu|Linux"
+  >
+  builders: <
+    name: "buildbucket/luci.chromium.ci-m80/Android Release (Nexus 5X)"
+    category: "chromium.gpu|Android"
   >
   builders: <
     name: "buildbucket/luci.chromium.ci-m80/mac-osxbeta-rel"
     category: "chromium.fyi|mac"
-    short_name: "osxbeta"
+    short_name: "beta"
+  >
+  builders: <
+    name: "buildbucket/luci.chromium.ci-m80/Linux Ozone Tester (Headless)"
+    category: "chromium.fyi|linux"
+    short_name: "loh"
+  >
+  builders: <
+    name: "buildbucket/luci.chromium.ci-m80/Linux Ozone Tester (Wayland)"
+    category: "chromium.fyi|linux"
+    short_name: "low"
+  >
+  builders: <
+    name: "buildbucket/luci.chromium.ci-m80/Linux Ozone Tester (X11)"
+    category: "chromium.fyi|linux"
+    short_name: "lox"
   >
   builders: <
     name: "buildbucket/luci.chromium.ci-m80/Win10 Tests x64 1803"
     category: "chromium.fyi|win10|1803"
   >
-  builders: <
-    name: "buildbucket/luci.chromium.ci-m80/Android Release (Nexus 5X)"
-    category: "chromium.gpu|android"
-  >
-  builders: <
-    name: "buildbucket/luci.chromium.ci-m80/GPU Linux Builder"
-    category: "chromium.gpu|linux"
-  >
-  builders: <
-    name: "buildbucket/luci.chromium.ci-m80/Linux Release (NVIDIA)"
-    category: "chromium.gpu|linux"
-  >
-  builders: <
-    name: "buildbucket/luci.chromium.ci-m80/GPU Mac Builder"
-    category: "chromium.gpu|mac"
-  >
-  builders: <
-    name: "buildbucket/luci.chromium.ci-m80/Mac Release (Intel)"
-    category: "chromium.gpu|mac"
-  >
-  builders: <
-    name: "buildbucket/luci.chromium.ci-m80/Mac Retina Release (AMD)"
-    category: "chromium.gpu|mac"
-  >
-  builders: <
-    name: "buildbucket/luci.chromium.ci-m80/GPU Win x64 Builder"
-    category: "chromium.gpu|win"
-  >
-  builders: <
-    name: "buildbucket/luci.chromium.ci-m80/Win10 x64 Release (NVIDIA)"
-    category: "chromium.gpu|win"
-  >
   header: <
     oncalls: <
       name: "Chromium"
@@ -11746,68 +11746,29 @@
   refs: "regexp:refs/branch-heads/4044"
   manifest_name: "REVISION"
   builders: <
-    name: "buildbucket/luci.chromium.ci-m81/Linux Builder"
-    category: "chromium.linux|release"
-    short_name: "bld"
+    name: "buildbucket/luci.chromium.ci-m81/Win x64 Builder"
+    category: "chromium.win|release|builder"
+    short_name: "64"
   >
   builders: <
-    name: "buildbucket/luci.chromium.ci-m81/Linux Ozone Tester (Headless)"
-    category: "linux"
-    short_name: "loh"
+    name: "buildbucket/luci.chromium.ci-m81/Win 7 Tests x64 (1)"
+    category: "chromium.win|release|tester"
+    short_name: "64"
   >
   builders: <
-    name: "buildbucket/luci.chromium.ci-m81/Linux Ozone Tester (Wayland)"
-    category: "linux"
-    short_name: "low"
+    name: "buildbucket/luci.chromium.ci-m81/Win10 Tests x64"
+    category: "chromium.win|release|tester"
+    short_name: "w10"
   >
   builders: <
-    name: "buildbucket/luci.chromium.ci-m81/Linux Ozone Tester (X11)"
-    category: "linux"
-    short_name: "lox"
+    name: "buildbucket/luci.chromium.ci-m81/Win Builder (dbg)"
+    category: "chromium.win|debug|builder"
+    short_name: "32"
   >
   builders: <
-    name: "buildbucket/luci.chromium.ci-m81/Linux Tests"
-    category: "chromium.linux|release"
-    short_name: "tst"
-  >
-  builders: <
-    name: "buildbucket/luci.chromium.ci-m81/linux-ozone-rel"
-    category: "chromium.linux|release"
-    short_name: "ozo"
-  >
-  builders: <
-    name: "buildbucket/luci.chromium.ci-m81/Cast Linux"
-    category: "chromium.linux|cast"
-    short_name: "vid"
-  >
-  builders: <
-    name: "buildbucket/luci.chromium.ci-m81/Fuchsia ARM64"
-    category: "chromium.linux|fuchsia|a64"
-  >
-  builders: <
-    name: "buildbucket/luci.chromium.ci-m81/Fuchsia x64"
-    category: "chromium.linux|fuchsia|x64"
-    short_name: "rel"
-  >
-  builders: <
-    name: "buildbucket/luci.chromium.ci-m81/linux-chromeos-rel"
-    category: "chromium.chromiumos|default"
-    short_name: "rel"
-  >
-  builders: <
-    name: "buildbucket/luci.chromium.ci-m81/linux-chromeos-dbg"
-    category: "chromium.chromiumos|default"
-    short_name: "dbg"
-  >
-  builders: <
-    name: "buildbucket/luci.chromium.ci-m81/chromeos-arm-generic-rel"
-    category: "chromium.chromiumos|simple|release"
-    short_name: "arm"
-  >
-  builders: <
-    name: "buildbucket/luci.chromium.ci-m81/chromeos-amd64-generic-rel"
-    category: "chromium.chromiumos|simple|release|x64"
-    short_name: "rel"
+    name: "buildbucket/luci.chromium.ci-m81/Win7 Tests (dbg)(1)"
+    category: "chromium.win|debug|tester"
+    short_name: "7"
   >
   builders: <
     name: "buildbucket/luci.chromium.ci-m81/Mac Builder"
@@ -11860,64 +11821,53 @@
     short_name: "sim"
   >
   builders: <
-    name: "buildbucket/luci.chromium.ci-m81/Win x64 Builder"
-    category: "chromium.win|release|builder"
-    short_name: "64"
-  >
-  builders: <
-    name: "buildbucket/luci.chromium.ci-m81/Win 7 Tests x64 (1)"
-    category: "chromium.win|release|tester"
-    short_name: "64"
-  >
-  builders: <
-    name: "buildbucket/luci.chromium.ci-m81/Win10 Tests x64"
-    category: "chromium.win|release|tester"
-    short_name: "w10"
-  >
-  builders: <
-    name: "buildbucket/luci.chromium.ci-m81/Win Builder (dbg)"
-    category: "chromium.win|debug|builder"
-    short_name: "32"
-  >
-  builders: <
-    name: "buildbucket/luci.chromium.ci-m81/Win7 Tests (dbg)(1)"
-    category: "chromium.win|debug|tester"
-    short_name: "7"
-  >
-  builders: <
-    name: "buildbucket/luci.chromium.ci-m81/Linux ASan LSan Builder"
-    category: "chromium.memory|linux|asan lsan"
+    name: "buildbucket/luci.chromium.ci-m81/Linux Builder"
+    category: "chromium.linux|release"
     short_name: "bld"
   >
   builders: <
-    name: "buildbucket/luci.chromium.ci-m81/Linux ASan LSan Tests (1)"
-    category: "chromium.memory|linux|asan lsan"
+    name: "buildbucket/luci.chromium.ci-m81/Linux Tests"
+    category: "chromium.linux|release"
     short_name: "tst"
   >
   builders: <
-    name: "buildbucket/luci.chromium.ci-m81/Linux ASan Tests (sandboxed)"
-    category: "chromium.memory|linux|asan lsan"
-    short_name: "sbx"
+    name: "buildbucket/luci.chromium.ci-m81/linux-ozone-rel"
+    category: "chromium.linux|release"
+    short_name: "ozo"
   >
   builders: <
-    name: "buildbucket/luci.chromium.ci-m81/android-kitkat-arm-rel"
-    category: "chromium.android"
-    short_name: "k"
+    name: "buildbucket/luci.chromium.ci-m81/Cast Linux"
+    category: "chromium.linux|cast"
+    short_name: "vid"
   >
   builders: <
-    name: "buildbucket/luci.chromium.ci-m81/android-marshmallow-arm64-rel"
-    category: "chromium.android"
-    short_name: "m"
+    name: "buildbucket/luci.chromium.ci-m81/Fuchsia ARM64"
+    category: "chromium.linux|fuchsia|a64"
   >
   builders: <
-    name: "buildbucket/luci.chromium.ci-m81/Cast Android (dbg)"
-    category: "chromium.android"
-    short_name: "cst"
+    name: "buildbucket/luci.chromium.ci-m81/Fuchsia x64"
+    category: "chromium.linux|fuchsia|x64"
+    short_name: "rel"
   >
   builders: <
-    name: "buildbucket/luci.chromium.ci-m81/Android arm Builder (dbg)"
-    category: "chromium.android|builder|arm"
-    short_name: "32"
+    name: "buildbucket/luci.chromium.ci-m81/linux-chromeos-rel"
+    category: "chromium.chromiumos|default"
+    short_name: "rel"
+  >
+  builders: <
+    name: "buildbucket/luci.chromium.ci-m81/linux-chromeos-dbg"
+    category: "chromium.chromiumos|default"
+    short_name: "dbg"
+  >
+  builders: <
+    name: "buildbucket/luci.chromium.ci-m81/chromeos-arm-generic-rel"
+    category: "chromium.chromiumos|simple|release"
+    short_name: "arm"
+  >
+  builders: <
+    name: "buildbucket/luci.chromium.ci-m81/chromeos-amd64-generic-rel"
+    category: "chromium.chromiumos|simple|release|x64"
+    short_name: "rel"
   >
   builders: <
     name: "buildbucket/luci.chromium.ci-m81/android-cronet-arm-rel"
@@ -11935,46 +11885,96 @@
     short_name: "l"
   >
   builders: <
+    name: "buildbucket/luci.chromium.ci-m81/Android arm Builder (dbg)"
+    category: "chromium.android|builder|arm"
+    short_name: "32"
+  >
+  builders: <
+    name: "buildbucket/luci.chromium.ci-m81/android-kitkat-arm-rel"
+    category: "chromium.android|on_cq"
+    short_name: "K"
+  >
+  builders: <
+    name: "buildbucket/luci.chromium.ci-m81/android-marshmallow-arm64-rel"
+    category: "chromium.android|on_cq"
+    short_name: "M"
+  >
+  builders: <
+    name: "buildbucket/luci.chromium.ci-m81/Cast Android (dbg)"
+    category: "chromium.android|on_cq"
+    short_name: "cst"
+  >
+  builders: <
+    name: "buildbucket/luci.chromium.ci-m81/Linux ASan LSan Builder"
+    category: "chromium.memory|linux|asan lsan"
+    short_name: "bld"
+  >
+  builders: <
+    name: "buildbucket/luci.chromium.ci-m81/Linux ASan LSan Tests (1)"
+    category: "chromium.memory|linux|asan lsan"
+    short_name: "tst"
+  >
+  builders: <
+    name: "buildbucket/luci.chromium.ci-m81/Linux ASan Tests (sandboxed)"
+    category: "chromium.memory|linux|asan lsan"
+    short_name: "sbx"
+  >
+  builders: <
+    name: "buildbucket/luci.chromium.ci-m81/GPU Win x64 Builder"
+    category: "chromium.gpu|Windows"
+  >
+  builders: <
+    name: "buildbucket/luci.chromium.ci-m81/Win10 x64 Release (NVIDIA)"
+    category: "chromium.gpu|Windows"
+  >
+  builders: <
+    name: "buildbucket/luci.chromium.ci-m81/GPU Mac Builder"
+    category: "chromium.gpu|Mac"
+  >
+  builders: <
+    name: "buildbucket/luci.chromium.ci-m81/Mac Release (Intel)"
+    category: "chromium.gpu|Mac"
+  >
+  builders: <
+    name: "buildbucket/luci.chromium.ci-m81/Mac Retina Release (AMD)"
+    category: "chromium.gpu|Mac"
+  >
+  builders: <
+    name: "buildbucket/luci.chromium.ci-m81/GPU Linux Builder"
+    category: "chromium.gpu|Linux"
+  >
+  builders: <
+    name: "buildbucket/luci.chromium.ci-m81/Linux Release (NVIDIA)"
+    category: "chromium.gpu|Linux"
+  >
+  builders: <
+    name: "buildbucket/luci.chromium.ci-m81/Android Release (Nexus 5X)"
+    category: "chromium.gpu|Android"
+  >
+  builders: <
     name: "buildbucket/luci.chromium.ci-m81/mac-osxbeta-rel"
     category: "chromium.fyi|mac"
-    short_name: "osxbeta"
+    short_name: "beta"
+  >
+  builders: <
+    name: "buildbucket/luci.chromium.ci-m81/Linux Ozone Tester (Headless)"
+    category: "chromium.fyi|linux"
+    short_name: "loh"
+  >
+  builders: <
+    name: "buildbucket/luci.chromium.ci-m81/Linux Ozone Tester (Wayland)"
+    category: "chromium.fyi|linux"
+    short_name: "low"
+  >
+  builders: <
+    name: "buildbucket/luci.chromium.ci-m81/Linux Ozone Tester (X11)"
+    category: "chromium.fyi|linux"
+    short_name: "lox"
   >
   builders: <
     name: "buildbucket/luci.chromium.ci-m81/Win10 Tests x64 1803"
     category: "chromium.fyi|win10|1803"
   >
-  builders: <
-    name: "buildbucket/luci.chromium.ci-m81/Android Release (Nexus 5X)"
-    category: "chromium.gpu|android"
-  >
-  builders: <
-    name: "buildbucket/luci.chromium.ci-m81/GPU Linux Builder"
-    category: "chromium.gpu|linux"
-  >
-  builders: <
-    name: "buildbucket/luci.chromium.ci-m81/Linux Release (NVIDIA)"
-    category: "chromium.gpu|linux"
-  >
-  builders: <
-    name: "buildbucket/luci.chromium.ci-m81/GPU Mac Builder"
-    category: "chromium.gpu|mac"
-  >
-  builders: <
-    name: "buildbucket/luci.chromium.ci-m81/Mac Release (Intel)"
-    category: "chromium.gpu|mac"
-  >
-  builders: <
-    name: "buildbucket/luci.chromium.ci-m81/Mac Retina Release (AMD)"
-    category: "chromium.gpu|mac"
-  >
-  builders: <
-    name: "buildbucket/luci.chromium.ci-m81/GPU Win x64 Builder"
-    category: "chromium.gpu|win"
-  >
-  builders: <
-    name: "buildbucket/luci.chromium.ci-m81/Win10 x64 Release (NVIDIA)"
-    category: "chromium.gpu|win"
-  >
   header: <
     oncalls: <
       name: "Chromium"
@@ -12387,16 +12387,6 @@
     short_name: "dbg"
   >
   builders: <
-    name: "buildbucket/luci.chromium.ci-m83/chromeos-amd64-generic-dbg"
-    category: "chromium.chromiumos|simple|debug|x64"
-    short_name: "dbg"
-  >
-  builders: <
-    name: "buildbucket/luci.chromium.ci-m83/chromeos-amd64-generic-rel"
-    category: "chromium.chromiumos|simple|release|x64"
-    short_name: "rel"
-  >
-  builders: <
     name: "buildbucket/luci.chromium.ci-m83/chromeos-arm-generic-rel"
     category: "chromium.chromiumos|simple|release"
     short_name: "arm"
@@ -12407,6 +12397,16 @@
     short_name: "kvn"
   >
   builders: <
+    name: "buildbucket/luci.chromium.ci-m83/chromeos-amd64-generic-rel"
+    category: "chromium.chromiumos|simple|release|x64"
+    short_name: "rel"
+  >
+  builders: <
+    name: "buildbucket/luci.chromium.ci-m83/chromeos-amd64-generic-dbg"
+    category: "chromium.chromiumos|simple|debug|x64"
+    short_name: "dbg"
+  >
+  builders: <
     name: "buildbucket/luci.chromium.ci-m83/android-cronet-arm-dbg"
     category: "chromium.android|cronet|arm"
     short_name: "dbg"
@@ -12497,34 +12497,14 @@
     short_name: "M"
   >
   builders: <
-    name: "buildbucket/luci.chromium.ci-m83/Cast Android (dbg)"
-    category: "chromium.android|on_cq"
-    short_name: "cst"
-  >
-  builders: <
     name: "buildbucket/luci.chromium.ci-m83/android-pie-arm64-rel"
     category: "chromium.android|on_cq"
     short_name: "P"
   >
   builders: <
-    name: "buildbucket/luci.chrome.ci/linux-chromeos-chrome"
-    category: "chrome"
-    short_name: "cro"
-  >
-  builders: <
-    name: "buildbucket/luci.chrome.ci/linux-chrome"
-    category: "chrome"
-    short_name: "lnx"
-  >
-  builders: <
-    name: "buildbucket/luci.chrome.ci/mac-chrome"
-    category: "chrome"
-    short_name: "mac"
-  >
-  builders: <
-    name: "buildbucket/luci.chrome.ci/win-chrome"
-    category: "chrome"
-    short_name: "win"
+    name: "buildbucket/luci.chromium.ci-m83/Cast Android (dbg)"
+    category: "chromium.android|on_cq"
+    short_name: "cst"
   >
   builders: <
     name: "buildbucket/luci.chromium.ci-m83/Linux TSan Builder"
@@ -12654,7 +12634,7 @@
   >
   builders: <
     name: "buildbucket/luci.chromium.ci-m83/chromeos-kevin-rel-hw-tests"
-    category: "chromium.fyi|chromos"
+    category: "chromium.fyi|chromeos"
   >
   builders: <
     name: "buildbucket/luci.chromium.ci-m83/VR Linux"

diff --git a/infra/config/main.star b/infra/config/main.star
index 52229fc3..6df2dab 100755
--- a/infra/config/main.star
+++ b/infra/config/main.star

@@ -113,7 +113,6 @@
 exec('//consoles/goma.latest.star')
 exec('//consoles/luci.chromium.goma.star')
 exec('//consoles/luci.chromium.try.star')
-exec('//consoles/main.star')
 exec('//consoles/sheriff.ios.star')
 exec('//consoles/try-m80.star')
 exec('//consoles/try-m81.star')

diff --git a/infra/config/versioned/milestones/m80/buckets/ci.star b/infra/config/versioned/milestones/m80/buckets/ci.star
index a64ea53..752e564 100644
--- a/infra/config/versioned/milestones/m80/buckets/ci.star
+++ b/infra/config/versioned/milestones/m80/buckets/ci.star

@@ -31,9 +31,37 @@
     refs = [vars.ref],
 )
 
+ci.main_console_view(
+    name = vars.main_console_name,
+    header = '//consoles/chromium-header.textpb',
+    repo = 'https://chromium.googlesource.com/chromium/src',
+    refs = [vars.ref],
+    title = vars.main_console_title,
+    top_level_ordering = [
+        'chromium',
+        'chromium.win',
+        'chromium.mac',
+        'chromium.linux',
+        'chromium.chromiumos',
+        'chromium.android',
+        'chrome',
+        'chromium.memory',
+        'chromium.dawn',
+        'chromium.gpu',
+        'chromium.fyi',
+        'chromium.android.fyi',
+        'chromium.clang',
+        'chromium.fuzz',
+        'chromium.gpu.fyi',
+        'chromium.swangle',
+    ],
+)
 
+
+ci.defaults.add_to_console_view.set(vars.is_master)
 ci.defaults.bucket.set(vars.ci_bucket)
 ci.defaults.bucketed_triggers.set(True)
+ci.defaults.main_console_view.set(vars.main_console_name)
 ci.defaults.triggered_by.set([vars.ci_poller])
 
 
@@ -43,19 +71,35 @@
 
 ci.android_builder(
     name = 'android-kitkat-arm-rel',
+    console_view_entry = ci.console_view_entry(
+        category = 'on_cq',
+        short_name = 'K',
+    ),
 )
 
 ci.android_builder(
     name = 'android-marshmallow-arm64-rel',
+    console_view_entry = ci.console_view_entry(
+        category = 'on_cq',
+        short_name = 'M',
+    ),
 )
 
 
 ci.chromiumos_builder(
     name = 'chromeos-amd64-generic-rel',
+    console_view_entry = ci.console_view_entry(
+        category = 'simple|release|x64',
+        short_name = 'rel',
+    ),
 )
 
 ci.chromiumos_builder(
     name = 'linux-chromeos-rel',
+    console_view_entry = ci.console_view_entry(
+        category = 'default',
+        short_name = 'rel',
+    ),
 )
 
 
@@ -63,6 +107,10 @@
 # OS shouldn't matter.
 ci.fyi_builder(
     name = 'mac-osxbeta-rel',
+    console_view_entry = ci.console_view_entry(
+        category = 'mac',
+        short_name = 'beta',
+    ),
     goma_backend = None,
     triggered_by = [builder_name('Mac Builder')],
 )
@@ -70,22 +118,34 @@
 
 ci.fyi_windows_builder(
     name = 'Win10 Tests x64 1803',
-    os = os.WINDOWS_10,
+    console_view_entry = ci.console_view_entry(
+        category = 'win10|1803',
+    ),
     goma_backend = None,
+    os = os.WINDOWS_10,
     triggered_by = [builder_name('Win x64 Builder')],
 )
 
 
 ci.gpu_builder(
     name = 'Android Release (Nexus 5X)',
+    console_view_entry = ci.console_view_entry(
+        category = 'Android',
+    ),
 )
 
 ci.gpu_builder(
     name = 'GPU Linux Builder',
+    console_view_entry = ci.console_view_entry(
+        category = 'Linux',
+    ),
 )
 
 ci.gpu_builder(
     name = 'GPU Mac Builder',
+    console_view_entry = ci.console_view_entry(
+        category = 'Mac',
+    ),
     cores = None,
     os = os.MAC_ANY,
 )
@@ -93,59 +153,101 @@
 ci.gpu_builder(
     name = 'GPU Win x64 Builder',
     builderless = True,
+    console_view_entry = ci.console_view_entry(
+        category = 'Windows',
+    ),
     os = os.WINDOWS_ANY,
 )
 
 
 ci.gpu_thin_tester(
     name = 'Linux Release (NVIDIA)',
+    console_view_entry = ci.console_view_entry(
+        category = 'Linux',
+    ),
     triggered_by = [builder_name('GPU Linux Builder')],
 )
 
 ci.gpu_thin_tester(
     name = 'Mac Release (Intel)',
+    console_view_entry = ci.console_view_entry(
+        category = 'Mac',
+    ),
     triggered_by = [builder_name('GPU Mac Builder')],
 )
 
 ci.gpu_thin_tester(
     name = 'Mac Retina Release (AMD)',
+    console_view_entry = ci.console_view_entry(
+        category = 'Mac',
+    ),
     triggered_by = [builder_name('GPU Mac Builder')],
 )
 
 ci.gpu_thin_tester(
     name = 'Win10 x64 Release (NVIDIA)',
+    console_view_entry = ci.console_view_entry(
+        category = 'Windows',
+    ),
     triggered_by = [builder_name('GPU Win x64 Builder')],
 )
 
 
 ci.linux_builder(
     name = 'Linux Builder',
+    console_view_entry = ci.console_view_entry(
+        category = 'release',
+        short_name = 'bld',
+    ),
 )
 
 ci.linux_builder(
     name = 'Linux Tests',
+    console_view_entry = ci.console_view_entry(
+        category = 'release',
+        short_name = 'tst',
+    ),
     goma_backend = None,
     triggered_by = [builder_name('Linux Builder')],
 )
 
 ci.linux_builder(
     name = 'linux-ozone-rel',
+    console_view_entry = ci.console_view_entry(
+        category = 'release',
+        short_name = 'ozo',
+    ),
 )
 
 ci.linux_builder(
     name = 'Linux Ozone Tester (Headless)',
+    console_view = 'chromium.fyi',
+    console_view_entry = ci.console_view_entry(
+        category = 'linux',
+        short_name = 'loh',
+    ),
     goma_backend = None,
     triggered_by = [builder_name('linux-ozone-rel')],
 )
 
 ci.linux_builder(
     name = 'Linux Ozone Tester (Wayland)',
+    console_view = 'chromium.fyi',
+    console_view_entry = ci.console_view_entry(
+        category = 'linux',
+        short_name = 'low',
+    ),
     goma_backend = None,
     triggered_by = [builder_name('linux-ozone-rel')],
 )
 
 ci.linux_builder(
     name = 'Linux Ozone Tester (X11)',
+    console_view = 'chromium.fyi',
+    console_view_entry = ci.console_view_entry(
+        category = 'linux',
+        short_name = 'lox',
+    ),
     goma_backend = None,
     triggered_by = [builder_name('linux-ozone-rel')],
 )
@@ -153,41 +255,69 @@
 
 ci.mac_builder(
     name = 'Mac Builder',
+    console_view_entry = ci.console_view_entry(
+        category = 'release',
+        short_name = 'bld',
+    ),
     os = os.MAC_10_14,
 )
 
 # The build runs on 10.13, but triggers tests on 10.10 bots.
 ci.mac_builder(
     name = 'Mac10.10 Tests',
+    console_view_entry = ci.console_view_entry(
+        category = 'release',
+        short_name = '10',
+    ),
     triggered_by = [builder_name('Mac Builder')],
 )
 
 # The build runs on 10.13, but triggers tests on 10.11 bots.
 ci.mac_builder(
     name = 'Mac10.11 Tests',
+    console_view_entry = ci.console_view_entry(
+        category = 'release',
+        short_name = '11',
+    ),
     triggered_by = [builder_name('Mac Builder')],
 )
 
 ci.mac_builder(
     name = 'Mac10.12 Tests',
+    console_view_entry = ci.console_view_entry(
+        category = 'release',
+        short_name = '12',
+    ),
     os = os.MAC_10_12,
     triggered_by = [builder_name('Mac Builder')],
 )
 
 ci.mac_builder(
     name = 'Mac10.13 Tests',
+    console_view_entry = ci.console_view_entry(
+        category = 'release',
+        short_name = '13',
+    ),
     os = os.MAC_10_13,
     triggered_by = [builder_name('Mac Builder')],
 )
 
 ci.mac_builder(
     name = 'Mac10.14 Tests',
+    console_view_entry = ci.console_view_entry(
+        category = 'release',
+        short_name = '14',
+    ),
     os = os.MAC_10_14,
     triggered_by = [builder_name('Mac Builder')],
 )
 
 ci.mac_builder(
     name = 'WebKit Mac10.13 (retina)',
+    console_view_entry = ci.console_view_entry(
+        category = 'release',
+        short_name = 'ret',
+    ),
     os = os.MAC_10_13,
     triggered_by = [builder_name('Mac Builder')],
 )
@@ -195,23 +325,40 @@
 
 ci.mac_ios_builder(
     name = 'ios-simulator',
+    console_view_entry = ci.console_view_entry(
+        category = 'ios|default',
+        short_name = 'sim',
+    ),
     goma_backend = None,
 )
 
 
+
 ci.win_builder(
     name = 'Win 7 Tests x64 (1)',
+    console_view_entry = ci.console_view_entry(
+        category = 'release|tester',
+        short_name = '64',
+    ),
     os = os.WINDOWS_7,
     triggered_by = [builder_name('Win x64 Builder')],
 )
 
 ci.win_builder(
     name = 'Win x64 Builder',
+    console_view_entry = ci.console_view_entry(
+        category = 'release|builder',
+        short_name = '64',
+    ),
     cores = 32,
     os = os.WINDOWS_ANY,
 )
 
 ci.win_builder(
     name = 'Win10 Tests x64',
+    console_view_entry = ci.console_view_entry(
+        category = 'release|tester',
+        short_name = 'w10',
+    ),
     triggered_by = [builder_name('Win x64 Builder')],
 )

diff --git a/infra/config/versioned/milestones/m80/consoles/main.star b/infra/config/versioned/milestones/m80/consoles/main.star
deleted file mode 100644
index a1647b7d..0000000
--- a/infra/config/versioned/milestones/m80/consoles/main.star
+++ /dev/null

@@ -1,163 +0,0 @@
-load('//lib/builders.star', 'builder_name', 'defaults')
-load('../vars.star', 'vars')
-
-defaults.bucket.set(vars.ci_bucket)
-
-# TODO(https://crbug.com/922150) Add to chromium header
-luci.console_view(
-    name = vars.main_console_name,
-    header = '//consoles/chromium-header.textpb',
-    repo = 'https://chromium.googlesource.com/chromium/src',
-    refs = [vars.ref],
-    title = vars.main_console_title,
-    entries = [
-        luci.console_view_entry(
-            builder = builder_name('Linux Builder'),
-            category = 'chromium.linux|release',
-            short_name = 'bld',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Linux Ozone Tester (Headless)'),
-            category = 'linux',
-            short_name = 'loh',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Linux Ozone Tester (Wayland)'),
-            category = 'linux',
-            short_name = 'low',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Linux Ozone Tester (X11)'),
-            category = 'linux',
-            short_name = 'lox',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Linux Tests'),
-            category = 'chromium.linux|release',
-            short_name = 'tst',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('linux-chromeos-rel'),
-            category = 'chromium.chromiumos|default',
-            short_name = 'rel',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('linux-ozone-rel'),
-            category = 'chromium.linux|release',
-            short_name = 'ozo',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('chromeos-amd64-generic-rel'),
-            category = 'chromium.chromiumos|simple|release|x64',
-            short_name = 'rel',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Mac Builder'),
-            category = 'chromium.mac|release',
-            short_name = 'bld',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Mac10.10 Tests'),
-            category = 'chromium.mac|release',
-            short_name = '10',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Mac10.11 Tests'),
-            category = 'chromium.mac|release',
-            short_name = '11',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Mac10.12 Tests'),
-            category = 'chromium.mac|release',
-            short_name = '12',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Mac10.13 Tests'),
-            category = 'chromium.mac|release',
-            short_name = '13',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Mac10.14 Tests'),
-            category = 'chromium.mac|release',
-            short_name = '14',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('WebKit Mac10.13 (retina)'),
-            category = 'chromium.mac|release',
-            short_name = 'ret',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('ios-simulator'),
-            category = 'chromium.mac|ios|default',
-            short_name = 'sim',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Win x64 Builder'),
-            category = 'chromium.win|release|builder',
-            short_name = '64',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Win 7 Tests x64 (1)'),
-            category = 'chromium.win|release|tester',
-            short_name = '64',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Win10 Tests x64'),
-            category = 'chromium.win|release|tester',
-            short_name = 'w10',
-        ),
-        # TODO(https://crbug.com/922150) Add the following builders to the main
-        # console or don't have them be mirrored by main waterfall trybots
-        luci.console_view_entry(
-            builder = builder_name('android-kitkat-arm-rel'),
-            category = 'chromium.android',
-            short_name = 'k',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('android-marshmallow-arm64-rel'),
-            category = 'chromium.android',
-            short_name = 'm',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('mac-osxbeta-rel'),
-            category = 'chromium.fyi|mac',
-            short_name = 'osxbeta',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Win10 Tests x64 1803'),
-            category = 'chromium.fyi|win10|1803',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Android Release (Nexus 5X)'),
-            category = 'chromium.gpu|android',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('GPU Linux Builder'),
-            category = 'chromium.gpu|linux',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Linux Release (NVIDIA)'),
-            category = 'chromium.gpu|linux',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('GPU Mac Builder'),
-            category = 'chromium.gpu|mac',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Mac Release (Intel)'),
-            category = 'chromium.gpu|mac',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Mac Retina Release (AMD)'),
-            category = 'chromium.gpu|mac',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('GPU Win x64 Builder'),
-            category = 'chromium.gpu|win',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Win10 x64 Release (NVIDIA)'),
-            category = 'chromium.gpu|win',
-        ),
-    ],
-)

diff --git a/infra/config/versioned/milestones/m80/vars.star b/infra/config/versioned/milestones/m80/vars.star
index a5d8eb5..6122c52 100644
--- a/infra/config/versioned/milestones/m80/vars.star
+++ b/infra/config/versioned/milestones/m80/vars.star

@@ -1,10 +1,11 @@
 vars = struct(
+    is_master = False,
     ref = 'refs/branch-heads/3987',
     ci_bucket = 'ci-m80',
     ci_poller = 'm80-gitiles-trigger',
+    main_console_name = 'main-m80',
+    main_console_title = 'Chromium M80 Console',
     try_bucket = 'try-m80',
     cq_group = 'cq-m80',
     cq_ref_regexp = 'refs/branch-heads/3987',
-    main_console_name = 'main-m80',
-    main_console_title = 'Chromium M80 Console',
 )

diff --git a/infra/config/versioned/milestones/m81/buckets/ci.star b/infra/config/versioned/milestones/m81/buckets/ci.star
index 4ca4365..e48e565 100644
--- a/infra/config/versioned/milestones/m81/buckets/ci.star
+++ b/infra/config/versioned/milestones/m81/buckets/ci.star

@@ -31,9 +31,37 @@
     refs = [vars.ref],
 )
 
+ci.main_console_view(
+    name = vars.main_console_name,
+    header = '//consoles/chromium-header.textpb',
+    repo = 'https://chromium.googlesource.com/chromium/src',
+    refs = [vars.ref],
+    title = vars.main_console_title,
+    top_level_ordering = [
+        'chromium',
+        'chromium.win',
+        'chromium.mac',
+        'chromium.linux',
+        'chromium.chromiumos',
+        'chromium.android',
+        'chrome',
+        'chromium.memory',
+        'chromium.dawn',
+        'chromium.gpu',
+        'chromium.fyi',
+        'chromium.android.fyi',
+        'chromium.clang',
+        'chromium.fuzz',
+        'chromium.gpu.fyi',
+        'chromium.swangle',
+    ],
+)
 
+
+ci.defaults.add_to_console_view.set(vars.is_master)
 ci.defaults.bucket.set(vars.ci_bucket)
 ci.defaults.bucketed_triggers.set(True)
+ci.defaults.main_console_view.set(vars.main_console_name)
 ci.defaults.triggered_by.set([vars.ci_poller])
 
 
@@ -43,53 +71,97 @@
 
 ci.android_builder(
     name = 'Android arm Builder (dbg)',
+    console_view_entry = ci.console_view_entry(
+        category = 'builder|arm',
+        short_name = '32',
+    ),
     execution_timeout = 4 * time.hour,
 )
 
 ci.android_builder(
     name = 'Cast Android (dbg)',
+    console_view_entry = ci.console_view_entry(
+        category = 'on_cq',
+        short_name = 'cst',
+    ),
 )
 
 ci.android_builder(
     name = 'android-cronet-arm-rel',
+    console_view_entry = ci.console_view_entry(
+        category = 'cronet|arm',
+        short_name = 'rel',
+    ),
     notifies = ['cronet'],
 )
 
 ci.android_builder(
     name = 'android-cronet-kitkat-arm-rel',
+    console_view_entry = ci.console_view_entry(
+        category = 'cronet|test',
+        short_name = 'k',
+    ),
     notifies = ['cronet'],
     triggered_by = [builder_name('android-cronet-arm-rel')],
 )
 
 ci.android_builder(
     name = 'android-cronet-lollipop-arm-rel',
+    console_view_entry = ci.console_view_entry(
+        category = 'cronet|test',
+        short_name = 'l',
+    ),
     notifies = ['cronet'],
     triggered_by = [builder_name('android-cronet-arm-rel')],
 )
 
 ci.android_builder(
     name = 'android-kitkat-arm-rel',
+    console_view_entry = ci.console_view_entry(
+        category = 'on_cq',
+        short_name = 'K',
+    ),
 )
 
 ci.android_builder(
     name = 'android-marshmallow-arm64-rel',
+    console_view_entry = ci.console_view_entry(
+        category = 'on_cq',
+        short_name = 'M',
+    ),
 )
 
 
 ci.chromiumos_builder(
     name = 'chromeos-amd64-generic-rel',
+    console_view_entry = ci.console_view_entry(
+        category = 'simple|release|x64',
+        short_name = 'rel',
+    ),
 )
 
 ci.chromiumos_builder(
     name = 'chromeos-arm-generic-rel',
+    console_view_entry = ci.console_view_entry(
+        category = 'simple|release',
+        short_name = 'arm',
+    ),
 )
 
 ci.chromiumos_builder(
     name = 'linux-chromeos-dbg',
+    console_view_entry = ci.console_view_entry(
+        category = 'default',
+        short_name = 'dbg',
+    ),
 )
 
 ci.chromiumos_builder(
     name = 'linux-chromeos-rel',
+    console_view_entry = ci.console_view_entry(
+        category = 'default',
+        short_name = 'rel',
+    ),
 )
 
 
@@ -97,6 +169,10 @@
 # OS shouldn't matter.
 ci.fyi_builder(
     name = 'mac-osxbeta-rel',
+    console_view_entry = ci.console_view_entry(
+        category = 'mac',
+        short_name = 'beta',
+    ),
     goma_backend = None,
     triggered_by = [builder_name('Mac Builder')],
 )
@@ -104,6 +180,9 @@
 
 ci.fyi_windows_builder(
     name = 'Win10 Tests x64 1803',
+    console_view_entry = ci.console_view_entry(
+        category = 'win10|1803',
+    ),
     goma_backend = None,
     os = os.WINDOWS_10,
     triggered_by = [builder_name('Win x64 Builder')],
@@ -112,14 +191,23 @@
 
 ci.gpu_builder(
     name = 'Android Release (Nexus 5X)',
+    console_view_entry = ci.console_view_entry(
+        category = 'Android',
+    ),
 )
 
 ci.gpu_builder(
     name = 'GPU Linux Builder',
+    console_view_entry = ci.console_view_entry(
+        category = 'Linux',
+    ),
 )
 
 ci.gpu_builder(
     name = 'GPU Mac Builder',
+    console_view_entry = ci.console_view_entry(
+        category = 'Mac',
+    ),
     cores = None,
     os = os.MAC_ANY,
 )
@@ -127,126 +215,216 @@
 ci.gpu_builder(
     name = 'GPU Win x64 Builder',
     builderless = True,
+    console_view_entry = ci.console_view_entry(
+        category = 'Windows',
+    ),
     os = os.WINDOWS_ANY,
 )
 
 
 ci.gpu_thin_tester(
     name = 'Linux Release (NVIDIA)',
+    console_view_entry = ci.console_view_entry(
+        category = 'Linux',
+    ),
     triggered_by = [builder_name('GPU Linux Builder')],
 )
 
 ci.gpu_thin_tester(
     name = 'Mac Release (Intel)',
+    console_view_entry = ci.console_view_entry(
+        category = 'Mac',
+    ),
     triggered_by = [builder_name('GPU Mac Builder')],
 )
 
 ci.gpu_thin_tester(
     name = 'Mac Retina Release (AMD)',
+    console_view_entry = ci.console_view_entry(
+        category = 'Mac',
+    ),
     triggered_by = [builder_name('GPU Mac Builder')],
 )
 
 ci.gpu_thin_tester(
     name = 'Win10 x64 Release (NVIDIA)',
+    console_view_entry = ci.console_view_entry(
+        category = 'Windows',
+    ),
     triggered_by = [builder_name('GPU Win x64 Builder')],
 )
 
 
 ci.linux_builder(
     name = 'Cast Linux',
+    console_view_entry = ci.console_view_entry(
+        category = 'cast',
+        short_name = 'vid',
+    ),
     goma_jobs = goma.jobs.J50,
 )
 
 ci.linux_builder(
     name = 'Fuchsia ARM64',
+    console_view_entry = ci.console_view_entry(
+        category = 'fuchsia|a64',
+    ),
     notifies = ['cr-fuchsia'],
 )
 
 ci.linux_builder(
     name = 'Fuchsia x64',
+    console_view_entry = ci.console_view_entry(
+        category = 'fuchsia|x64',
+        short_name = 'rel',
+    ),
     notifies = ['cr-fuchsia'],
 )
 
 ci.linux_builder(
     name = 'Linux Builder',
+    console_view_entry = ci.console_view_entry(
+        category = 'release',
+        short_name = 'bld',
+    ),
 )
 
 ci.linux_builder(
     name = 'Linux Tests',
+    console_view_entry = ci.console_view_entry(
+        category = 'release',
+        short_name = 'tst',
+    ),
     goma_backend = None,
     triggered_by = [builder_name('Linux Builder')],
 )
 
 ci.linux_builder(
     name = 'linux-ozone-rel',
+    console_view_entry = ci.console_view_entry(
+        category = 'release',
+        short_name = 'ozo',
+    ),
 )
 
 ci.linux_builder(
     name = 'Linux Ozone Tester (Headless)',
+    console_view = 'chromium.fyi',
+    console_view_entry = ci.console_view_entry(
+        category = 'linux',
+        short_name = 'loh',
+    ),
     goma_backend = None,
     triggered_by = [builder_name('linux-ozone-rel')],
 )
 
 ci.linux_builder(
     name = 'Linux Ozone Tester (Wayland)',
+    console_view = 'chromium.fyi',
+    console_view_entry = ci.console_view_entry(
+        category = 'linux',
+        short_name = 'low',
+    ),
     goma_backend = None,
     triggered_by = [builder_name('linux-ozone-rel')],
 )
 
 ci.linux_builder(
     name = 'Linux Ozone Tester (X11)',
+    console_view = 'chromium.fyi',
+    console_view_entry = ci.console_view_entry(
+        category = 'linux',
+        short_name = 'lox',
+    ),
     goma_backend = None,
     triggered_by = [builder_name('linux-ozone-rel')],
 )
 
+
 ci.mac_builder(
     name = 'Mac Builder',
+    console_view_entry = ci.console_view_entry(
+        category = 'release',
+        short_name = 'bld',
+    ),
     os = os.MAC_10_14,
 )
 
 ci.mac_builder(
     name = 'Mac Builder (dbg)',
+    console_view_entry = ci.console_view_entry(
+        category = 'debug',
+        short_name = 'bld',
+    ),
     os = os.MAC_ANY,
 )
 
 # The build runs on 10.13, but triggers tests on 10.10 bots.
 ci.mac_builder(
     name = 'Mac10.10 Tests',
+    console_view_entry = ci.console_view_entry(
+        category = 'release',
+        short_name = '10',
+    ),
     triggered_by = [builder_name('Mac Builder')],
 )
 
 # The build runs on 10.13, but triggers tests on 10.11 bots.
 ci.mac_builder(
     name = 'Mac10.11 Tests',
+    console_view_entry = ci.console_view_entry(
+        category = 'release',
+        short_name = '11',
+    ),
     triggered_by = [builder_name('Mac Builder')],
 )
 
 ci.mac_builder(
     name = 'Mac10.12 Tests',
+    console_view_entry = ci.console_view_entry(
+        category = 'release',
+        short_name = '12',
+    ),
     os = os.MAC_10_12,
     triggered_by = [builder_name('Mac Builder')],
 )
 
 ci.mac_builder(
     name = 'Mac10.13 Tests',
+    console_view_entry = ci.console_view_entry(
+        category = 'release',
+        short_name = '13',
+    ),
     os = os.MAC_10_13,
     triggered_by = [builder_name('Mac Builder')],
 )
 
 ci.mac_builder(
     name = 'Mac10.14 Tests',
+    console_view_entry = ci.console_view_entry(
+        category = 'release',
+        short_name = '14',
+    ),
     os = os.MAC_10_14,
     triggered_by = [builder_name('Mac Builder')],
 )
 
 ci.mac_builder(
     name = 'Mac10.13 Tests (dbg)',
+    console_view_entry = ci.console_view_entry(
+        category = 'debug',
+        short_name = '13',
+    ),
     os = os.MAC_ANY,
     triggered_by = [builder_name('Mac Builder (dbg)')],
 )
 
 ci.mac_builder(
     name = 'WebKit Mac10.13 (retina)',
+    console_view_entry = ci.console_view_entry(
+        category = 'release',
+        short_name = 'ret',
+    ),
     os = os.MAC_10_13,
     triggered_by = [builder_name('Mac Builder')],
 )
@@ -254,51 +432,87 @@
 
 ci.mac_ios_builder(
     name = 'ios-simulator',
+    console_view_entry = ci.console_view_entry(
+        category = 'ios|default',
+        short_name = 'sim',
+    ),
     goma_backend = None,
 )
 
 
 ci.memory_builder(
     name = 'Linux ASan LSan Builder',
+    console_view_entry = ci.console_view_entry(
+        category = 'linux|asan lsan',
+        short_name = 'bld',
+    ),
     ssd = True,
 )
 
 ci.memory_builder(
     name = 'Linux ASan LSan Tests (1)',
+    console_view_entry = ci.console_view_entry(
+        category = 'linux|asan lsan',
+        short_name = 'tst',
+    ),
     triggered_by = [builder_name('Linux ASan LSan Builder')],
 )
 
 ci.memory_builder(
     name = 'Linux ASan Tests (sandboxed)',
+    console_view_entry = ci.console_view_entry(
+        category = 'linux|asan lsan',
+        short_name = 'sbx',
+    ),
     triggered_by = [builder_name('Linux ASan LSan Builder')],
 )
 
 
 ci.win_builder(
     name = 'Win7 Tests (dbg)(1)',
+    console_view_entry = ci.console_view_entry(
+        category = 'debug|tester',
+        short_name = '7',
+    ),
     os = os.WINDOWS_7,
     triggered_by = [builder_name('Win Builder (dbg)')],
 )
 
 ci.win_builder(
     name = 'Win 7 Tests x64 (1)',
+    console_view_entry = ci.console_view_entry(
+        category = 'release|tester',
+        short_name = '64',
+    ),
     os = os.WINDOWS_7,
     triggered_by = [builder_name('Win x64 Builder')],
 )
 
 ci.win_builder(
     name = 'Win Builder (dbg)',
+    console_view_entry = ci.console_view_entry(
+        category = 'debug|builder',
+        short_name = '32',
+    ),
     cores = 32,
     os = os.WINDOWS_ANY,
 )
 
 ci.win_builder(
     name = 'Win x64 Builder',
+    console_view_entry = ci.console_view_entry(
+        category = 'release|builder',
+        short_name = '64',
+    ),
     cores = 32,
     os = os.WINDOWS_ANY,
 )
 
 ci.win_builder(
     name = 'Win10 Tests x64',
+    console_view_entry = ci.console_view_entry(
+        category = 'release|tester',
+        short_name = 'w10',
+    ),
     triggered_by = [builder_name('Win x64 Builder')],
 )

diff --git a/infra/config/versioned/milestones/m81/consoles/main.star b/infra/config/versioned/milestones/m81/consoles/main.star
deleted file mode 100644
index ddc4d8f..0000000
--- a/infra/config/versioned/milestones/m81/consoles/main.star
+++ /dev/null

@@ -1,247 +0,0 @@
-load('//lib/builders.star', 'builder_name', 'defaults')
-load('../vars.star', 'vars')
-
-defaults.bucket.set(vars.ci_bucket)
-
-# TODO(https://crbug.com/922150) Add to chromium header
-luci.console_view(
-    name = vars.main_console_name,
-    header = '//consoles/chromium-header.textpb',
-    repo = 'https://chromium.googlesource.com/chromium/src',
-    refs = [vars.ref],
-    title = vars.main_console_title,
-    entries = [
-        luci.console_view_entry(
-            builder = builder_name('Linux Builder'),
-            category = 'chromium.linux|release',
-            short_name = 'bld',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Linux Ozone Tester (Headless)'),
-            category = 'linux',
-            short_name = 'loh',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Linux Ozone Tester (Wayland)'),
-            category = 'linux',
-            short_name = 'low',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Linux Ozone Tester (X11)'),
-            category = 'linux',
-            short_name = 'lox',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Linux Tests'),
-            category = 'chromium.linux|release',
-            short_name = 'tst',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('linux-ozone-rel'),
-            category = 'chromium.linux|release',
-            short_name = 'ozo',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Cast Linux'),
-            category = 'chromium.linux|cast',
-            short_name = 'vid',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Fuchsia ARM64'),
-            category = 'chromium.linux|fuchsia|a64',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Fuchsia x64'),
-            category = 'chromium.linux|fuchsia|x64',
-            short_name = 'rel',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('linux-chromeos-rel'),
-            category = 'chromium.chromiumos|default',
-            short_name = 'rel',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('linux-chromeos-dbg'),
-            category = 'chromium.chromiumos|default',
-            short_name = 'dbg',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('chromeos-arm-generic-rel'),
-            category = 'chromium.chromiumos|simple|release',
-            short_name = 'arm',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('chromeos-amd64-generic-rel'),
-            category = 'chromium.chromiumos|simple|release|x64',
-            short_name = 'rel',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Mac Builder'),
-            category = 'chromium.mac|release',
-            short_name = 'bld',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Mac10.10 Tests'),
-            category = 'chromium.mac|release',
-            short_name = '10',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Mac10.11 Tests'),
-            category = 'chromium.mac|release',
-            short_name = '11',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Mac10.12 Tests'),
-            category = 'chromium.mac|release',
-            short_name = '12',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Mac10.13 Tests'),
-            category = 'chromium.mac|release',
-            short_name = '13',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Mac10.14 Tests'),
-            category = 'chromium.mac|release',
-            short_name = '14',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('WebKit Mac10.13 (retina)'),
-            category = 'chromium.mac|release',
-            short_name = 'ret',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Mac Builder (dbg)'),
-            category = 'chromium.mac|debug',
-            short_name = 'bld',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Mac10.13 Tests (dbg)'),
-            category = 'chromium.mac|debug',
-            short_name = '13',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('ios-simulator'),
-            category = 'chromium.mac|ios|default',
-            short_name = 'sim',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Win x64 Builder'),
-            category = 'chromium.win|release|builder',
-            short_name = '64',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Win 7 Tests x64 (1)'),
-            category = 'chromium.win|release|tester',
-            short_name = '64',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Win10 Tests x64'),
-            category = 'chromium.win|release|tester',
-            short_name = 'w10',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Win Builder (dbg)'),
-            category = 'chromium.win|debug|builder',
-            short_name = '32',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Win7 Tests (dbg)(1)'),
-            category = 'chromium.win|debug|tester',
-            short_name = '7',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Linux ASan LSan Builder'),
-            category = 'chromium.memory|linux|asan lsan',
-            short_name = 'bld',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Linux ASan LSan Tests (1)'),
-            category = 'chromium.memory|linux|asan lsan',
-            short_name = 'tst',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Linux ASan Tests (sandboxed)'),
-            category = 'chromium.memory|linux|asan lsan',
-            short_name = 'sbx',
-        ),
-        # TODO(https://crbug.com/922150) Add the following builders to the main
-        # console or don't have them be mirrored by main waterfall trybots
-        luci.console_view_entry(
-            builder = builder_name('android-kitkat-arm-rel'),
-            category = 'chromium.android',
-            short_name = 'k',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('android-marshmallow-arm64-rel'),
-            category = 'chromium.android',
-            short_name = 'm',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Cast Android (dbg)'),
-            category = 'chromium.android',
-            short_name = 'cst',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Android arm Builder (dbg)'),
-            category = 'chromium.android|builder|arm',
-            short_name = '32',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('android-cronet-arm-rel'),
-            category = 'chromium.android|cronet|arm',
-            short_name = 'rel',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('android-cronet-kitkat-arm-rel'),
-            category = 'chromium.android|cronet|test',
-            short_name = 'k',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('android-cronet-lollipop-arm-rel'),
-            category = 'chromium.android|cronet|test',
-            short_name = 'l',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('mac-osxbeta-rel'),
-            category = 'chromium.fyi|mac',
-            short_name = 'osxbeta',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Win10 Tests x64 1803'),
-            category = 'chromium.fyi|win10|1803',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Android Release (Nexus 5X)'),
-            category = 'chromium.gpu|android',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('GPU Linux Builder'),
-            category = 'chromium.gpu|linux',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Linux Release (NVIDIA)'),
-            category = 'chromium.gpu|linux',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('GPU Mac Builder'),
-            category = 'chromium.gpu|mac',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Mac Release (Intel)'),
-            category = 'chromium.gpu|mac',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Mac Retina Release (AMD)'),
-            category = 'chromium.gpu|mac',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('GPU Win x64 Builder'),
-            category = 'chromium.gpu|win',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Win10 x64 Release (NVIDIA)'),
-            category = 'chromium.gpu|win',
-        ),
-    ],
-)

diff --git a/infra/config/versioned/milestones/m81/vars.star b/infra/config/versioned/milestones/m81/vars.star
index 742d89e..078bcc81 100644
--- a/infra/config/versioned/milestones/m81/vars.star
+++ b/infra/config/versioned/milestones/m81/vars.star

@@ -1,10 +1,11 @@
 vars = struct(
+    is_master = False,
     ref = 'refs/branch-heads/4044',
     ci_bucket = 'ci-m81',
     ci_poller = 'm81-gitiles-trigger',
+    main_console_name = 'main-m81',
+    main_console_title = 'Chromium M81 Console',
     try_bucket = 'try-m81',
     cq_group = 'cq-m81',
     cq_ref_regexp = 'refs/branch-heads/4044',
-    main_console_name = 'main-m81',
-    main_console_title = 'Chromium M81 Console',
 )

diff --git a/infra/config/versioned/milestones/m83/buckets/ci.star b/infra/config/versioned/milestones/m83/buckets/ci.star
index 70b2755..460013a 100644
--- a/infra/config/versioned/milestones/m83/buckets/ci.star
+++ b/infra/config/versioned/milestones/m83/buckets/ci.star

@@ -31,9 +31,37 @@
     refs = [vars.ref],
 )
 
+ci.main_console_view(
+    name = vars.main_console_name,
+    header = '//consoles/chromium-header.textpb',
+    repo = 'https://chromium.googlesource.com/chromium/src',
+    refs = [vars.ref],
+    title = vars.main_console_title,
+    top_level_ordering = [
+        'chromium',
+        'chromium.win',
+        'chromium.mac',
+        'chromium.linux',
+        'chromium.chromiumos',
+        'chromium.android',
+        'chrome',
+        'chromium.memory',
+        'chromium.dawn',
+        'chromium.gpu',
+        'chromium.fyi',
+        'chromium.android.fyi',
+        'chromium.clang',
+        'chromium.fuzz',
+        'chromium.gpu.fyi',
+        'chromium.swangle',
+    ],
+)
 
+
+ci.defaults.add_to_console_view.set(vars.is_master)
 ci.defaults.bucket.set(vars.ci_bucket)
 ci.defaults.bucketed_triggers.set(True)
+ci.defaults.main_console_view.set(vars.main_console_name)
 ci.defaults.triggered_by.set([vars.ci_poller])
 
 
@@ -43,138 +71,253 @@
 
 ci.android_builder(
     name = 'Android WebView M (dbg)',
+    console_view_entry = ci.console_view_entry(
+        category = 'tester|webview',
+        short_name = 'M',
+    ),
     triggered_by = [builder_name('Android arm64 Builder (dbg)')],
 )
 
 ci.android_builder(
     name = 'Android WebView N (dbg)',
+    console_view_entry = ci.console_view_entry(
+        category = 'tester|webview',
+        short_name = 'N',
+    ),
     triggered_by = [builder_name('Android arm64 Builder (dbg)')],
 )
 
 ci.android_builder(
     name = 'Android WebView O (dbg)',
+    console_view_entry = ci.console_view_entry(
+        category = 'tester|webview',
+        short_name = 'O',
+    ),
     triggered_by = [builder_name('Android arm64 Builder (dbg)')],
 )
 
 ci.android_builder(
     name = 'Android WebView P (dbg)',
+    console_view_entry = ci.console_view_entry(
+        category = 'tester|webview',
+        short_name = 'P',
+    ),
     triggered_by = [builder_name('Android arm64 Builder (dbg)')],
 )
 
 ci.android_builder(
     name = 'Android arm Builder (dbg)',
+    console_view_entry = ci.console_view_entry(
+        category = 'builder|arm',
+        short_name = '32',
+    ),
     execution_timeout = 4 * time.hour,
 )
 
 ci.android_builder(
     name = 'Android arm64 Builder (dbg)',
+    console_view_entry = ci.console_view_entry(
+        category = 'builder|arm',
+        short_name = '64',
+    ),
     goma_jobs = goma.jobs.MANY_JOBS_FOR_CI,
     execution_timeout = 4 * time.hour,
 )
 
 ci.android_builder(
     name = 'Android x64 Builder (dbg)',
+    console_view_entry = ci.console_view_entry(
+        category = 'builder|x86',
+        short_name = '64',
+    ),
     execution_timeout = 4 * time.hour,
 )
 
 ci.android_builder(
     name = 'Android x86 Builder (dbg)',
+    console_view_entry = ci.console_view_entry(
+        category = 'builder|x86',
+        short_name = '32',
+    ),
 )
 
 ci.android_builder(
     name = 'Cast Android (dbg)',
+    console_view_entry = ci.console_view_entry(
+        category = 'on_cq',
+        short_name = 'cst',
+    ),
 )
 
 ci.android_builder(
     name = 'Marshmallow 64 bit Tester',
+    console_view_entry = ci.console_view_entry(
+        category = 'tester|phone',
+        short_name = 'M',
+    ),
     triggered_by = [builder_name('Android arm64 Builder (dbg)')],
 )
 
 ci.android_builder(
     name = 'Nougat Phone Tester',
+    console_view_entry = ci.console_view_entry(
+        category = 'tester|phone',
+        short_name = 'N',
+    ),
     triggered_by = [builder_name('Android arm64 Builder (dbg)')],
 )
 
 ci.android_builder(
     name = 'Oreo Phone Tester',
+    console_view_entry = ci.console_view_entry(
+        category = 'tester|phone',
+        short_name = 'O',
+    ),
     triggered_by = [builder_name('Android arm64 Builder (dbg)')],
 )
 
 ci.android_builder(
     name = 'android-cronet-arm-dbg',
+    console_view_entry = ci.console_view_entry(
+        category = 'cronet|arm',
+        short_name = 'dbg',
+    ),
     notifies = ['cronet'],
 )
 
 ci.android_builder(
     name = 'android-cronet-arm-rel',
+    console_view_entry = ci.console_view_entry(
+        category = 'cronet|arm',
+        short_name = 'rel',
+    ),
     notifies = ['cronet'],
 )
 
 ci.android_builder(
     name = 'android-cronet-kitkat-arm-rel',
+    console_view_entry = ci.console_view_entry(
+        category = 'cronet|test',
+        short_name = 'k',
+    ),
     notifies = ['cronet'],
     triggered_by = [builder_name('android-cronet-arm-rel')],
 )
 
 ci.android_builder(
     name = 'android-cronet-lollipop-arm-rel',
+    console_view_entry = ci.console_view_entry(
+        category = 'cronet|test',
+        short_name = 'l',
+    ),
     notifies = ['cronet'],
     triggered_by = [builder_name('android-cronet-arm-rel')],
 )
 
 ci.android_builder(
     name = 'android-kitkat-arm-rel',
+    console_view_entry = ci.console_view_entry(
+        category = 'on_cq',
+        short_name = 'K',
+    ),
 )
 
 ci.android_builder(
     name = 'android-marshmallow-arm64-rel',
+    console_view_entry = ci.console_view_entry(
+        category = 'on_cq',
+        short_name = 'M',
+    ),
 )
 
 ci.android_builder(
     name = 'android-pie-arm64-dbg',
+    console_view_entry = ci.console_view_entry(
+        category = 'tester|phone',
+        short_name = 'P',
+    ),
     triggered_by = [builder_name('Android arm64 Builder (dbg)')],
 )
 
 ci.android_builder(
     name = 'android-pie-arm64-rel',
+    console_view_entry = ci.console_view_entry(
+        category = 'on_cq',
+        short_name = 'P',
+    ),
 )
 
 
 ci.chromiumos_builder(
     name = 'chromeos-amd64-generic-dbg',
+    console_view_entry = ci.console_view_entry(
+        category = 'simple|debug|x64',
+        short_name = 'dbg',
+    ),
 )
 
 ci.chromiumos_builder(
     name = 'chromeos-amd64-generic-rel',
+    console_view_entry = ci.console_view_entry(
+        category = 'simple|release|x64',
+        short_name = 'rel',
+    ),
 )
 
 ci.chromiumos_builder(
     name = 'chromeos-arm-generic-rel',
+    console_view_entry = ci.console_view_entry(
+        category = 'simple|release',
+        short_name = 'arm',
+    ),
 )
 
 ci.chromiumos_builder(
     name = 'chromeos-kevin-rel',
+    console_view_entry = ci.console_view_entry(
+        category = 'simple|release',
+        short_name = 'kvn',
+    ),
 )
 
 ci.fyi_builder(
     name = 'chromeos-kevin-rel-hw-tests',
+    console_view_entry = ci.console_view_entry(
+        category = 'chromeos',
+    ),
 )
 
 ci.chromiumos_builder(
     name = 'linux-chromeos-dbg',
+    console_view_entry = ci.console_view_entry(
+        category = 'default',
+        short_name = 'dbg',
+    ),
 )
 
 ci.chromiumos_builder(
     name = 'linux-chromeos-rel',
+    console_view_entry = ci.console_view_entry(
+        category = 'default',
+        short_name = 'rel',
+    ),
 )
 
 
 ci.dawn_builder(
     name = 'Dawn Linux x64 DEPS Builder',
+    console_view_entry = ci.console_view_entry(
+        category = 'DEPS|Linux|Builder',
+        short_name = 'x64',
+    ),
 )
 
 ci.dawn_builder(
     name = 'Dawn Linux x64 DEPS Release (Intel HD 630)',
+    console_view_entry = ci.console_view_entry(
+        category = 'DEPS|Linux|Intel',
+        short_name = 'x64',
+    ),
     cores = 2,
     os = os.LINUX_DEFAULT,
     triggered_by = [builder_name('Dawn Linux x64 DEPS Builder')],
@@ -182,6 +325,10 @@
 
 ci.dawn_builder(
     name = 'Dawn Linux x64 DEPS Release (NVIDIA)',
+    console_view_entry = ci.console_view_entry(
+        category = 'DEPS|Linux|Nvidia',
+        short_name = 'x64',
+    ),
     cores = 2,
     os = os.LINUX_DEFAULT,
     triggered_by = [builder_name('Dawn Linux x64 DEPS Builder')],
@@ -190,6 +337,10 @@
 ci.dawn_builder(
     name = 'Dawn Mac x64 DEPS Builder',
     builderless = False,
+    console_view_entry = ci.console_view_entry(
+        category = 'DEPS|Mac|Builder',
+        short_name = 'x64',
+    ),
     cores = None,
     os = os.MAC_ANY,
 )
@@ -198,6 +349,10 @@
 # physical Mac hardware in the Swarming pool which is why they run on linux
 ci.dawn_builder(
     name = 'Dawn Mac x64 DEPS Release (AMD)',
+    console_view_entry = ci.console_view_entry(
+        category = 'DEPS|Mac|AMD',
+        short_name = 'x64',
+    ),
     cores = 2,
     os = os.LINUX_DEFAULT,
     triggered_by = [builder_name('Dawn Mac x64 DEPS Builder')],
@@ -205,6 +360,10 @@
 
 ci.dawn_builder(
     name = 'Dawn Mac x64 DEPS Release (Intel)',
+    console_view_entry = ci.console_view_entry(
+        category = 'DEPS|Mac|Intel',
+        short_name = 'x64',
+    ),
     cores = 2,
     os = os.LINUX_DEFAULT,
     triggered_by = [builder_name('Dawn Mac x64 DEPS Builder')],
@@ -212,11 +371,19 @@
 
 ci.dawn_builder(
     name = 'Dawn Win10 x64 DEPS Builder',
+    console_view_entry = ci.console_view_entry(
+        category = 'DEPS|Windows|Builder',
+        short_name = 'x64',
+    ),
     os = os.WINDOWS_ANY,
 )
 
 ci.dawn_builder(
     name = 'Dawn Win10 x64 DEPS Release (Intel HD 630)',
+    console_view_entry = ci.console_view_entry(
+        category = 'DEPS|Windows|Intel',
+        short_name = 'x64',
+    ),
     cores = 2,
     os = os.LINUX_DEFAULT,
     triggered_by = [builder_name('Dawn Win10 x64 DEPS Builder')],
@@ -224,6 +391,10 @@
 
 ci.dawn_builder(
     name = 'Dawn Win10 x64 DEPS Release (NVIDIA)',
+    console_view_entry = ci.console_view_entry(
+        category = 'DEPS|Windows|Nvidia',
+        short_name = 'x64',
+    ),
     cores = 2,
     os = os.LINUX_DEFAULT,
     triggered_by = [builder_name('Dawn Win10 x64 DEPS Builder')],
@@ -231,11 +402,19 @@
 
 ci.dawn_builder(
     name = 'Dawn Win10 x86 DEPS Builder',
+    console_view_entry = ci.console_view_entry(
+        category = 'DEPS|Windows|Builder',
+        short_name = 'x86',
+    ),
     os = os.WINDOWS_ANY,
 )
 
 ci.dawn_builder(
     name = 'Dawn Win10 x86 DEPS Release (Intel HD 630)',
+    console_view_entry = ci.console_view_entry(
+        category = 'DEPS|Windows|Intel',
+        short_name = 'x86',
+    ),
     cores = 2,
     os = os.LINUX_DEFAULT,
     triggered_by = [builder_name('Dawn Win10 x86 DEPS Builder')],
@@ -243,6 +422,10 @@
 
 ci.dawn_builder(
     name = 'Dawn Win10 x86 DEPS Release (NVIDIA)',
+    console_view_entry = ci.console_view_entry(
+        category = 'DEPS|Windows|Nvidia',
+        short_name = 'x86',
+    ),
     cores = 2,
     os = os.LINUX_DEFAULT,
     triggered_by = [builder_name('Dawn Win10 x86 DEPS Builder')],
@@ -251,12 +434,19 @@
 
 ci.fyi_builder(
     name = 'VR Linux',
+    console_view_entry = ci.console_view_entry(
+        category = 'linux',
+    ),
 )
 
 # This is launching & collecting entirely isolated tests.
 # OS shouldn't matter.
 ci.fyi_builder(
     name = 'mac-osxbeta-rel',
+    console_view_entry = ci.console_view_entry(
+        category = 'mac',
+        short_name = 'beta',
+    ),
     goma_backend = None,
     triggered_by = [builder_name('Mac Builder')],
 )
@@ -264,6 +454,9 @@
 
 ci.fyi_ios_builder(
     name = 'ios-simulator-cronet',
+    console_view_entry = ci.console_view_entry(
+        category = 'cronet',
+    ),
     executable = 'recipe:chromium',
     notifies = ['cronet'],
     properties = {
@@ -274,6 +467,9 @@
 
 ci.fyi_windows_builder(
     name = 'Win10 Tests x64 1803',
+    console_view_entry = ci.console_view_entry(
+        category = 'win10|1803',
+    ),
     goma_backend = None,
     os = os.WINDOWS_10,
     triggered_by = [builder_name('Win x64 Builder')],
@@ -282,14 +478,23 @@
 
 ci.gpu_builder(
     name = 'Android Release (Nexus 5X)',
+    console_view_entry = ci.console_view_entry(
+        category = 'Android',
+    ),
 )
 
 ci.gpu_builder(
     name = 'GPU Linux Builder',
+    console_view_entry = ci.console_view_entry(
+        category = 'Linux',
+    ),
 )
 
 ci.gpu_builder(
     name = 'GPU Mac Builder',
+    console_view_entry = ci.console_view_entry(
+        category = 'Mac',
+    ),
     cores = None,
     os = os.MAC_ANY,
 )
@@ -297,143 +502,248 @@
 ci.gpu_builder(
     name = 'GPU Win x64 Builder',
     builderless = True,
+    console_view_entry = ci.console_view_entry(
+        category = 'Windows',
+    ),
     os = os.WINDOWS_ANY,
 )
 
 
 ci.gpu_thin_tester(
     name = 'Linux Release (NVIDIA)',
+    console_view_entry = ci.console_view_entry(
+        category = 'Linux',
+    ),
     triggered_by = [builder_name('GPU Linux Builder')],
 )
 
 ci.gpu_thin_tester(
     name = 'Mac Release (Intel)',
+    console_view_entry = ci.console_view_entry(
+        category = 'Mac',
+    ),
     triggered_by = [builder_name('GPU Mac Builder')],
 )
 
 ci.gpu_thin_tester(
     name = 'Mac Retina Release (AMD)',
+    console_view_entry = ci.console_view_entry(
+        category = 'Mac',
+    ),
     triggered_by = [builder_name('GPU Mac Builder')],
 )
 
 ci.gpu_thin_tester(
     name = 'Win10 x64 Release (NVIDIA)',
+    console_view_entry = ci.console_view_entry(
+        category = 'Windows',
+    ),
     triggered_by = [builder_name('GPU Win x64 Builder')],
 )
 
 
 ci.linux_builder(
     name = 'Cast Linux',
+    console_view_entry = ci.console_view_entry(
+        category = 'cast',
+        short_name = 'vid',
+    ),
     goma_jobs = goma.jobs.J50,
 )
 
 ci.linux_builder(
     name = 'Fuchsia ARM64',
+    console_view_entry = ci.console_view_entry(
+        category = 'fuchsia|a64',
+    ),
     notifies = ['cr-fuchsia'],
 )
 
 ci.linux_builder(
     name = 'Fuchsia x64',
+    console_view_entry = ci.console_view_entry(
+        category = 'fuchsia|x64',
+        short_name = 'rel',
+    ),
     notifies = ['cr-fuchsia'],
 )
 
 ci.linux_builder(
     name = 'Linux Builder',
+    console_view_entry = ci.console_view_entry(
+        category = 'release',
+        short_name = 'bld',
+    ),
 )
 
 ci.linux_builder(
     name = 'Linux Builder (dbg)',
+    console_view_entry = ci.console_view_entry(
+        category = 'debug|builder',
+        short_name = '64',
+    ),
 )
 
 ci.linux_builder(
     name = 'Linux Tests',
+    console_view_entry = ci.console_view_entry(
+        category = 'release',
+        short_name = 'tst',
+    ),
     goma_backend = None,
     triggered_by = [builder_name('Linux Builder')],
 )
 
 ci.linux_builder(
     name = 'Linux Tests (dbg)(1)',
+    console_view_entry = ci.console_view_entry(
+        category = 'debug|tester',
+        short_name = '64',
+    ),
     triggered_by = [builder_name('Linux Builder (dbg)')],
 )
 
 ci.linux_builder(
     name = 'fuchsia-arm64-cast',
+    console_view_entry = ci.console_view_entry(
+        category = 'fuchsia|cast',
+        short_name = 'a64',
+    ),
     notifies = ['cr-fuchsia'],
 )
 
 ci.linux_builder(
     name = 'fuchsia-x64-cast',
+    console_view_entry = ci.console_view_entry(
+        category = 'fuchsia|cast',
+        short_name = 'x64',
+    ),
     notifies = ['cr-fuchsia'],
 )
 
 ci.linux_builder(
     name = 'linux-ozone-rel',
+    console_view_entry = ci.console_view_entry(
+        category = 'release',
+        short_name = 'ozo',
+    ),
 )
 
 ci.linux_builder(
     name = 'Linux Ozone Tester (Headless)',
+    console_view = 'chromium.fyi',
+    console_view_entry = ci.console_view_entry(
+        category = 'linux',
+        short_name = 'loh',
+    ),
     triggered_by = [builder_name('linux-ozone-rel')],
 )
 
 ci.linux_builder(
     name = 'Linux Ozone Tester (Wayland)',
+    console_view = 'chromium.fyi',
+    console_view_entry = ci.console_view_entry(
+        category = 'linux',
+        short_name = 'low',
+    ),
     triggered_by = [builder_name('linux-ozone-rel')],
 )
 
 ci.linux_builder(
     name = 'Linux Ozone Tester (X11)',
+    console_view = 'chromium.fyi',
+    console_view_entry = ci.console_view_entry(
+        category = 'linux',
+        short_name = 'lox',
+    ),
     triggered_by = [builder_name('linux-ozone-rel')],
 )
 
 
 ci.mac_builder(
     name = 'Mac Builder',
+    console_view_entry = ci.console_view_entry(
+        category = 'release',
+        short_name = 'bld',
+    ),
     os = os.MAC_10_14,
 )
 
 ci.mac_builder(
     name = 'Mac Builder (dbg)',
+    console_view_entry = ci.console_view_entry(
+        category = 'debug',
+        short_name = 'bld',
+    ),
     os = os.MAC_ANY,
 )
 
 # The build runs on 10.13, but triggers tests on 10.10 bots.
 ci.mac_builder(
     name = 'Mac10.10 Tests',
+    console_view_entry = ci.console_view_entry(
+        category = 'release',
+        short_name = '10',
+    ),
     triggered_by = [builder_name('Mac Builder')],
 )
 
 # The build runs on 10.13, but triggers tests on 10.11 bots.
 ci.mac_builder(
     name = 'Mac10.11 Tests',
+    console_view_entry = ci.console_view_entry(
+        category = 'release',
+        short_name = '11',
+    ),
     triggered_by = [builder_name('Mac Builder')],
 )
 
 ci.mac_builder(
     name = 'Mac10.12 Tests',
+    console_view_entry = ci.console_view_entry(
+        category = 'release',
+        short_name = '12',
+    ),
     os = os.MAC_10_12,
     triggered_by = [builder_name('Mac Builder')],
 )
 
 ci.mac_builder(
     name = 'Mac10.13 Tests',
+    console_view_entry = ci.console_view_entry(
+        category = 'release',
+        short_name = '13',
+    ),
     os = os.MAC_10_13,
     triggered_by = [builder_name('Mac Builder')],
 )
 
 ci.mac_builder(
     name = 'Mac10.14 Tests',
+    console_view_entry = ci.console_view_entry(
+        category = 'release',
+        short_name = '14',
+    ),
     os = os.MAC_10_14,
     triggered_by = [builder_name('Mac Builder')],
 )
 
 ci.mac_builder(
     name = 'Mac10.13 Tests (dbg)',
+    console_view_entry = ci.console_view_entry(
+        category = 'debug',
+        short_name = '13',
+    ),
     os = os.MAC_ANY,
     triggered_by = [builder_name('Mac Builder (dbg)')],
 )
 
 ci.mac_builder(
     name = 'WebKit Mac10.13 (retina)',
+    console_view_entry = ci.console_view_entry(
+        category = 'release',
+        short_name = 'ret',
+    ),
     os = os.MAC_10_13,
     triggered_by = [builder_name('Mac Builder')],
 )
@@ -441,63 +751,111 @@
 
 ci.mac_ios_builder(
     name = 'ios-simulator',
+    console_view_entry = ci.console_view_entry(
+        category = 'ios|default',
+        short_name = 'sim',
+    ),
 )
 
 ci.mac_ios_builder(
     name = 'ios-simulator-full-configs',
+    console_view_entry = ci.console_view_entry(
+        category = 'ios|default',
+        short_name = 'ful',
+    ),
 )
 
 
 ci.memory_builder(
     name = 'Linux ASan LSan Builder',
+    console_view_entry = ci.console_view_entry(
+        category = 'linux|asan lsan',
+        short_name = 'bld',
+    ),
     ssd = True,
 )
 
 ci.memory_builder(
     name = 'Linux ASan LSan Tests (1)',
+    console_view_entry = ci.console_view_entry(
+        category = 'linux|asan lsan',
+        short_name = 'tst',
+    ),
     triggered_by = [builder_name('Linux ASan LSan Builder')],
 )
 
 ci.memory_builder(
     name = 'Linux ASan Tests (sandboxed)',
+    console_view_entry = ci.console_view_entry(
+        category = 'linux|asan lsan',
+        short_name = 'sbx',
+    ),
     triggered_by = [builder_name('Linux ASan LSan Builder')],
 )
 
 ci.memory_builder(
     name = 'Linux TSan Builder',
+    console_view_entry = ci.console_view_entry(
+        category = 'linux|TSan v2',
+        short_name = 'bld',
+    ),
 )
 
 ci.memory_builder(
     name = 'Linux TSan Tests',
+    console_view_entry = ci.console_view_entry(
+        category = 'linux|TSan v2',
+        short_name = 'tst',
+    ),
     triggered_by = [builder_name('Linux TSan Builder')],
 )
 
 
 ci.win_builder(
     name = 'Win7 Tests (dbg)(1)',
+    console_view_entry = ci.console_view_entry(
+        category = 'debug|tester',
+        short_name = '7',
+    ),
     os = os.WINDOWS_7,
     triggered_by = [builder_name('Win Builder (dbg)')],
 )
 
 ci.win_builder(
     name = 'Win 7 Tests x64 (1)',
+    console_view_entry = ci.console_view_entry(
+        category = 'release|tester',
+        short_name = '64',
+    ),
     os = os.WINDOWS_7,
     triggered_by = [builder_name('Win x64 Builder')],
 )
 
 ci.win_builder(
     name = 'Win Builder (dbg)',
+    console_view_entry = ci.console_view_entry(
+        category = 'debug|builder',
+        short_name = '32',
+    ),
     cores = 32,
     os = os.WINDOWS_ANY,
 )
 
 ci.win_builder(
     name = 'Win x64 Builder',
+    console_view_entry = ci.console_view_entry(
+        category = 'release|builder',
+        short_name = '64',
+    ),
     cores = 32,
     os = os.WINDOWS_ANY,
 )
 
 ci.win_builder(
     name = 'Win10 Tests x64',
+    console_view_entry = ci.console_view_entry(
+        category = 'release|tester',
+        short_name = 'w10',
+    ),
     triggered_by = [builder_name('Win x64 Builder')],
 )

diff --git a/infra/config/versioned/milestones/m83/consoles/main.star b/infra/config/versioned/milestones/m83/consoles/main.star
deleted file mode 100644
index 7e59621..0000000
--- a/infra/config/versioned/milestones/m83/consoles/main.star
+++ /dev/null

@@ -1,448 +0,0 @@
-load('//lib/builders.star', 'builder_name', 'defaults')
-load('../vars.star', 'vars')
-
-defaults.bucket.set(vars.ci_bucket)
-
-luci.console_view(
-    name = vars.main_console_name,
-    header = '//consoles/chromium-header.textpb',
-    repo = 'https://chromium.googlesource.com/chromium/src',
-    refs = [vars.ref],
-    title = vars.main_console_title,
-    entries = [
-        luci.console_view_entry(
-            builder = builder_name('Win x64 Builder'),
-            category = 'chromium.win|release|builder',
-            short_name = '64',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Win 7 Tests x64 (1)'),
-            category = 'chromium.win|release|tester',
-            short_name = '64',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Win10 Tests x64'),
-            category = 'chromium.win|release|tester',
-            short_name = 'w10',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Win Builder (dbg)'),
-            category = 'chromium.win|debug|builder',
-            short_name = '32',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Win7 Tests (dbg)(1)'),
-            category = 'chromium.win|debug|tester',
-            short_name = '7',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Mac Builder'),
-            category = 'chromium.mac|release',
-            short_name = 'bld',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Mac10.10 Tests'),
-            category = 'chromium.mac|release',
-            short_name = '10',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Mac10.11 Tests'),
-            category = 'chromium.mac|release',
-            short_name = '11',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Mac10.12 Tests'),
-            category = 'chromium.mac|release',
-            short_name = '12',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Mac10.13 Tests'),
-            category = 'chromium.mac|release',
-            short_name = '13',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Mac10.14 Tests'),
-            category = 'chromium.mac|release',
-            short_name = '14',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('WebKit Mac10.13 (retina)'),
-            category = 'chromium.mac|release',
-            short_name = 'ret',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Mac Builder (dbg)'),
-            category = 'chromium.mac|debug',
-            short_name = 'bld',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Mac10.13 Tests (dbg)'),
-            category = 'chromium.mac|debug',
-            short_name = '13',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('ios-simulator'),
-            category = 'chromium.mac|ios|default',
-            short_name = 'sim',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('ios-simulator-full-configs'),
-            category = 'chromium.mac|ios|default',
-            short_name = 'ful',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Linux Builder'),
-            category = 'chromium.linux|release',
-            short_name = 'bld',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Linux Tests'),
-            category = 'chromium.linux|release',
-            short_name = 'tst',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('linux-ozone-rel'),
-            category = 'chromium.linux|release',
-            short_name = 'ozo',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Linux Builder (dbg)'),
-            category = 'chromium.linux|debug|builder',
-            short_name = '64',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Linux Tests (dbg)(1)'),
-            category = 'chromium.linux|debug|tester',
-            short_name = '64',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Cast Linux'),
-            category = 'chromium.linux|cast',
-            short_name = 'vid',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Fuchsia ARM64'),
-            category = 'chromium.linux|fuchsia|a64',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('fuchsia-arm64-cast'),
-            category = 'chromium.linux|fuchsia|cast',
-            short_name = 'a64',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('fuchsia-x64-cast'),
-            category = 'chromium.linux|fuchsia|cast',
-            short_name = 'x64',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Fuchsia x64'),
-            category = 'chromium.linux|fuchsia|x64',
-            short_name = 'rel',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('linux-chromeos-rel'),
-            category = 'chromium.chromiumos|default',
-            short_name = 'rel',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('linux-chromeos-dbg'),
-            category = 'chromium.chromiumos|default',
-            short_name = 'dbg',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('chromeos-amd64-generic-dbg'),
-            category = 'chromium.chromiumos|simple|debug|x64',
-            short_name = 'dbg',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('chromeos-amd64-generic-rel'),
-            category = 'chromium.chromiumos|simple|release|x64',
-            short_name = 'rel',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('chromeos-arm-generic-rel'),
-            category = 'chromium.chromiumos|simple|release',
-            short_name = 'arm',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('chromeos-kevin-rel'),
-            category = 'chromium.chromiumos|simple|release',
-            short_name = 'kvn',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('android-cronet-arm-dbg'),
-            category = 'chromium.android|cronet|arm',
-            short_name = 'dbg',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('android-cronet-arm-rel'),
-            category = 'chromium.android|cronet|arm',
-            short_name = 'rel',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('android-cronet-kitkat-arm-rel'),
-            category = 'chromium.android|cronet|test',
-            short_name = 'k',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('android-cronet-lollipop-arm-rel'),
-            category = 'chromium.android|cronet|test',
-            short_name = 'l',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Android arm Builder (dbg)'),
-            category = 'chromium.android|builder|arm',
-            short_name = '32',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Android arm64 Builder (dbg)'),
-            category = 'chromium.android|builder|arm',
-            short_name = '64',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Android x86 Builder (dbg)'),
-            category = 'chromium.android|builder|x86',
-            short_name = '32',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Android x64 Builder (dbg)'),
-            category = 'chromium.android|builder|x86',
-            short_name = '64',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Marshmallow 64 bit Tester'),
-            category = 'chromium.android|tester|phone',
-            short_name = 'M',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Nougat Phone Tester'),
-            category = 'chromium.android|tester|phone',
-            short_name = 'N',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Oreo Phone Tester'),
-            category = 'chromium.android|tester|phone',
-            short_name = 'O',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('android-pie-arm64-dbg'),
-            category = 'chromium.android|tester|phone',
-            short_name = 'P',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Android WebView M (dbg)'),
-            category = 'chromium.android|tester|webview',
-            short_name = 'M',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Android WebView N (dbg)'),
-            category = 'chromium.android|tester|webview',
-            short_name = 'N',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Android WebView O (dbg)'),
-            category = 'chromium.android|tester|webview',
-            short_name = 'O',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Android WebView P (dbg)'),
-            category = 'chromium.android|tester|webview',
-            short_name = 'P',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('android-kitkat-arm-rel'),
-            category = 'chromium.android|on_cq',
-            short_name = 'K',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('android-marshmallow-arm64-rel'),
-            category = 'chromium.android|on_cq',
-            short_name = 'M',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Cast Android (dbg)'),
-            category = 'chromium.android|on_cq',
-            short_name = 'cst',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('android-pie-arm64-rel'),
-            category = 'chromium.android|on_cq',
-            short_name = 'P',
-        ),
-        luci.console_view_entry(
-            builder = 'chrome:ci/linux-chromeos-chrome',
-            category = 'chrome',
-            short_name = 'cro',
-        ),
-        luci.console_view_entry(
-            builder = 'chrome:ci/linux-chrome',
-            category = 'chrome',
-            short_name = 'lnx',
-        ),
-        luci.console_view_entry(
-            builder = 'chrome:ci/mac-chrome',
-            category = 'chrome',
-            short_name = 'mac',
-        ),
-        luci.console_view_entry(
-            builder = 'chrome:ci/win-chrome',
-            category = 'chrome',
-            short_name = 'win',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Linux TSan Builder'),
-            category = 'chromium.memory|linux|TSan v2',
-            short_name = 'bld',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Linux TSan Tests'),
-            category = 'chromium.memory|linux|TSan v2',
-            short_name = 'tst',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Linux ASan LSan Builder'),
-            category = 'chromium.memory|linux|asan lsan',
-            short_name = 'bld',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Linux ASan LSan Tests (1)'),
-            category = 'chromium.memory|linux|asan lsan',
-            short_name = 'tst',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Linux ASan Tests (sandboxed)'),
-            category = 'chromium.memory|linux|asan lsan',
-            short_name = 'sbx',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Dawn Linux x64 DEPS Builder'),
-            category = 'chromium.dawn|DEPS|Linux|Builder',
-            short_name = 'x64',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Dawn Linux x64 DEPS Release (Intel HD 630)'),
-            category = 'chromium.dawn|DEPS|Linux|Intel',
-            short_name = 'x64',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Dawn Linux x64 DEPS Release (NVIDIA)'),
-            category = 'chromium.dawn|DEPS|Linux|Nvidia',
-            short_name = 'x64',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Dawn Mac x64 DEPS Builder'),
-            category = 'chromium.dawn|DEPS|Mac|Builder',
-            short_name = 'x64',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Dawn Mac x64 DEPS Release (AMD)'),
-            category = 'chromium.dawn|DEPS|Mac|AMD',
-            short_name = 'x64',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Dawn Mac x64 DEPS Release (Intel)'),
-            category = 'chromium.dawn|DEPS|Mac|Intel',
-            short_name = 'x64',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Dawn Win10 x86 DEPS Builder'),
-            category = 'chromium.dawn|DEPS|Windows|Builder',
-            short_name = 'x86',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Dawn Win10 x64 DEPS Builder'),
-            category = 'chromium.dawn|DEPS|Windows|Builder',
-            short_name = 'x64',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Dawn Win10 x86 DEPS Release (Intel HD 630)'),
-            category = 'chromium.dawn|DEPS|Windows|Intel',
-            short_name = 'x86',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Dawn Win10 x64 DEPS Release (Intel HD 630)'),
-            category = 'chromium.dawn|DEPS|Windows|Intel',
-            short_name = 'x64',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Dawn Win10 x86 DEPS Release (NVIDIA)'),
-            category = 'chromium.dawn|DEPS|Windows|Nvidia',
-            short_name = 'x86',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Dawn Win10 x64 DEPS Release (NVIDIA)'),
-            category = 'chromium.dawn|DEPS|Windows|Nvidia',
-            short_name = 'x64',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('GPU Win x64 Builder'),
-            category = 'chromium.gpu|Windows',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Win10 x64 Release (NVIDIA)'),
-            category = 'chromium.gpu|Windows',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('GPU Mac Builder'),
-            category = 'chromium.gpu|Mac',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Mac Release (Intel)'),
-            category = 'chromium.gpu|Mac',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Mac Retina Release (AMD)'),
-            category = 'chromium.gpu|Mac',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('GPU Linux Builder'),
-            category = 'chromium.gpu|Linux',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Linux Release (NVIDIA)'),
-            category = 'chromium.gpu|Linux',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Android Release (Nexus 5X)'),
-            category = 'chromium.gpu|Android',
-        ),
-        # TODO(gbeaty): FYI builders should not be mirrors for try builders on
-        # the CQ, but things are what they are
-        luci.console_view_entry(
-            builder = builder_name('ios-simulator-cronet'),
-            category = 'chromium.fyi|cronet',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('mac-osxbeta-rel'),
-            category = 'chromium.fyi|mac',
-            short_name = 'beta',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('chromeos-kevin-rel-hw-tests'),
-            category = 'chromium.fyi|chromos',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('VR Linux'),
-            category = 'chromium.fyi|linux',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Linux Ozone Tester (Headless)'),
-            category = 'chromium.fyi|linux',
-            short_name = 'loh',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Linux Ozone Tester (Wayland)'),
-            category = 'chromium.fyi|linux',
-            short_name = 'low',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Linux Ozone Tester (X11)'),
-            category = 'chromium.fyi|linux',
-            short_name = 'lox',
-        ),
-        luci.console_view_entry(
-            builder = builder_name('Win10 Tests x64 1803'),
-            category = 'chromium.fyi|win10|1803',
-        ),
-    ],
-)

diff --git a/infra/config/versioned/milestones/m83/vars.star b/infra/config/versioned/milestones/m83/vars.star
index 2223c2a..f2f9c139 100644
--- a/infra/config/versioned/milestones/m83/vars.star
+++ b/infra/config/versioned/milestones/m83/vars.star

@@ -1,10 +1,11 @@
 vars = struct(
+    is_master = False,
     ref = 'refs/branch-heads/4103',
     ci_bucket = 'ci-m83',
     ci_poller = 'm83-gitiles-trigger',
+    main_console_name = 'main-m83',
+    main_console_title = 'Chromium M83 Console',
     try_bucket = 'try-m83',
     cq_group = 'cq-m83',
     cq_ref_regexp = 'refs/branch-heads/4103',
-    main_console_name = 'main-m83',
-    main_console_title = 'Chromium M83 Console',
 )

diff --git a/ios/chrome/browser/browsing_data/browsing_data_remover_impl.mm b/ios/chrome/browser/browsing_data/browsing_data_remover_impl.mm
index 256126c..f1ed8b6 100644
--- a/ios/chrome/browser/browsing_data/browsing_data_remover_impl.mm
+++ b/ios/chrome/browser/browsing_data/browsing_data_remover_impl.mm

@@ -29,7 +29,7 @@
 #include "components/history/core/browser/history_service.h"
 #include "components/keyed_service/core/service_access_type.h"
 #include "components/language/core/browser/url_language_histogram.h"
-#include "components/omnibox/browser/omnibox_pref_names.h"
+#include "components/omnibox/browser/omnibox_prefs.h"
 #include "components/open_from_clipboard/clipboard_recent_content.h"
 #include "components/password_manager/core/browser/password_store.h"
 #include "components/prefs/pref_service.h"

diff --git a/ios/chrome/browser/ui/browser_view/browser_view_controller.mm b/ios/chrome/browser/ui/browser_view/browser_view_controller.mm
index 3584504..4fccda1 100644
--- a/ios/chrome/browser/ui/browser_view/browser_view_controller.mm
+++ b/ios/chrome/browser/ui/browser_view/browser_view_controller.mm

@@ -890,11 +890,6 @@
     return;
   _broadcasting = broadcasting;
 
-  if (IsMultiwindowSupported()) {
-    // TODO(crbug.com/1060653): fix fullscreen.
-    return;
-  }
-
   ChromeBroadcaster* broadcaster = self.fullscreenController->broadcaster();
   if (_broadcasting) {
     _toolbarUIUpdater = [[LegacyToolbarUIUpdater alloc]
@@ -2664,7 +2659,7 @@
         ios::GetChromeBrowserProvider()->GetVoiceSearchProvider();
     if (provider) {
       _voiceSearchController =
-          provider->CreateVoiceSearchController(self.browserState);
+          provider->CreateVoiceSearchController(self.browser);
       if (self.primaryToolbarCoordinator) {
         _voiceSearchController->SetDispatcher(
             static_cast<id<LoadQueryCommands>>(self.commandDispatcher));

diff --git a/ios/chrome/browser/ui/fullscreen/BUILD.gn b/ios/chrome/browser/ui/fullscreen/BUILD.gn
index dfd9f65..b55b39f 100644
--- a/ios/chrome/browser/ui/fullscreen/BUILD.gn
+++ b/ios/chrome/browser/ui/fullscreen/BUILD.gn

@@ -39,6 +39,7 @@
   deps = [
     "//base",
     "//components/flags_ui",
+    "//ios/chrome/browser/ui/util:multiwindow_util",
   ]
 }
 

diff --git a/ios/chrome/browser/ui/fullscreen/fullscreen_features.mm b/ios/chrome/browser/ui/fullscreen/fullscreen_features.mm
index 9234c2b8..01554e0 100644
--- a/ios/chrome/browser/ui/fullscreen/fullscreen_features.mm
+++ b/ios/chrome/browser/ui/fullscreen/fullscreen_features.mm

@@ -6,6 +6,7 @@
 
 #include "base/command_line.h"
 #include "base/feature_list.h"
+#import "ios/chrome/browser/ui/util/multi_window_support.h"
 
 #if !defined(__has_feature) || !__has_feature(objc_arc)
 #error "This file requires ARC support."
@@ -25,6 +26,10 @@
 }
 
 bool ShouldScopeFullscreenControllerToBrowser() {
+  if (IsMultiwindowSupported()) {
+    return true;
+  }
+
   return base::FeatureList::IsEnabled(kFullscreenControllerBrowserScoped);
 }
 

diff --git a/ios/chrome/browser/ui/main/BUILD.gn b/ios/chrome/browser/ui/main/BUILD.gn
index 7922933..63470618 100644
--- a/ios/chrome/browser/ui/main/BUILD.gn
+++ b/ios/chrome/browser/ui/main/BUILD.gn

@@ -129,6 +129,7 @@
     "//ios/chrome/browser/ui/recent_tabs",
     "//ios/chrome/browser/ui/snackbar",
     "//ios/chrome/browser/ui/translate:legacy_translate",
+    "//ios/chrome/browser/ui/util:multiwindow_util",
     "//ios/chrome/browser/url_loading",
     "//ios/chrome/browser/web",
     "//ios/chrome/browser/web:tab_helper_delegates",

diff --git a/ios/chrome/browser/ui/main/browser_view_wrangler.h b/ios/chrome/browser/ui/main/browser_view_wrangler.h
index e22a7924..c47c316 100644
--- a/ios/chrome/browser/ui/main/browser_view_wrangler.h
+++ b/ios/chrome/browser/ui/main/browser_view_wrangler.h

@@ -43,6 +43,11 @@
 
 - (instancetype)init NS_UNAVAILABLE;
 
+// Window ID. Only used in multiwindow. Temporary solution for session
+// restoration in multiwindow.
+// TODO(crbug.com/1069762): remove this.
+@property(nonatomic, assign) NSUInteger windowID;
+
 // Creates the main Browser used by the receiver, using the browser state
 // and tab model observer it was configured with. The main interface is then
 // created; until this method is called, the main and incognito interfaces will

diff --git a/ios/chrome/browser/ui/main/browser_view_wrangler.mm b/ios/chrome/browser/ui/main/browser_view_wrangler.mm
index 92655eb..03c110b 100644
--- a/ios/chrome/browser/ui/main/browser_view_wrangler.mm
+++ b/ios/chrome/browser/ui/main/browser_view_wrangler.mm

@@ -25,6 +25,7 @@
 #import "ios/chrome/browser/ui/commands/application_commands.h"
 #import "ios/chrome/browser/ui/commands/browsing_data_commands.h"
 #import "ios/chrome/browser/ui/commands/command_dispatcher.h"
+#import "ios/chrome/browser/ui/util/multi_window_support.h"
 
 #if !defined(__has_feature) || !__has_feature(objc_arc)
 #error "This file requires ARC support."
@@ -408,10 +409,18 @@
       browser->GetBrowserState()->GetStatePath().AsUTF8Unsafe());
   SessionIOS* session =
       [[SessionServiceIOS sharedService] loadSessionFromDirectory:statePath];
-  if (session) {
-    DCHECK_EQ(session.sessionWindows.count, 1u);
-    sessionWindow = session.sessionWindows[0];
+  if (IsMultiwindowSupported()) {
+    if (session && session.sessionWindows.count > self.windowID) {
+      sessionWindow = session.sessionWindows[self.windowID];
+    }
+
+  } else {
+    if (session) {
+      DCHECK_EQ(session.sessionWindows.count, 1u);
+      sessionWindow = session.sessionWindows[0];
+    }
   }
+
   SessionRestorationBrowserAgent::FromBrowser(browser)->RestoreSessionWindow(
       sessionWindow);
 }

diff --git a/ios/chrome/browser/ui/main/scene_controller.mm b/ios/chrome/browser/ui/main/scene_controller.mm
index 36bfb06e..754394c 100644
--- a/ios/chrome/browser/ui/main/scene_controller.mm
+++ b/ios/chrome/browser/ui/main/scene_controller.mm

@@ -306,6 +306,8 @@
        applicationCommandEndpoint:self
       browsingDataCommandEndpoint:self.mainController];
 
+  self.browserViewWrangler.windowID = self.sceneState.windowID;
+
   // Ensure the main browser is created. This also creates the BVC.
   [self.browserViewWrangler createMainBrowser];
 

diff --git a/ios/chrome/browser/ui/main/scene_state.h b/ios/chrome/browser/ui/main/scene_state.h
index 624bd12..c3c589721 100644
--- a/ios/chrome/browser/ui/main/scene_state.h
+++ b/ios/chrome/browser/ui/main/scene_state.h

@@ -45,6 +45,10 @@
 // The current activation level.
 @property(nonatomic, assign) SceneActivationLevel activationLevel;
 
+// Window ID, used for restoration.
+// TODO(crbug.com/1069762): remove this.
+@property(nonatomic, assign, readonly) NSUInteger windowID;
+
 // Window for the associated scene, if any.
 @property(nonatomic, strong) UIWindow* window;
 

diff --git a/ios/chrome/browser/ui/main/scene_state.mm b/ios/chrome/browser/ui/main/scene_state.mm
index 0c4adc59..125d70dc 100644
--- a/ios/chrome/browser/ui/main/scene_state.mm
+++ b/ios/chrome/browser/ui/main/scene_state.mm

@@ -30,12 +30,16 @@
 
 @implementation SceneState
 @synthesize window = _window;
+@synthesize windowID = _windowID;
 
 - (instancetype)init {
   self = [super init];
   if (self) {
     _observers = [SceneStateObserverList
         observersWithProtocol:@protocol(SceneStateObserver)];
+    if (@available(iOS 13, *)) {
+      _windowID = UIApplication.sharedApplication.connectedScenes.count - 1;
+    }
   }
   return self;
 }
@@ -52,6 +56,14 @@
 
 #pragma mark - Setters & Getters.
 
+- (NSUInteger)windowID {
+  if (IsMultiwindowSupported()) {
+    return _windowID;
+  } else {
+    return 0;
+  }
+}
+
 - (void)setWindow:(UIWindow*)window {
   if (IsMultiwindowSupported()) {
     // No need to set anything, instead the getter is backed by scene.windows

diff --git a/ios/chrome/credential_provider_extension/credential_provider_extension_localize_strings_config.plist b/ios/chrome/credential_provider_extension/credential_provider_extension_localize_strings_config.plist
index 9aad3b37..5514f45 100644
--- a/ios/chrome/credential_provider_extension/credential_provider_extension_localize_strings_config.plist
+++ b/ios/chrome/credential_provider_extension/credential_provider_extension_localize_strings_config.plist

@@ -17,6 +17,13 @@
 				<string>IDS_IOS_CREDENTIAL_PROVIDER_CONSENT_ENABLE_BUTTON_TITLE</string>
 				<string>IDS_IOS_CREDENTIAL_PROVIDER_CONSENT_SUBTITLE</string>
 				<string>IDS_IOS_CREDENTIAL_PROVIDER_CONSENT_TITLE</string>
+				<string>IDS_IOS_CREDENTIAL_PROVIDER_DETAILS_COPY</string>
+				<string>IDS_IOS_CREDENTIAL_PROVIDER_DETAILS_PASSWORD</string>
+				<string>IDS_IOS_CREDENTIAL_PROVIDER_DETAILS_PASSWORD_COPIED</string>
+				<string>IDS_IOS_CREDENTIAL_PROVIDER_DETAILS_URL</string>
+				<string>IDS_IOS_CREDENTIAL_PROVIDER_DETAILS_URL_COPIED</string>
+				<string>IDS_IOS_CREDENTIAL_PROVIDER_DETAILS_USERNAME</string>
+				<string>IDS_IOS_CREDENTIAL_PROVIDER_DETAILS_USERNAME_COPIED</string>
 				<string>IDS_IOS_CREDENTIAL_PROVIDER_EMPTY_CREDENTIALS_SUBTITLE</string>
 				<string>IDS_IOS_CREDENTIAL_PROVIDER_EMPTY_CREDENTIALS_TITLE</string>
 				<string>IDS_IOS_CREDENTIAL_PROVIDER_EXTENSION_CANCEL</string>

diff --git a/ios/chrome/credential_provider_extension/strings/ios_credential_provider_extension_strings.grd b/ios/chrome/credential_provider_extension/strings/ios_credential_provider_extension_strings.grd
index 5cb1c64d..c0da9edf 100644
--- a/ios/chrome/credential_provider_extension/strings/ios_credential_provider_extension_strings.grd
+++ b/ios/chrome/credential_provider_extension/strings/ios_credential_provider_extension_strings.grd

@@ -170,6 +170,27 @@
       <message name="IDS_IOS_CREDENTIAL_PROVIDER_CONSENT_TITLE" desc="Title for consent screen. 'AutoFill' matches what Apple shows in settings. For other languages see: Settings  > Safari > AutoFill." meaning="Title to show when enabling the extension">
         AutoFill Chrome Passwords
       </message>
+      <message name="IDS_IOS_CREDENTIAL_PROVIDER_DETAILS_COPY" desc="Used for Copy (Copy/Paste) on menu item" meaning="Label for a Copy menu item.">
+        Copy
+      </message>
+      <message name="IDS_IOS_CREDENTIAL_PROVIDER_DETAILS_PASSWORD" desc="Label for Password row in details page" meaning="When displaying a credential details page, this label shows at the left of the credential Password.">
+        Password
+      </message>
+      <message name="IDS_IOS_CREDENTIAL_PROVIDER_DETAILS_PASSWORD_COPIED" desc="Used as message on a toast to show that Password was copied" meaning="Message on a toast, at the bottom of the details page, that tells the user that the Password was copied to the clipboard as requested.">
+        Password was copied
+      </message>
+      <message name="IDS_IOS_CREDENTIAL_PROVIDER_DETAILS_URL" desc="Label for URL row in details page" meaning="When displaying a credential details page, this label shows at the left of the credential URL.">
+        URL
+      </message>
+      <message name="IDS_IOS_CREDENTIAL_PROVIDER_DETAILS_URL_COPIED" desc="Used as message on a toast to show that URL was copied" meaning="Message on a toast, at the bottom of the details page, that tells the user that the URL was copied to the clipboard as requested.">
+        URL was copied
+      </message>
+      <message name="IDS_IOS_CREDENTIAL_PROVIDER_DETAILS_USERNAME" desc="Label for Username row in details page" meaning="When displaying a credential details page, this label shows at the left of the credential Username.">
+        Username
+      </message>
+      <message name="IDS_IOS_CREDENTIAL_PROVIDER_DETAILS_USERNAME_COPIED" desc="Used as message on a toast to show that Username was copied" meaning="Message on a toast, at the bottom of the details page, that tells the user that the Username was copied to the clipboard as requested.">
+        Username was copied
+      </message>
       <message name="IDS_IOS_CREDENTIAL_PROVIDER_EMPTY_CREDENTIALS_SUBTITLE" desc="Subtitle for empty credentials screen" meaning="Subtitle to show when a user has no credentials available.">
         Save some passwords in Chrome to get started. If you already have passwords stored in your Google Account, sign in to Chrome and turn on sync to see them here.
       </message>

diff --git a/ios/chrome/credential_provider_extension/ui/credential_details_view_controller.mm b/ios/chrome/credential_provider_extension/ui/credential_details_view_controller.mm
index 192fc6c..6a69d3d6 100644
--- a/ios/chrome/credential_provider_extension/ui/credential_details_view_controller.mm
+++ b/ios/chrome/credential_provider_extension/ui/credential_details_view_controller.mm

@@ -12,11 +12,38 @@
 #error "This file requires ARC support."
 #endif
 
+namespace {
+
+CGFloat kToastMinHeight = 40.0f;
+CGFloat kToastMinWidth = 200.0f;
+CGFloat kToastCornerRadius = 3.0f;
+CGFloat kToastHorizontalPadding = 10.0f;
+CGFloat kToastVerticalPadding = 4.0f;
+CGFloat kToastBottomMargin = 4.0f;
+CGFloat kToastSlideTime = 0.2f;
+CGFloat kToastUptime = 3.0f;
+
+NSString* kCellIdentifier = @"cdvcCell";
+
+NSString* const kMaskedPassword = @"••••••••";
+
+typedef NS_ENUM(NSInteger, RowIdentifier) {
+  RowIdentifierURL,
+  RowIdentifierUsername,
+  RowIdentifierPassword,
+  NumRows
+};
+
+}  // namespace
+
 @interface CredentialDetailsViewController () <UITableViewDataSource>
 
 // Current credential.
 @property(nonatomic, weak) id<Credential> credential;
 
+// Current clear password or nil (while locked).
+@property(nonatomic, strong) NSString* clearPassword;
+
 @end
 
 @implementation CredentialDetailsViewController
@@ -27,17 +54,154 @@
   [super viewDidLoad];
   self.view.backgroundColor = [UIColor colorNamed:kBackgroundColor];
   self.navigationItem.rightBarButtonItem = [self navigationCancelButton];
+  self.tableView.tableFooterView = [[UIView alloc] initWithFrame:CGRectZero];
+
+  NSNotificationCenter* defaultCenter = [NSNotificationCenter defaultCenter];
+  [defaultCenter addObserver:self
+                    selector:@selector(hidePassword)
+                        name:UIApplicationDidEnterBackgroundNotification
+                      object:nil];
 }
 
 #pragma mark - CredentialDetailsConsumer
 
 - (void)presentCredential:(id<Credential>)credential {
   self.credential = credential;
+  self.clearPassword = nil;
   [self.tableView reloadData];
 }
 
+#pragma mark - UITableViewDataSource
+
+- (NSInteger)tableView:(UITableView*)tableView
+    numberOfRowsInSection:(NSInteger)section {
+  return RowIdentifier::NumRows;
+}
+
+- (UITableViewCell*)tableView:(UITableView*)tableView
+        cellForRowAtIndexPath:(NSIndexPath*)indexPath {
+  UITableViewCell* cell =
+      [tableView dequeueReusableCellWithIdentifier:kCellIdentifier];
+  if (!cell) {
+    cell = [[UITableViewCell alloc] initWithStyle:UITableViewCellStyleValue1
+                                  reuseIdentifier:kCellIdentifier];
+  }
+
+  cell.selectionStyle = UITableViewCellSelectionStyleNone;
+  cell.textLabel.textColor = [UIColor colorNamed:kTextPrimaryColor];
+  cell.detailTextLabel.textColor = [UIColor colorNamed:kTextSecondaryColor];
+
+  switch (indexPath.row) {
+    case RowIdentifier::RowIdentifierURL:
+      cell.accessoryView = nil;
+      cell.textLabel.text =
+          NSLocalizedString(@"IDS_IOS_CREDENTIAL_PROVIDER_DETAILS_URL", @"URL");
+      cell.detailTextLabel.text = self.credential.serviceName;
+      break;
+    case RowIdentifier::RowIdentifierUsername:
+      cell.accessoryView = nil;
+      cell.textLabel.text = NSLocalizedString(
+          @"IDS_IOS_CREDENTIAL_PROVIDER_DETAILS_USERNAME", @"Username");
+      cell.detailTextLabel.text = self.credential.user;
+      break;
+    case RowIdentifier::RowIdentifierPassword:
+      cell.accessoryView = [self passwordIconButton];
+      cell.textLabel.text = NSLocalizedString(
+          @"IDS_IOS_CREDENTIAL_PROVIDER_DETAILS_PASSWORD", @"Password");
+      cell.detailTextLabel.text = [self password];
+      break;
+    default:
+      break;
+  }
+
+  return cell;
+}
+
+#pragma mark - UITableViewDelegate
+
+- (void)tableView:(UITableView*)tableView
+    didSelectRowAtIndexPath:(NSIndexPath*)indexPath {
+  UIMenuController* menu = [UIMenuController sharedMenuController];
+  if (![menu isMenuVisible]) {
+    NSMutableArray<UIMenuItem*>* items = [[NSMutableArray alloc] init];
+    switch (indexPath.row) {
+      case RowIdentifier::RowIdentifierURL:
+        [items
+            addObject:[[UIMenuItem alloc]
+                          initWithTitle:
+                              NSLocalizedString(
+                                  @"IDS_IOS_CREDENTIAL_PROVIDER_DETAILS_COPY",
+                                  @"Copy")
+                                 action:@selector(copyURL)]];
+        break;
+      case RowIdentifier::RowIdentifierUsername:
+        [items
+            addObject:[[UIMenuItem alloc]
+                          initWithTitle:
+                              NSLocalizedString(
+                                  @"IDS_IOS_CREDENTIAL_PROVIDER_DETAILS_COPY",
+                                  @"Copy")
+                                 action:@selector(copyUsername)]];
+        break;
+      case RowIdentifier::RowIdentifierPassword:
+        if (self.clearPassword) {
+          [items
+              addObject:[[UIMenuItem alloc]
+                            initWithTitle:
+                                NSLocalizedString(
+                                    @"IDS_IOS_CREDENTIAL_PROVIDER_DETAILS_COPY",
+                                    @"Copy")
+                                   action:@selector(copyPassword)]];
+        }
+        break;
+      default:
+        break;
+    }
+
+    if ([items count]) {
+      UITableViewCell* cell = [tableView cellForRowAtIndexPath:indexPath];
+      [menu setMenuItems:items];
+      [menu setTargetRect:cell.textLabel.frame inView:cell.textLabel];
+      [menu setMenuVisible:YES animated:YES];
+    }
+  }
+}
+
+#pragma mark - UIResponder
+
+- (BOOL)canBecomeFirstResponder {
+  return YES;
+}
+
 #pragma mark - Private
 
+// Copy credential URL to clipboard.
+- (void)copyURL {
+  UIPasteboard* generalPasteboard = [UIPasteboard generalPasteboard];
+  generalPasteboard.string = self.credential.serviceName;
+  [self showToast:NSLocalizedString(
+                      @"IDS_IOS_CREDENTIAL_PROVIDER_DETAILS_URL_COPIED",
+                      @"URL was copied")];
+}
+
+// Copy credential Username to clipboard.
+- (void)copyUsername {
+  UIPasteboard* generalPasteboard = [UIPasteboard generalPasteboard];
+  generalPasteboard.string = self.credential.user;
+  [self showToast:NSLocalizedString(
+                      @"IDS_IOS_CREDENTIAL_PROVIDER_DETAILS_USERNAME_COPIED",
+                      @"Username was copied")];
+}
+
+// Copy password to clipboard.
+- (void)copyPassword {
+  UIPasteboard* generalPasteboard = [UIPasteboard generalPasteboard];
+  generalPasteboard.string = self.clearPassword;
+  [self showToast:NSLocalizedString(
+                      @"IDS_IOS_CREDENTIAL_PROVIDER_DETAILS_PASSWORD_COPIED",
+                      @"Password was copied")];
+}
+
 // Creates a cancel button for the navigation item.
 - (UIBarButtonItem*)navigationCancelButton {
   UIBarButtonItem* cancelButton = [[UIBarButtonItem alloc]
@@ -47,4 +211,158 @@
   return cancelButton;
 }
 
+// Returns the string to display as password.
+- (NSString*)password {
+  return self.clearPassword ? self.clearPassword : kMaskedPassword;
+}
+
+// Creates a button to be displayed as accessory of the password row item.
+- (UIView*)passwordIconButton {
+  UIImage* image =
+      [UIImage imageNamed:self.clearPassword ? @"password_hide_icon"
+                                             : @"password_reveal_icon"];
+  image = [image imageWithRenderingMode:UIImageRenderingModeAlwaysTemplate];
+
+  UIButton* button = [UIButton buttonWithType:UIButtonTypeCustom];
+  button.frame = CGRectMake(0.0, 0.0, image.size.width, image.size.height);
+  [button setBackgroundImage:image forState:UIControlStateNormal];
+  [button setTintColor:[UIColor colorNamed:kBlueColor]];
+  [button addTarget:self
+                action:@selector(passwordIconButtonTapped:event:)
+      forControlEvents:UIControlEventTouchUpInside];
+
+  return button;
+}
+
+// Called when show/hine password icon is tapped.
+- (void)passwordIconButtonTapped:(id)sender event:(id)event {
+  // Only password reveal / hide is an accessory, so no need to check
+  // indexPath.
+  if (self.clearPassword) {
+    self.clearPassword = nil;
+    [self updatePasswordRow];
+  } else {
+    [self.delegate unlockPasswordForCredential:self.credential
+                             completionHandler:^(NSString* password) {
+                               self.clearPassword = password;
+                               [self updatePasswordRow];
+                             }];
+  }
+}
+
+// Hides the password and toggles the "Show/Hide" button.
+- (void)hidePassword {
+  if (!self.clearPassword)
+    return;
+  self.clearPassword = nil;
+  [self updatePasswordRow];
+}
+
+// Updates the password row.
+- (void)updatePasswordRow {
+  NSIndexPath* indexPath =
+      [NSIndexPath indexPathForRow:RowIdentifier::RowIdentifierPassword
+                         inSection:0];
+  [self.tableView reloadRowsAtIndexPaths:@[ indexPath ]
+                        withRowAnimation:UITableViewRowAnimationAutomatic];
+}
+
+// Shows given message in a toast at the bottom.
+- (void)showToast:(NSString*)message {
+  dispatch_async(dispatch_get_main_queue(), ^{
+    // Find top window/view without using UIApplication.
+    UIView* keyWindow = self.view;
+    while (keyWindow.superview) {
+      if ([keyWindow isKindOfClass:[UIWindow class]])
+        break;
+      keyWindow = keyWindow.superview;
+    }
+
+    CGSize labelSize = [message sizeWithAttributes:@{
+      NSFontAttributeName :
+          [UIFont preferredFontForTextStyle:UIFontTextStyleFootnote]
+    }];
+
+    CGFloat width =
+        MIN(MAX(kToastMinWidth, labelSize.width + 2 * kToastHorizontalPadding),
+            keyWindow.frame.size.width);
+    CGFloat height =
+        MAX(kToastMinHeight, labelSize.height + 2 * kToastVerticalPadding);
+
+    UILabel* label = [[UILabel alloc]
+        initWithFrame:CGRectMake(kToastHorizontalPadding, 0.0,
+                                 width - kToastHorizontalPadding, height)];
+    label.textAlignment = NSTextAlignmentLeft;
+    label.text = message;
+    label.font = [UIFont preferredFontForTextStyle:UIFontTextStyleFootnote];
+    label.textColor = [UIColor colorNamed:kBackgroundColor];
+
+    UIView* toast =
+        [[UIView alloc] initWithFrame:CGRectMake(0.0, 0.0, width, height)];
+    toast.backgroundColor = [UIColor colorNamed:kTextPrimaryColor];
+    toast.layer.cornerRadius = kToastCornerRadius;
+    toast.layer.masksToBounds = YES;
+    toast.center = CGPointMake(keyWindow.center.x,
+                               keyWindow.frame.size.height + height / 2);
+    toast.translatesAutoresizingMaskIntoConstraints = NO;
+
+    // Force toast size constraints.
+    [toast addConstraint:[NSLayoutConstraint
+                             constraintWithItem:toast
+                                      attribute:NSLayoutAttributeHeight
+                                      relatedBy:NSLayoutRelationEqual
+                                         toItem:nil
+                                      attribute:NSLayoutAttributeNotAnAttribute
+                                     multiplier:1
+                                       constant:height]];
+    [toast addConstraint:[NSLayoutConstraint
+                             constraintWithItem:toast
+                                      attribute:NSLayoutAttributeWidth
+                                      relatedBy:NSLayoutRelationEqual
+                                         toItem:nil
+                                      attribute:NSLayoutAttributeNotAnAttribute
+                                     multiplier:1
+                                       constant:width]];
+
+    [toast addSubview:label];
+    [keyWindow addSubview:toast];
+
+    // Animation constraint, based on bottom of window.
+    NSLayoutConstraint* constraint =
+        [NSLayoutConstraint constraintWithItem:toast
+                                     attribute:NSLayoutAttributeBottom
+                                     relatedBy:NSLayoutRelationEqual
+                                        toItem:keyWindow
+                                     attribute:NSLayoutAttributeBottom
+                                    multiplier:1.f
+                                      constant:height];
+    [keyWindow addConstraint:constraint];
+
+    // Force align toast with center X of window.
+    [keyWindow addConstraint:[NSLayoutConstraint
+                                 constraintWithItem:toast
+                                          attribute:NSLayoutAttributeCenterX
+                                          relatedBy:NSLayoutRelationEqual
+                                             toItem:keyWindow
+                                          attribute:NSLayoutAttributeCenterX
+                                         multiplier:1.f
+                                           constant:0]];
+
+    [UIView animateWithDuration:kToastSlideTime
+        delay:0.0
+        options:UIViewAnimationOptionCurveEaseOut
+        animations:^{
+          constraint.constant = -kToastBottomMargin;
+          [keyWindow layoutIfNeeded];
+        }
+        completion:^(BOOL finished) {
+          dispatch_after(dispatch_time(DISPATCH_TIME_NOW,
+                                       (int64_t)(kToastUptime * NSEC_PER_SEC)),
+                         dispatch_get_main_queue(), ^{
+                           [toast removeFromSuperview];
+                         });
+        }];
+  });
+}
+
 @end

diff --git a/ios/chrome/credential_provider_extension/ui/credential_list_mediator.mm b/ios/chrome/credential_provider_extension/ui/credential_list_mediator.mm
index 5fb7d0f7..d540828 100644
--- a/ios/chrome/credential_provider_extension/ui/credential_list_mediator.mm
+++ b/ios/chrome/credential_provider_extension/ui/credential_list_mediator.mm

@@ -32,6 +32,12 @@
 // The extension context in which the credential list was started.
 @property(nonatomic, weak) ASCredentialProviderExtensionContext* context;
 
+// List of suggested credentials.
+@property(nonatomic, copy) NSArray<id<Credential>>* suggestedCredentials;
+
+// List of all credentials.
+@property(nonatomic, copy) NSArray<id<Credential>>* allCredentials;
+
 @end
 
 @implementation CredentialListMediator
@@ -56,12 +62,14 @@
 
 - (void)fetchCredentials {
   // TODO(crbug.com/1045454): Implement ordering and suggestions.
-  NSArray<id<Credential>>* allCredentials = self.credentialStore.credentials;
-  if (!allCredentials.count) {
+  self.allCredentials = self.credentialStore.credentials;
+  self.suggestedCredentials = nil;
+  if (!self.allCredentials.count) {
     [self.UIHandler showEmptyCredentials];
     return;
   }
-  [self.consumer presentSuggestedPasswords:nil allPasswords:allCredentials];
+  [self.consumer presentSuggestedPasswords:self.suggestedCredentials
+                              allPasswords:self.allCredentials];
 }
 
 #pragma mark - CredentialListConsumerDelegate
@@ -75,7 +83,27 @@
 }
 
 - (void)updateResultsWithFilter:(NSString*)filter {
-  // TODO(crbug.com/1045454): Implement this method.
+  NSMutableArray<id<Credential>>* suggested = [[NSMutableArray alloc] init];
+  if (self.suggestedCredentials.count > 0) {
+    for (id<Credential> credential in self.suggestedCredentials) {
+      if ([filter length] == 0 ||
+          [credential.serviceName localizedStandardContainsString:filter] ||
+          [credential.user localizedStandardContainsString:filter]) {
+        [suggested addObject:credential];
+      }
+    }
+  }
+  NSMutableArray<id<Credential>>* all = [[NSMutableArray alloc] init];
+  if (self.allCredentials.count > 0) {
+    for (id<Credential> credential in self.allCredentials) {
+      if ([filter length] == 0 ||
+          [credential.serviceName localizedStandardContainsString:filter] ||
+          [credential.user localizedStandardContainsString:filter]) {
+        [all addObject:credential];
+      }
+    }
+  }
+  [self.consumer presentSuggestedPasswords:suggested allPasswords:all];
 }
 
 - (void)showDetailsForCredential:(id<Credential>)credential {

diff --git a/ios/chrome/credential_provider_extension/ui/credential_list_view_controller.mm b/ios/chrome/credential_provider_extension/ui/credential_list_view_controller.mm
index 39f2fd9..4580845 100644
--- a/ios/chrome/credential_provider_extension/ui/credential_list_view_controller.mm
+++ b/ios/chrome/credential_provider_extension/ui/credential_list_view_controller.mm

@@ -164,6 +164,7 @@
   cell.textLabel.textColor = [UIColor colorNamed:kTextPrimaryColor];
   cell.detailTextLabel.text = credential.serviceName;
   cell.detailTextLabel.textColor = [UIColor colorNamed:kTextSecondaryColor];
+  cell.selectionStyle = UITableViewCellSelectionStyleNone;
   return cell;
 }
 

diff --git a/ios/chrome/credential_provider_extension/ui/resources/BUILD.gn b/ios/chrome/credential_provider_extension/ui/resources/BUILD.gn
index 13e48c5..8494b31 100644
--- a/ios/chrome/credential_provider_extension/ui/resources/BUILD.gn
+++ b/ios/chrome/credential_provider_extension/ui/resources/BUILD.gn

@@ -9,6 +9,8 @@
   deps = [
     ":consent_illustration",
     ":empty_credentials_illustration",
+    ":password_hide_icon",
+    ":password_reveal_icon",
     ":stale_credentials_illustration",
   ]
 }
@@ -36,3 +38,19 @@
     "stale_credentials_illustration.imageset/illustration_light.png",
   ]
 }
+
+imageset("password_reveal_icon") {
+  sources = [
+    "password_reveal_icon.imageset/Contents.json",
+    "password_reveal_icon.imageset/password_reveal_icon@2x.png",
+    "password_reveal_icon.imageset/password_reveal_icon@3x.png",
+  ]
+}
+
+imageset("password_hide_icon") {
+  sources = [
+    "password_hide_icon.imageset/Contents.json",
+    "password_hide_icon.imageset/password_hide_icon@2x.png",
+    "password_hide_icon.imageset/password_hide_icon@3x.png",
+  ]
+}

diff --git a/ios/chrome/credential_provider_extension/ui/resources/password_hide_icon.imageset/Contents.json b/ios/chrome/credential_provider_extension/ui/resources/password_hide_icon.imageset/Contents.json
new file mode 100644
index 0000000..8a0874c
--- /dev/null
+++ b/ios/chrome/credential_provider_extension/ui/resources/password_hide_icon.imageset/Contents.json

@@ -0,0 +1,18 @@
+{
+    "images": [
+        {
+            "idiom": "universal",
+            "scale": "2x",
+            "filename": "password_hide_icon@2x.png"
+        },
+        {
+            "idiom": "universal",
+            "scale": "3x",
+            "filename": "password_hide_icon@3x.png"
+        }
+    ],
+    "info": {
+        "version": 1,
+        "author": "xcode"
+    }
+}

diff --git a/ios/chrome/credential_provider_extension/ui/resources/password_hide_icon.imageset/password_hide_icon@2x.png b/ios/chrome/credential_provider_extension/ui/resources/password_hide_icon.imageset/password_hide_icon@2x.png
new file mode 100644
index 0000000..4827898
--- /dev/null
+++ b/ios/chrome/credential_provider_extension/ui/resources/password_hide_icon.imageset/password_hide_icon@2x.png
Binary files differ

diff --git a/ios/chrome/credential_provider_extension/ui/resources/password_hide_icon.imageset/password_hide_icon@3x.png b/ios/chrome/credential_provider_extension/ui/resources/password_hide_icon.imageset/password_hide_icon@3x.png
new file mode 100644
index 0000000..8863188a
--- /dev/null
+++ b/ios/chrome/credential_provider_extension/ui/resources/password_hide_icon.imageset/password_hide_icon@3x.png
Binary files differ

diff --git a/ios/chrome/credential_provider_extension/ui/resources/password_reveal_icon.imageset/Contents.json b/ios/chrome/credential_provider_extension/ui/resources/password_reveal_icon.imageset/Contents.json
new file mode 100644
index 0000000..3e1d8bf
--- /dev/null
+++ b/ios/chrome/credential_provider_extension/ui/resources/password_reveal_icon.imageset/Contents.json

@@ -0,0 +1,18 @@
+{
+    "images": [
+        {
+            "idiom": "universal",
+            "scale": "2x",
+            "filename": "password_reveal_icon@2x.png"
+        },
+        {
+            "idiom": "universal",
+            "scale": "3x",
+            "filename": "password_reveal_icon@3x.png"
+        }
+    ],
+    "info": {
+        "version": 1,
+        "author": "xcode"
+    }
+}

diff --git a/ios/chrome/credential_provider_extension/ui/resources/password_reveal_icon.imageset/password_reveal_icon@2x.png b/ios/chrome/credential_provider_extension/ui/resources/password_reveal_icon.imageset/password_reveal_icon@2x.png
new file mode 100644
index 0000000..d421f539
--- /dev/null
+++ b/ios/chrome/credential_provider_extension/ui/resources/password_reveal_icon.imageset/password_reveal_icon@2x.png
Binary files differ

diff --git a/ios/chrome/credential_provider_extension/ui/resources/password_reveal_icon.imageset/password_reveal_icon@3x.png b/ios/chrome/credential_provider_extension/ui/resources/password_reveal_icon.imageset/password_reveal_icon@3x.png
new file mode 100644
index 0000000..63cea42
--- /dev/null
+++ b/ios/chrome/credential_provider_extension/ui/resources/password_reveal_icon.imageset/password_reveal_icon@3x.png
Binary files differ

diff --git a/ios/showcase/credential_provider/sc_credential_list_coordinator.mm b/ios/showcase/credential_provider/sc_credential_list_coordinator.mm
index 1c0e8fc..9844b4d35 100644
--- a/ios/showcase/credential_provider/sc_credential_list_coordinator.mm
+++ b/ios/showcase/credential_provider/sc_credential_list_coordinator.mm

@@ -90,7 +90,6 @@
 }
 
 - (void)updateResultsWithFilter:(NSString*)filter {
-  // TODO(crbug.com/1045454): Implement this method.
   NSMutableArray<id<Credential>>* suggested = [[NSMutableArray alloc] init];
   for (id<Credential> credential in suggestedPasswords) {
     if ([filter length] == 0 ||

diff --git a/ios/third_party/material_components_ios/BUILD.gn b/ios/third_party/material_components_ios/BUILD.gn
index 7d2c9e6..d632574 100644
--- a/ios/third_party/material_components_ios/BUILD.gn
+++ b/ios/third_party/material_components_ios/BUILD.gn

@@ -128,6 +128,8 @@
   "src/components/Buttons/src/TypographyThemer/MDCButtonTypographyThemer.h",
   "src/components/Buttons/src/TypographyThemer/MaterialButtons+TypographyThemer.h",
   "src/components/Buttons/src/private/MDCButton+Subclassing.h",
+  "src/components/Buttons/src/private/MDCFloatingButtonModeAnimator.h",
+  "src/components/Buttons/src/private/MDCFloatingButtonModeAnimatorDelegate.h",
   "src/components/Cards/src/MDCCard.h",
   "src/components/Cards/src/MDCCardCollectionCell.h",
   "src/components/Cards/src/MaterialCards.h",
@@ -869,6 +871,9 @@
   "src/components/Buttons/src/TypographyThemer/MDCButtonTypographyThemer.m",
   "src/components/Buttons/src/TypographyThemer/MaterialButtons+TypographyThemer.h",
   "src/components/Buttons/src/private/MDCButton+Subclassing.h",
+  "src/components/Buttons/src/private/MDCFloatingButtonModeAnimator.h",
+  "src/components/Buttons/src/private/MDCFloatingButtonModeAnimator.m",
+  "src/components/Buttons/src/private/MDCFloatingButtonModeAnimatorDelegate.h",
   "src/components/Cards/src/MDCCard.h",
   "src/components/Cards/src/MDCCard.m",
   "src/components/Cards/src/MDCCardCollectionCell.h",

diff --git a/ios/web_view/BUILD.gn b/ios/web_view/BUILD.gn
index 2594180..2ede97c 100644
--- a/ios/web_view/BUILD.gn
+++ b/ios/web_view/BUILD.gn

@@ -163,6 +163,8 @@
     "internal/passwords/cwv_password_controller.h",
     "internal/passwords/cwv_password_controller.mm",
     "internal/passwords/cwv_password_internal.h",
+    "internal/passwords/web_view_account_password_store_factory.h",
+    "internal/passwords/web_view_account_password_store_factory.mm",
     "internal/passwords/web_view_password_feature_manager.h",
     "internal/passwords/web_view_password_feature_manager.mm",
     "internal/passwords/web_view_password_manager_client.h",
@@ -411,6 +413,7 @@
     "internal/passwords/cwv_password_controller_fake.h",
     "internal/passwords/cwv_password_controller_fake.mm",
     "internal/passwords/cwv_password_unittest.mm",
+    "internal/passwords/web_view_password_manager_client_unittest.mm",
     "internal/signin/cwv_identity_unittest.mm",
     "internal/signin/web_view_gaia_auth_fetcher_unittest.mm",
     "internal/sync/cwv_sync_controller_unittest.mm",

diff --git a/ios/web_view/internal/cwv_web_view_configuration.mm b/ios/web_view/internal/cwv_web_view_configuration.mm
index e199882..6ed4db4 100644
--- a/ios/web_view/internal/cwv_web_view_configuration.mm
+++ b/ios/web_view/internal/cwv_web_view_configuration.mm

@@ -18,7 +18,7 @@
 #import "ios/web_view/internal/cwv_preferences_internal.h"
 #import "ios/web_view/internal/cwv_user_content_controller_internal.h"
 #import "ios/web_view/internal/cwv_web_view_internal.h"
-#include "ios/web_view/internal/passwords/web_view_password_store_factory.h"
+#import "ios/web_view/internal/passwords/web_view_account_password_store_factory.h"
 #include "ios/web_view/internal/signin/web_view_identity_manager_factory.h"
 #include "ios/web_view/internal/signin/web_view_signin_error_controller_factory.h"
 #import "ios/web_view/internal/sync/cwv_sync_controller_internal.h"
@@ -130,7 +130,7 @@
         ios_web_view::WebViewPersonalDataManagerFactory::GetForBrowserState(
             self.browserState);
     scoped_refptr<password_manager::PasswordStore> passwordStore =
-        ios_web_view::WebViewPasswordStoreFactory::GetForBrowserState(
+        ios_web_view::WebViewAccountPasswordStoreFactory::GetForBrowserState(
             self.browserState, ServiceAccessType::EXPLICIT_ACCESS);
     _autofillDataManager = [[CWVAutofillDataManager alloc]
         initWithPersonalDataManager:personalDataManager
@@ -160,7 +160,7 @@
             GetAutofillWebDataForBrowserState(
                 self.browserState, ServiceAccessType::EXPLICIT_ACCESS);
     scoped_refptr<password_manager::PasswordStore> passwordStore =
-        ios_web_view::WebViewPasswordStoreFactory::GetForBrowserState(
+        ios_web_view::WebViewAccountPasswordStoreFactory::GetForBrowserState(
             self.browserState, ServiceAccessType::EXPLICIT_ACCESS);
 
     _syncController = [[CWVSyncController alloc]

diff --git a/ios/web_view/internal/passwords/web_view_account_password_store_factory.h b/ios/web_view/internal/passwords/web_view_account_password_store_factory.h
new file mode 100644
index 0000000..1ede3a5
--- /dev/null
+++ b/ios/web_view/internal/passwords/web_view_account_password_store_factory.h

@@ -0,0 +1,52 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef IOS_WEB_VIEW_INTERNAL_PASSWORDS_WEB_VIEW_ACCOUNT_PASSWORD_STORE_FACTORY_H_
+#define IOS_WEB_VIEW_INTERNAL_PASSWORDS_WEB_VIEW_ACCOUNT_PASSWORD_STORE_FACTORY_H_
+
+#include "base/macros.h"
+#include "base/memory/ref_counted.h"
+#include "base/no_destructor.h"
+#include "components/keyed_service/ios/refcounted_browser_state_keyed_service_factory.h"
+
+enum class ServiceAccessType;
+
+namespace password_manager {
+class PasswordStore;
+}
+
+namespace ios_web_view {
+
+class WebViewBrowserState;
+
+// Singleton that owns all Gaia-account-scoped PasswordStores and associates
+// them with WebViewBrowserStates.
+class WebViewAccountPasswordStoreFactory
+    : public RefcountedBrowserStateKeyedServiceFactory {
+ public:
+  static scoped_refptr<password_manager::PasswordStore> GetForBrowserState(
+      WebViewBrowserState* browser_state,
+      ServiceAccessType access_type);
+
+  static WebViewAccountPasswordStoreFactory* GetInstance();
+
+ private:
+  friend class base::NoDestructor<WebViewAccountPasswordStoreFactory>;
+
+  WebViewAccountPasswordStoreFactory();
+  ~WebViewAccountPasswordStoreFactory() override;
+
+  // Overrides of methods in BrowserStateKeyedServiceFactory:
+  scoped_refptr<RefcountedKeyedService> BuildServiceInstanceFor(
+      web::BrowserState* context) const override;
+  web::BrowserState* GetBrowserStateToUse(
+      web::BrowserState* context) const override;
+  bool ServiceIsNULLWhileTesting() const override;
+
+  DISALLOW_COPY_AND_ASSIGN(WebViewAccountPasswordStoreFactory);
+};
+
+}  // namespace ios_web_view
+
+#endif  // IOS_WEB_VIEW_INTERNAL_PASSWORDS_WEB_VIEW_ACCOUNT_PASSWORD_STORE_FACTORY_H_

diff --git a/ios/web_view/internal/passwords/web_view_account_password_store_factory.mm b/ios/web_view/internal/passwords/web_view_account_password_store_factory.mm
new file mode 100644
index 0000000..c96b7659
--- /dev/null
+++ b/ios/web_view/internal/passwords/web_view_account_password_store_factory.mm

@@ -0,0 +1,107 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#import "ios/web_view/internal/passwords/web_view_account_password_store_factory.h"
+
+#include <memory>
+#include <utility>
+
+#include "base/bind.h"
+#include "base/bind_helpers.h"
+#include "build/build_config.h"
+#include "components/keyed_service/core/service_access_type.h"
+#include "components/keyed_service/ios/browser_state_dependency_manager.h"
+#include "components/password_manager/core/browser/login_database.h"
+#include "components/password_manager/core/browser/password_manager_constants.h"
+#include "components/password_manager/core/browser/password_manager_util.h"
+#include "components/password_manager/core/browser/password_store.h"
+#include "components/password_manager/core/browser/password_store_default.h"
+#include "components/password_manager/core/browser/password_store_factory_util.h"
+#include "components/password_manager/core/common/password_manager_features.h"
+#include "components/prefs/pref_service.h"
+#include "ios/web_view/internal/web_view_browser_state.h"
+#include "ios/web_view/internal/webdata_services/web_view_web_data_service_wrapper_factory.h"
+
+#if !defined(__has_feature) || !__has_feature(objc_arc)
+#error "This file requires ARC support."
+#endif
+
+namespace ios_web_view {
+
+// static
+scoped_refptr<password_manager::PasswordStore>
+WebViewAccountPasswordStoreFactory::GetForBrowserState(
+    WebViewBrowserState* browser_state,
+    ServiceAccessType access_type) {
+  if (!base::FeatureList::IsEnabled(
+          password_manager::features::kEnablePasswordsAccountStorage)) {
+    return nullptr;
+  }
+
+  // |browser_state| always gets redirected to a the recording version in
+  // |GetBrowserStateToUse|.
+  if (access_type == ServiceAccessType::IMPLICIT_ACCESS &&
+      browser_state->IsOffTheRecord()) {
+    return nullptr;
+  }
+
+  return base::WrapRefCounted(static_cast<password_manager::PasswordStore*>(
+      GetInstance()->GetServiceForBrowserState(browser_state, true).get()));
+}
+
+// static
+WebViewAccountPasswordStoreFactory*
+WebViewAccountPasswordStoreFactory::GetInstance() {
+  static base::NoDestructor<WebViewAccountPasswordStoreFactory> instance;
+  return instance.get();
+}
+
+WebViewAccountPasswordStoreFactory::WebViewAccountPasswordStoreFactory()
+    : RefcountedBrowserStateKeyedServiceFactory(
+          "AccountPasswordStore",
+          BrowserStateDependencyManager::GetInstance()) {
+  DependsOn(WebViewWebDataServiceWrapperFactory::GetInstance());
+}
+
+WebViewAccountPasswordStoreFactory::~WebViewAccountPasswordStoreFactory() {}
+
+scoped_refptr<RefcountedKeyedService>
+WebViewAccountPasswordStoreFactory::BuildServiceInstanceFor(
+    web::BrowserState* context) const {
+  DCHECK(base::FeatureList::IsEnabled(
+      password_manager::features::kEnablePasswordsAccountStorage));
+
+  WebViewBrowserState* browser_state =
+      WebViewBrowserState::FromBrowserState(context);
+
+  std::unique_ptr<password_manager::LoginDatabase> login_db(
+      password_manager::CreateLoginDatabaseForAccountStorage(
+          browser_state->GetStatePath()));
+
+  scoped_refptr<password_manager::PasswordStore> ps =
+      new password_manager::PasswordStoreDefault(std::move(login_db));
+  // TODO(crbug.com/1056406): Call PasswordManagerClient::UpdateAllFormManagers
+  // in response to sync state.
+  if (!ps->Init(browser_state->GetPrefs())) {
+    // TODO(crbug.com/479725): Remove the LOG once this error is visible in the
+    // UI.
+    LOG(WARNING) << "Could not initialize password store.";
+    return nullptr;
+  }
+
+  return ps;
+}
+
+web::BrowserState* WebViewAccountPasswordStoreFactory::GetBrowserStateToUse(
+    web::BrowserState* context) const {
+  WebViewBrowserState* browser_state =
+      WebViewBrowserState::FromBrowserState(context);
+  return browser_state->GetRecordingBrowserState();
+}
+
+bool WebViewAccountPasswordStoreFactory::ServiceIsNULLWhileTesting() const {
+  return true;
+}
+
+}  // namespace ios_web_view

diff --git a/ios/web_view/internal/passwords/web_view_password_feature_manager.h b/ios/web_view/internal/passwords/web_view_password_feature_manager.h
index 6ba7d989..dee05e3 100644
--- a/ios/web_view/internal/passwords/web_view_password_feature_manager.h
+++ b/ios/web_view/internal/passwords/web_view_password_feature_manager.h

@@ -8,12 +8,19 @@
 #include "base/macros.h"
 #include "components/password_manager/core/browser/password_feature_manager.h"
 
+namespace syncer {
+class SyncService;
+}  // namespace syncer
+
+class PrefService;
+
 namespace ios_web_view {
 // An //ios/web_view implementation of password_manager::PasswordFeatureManager.
 class WebViewPasswordFeatureManager
     : public password_manager::PasswordFeatureManager {
  public:
-  WebViewPasswordFeatureManager() = default;
+  WebViewPasswordFeatureManager(PrefService* pref_service,
+                                const syncer::SyncService* sync_service);
   ~WebViewPasswordFeatureManager() override = default;
 
   bool IsGenerationEnabled() const override;
@@ -30,6 +37,9 @@
   autofill::PasswordForm::Store GetDefaultPasswordStore() const override;
 
  private:
+  PrefService* const pref_service_;
+  const syncer::SyncService* const sync_service_;
+
   DISALLOW_COPY_AND_ASSIGN(WebViewPasswordFeatureManager);
 };
 }  // namespace ios_web_view

diff --git a/ios/web_view/internal/passwords/web_view_password_feature_manager.mm b/ios/web_view/internal/passwords/web_view_password_feature_manager.mm
index 32b34eb..f72a5dd6 100644
--- a/ios/web_view/internal/passwords/web_view_password_feature_manager.mm
+++ b/ios/web_view/internal/passwords/web_view_password_feature_manager.mm

@@ -5,19 +5,30 @@
 #include "ios/web_view/internal/passwords/web_view_password_feature_manager.h"
 
 #include "base/logging.h"
+#include "components/password_manager/core/browser/password_manager_util.h"
+#include "components/prefs/pref_service.h"
+#include "components/sync/driver/sync_service.h"
 
 #if !defined(__has_feature) || !__has_feature(objc_arc)
 #error "This file requires ARC support."
 #endif
 
 namespace ios_web_view {
+WebViewPasswordFeatureManager::WebViewPasswordFeatureManager(
+    PrefService* pref_service,
+    const syncer::SyncService* sync_service)
+    : pref_service_(pref_service), sync_service_(sync_service) {}
 
 bool WebViewPasswordFeatureManager::IsGenerationEnabled() const {
   return false;
 }
 
 bool WebViewPasswordFeatureManager::IsOptedInForAccountStorage() const {
-  return false;
+  // Although ios/web_view will only write to the account store, this should
+  // still be controlled on a per user basis to ensure that the logged out user
+  // remains opted out.
+  return password_manager_util::IsOptedInForAccountStorage(pref_service_,
+                                                           sync_service_);
 }
 
 bool WebViewPasswordFeatureManager::ShouldShowAccountStorageOptIn() const {
@@ -38,7 +49,8 @@
 
 autofill::PasswordForm::Store
 WebViewPasswordFeatureManager::GetDefaultPasswordStore() const {
-  return autofill::PasswordForm::Store::kProfileStore;
+  // ios/web_view should never write to the profile password store.
+  return autofill::PasswordForm::Store::kAccountStore;
 }
 
 void WebViewPasswordFeatureManager::SetDefaultPasswordStore(

diff --git a/ios/web_view/internal/passwords/web_view_password_manager_client.mm b/ios/web_view/internal/passwords/web_view_password_manager_client.mm
index 09b7cf0c..92d5ab7 100644
--- a/ios/web_view/internal/passwords/web_view_password_manager_client.mm
+++ b/ios/web_view/internal/passwords/web_view_password_manager_client.mm

@@ -19,6 +19,7 @@
 #include "components/password_manager/ios/credential_manager_util.h"
 #import "ios/web/public/web_state.h"
 #include "ios/web_view/internal/app/application_context.h"
+#import "ios/web_view/internal/passwords/web_view_account_password_store_factory.h"
 #import "ios/web_view/internal/passwords/web_view_password_manager_log_router_factory.h"
 #include "ios/web_view/internal/passwords/web_view_password_store_factory.h"
 #include "ios/web_view/internal/signin/web_view_identity_manager_factory.h"
@@ -52,6 +53,8 @@
 WebViewPasswordManagerClient::WebViewPasswordManagerClient(
     id<CWVPasswordManagerClientDelegate> delegate)
     : delegate_(delegate),
+      password_feature_manager_(GetPrefs(),
+                                GetSyncService(delegate.browserState)),
       credentials_filter_(
           this,
           base::BindRepeating(&GetSyncService, delegate_.browserState)),
@@ -86,6 +89,9 @@
   if (form_to_save->IsBlacklisted()) {
     return false;
   }
+  if (!password_feature_manager_.IsOptedInForAccountStorage()) {
+    return false;
+  }
 
   if (update_password) {
     [delegate_ showUpdatePasswordInfoBar:std::move(form_to_save)];
@@ -157,8 +163,9 @@
 }
 
 PasswordStore* WebViewPasswordManagerClient::GetAccountPasswordStore() const {
-  // Account password stores aren't currently supported in iOS webviews.
-  return nullptr;
+  return ios_web_view::WebViewAccountPasswordStoreFactory::GetForBrowserState(
+             delegate_.browserState, ServiceAccessType::EXPLICIT_ACCESS)
+      .get();
 }
 
 void WebViewPasswordManagerClient::NotifyUserAutoSignin(

diff --git a/ios/web_view/internal/passwords/web_view_password_manager_client_unittest.mm b/ios/web_view/internal/passwords/web_view_password_manager_client_unittest.mm
new file mode 100644
index 0000000..e07315c
--- /dev/null
+++ b/ios/web_view/internal/passwords/web_view_password_manager_client_unittest.mm

@@ -0,0 +1,127 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#import "ios/web_view/internal/passwords/web_view_password_manager_client.h"
+
+#include <memory>
+
+#include "base/test/scoped_feature_list.h"
+#include "components/autofill/core/common/password_form.h"
+#include "components/password_manager/core/browser/mock_password_form_manager_for_ui.h"
+#include "components/password_manager/core/browser/password_form_manager_for_ui.h"
+#include "components/password_manager/core/browser/password_manager.h"
+#include "components/password_manager/core/common/password_manager_features.h"
+#include "ios/web/public/test/scoped_testing_web_client.h"
+#include "ios/web/public/test/web_task_environment.h"
+#include "ios/web/public/web_client.h"
+#include "ios/web_view/internal/web_view_browser_state.h"
+#include "ios/web_view/test/test_with_locale_and_resources.h"
+#include "testing/gtest/include/gtest/gtest.h"
+#import "testing/gtest_mac.h"
+#include "testing/platform_test.h"
+#include "url/gurl.h"
+
+#if !defined(__has_feature) || !__has_feature(objc_arc)
+#error "This file requires ARC support."
+#endif
+
+@interface CWVTestPasswordManagerClientDelegate
+    : NSObject <CWVPasswordManagerClientDelegate>
+@end
+
+@implementation CWVTestPasswordManagerClientDelegate {
+  GURL _emptyURL;
+  std::unique_ptr<ios_web_view::WebViewBrowserState> _browserState;
+}
+
+- (instancetype)init {
+  self = [super init];
+  if (self) {
+    _browserState = std::make_unique<ios_web_view::WebViewBrowserState>(
+        /*off_the_record=*/false);
+  }
+  return self;
+}
+
+- (void)showSavePasswordInfoBar:
+    (std::unique_ptr<password_manager::PasswordFormManagerForUI>)formToSave {
+}
+
+- (void)showUpdatePasswordInfoBar:
+    (std::unique_ptr<password_manager::PasswordFormManagerForUI>)formToUpdate {
+}
+
+- (void)showAutosigninNotification:
+    (std::unique_ptr<autofill::PasswordForm>)formSignedIn {
+}
+
+- (ios_web_view::WebViewBrowserState*)browserState {
+  return _browserState.get();
+}
+
+- (web::WebState*)webState {
+  return nullptr;
+}
+
+- (password_manager::PasswordManager*)passwordManager {
+  return nullptr;
+}
+
+- (const GURL&)lastCommittedURL {
+  return _emptyURL;
+}
+
+@end
+
+namespace ios_web_view {
+
+using testing::_;
+using testing::Invoke;
+using testing::Return;
+
+class WebViewPasswordManagerClientTest : public TestWithLocaleAndResources {
+ protected:
+  WebViewPasswordManagerClientTest()
+      : web_client_(std::make_unique<web::WebClient>()) {}
+  web::ScopedTestingWebClient web_client_;
+  web::WebTaskEnvironment task_environment_;
+};
+
+TEST_F(WebViewPasswordManagerClientTest, NoPromptIfBlacklisted) {
+  CWVTestPasswordManagerClientDelegate* test_delegate =
+      [[CWVTestPasswordManagerClientDelegate alloc] init];
+  WebViewPasswordManagerClient client(test_delegate);
+  auto password_manager_for_ui =
+      std::make_unique<password_manager::MockPasswordFormManagerForUI>();
+
+  EXPECT_CALL(*password_manager_for_ui, IsBlacklisted()).WillOnce(Return(true));
+  base::test::ScopedFeatureList scoped_feature;
+  scoped_feature.InitAndEnableFeature(
+      password_manager::features::kEnablePasswordsAccountStorage);
+
+  EXPECT_FALSE(client.PromptUserToSaveOrUpdatePassword(
+      std::move(password_manager_for_ui), /*update_password=*/false));
+}
+
+TEST_F(WebViewPasswordManagerClientTest, NoPromptIfNotOptedInToAccountStorage) {
+  CWVTestPasswordManagerClientDelegate* test_delegate =
+      [[CWVTestPasswordManagerClientDelegate alloc] init];
+  WebViewPasswordManagerClient client(test_delegate);
+  auto password_manager_for_ui =
+      std::make_unique<password_manager::MockPasswordFormManagerForUI>();
+
+  EXPECT_CALL(*password_manager_for_ui, IsBlacklisted())
+      .WillOnce(Return(false));
+  base::test::ScopedFeatureList scoped_feature;
+  scoped_feature.InitAndDisableFeature(
+      password_manager::features::kEnablePasswordsAccountStorage);
+
+  EXPECT_FALSE(client.PromptUserToSaveOrUpdatePassword(
+      std::move(password_manager_for_ui), /*update_password=*/false));
+}
+
+// TODO(crbug.com/1069338): Write test that verifies it prompts if all
+// conditions passes.
+
+}  // namespace ios_web_view

diff --git a/ios/web_view/internal/sync/web_view_profile_sync_service_factory.mm b/ios/web_view/internal/sync/web_view_profile_sync_service_factory.mm
index 2ec886b..b093a9a 100644
--- a/ios/web_view/internal/sync/web_view_profile_sync_service_factory.mm
+++ b/ios/web_view/internal/sync/web_view_profile_sync_service_factory.mm

@@ -14,6 +14,7 @@
 #include "components/autofill/core/common/autofill_features.h"
 #include "components/invalidation/impl/profile_invalidation_provider.h"
 #include "components/keyed_service/ios/browser_state_dependency_manager.h"
+#include "components/password_manager/core/common/password_manager_features.h"
 #include "components/signin/public/identity_manager/identity_manager.h"
 #include "components/sync/base/model_type.h"
 #include "components/sync/driver/profile_sync_service.h"
@@ -23,6 +24,7 @@
 #include "ios/web/public/thread/web_thread.h"
 #include "ios/web_view/internal/app/application_context.h"
 #include "ios/web_view/internal/autofill/web_view_personal_data_manager_factory.h"
+#import "ios/web_view/internal/passwords/web_view_account_password_store_factory.h"
 #include "ios/web_view/internal/passwords/web_view_password_store_factory.h"
 #include "ios/web_view/internal/signin/web_view_identity_manager_factory.h"
 #import "ios/web_view/internal/sync/web_view_device_info_sync_service_factory.h"
@@ -66,6 +68,7 @@
   DependsOn(WebViewIdentityManagerFactory::GetInstance());
   DependsOn(WebViewPersonalDataManagerFactory::GetInstance());
   DependsOn(WebViewWebDataServiceWrapperFactory::GetInstance());
+  DependsOn(WebViewAccountPasswordStoreFactory::GetInstance());
   DependsOn(WebViewPasswordStoreFactory::GetInstance());
   DependsOn(WebViewGCMProfileServiceFactory::GetInstance());
   DependsOn(WebViewProfileInvalidationProviderFactory::GetInstance());
@@ -101,6 +104,8 @@
   init_params.autofill_enable_account_wallet_storage =
       base::FeatureList::IsEnabled(
           autofill::features::kAutofillEnableAccountWalletStorage);
+  init_params.enable_passwords_account_storage = base::FeatureList::IsEnabled(
+      password_manager::features::kEnablePasswordsAccountStorage);
 
   auto profile_sync_service =
       std::make_unique<syncer::ProfileSyncService>(std::move(init_params));

diff --git a/ios/web_view/internal/sync/web_view_sync_client.h b/ios/web_view/internal/sync/web_view_sync_client.h
index a6b5b32..45787f4d 100644
--- a/ios/web_view/internal/sync/web_view_sync_client.h
+++ b/ios/web_view/internal/sync/web_view_sync_client.h

@@ -70,6 +70,7 @@
   scoped_refptr<autofill::AutofillWebDataService> profile_web_data_service_;
   scoped_refptr<autofill::AutofillWebDataService> account_web_data_service_;
   scoped_refptr<password_manager::PasswordStore> password_store_;
+  scoped_refptr<password_manager::PasswordStore> account_password_store_;
 
   // TODO(crbug.com/915154): Revert to SyncApiComponentFactory once common
   // controller creation is moved elsewhere.

diff --git a/ios/web_view/internal/sync/web_view_sync_client.mm b/ios/web_view/internal/sync/web_view_sync_client.mm
index 70850d0..51c5add7 100644
--- a/ios/web_view/internal/sync/web_view_sync_client.mm
+++ b/ios/web_view/internal/sync/web_view_sync_client.mm

@@ -27,6 +27,7 @@
 #include "components/version_info/version_string.h"
 #include "ios/web/public/thread/web_task_traits.h"
 #include "ios/web/public/thread/web_thread.h"
+#import "ios/web_view/internal/passwords/web_view_account_password_store_factory.h"
 #include "ios/web_view/internal/passwords/web_view_password_store_factory.h"
 #include "ios/web_view/internal/pref_names.h"
 #include "ios/web_view/internal/signin/web_view_identity_manager_factory.h"
@@ -72,6 +73,9 @@
 
   password_store_ = WebViewPasswordStoreFactory::GetForBrowserState(
       browser_state_, ServiceAccessType::IMPLICIT_ACCESS);
+  account_password_store_ =
+      WebViewAccountPasswordStoreFactory::GetForBrowserState(
+          browser_state_, ServiceAccessType::IMPLICIT_ACCESS);
 
   component_factory_ =
       std::make_unique<browser_sync::ProfileSyncComponentsFactoryImpl>(
@@ -79,7 +83,7 @@
           prefs::kSavingBrowserHistoryDisabled,
           base::CreateSingleThreadTaskRunner({web::WebThread::UI}), db_thread_,
           profile_web_data_service_, account_web_data_service_, password_store_,
-          /*account_password_store=*/nullptr,
+          account_password_store_,
           /*bookmark_sync_service=*/nullptr);
 }
 

diff --git a/ios/web_view/internal/web_view_browser_state.mm b/ios/web_view/internal/web_view_browser_state.mm
index f561c591..40e7bae 100644
--- a/ios/web_view/internal/web_view_browser_state.mm
+++ b/ios/web_view/internal/web_view_browser_state.mm

@@ -37,6 +37,7 @@
 #include "ios/web_view/internal/autofill/web_view_personal_data_manager_factory.h"
 #include "ios/web_view/internal/language/web_view_language_model_manager_factory.h"
 #include "ios/web_view/internal/language/web_view_url_language_histogram_factory.h"
+#include "ios/web_view/internal/passwords/web_view_account_password_store_factory.h"
 #import "ios/web_view/internal/passwords/web_view_password_manager_log_router_factory.h"
 #include "ios/web_view/internal/passwords/web_view_password_store_factory.h"
 #include "ios/web_view/internal/signin/web_view_identity_manager_factory.h"
@@ -182,6 +183,7 @@
   WebViewPersonalDataManagerFactory::GetInstance();
   WebViewWebDataServiceWrapperFactory::GetInstance();
   WebViewPasswordManagerLogRouterFactory::GetInstance();
+  WebViewAccountPasswordStoreFactory::GetInstance();
   WebViewPasswordStoreFactory::GetInstance();
   WebViewSigninClientFactory::GetInstance();
   WebViewSigninErrorControllerFactory::GetInstance();

diff --git a/ios/web_view/internal/web_view_web_main_parts.mm b/ios/web_view/internal/web_view_web_main_parts.mm
index 8701bc2..4a25fbf 100644
--- a/ios/web_view/internal/web_view_web_main_parts.mm
+++ b/ios/web_view/internal/web_view_web_main_parts.mm

@@ -12,6 +12,7 @@
 #include "components/autofill/core/common/autofill_features.h"
 #include "components/autofill/core/common/autofill_payments_features.h"
 #include "components/content_settings/core/common/content_settings_pattern.h"
+#include "components/password_manager/core/common/password_manager_features.h"
 #include "ios/web/public/webui/web_ui_ios_controller_factory.h"
 #include "ios/web_view/internal/app/application_context.h"
 #import "ios/web_view/internal/cwv_flags_internal.h"
@@ -54,7 +55,8 @@
   std::string enable_features = base::JoinString(
       {autofill::features::kAutofillUpstream.name,
        autofill::features::kAutofillNoLocalSaveOnUploadSuccess.name,
-       autofill::features::kAutofillNoLocalSaveOnUnmaskSuccess.name},
+       autofill::features::kAutofillNoLocalSaveOnUnmaskSuccess.name,
+       password_manager::features::kEnablePasswordsAccountStorage.name},
       ",");
   std::string disabled_features = base::JoinString({}, ",");
   feature_list->InitializeFromCommandLine(

diff --git a/media/base/media_switches.cc b/media/base/media_switches.cc
index b5dca3b..8d472e4 100644
--- a/media/base/media_switches.cc
+++ b/media/base/media_switches.cc

@@ -29,9 +29,9 @@
 // Set number of threads to use for video decoding.
 const char kVideoThreads[] = "video-threads";
 
-// Suspend media pipeline on background tabs.
-const char kEnableMediaSuspend[] = "enable-media-suspend";
-const char kDisableMediaSuspend[] = "disable-media-suspend";
+// Do not immediately suspend media in background tabs.
+const char kDisableBackgroundMediaSuspend[] =
+    "disable-background-media-suspend";
 
 // Force to report VP9 as an unsupported MIME type.
 const char kReportVp9AsAnUnsupportedMimeType[] =

diff --git a/media/base/media_switches.h b/media/base/media_switches.h
index 4239d51a0..494a4e7 100644
--- a/media/base/media_switches.h
+++ b/media/base/media_switches.h

@@ -31,9 +31,7 @@
 
 MEDIA_EXPORT extern const char kVideoThreads[];
 
-// TODO(crbug.com/867146): remove these switches.
-MEDIA_EXPORT extern const char kEnableMediaSuspend[];
-MEDIA_EXPORT extern const char kDisableMediaSuspend[];
+MEDIA_EXPORT extern const char kDisableBackgroundMediaSuspend[];
 
 MEDIA_EXPORT extern const char kReportVp9AsAnUnsupportedMimeType[];
 

diff --git a/media/blink/webmediaplayer_impl.cc b/media/blink/webmediaplayer_impl.cc
index 5867a08..d6483b64 100644
--- a/media/blink/webmediaplayer_impl.cc
+++ b/media/blink/webmediaplayer_impl.cc

@@ -110,14 +110,10 @@
 }
 
 bool IsBackgroundSuspendEnabled(const WebMediaPlayerImpl* wmpi) {
-  // TODO(crbug.com/867146): remove these switches.
   if (base::CommandLine::ForCurrentProcess()->HasSwitch(
-          switches::kDisableMediaSuspend))
+          switches::kDisableBackgroundMediaSuspend)) {
     return false;
-  if (base::CommandLine::ForCurrentProcess()->HasSwitch(
-          switches::kEnableMediaSuspend))
-    return true;
-
+  }
   return wmpi->IsBackgroundMediaSuspendEnabled();
 }
 

diff --git a/mojo/public/cpp/bindings/tests/remote_unittest.cc b/mojo/public/cpp/bindings/tests/remote_unittest.cc
index 12744135..cd10adbe 100644
--- a/mojo/public/cpp/bindings/tests/remote_unittest.cc
+++ b/mojo/public/cpp/bindings/tests/remote_unittest.cc

@@ -1111,6 +1111,7 @@
 }
 
 INSTANTIATE_MOJO_BINDINGS_TEST_SUITE_P(RemoteTest);
+INSTANTIATE_MOJO_BINDINGS_TEST_SUITE_P(EndToEndRemoteTest);
 
 }  // namespace
 }  // namespace remote_unittest

diff --git a/net/cookies/cookie_util.cc b/net/cookies/cookie_util.cc
index 70d3605..165d632 100644
--- a/net/cookies/cookie_util.cc
+++ b/net/cookies/cookie_util.cc

@@ -552,6 +552,10 @@
              features::kCookiesWithoutSameSiteMustBeSecure);
 }
 
+bool IsSchemefulSameSiteEnabled() {
+  return base::FeatureList::IsEnabled(features::kSchemefulSameSite);
+}
+
 bool IsRecentHttpSameSiteAccessGrantsLegacyCookieSemanticsEnabled() {
   return IsSameSiteByDefaultCookiesEnabled() &&
          base::FeatureList::IsEnabled(

diff --git a/net/cookies/cookie_util.h b/net/cookies/cookie_util.h
index 19c63715..168feec4 100644
--- a/net/cookies/cookie_util.h
+++ b/net/cookies/cookie_util.h

@@ -160,6 +160,7 @@
 // Returns whether the respective SameSite feature is enabled.
 NET_EXPORT bool IsSameSiteByDefaultCookiesEnabled();
 NET_EXPORT bool IsCookiesWithoutSameSiteMustBeSecureEnabled();
+NET_EXPORT bool IsSchemefulSameSiteEnabled();
 bool IsRecentHttpSameSiteAccessGrantsLegacyCookieSemanticsEnabled();
 bool IsRecentCreationTimeGrantsLegacyCookieSemanticsEnabled();
 

diff --git a/net/cookies/site_for_cookies.cc b/net/cookies/site_for_cookies.cc
index 474eacdf..c3ba304 100644
--- a/net/cookies/site_for_cookies.cc
+++ b/net/cookies/site_for_cookies.cc

@@ -7,6 +7,7 @@
 #include "base/strings/strcat.h"
 #include "base/strings/string_util.h"
 #include "net/base/registry_controlled_domains/registry_controlled_domain.h"
+#include "net/cookies/cookie_util.h"
 
 namespace net {
 
@@ -75,21 +76,21 @@
 }
 
 bool SiteForCookies::IsFirstParty(const GURL& url) const {
-  if (IsNull() || !url.is_valid())
-    return false;
+  if (cookie_util::IsSchemefulSameSiteEnabled())
+    return IsSchemefullyFirstParty(url);
 
-  std::string other_registrable_domain = RegistrableDomainOrHost(url.host());
-
-  if (registrable_domain_.empty())
-    return other_registrable_domain.empty() && (scheme_ == url.scheme());
-
-  return registrable_domain_ == other_registrable_domain;
+  return IsSchemelesslyFirstParty(url);
 }
 
 bool SiteForCookies::IsEquivalent(const SiteForCookies& other) const {
   if (IsNull())
     return other.IsNull();
 
+  if (cookie_util::IsSchemefulSameSiteEnabled() &&
+      !CompatibleScheme(other.scheme())) {
+    return false;
+  }
+
   if (registrable_domain_.empty())
     return other.registrable_domain_.empty() && (scheme_ == other.scheme_);
 
@@ -103,29 +104,15 @@
   if (IsNull() || !schemefully_same_)
     return;
 
-  // Mark and return early if |other| is opaque. Opaque origins shouldn't match.
+  // Mark if |other| is opaque. Opaque origins shouldn't match.
   if (other.opaque()) {
     schemefully_same_ = false;
     return;
   }
-  const std::string& other_scheme = other.scheme();
 
-  // Exact match case.
-  if (scheme_ == other_scheme)
+  if (CompatibleScheme(other.scheme()))
     return;
 
-  // ["https", "wss"] case.
-  if ((scheme_ == url::kHttpsScheme || scheme_ == url::kWssScheme) &&
-      (other_scheme == url::kHttpsScheme || other_scheme == url::kWssScheme)) {
-    return;
-  }
-
-  // ["http", "ws"] case.
-  if ((scheme_ == url::kHttpScheme || scheme_ == url::kWsScheme) &&
-      (other_scheme == url::kHttpScheme || other_scheme == url::kWsScheme)) {
-    return;
-  }
-
   // The two are cross-scheme to each other.
   schemefully_same_ = false;
 }
@@ -138,10 +125,63 @@
   return result;
 }
 
+bool SiteForCookies::IsNull() const {
+  if (cookie_util::IsSchemefulSameSiteEnabled())
+    return scheme_.empty() || !schemefully_same_;
+
+  return scheme_.empty();
+}
+
+bool SiteForCookies::IsSchemefullyFirstParty(const GURL& url) const {
+  // Can't use IsNull() as we want the same behavior regardless of
+  // SchemefulSameSite feature status.
+  if (scheme_.empty() || !schemefully_same_ || !url.is_valid())
+    return false;
+
+  return CompatibleScheme(url.scheme()) && IsSchemelesslyFirstParty(url);
+}
+
+bool SiteForCookies::IsSchemelesslyFirstParty(const GURL& url) const {
+  // Can't use IsNull() as we want the same behavior regardless of
+  // SchemefulSameSite feature status.
+  if (scheme_.empty() || !url.is_valid())
+    return false;
+
+  std::string other_registrable_domain = RegistrableDomainOrHost(url.host());
+
+  if (registrable_domain_.empty())
+    return other_registrable_domain.empty() && (scheme_ == url.scheme());
+
+  return registrable_domain_ == other_registrable_domain;
+}
+
 SiteForCookies::SiteForCookies(const std::string& scheme,
                                const std::string& host)
     : scheme_(scheme),
       registrable_domain_(RegistrableDomainOrHost(host)),
       schemefully_same_(!scheme.empty()) {}
 
+bool SiteForCookies::CompatibleScheme(const std::string& other_scheme) const {
+  DCHECK(base::IsStringASCII(other_scheme));
+  DCHECK(base::ToLowerASCII(other_scheme) == other_scheme);
+
+  // Exact match case.
+  if (scheme_ == other_scheme)
+    return true;
+
+  // ["https", "wss"] case.
+  if ((scheme_ == url::kHttpsScheme || scheme_ == url::kWssScheme) &&
+      (other_scheme == url::kHttpsScheme || other_scheme == url::kWssScheme)) {
+    return true;
+  }
+
+  // ["http", "ws"] case.
+  if ((scheme_ == url::kHttpScheme || scheme_ == url::kWsScheme) &&
+      (other_scheme == url::kHttpScheme || other_scheme == url::kWsScheme)) {
+    return true;
+  }
+
+  return false;
+}
+
 }  // namespace net

diff --git a/net/cookies/site_for_cookies.h b/net/cookies/site_for_cookies.h
index cf3d6f4..e846205c 100644
--- a/net/cookies/site_for_cookies.h
+++ b/net/cookies/site_for_cookies.h

@@ -23,8 +23,13 @@
 // 2) They both have empty hostnames and equal schemes.
 // Invalid URLs are not first party to anything.
 //
-// TODO(crbug.com/1030938): For case 1 the schemes must be "https" & "wss",
-// "http" & "ws", or they must match exactly.
+// With the SchemefulSameSite feature enabled the policy is that two valid URLs
+// would be considered the same party if either:
+// 1) They both have compatible schemes along with non-empty and equal
+// registrable domains or hostnames/IPs. See CompatibleScheme() for more details
+// on what it means to have a compatible scheme.
+// 2) They both have empty hostnames and exactly equal schemes. Invalid URLs are
+// not first party to anything.
 class NET_EXPORT SiteForCookies {
  public:
   // Matches nothing.
@@ -58,6 +63,8 @@
   // Equivalent to FromOrigin(url::Origin::Create(url)).
   static SiteForCookies FromUrl(const GURL& url);
 
+  // Returns a string with the values of the member variables.
+  // |schemefully_same| being false does not change the output.
   std::string ToDebugString() const;
 
   // Returns true if |url| should be considered first-party to the context
@@ -69,10 +76,7 @@
   bool IsEquivalent(const SiteForCookies& other) const;
 
   // Clears the schemefully_same_ flag if |other|'s scheme is cross-scheme to
-  // |this|.
-  // Two schemes are considered the same (not cross-scheme) if they exactly
-  // match, they are both in ["https", "wss"], or they are both in ["http",
-  // "ws"]. All other cases are cross-scheme.
+  // |this|. Schemes are considered cross-scheme if they're !CompatibleScheme().
   void MarkIfCrossScheme(const url::Origin& other);
 
   // Returns a URL that's first party to this SiteForCookies (an empty URL if
@@ -96,11 +100,36 @@
   bool schemefully_same() const { return schemefully_same_; }
 
   // Returns true if this SiteForCookies matches nothing.
-  bool IsNull() const { return scheme_.empty(); }
+  // If the SchemefulSameSite feature is enabled then !schemefully_same_ causes
+  // this function to return true.
+  bool IsNull() const;
+
+  // Don't use this function unless you know what you're doing, if you're unsure
+  // you probably want IsFirstParty().
+  //
+  // Returns true if |url| should be considered first-party to the context
+  // |this| represents when the compatibility of the schemes are taken into
+  // account. See CompatibleScheme().
+  bool IsSchemefullyFirstParty(const GURL& url) const;
+
+  // Don't use this function unless you know what you're doing, if you're unsure
+  // you probably want IsFirstParty().
+  //
+  // Returns true if |url| should be considered first-party to the context
+  // |this| represents when the compatibility of the scheme are not taken into
+  // account. See CompatibleScheme().
+  //
+  // Note that schemes are still compared for exact equality if neither |this|
+  // nor |url| have a registered domain.
+  bool IsSchemelesslyFirstParty(const GURL& url) const;
 
  private:
   SiteForCookies(const std::string& scheme, const std::string& host);
 
+  // Two schemes are considered compatible if they exactly match, they are both
+  // in ["https", "wss"], or they are both in ["http", "ws"].
+  bool CompatibleScheme(const std::string& other_scheme) const;
+
   // These should be canonicalized appropriately by GURL/url::Origin.
   // An empty |scheme_| means that this matches nothing.
   std::string scheme_;
@@ -114,10 +143,10 @@
   // Used to indicate if the SiteForCookies would be the same if computed
   // schemefully. A schemeful computation means to take the |scheme_| as well as
   // the |registrable_domain_| into account when determining first-partyness.
-  // See MarkIfCrossScheme() for more information on scheme comparison.
+  // See CompatibleScheme() for more information on scheme comparison.
   //
   // True means to treat |this| as-is while false means that |this| should be
-  // treated as if it matches nothing i.e. as if IsNull() returned true.
+  // treated as if it matches nothing i.e. IsNull() returns true.
   //
   // This value is important in the case where the SiteForCookies is being used
   // to assess the first-partyness of a sub-frame in a document.
@@ -125,9 +154,6 @@
   // For a SiteForCookies with !scheme_.empty() this value starts as true and
   // will only go false via MarkIfCrossScheme(), otherwise this value is
   // irrelevant.
-  //
-  // TODO(https://crbug.com/1030938): Actually use this for decisions in other
-  // functions.
   bool schemefully_same_;
 };
 

diff --git a/net/cookies/site_for_cookies_unittest.cc b/net/cookies/site_for_cookies_unittest.cc
index aad3078..640b9987 100644
--- a/net/cookies/site_for_cookies_unittest.cc
+++ b/net/cookies/site_for_cookies_unittest.cc

@@ -7,6 +7,8 @@
 #include <vector>
 
 #include "base/strings/strcat.h"
+#include "base/test/scoped_feature_list.h"
+#include "net/base/features.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "url/gurl.h"
 #include "url/origin.h"
@@ -15,6 +17,16 @@
 namespace net {
 namespace {
 
+class SchemefulSiteForCookiesTest : public ::testing::Test {
+ public:
+  SchemefulSiteForCookiesTest() {
+    scope_feature_list_.InitAndEnableFeature(features::kSchemefulSameSite);
+  }
+
+ protected:
+  base::test::ScopedFeatureList scope_feature_list_;
+};
+
 // Tests that all URLs from |equivalent| produce SiteForCookies that match
 // URLs in the set and are equivalent to each other, and are distinct and
 // don't match |distinct|.
@@ -90,6 +102,38 @@
   TestEquivalentAndDistinct(equivalent, distinct, "example.com");
 }
 
+// Similar to SiteForCookiesTest_Basic with a focus on testing secure SFCs.
+TEST_F(SchemefulSiteForCookiesTest, BasicSecure) {
+  std::vector<GURL> equivalent = {GURL("https://example.com"),
+                                  GURL("wss://example.com"),
+                                  GURL("https://sub1.example.com:42/something"),
+                                  GURL("wss://sub2.example.com/something")};
+
+  std::vector<GURL> distinct = {
+      GURL("http://example.com"),      GURL("https://example.org"),
+      GURL("ws://example.com"),        GURL("https://com/i_am_a_tld"),
+      GURL("file://example.com/helo"),
+  };
+
+  TestEquivalentAndDistinct(equivalent, distinct, "example.com");
+}
+
+// Similar to SiteForCookiesTest_Basic with a focus on testing insecure SFCs.
+TEST_F(SchemefulSiteForCookiesTest, BasicInsecure) {
+  std::vector<GURL> equivalent = {GURL("http://example.com"),
+                                  GURL("ws://example.com"),
+                                  GURL("http://sub1.example.com:42/something"),
+                                  GURL("ws://sub2.example.com/something")};
+
+  std::vector<GURL> distinct = {
+      GURL("https://example.com"),     GURL("http://example.org"),
+      GURL("wss://example.com"),       GURL("http://com/i_am_a_tld"),
+      GURL("file://example.com/helo"),
+  };
+
+  TestEquivalentAndDistinct(equivalent, distinct, "example.com");
+}
+
 TEST(SiteForCookiesTest, File) {
   std::vector<GURL> equivalent = {GURL("file:///a/b/c"),
                                   GURL("file:///etc/shaaadow")};
@@ -104,6 +148,7 @@
   url::AddStandardScheme("chrome-extension", url::SCHEME_WITH_HOST);
   std::vector<GURL> equivalent = {GURL("chrome-extension://abc/"),
                                   GURL("chrome-extension://abc/foo.txt"),
+                                  GURL("https://abc"), GURL("http://abc"),
                                   // This one is disputable.
                                   GURL("file://abc/bar.txt")};
 
@@ -112,6 +157,23 @@
   TestEquivalentAndDistinct(equivalent, distinct, "abc");
 }
 
+// Similar to SiteForCookiesTest_Extension with a focus on ensuring that http(s)
+// schemes are distinct.
+TEST_F(SchemefulSiteForCookiesTest, Extension) {
+  url::ScopedSchemeRegistryForTests scoped_registry;
+  url::AddStandardScheme("chrome-extension", url::SCHEME_WITH_HOST);
+  std::vector<GURL> equivalent = {
+      GURL("chrome-extension://abc/"),
+      GURL("chrome-extension://abc/foo.txt"),
+  };
+
+  std::vector<GURL> distinct = {GURL("chrome-extension://def"),
+                                GURL("https://abc"), GURL("http://abc"),
+                                GURL("file://abc/bar.txt")};
+
+  TestEquivalentAndDistinct(equivalent, distinct, "abc");
+}
+
 TEST(SiteForCookiesTest, NonStandard) {
   // If we don't register the scheme, nothing matches, even identical ones
   std::vector<GURL> equivalent;
@@ -144,6 +206,45 @@
       SiteForCookies::FromUrl(GURL("http://www.example.org:631"))));
 }
 
+// Similar to SiteForCookiesTest_Blob with a focus on a secure blob.
+TEST_F(SchemefulSiteForCookiesTest, SecureBlob) {
+  SiteForCookies from_blob = SiteForCookies::FromUrl(
+      GURL("blob:https://example.org/9115d58c-bcda-ff47-86e5-083e9a2153041"));
+
+  EXPECT_TRUE(from_blob.IsFirstParty(GURL("https://sub.example.org/resource")));
+  EXPECT_FALSE(from_blob.IsFirstParty(GURL("http://sub.example.org/resource")));
+  EXPECT_EQ("https", from_blob.scheme());
+  EXPECT_EQ(
+      "SiteForCookies: {scheme=https; registrable_domain=example.org; "
+      "schemefully_same=true}",
+      from_blob.ToDebugString());
+  EXPECT_EQ("https://example.org/", from_blob.RepresentativeUrl().spec());
+  EXPECT_TRUE(from_blob.IsEquivalent(
+      SiteForCookies::FromUrl(GURL("https://www.example.org:631"))));
+  EXPECT_FALSE(from_blob.IsEquivalent(
+      SiteForCookies::FromUrl(GURL("http://www.example.org:631"))));
+}
+
+// Similar to SiteForCookiesTest_Blob with a focus on an insecure blob.
+TEST_F(SchemefulSiteForCookiesTest, InsecureBlob) {
+  SiteForCookies from_blob = SiteForCookies::FromUrl(
+      GURL("blob:http://example.org/9115d58c-bcda-ff47-86e5-083e9a2153041"));
+
+  EXPECT_TRUE(from_blob.IsFirstParty(GURL("http://sub.example.org/resource")));
+  EXPECT_FALSE(
+      from_blob.IsFirstParty(GURL("https://sub.example.org/resource")));
+  EXPECT_EQ("http", from_blob.scheme());
+  EXPECT_EQ(
+      "SiteForCookies: {scheme=http; registrable_domain=example.org; "
+      "schemefully_same=true}",
+      from_blob.ToDebugString());
+  EXPECT_EQ("http://example.org/", from_blob.RepresentativeUrl().spec());
+  EXPECT_TRUE(from_blob.IsEquivalent(
+      SiteForCookies::FromUrl(GURL("http://www.example.org:631"))));
+  EXPECT_FALSE(from_blob.IsEquivalent(
+      SiteForCookies::FromUrl(GURL("https://www.example.org:631"))));
+}
+
 TEST(SiteForCookiesTest, Wire) {
   SiteForCookies out;
 
@@ -187,6 +288,48 @@
       out.ToDebugString());
 }
 
+// Similar to SiteForCookiesTest_Wire except that schemefully_same has an
+// effect.
+TEST_F(SchemefulSiteForCookiesTest, Wire) {
+  SiteForCookies out;
+
+  // Empty one.
+  EXPECT_TRUE(SiteForCookies::FromWire("", "", false, &out));
+  EXPECT_TRUE(out.IsNull());
+
+  EXPECT_TRUE(SiteForCookies::FromWire("", "", true, &out));
+  EXPECT_TRUE(out.IsNull());
+
+  // Not a valid scheme.
+  EXPECT_FALSE(SiteForCookies::FromWire("aH", "example.com", false, &out));
+  EXPECT_TRUE(out.IsNull());
+
+  // Not a eTLD + 1 (or something hosty).
+  EXPECT_FALSE(
+      SiteForCookies::FromWire("http", "sub.example.com", false, &out));
+  EXPECT_TRUE(out.IsNull());
+
+  // This is fine, though.
+  EXPECT_TRUE(SiteForCookies::FromWire("https", "127.0.0.1", true, &out));
+  EXPECT_FALSE(out.IsNull());
+  EXPECT_EQ(
+      "SiteForCookies: {scheme=https; registrable_domain=127.0.0.1; "
+      "schemefully_same=true}",
+      out.ToDebugString());
+
+  // This one's schemefully_same is false
+  EXPECT_TRUE(SiteForCookies::FromWire("https", "127.0.0.1", false, &out));
+  EXPECT_TRUE(out.IsNull());
+
+  // As is actual eTLD+1.
+  EXPECT_TRUE(SiteForCookies::FromWire("wss", "example.com", true, &out));
+  EXPECT_FALSE(out.IsNull());
+  EXPECT_EQ(
+      "SiteForCookies: {scheme=wss; registrable_domain=example.com; "
+      "schemefully_same=true}",
+      out.ToDebugString());
+}
+
 TEST(SiteForCookiesTest, SameScheme) {
   struct TestCase {
     const char* first;

diff --git a/net/docs/proxy.md b/net/docs/proxy.md
index 34551e96..3e1b257 100644
--- a/net/docs/proxy.md
+++ b/net/docs/proxy.md

@@ -996,3 +996,44 @@
 Network change events can also be key to understanding proxy issues. After
 switching networks (ex VPN), the effective proxy settings, as well as content
 of any PAC scripts/auto-detect can change.
+
+## Web Proxy Auto-Discovery (WPAD)
+
+When configured to use WPAD (aka "autotmaticaly detect proxy settings"), Chrome
+will prioritize:
+
+1. DHCP-based WPAD (option 252)
+2. DNS-based WPAD
+
+These are tried in order, however DHCP-based WPAD is only supported for Chrome
+on Windows and Chrome on Chrome OS.
+
+WPAD is the system default for many home and Enterprise users.
+
+### Chrome on macOS support for DHCP-based WPAD
+
+Chrome on macOS does not support DHCP-based WPAD when configured to use
+"autodetect".
+
+However, macOS might perform DHCP-based WPAD and embed this discovered PAC URL
+as part of the system proxy settings. So effectively when Chrome is configured
+to "use system proxy settings" it may behave as if it supports DHCP-based WPAD.
+
+### Dangers of DNS-based WPAD and DNS search suffix list
+
+DNS-based WPAD involves probing for the non-FQDN `wpad`. This means
+WPAD's performance and security is directly tied to the user's DNS search
+suffix list.
+
+When resolving `wpad`, the host's DNS resolver will complete the hostname using
+each of the suffixes in the search list:
+
+1. If the suffix list is long this process can very slow, as it triggers a
+   cascade of NXDOMAIN.
+2. If the suffix list includes domains *outside of the administrative domain*,
+   WPAD may select an attacker controlled PAC server, and can subsequently
+   funnel the user's traffic through a proxy server of their choice. The
+   evolution of TLDs further increases this risk, since what were previously
+   private suffixes used by an enterprise can become publicly registerable.
+   See also [WPAD Name Collision
+   Vulnerability](https://www.us-cert.gov/ncas/alerts/TA16-144A)

diff --git a/printing/backend/printing_restrictions.h b/printing/backend/printing_restrictions.h
index 718e5ae..89920436 100644
--- a/printing/backend/printing_restrictions.h
+++ b/printing/backend/printing_restrictions.h

@@ -53,8 +53,7 @@
 PRINTING_EXPORT extern const char kDefaultDuplexMode[];
 PRINTING_EXPORT extern const char kDefaultPinMode[];
 
-// Dictionary keys to be used with |kPrintingAllowedPageSizes| and
-// |kPrintingSizeDefault| policies.
+// Dictionary keys to be used with |kPrintingSizeDefault| policy.
 PRINTING_EXPORT extern const char kPageWidthUm[];
 PRINTING_EXPORT extern const char kPageHeightUm[];
 

diff --git a/services/network/public/cpp/BUILD.gn b/services/network/public/cpp/BUILD.gn
index a2bf02f3..651c88ed 100644
--- a/services/network/public/cpp/BUILD.gn
+++ b/services/network/public/cpp/BUILD.gn

@@ -80,6 +80,7 @@
     "source_stream_to_data_pipe.h",
     "weak_wrapper_shared_url_loader_factory.cc",
     "weak_wrapper_shared_url_loader_factory.h",
+    "web_sandbox_flags.h",
     "wrapper_shared_url_loader_factory.cc",
     "wrapper_shared_url_loader_factory.h",
   ]

diff --git a/services/network/public/cpp/web_sandbox_flags.h b/services/network/public/cpp/web_sandbox_flags.h
new file mode 100644
index 0000000..a1ed4bd
--- /dev/null
+++ b/services/network/public/cpp/web_sandbox_flags.h

@@ -0,0 +1,38 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef SERVICES_NETWORK_PUBLIC_CPP_WEB_SANDBOX_FLAGS_H_
+#define SERVICES_NETWORK_PUBLIC_CPP_WEB_SANDBOX_FLAGS_H_
+
+#include <cstdint>
+
+namespace network {
+namespace mojom {
+
+enum class WebSandboxFlags : int32_t;
+
+inline constexpr WebSandboxFlags operator&(WebSandboxFlags a,
+                                           WebSandboxFlags b) {
+  return static_cast<WebSandboxFlags>(static_cast<int>(a) &
+                                      static_cast<int>(b));
+}
+
+inline constexpr WebSandboxFlags operator|(WebSandboxFlags a,
+                                           WebSandboxFlags b) {
+  return static_cast<WebSandboxFlags>(static_cast<int>(a) |
+                                      static_cast<int>(b));
+}
+
+inline WebSandboxFlags& operator|=(WebSandboxFlags& a, WebSandboxFlags b) {
+  return a = a | b;
+}
+
+inline constexpr WebSandboxFlags operator~(WebSandboxFlags flags) {
+  return static_cast<WebSandboxFlags>(~static_cast<int>(flags));
+}
+
+}  // namespace mojom
+}  // namespace network
+
+#endif  // SERVICES_NETWORK_PUBLIC_CPP_SANDBOX_FLAGS_H_

diff --git a/services/network/public/mojom/BUILD.gn b/services/network/public/mojom/BUILD.gn
index 32ed125e..c99382c 100644
--- a/services/network/public/mojom/BUILD.gn
+++ b/services/network/public/mojom/BUILD.gn

@@ -321,6 +321,7 @@
     "url_loader_factory.mojom",
     "url_response_head.mojom",
     "web_client_hints_types.mojom",
+    "web_sandbox_flags.mojom",
   ]
 
   public_deps = [

diff --git a/services/network/public/mojom/web_sandbox_flags.mojom b/services/network/public/mojom/web_sandbox_flags.mojom
new file mode 100644
index 0000000..04d3d5b
--- /dev/null
+++ b/services/network/public/mojom/web_sandbox_flags.mojom

@@ -0,0 +1,49 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+module network.mojom;
+// Enum types for the sandbox attributes of the main resource.
+// TODO(https://crbug.com/1041376): Parse the flags in the network service.
+//
+// See content/browser/frame_host/sandbox_flags.md for more details about how
+// the web-layer components (i.e. //content and Blink) consume and apply these
+// flags.
+
+[Extensible]
+enum WebSandboxFlags {
+  kNone                                  =      0,
+
+  kNavigation                            =      1, // 1 << 0
+  kPlugins                               =      2, // 1 << 1
+  kOrigin                                =      4, // 1 << 2
+  kForms                                 =      8, // 1 << 3
+  kScripts                               =     16, // 1 << 4
+  kTopNavigation                         =     32, // 1 << 5
+
+  // See https://www.w3.org/Bugs/Public/show_bug.cgi?id=12393
+  kPopups                                =     64, // 1 << 6
+
+  kAutomaticFeatures                     =    128, // 1 << 7
+  kPointerLock                           =    256, // 1 << 8
+  kDocumentDomain                        =    512, // 1 << 9
+
+  // See https://w3c.github.io/screen-orientation/#dfn-sandboxed-orientation-lock-browsing-context-flag.
+  kOrientationLock                       =   1024, // 1 << 10
+
+  kPropagatesToAuxiliaryBrowsingContexts =   2048, // 1 << 11
+  kModals                                =   4096, // 1 << 12
+
+  // See https://w3c.github.io/presentation-api/#sandboxing-and-the-allow-presentation-keyword
+  kPresentationController                =   8192, // 1 << 13
+
+  // See https://github.com/WICG/interventions/issues/42.
+  kTopNavigationByUserActivation         =  16384, // 1 << 14
+
+  // See https://crbug.com/539938
+  kDownloads                             =  32768, // 1 << 15
+
+  kStorageAccessByUserActivation         =  65536, // 1 << 16
+
+  kAll                                   = -1, // Mask with all bits set.
+};

diff --git a/testing/buildbot/filters/fuchsia.accessibility_unittests.filter b/testing/buildbot/filters/fuchsia.accessibility_unittests.filter
index 8e66025..f7ff1eb 100644
--- a/testing/buildbot/filters/fuchsia.accessibility_unittests.filter
+++ b/testing/buildbot/filters/fuchsia.accessibility_unittests.filter

@@ -1,2 +1,5 @@
 # crbug.com/1067395
--AXPlatformNodeBaseTest.InnerTextIgnoresInvisibleAndIgnored
\ No newline at end of file
+-AXPlatformNodeBaseTest.InnerTextIgnoresInvisibleAndIgnored
+
+# crbug.com/1069808
+-AXPlatformNodeBaseTest.TestSelectedChildren*
\ No newline at end of file

diff --git a/testing/buildbot/filters/fuchsia.services_unittests.filter b/testing/buildbot/filters/fuchsia.services_unittests.filter
index 804aefc..85c0dff 100644
--- a/testing/buildbot/filters/fuchsia.services_unittests.filter
+++ b/testing/buildbot/filters/fuchsia.services_unittests.filter

@@ -29,8 +29,3 @@
 
 # https://crbug.com/986544 - Flakes with mismatched state expectations.
 -URLLoaderTest.ResourceSchedulerIntegration
-
-# https://crbug.com/989223 - connect()ed UDP socket's getsockname() is wrong.
--UDPSocketTest.TestReceiveMoreWithBufferSize
--UDPSocketTest.TestReadSend
--NetworkContextTest.CreateUDPSocket

diff --git a/testing/variations/fieldtrial_testing_config.json b/testing/variations/fieldtrial_testing_config.json
index 489bb34d..efa52878 100644
--- a/testing/variations/fieldtrial_testing_config.json
+++ b/testing/variations/fieldtrial_testing_config.json

@@ -3329,24 +3329,6 @@
             ]
         }
     ],
-    "MostLikelyDesktopDeprecation": [
-        {
-            "platforms": [
-                "chromeos",
-                "linux",
-                "mac",
-                "windows"
-            ],
-            "experiments": [
-                {
-                    "name": "Disabled",
-                    "disable_features": [
-                        "DisplaySuggestionsServiceTiles"
-                    ]
-                }
-            ]
-        }
-    ],
     "MyChromeEverywhere": [
         {
             "platforms": [

diff --git a/third_party/blink/common/DEPS b/third_party/blink/common/DEPS
index da11faf..34db6b0 100644
--- a/third_party/blink/common/DEPS
+++ b/third_party/blink/common/DEPS

@@ -13,6 +13,7 @@
     "+mojo",
     "+services/metrics/public/cpp",
     "+services/network/public/cpp",
+    "+services/network/public/mojom/web_sandbox_flags.mojom-shared.h",
     "+services/network/public/mojom/url_loader.mojom.h",
     "+services/network/public/mojom/url_loader_factory.mojom.h",
     "+services/network/public/mojom/url_response_head.mojom.h",

diff --git a/third_party/blink/common/feature_policy/feature_policy.cc b/third_party/blink/common/feature_policy/feature_policy.cc
index 0eb5e615..8ba466d 100644
--- a/third_party/blink/common/feature_policy/feature_policy.cc
+++ b/third_party/blink/common/feature_policy/feature_policy.cc

@@ -8,7 +8,7 @@
 #include "base/memory/ptr_util.h"
 #include "base/no_destructor.h"
 #include "base/stl_util.h"
-#include "third_party/blink/public/common/frame/sandbox_flags.h"
+#include "services/network/public/mojom/web_sandbox_flags.mojom-shared.h"
 #include "third_party/blink/public/mojom/feature_policy/feature_policy.mojom.h"
 
 namespace blink {
@@ -381,41 +381,42 @@
 
 // static
 mojom::FeaturePolicyFeature FeaturePolicy::FeatureForSandboxFlag(
-    mojom::WebSandboxFlags flag) {
+    network::mojom::WebSandboxFlags flag) {
   switch (flag) {
-    case mojom::WebSandboxFlags::kAll:
+    case network::mojom::WebSandboxFlags::kAll:
       NOTREACHED();
       break;
-    case mojom::WebSandboxFlags::kTopNavigation:
+    case network::mojom::WebSandboxFlags::kTopNavigation:
       return mojom::FeaturePolicyFeature::kTopNavigation;
-    case mojom::WebSandboxFlags::kForms:
+    case network::mojom::WebSandboxFlags::kForms:
       return mojom::FeaturePolicyFeature::kFormSubmission;
-    case mojom::WebSandboxFlags::kAutomaticFeatures:
-    case mojom::WebSandboxFlags::kScripts:
+    case network::mojom::WebSandboxFlags::kAutomaticFeatures:
+    case network::mojom::WebSandboxFlags::kScripts:
       return mojom::FeaturePolicyFeature::kScript;
-    case mojom::WebSandboxFlags::kPopups:
+    case network::mojom::WebSandboxFlags::kPopups:
       return mojom::FeaturePolicyFeature::kPopups;
-    case mojom::WebSandboxFlags::kPointerLock:
+    case network::mojom::WebSandboxFlags::kPointerLock:
       return mojom::FeaturePolicyFeature::kPointerLock;
-    case mojom::WebSandboxFlags::kOrientationLock:
+    case network::mojom::WebSandboxFlags::kOrientationLock:
       return mojom::FeaturePolicyFeature::kOrientationLock;
-    case mojom::WebSandboxFlags::kModals:
+    case network::mojom::WebSandboxFlags::kModals:
       return mojom::FeaturePolicyFeature::kModals;
-    case mojom::WebSandboxFlags::kPresentationController:
+    case network::mojom::WebSandboxFlags::kPresentationController:
       return mojom::FeaturePolicyFeature::kPresentation;
-    case mojom::WebSandboxFlags::kDownloads:
+    case network::mojom::WebSandboxFlags::kDownloads:
       return mojom::FeaturePolicyFeature::kDownloads;
     // Other flags fall through to the bitmask test below. They are named
     // specifically here so that authors introducing new flags must consider
     // this method when adding them.
-    case mojom::WebSandboxFlags::kDocumentDomain:
-    case mojom::WebSandboxFlags::kNavigation:
-    case mojom::WebSandboxFlags::kNone:
-    case mojom::WebSandboxFlags::kOrigin:
-    case mojom::WebSandboxFlags::kPlugins:
-    case mojom::WebSandboxFlags::kPropagatesToAuxiliaryBrowsingContexts:
-    case mojom::WebSandboxFlags::kTopNavigationByUserActivation:
-    case mojom::WebSandboxFlags::kStorageAccessByUserActivation:
+    case network::mojom::WebSandboxFlags::kDocumentDomain:
+    case network::mojom::WebSandboxFlags::kNavigation:
+    case network::mojom::WebSandboxFlags::kNone:
+    case network::mojom::WebSandboxFlags::kOrigin:
+    case network::mojom::WebSandboxFlags::kPlugins:
+    case network::mojom::WebSandboxFlags::
+        kPropagatesToAuxiliaryBrowsingContexts:
+    case network::mojom::WebSandboxFlags::kTopNavigationByUserActivation:
+    case network::mojom::WebSandboxFlags::kStorageAccessByUserActivation:
       break;
   }
   return mojom::FeaturePolicyFeature::kNotFound;

diff --git a/third_party/blink/common/feature_policy/feature_policy.typemap b/third_party/blink/common/feature_policy/feature_policy.typemap
index 46ec995..f3c1a87 100644
--- a/third_party/blink/common/feature_policy/feature_policy.typemap
+++ b/third_party/blink/common/feature_policy/feature_policy.typemap

@@ -6,11 +6,8 @@
 public_headers = [
   "//third_party/blink/public/common/feature_policy/feature_policy.h",
   "//third_party/blink/public/common/feature_policy/policy_value.h",
-  "//third_party/blink/public/common/frame/sandbox_flags.h",
 ]
 traits_headers = [
   "//third_party/blink/common/feature_policy/feature_policy_mojom_traits.h",
 ]
-type_mappings = [
-  "blink.mojom.ParsedFeaturePolicyDeclaration=::blink::ParsedFeaturePolicyDeclaration",
-]
+type_mappings = [ "blink.mojom.ParsedFeaturePolicyDeclaration=::blink::ParsedFeaturePolicyDeclaration" ]

diff --git a/third_party/blink/common/feature_policy/feature_policy_mojom_traits.h b/third_party/blink/common/feature_policy/feature_policy_mojom_traits.h
index 50a9f97..d3d2507 100644
--- a/third_party/blink/common/feature_policy/feature_policy_mojom_traits.h
+++ b/third_party/blink/common/feature_policy/feature_policy_mojom_traits.h

@@ -12,7 +12,6 @@
 #include "third_party/blink/common/feature_policy/policy_value_mojom_traits.h"
 #include "third_party/blink/public/common/common_export.h"
 #include "third_party/blink/public/common/feature_policy/feature_policy.h"
-#include "third_party/blink/public/common/frame/sandbox_flags.h"
 #include "third_party/blink/public/mojom/feature_policy/feature_policy.mojom-shared.h"
 #include "url/mojom/origin_mojom_traits.h"
 

diff --git a/third_party/blink/common/frame/frame_policy.cc b/third_party/blink/common/frame/frame_policy.cc
index 0165cfc..195d4ac 100644
--- a/third_party/blink/common/frame/frame_policy.cc
+++ b/third_party/blink/common/frame/frame_policy.cc

@@ -3,18 +3,19 @@
 // found in the LICENSE file.
 
 #include "third_party/blink/public/common/frame/frame_policy.h"
+#include "services/network/public/mojom/web_sandbox_flags.mojom-shared.h"
 
 namespace blink {
 
 FramePolicy::FramePolicy()
-    : sandbox_flags(mojom::WebSandboxFlags::kNone),
+    : sandbox_flags(network::mojom::WebSandboxFlags::kNone),
       container_policy({}),
       required_document_policy({}),
       allowed_to_download(true),
       disallow_document_access(false) {}
 
 FramePolicy::FramePolicy(
-    mojom::WebSandboxFlags sandbox_flags,
+    network::mojom::WebSandboxFlags sandbox_flags,
     const ParsedFeaturePolicy& container_policy,
     const DocumentPolicy::FeatureState& required_document_policy,
     bool allowed_to_download,

diff --git a/third_party/blink/common/frame/frame_policy.typemap b/third_party/blink/common/frame/frame_policy.typemap
index e6b5681..ef74948 100644
--- a/third_party/blink/common/frame/frame_policy.typemap
+++ b/third_party/blink/common/frame/frame_policy.typemap

@@ -6,7 +6,6 @@
 public_headers = [
   "//third_party/blink/public/common/frame/frame_policy.h",
   "//third_party/blink/public/common/feature_policy/policy_value.h",
-  "//third_party/blink/public/common/frame/sandbox_flags.h",
 ]
 traits_headers =
     [ "//third_party/blink/common/frame/frame_policy_mojom_traits.h" ]

diff --git a/third_party/blink/common/frame/frame_policy_mojom_traits.h b/third_party/blink/common/frame/frame_policy_mojom_traits.h
index b585f00b..59a3182 100644
--- a/third_party/blink/common/frame/frame_policy_mojom_traits.h
+++ b/third_party/blink/common/frame/frame_policy_mojom_traits.h

@@ -5,6 +5,7 @@
 #ifndef THIRD_PARTY_BLINK_COMMON_FRAME_FRAME_POLICY_MOJOM_TRAITS_H_
 #define THIRD_PARTY_BLINK_COMMON_FRAME_FRAME_POLICY_MOJOM_TRAITS_H_
 
+#include "services/network/public/mojom/web_sandbox_flags.mojom-shared.h"
 #include "third_party/blink/common/feature_policy/feature_policy_mojom_traits.h"
 #include "third_party/blink/public/common/frame/frame_policy.h"
 #include "third_party/blink/public/mojom/frame/frame_policy.mojom-shared.h"
@@ -28,7 +29,7 @@
     return frame_policy.container_policy;
   }
 
-  static blink::mojom::WebSandboxFlags sandbox_flags(
+  static network::mojom::WebSandboxFlags sandbox_flags(
       const blink::FramePolicy& frame_policy) {
     return frame_policy.sandbox_flags;
   }

diff --git a/third_party/blink/public/common/BUILD.gn b/third_party/blink/public/common/BUILD.gn
index 4d63da6..402f79f2 100644
--- a/third_party/blink/public/common/BUILD.gn
+++ b/third_party/blink/public/common/BUILD.gn

@@ -75,7 +75,6 @@
     "frame/frame_owner_element_type.h",
     "frame/frame_policy.h",
     "frame/from_ad_state.h",
-    "frame/sandbox_flags.h",
     "frame/user_activation_state.h",
     "frame/user_activation_update_source.h",
     "indexeddb/indexed_db_default_mojom_traits.h",
@@ -141,7 +140,6 @@
     "peerconnection/webrtc_ip_handling_policy.h",
     "permissions/permission_utils.h",
     "prerender/prerender_rel_type.h",
-    "presentation/presentation_receiver_flags.h",
     "privacy_budget/identifiability_metric_builder.h",
     "privacy_budget/identifiability_metrics.h",
     "privacy_budget/identifiable_surface.h",

diff --git a/third_party/blink/public/common/feature_policy/feature_policy.h b/third_party/blink/public/common/feature_policy/feature_policy.h
index 12bb4018..f47828b 100644
--- a/third_party/blink/public/common/feature_policy/feature_policy.h
+++ b/third_party/blink/public/common/feature_policy/feature_policy.h

@@ -13,6 +13,7 @@
 #include "base/containers/flat_set.h"
 #include "base/gtest_prod_util.h"
 #include "base/macros.h"
+#include "services/network/public/mojom/web_sandbox_flags.mojom-shared.h"
 #include "third_party/blink/public/common/common_export.h"
 #include "third_party/blink/public/common/feature_policy/policy_value.h"
 #include "third_party/blink/public/mojom/feature_policy/feature_policy.mojom-forward.h"
@@ -21,10 +22,6 @@
 
 namespace blink {
 
-namespace mojom {
-enum class WebSandboxFlags;
-}
-
 // Feature Policy is a mechanism for controlling the availability of web
 // platform features in a frame, including all embedded frames. It can be used
 // to remove features, automatically refuse API permission requests, or modify
@@ -258,7 +255,7 @@
   static const FeatureList& GetDefaultFeatureList();
 
   static mojom::FeaturePolicyFeature FeatureForSandboxFlag(
-      mojom::WebSandboxFlags flag);
+      network::mojom::WebSandboxFlags flag);
 
  private:
   friend class FeaturePolicyTest;

diff --git a/third_party/blink/public/common/frame/frame_policy.h b/third_party/blink/public/common/frame/frame_policy.h
index ccb7254..9b88064 100644
--- a/third_party/blink/public/common/frame/frame_policy.h
+++ b/third_party/blink/public/common/frame/frame_policy.h

@@ -5,9 +5,9 @@
 #ifndef THIRD_PARTY_BLINK_PUBLIC_COMMON_FRAME_FRAME_POLICY_H_
 #define THIRD_PARTY_BLINK_PUBLIC_COMMON_FRAME_FRAME_POLICY_H_
 
+#include "services/network/public/mojom/web_sandbox_flags.mojom-shared.h"
 #include "third_party/blink/public/common/feature_policy/document_policy.h"
 #include "third_party/blink/public/common/feature_policy/feature_policy.h"
-#include "third_party/blink/public/common/frame/sandbox_flags.h"
 
 namespace blink {
 
@@ -25,7 +25,7 @@
 // navigated.
 struct BLINK_COMMON_EXPORT FramePolicy {
   FramePolicy();
-  FramePolicy(mojom::WebSandboxFlags sandbox_flags,
+  FramePolicy(network::mojom::WebSandboxFlags sandbox_flags,
               const ParsedFeaturePolicy& container_policy,
               const DocumentPolicy::FeatureState& required_document_policy,
               bool allowed_to_download = true,
@@ -33,7 +33,7 @@
   FramePolicy(const FramePolicy& lhs);
   ~FramePolicy();
 
-  mojom::WebSandboxFlags sandbox_flags;
+  network::mojom::WebSandboxFlags sandbox_flags;
   ParsedFeaturePolicy container_policy;
   // |required_document_policy| is the combination of the following:
   // - iframe 'policy' attribute

diff --git a/third_party/blink/public/common/presentation/presentation_receiver_flags.h b/third_party/blink/public/common/presentation/presentation_receiver_flags.h
deleted file mode 100644
index b8b4f95..0000000
--- a/third_party/blink/public/common/presentation/presentation_receiver_flags.h
+++ /dev/null

@@ -1,47 +0,0 @@
-/*
- * Copyright (C) 2017 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef THIRD_PARTY_BLINK_PUBLIC_COMMON_PRESENTATION_PRESENTATION_RECEIVER_FLAGS_H_
-#define THIRD_PARTY_BLINK_PUBLIC_COMMON_PRESENTATION_PRESENTATION_RECEIVER_FLAGS_H_
-
-#include "third_party/blink/public/common/frame/sandbox_flags.h"
-
-namespace blink {
-
-// Disable popups, modals, and top-level navigation for presentation receivers.
-// See:
-// https://w3c.github.io/presentation-api/#creating-a-receiving-browsing-context
-constexpr mojom::WebSandboxFlags kPresentationReceiverSandboxFlags =
-    mojom::WebSandboxFlags::kPopups | mojom::WebSandboxFlags::kModals |
-    mojom::WebSandboxFlags::kTopNavigation;
-
-}  // namespace blink
-
-#endif  // THIRD_PARTY_BLINK_PUBLIC_COMMON_PRESENTATION_PRESENTATION_RECEIVER_FLAGS_H_

diff --git a/third_party/blink/public/mojom/feature_policy/feature_policy.mojom b/third_party/blink/public/mojom/feature_policy/feature_policy.mojom
index 576639a0..4d51e1e8 100644
--- a/third_party/blink/public/mojom/feature_policy/feature_policy.mojom
+++ b/third_party/blink/public/mojom/feature_policy/feature_policy.mojom

@@ -8,38 +8,6 @@
 import "third_party/blink/public/mojom/feature_policy/feature_policy_feature.mojom";
 import "third_party/blink/public/mojom/feature_policy/policy_value.mojom";
 
-// See http://www.whatwg.org/specs/web-apps/current-work/#attr-iframe-sandbox
-// for a list of the sandbox flags.
-[Extensible]
-enum WebSandboxFlags {
-  kNone                                  =     0,
-  kNavigation                            =     1, // 1 << 0
-  kPlugins                               =     2, // 1 << 1
-  kOrigin                                =     4, // 1 << 2
-  kForms                                 =     8, // 1 << 3
-  kScripts                               =    16, // 1 << 4
-  kTopNavigation                         =    32, // 1 << 5
-  // See https://www.w3.org/Bugs/Public/show_bug.cgi?id=12393
-  kPopups                                =    64, // 1 << 6
-  kAutomaticFeatures                     =   128, // 1 << 7
-  kPointerLock                           =   256, // 1 << 8
-  // See
-  // https://w3c.github.io/screen-orientation/#dfn-sandboxed-orientation-lock-browsing-context-flag.
-  kDocumentDomain                        =   512, // 1 << 9
-  kOrientationLock                       =  1024, // 1 << 10
-  kPropagatesToAuxiliaryBrowsingContexts =  2048, // 1 << 11
-  kModals                                =  4096, // 1 << 12
-  // See
-  // https://w3c.github.io/presentation-api/#sandboxing-and-the-allow-presentation-keyword
-  kPresentationController                =  8192, // 1 << 13
-  // See https://github.com/WICG/interventions/issues/42.
-  kTopNavigationByUserActivation         = 16384, // 1 << 14
-  // See https://crbug.com/539938
-  kDownloads                             = 32768, // 1 << 15
-  kStorageAccessByUserActivation         = 65536, // 1 << 16
-  kAll                                   =    -1, // Masks all bits set to 1.
-};
-
 // This struct holds feature policy allowlist data that needs to be replicated
 // between a RenderFrame and any of its associated RenderFrameProxies. A list of
 // these form a ParsedFeaturePolicy.

diff --git a/third_party/blink/public/mojom/frame/frame.mojom b/third_party/blink/public/mojom/frame/frame.mojom
index 4419927..483ffbd 100644
--- a/third_party/blink/public/mojom/frame/frame.mojom
+++ b/third_party/blink/public/mojom/frame/frame.mojom

@@ -12,6 +12,7 @@
 import "services/data_decoder/public/mojom/resource_snapshot_for_web_bundle.mojom";
 import "services/network/public/mojom/content_security_policy.mojom";
 import "services/network/public/mojom/fetch_api.mojom";
+import "services/network/public/mojom/web_sandbox_flags.mojom";
 import "skia/public/mojom/skcolor.mojom";
 import "third_party/blink/public/mojom/ad_tagging/ad_frame.mojom";
 import "third_party/blink/public/mojom/devtools/console_message.mojom";
@@ -607,7 +608,7 @@
 
   // Used to replicate the updated sandbox flags and feature policy headers to
   // all corresponding remote frames of a local frame when a navigation commits.
-  DidSetFramePolicyHeaders(blink.mojom.WebSandboxFlags sandbox_flags,
+  DidSetFramePolicyHeaders(network.mojom.WebSandboxFlags sandbox_flags,
       array<blink.mojom.ParsedFeaturePolicyDeclaration> parsed_feature_policy);
 
   // Notifies the frame that its parent has changed the frame's sandbox flags or

diff --git a/third_party/blink/public/mojom/frame/frame_policy.mojom b/third_party/blink/public/mojom/frame/frame_policy.mojom
index 1f510af6..9894c56 100644
--- a/third_party/blink/public/mojom/frame/frame_policy.mojom
+++ b/third_party/blink/public/mojom/frame/frame_policy.mojom

@@ -4,6 +4,7 @@
 
 module blink.mojom;
 
+import "services/network/public/mojom/web_sandbox_flags.mojom";
 import "third_party/blink/public/mojom/feature_policy/feature_policy.mojom";
 import "third_party/blink/public/mojom/feature_policy/document_policy_feature.mojom";
 import "third_party/blink/public/mojom/feature_policy/feature_policy_feature.mojom";
@@ -14,7 +15,7 @@
 // member of CommitNavigationParams. For details, please refer to
 // navigation_params.mojom.
 struct FramePolicy {
-  blink.mojom.WebSandboxFlags sandbox_flags;
+  network.mojom.WebSandboxFlags sandbox_flags;
   array<blink.mojom.ParsedFeaturePolicyDeclaration> container_policy;
   map<blink.mojom.DocumentPolicyFeature, blink.mojom.PolicyValue> required_document_policy;
   bool allowed_to_download = true;

diff --git a/third_party/blink/public/platform/web_url_request.h b/third_party/blink/public/platform/web_url_request.h
index d8642ae..2a80275 100644
--- a/third_party/blink/public/platform/web_url_request.h
+++ b/third_party/blink/public/platform/web_url_request.h

@@ -115,15 +115,10 @@
     kOfflinePageOn = 1 << 8,
     kLitePageRedirectOn = 1 << 9,  // Allow the browser to redirect the resource
                                    // to a Lite Page server.
-    kLazyImageLoadDeferred = 1 << 10,  // Request the placeholder version of an
-                                       // image that was deferred by lazyload.
-    kLazyImageAutoReload = 1 << 11,    // Request the full version of an image
-                                       // that was previously fetched as a
-                                       // placeholder by lazyload.
-    kDeferAllScriptOn = 1 << 12,  // Request that script execution be deferred
-                                  // until parsing completes.
+    kDeferAllScriptOn = 1 << 10,   // Request that script execution be deferred
+                                   // until parsing completes.
     kSubresourceRedirectOn =
-        1 << 13,  // Allow the subresources in the page to be redirected
+        1 << 11,  // Allow the subresources in the page to be redirected
                   // to serve better optimized resources.
     kPreviewsStateLast = kSubresourceRedirectOn
   };

diff --git a/third_party/blink/public/web/DEPS b/third_party/blink/public/web/DEPS
index 99d893d2..37dde92 100644
--- a/third_party/blink/public/web/DEPS
+++ b/third_party/blink/public/web/DEPS

@@ -27,6 +27,9 @@
     "+mojo/public",
     "+net/cookies/site_for_cookies.h",
     "+services/metrics/public/cpp/ukm_source_id.h",
+    "+services/network/public/cpp/web_sandbox_flags.h",
+    "+services/network/public/mojom/web_sandbox_flags.mojom-shared.h",
+    "+services/network/public/mojom/web_sandbox_flags.mojom-blink-forward.h",
     "+services/network/public/mojom/content_security_policy.mojom-shared.h",
     "+services/network/public/mojom/cors.mojom-shared.h",
     "+services/network/public/mojom/cors_origin_pattern.mojom-shared.h",

diff --git a/third_party/blink/public/web/web_frame.h b/third_party/blink/public/web/web_frame.h
index 14a2f0b..405796fe 100644
--- a/third_party/blink/public/web/web_frame.h
+++ b/third_party/blink/public/web/web_frame.h

@@ -49,9 +49,6 @@
 class WebRemoteFrame;
 class WebSecurityOrigin;
 class WebView;
-namespace mojom {
-enum class WebSandboxFlags;
-}
 
 // Frames may be rendered in process ('local') or out of process ('remote').
 // A remote frame is always cross-site; a local frame may be either same-site or

diff --git a/third_party/blink/public/web/web_local_frame.h b/third_party/blink/public/web/web_local_frame.h
index 0b15441..8a545fca 100644
--- a/third_party/blink/public/web/web_local_frame.h
+++ b/third_party/blink/public/web/web_local_frame.h

@@ -13,9 +13,9 @@
 #include "base/optional.h"
 #include "base/unguessable_token.h"
 #include "services/network/public/mojom/fetch_api.mojom-shared.h"
+#include "services/network/public/mojom/web_sandbox_flags.mojom-shared.h"
 #include "third_party/blink/public/common/css/page_size_type.h"
 #include "third_party/blink/public/common/feature_policy/feature_policy.h"
-#include "third_party/blink/public/common/frame/sandbox_flags.h"
 #include "third_party/blink/public/common/frame/user_activation_update_source.h"
 #include "third_party/blink/public/common/messaging/transferable_message.h"
 #include "third_party/blink/public/mojom/ad_tagging/ad_frame.mojom-shared.h"
@@ -95,7 +95,7 @@
       blink::InterfaceRegistry*,
       WebFrame* opener = nullptr,
       const WebString& name = WebString(),
-      mojom::WebSandboxFlags = mojom::WebSandboxFlags::kNone,
+      network::mojom::WebSandboxFlags = network::mojom::WebSandboxFlags::kNone,
       const FeaturePolicy::FeatureState& opener_feature_state =
           FeaturePolicy::FeatureState());
 
@@ -527,7 +527,8 @@
   // where the notion of FrameReplicationState is relevant to.
   // Returns the effective sandbox flags which are inherited from their parent
   // frame.
-  virtual mojom::WebSandboxFlags EffectiveSandboxFlagsForTesting() const = 0;
+  virtual network::mojom::WebSandboxFlags EffectiveSandboxFlagsForTesting()
+      const = 0;
 
   // Returns false if this frame, or any parent frame is sandboxed and does not
   // have the flag "allow-downloads" set.

diff --git a/third_party/blink/public/web/web_local_frame_client.h b/third_party/blink/public/web/web_local_frame_client.h
index d11faf48..4bb3e8c 100644
--- a/third_party/blink/public/web/web_local_frame_client.h
+++ b/third_party/blink/public/web/web_local_frame_client.h

@@ -37,9 +37,9 @@
 #include "base/optional.h"
 #include "base/unguessable_token.h"
 #include "mojo/public/cpp/bindings/scoped_interface_endpoint_handle.h"
+#include "services/network/public/mojom/web_sandbox_flags.mojom-shared.h"
 #include "third_party/blink/public/common/feature_policy/feature_policy.h"
 #include "third_party/blink/public/common/frame/frame_owner_element_type.h"
-#include "third_party/blink/public/common/frame/sandbox_flags.h"
 #include "third_party/blink/public/common/loader/loading_behavior_flag.h"
 #include "third_party/blink/public/common/loader/url_loader_factory_bundle.h"
 #include "third_party/blink/public/common/navigation/triggering_event_info.h"
@@ -260,7 +260,7 @@
   // HTTP header (for sandbox flags) is encountered while loading the frame's
   // document.
   virtual void DidSetFramePolicyHeaders(
-      mojom::WebSandboxFlags flags,
+      network::mojom::WebSandboxFlags flags,
       const ParsedFeaturePolicy& feature_policy_header,
       const DocumentPolicy::FeatureState& document_policy_header) {}
 

diff --git a/third_party/blink/public/web/web_navigation_params.h b/third_party/blink/public/web/web_navigation_params.h
index 9c9d6d2b..2097c74 100644
--- a/third_party/blink/public/web/web_navigation_params.h
+++ b/third_party/blink/public/web/web_navigation_params.h

@@ -88,8 +88,8 @@
   bool is_client_redirect = false;
 
   // Whether the navigation initiator frame has the
-  // |mojom::blink::WebSandboxFlags::kDownloads| bit set in its sandbox flags
-  // set.
+  // |network::mojom::blink::WebSandboxFlags::kDownloads| bit set in its sandbox
+  // flags set.
   bool initiator_frame_has_download_sandbox_flag = false;
 
   // Whether the navigation initiator frame is an ad frame.

diff --git a/third_party/blink/public/web/web_remote_frame.h b/third_party/blink/public/web/web_remote_frame.h
index c684e48..b54ec89f1 100644
--- a/third_party/blink/public/web/web_remote_frame.h
+++ b/third_party/blink/public/web/web_remote_frame.h

@@ -8,7 +8,6 @@
 #include "services/network/public/mojom/content_security_policy.mojom-shared.h"
 #include "third_party/blink/public/common/feature_policy/feature_policy.h"
 #include "third_party/blink/public/common/frame/frame_owner_element_type.h"
-#include "third_party/blink/public/common/frame/sandbox_flags.h"
 #include "third_party/blink/public/mojom/ad_tagging/ad_frame.mojom-shared.h"
 #include "third_party/blink/public/mojom/frame/user_activation_update_types.mojom-shared.h"
 #include "third_party/blink/public/mojom/security_context/insecure_request_policy.mojom-shared.h"
@@ -96,7 +95,7 @@
       bool is_potentially_trustworthy_opaque_origin) = 0;
 
   // Set sandbox flags replicated from another process.
-  virtual void SetReplicatedSandboxFlags(mojom::WebSandboxFlags) = 0;
+  virtual void SetReplicatedSandboxFlags(network::mojom::WebSandboxFlags) = 0;
 
   // Set frame |name| replicated from another process.
   virtual void SetReplicatedName(const WebString&) = 0;

diff --git a/third_party/blink/public/web/web_view_client.h b/third_party/blink/public/web/web_view_client.h
index 2e572f27..7fbb17df 100644
--- a/third_party/blink/public/web/web_view_client.h
+++ b/third_party/blink/public/web/web_view_client.h

@@ -32,6 +32,7 @@
 #define THIRD_PARTY_BLINK_PUBLIC_WEB_WEB_VIEW_CLIENT_H_
 
 #include "base/strings/string_piece.h"
+#include "services/network/public/mojom/web_sandbox_flags.mojom-shared.h"
 #include "third_party/blink/public/common/dom_storage/session_storage_namespace_id.h"
 #include "third_party/blink/public/common/feature_policy/feature_policy.h"
 #include "third_party/blink/public/platform/web_string.h"
@@ -45,9 +46,6 @@
 class WebURL;
 class WebURLRequest;
 class WebView;
-namespace mojom {
-enum class WebSandboxFlags;
-}
 struct WebRect;
 struct WebSize;
 struct WebTextAutosizerPageInfo;
@@ -71,7 +69,7 @@
       const WebWindowFeatures& features,
       const WebString& name,
       WebNavigationPolicy policy,
-      mojom::WebSandboxFlags,
+      network::mojom::WebSandboxFlags,
       const FeaturePolicy::FeatureState&,
       const SessionStorageNamespaceId& session_storage_namespace_id) {
     return nullptr;

diff --git a/third_party/blink/renderer/bindings/core/v8/isolated_world_csp.cc b/third_party/blink/renderer/bindings/core/v8/isolated_world_csp.cc
index 0948f87a..1c7307b 100644
--- a/third_party/blink/renderer/bindings/core/v8/isolated_world_csp.cc
+++ b/third_party/blink/renderer/bindings/core/v8/isolated_world_csp.cc

@@ -70,7 +70,7 @@
   // These directives depend on ExecutionContext for their implementation and
   // since isolated worlds don't have their own ExecutionContext, these are not
   // supported.
-  void SetSandboxFlags(SandboxFlags) override {}
+  void SetSandboxFlags(network::mojom::blink::WebSandboxFlags) override {}
   void SetRequireTrustedTypes() override {}
   void AddInsecureRequestPolicy(mojom::blink::InsecureRequestPolicy) override {}
 

diff --git a/third_party/blink/renderer/bindings/generated_in_core.gni b/third_party/blink/renderer/bindings/generated_in_core.gni
index e4dffec..cfd767b 100644
--- a/third_party/blink/renderer/bindings/generated_in_core.gni
+++ b/third_party/blink/renderer/bindings/generated_in_core.gni

@@ -344,6 +344,8 @@
   "$root_gen_dir/third_party/blink/renderer/bindings/core/v8/v8_error_event.h",
   "$root_gen_dir/third_party/blink/renderer/bindings/core/v8/v8_event.cc",
   "$root_gen_dir/third_party/blink/renderer/bindings/core/v8/v8_event.h",
+  "$root_gen_dir/third_party/blink/renderer/bindings/core/v8/v8_event_counts.cc",
+  "$root_gen_dir/third_party/blink/renderer/bindings/core/v8/v8_event_counts.h",
   "$root_gen_dir/third_party/blink/renderer/bindings/core/v8/v8_event_target.cc",
   "$root_gen_dir/third_party/blink/renderer/bindings/core/v8/v8_event_target.h",
   "$root_gen_dir/third_party/blink/renderer/bindings/core/v8/v8_external.cc",
@@ -558,6 +560,8 @@
   "$root_gen_dir/third_party/blink/renderer/bindings/core/v8/v8_intervention_report_body.h",
   "$root_gen_dir/third_party/blink/renderer/bindings/core/v8/v8_intrinsic_sizes.cc",
   "$root_gen_dir/third_party/blink/renderer/bindings/core/v8/v8_intrinsic_sizes.h",
+  "$root_gen_dir/third_party/blink/renderer/bindings/core/v8/v8_is_input_pending_options.cc",
+  "$root_gen_dir/third_party/blink/renderer/bindings/core/v8/v8_is_input_pending_options.h",
   "$root_gen_dir/third_party/blink/renderer/bindings/core/v8/v8_iterator.cc",
   "$root_gen_dir/third_party/blink/renderer/bindings/core/v8/v8_iterator.h",
   "$root_gen_dir/third_party/blink/renderer/bindings/core/v8/v8_keyboard_event.cc",

diff --git a/third_party/blink/renderer/bindings/scripts/bind_gen/codegen_context.py b/third_party/blink/renderer/bindings/scripts/bind_gen/codegen_context.py
index 7ef1ef1..a19105a 100644
--- a/third_party/blink/renderer/bindings/scripts/bind_gen/codegen_context.py
+++ b/third_party/blink/renderer/bindings/scripts/bind_gen/codegen_context.py

@@ -331,4 +331,4 @@
             identifier=web_idl.Identifier("toString"),
             extended_attributes=extended_attributes,
             owner=stringifier.owner,
-            debug_info=stringifier.debug_info)
+            debug_info=stringifier.operation.debug_info)

diff --git a/third_party/blink/renderer/bindings/scripts/bind_gen/interface.py b/third_party/blink/renderer/bindings/scripts/bind_gen/interface.py
index a0722f6..ea52e71 100644
--- a/third_party/blink/renderer/bindings/scripts/bind_gen/interface.py
+++ b/third_party/blink/renderer/bindings/scripts/bind_gen/interface.py

@@ -384,6 +384,13 @@
             S("v8_receiver",
               "v8::Local<v8::Object> ${v8_receiver} = ${info}.Holder();"))
 
+    # throw_security_error
+    template_vars["throw_security_error"] = T(
+        "BindingSecurity::FailedAccessCheckFor("
+        "${info}.GetIsolate(), "
+        "${class_name}::GetWrapperTypeInfo(), "
+        "${info}.Holder());")
+
     code_node.register_code_symbols(local_vars)
     code_node.add_template_vars(template_vars)
 
@@ -2317,7 +2324,8 @@
 uint32_t length = ${blink_receiver}->length();
 v8::Local<v8::Array> array =
     bindings::EnumerateIndexedProperties(${isolate}, length);
-bindings::V8SetReturnValue(${info}, array);"""),
+bindings::V8SetReturnValue(${info}, array);\
+"""),
     ])
 
     return func_decl, func_def
@@ -3032,7 +3040,180 @@
     return func_def
 
 
-def make_cross_origin_property_getter_callback(cg_context, function_name):
+def make_cross_origin_indexed_getter_callback(cg_context, function_name):
+    assert isinstance(cg_context, CodeGenContext)
+    assert isinstance(function_name, str)
+
+    func_def = CxxFuncDefNode(
+        name=function_name,
+        arg_decls=[
+            "uint32_t index",
+            "const v8::PropertyCallbackInfo<v8::Value>& info",
+        ],
+        return_type="void")
+    func_def.set_base_template_vars(cg_context.template_bindings())
+    body = func_def.body
+    body.add_template_var("index", "index")
+    body.add_template_var("info", "info")
+    bind_callback_local_vars(body, cg_context)
+
+    props = cg_context.interface.indexed_and_named_properties
+    if not (props and props.indexed_getter):
+        body.append(TextNode("${throw_security_error}"))
+        return func_def
+
+    body.append(
+        TextNode("""\
+if (${index} >= ${blink_receiver}->length()) {
+  ${throw_security_error}
+  return;
+}
+
+${class_name}::IndexedPropertyGetterCallback(${index}, ${info});\
+"""))
+
+    return func_def
+
+
+def make_cross_origin_indexed_setter_callback(cg_context, function_name):
+    assert isinstance(cg_context, CodeGenContext)
+    assert isinstance(function_name, str)
+
+    func_def = CxxFuncDefNode(
+        name=function_name,
+        arg_decls=[
+            "uint32_t index",
+            "v8::Local<v8::Value> v8_property_value",
+            "const v8::PropertyCallbackInfo<v8::Value>& info",
+        ],
+        return_type="void")
+    func_def.set_base_template_vars(cg_context.template_bindings())
+    body = func_def.body
+    body.add_template_var("index", "index")
+    body.add_template_var("v8_property_value", "v8_property_value")
+    body.add_template_var("info", "info")
+    bind_callback_local_vars(body, cg_context)
+
+    body.append(TextNode("${throw_security_error}"))
+
+    return func_def
+
+
+def make_cross_origin_indexed_deleter_callback(cg_context, function_name):
+    assert isinstance(cg_context, CodeGenContext)
+    assert isinstance(function_name, str)
+
+    func_def = CxxFuncDefNode(
+        name=function_name,
+        arg_decls=[
+            "uint32_t index",
+            "const v8::PropertyCallbackInfo<v8::Boolean>& info",
+        ],
+        return_type="void")
+    func_def.set_base_template_vars(cg_context.template_bindings())
+    body = func_def.body
+    body.add_template_var("index", "index")
+    body.add_template_var("info", "info")
+    bind_callback_local_vars(body, cg_context)
+
+    body.append(TextNode("${throw_security_error}"))
+
+    return func_def
+
+
+def make_cross_origin_indexed_definer_callback(cg_context, function_name):
+    assert isinstance(cg_context, CodeGenContext)
+    assert isinstance(function_name, str)
+
+    func_def = CxxFuncDefNode(
+        name=function_name,
+        arg_decls=[
+            "uint32_t index",
+            "const v8::PropertyDescriptor& v8_property_desc",
+            "const v8::PropertyCallbackInfo<v8::Value>& info",
+        ],
+        return_type="void")
+    func_def.set_base_template_vars(cg_context.template_bindings())
+    body = func_def.body
+    body.add_template_var("index", "index")
+    body.add_template_var("v8_property_desc", "v8_property_desc")
+    body.add_template_var("info", "info")
+    bind_callback_local_vars(body, cg_context)
+
+    body.append(TextNode("${throw_security_error}"))
+
+    return func_def
+
+
+def make_cross_origin_indexed_descriptor_callback(cg_context, function_name):
+    assert isinstance(cg_context, CodeGenContext)
+    assert isinstance(function_name, str)
+
+    func_def = CxxFuncDefNode(
+        name=function_name,
+        arg_decls=[
+            "uint32_t index",
+            "const v8::PropertyCallbackInfo<v8::Value>& info",
+        ],
+        return_type="void")
+    func_def.set_base_template_vars(cg_context.template_bindings())
+    body = func_def.body
+    body.add_template_var("index", "index")
+    body.add_template_var("info", "info")
+    bind_callback_local_vars(body, cg_context)
+
+    props = cg_context.interface.indexed_and_named_properties
+    if not (props and props.indexed_getter):
+        body.append(TextNode("${throw_security_error}"))
+        return func_def
+
+    body.append(
+        TextNode("""\
+CrossOriginIndexedGetterCallback(${index}, ${info});
+v8::Local<v8::Value> v8_value = ${info}.GetReturnValue().Get();
+if (v8_value->IsUndefined()) {
+  // Must have already thrown a SecurityError.
+  return;
+}
+
+v8::PropertyDescriptor desc(v8_value, /*writable=*/false);
+desc.set_enumerable(true);
+desc.set_configurable(true);
+bindings::V8SetReturnValue(${info}, desc);\
+"""))
+
+    return func_def
+
+
+def make_cross_origin_indexed_enumerator_callback(cg_context, function_name):
+    assert isinstance(cg_context, CodeGenContext)
+    assert isinstance(function_name, str)
+
+    func_def = CxxFuncDefNode(
+        name=function_name,
+        arg_decls=["const v8::PropertyCallbackInfo<v8::Array>& info"],
+        return_type="void")
+    func_def.set_base_template_vars(cg_context.template_bindings())
+    body = func_def.body
+    body.add_template_var("info", "info")
+    bind_callback_local_vars(body, cg_context)
+
+    props = cg_context.interface.indexed_and_named_properties
+    if not (props and props.indexed_getter):
+        return func_def
+
+    body.append(
+        TextNode("""\
+uint32_t length = ${blink_receiver}->length();
+v8::Local<v8::Array> array =
+    bindings::EnumerateIndexedProperties(${isolate}, length);
+bindings::V8SetReturnValue(${info}, array);\
+"""))
+
+    return func_def
+
+
+def make_cross_origin_named_getter_callback(cg_context, function_name):
     assert isinstance(cg_context, CodeGenContext)
     assert isinstance(function_name, str)
 
@@ -3056,13 +3237,11 @@
   if (${blink_property_name} != attribute.name)
     continue;
   if (UNLIKELY(!attribute.get_value)) {
-    BindingSecurity::FailedAccessCheckFor(
-        ${info}.GetIsolate(),
-        ${class_name}::GetWrapperTypeInfo(),
-        ${info}.This());
+    ${throw_security_error}
     return;
   }
-  return attribute.get_value(${v8_property_name}, ${info});
+  attribute.get_value(${v8_property_name}, ${info});
+  return;
 }
 for (const auto& operation : kCrossOriginOperationTable) {
   if (${blink_property_name} != operation.name)
@@ -3100,16 +3279,14 @@
         ${info}.GetIsolate(), ${v8_property_name})) {
   return ${info}.GetReturnValue().SetUndefined();
 }
-BindingSecurity::FailedAccessCheckFor(
-    ${info}.GetIsolate(),
-    ${class_name}::GetWrapperTypeInfo(),
-    ${info}.This());"""),
+${throw_security_error}\
+"""),
     ])
 
     return func_def
 
 
-def make_cross_origin_property_setter_callback(cg_context, function_name):
+def make_cross_origin_named_setter_callback(cg_context, function_name):
     assert isinstance(cg_context, CodeGenContext)
     assert isinstance(function_name, str)
 
@@ -3133,8 +3310,8 @@
         TextNode("""\
 for (const auto& attribute : kCrossOriginAttributeTable) {
   if (${blink_property_name} == attribute.name && attribute.set_value) {
-    return attribute.set_value(
-        ${v8_property_name}, ${v8_property_value}, ${info});
+    attribute.set_value(${v8_property_name}, ${v8_property_value}, ${info});
+    return;
   }
 }"""))
 
@@ -3144,17 +3321,59 @@
         CxxLikelyIfNode(
             cond="${v8_property_name}->IsString()", body=string_case_body),
         EmptyNode(),
-        TextNode("""\
-BindingSecurity::FailedAccessCheckFor(
-    ${info}.GetIsolate(),
-    ${class_name}::GetWrapperTypeInfo(),
-    ${info}.This());"""),
+        TextNode("${throw_security_error}"),
     ])
 
     return func_def
 
 
-def make_cross_origin_property_descriptor_callback(cg_context, function_name):
+def make_cross_origin_named_deleter_callback(cg_context, function_name):
+    assert isinstance(cg_context, CodeGenContext)
+    assert isinstance(function_name, str)
+
+    func_def = CxxFuncDefNode(
+        name=function_name,
+        arg_decls=[
+            "v8::Local<v8::Name> v8_property_name",
+            "const v8::PropertyCallbackInfo<v8::Boolean>& info",
+        ],
+        return_type="void")
+    func_def.set_base_template_vars(cg_context.template_bindings())
+    body = func_def.body
+    body.add_template_var("v8_property_name", "v8_property_name")
+    body.add_template_var("info", "info")
+    bind_callback_local_vars(body, cg_context)
+
+    body.append(TextNode("${throw_security_error}"))
+
+    return func_def
+
+
+def make_cross_origin_named_definer_callback(cg_context, function_name):
+    assert isinstance(cg_context, CodeGenContext)
+    assert isinstance(function_name, str)
+
+    func_def = CxxFuncDefNode(
+        name=function_name,
+        arg_decls=[
+            "v8::Local<v8::Name> v8_property_name",
+            "const v8::PropertyDescriptor& v8_property_desc",
+            "const v8::PropertyCallbackInfo<v8::Value>& info",
+        ],
+        return_type="void")
+    func_def.set_base_template_vars(cg_context.template_bindings())
+    body = func_def.body
+    body.add_template_var("v8_property_name", "v8_property_name")
+    body.add_template_var("v8_property_desc", "v8_property_desc")
+    body.add_template_var("info", "info")
+    bind_callback_local_vars(body, cg_context)
+
+    body.append(TextNode("${throw_security_error}"))
+
+    return func_def
+
+
+def make_cross_origin_named_descriptor_callback(cg_context, function_name):
     assert isinstance(cg_context, CodeGenContext)
     assert isinstance(function_name, str)
 
@@ -3194,6 +3413,7 @@
   v8::PropertyDescriptor desc(get, set);
   desc.set_enumerable(false);
   desc.set_configurable(true);
+  bindings::V8SetReturnValue(${info}, desc);
   return;
 }
 for (const auto& operation : kCrossOriginOperationTable) {
@@ -3245,16 +3465,71 @@
   bindings::V8SetReturnValue(${info}, desc);
   return;
 }
-BindingSecurity::FailedAccessCheckFor(
-    ${info}.GetIsolate(),
-    ${class_name}::GetWrapperTypeInfo(),
-    ${info}.This());"""),
+${throw_security_error}\
+"""),
     ])
 
     return func_def
 
 
-def make_cross_origin_property_enumerator_callback(cg_context, function_name):
+def make_cross_origin_named_query_callback(cg_context, function_name):
+    assert isinstance(cg_context, CodeGenContext)
+    assert isinstance(function_name, str)
+
+    func_def = CxxFuncDefNode(
+        name=function_name,
+        arg_decls=[
+            "v8::Local<v8::Name> v8_property_name",
+            "const v8::PropertyCallbackInfo<v8::Integer>& info",
+        ],
+        return_type="void")
+    func_def.set_base_template_vars(cg_context.template_bindings())
+    body = func_def.body
+    body.add_template_var("v8_property_name", "v8_property_name")
+    body.add_template_var("info", "info")
+    bind_callback_local_vars(body, cg_context)
+
+    string_case_body = []
+    string_case_body.append(
+        TextNode("""\
+// 7.2.3.4 CrossOriginGetOwnPropertyHelper ( O, P )
+// https://html.spec.whatwg.org/C/#crossorigingetownpropertyhelper-(-o,-p-)
+for (const auto& attribute : kCrossOriginAttributeTable) {
+  if (${blink_property_name} != attribute.name)
+    continue;
+  int32_t v8_property_attribute = v8::DontEnum;
+  if (!attribute.set_callback)
+    v8_property_attribute |= v8::ReadOnly;
+  bindings::V8SetReturnValue(${info}, v8_property_attribute);
+  return;
+}
+for (const auto& operation : kCrossOriginOperationTable) {
+  if (${blink_property_name} != operation.name)
+    continue;
+  int32_t v8_property_attribute = v8::DontEnum | v8::ReadOnly;
+  bindings::V8SetReturnValue(${info}, v8_property_attribute);
+  return;
+}"""))
+
+    body.extend([
+        CxxLikelyIfNode(
+            cond="${v8_property_name}->IsString()", body=string_case_body),
+        EmptyNode(),
+        TextNode("""\
+// 7.2.3.2 CrossOriginPropertyFallback ( P )
+// https://html.spec.whatwg.org/C/#crossoriginpropertyfallback-(-p-)
+if (bindings::IsSupportedInCrossOriginPropertyFallback(
+        ${info}.GetIsolate(), ${v8_property_name})) {
+  int32_t v8_property_attribute = v8::DontEnum | v8::ReadOnly;
+  bindings::V8SetReturnValue(${info}, v8_property_attribute);
+  return;
+}"""),
+    ])
+
+    return func_def
+
+
+def make_cross_origin_named_enumerator_callback(cg_context, function_name):
     assert isinstance(cg_context, CodeGenContext)
     assert isinstance(function_name, str)
 
@@ -3274,7 +3549,8 @@
     bindings::EnumerateCrossOriginProperties(
         ${isolate},
         kCrossOriginAttributeTable,
-        kCrossOriginOperationTable));"""))
+        kCrossOriginOperationTable));\
+"""))
 
     return func_def
 
@@ -4659,7 +4935,7 @@
             get_value = callback_function_name(cgc, for_cross_origin=True)
             func_def = make_attribute_get_callback_def(cgc, get_value)
             callback_defs.extend([func_def, EmptyNode()])
-        if (not values or "Setter" in values) and entry.attr_set_callback_name:
+        if values and "Setter" in values:
             set_func = entry.attr_set_callback_name
             cgc = cg_context.make_copy(
                 attribute=attribute,
@@ -4718,17 +4994,44 @@
         make_cross_origin_access_check_callback(
             cg_context, "CrossOriginAccessCheckCallback"),
         EmptyNode(),
-        make_cross_origin_property_getter_callback(
-            cg_context, "CrossOriginPropertyGetterCallback"),
+        make_cross_origin_indexed_getter_callback(
+            cg_context, "CrossOriginIndexedGetterCallback"),
         EmptyNode(),
-        make_cross_origin_property_setter_callback(
-            cg_context, "CrossOriginPropertySetterCallback"),
+        make_cross_origin_indexed_setter_callback(
+            cg_context, "CrossOriginIndexedSetterCallback"),
         EmptyNode(),
-        make_cross_origin_property_descriptor_callback(
-            cg_context, "CrossOriginPropertyDescriptorCallback"),
+        make_cross_origin_indexed_deleter_callback(
+            cg_context, "CrossOriginIndexedDeleterCallback"),
         EmptyNode(),
-        make_cross_origin_property_enumerator_callback(
-            cg_context, "CrossOriginPropertyEnumeratorCallback"),
+        make_cross_origin_indexed_definer_callback(
+            cg_context, "CrossOriginIndexedDefinerCallback"),
+        EmptyNode(),
+        make_cross_origin_indexed_descriptor_callback(
+            cg_context, "CrossOriginIndexedDescriptorCallback"),
+        EmptyNode(),
+        make_cross_origin_indexed_enumerator_callback(
+            cg_context, "CrossOriginIndexedEnumeratorCallback"),
+        EmptyNode(),
+        make_cross_origin_named_getter_callback(
+            cg_context, "CrossOriginNamedGetterCallback"),
+        EmptyNode(),
+        make_cross_origin_named_setter_callback(
+            cg_context, "CrossOriginNamedSetterCallback"),
+        EmptyNode(),
+        make_cross_origin_named_deleter_callback(
+            cg_context, "CrossOriginNamedDeleterCallback"),
+        EmptyNode(),
+        make_cross_origin_named_definer_callback(
+            cg_context, "CrossOriginNamedDefinerCallback"),
+        EmptyNode(),
+        make_cross_origin_named_descriptor_callback(
+            cg_context, "CrossOriginNamedDescriptorCallback"),
+        EmptyNode(),
+        make_cross_origin_named_query_callback(
+            cg_context, "CrossOriginNamedQueryCallback"),
+        EmptyNode(),
+        make_cross_origin_named_enumerator_callback(
+            cg_context, "CrossOriginNamedEnumeratorCallback"),
     ])
 
     text = """\
@@ -4736,38 +5039,29 @@
 ${instance_template}->SetAccessCheckCallbackAndHandler(
     CrossOriginAccessCheckCallback,
     v8::NamedPropertyHandlerConfiguration(
-        CrossOriginPropertyGetterCallback,
-        CrossOriginPropertySetterCallback,
-        CrossOriginPropertyDescriptorCallback,
-        nullptr,  // deleter
-        CrossOriginPropertyEnumeratorCallback,
-        nullptr,  // definer,
+        CrossOriginNamedGetterCallback,
+        CrossOriginNamedSetterCallback,
+        CrossOriginNamedQueryCallback,
+        CrossOriginNamedDeleterCallback,
+        CrossOriginNamedEnumeratorCallback,
+        CrossOriginNamedDefinerCallback,
+        CrossOriginNamedDescriptorCallback,
         v8::Local<v8::Value>(),
         v8::PropertyHandlerFlags::kNone),
-% if interface.indexed_and_named_properties and \
-     interface.indexed_and_named_properties.has_indexed_properties:
-    // Reuse non-cross origin indexed property callbacks.
     v8::IndexedPropertyHandlerConfiguration(
-        ${class_name}::IndexedPropertyGetterCallback,
-        nullptr,  // setter
-        ${class_name}::IndexedPropertyDescriptorCallback,
-        nullptr,  // deleter
-        ${class_name}::IndexedPropertyEnumeratorCallback,
-        nullptr,  // definer
+        CrossOriginIndexedGetterCallback,
+        CrossOriginIndexedSetterCallback,
+        nullptr,  // query
+        CrossOriginIndexedDeleterCallback,
+        CrossOriginIndexedEnumeratorCallback,
+        CrossOriginIndexedDefinerCallback,
+        CrossOriginIndexedDescriptorCallback,
         v8::Local<v8::Value>(),
         v8::PropertyHandlerFlags::kNone),
-% else:
-    v8::IndexedPropertyHandlerConfiguration(
-        nullptr,  // getter
-        nullptr,  // setter
-        nullptr,  // descriptor
-        nullptr,  // deleter
-        nullptr,  // enumerator
-        nullptr,  // definer
-        v8::Local<v8::Value>(),
-        v8::PropertyHandlerFlags::kNone),
-% endif
-    v8::Local<v8::Value>());"""
+    v8::External::New(
+        ${isolate},
+        const_cast<WrapperTypeInfo*>(${class_name}::GetWrapperTypeInfo())));\
+"""
     install_nodes.append(TextNode(text))
     install_nodes.accumulate(
         CodeGenAccumulator.require_include_headers([

diff --git a/third_party/blink/renderer/bindings/scripts/web_idl/interface.py b/third_party/blink/renderer/bindings/scripts/web_idl/interface.py
index 4759c6fd..10cb4490 100644
--- a/third_party/blink/renderer/bindings/scripts/web_idl/interface.py
+++ b/third_party/blink/renderer/bindings/scripts/web_idl/interface.py

@@ -40,8 +40,6 @@
                      constructors=None,
                      named_constructors=None,
                      operations=None,
-                     indexed_and_named_properties=None,
-                     stringifier=None,
                      iterable=None,
                      maplike=None,
                      setlike=None,
@@ -58,10 +56,6 @@
             assert named_constructors is None or isinstance(
                 named_constructors, (list, tuple))
             assert operations is None or isinstance(operations, (list, tuple))
-            assert indexed_and_named_properties is None or isinstance(
-                indexed_and_named_properties, IndexedAndNamedProperties.IR)
-            assert stringifier is None or isinstance(stringifier,
-                                                     Stringifier.IR)
             assert iterable is None or isinstance(iterable, Iterable)
             assert maplike is None or isinstance(maplike, Maplike)
             assert setlike is None or isinstance(setlike, Setlike)
@@ -118,8 +112,6 @@
             self.operation_groups = []
             self.exposed_constructs = []
             self.legacy_window_aliases = []
-            self.indexed_and_named_properties = indexed_and_named_properties
-            self.stringifier = stringifier
             self.iterable = iterable
             self.maplike = maplike
             self.setlike = setlike
@@ -195,27 +187,26 @@
         self._exposed_constructs = tuple(ir.exposed_constructs)
         self._legacy_window_aliases = tuple(ir.legacy_window_aliases)
         self._indexed_and_named_properties = None
-        if ir.indexed_and_named_properties:
-            operations = filter(
-                lambda x: x.is_indexed_or_named_property_operation,
-                self._operations)
+        indexed_and_named_property_operations = filter(
+            lambda x: x.is_indexed_or_named_property_operation,
+            self._operations)
+        if indexed_and_named_property_operations:
             self._indexed_and_named_properties = IndexedAndNamedProperties(
-                ir.indexed_and_named_properties, operations, owner=self)
+                indexed_and_named_property_operations, owner=self)
         self._stringifier = None
-        if ir.stringifier:
-            operations = filter(lambda x: x.is_stringifier, self._operations)
-            assert len(operations) == 1
-            attributes = [None]
-            if ir.stringifier.attribute:
-                attr_id = ir.stringifier.attribute.identifier
+        stringifier_operations = filter(lambda x: x.is_stringifier,
+                                        self._operations)
+        if stringifier_operations:
+            assert len(stringifier_operations) == 1
+            operation = stringifier_operations[0]
+            attribute = None
+            if operation.stringifier_attribute:
+                attr_id = operation.stringifier_attribute
                 attributes = filter(lambda x: x.identifier == attr_id,
                                     self._attributes)
-            assert len(attributes) == 1
-            self._stringifier = Stringifier(
-                ir.stringifier,
-                operation=operations[0],
-                attribute=attributes[0],
-                owner=self)
+                assert len(attributes) == 1
+                attribute = attributes[0]
+            self._stringifier = Stringifier(operation, attribute, owner=self)
         self._iterable = ir.iterable
         self._maplike = ir.maplike
         self._setlike = ir.setlike
@@ -383,7 +374,7 @@
         return self._original.target_object
 
 
-class IndexedAndNamedProperties(WithOwner, WithDebugInfo):
+class IndexedAndNamedProperties(WithOwner):
     """
     Represents a set of indexed/named getter/setter/deleter.
 
@@ -391,55 +382,12 @@
     https://heycam.github.io/webidl/#idl-named-properties
     """
 
-    class IR(WithDebugInfo):
-        def __init__(self, operations, debug_info=None):
-            assert isinstance(operations, (list, tuple))
-            assert all(
-                isinstance(operation, Operation.IR)
-                for operation in operations)
-
-            WithDebugInfo.__init__(self, debug_info)
-
-            self.indexed_getter = None
-            self.indexed_setter = None
-            self.named_getter = None
-            self.named_setter = None
-            self.named_deleter = None
-
-            for operation in operations:
-                arg1_type = operation.arguments[0].idl_type
-                if arg1_type.is_integer:
-                    if operation.is_getter:
-                        assert self.indexed_getter is None
-                        self.indexed_getter = operation
-                    elif operation.is_setter:
-                        assert self.indexed_setter is None
-                        self.indexed_setter = operation
-                    else:
-                        assert False
-                elif arg1_type.is_string:
-                    if operation.is_getter:
-                        assert self.named_getter is None
-                        self.named_getter = operation
-                    elif operation.is_setter:
-                        assert self.named_setter is None
-                        self.named_setter = operation
-                    elif operation.is_deleter:
-                        assert self.named_deleter is None
-                        self.named_deleter = operation
-                    else:
-                        assert False
-                else:
-                    assert False
-
-    def __init__(self, ir, operations, owner):
-        assert isinstance(ir, IndexedAndNamedProperties.IR)
+    def __init__(self, operations, owner):
         assert isinstance(operations, (list, tuple))
         assert all(
             isinstance(operation, Operation) for operation in operations)
 
         WithOwner.__init__(self, owner)
-        WithDebugInfo.__init__(self, ir)
 
         self._own_indexed_getter = None
         self._own_indexed_setter = None
@@ -539,26 +487,14 @@
         return None
 
 
-class Stringifier(WithOwner, WithDebugInfo):
+class Stringifier(WithOwner):
     """https://heycam.github.io/webidl/#idl-stringifiers"""
 
-    class IR(WithDebugInfo):
-        def __init__(self, operation=None, attribute=None, debug_info=None):
-            assert isinstance(operation, Operation.IR)
-            assert attribute is None or isinstance(attribute, Attribute.IR)
-
-            WithDebugInfo.__init__(self, debug_info)
-
-            self.operation = operation
-            self.attribute = attribute
-
-    def __init__(self, ir, operation, attribute, owner):
-        assert isinstance(ir, Stringifier.IR)
+    def __init__(self, operation, attribute, owner):
         assert isinstance(operation, Operation)
         assert attribute is None or isinstance(attribute, Attribute)
 
         WithOwner.__init__(self, owner)
-        WithDebugInfo.__init__(self, ir)
 
         self._operation = operation
         self._attribute = attribute

diff --git a/third_party/blink/renderer/bindings/scripts/web_idl/ir_builder.py b/third_party/blink/renderer/bindings/scripts/web_idl/ir_builder.py
index 5f2fe5f..ab775575 100644
--- a/third_party/blink/renderer/bindings/scripts/web_idl/ir_builder.py
+++ b/third_party/blink/renderer/bindings/scripts/web_idl/ir_builder.py

@@ -20,12 +20,10 @@
 from .extended_attribute import ExtendedAttributes
 from .idl_type import IdlTypeFactory
 from .includes import Includes
-from .interface import IndexedAndNamedProperties
 from .interface import Interface
 from .interface import Iterable
 from .interface import Maplike
 from .interface import Setlike
-from .interface import Stringifier
 from .literal_constant import LiteralConstant
 from .namespace import Namespace
 from .operation import Operation
@@ -99,7 +97,7 @@
 
         child_nodes = list(node.GetChildren())
         inherited = self._take_inheritance(child_nodes)
-        stringifier = self._take_stringifier(child_nodes)
+        stringifier_members = self._take_stringifier(child_nodes)
         iterable = self._take_iterable(child_nodes)
         maplike = self._take_maplike(child_nodes)
         setlike = self._take_setlike(child_nodes)
@@ -111,11 +109,12 @@
                 child, interface_identifier=identifier)
             for child in child_nodes
         ]
+        if stringifier_members:
+            members.extend(filter(None, stringifier_members))
         attributes = []
         constants = []
         constructors = []
         operations = []
-        indexed_and_named_property_operations = []
         for member in members:
             if isinstance(member, Attribute.IR):
                 attributes.append(member)
@@ -125,24 +124,11 @@
                 constructors.append(member)
             elif isinstance(member, Operation.IR):
                 operations.append(member)
-                if member.is_getter or member.is_setter or member.is_deleter:
-                    indexed_and_named_property_operations.append(member)
             else:
                 assert False
 
         named_constructors = self._build_named_constructors(node)
 
-        indexed_and_named_properties = None
-        if indexed_and_named_property_operations:
-            indexed_and_named_properties = IndexedAndNamedProperties.IR(
-                indexed_and_named_property_operations,
-                self._build_debug_info(node))
-
-        if stringifier:
-            operations.append(stringifier.operation)
-            if stringifier.attribute:
-                attributes.append(stringifier.attribute)
-
         return Interface.IR(
             identifier=identifier,
             is_partial=bool(node.GetProperty('PARTIAL')),
@@ -153,8 +139,6 @@
             constructors=constructors,
             named_constructors=named_constructors,
             operations=operations,
-            indexed_and_named_properties=indexed_and_named_properties,
-            stringifier=stringifier,
             iterable=iterable,
             maplike=maplike,
             setlike=setlike,
@@ -631,11 +615,11 @@
                 component=self._component,
                 debug_info=self._build_debug_info(node))
         operation.is_stringifier = True
-
-        return Stringifier.IR(
-            operation=operation,
-            attribute=attribute,
-            debug_info=self._build_debug_info(node))
+        if attribute:
+            operation.stringifier_attribute = attribute.identifier
+            return (operation, attribute)
+        else:
+            return (operation, )
 
     def _build_type(self,
                     node,

diff --git a/third_party/blink/renderer/bindings/scripts/web_idl/operation.py b/third_party/blink/renderer/bindings/scripts/web_idl/operation.py
index 7613451..7af7455d 100644
--- a/third_party/blink/renderer/bindings/scripts/web_idl/operation.py
+++ b/third_party/blink/renderer/bindings/scripts/web_idl/operation.py

@@ -60,6 +60,7 @@
             self.is_setter = is_setter
             self.is_deleter = is_deleter
             self.is_stringifier = False
+            self.stringifier_attribute = None
 
     def __init__(self, ir, owner):
         assert isinstance(ir, Operation.IR)
@@ -77,6 +78,7 @@
         self._is_setter = ir.is_setter
         self._is_deleter = ir.is_deleter
         self._is_stringifier = ir.is_stringifier
+        self._stringifier_attribute = ir.stringifier_attribute
 
     @property
     def is_special_operation(self):
@@ -107,6 +109,10 @@
     def is_stringifier(self):
         return self._is_stringifier
 
+    @property
+    def stringifier_attribute(self):
+        return self._stringifier_attribute
+
 
 class OperationGroup(OverloadGroup, WithExtendedAttributes,
                      WithCodeGeneratorInfo, WithExposure, WithOwner,

diff --git a/third_party/blink/renderer/core/DEPS b/third_party/blink/renderer/core/DEPS
index 391a212..fa466e5 100644
--- a/third_party/blink/renderer/core/DEPS
+++ b/third_party/blink/renderer/core/DEPS

@@ -70,8 +70,9 @@
     "+services/metrics/public",
     "+services/network/public/cpp/cors/cors_error_status.h",
     "+services/network/public/cpp/features.h",
-    "+services/network/public/cpp/request_mode.h",
     "+services/network/public/cpp/request_destination.h",
+    "+services/network/public/cpp/request_mode.h",
+    "+services/network/public/cpp/web_sandbox_flags.h",
     "+services/network/public/cpp/shared_url_loader_factory.h",
     "+services/resource_coordinator/public/mojom/coordination_unit.mojom-blink.h",
     "+services/service_manager/public",

diff --git a/third_party/blink/renderer/core/css/css_crossfade_value.cc b/third_party/blink/renderer/core/css/css_crossfade_value.cc
index 5051a54..3e1ce9c 100644
--- a/third_party/blink/renderer/core/css/css_crossfade_value.cc
+++ b/third_party/blink/renderer/core/css/css_crossfade_value.cc

@@ -68,7 +68,7 @@
 
   if (auto* image_value = DynamicTo<CSSImageValue>(value)) {
     StyleImage* style_image_resource =
-        image_value->CacheImage(document, FetchParameters::kAllowPlaceholder);
+        image_value->CacheImage(document, FetchParameters::kNone);
     if (!style_image_resource)
       return nullptr;
 

diff --git a/third_party/blink/renderer/core/css/resolver/element_style_resources.cc b/third_party/blink/renderer/core/css/resolver/element_style_resources.cc
index bfdffe6..0b8172f6 100644
--- a/third_party/blink/renderer/core/css/resolver/element_style_resources.cc
+++ b/third_party/blink/renderer/core/css/resolver/element_style_resources.cc

@@ -212,8 +212,6 @@
                       ->GetLazyLoadImageSetting() ==
                   LocalFrame::LazyLoadImageSetting::kEnabledAutomatic) {
                 image_request_behavior = FetchParameters::kDeferImageLoad;
-              } else {
-                image_request_behavior = FetchParameters::kAllowPlaceholder;
               }
             }
             StyleImage* new_image =
@@ -236,9 +234,9 @@
             StyleImage* image = To<ImageContentData>(content_data)->GetImage();
             if (image->IsPendingImage()) {
               To<ImageContentData>(content_data)
-                  ->SetImage(
-                      LoadPendingImage(style, To<StylePendingImage>(image),
-                                       FetchParameters::kAllowPlaceholder));
+                  ->SetImage(LoadPendingImage(style,
+                                              To<StylePendingImage>(image),
+                                              FetchParameters::kNone));
             }
           }
         }
@@ -250,7 +248,6 @@
             CursorData& current_cursor = cursor_list->at(i);
             if (StyleImage* image = current_cursor.GetImage()) {
               if (image->IsPendingImage()) {
-                // cursor images shouldn't be replaced with placeholders
                 current_cursor.SetImage(
                     LoadPendingImage(style, To<StylePendingImage>(image),
                                      FetchParameters::kNone));
@@ -263,7 +260,6 @@
       case CSSPropertyID::kListStyleImage: {
         if (style->ListStyleImage() &&
             style->ListStyleImage()->IsPendingImage()) {
-          // List style images shouldn't be replaced with placeholders
           style->SetListStyleImage(LoadPendingImage(
               style, To<StylePendingImage>(style->ListStyleImage()),
               FetchParameters::kNone));
@@ -273,7 +269,6 @@
       case CSSPropertyID::kBorderImageSource: {
         if (style->BorderImageSource() &&
             style->BorderImageSource()->IsPendingImage()) {
-          // Border images shouldn't be replaced with placeholders
           style->SetBorderImageSource(LoadPendingImage(
               style, To<StylePendingImage>(style->BorderImageSource()),
               FetchParameters::kNone));
@@ -287,7 +282,7 @@
               mask_image.GetImage()->IsPendingImage()) {
             StyleImage* loaded_image = LoadPendingImage(
                 style, To<StylePendingImage>(mask_image.GetImage()),
-                FetchParameters::kAllowPlaceholder);
+                FetchParameters::kNone);
             reflection->SetMask(NinePieceImage(
                 loaded_image, mask_image.ImageSlices(), mask_image.Fill(),
                 mask_image.BorderSlices(), mask_image.Outset(),
@@ -301,7 +296,7 @@
             style->MaskBoxImageSource()->IsPendingImage()) {
           style->SetMaskBoxImageSource(LoadPendingImage(
               style, To<StylePendingImage>(style->MaskBoxImageSource()),
-              FetchParameters::kAllowPlaceholder));
+              FetchParameters::kNone));
         }
         break;
       }
@@ -312,8 +307,7 @@
               mask_layer->GetImage()->IsPendingImage()) {
             mask_layer->SetImage(LoadPendingImage(
                 style, To<StylePendingImage>(mask_layer->GetImage()),
-                FetchParameters::kAllowPlaceholder,
-                kCrossOriginAttributeAnonymous));
+                FetchParameters::kNone, kCrossOriginAttributeAnonymous));
           }
         }
         break;
@@ -323,8 +317,7 @@
             style->ShapeOutside()->GetImage()->IsPendingImage()) {
           style->ShapeOutside()->SetImage(LoadPendingImage(
               style, To<StylePendingImage>(style->ShapeOutside()->GetImage()),
-              FetchParameters::kAllowPlaceholder,
-              kCrossOriginAttributeAnonymous));
+              FetchParameters::kNone, kCrossOriginAttributeAnonymous));
         }
         break;
       default:

diff --git a/third_party/blink/renderer/core/dom/document.cc b/third_party/blink/renderer/core/dom/document.cc
index b191614..bc4b7d8 100644
--- a/third_party/blink/renderer/core/dom/document.cc
+++ b/third_party/blink/renderer/core/dom/document.cc

@@ -49,6 +49,7 @@
 #include "services/metrics/public/mojom/ukm_interface.mojom-blink.h"
 #include "services/network/public/mojom/ip_address_space.mojom-blink.h"
 #include "services/network/public/mojom/trust_tokens.mojom-blink.h"
+#include "services/network/public/mojom/web_sandbox_flags.mojom-blink.h"
 #include "third_party/blink/public/common/associated_interfaces/associated_interface_provider.h"
 #include "third_party/blink/public/common/browser_interface_broker_proxy.h"
 #include "third_party/blink/public/common/feature_policy/document_policy_features.h"
@@ -1038,11 +1039,11 @@
   return GetSecurityContext().GetContentSecurityPolicy();
 }
 
-mojom::blink::WebSandboxFlags Document::GetSandboxFlags() const {
+network::mojom::blink::WebSandboxFlags Document::GetSandboxFlags() const {
   return GetSecurityContext().GetSandboxFlags();
 }
 
-bool Document::IsSandboxed(mojom::blink::WebSandboxFlags mask) const {
+bool Document::IsSandboxed(network::mojom::blink::WebSandboxFlags mask) const {
   return GetSecurityContext().IsSandboxed(mask);
 }
 
@@ -4777,7 +4778,7 @@
   }
 
   if (http_refresh_type == kHttpRefreshFromMetaTag &&
-      IsSandboxed(mojom::blink::WebSandboxFlags::kAutomaticFeatures)) {
+      IsSandboxed(network::mojom::blink::WebSandboxFlags::kAutomaticFeatures)) {
     String message =
         "Refused to execute the redirect specified via '<meta "
         "http-equiv='refresh' content='...'>'. The document is sandboxed, and "
@@ -5897,7 +5898,7 @@
   CountUse(WebFeature::kCookieGet);
 
   if (!GetSecurityOrigin()->CanAccessCookies()) {
-    if (IsSandboxed(mojom::blink::WebSandboxFlags::kOrigin))
+    if (IsSandboxed(network::mojom::blink::WebSandboxFlags::kOrigin))
       exception_state.ThrowSecurityError(
           "The document is sandboxed and lacks the 'allow-same-origin' flag.");
     else if (Url().ProtocolIsData())
@@ -5923,7 +5924,7 @@
   UseCounter::Count(*this, WebFeature::kCookieSet);
 
   if (!GetSecurityOrigin()->CanAccessCookies()) {
-    if (IsSandboxed(mojom::blink::WebSandboxFlags::kOrigin))
+    if (IsSandboxed(network::mojom::blink::WebSandboxFlags::kOrigin))
       exception_state.ThrowSecurityError(
           "The document is sandboxed and lacks the 'allow-same-origin' flag.");
     else if (Url().ProtocolIsData())
@@ -5982,7 +5983,7 @@
     return;
   }
 
-  if (IsSandboxed(mojom::blink::WebSandboxFlags::kDocumentDomain)) {
+  if (IsSandboxed(network::mojom::blink::WebSandboxFlags::kDocumentDomain)) {
     exception_state.ThrowSecurityError(
         "Assignment is forbidden for sandboxed iframes.");
     return;
@@ -7189,7 +7190,7 @@
   // However, there is an exception for cases when the script should bypass the
   // main world's CSP (such as for privileged isolated worlds). See
   // https://crbug.com/811528.
-  if (IsSandboxed(mojom::blink::WebSandboxFlags::kScripts) &&
+  if (IsSandboxed(network::mojom::blink::WebSandboxFlags::kScripts) &&
       !ContentSecurityPolicy::ShouldBypassMainWorld(domWindow())) {
     // FIXME: This message should be moved off the console once a solution to
     // https://bugs.webkit.org/show_bug.cgi?id=103274 exists.
@@ -8414,7 +8415,8 @@
   }
 
   WebFeature uma_type;
-  bool sandboxed = IsSandboxed(mojom::blink::WebSandboxFlags::kNavigation);
+  bool sandboxed =
+      IsSandboxed(network::mojom::blink::WebSandboxFlags::kNavigation);
   bool ad = frame_->IsAdSubframe();
   if (sandboxed) {
     uma_type = ad ? WebFeature::kFocusWithoutUserActivationSandboxedAdFrame
@@ -8484,7 +8486,7 @@
 
   FeaturePolicyViolationReportBody* body =
       MakeGarbageCollected<FeaturePolicyViolationReportBody>(
-          feature_name, "Feature policy violation", disp_str, source_file);
+          feature_name, message, disp_str, source_file);
 
   Report* report = MakeGarbageCollected<Report>(
       ReportType::kFeaturePolicyViolation, Url().GetString(), body);
@@ -8496,11 +8498,8 @@
   // TODO(iclelland): Report something different in report-only mode
   if (disposition == mojom::blink::PolicyDisposition::kEnforce) {
     frame->Console().AddMessage(MakeGarbageCollected<ConsoleMessage>(
-        mojom::ConsoleMessageSource::kViolation,
-        mojom::ConsoleMessageLevel::kError,
-        (message.IsEmpty() ? ("Feature policy violation: " + feature_name +
-                              " is not allowed in this document.")
-                           : message)));
+        mojom::blink::ConsoleMessageSource::kViolation,
+        mojom::blink::ConsoleMessageLevel::kError, body->message()));
   }
 }
 
@@ -8524,7 +8523,7 @@
 
   DocumentPolicyViolationReportBody* body =
       MakeGarbageCollected<DocumentPolicyViolationReportBody>(
-          feature_name, "Document policy violation", disp_str, source_file);
+          feature_name, message, disp_str, source_file);
 
   Report* report = MakeGarbageCollected<Report>(
       ReportType::kDocumentPolicyViolation, Url().GetString(), body);
@@ -8541,10 +8540,7 @@
   if (!is_report_only) {
     frame->Console().AddMessage(MakeGarbageCollected<ConsoleMessage>(
         mojom::blink::ConsoleMessageSource::kViolation,
-        mojom::blink::ConsoleMessageLevel::kError,
-        (message.IsEmpty() ? ("Document policy violation: " + feature_name +
-                              " is not allowed in this document.")
-                           : message)));
+        mojom::blink::ConsoleMessageLevel::kError, body->message()));
   }
 }
 

diff --git a/third_party/blink/renderer/core/dom/document.h b/third_party/blink/renderer/core/dom/document.h
index 8d3ea58..07823729 100644
--- a/third_party/blink/renderer/core/dom/document.h
+++ b/third_party/blink/renderer/core/dom/document.h

@@ -39,6 +39,7 @@
 #include "net/cookies/site_for_cookies.h"
 #include "services/metrics/public/cpp/ukm_source_id.h"
 #include "services/network/public/mojom/trust_tokens.mojom-blink.h"
+#include "services/network/public/mojom/web_sandbox_flags.mojom-blink-forward.h"
 #include "third_party/blink/public/common/metrics/document_update_reason.h"
 #include "third_party/blink/public/mojom/input/focus_type.mojom-blink-forward.h"
 #include "third_party/blink/public/mojom/permissions/permission.mojom-blink.h"
@@ -386,8 +387,8 @@
   const SecurityOrigin* GetSecurityOrigin() const;
   SecurityOrigin* GetMutableSecurityOrigin();
   ContentSecurityPolicy* GetContentSecurityPolicy() const;
-  mojom::blink::WebSandboxFlags GetSandboxFlags() const;
-  bool IsSandboxed(mojom::blink::WebSandboxFlags mask) const;
+  network::mojom::blink::WebSandboxFlags GetSandboxFlags() const;
+  bool IsSandboxed(network::mojom::blink::WebSandboxFlags mask) const;
   PublicURLManager& GetPublicURLManager();
   bool IsContextPaused() const;
   bool IsContextDestroyed() const;

diff --git a/third_party/blink/renderer/core/dom/document_init.cc b/third_party/blink/renderer/core/dom/document_init.cc
index c9c761d..b528df7 100644
--- a/third_party/blink/renderer/core/dom/document_init.cc
+++ b/third_party/blink/renderer/core/dom/document_init.cc

@@ -29,6 +29,8 @@
 
 #include "third_party/blink/renderer/core/dom/document_init.h"
 
+#include "services/network/public/cpp/web_sandbox_flags.h"
+#include "services/network/public/mojom/web_sandbox_flags.mojom-blink.h"
 #include "third_party/blink/public/mojom/security_context/insecure_request_policy.mojom-blink.h"
 #include "third_party/blink/renderer/core/dom/document.h"
 #include "third_party/blink/renderer/core/dom/dom_implementation.h"
@@ -61,28 +63,21 @@
   return &owner_element->GetDocument();
 }
 
+// static
 DocumentInit DocumentInit::Create() {
-  return DocumentInit(nullptr);
+  return DocumentInit();
 }
 
-DocumentInit DocumentInit::CreateWithImportsController(
-    HTMLImportsController* controller) {
-  DCHECK(controller);
-  Document* master = controller->Master();
-  return DocumentInit(controller)
-      .WithContextDocument(master->ContextDocument())
-      .WithRegistrationContext(master->RegistrationContext());
-}
-
-DocumentInit::DocumentInit(HTMLImportsController* imports_controller)
-    : imports_controller_(imports_controller),
-      create_new_registration_context_(false),
-      content_security_policy_from_context_doc_(false) {}
-
 DocumentInit::DocumentInit(const DocumentInit&) = default;
 
 DocumentInit::~DocumentInit() = default;
 
+DocumentInit& DocumentInit::WithImportsController(
+    HTMLImportsController* controller) {
+  imports_controller_ = controller;
+  return *this;
+}
+
 bool DocumentInit::ShouldSetURL() const {
   DocumentLoader* loader = MasterDocumentLoader();
   return (loader && loader->GetFrame()->Tree().Parent()) || !url_.IsEmpty();
@@ -105,8 +100,8 @@
   return nullptr;
 }
 
-mojom::blink::WebSandboxFlags DocumentInit::GetSandboxFlags() const {
-  mojom::blink::WebSandboxFlags flags = sandbox_flags_;
+network::mojom::blink::WebSandboxFlags DocumentInit::GetSandboxFlags() const {
+  network::mojom::blink::WebSandboxFlags flags = sandbox_flags_;
   if (DocumentLoader* loader = MasterDocumentLoader())
     flags |= loader->GetFrame()->Loader().EffectiveSandboxFlags();
   // If the load was blocked by CSP, force the Document's origin to be unique,
@@ -114,7 +109,7 @@
   // document's load per CSP spec:
   // https://www.w3.org/TR/CSP3/#directive-frame-ancestors.
   if (blocked_by_csp_)
-    flags |= mojom::blink::WebSandboxFlags::kOrigin;
+    flags |= network::mojom::blink::WebSandboxFlags::kOrigin;
   return flags;
 }
 
@@ -162,80 +157,90 @@
   return document_loader_;
 }
 
-DocumentInit& DocumentInit::WithTypeFrom(const String& type) {
-  mime_type_ = type;
-
-  if (GetFrame() && GetFrame()->InViewSourceMode()) {
-    type_ = Type::kViewSource;
-    return *this;
-  }
+// static
+DocumentInit::Type DocumentInit::ComputeDocumentType(
+    LocalFrame* frame,
+    const KURL& url,
+    const String& mime_type,
+    bool* is_for_external_handler) {
+  if (frame && frame->InViewSourceMode())
+    return Type::kViewSource;
 
   // Plugins cannot take HTML and XHTML from us, and we don't even need to
   // initialize the plugin database for those.
-  if (type == "text/html") {
-    type_ = Type::kHTML;
-    return *this;
-  }
-  if (type == "application/xhtml+xml") {
-    type_ = Type::kXHTML;
-    return *this;
-  }
+  if (mime_type == "text/html")
+    return Type::kHTML;
+
+  if (mime_type == "application/xhtml+xml")
+    return Type::kXHTML;
+
   // multipart/x-mixed-replace is only supported for images.
-  if (MIMETypeRegistry::IsSupportedImageResourceMIMEType(type) ||
-      type == "multipart/x-mixed-replace") {
-    type_ = Type::kImage;
-    return *this;
-  }
-  if (HTMLMediaElement::GetSupportsType(ContentType(type))) {
-    type_ = Type::kMedia;
-    return *this;
+  if (MIMETypeRegistry::IsSupportedImageResourceMIMEType(mime_type) ||
+      mime_type == "multipart/x-mixed-replace") {
+    return Type::kImage;
   }
 
-  PluginData* plugin_data = nullptr;
-  if (GetFrame() && GetFrame()->GetPage() &&
-      GetFrame()->Loader().AllowPlugins(kNotAboutToInstantiatePlugin)) {
-    // If the document is being created for the main frame,
-    // frame()->tree().top()->securityContext() returns nullptr.
-    // For that reason, the origin must be retrieved directly from url().
-    if (GetFrame()->IsMainFrame()) {
-      scoped_refptr<const SecurityOrigin> origin =
-          SecurityOrigin::Create(Url());
-      plugin_data = GetFrame()->GetPage()->GetPluginData(origin.get());
-    } else {
-      auto* top_security_origin =
-          GetFrame()->Tree().Top().GetSecurityContext()->GetSecurityOrigin();
-      plugin_data = GetFrame()->GetPage()->GetPluginData(top_security_origin);
+  if (HTMLMediaElement::GetSupportsType(ContentType(mime_type)))
+    return Type::kMedia;
+
+  if (frame && frame->GetPage() &&
+      frame->Loader().AllowPlugins(kNotAboutToInstantiatePlugin)) {
+    PluginData* plugin_data = GetPluginData(frame, url);
+
+    // Everything else except text/plain can be overridden by plugins.
+    // Disallowing plugins to use text/plain prevents plugins from hijacking a
+    // fundamental type that the browser is expected to handle, and also serves
+    // as an optimization to prevent loading the plugin database in the common
+    // case.
+    if (mime_type != "text/plain" && plugin_data &&
+        plugin_data->SupportsMimeType(mime_type)) {
+      // Plugins handled by MimeHandlerView do not create a PluginDocument. They
+      // are rendered inside cross-process frames and the notion of a PluginView
+      // (which is associated with PluginDocument) is irrelevant here.
+      if (plugin_data->IsExternalPluginMimeType(mime_type)) {
+        if (is_for_external_handler)
+          *is_for_external_handler = true;
+        return Type::kHTML;
+      }
+
+      return Type::kPlugin;
     }
   }
 
-  // Everything else except text/plain can be overridden by plugins.
-  // Disallowing plugins to use text/plain prevents plugins from hijacking a
-  // fundamental type that the browser is expected to handle, and also serves as
-  // an optimization to prevent loading the plugin database in the common case.
-  if (type != "text/plain" && plugin_data &&
-      plugin_data->SupportsMimeType(type)) {
-    // Plugins handled by MimeHandlerView do not create a PluginDocument. They
-    // are rendered inside cross-process frames and the notion of a PluginView
-    // (which is associated with PluginDocument) is irrelevant here.
-    if (plugin_data->IsExternalPluginMimeType(type)) {
-      type_ = Type::kHTML;
-      is_for_external_handler_ = true;
-    } else {
-      type_ = Type::kPlugin;
-      plugin_background_color_ =
-          plugin_data->PluginBackgroundColorForMimeType(type);
-    }
-    return *this;
-  }
+  if (DOMImplementation::IsTextMIMEType(mime_type))
+    return Type::kText;
 
-  if (DOMImplementation::IsTextMIMEType(type))
-    type_ = Type::kText;
-  else if (type == "image/svg+xml")
-    type_ = Type::kSVG;
-  else if (DOMImplementation::IsXMLMIMEType(type))
-    type_ = Type::kXML;
-  else
-    type_ = Type::kHTML;
+  if (mime_type == "image/svg+xml")
+    return Type::kSVG;
+
+  if (DOMImplementation::IsXMLMIMEType(mime_type))
+    return Type::kXML;
+
+  return Type::kHTML;
+}
+
+// static
+PluginData* DocumentInit::GetPluginData(LocalFrame* frame, const KURL& url) {
+  // If the document is being created for the main frame,
+  // frame()->tree().top()->securityContext() returns nullptr.
+  // For that reason, the origin must be retrieved directly from |url|.
+  if (frame->IsMainFrame())
+    return frame->GetPage()->GetPluginData(SecurityOrigin::Create(url).get());
+
+  const SecurityOrigin* main_frame_origin =
+      frame->Tree().Top().GetSecurityContext()->GetSecurityOrigin();
+  return frame->GetPage()->GetPluginData(main_frame_origin);
+}
+
+DocumentInit& DocumentInit::WithTypeFrom(const String& mime_type) {
+  mime_type_ = mime_type;
+  type_ = ComputeDocumentType(GetFrame(), Url(), mime_type_,
+                              &is_for_external_handler_);
+  if (type_ == Type::kPlugin) {
+    plugin_background_color_ =
+        GetPluginData(GetFrame(), Url())
+            ->PluginBackgroundColorForMimeType(mime_type_);
+  }
   return *this;
 }
 
@@ -365,7 +370,7 @@
 }
 
 DocumentInit& DocumentInit::WithSandboxFlags(
-    mojom::blink::WebSandboxFlags flags) {
+    network::mojom::blink::WebSandboxFlags flags) {
   // Only allow adding more sandbox flags.
   sandbox_flags_ |= flags;
   return *this;

diff --git a/third_party/blink/renderer/core/dom/document_init.h b/third_party/blink/renderer/core/dom/document_init.h
index 7a7da46..45eb8b5 100644
--- a/third_party/blink/renderer/core/dom/document_init.h
+++ b/third_party/blink/renderer/core/dom/document_init.h

@@ -31,12 +31,12 @@
 #define THIRD_PARTY_BLINK_RENDERER_CORE_DOM_DOCUMENT_INIT_H_
 
 #include "services/network/public/mojom/ip_address_space.mojom-shared.h"
+#include "services/network/public/mojom/web_sandbox_flags.mojom-blink.h"
 #include "third_party/blink/public/common/frame/frame_policy.h"
 #include "third_party/blink/public/mojom/feature_policy/feature_policy.mojom-blink.h"
 #include "third_party/blink/public/mojom/security_context/insecure_request_policy.mojom-blink-forward.h"
 #include "third_party/blink/renderer/core/core_export.h"
 #include "third_party/blink/renderer/core/execution_context/security_context.h"
-#include "third_party/blink/renderer/core/frame/sandbox_flags.h"
 #include "third_party/blink/renderer/core/html/custom/v0_custom_element_registration_context.h"
 #include "third_party/blink/renderer/platform/graphics/color.h"
 #include "third_party/blink/renderer/platform/heap/handle.h"
@@ -47,8 +47,9 @@
 class ContentSecurityPolicy;
 class Document;
 class DocumentLoader;
-class LocalFrame;
 class HTMLImportsController;
+class LocalFrame;
+class PluginData;
 class Settings;
 class UseCounter;
 class WindowAgentFactory;
@@ -69,7 +70,6 @@
   //       .WithURL(url);
   //   Document* document = MakeGarbageCollected<Document>(init);
   static DocumentInit Create();
-  static DocumentInit CreateWithImportsController(HTMLImportsController*);
 
   DocumentInit(const DocumentInit&);
   ~DocumentInit();
@@ -87,6 +87,7 @@
     kUnspecified
   };
 
+  DocumentInit& WithImportsController(HTMLImportsController*);
   HTMLImportsController* ImportsController() const {
     return imports_controller_;
   }
@@ -94,7 +95,7 @@
   bool HasSecurityContext() const { return MasterDocumentLoader(); }
   bool IsSrcdocDocument() const;
   bool ShouldSetURL() const;
-  mojom::blink::WebSandboxFlags GetSandboxFlags() const;
+  network::mojom::blink::WebSandboxFlags GetSandboxFlags() const;
   mojom::blink::InsecureRequestPolicy GetInsecureRequestPolicy() const;
   const SecurityContext::InsecureNavigationsSet* InsecureNavigationsToUpgrade()
       const;
@@ -106,7 +107,17 @@
   LocalFrame* GetFrame() const;
   UseCounter* GetUseCounter() const;
 
-  DocumentInit& WithTypeFrom(const String& type);
+  // Compute the type of document to be loaded inside a |frame|, given its |url|
+  // and its |mime_type|.
+  //
+  // In case of plugin handled by MimeHandlerview (which do not create a
+  // PluginDocument), the type is Type::KHTML and |is_for_external_handler| is
+  // set to true.
+  static Type ComputeDocumentType(LocalFrame* frame,
+                                  const KURL& url,
+                                  const String& mime_type,
+                                  bool* is_for_external_handler = nullptr);
+  DocumentInit& WithTypeFrom(const String& mime_type);
   Type GetType() const { return type_; }
   const String& GetMimeType() const { return mime_type_; }
   bool IsForExternalHandler() const { return is_for_external_handler_; }
@@ -162,7 +173,7 @@
   DocumentInit& WithOriginTrialsHeader(const String& header);
   const String& OriginTrialsHeader() const { return origin_trials_header_; }
 
-  DocumentInit& WithSandboxFlags(mojom::blink::WebSandboxFlags flags);
+  DocumentInit& WithSandboxFlags(network::mojom::blink::WebSandboxFlags flags);
 
   DocumentInit& WithContentSecurityPolicy(ContentSecurityPolicy* policy);
   DocumentInit& WithContentSecurityPolicyFromContextDoc();
@@ -192,7 +203,7 @@
   Settings* GetSettingsForWindowAgentFactory() const;
 
  private:
-  DocumentInit(HTMLImportsController*);
+  DocumentInit() = default;
 
   // For a Document associated directly with a frame, this will be the
   // DocumentLoader driving the commit. For an import, XSLT-generated
@@ -200,6 +211,8 @@
   // of its owning Document.
   DocumentLoader* MasterDocumentLoader() const;
 
+  static PluginData* GetPluginData(LocalFrame* frame, const KURL& url);
+
   Type type_ = Type::kUnspecified;
   String mime_type_;
 
@@ -244,7 +257,7 @@
   bool grant_load_local_resources_ = false;
 
   V0CustomElementRegistrationContext* registration_context_ = nullptr;
-  bool create_new_registration_context_;
+  bool create_new_registration_context_ = false;
 
   // The feature policy set via response header.
   String feature_policy_header_;
@@ -254,12 +267,12 @@
   String origin_trials_header_;
 
   // Additional sandbox flags
-  mojom::blink::WebSandboxFlags sandbox_flags_ =
-      mojom::blink::WebSandboxFlags::kNone;
+  network::mojom::blink::WebSandboxFlags sandbox_flags_ =
+      network::mojom::blink::WebSandboxFlags::kNone;
 
   // Loader's CSP
   ContentSecurityPolicy* content_security_policy_ = nullptr;
-  bool content_security_policy_from_context_doc_;
+  bool content_security_policy_from_context_doc_ = false;
 
   network::mojom::IPAddressSpace ip_address_space_ =
       network::mojom::IPAddressSpace::kUnknown;

diff --git a/third_party/blink/renderer/core/dom/dom_implementation.cc b/third_party/blink/renderer/core/dom/dom_implementation.cc
index 7c1a0d0..141dc77 100644
--- a/third_party/blink/renderer/core/dom/dom_implementation.cc
+++ b/third_party/blink/renderer/core/dom/dom_implementation.cc

@@ -219,7 +219,8 @@
       // replace it with a SinkDocument when plugins are sanboxed. If we move
       // final sandbox flag calcuation earlier, we could construct the
       // SinkDocument directly.
-      if (document->IsSandboxed(mojom::blink::WebSandboxFlags::kPlugins))
+      if (document->IsSandboxed(
+              network::mojom::blink::WebSandboxFlags::kPlugins))
         document = MakeGarbageCollected<SinkDocument>(init);
       return document;
     }

diff --git a/third_party/blink/renderer/core/dom/element.cc b/third_party/blink/renderer/core/dom/element.cc
index be13a483..9434d8e 100644
--- a/third_party/blink/renderer/core/dom/element.cc
+++ b/third_party/blink/renderer/core/dom/element.cc

@@ -498,7 +498,8 @@
 
   // 4. If target's active sandboxing flag set has the sandboxed automatic
   // features browsing context flag, then return.
-  if (doc.IsSandboxed(mojom::blink::WebSandboxFlags::kAutomaticFeatures)) {
+  if (doc.IsSandboxed(
+          network::mojom::blink::WebSandboxFlags::kAutomaticFeatures)) {
     doc.AddConsoleMessage(MakeGarbageCollected<ConsoleMessage>(
         mojom::ConsoleMessageSource::kSecurity,
         mojom::ConsoleMessageLevel::kError,

diff --git a/third_party/blink/renderer/core/editing/spellcheck/spell_checker.cc b/third_party/blink/renderer/core/editing/spellcheck/spell_checker.cc
index d5b3c0c..ccd649e 100644
--- a/third_party/blink/renderer/core/editing/spellcheck/spell_checker.cc
+++ b/third_party/blink/renderer/core/editing/spellcheck/spell_checker.cc

@@ -412,7 +412,8 @@
                                                    ElementsType elements_type) {
   // TODO(editing-dev): The use of updateStyleAndLayoutIgnorePendingStylesheets
   // needs to be audited.  See http://crbug.com/590369 for more details.
-  GetFrame().GetDocument()->UpdateStyleAndLayoutTreeForNode(&element);
+  if (elements_type == ElementsType::kOnlyNonEditable)
+    GetFrame().GetDocument()->UpdateStyleAndLayoutTreeForNode(&element);
 
   for (Node& node : NodeTraversal::InclusiveDescendantsOf(element)) {
     auto* text_node = DynamicTo<Text>(node);

diff --git a/third_party/blink/renderer/core/execution_context/execution_context.cc b/third_party/blink/renderer/core/execution_context/execution_context.cc
index eaa55b55..338d58e 100644
--- a/third_party/blink/renderer/core/execution_context/execution_context.cc
+++ b/third_party/blink/renderer/core/execution_context/execution_context.cc

@@ -239,11 +239,13 @@
   return GetSecurityContext().GetContentSecurityPolicy();
 }
 
-mojom::blink::WebSandboxFlags ExecutionContext::GetSandboxFlags() const {
+network::mojom::blink::WebSandboxFlags ExecutionContext::GetSandboxFlags()
+    const {
   return GetSecurityContext().GetSandboxFlags();
 }
 
-bool ExecutionContext::IsSandboxed(mojom::blink::WebSandboxFlags mask) const {
+bool ExecutionContext::IsSandboxed(
+    network::mojom::blink::WebSandboxFlags mask) const {
   return GetSecurityContext().IsSandboxed(mask);
 }
 

diff --git a/third_party/blink/renderer/core/execution_context/execution_context.h b/third_party/blink/renderer/core/execution_context/execution_context.h
index b92345f..b80198f9 100644
--- a/third_party/blink/renderer/core/execution_context/execution_context.h
+++ b/third_party/blink/renderer/core/execution_context/execution_context.h

@@ -155,8 +155,8 @@
 
   ContentSecurityPolicy* GetContentSecurityPolicy() const;
 
-  mojom::blink::WebSandboxFlags GetSandboxFlags() const;
-  bool IsSandboxed(mojom::blink::WebSandboxFlags mask) const;
+  network::mojom::blink::WebSandboxFlags GetSandboxFlags() const;
+  bool IsSandboxed(network::mojom::blink::WebSandboxFlags mask) const;
 
   // Returns the content security policy to be used based on the current
   // JavaScript world we are in.

diff --git a/third_party/blink/renderer/core/execution_context/remote_security_context.cc b/third_party/blink/renderer/core/execution_context/remote_security_context.cc
index e97fffe..6210891 100644
--- a/third_party/blink/renderer/core/execution_context/remote_security_context.cc
+++ b/third_party/blink/renderer/core/execution_context/remote_security_context.cc

@@ -4,6 +4,7 @@
 
 #include "third_party/blink/renderer/core/execution_context/remote_security_context.h"
 
+#include "services/network/public/mojom/web_sandbox_flags.mojom-blink.h"
 #include "third_party/blink/renderer/core/execution_context/security_context_init.h"
 #include "third_party/blink/renderer/core/frame/csp/content_security_policy.h"
 #include "third_party/blink/renderer/platform/runtime_enabled_features.h"
@@ -40,10 +41,10 @@
 }
 
 void RemoteSecurityContext::ResetAndEnforceSandboxFlags(
-    mojom::blink::WebSandboxFlags flags) {
+    network::mojom::blink::WebSandboxFlags flags) {
   sandbox_flags_ = flags;
 
-  if (IsSandboxed(mojom::blink::WebSandboxFlags::kOrigin) &&
+  if (IsSandboxed(network::mojom::blink::WebSandboxFlags::kOrigin) &&
       GetSecurityOrigin() && !GetSecurityOrigin()->IsOpaque()) {
     SetSecurityOrigin(GetSecurityOrigin()->DeriveNewOpaqueOrigin());
   }

diff --git a/third_party/blink/renderer/core/execution_context/remote_security_context.h b/third_party/blink/renderer/core/execution_context/remote_security_context.h
index 00042b46..b8005ee 100644
--- a/third_party/blink/renderer/core/execution_context/remote_security_context.h
+++ b/third_party/blink/renderer/core/execution_context/remote_security_context.h

@@ -5,6 +5,7 @@
 #ifndef THIRD_PARTY_BLINK_RENDERER_CORE_EXECUTION_CONTEXT_REMOTE_SECURITY_CONTEXT_H_
 #define THIRD_PARTY_BLINK_RENDERER_CORE_EXECUTION_CONTEXT_REMOTE_SECURITY_CONTEXT_H_
 
+#include "services/network/public/mojom/web_sandbox_flags.mojom-blink-forward.h"
 #include "third_party/blink/public/common/feature_policy/feature_policy.h"
 #include "third_party/blink/renderer/core/core_export.h"
 #include "third_party/blink/renderer/core/execution_context/security_context.h"
@@ -18,7 +19,8 @@
 
   void SetReplicatedOrigin(scoped_refptr<SecurityOrigin>);
   void ResetReplicatedContentSecurityPolicy();
-  void ResetAndEnforceSandboxFlags(mojom::blink::WebSandboxFlags flags);
+  void ResetAndEnforceSandboxFlags(
+      network::mojom::blink::WebSandboxFlags flags);
 
   // Constructs the enforcement FeaturePolicy struct for this security context.
   // The resulting FeaturePolicy is a combination of:

diff --git a/third_party/blink/renderer/core/execution_context/security_context.cc b/third_party/blink/renderer/core/execution_context/security_context.cc
index 0d20182..52930775 100644
--- a/third_party/blink/renderer/core/execution_context/security_context.cc
+++ b/third_party/blink/renderer/core/execution_context/security_context.cc

@@ -27,7 +27,9 @@
 #include "third_party/blink/renderer/core/execution_context/security_context.h"
 
 #include "base/metrics/histogram_macros.h"
+#include "services/network/public/cpp/web_sandbox_flags.h"
 #include "services/network/public/mojom/ip_address_space.mojom-blink.h"
+#include "services/network/public/mojom/web_sandbox_flags.mojom-blink.h"
 #include "third_party/blink/public/common/feature_policy/document_policy_features.h"
 #include "third_party/blink/public/common/feature_policy/feature_policy.h"
 #include "third_party/blink/public/mojom/feature_policy/feature_policy.mojom-blink.h"
@@ -108,14 +110,21 @@
   content_security_policy_ = content_security_policy;
 }
 
-bool SecurityContext::IsSandboxed(mojom::blink::WebSandboxFlags mask) const {
+bool SecurityContext::IsSandboxed(
+    network::mojom::blink::WebSandboxFlags mask) const {
   if (RuntimeEnabledFeatures::FeaturePolicyForSandboxEnabled()) {
     mojom::blink::FeaturePolicyFeature feature =
         FeaturePolicy::FeatureForSandboxFlag(mask);
     if (feature != mojom::blink::FeaturePolicyFeature::kNotFound)
       return !feature_policy_->IsFeatureEnabled(feature);
   }
-  return (sandbox_flags_ & mask) != mojom::blink::WebSandboxFlags::kNone;
+  return (sandbox_flags_ & mask) !=
+         network::mojom::blink::WebSandboxFlags::kNone;
+}
+
+void SecurityContext::ApplySandboxFlags(
+    network::mojom::blink::WebSandboxFlags flags) {
+  sandbox_flags_ |= flags;
 }
 
 void SecurityContext::SetRequireTrustedTypes() {

diff --git a/third_party/blink/renderer/core/execution_context/security_context.h b/third_party/blink/renderer/core/execution_context/security_context.h
index 1f7d760a0..cf92c0a 100644
--- a/third_party/blink/renderer/core/execution_context/security_context.h
+++ b/third_party/blink/renderer/core/execution_context/security_context.h

@@ -32,8 +32,8 @@
 #include "base/macros.h"
 #include "base/memory/scoped_refptr.h"
 #include "services/network/public/mojom/ip_address_space.mojom-blink-forward.h"
+#include "services/network/public/mojom/web_sandbox_flags.mojom-blink-forward.h"
 #include "third_party/blink/public/common/feature_policy/document_policy.h"
-#include "third_party/blink/public/common/frame/sandbox_flags.h"
 #include "third_party/blink/public/mojom/feature_policy/document_policy_feature.mojom-blink-forward.h"
 #include "third_party/blink/public/mojom/feature_policy/feature_policy.mojom-blink-forward.h"
 #include "third_party/blink/public/mojom/feature_policy/feature_policy_feature.mojom-blink-forward.h"
@@ -104,13 +104,11 @@
   // Like SetSecurityOrigin(), but no security CHECKs.
   void SetSecurityOriginForTesting(scoped_refptr<SecurityOrigin>);
 
-  mojom::blink::WebSandboxFlags GetSandboxFlags() const {
+  network::mojom::blink::WebSandboxFlags GetSandboxFlags() const {
     return sandbox_flags_;
   }
-  bool IsSandboxed(mojom::blink::WebSandboxFlags mask) const;
-  void ApplySandboxFlags(mojom::blink::WebSandboxFlags flags) {
-    sandbox_flags_ |= flags;
-  }
+  bool IsSandboxed(network::mojom::blink::WebSandboxFlags mask) const;
+  void ApplySandboxFlags(network::mojom::blink::WebSandboxFlags flags);
 
   void SetAddressSpace(network::mojom::IPAddressSpace space) {
     address_space_ = space;
@@ -197,7 +195,7 @@
   bool BindCSPImmediately() const { return bind_csp_immediately_; }
 
  protected:
-  mojom::blink::WebSandboxFlags sandbox_flags_;
+  network::mojom::blink::WebSandboxFlags sandbox_flags_;
   scoped_refptr<SecurityOrigin> security_origin_;
   std::unique_ptr<FeaturePolicy> feature_policy_;
   std::unique_ptr<FeaturePolicy> report_only_feature_policy_;

diff --git a/third_party/blink/renderer/core/execution_context/security_context_init.cc b/third_party/blink/renderer/core/execution_context/security_context_init.cc
index b667fa5..561b8d4 100644
--- a/third_party/blink/renderer/core/execution_context/security_context_init.cc
+++ b/third_party/blink/renderer/core/execution_context/security_context_init.cc

@@ -4,6 +4,7 @@
 
 #include "third_party/blink/renderer/core/execution_context/security_context_init.h"
 
+#include "services/network/public/cpp/web_sandbox_flags.h"
 #include "third_party/blink/public/mojom/devtools/console_message.mojom-blink.h"
 #include "third_party/blink/renderer/core/dom/document_init.h"
 #include "third_party/blink/renderer/core/dom/element.h"
@@ -14,6 +15,7 @@
 #include "third_party/blink/renderer/core/frame/csp/content_security_policy.h"
 #include "third_party/blink/renderer/core/frame/local_frame.h"
 #include "third_party/blink/renderer/core/frame/local_frame_client.h"
+#include "third_party/blink/renderer/core/frame/sandbox_flags.h"
 #include "third_party/blink/renderer/core/frame/settings.h"
 #include "third_party/blink/renderer/core/html/imports/html_imports_controller.h"
 #include "third_party/blink/renderer/core/inspector/console_message.h"
@@ -137,74 +139,25 @@
 
 void SecurityContextInit::InitializeContentSecurityPolicy(
     const DocumentInit& initializer) {
-  auto* frame = initializer.GetFrame();
-  ContentSecurityPolicy* last_origin_document_csp =
-      frame ? frame->Loader().GetLastOriginDocumentCSP() : nullptr;
-
-  KURL url;
-  if (initializer.ShouldSetURL())
-    url = initializer.Url().IsEmpty() ? BlankURL() : initializer.Url();
-
-  // Alias certain security properties from |owner_document|. Used for the
-  // case of about:blank pages inheriting the security properties of their
-  // requestor context.
+  // --------------
+  // THE MAIN PATH:
+  // --------------
   //
-  // Note that this is currently somewhat broken; Blink always inherits from
-  // the parent or opener, even though it should actually be inherited from
-  // the request initiator.
-  if (url.IsEmpty() && initializer.HasSecurityContext() &&
-      !initializer.OriginToCommit() && initializer.OwnerDocument()) {
-    last_origin_document_csp =
-        initializer.OwnerDocument()->GetContentSecurityPolicy();
-  }
-
+  // This path is used (among others) to load a document inside a frame. In this
+  // case, the CSP is computed by:
+  // - FrameLoader::CreateCSPForInitialEmptyDocument() or
+  // - FrameLoader::CreateCSP().
   csp_ = initializer.GetContentSecurityPolicy();
+  if (csp_)
+    return;
 
-  if (!csp_) {
-    if (initializer.ImportsController()) {
-      // If this document is an HTML import, grab a reference to its master
-      // document's Content Security Policy. We don't bind the CSP's delegate
-      // in 'InitSecurityPolicy' in this case, as we can't rebind the master
-      // document's policy object: The Content Security Policy's delegate
-      // needs to remain set to the master document.
-      csp_ =
-          initializer.ImportsController()->Master()->GetContentSecurityPolicy();
-      return;
-    }
-
-    csp_ = MakeGarbageCollected<ContentSecurityPolicy>();
-    bind_csp_immediately_ = true;
-  }
-
-  // We should inherit the navigation initiator CSP if the document is loaded
-  // using a local-scheme url.
-  //
-  // Note: about:srcdoc inherits CSP from its parent, not from its initiator.
-  // In this case, the initializer.GetContentSecurityPolicy() is used.
-  if (last_origin_document_csp && !url.IsAboutSrcdocURL() &&
-      (url.IsEmpty() || url.ProtocolIsAbout() || url.ProtocolIsData() ||
-       url.ProtocolIs("blob") || url.ProtocolIs("filesystem"))) {
-    csp_->CopyStateFrom(last_origin_document_csp);
-  }
-
-  if (initializer.GetType() == DocumentInit::Type::kPlugin) {
-    if (last_origin_document_csp) {
-      csp_->CopyPluginTypesFrom(last_origin_document_csp);
-      return;
-    }
-
-    // TODO(andypaicu): This should inherit the origin document's plugin types
-    // but because this could be a OOPIF document it might not have access. In
-    // this situation we fallback on using the parent/opener:
-    if (frame) {
-      Frame* inherit_from = frame->Tree().Parent() ? frame->Tree().Parent()
-                                                   : frame->Client()->Opener();
-      if (inherit_from && frame != inherit_from) {
-        csp_->CopyPluginTypesFrom(
-            inherit_from->GetSecurityContext()->GetContentSecurityPolicy());
-      }
-    }
-  }
+  // A few users of DocumentInit do not specify the CSP to be used. An empty CSP
+  // is used in this case.
+  // TODO(arthursonzogni): Audit every users of DocumentInit::Create() that do
+  // not specify a CSP to be used. Ideally they should be forced to explicitly
+  // choose one.
+  csp_ = MakeGarbageCollected<ContentSecurityPolicy>();
+  bind_csp_immediately_ = true;
 }
 
 void SecurityContextInit::InitializeSandboxFlags(
@@ -218,9 +171,9 @@
     // Document's URL and origin. Instead, force a Document loaded from a
     // MHTML archive to be sandboxed, providing exceptions only for creating
     // new windows.
-    sandbox_flags_ |= (mojom::blink::WebSandboxFlags::kAll &
-                       ~(mojom::blink::WebSandboxFlags::kPopups |
-                         mojom::blink::WebSandboxFlags::
+    sandbox_flags_ |= (network::mojom::blink::WebSandboxFlags::kAll &
+                       ~(network::mojom::blink::WebSandboxFlags::kPopups |
+                         network::mojom::blink::WebSandboxFlags::
                              kPropagatesToAuxiliaryBrowsingContexts));
   }
 }
@@ -228,8 +181,8 @@
 void SecurityContextInit::InitializeOrigin(const DocumentInit& initializer) {
   scoped_refptr<SecurityOrigin> document_origin =
       initializer.GetDocumentOrigin();
-  if ((sandbox_flags_ & mojom::blink::WebSandboxFlags::kOrigin) !=
-      mojom::blink::WebSandboxFlags::kNone) {
+  if ((sandbox_flags_ & network::mojom::blink::WebSandboxFlags::kOrigin) !=
+      network::mojom::blink::WebSandboxFlags::kNone) {
     scoped_refptr<SecurityOrigin> sandboxed_origin =
         initializer.OriginToCommit() ? initializer.OriginToCommit()
                                      : document_origin->DeriveNewOpaqueOrigin();
@@ -337,7 +290,7 @@
       initializer.ReportOnlyFeaturePolicyHeader(), security_origin_,
       &report_only_feature_policy_parse_messages_, this);
 
-  if (sandbox_flags_ != mojom::blink::WebSandboxFlags::kNone &&
+  if (sandbox_flags_ != network::mojom::blink::WebSandboxFlags::kNone &&
       RuntimeEnabledFeatures::FeaturePolicyForSandboxEnabled()) {
     // The sandbox flags might have come from CSP header or the browser; in
     // such cases the sandbox is not part of the container policy. They are
@@ -356,8 +309,8 @@
   // feature policy is initialized.
   if (RuntimeEnabledFeatures::BlockingFocusWithoutUserActivationEnabled() &&
       frame && frame->Tree().Parent() &&
-      (sandbox_flags_ & mojom::blink::WebSandboxFlags::kNavigation) !=
-          mojom::blink::WebSandboxFlags::kNone) {
+      (sandbox_flags_ & network::mojom::blink::WebSandboxFlags::kNavigation) !=
+          network::mojom::blink::WebSandboxFlags::kNone) {
     // Enforcing the policy for sandbox frames (for context see
     // https://crbug.com/954349).
     DisallowFeatureIfNotPresent(
@@ -464,7 +417,7 @@
     secure_context_mode_ = SecureContextMode::kInsecureContext;
   }
   bool is_secure = secure_context_mode_ == SecureContextMode::kSecureContext;
-  if (GetSandboxFlags() != mojom::blink::WebSandboxFlags::kNone) {
+  if (GetSandboxFlags() != network::mojom::blink::WebSandboxFlags::kNone) {
     feature_count_.insert(
         is_secure ? WebFeature::kSecureContextCheckForSandboxedOriginPassed
                   : WebFeature::kSecureContextCheckForSandboxedOriginFailed);

diff --git a/third_party/blink/renderer/core/execution_context/security_context_init.h b/third_party/blink/renderer/core/execution_context/security_context_init.h
index 5546eaf..e615743 100644
--- a/third_party/blink/renderer/core/execution_context/security_context_init.h
+++ b/third_party/blink/renderer/core/execution_context/security_context_init.h

@@ -5,6 +5,7 @@
 #ifndef THIRD_PARTY_BLINK_RENDERER_CORE_EXECUTION_CONTEXT_SECURITY_CONTEXT_INIT_H_
 #define THIRD_PARTY_BLINK_RENDERER_CORE_EXECUTION_CONTEXT_SECURITY_CONTEXT_INIT_H_
 
+#include "services/network/public/mojom/web_sandbox_flags.mojom-blink.h"
 #include "third_party/blink/public/common/feature_policy/feature_policy.h"
 #include "third_party/blink/public/mojom/feature_policy/feature_policy_feature.mojom-blink.h"
 #include "third_party/blink/renderer/core/execution_context/execution_context.h"
@@ -38,7 +39,7 @@
     return security_origin_;
   }
 
-  mojom::blink::WebSandboxFlags GetSandboxFlags() const {
+  network::mojom::blink::WebSandboxFlags GetSandboxFlags() const {
     return sandbox_flags_;
   }
 
@@ -91,8 +92,8 @@
   void InitializeAgent(const DocumentInit&);
 
   scoped_refptr<SecurityOrigin> security_origin_;
-  mojom::blink::WebSandboxFlags sandbox_flags_ =
-      mojom::blink::WebSandboxFlags::kNone;
+  network::mojom::blink::WebSandboxFlags sandbox_flags_ =
+      network::mojom::blink::WebSandboxFlags::kNone;
   DocumentPolicy::ParsedDocumentPolicy document_policy_;
   DocumentPolicy::ParsedDocumentPolicy report_only_document_policy_;
   bool initialized_feature_policy_state_ = false;

diff --git a/third_party/blink/renderer/core/exported/local_frame_client_impl.cc b/third_party/blink/renderer/core/exported/local_frame_client_impl.cc
index 64278a1..6f6720c 100644
--- a/third_party/blink/renderer/core/exported/local_frame_client_impl.cc
+++ b/third_party/blink/renderer/core/exported/local_frame_client_impl.cc

@@ -607,7 +607,7 @@
     navigation_info->initiator_frame_has_download_sandbox_flag =
         frame->GetSecurityContext() &&
         frame->GetSecurityContext()->IsSandboxed(
-            mojom::blink::WebSandboxFlags::kDownloads);
+            network::mojom::blink::WebSandboxFlags::kDownloads);
     navigation_info->initiator_frame_is_ad = frame->IsAdSubframe();
   }
 
@@ -934,12 +934,12 @@
 }
 
 void LocalFrameClientImpl::DidSetFramePolicyHeaders(
-    mojom::blink::WebSandboxFlags sandbox_flags,
+    network::mojom::blink::WebSandboxFlags sandbox_flags,
     const ParsedFeaturePolicy& feature_policy_header,
     const DocumentPolicy::FeatureState& document_policy_header) {
   if (web_frame_->Client()) {
     web_frame_->Client()->DidSetFramePolicyHeaders(
-        static_cast<mojom::blink::WebSandboxFlags>(sandbox_flags),
+        static_cast<network::mojom::blink::WebSandboxFlags>(sandbox_flags),
         feature_policy_header, document_policy_header);
   }
 }

diff --git a/third_party/blink/renderer/core/exported/local_frame_client_impl.h b/third_party/blink/renderer/core/exported/local_frame_client_impl.h
index bd150af..47374d2 100644
--- a/third_party/blink/renderer/core/exported/local_frame_client_impl.h
+++ b/third_party/blink/renderer/core/exported/local_frame_client_impl.h

@@ -200,7 +200,7 @@
   void DidChangeName(const String&) override;
   void DidChangeFramePolicy(Frame* child_frame, const FramePolicy&) override;
   void DidSetFramePolicyHeaders(
-      mojom::blink::WebSandboxFlags,
+      network::mojom::blink::WebSandboxFlags,
       const ParsedFeaturePolicy& fp_header,
       const blink::DocumentPolicy::FeatureState& dp_header) override;
   void DidChangeFrameOwnerProperties(HTMLFrameOwnerElement*) override;

diff --git a/third_party/blink/renderer/core/exported/web_frame.cc b/third_party/blink/renderer/core/exported/web_frame.cc
index 91353f08..489289a 100644
--- a/third_party/blink/renderer/core/exported/web_frame.cc
+++ b/third_party/blink/renderer/core/exported/web_frame.cc

@@ -5,7 +5,6 @@
 #include "third_party/blink/public/web/web_frame.h"
 
 #include <algorithm>
-#include "third_party/blink/public/common/frame/sandbox_flags.h"
 #include "third_party/blink/public/mojom/scroll/scrollbar_mode.mojom-blink.h"
 #include "third_party/blink/public/mojom/security_context/insecure_request_policy.mojom-blink.h"
 #include "third_party/blink/public/web/web_element.h"

diff --git a/third_party/blink/renderer/core/exported/web_frame_test.cc b/third_party/blink/renderer/core/exported/web_frame_test.cc
index afcd8aa4..6907034 100644
--- a/third_party/blink/renderer/core/exported/web_frame_test.cc
+++ b/third_party/blink/renderer/core/exported/web_frame_test.cc

@@ -7084,7 +7084,7 @@
                       const WebWindowFeatures&,
                       const WebString&,
                       WebNavigationPolicy,
-                      mojom::blink::WebSandboxFlags,
+                      network::mojom::blink::WebSandboxFlags,
                       const FeaturePolicy::FeatureState&,
                       const SessionStorageNamespaceId&) override {
     EXPECT_TRUE(false);

diff --git a/third_party/blink/renderer/core/exported/web_remote_frame_impl.cc b/third_party/blink/renderer/core/exported/web_remote_frame_impl.cc
index 56ec1b3..e894691 100644
--- a/third_party/blink/renderer/core/exported/web_remote_frame_impl.cc
+++ b/third_party/blink/renderer/core/exported/web_remote_frame_impl.cc

@@ -261,7 +261,7 @@
 }
 
 void WebRemoteFrameImpl::SetReplicatedSandboxFlags(
-    mojom::blink::WebSandboxFlags flags) {
+    network::mojom::blink::WebSandboxFlags flags) {
   DCHECK(GetFrame());
   GetFrame()->SetReplicatedSandboxFlags(flags);
 }

diff --git a/third_party/blink/renderer/core/exported/web_remote_frame_impl.h b/third_party/blink/renderer/core/exported/web_remote_frame_impl.h
index defdadc8..ff43957 100644
--- a/third_party/blink/renderer/core/exported/web_remote_frame_impl.h
+++ b/third_party/blink/renderer/core/exported/web_remote_frame_impl.h

@@ -78,7 +78,8 @@
   void SetReplicatedOrigin(
       const WebSecurityOrigin&,
       bool is_potentially_trustworthy_opaque_origin) override;
-  void SetReplicatedSandboxFlags(mojom::blink::WebSandboxFlags) override;
+  void SetReplicatedSandboxFlags(
+      network::mojom::blink::WebSandboxFlags) override;
   void SetReplicatedName(const WebString&) override;
   void SetReplicatedFeaturePolicyHeaderAndOpenerPolicies(
       const ParsedFeaturePolicy& parsed_header,

diff --git a/third_party/blink/renderer/core/exported/web_view_test.cc b/third_party/blink/renderer/core/exported/web_view_test.cc
index 970b1a2fc..27efc56 100644
--- a/third_party/blink/renderer/core/exported/web_view_test.cc
+++ b/third_party/blink/renderer/core/exported/web_view_test.cc

@@ -3675,7 +3675,7 @@
                       const WebWindowFeatures&,
                       const WebString& name,
                       WebNavigationPolicy,
-                      mojom::blink::WebSandboxFlags,
+                      network::mojom::blink::WebSandboxFlags,
                       const FeaturePolicy::FeatureState&,
                       const SessionStorageNamespaceId&) override {
     return web_view_helper_.InitializeWithOpener(opener);
@@ -3759,7 +3759,7 @@
                       const WebWindowFeatures&,
                       const WebString& name,
                       WebNavigationPolicy,
-                      mojom::blink::WebSandboxFlags,
+                      network::mojom::blink::WebSandboxFlags,
                       const FeaturePolicy::FeatureState&,
                       const SessionStorageNamespaceId&) override {
     return web_view_;

diff --git a/third_party/blink/renderer/core/frame/csp/content_security_policy.cc b/third_party/blink/renderer/core/frame/csp/content_security_policy.cc
index 80d4832..39c0443 100644
--- a/third_party/blink/renderer/core/frame/csp/content_security_policy.cc
+++ b/third_party/blink/renderer/core/frame/csp/content_security_policy.cc

@@ -29,6 +29,8 @@
 #include <utility>
 
 #include "base/debug/dump_without_crashing.h"
+#include "services/network/public/cpp/web_sandbox_flags.h"
+#include "services/network/public/mojom/web_sandbox_flags.mojom-blink.h"
 #include "third_party/blink/public/mojom/security_context/insecure_request_policy.mojom-blink.h"
 #include "third_party/blink/public/platform/platform.h"
 #include "third_party/blink/public/platform/task_type.h"
@@ -50,7 +52,6 @@
 #include "third_party/blink/renderer/core/frame/local_frame.h"
 #include "third_party/blink/renderer/core/frame/local_frame_client.h"
 #include "third_party/blink/renderer/core/frame/location.h"
-#include "third_party/blink/renderer/core/frame/sandbox_flags.h"
 #include "third_party/blink/renderer/core/html/html_script_element.h"
 #include "third_party/blink/renderer/core/inspector/console_message.h"
 #include "third_party/blink/renderer/platform/bindings/dom_wrapper_world.h"
@@ -156,7 +157,7 @@
       override_inline_style_allowed_(false),
       script_hash_algorithms_used_(kContentSecurityPolicyHashAlgorithmNone),
       style_hash_algorithms_used_(kContentSecurityPolicyHashAlgorithmNone),
-      sandbox_mask_(mojom::blink::WebSandboxFlags::kNone),
+      sandbox_mask_(network::mojom::blink::WebSandboxFlags::kNone),
       require_trusted_types_(false),
       insecure_request_policy_(
           mojom::blink::InsecureRequestPolicy::kLeaveInsecureRequestsAlone) {}
@@ -200,7 +201,7 @@
 
   // Set mixed content checking and sandbox flags, then dump all the parsing
   // error messages, then poke at histograms.
-  if (sandbox_mask_ != mojom::blink::WebSandboxFlags::kNone) {
+  if (sandbox_mask_ != network::mojom::blink::WebSandboxFlags::kNone) {
     Count(WebFeature::kSandboxViaCSP);
     delegate_->SetSandboxFlags(sandbox_mask_);
   }
@@ -928,7 +929,8 @@
   return delegate_ ? delegate_->Url() : KURL();
 }
 
-void ContentSecurityPolicy::EnforceSandboxFlags(SandboxFlags mask) {
+void ContentSecurityPolicy::EnforceSandboxFlags(
+    network::mojom::blink::WebSandboxFlags mask) {
   sandbox_mask_ |= mask;
 }
 

diff --git a/third_party/blink/renderer/core/frame/csp/content_security_policy.h b/third_party/blink/renderer/core/frame/csp/content_security_policy.h
index 54d3b7c..deb8f0d 100644
--- a/third_party/blink/renderer/core/frame/csp/content_security_policy.h
+++ b/third_party/blink/renderer/core/frame/csp/content_security_policy.h

@@ -30,6 +30,7 @@
 #include <utility>
 
 #include "services/network/public/mojom/content_security_policy.mojom-blink.h"
+#include "services/network/public/mojom/web_sandbox_flags.mojom-blink-forward.h"
 #include "third_party/blink/public/mojom/devtools/console_message.mojom-blink.h"
 #include "third_party/blink/public/mojom/security_context/insecure_request_policy.mojom-blink-forward.h"
 #include "third_party/blink/public/platform/web_content_security_policy_struct.h"
@@ -73,7 +74,6 @@
 class SourceLocation;
 enum class ResourceType : uint8_t;
 
-using SandboxFlags = mojom::blink::WebSandboxFlags;
 typedef HeapVector<Member<CSPDirectiveList>> CSPDirectiveListVector;
 typedef HeapVector<Member<ConsoleMessage>> ConsoleMessageVector;
 typedef std::pair<String, network::mojom::ContentSecurityPolicyType>
@@ -101,7 +101,7 @@
   virtual const KURL& Url() const = 0;
 
   // Directives support.
-  virtual void SetSandboxFlags(SandboxFlags) = 0;
+  virtual void SetSandboxFlags(network::mojom::blink::WebSandboxFlags) = 0;
   virtual void SetRequireTrustedTypes() = 0;
   virtual void AddInsecureRequestPolicy(
       mojom::blink::InsecureRequestPolicy) = 0;
@@ -425,7 +425,7 @@
   // Used as <object>'s URL when there is no `src` attribute.
   const KURL FallbackUrlForPlugin() const;
 
-  void EnforceSandboxFlags(SandboxFlags);
+  void EnforceSandboxFlags(network::mojom::blink::WebSandboxFlags);
   void RequireTrustedTypes();
   bool IsRequireTrustedTypes() const { return require_trusted_types_; }
   String EvalDisabledErrorMessage() const;
@@ -486,7 +486,9 @@
   // context will be used for all sandbox checks but there are situations
   // (before installing the document that this CSP will bind to) when
   // there is no execution context to enforce the sandbox flags.
-  SandboxFlags GetSandboxMask() const { return sandbox_mask_; }
+  network::mojom::blink::WebSandboxFlags GetSandboxMask() const {
+    return sandbox_mask_;
+  }
 
   bool HasPolicyFromSource(network::mojom::ContentSecurityPolicySource) const;
 
@@ -577,7 +579,7 @@
   uint8_t style_hash_algorithms_used_;
 
   // State flags used to configure the environment after parsing a policy.
-  SandboxFlags sandbox_mask_;
+  network::mojom::blink::WebSandboxFlags sandbox_mask_;
   bool require_trusted_types_;
   String disable_eval_error_message_;
   mojom::blink::InsecureRequestPolicy insecure_request_policy_;

diff --git a/third_party/blink/renderer/core/frame/csp/content_security_policy_fuzzer.cc b/third_party/blink/renderer/core/frame/csp/content_security_policy_fuzzer.cc
index b6d50a9e..00bef2f 100644
--- a/third_party/blink/renderer/core/frame/csp/content_security_policy_fuzzer.cc
+++ b/third_party/blink/renderer/core/frame/csp/content_security_policy_fuzzer.cc

@@ -30,7 +30,7 @@
   // CSP is bound.
   scoped_refptr<SharedBuffer> empty_document_data = SharedBuffer::Create();
   g_page_holder->GetFrame().Loader().ForceSandboxFlags(
-      mojom::blink::WebSandboxFlags::kAll);
+      network::mojom::blink::WebSandboxFlags::kAll);
   g_page_holder->GetFrame().ForceSynchronousDocumentInstall(
       "text/html", empty_document_data);
   return 0;

diff --git a/third_party/blink/renderer/core/frame/csp/content_security_policy_test.cc b/third_party/blink/renderer/core/frame/csp/content_security_policy_test.cc
index e6206ef3..218b6559 100644
--- a/third_party/blink/renderer/core/frame/csp/content_security_policy_test.cc
+++ b/third_party/blink/renderer/core/frame/csp/content_security_policy_test.cc

@@ -235,15 +235,18 @@
 // delivered in <meta> elements.
 TEST_F(ContentSecurityPolicyTest, SandboxInMeta) {
   csp->BindToDelegate(execution_context->GetContentSecurityPolicyDelegate());
-  EXPECT_EQ(mojom::blink::WebSandboxFlags::kNone, csp->GetSandboxMask());
+  EXPECT_EQ(network::mojom::blink::WebSandboxFlags::kNone,
+            csp->GetSandboxMask());
   csp->DidReceiveHeader("sandbox;", ContentSecurityPolicyType::kEnforce,
                         ContentSecurityPolicySource::kMeta);
-  EXPECT_EQ(mojom::blink::WebSandboxFlags::kNone, csp->GetSandboxMask());
+  EXPECT_EQ(network::mojom::blink::WebSandboxFlags::kNone,
+            csp->GetSandboxMask());
   execution_context->GetSecurityContext().ApplySandboxFlags(
-      mojom::blink::WebSandboxFlags::kAll);
+      network::mojom::blink::WebSandboxFlags::kAll);
   csp->DidReceiveHeader("sandbox;", ContentSecurityPolicyType::kEnforce,
                         ContentSecurityPolicySource::kHTTP);
-  EXPECT_EQ(mojom::blink::WebSandboxFlags::kAll, csp->GetSandboxMask());
+  EXPECT_EQ(network::mojom::blink::WebSandboxFlags::kAll,
+            csp->GetSandboxMask());
 }
 
 // Tests that report-uri directives are discarded from policies
@@ -1657,7 +1660,8 @@
             csp->GetInsecureRequestPolicy());
   EXPECT_FALSE(csp->HasHeaderDeliveredPolicy());
   EXPECT_FALSE(csp->SupportsWasmEval());
-  EXPECT_EQ(mojom::blink::WebSandboxFlags::kNone, csp->GetSandboxMask());
+  EXPECT_EQ(network::mojom::blink::WebSandboxFlags::kNone,
+            csp->GetSandboxMask());
   EXPECT_FALSE(csp->HasPolicyFromSource(ContentSecurityPolicySource::kHTTP));
 }
 

diff --git a/third_party/blink/renderer/core/frame/csp/csp_directive_list.cc b/third_party/blink/renderer/core/frame/csp/csp_directive_list.cc
index faa7557..f6307f0 100644
--- a/third_party/blink/renderer/core/frame/csp/csp_directive_list.cc
+++ b/third_party/blink/renderer/core/frame/csp/csp_directive_list.cc

@@ -15,6 +15,7 @@
 #include "third_party/blink/renderer/core/execution_context/security_context.h"
 #include "third_party/blink/renderer/core/frame/deprecation.h"
 #include "third_party/blink/renderer/core/frame/local_frame.h"
+#include "third_party/blink/renderer/core/frame/sandbox_flags.h"
 #include "third_party/blink/renderer/core/html/html_script_element.h"
 #include "third_party/blink/renderer/core/inspector/console_message.h"
 #include "third_party/blink/renderer/platform/crypto.h"

diff --git a/third_party/blink/renderer/core/frame/csp/execution_context_csp_delegate.cc b/third_party/blink/renderer/core/frame/csp/execution_context_csp_delegate.cc
index 151bb26..00cb8b3 100644
--- a/third_party/blink/renderer/core/frame/csp/execution_context_csp_delegate.cc
+++ b/third_party/blink/renderer/core/frame/csp/execution_context_csp_delegate.cc

@@ -4,6 +4,8 @@
 
 #include "third_party/blink/renderer/core/frame/csp/execution_context_csp_delegate.h"
 
+#include "services/network/public/cpp/web_sandbox_flags.h"
+#include "services/network/public/mojom/web_sandbox_flags.mojom-blink.h"
 #include "third_party/blink/public/common/security_context/insecure_request_policy.h"
 #include "third_party/blink/public/mojom/security_context/insecure_request_policy.mojom-blink.h"
 #include "third_party/blink/renderer/bindings/core/v8/source_location.h"
@@ -49,7 +51,8 @@
   return execution_context_->Url();
 }
 
-void ExecutionContextCSPDelegate::SetSandboxFlags(SandboxFlags mask) {
+void ExecutionContextCSPDelegate::SetSandboxFlags(
+    network::mojom::blink::WebSandboxFlags mask) {
   // Ideally sandbox flags are determined at construction time since
   // sandbox flags influence the security origin and that influences
   // the Agent that is assigned for the ExecutionContext. Changing
@@ -67,7 +70,8 @@
   // already been set on the security context. Meta tags can't set them
   // and we should have already constructed the document with the correct
   // sandbox flags from CSP already.
-  mojom::blink::WebSandboxFlags flags = GetSecurityContext().GetSandboxFlags();
+  network::mojom::blink::WebSandboxFlags flags =
+      GetSecurityContext().GetSandboxFlags();
   CHECK_EQ(flags | mask, flags);
 }
 

diff --git a/third_party/blink/renderer/core/frame/csp/execution_context_csp_delegate.h b/third_party/blink/renderer/core/frame/csp/execution_context_csp_delegate.h
index 426ee79..03f8f58d 100644
--- a/third_party/blink/renderer/core/frame/csp/execution_context_csp_delegate.h
+++ b/third_party/blink/renderer/core/frame/csp/execution_context_csp_delegate.h

@@ -28,7 +28,7 @@
   const SecurityOrigin* GetSecurityOrigin() override;
   SecureContextMode GetSecureContextMode() override;
   const KURL& Url() const override;
-  void SetSandboxFlags(SandboxFlags) override;
+  void SetSandboxFlags(network::mojom::blink::WebSandboxFlags) override;
   void SetRequireTrustedTypes() override;
   void AddInsecureRequestPolicy(mojom::blink::InsecureRequestPolicy) override;
   std::unique_ptr<SourceLocation> GetSourceLocation() override;

diff --git a/third_party/blink/renderer/core/frame/document_policy_violation_report_body.h b/third_party/blink/renderer/core/frame/document_policy_violation_report_body.h
index 77e9b63..e6364be6 100644
--- a/third_party/blink/renderer/core/frame/document_policy_violation_report_body.h
+++ b/third_party/blink/renderer/core/frame/document_policy_violation_report_body.h

@@ -24,7 +24,10 @@
       const String& resource_url)
       : LocationReportBody(resource_url),
         feature_id_(feature_id),
-        message_(message),
+        message_("Document policy violation: " +
+                 (message.IsEmpty()
+                      ? feature_id + " is not allowed in this document."
+                      : message)),
         disposition_(disposition) {}
 
   const String& featureId() const { return feature_id_; }

diff --git a/third_party/blink/renderer/core/frame/dom_window.cc b/third_party/blink/renderer/core/frame/dom_window.cc
index 0bf6a7d..db43ab35 100644
--- a/third_party/blink/renderer/core/frame/dom_window.cc
+++ b/third_party/blink/renderer/core/frame/dom_window.cc

@@ -6,6 +6,7 @@
 
 #include <memory>
 
+#include "services/network/public/mojom/web_sandbox_flags.mojom-blink.h"
 #include "third_party/blink/renderer/bindings/core/v8/serialization/post_message_helper.h"
 #include "third_party/blink/renderer/bindings/core/v8/v8_window_post_message_options.h"
 #include "third_party/blink/renderer/bindings/core/v8/window_proxy_manager.h"
@@ -245,26 +246,27 @@
   KURL target_url = local_dom_window
                         ? local_dom_window->document()->Url()
                         : KURL(NullURL(), target_origin->ToString());
-  if (GetFrame()->GetSecurityContext()->IsSandboxed(
-          mojom::blink::WebSandboxFlags::kOrigin) ||
-      accessing_window->document()->IsSandboxed(
-          mojom::blink::WebSandboxFlags::kOrigin)) {
+  using SandboxFlags = network::mojom::blink::WebSandboxFlags;
+  if (GetFrame()->GetSecurityContext()->IsSandboxed(SandboxFlags::kOrigin) ||
+      accessing_window->document()->IsSandboxed(SandboxFlags::kOrigin)) {
     message = "Blocked a frame at \"" +
               SecurityOrigin::Create(active_url)->ToString() +
               "\" from accessing a frame at \"" +
               SecurityOrigin::Create(target_url)->ToString() + "\". ";
-    if (GetFrame()->GetSecurityContext()->IsSandboxed(
-            mojom::blink::WebSandboxFlags::kOrigin) &&
-        accessing_window->document()->IsSandboxed(
-            mojom::blink::WebSandboxFlags::kOrigin))
+
+    if (GetFrame()->GetSecurityContext()->IsSandboxed(SandboxFlags::kOrigin) &&
+        accessing_window->document()->IsSandboxed(SandboxFlags::kOrigin)) {
       return "Sandbox access violation: " + message +
              " Both frames are sandboxed and lack the \"allow-same-origin\" "
              "flag.";
-    if (GetFrame()->GetSecurityContext()->IsSandboxed(
-            mojom::blink::WebSandboxFlags::kOrigin))
+    }
+
+    if (GetFrame()->GetSecurityContext()->IsSandboxed(SandboxFlags::kOrigin)) {
       return "Sandbox access violation: " + message +
              " The frame being accessed is sandboxed and lacks the "
              "\"allow-same-origin\" flag.";
+    }
+
     return "Sandbox access violation: " + message +
            " The frame requesting access is sandboxed and lacks the "
            "\"allow-same-origin\" flag.";

diff --git a/third_party/blink/renderer/core/frame/feature_policy_violation_report_body.h b/third_party/blink/renderer/core/frame/feature_policy_violation_report_body.h
index cb3e321a2..f7d71f9 100644
--- a/third_party/blink/renderer/core/frame/feature_policy_violation_report_body.h
+++ b/third_party/blink/renderer/core/frame/feature_policy_violation_report_body.h

@@ -23,7 +23,10 @@
       const String& resource_url)
       : LocationReportBody(resource_url),
         feature_id_(feature_id),
-        message_(message),
+        message_("Feature policy violation: " +
+                 (message.IsEmpty()
+                      ? feature_id + " is not allowed in this document."
+                      : message)),
         disposition_(disposition) {}
 
   const String& featureId() const { return feature_id_; }

diff --git a/third_party/blink/renderer/core/frame/frame_test_helpers.cc b/third_party/blink/renderer/core/frame/frame_test_helpers.cc
index e3a9ffc4..a91f27b 100644
--- a/third_party/blink/renderer/core/frame/frame_test_helpers.cc
+++ b/third_party/blink/renderer/core/frame/frame_test_helpers.cc

@@ -752,7 +752,7 @@
                                        const WebWindowFeatures&,
                                        const WebString& name,
                                        WebNavigationPolicy,
-                                       mojom::blink::WebSandboxFlags,
+                                       network::mojom::blink::WebSandboxFlags,
                                        const FeaturePolicy::FeatureState&,
                                        const SessionStorageNamespaceId&) {
   auto webview_helper = std::make_unique<WebViewHelper>();

diff --git a/third_party/blink/renderer/core/frame/frame_test_helpers.h b/third_party/blink/renderer/core/frame/frame_test_helpers.h
index 35504d9..414b96f28 100644
--- a/third_party/blink/renderer/core/frame/frame_test_helpers.h
+++ b/third_party/blink/renderer/core/frame/frame_test_helpers.h

@@ -288,7 +288,7 @@
                       const WebWindowFeatures&,
                       const WebString& name,
                       WebNavigationPolicy,
-                      mojom::blink::WebSandboxFlags,
+                      network::mojom::blink::WebSandboxFlags,
                       const FeaturePolicy::FeatureState&,
                       const SessionStorageNamespaceId&) override;
 

diff --git a/third_party/blink/renderer/core/frame/local_dom_window.cc b/third_party/blink/renderer/core/frame/local_dom_window.cc
index 558e2a8..24e4e5b 100644
--- a/third_party/blink/renderer/core/frame/local_dom_window.cc
+++ b/third_party/blink/renderer/core/frame/local_dom_window.cc

@@ -77,7 +77,6 @@
 #include "third_party/blink/renderer/core/frame/local_frame_client.h"
 #include "third_party/blink/renderer/core/frame/local_frame_view.h"
 #include "third_party/blink/renderer/core/frame/navigator.h"
-#include "third_party/blink/renderer/core/frame/sandbox_flags.h"
 #include "third_party/blink/renderer/core/frame/screen.h"
 #include "third_party/blink/renderer/core/frame/settings.h"
 #include "third_party/blink/renderer/core/frame/viewport_data.h"
@@ -935,7 +934,8 @@
   if (!GetFrame())
     return;
 
-  if (document()->IsSandboxed(mojom::blink::WebSandboxFlags::kModals)) {
+  if (document()->IsSandboxed(
+          network::mojom::blink::WebSandboxFlags::kModals)) {
     UseCounter::Count(document(), WebFeature::kDialogInSandboxedContext);
     GetFrameConsole()->AddMessage(MakeGarbageCollected<ConsoleMessage>(
         mojom::ConsoleMessageSource::kSecurity,
@@ -968,7 +968,8 @@
   if (!GetFrame())
     return false;
 
-  if (document()->IsSandboxed(mojom::blink::WebSandboxFlags::kModals)) {
+  if (document()->IsSandboxed(
+          network::mojom::blink::WebSandboxFlags::kModals)) {
     UseCounter::Count(document(), WebFeature::kDialogInSandboxedContext);
     GetFrameConsole()->AddMessage(MakeGarbageCollected<ConsoleMessage>(
         mojom::ConsoleMessageSource::kSecurity,
@@ -1003,7 +1004,8 @@
   if (!GetFrame())
     return String();
 
-  if (document()->IsSandboxed(mojom::blink::WebSandboxFlags::kModals)) {
+  if (document()->IsSandboxed(
+          network::mojom::blink::WebSandboxFlags::kModals)) {
     UseCounter::Count(document(), WebFeature::kDialogInSandboxedContext);
     GetFrameConsole()->AddMessage(MakeGarbageCollected<ConsoleMessage>(
         mojom::ConsoleMessageSource::kSecurity,

diff --git a/third_party/blink/renderer/core/frame/local_frame.cc b/third_party/blink/renderer/core/frame/local_frame.cc
index 0b3593de..d051a7e 100644
--- a/third_party/blink/renderer/core/frame/local_frame.cc
+++ b/third_party/blink/renderer/core/frame/local_frame.cc

@@ -1137,7 +1137,7 @@
   }
 
   if (GetSecurityContext()->IsSandboxed(
-          mojom::blink::WebSandboxFlags::kNavigation)) {
+          network::mojom::blink::WebSandboxFlags::kNavigation)) {
     if (!target_frame.Tree().IsDescendantOf(this) &&
         !target_frame.IsMainFrame()) {
       PrintNavigationErrorMessage(
@@ -1152,10 +1152,10 @@
     // 'allow-popups' flag is specified, or if the
     if (target_frame.IsMainFrame() && target_frame != Tree().Top() &&
         GetSecurityContext()->IsSandboxed(
-            mojom::blink::WebSandboxFlags::
+            network::mojom::blink::WebSandboxFlags::
                 kPropagatesToAuxiliaryBrowsingContexts) &&
         (GetSecurityContext()->IsSandboxed(
-             mojom::blink::WebSandboxFlags::kPopups) ||
+             network::mojom::blink::WebSandboxFlags::kPopups) ||
          target_frame.Client()->Opener() != this)) {
       PrintNavigationErrorMessage(
           target_frame,
@@ -1169,9 +1169,10 @@
     // allow-top-navigation-by-user-activation will also skips origin checks.
     if (target_frame == Tree().Top()) {
       if (GetSecurityContext()->IsSandboxed(
-              mojom::blink::WebSandboxFlags::kTopNavigation) &&
+              network::mojom::blink::WebSandboxFlags::kTopNavigation) &&
           GetSecurityContext()->IsSandboxed(
-              mojom::blink::WebSandboxFlags::kTopNavigationByUserActivation)) {
+              network::mojom::blink::WebSandboxFlags::
+                  kTopNavigationByUserActivation)) {
         PrintNavigationErrorMessage(
             target_frame,
             "The frame attempting navigation of the top-level window is "
@@ -1181,9 +1182,10 @@
       }
 
       if (GetSecurityContext()->IsSandboxed(
-              mojom::blink::WebSandboxFlags::kTopNavigation) &&
+              network::mojom::blink::WebSandboxFlags::kTopNavigation) &&
           !GetSecurityContext()->IsSandboxed(
-              mojom::blink::WebSandboxFlags::kTopNavigationByUserActivation) &&
+              network::mojom::blink::WebSandboxFlags::
+                  kTopNavigationByUserActivation) &&
           !LocalFrame::HasTransientUserActivation(this)) {
         // With only 'allow-top-navigation-by-user-activation' (but not
         // 'allow-top-navigation'), top navigation requires a user gesture.

diff --git a/third_party/blink/renderer/core/frame/local_frame_client.h b/third_party/blink/renderer/core/frame/local_frame_client.h
index c93bc8bd..39961b6 100644
--- a/third_party/blink/renderer/core/frame/local_frame_client.h
+++ b/third_party/blink/renderer/core/frame/local_frame_client.h

@@ -309,7 +309,7 @@
   virtual void DidChangeFramePolicy(Frame* child_frame, const FramePolicy&) {}
 
   virtual void DidSetFramePolicyHeaders(
-      mojom::blink::WebSandboxFlags,
+      network::mojom::blink::WebSandboxFlags,
       const ParsedFeaturePolicy& feature_policy_header,
       const DocumentPolicy::FeatureState& document_policy_header) {}
 

diff --git a/third_party/blink/renderer/core/frame/mhtml_loading_test.cc b/third_party/blink/renderer/core/frame/mhtml_loading_test.cc
index b73fafe..ec2b154f 100644
--- a/third_party/blink/renderer/core/frame/mhtml_loading_test.cc
+++ b/third_party/blink/renderer/core/frame/mhtml_loading_test.cc

@@ -30,6 +30,8 @@
 
 #include "base/bind_helpers.h"
 #include "build/build_config.h"
+#include "services/network/public/cpp/web_sandbox_flags.h"
+#include "services/network/public/mojom/web_sandbox_flags.mojom-blink.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/blink/public/platform/web_string.h"
 #include "third_party/blink/public/platform/web_url.h"
@@ -119,9 +121,9 @@
 
   // Full sandboxing with the exception to new top-level windows should be
   // turned on.
-  EXPECT_EQ(mojom::blink::WebSandboxFlags::kAll &
-                ~(mojom::blink::WebSandboxFlags::kPopups |
-                  mojom::blink::WebSandboxFlags::
+  EXPECT_EQ(network::mojom::blink::WebSandboxFlags::kAll &
+                ~(network::mojom::blink::WebSandboxFlags::kPopups |
+                  network::mojom::blink::WebSandboxFlags::
                       kPropagatesToAuxiliaryBrowsingContexts),
             document->GetSandboxFlags());
 
@@ -140,9 +142,9 @@
   Document* child_document = child_frame->GetDocument();
   ASSERT_TRUE(child_document);
 
-  EXPECT_EQ(mojom::blink::WebSandboxFlags::kAll &
-                ~(mojom::blink::WebSandboxFlags::kPopups |
-                  mojom::blink::WebSandboxFlags::
+  EXPECT_EQ(network::mojom::blink::WebSandboxFlags::kAll &
+                ~(network::mojom::blink::WebSandboxFlags::kPopups |
+                  network::mojom::blink::WebSandboxFlags::
                       kPropagatesToAuxiliaryBrowsingContexts),
             child_document->GetSandboxFlags());
 
@@ -167,9 +169,9 @@
 
   // Full sandboxing with the exception to new top-level windows should be
   // turned on.
-  EXPECT_EQ(mojom::blink::WebSandboxFlags::kAll &
-                ~(mojom::blink::WebSandboxFlags::kPopups |
-                  mojom::blink::WebSandboxFlags::
+  EXPECT_EQ(network::mojom::blink::WebSandboxFlags::kAll &
+                ~(network::mojom::blink::WebSandboxFlags::kPopups |
+                  network::mojom::blink::WebSandboxFlags::
                       kPropagatesToAuxiliaryBrowsingContexts),
             document->GetSandboxFlags());
 

diff --git a/third_party/blink/renderer/core/frame/remote_frame.cc b/third_party/blink/renderer/core/frame/remote_frame.cc
index e49e577b..0d84260 100644
--- a/third_party/blink/renderer/core/frame/remote_frame.cc
+++ b/third_party/blink/renderer/core/frame/remote_frame.cc

@@ -5,6 +5,7 @@
 #include "third_party/blink/renderer/core/frame/remote_frame.h"
 
 #include "cc/layers/surface_layer.h"
+#include "services/network/public/mojom/web_sandbox_flags.mojom-blink.h"
 #include "third_party/blink/public/common/associated_interfaces/associated_interface_provider.h"
 #include "third_party/blink/public/mojom/frame/frame_owner_properties.mojom-blink.h"
 #include "third_party/blink/public/mojom/frame/intrinsic_sizing_info.mojom-blink.h"
@@ -151,7 +152,7 @@
     initiator_frame_has_download_sandbox_flag =
         frame->GetSecurityContext() &&
         frame->GetSecurityContext()->IsSandboxed(
-            mojom::blink::WebSandboxFlags::kDownloads);
+            network::mojom::blink::WebSandboxFlags::kDownloads);
     initiator_frame_is_ad = frame->IsAdSubframe();
     if (frame_request.ClientRedirectReason() != ClientNavigationReason::kNone) {
       probe::FrameRequestedNavigation(frame, this, url,
@@ -324,7 +325,7 @@
 }
 
 void RemoteFrame::SetReplicatedSandboxFlags(
-    mojom::blink::WebSandboxFlags flags) {
+    network::mojom::blink::WebSandboxFlags flags) {
   security_context_.ResetAndEnforceSandboxFlags(flags);
 }
 
@@ -565,8 +566,8 @@
 // ensure that sandbox flags and feature policy are inherited properly if this
 // proxy ever parents a local frame.
 void RemoteFrame::DidSetFramePolicyHeaders(
-    mojom::blink::WebSandboxFlags sandbox_flags,
-    const Vector<ParsedFeaturePolicyDeclaration>& parsed_feature_policy) {
+    network::mojom::blink::WebSandboxFlags sandbox_flags,
+    const WTF::Vector<ParsedFeaturePolicyDeclaration>& parsed_feature_policy) {
   SetReplicatedSandboxFlags(sandbox_flags);
   // Convert from WTF::Vector<ParsedFeaturePolicyDeclaration>
   // to std::vector<ParsedFeaturePolicyDeclaration>, since ParsedFeaturePolicy

diff --git a/third_party/blink/renderer/core/frame/remote_frame.h b/third_party/blink/renderer/core/frame/remote_frame.h
index 15767ce..61fb839 100644
--- a/third_party/blink/renderer/core/frame/remote_frame.h
+++ b/third_party/blink/renderer/core/frame/remote_frame.h

@@ -7,6 +7,7 @@
 
 #include "mojo/public/cpp/bindings/associated_receiver.h"
 #include "mojo/public/cpp/bindings/associated_remote.h"
+#include "services/network/public/mojom/web_sandbox_flags.mojom-blink-forward.h"
 #include "third_party/blink/public/mojom/frame/frame.mojom-blink.h"
 #include "third_party/blink/public/mojom/frame/frame_owner_properties.mojom-blink-forward.h"
 #include "third_party/blink/public/mojom/input/focus_type.mojom-blink-forward.h"
@@ -89,7 +90,7 @@
       const ParsedFeaturePolicy& parsed_header,
       const FeaturePolicy::FeatureState&);
 
-  void SetReplicatedSandboxFlags(mojom::blink::WebSandboxFlags);
+  void SetReplicatedSandboxFlags(network::mojom::blink::WebSandboxFlags);
   void SetInsecureRequestPolicy(mojom::blink::InsecureRequestPolicy);
   void SetInsecureNavigationsSet(const WebVector<unsigned>&);
 
@@ -130,7 +131,7 @@
   void IntrinsicSizingInfoOfChildChanged(
       mojom::blink::IntrinsicSizingInfoPtr sizing_info) override;
   void DidSetFramePolicyHeaders(
-      mojom::blink::WebSandboxFlags,
+      network::mojom::blink::WebSandboxFlags,
       const WTF::Vector<ParsedFeaturePolicyDeclaration>&) override;
   // Updates the snapshotted policy attributes (sandbox flags and feature policy
   // container policy) in the frame's FrameOwner. This is used when this frame's

diff --git a/third_party/blink/renderer/core/frame/sandbox_flags.cc b/third_party/blink/renderer/core/frame/sandbox_flags.cc
index 218f023..b428d83 100644
--- a/third_party/blink/renderer/core/frame/sandbox_flags.cc
+++ b/third_party/blink/renderer/core/frame/sandbox_flags.cc

@@ -26,7 +26,8 @@
 
 #include "third_party/blink/renderer/core/frame/sandbox_flags.h"
 
-#include "third_party/blink/public/common/frame/sandbox_flags.h"
+#include "services/network/public/cpp/web_sandbox_flags.h"
+#include "services/network/public/mojom/web_sandbox_flags.mojom-blink.h"
 #include "third_party/blink/public/mojom/feature_policy/feature_policy.mojom-blink.h"
 #include "third_party/blink/renderer/core/feature_policy/feature_policy_parser.h"
 #include "third_party/blink/renderer/core/html/html_iframe_element.h"
@@ -39,25 +40,28 @@
 namespace blink {
 
 const SandboxFlagFeaturePolicyPairs& SandboxFlagsWithFeaturePolicies() {
-  DEFINE_STATIC_LOCAL(SandboxFlagFeaturePolicyPairs, array,
-                      ({{mojom::blink::WebSandboxFlags::kTopNavigation,
-                         mojom::blink::FeaturePolicyFeature::kTopNavigation},
-                        {mojom::blink::WebSandboxFlags::kForms,
-                         mojom::blink::FeaturePolicyFeature::kFormSubmission},
-                        {mojom::blink::WebSandboxFlags::kScripts,
-                         mojom::blink::FeaturePolicyFeature::kScript},
-                        {mojom::blink::WebSandboxFlags::kPopups,
-                         mojom::blink::FeaturePolicyFeature::kPopups},
-                        {mojom::blink::WebSandboxFlags::kPointerLock,
-                         mojom::blink::FeaturePolicyFeature::kPointerLock},
-                        {mojom::blink::WebSandboxFlags::kModals,
-                         mojom::blink::FeaturePolicyFeature::kModals},
-                        {mojom::blink::WebSandboxFlags::kOrientationLock,
-                         mojom::blink::FeaturePolicyFeature::kOrientationLock},
-                        {mojom::blink::WebSandboxFlags::kPresentationController,
-                         mojom::blink::FeaturePolicyFeature::kPresentation},
-                        {mojom::blink::WebSandboxFlags::kDownloads,
-                         mojom::blink::FeaturePolicyFeature::kDownloads}}));
+  DEFINE_STATIC_LOCAL(
+      SandboxFlagFeaturePolicyPairs, array,
+      ({
+          {network::mojom::blink::WebSandboxFlags::kTopNavigation,
+           mojom::blink::FeaturePolicyFeature::kTopNavigation},
+          {network::mojom::blink::WebSandboxFlags::kForms,
+           mojom::blink::FeaturePolicyFeature::kFormSubmission},
+          {network::mojom::blink::WebSandboxFlags::kScripts,
+           mojom::blink::FeaturePolicyFeature::kScript},
+          {network::mojom::blink::WebSandboxFlags::kPopups,
+           mojom::blink::FeaturePolicyFeature::kPopups},
+          {network::mojom::blink::WebSandboxFlags::kPointerLock,
+           mojom::blink::FeaturePolicyFeature::kPointerLock},
+          {network::mojom::blink::WebSandboxFlags::kModals,
+           mojom::blink::FeaturePolicyFeature::kModals},
+          {network::mojom::blink::WebSandboxFlags::kOrientationLock,
+           mojom::blink::FeaturePolicyFeature::kOrientationLock},
+          {network::mojom::blink::WebSandboxFlags::kPresentationController,
+           mojom::blink::FeaturePolicyFeature::kPresentation},
+          {network::mojom::blink::WebSandboxFlags::kDownloads,
+           mojom::blink::FeaturePolicyFeature::kDownloads},
+      }));
   return array;
 }
 
@@ -65,64 +69,65 @@
 // corresponding feature policies. With FeaturePolicyForSandbox, these flags
 // are always removed from the set of sandbox flags set for a sandboxed
 // <iframe> (those sandbox flags are now contained in the |ContainerPolicy|).
-mojom::blink::WebSandboxFlags SandboxFlagsImplementedByFeaturePolicy() {
-  DEFINE_STATIC_LOCAL(mojom::blink::WebSandboxFlags, mask,
-                      (mojom::blink::WebSandboxFlags::kNone));
-  if (mask == mojom::blink::WebSandboxFlags::kNone) {
+network::mojom::blink::WebSandboxFlags
+SandboxFlagsImplementedByFeaturePolicy() {
+  DEFINE_STATIC_LOCAL(network::mojom::blink::WebSandboxFlags, mask,
+                      (network::mojom::blink::WebSandboxFlags::kNone));
+  if (mask == network::mojom::blink::WebSandboxFlags::kNone) {
     for (const auto& pair : SandboxFlagsWithFeaturePolicies())
       mask |= pair.first;
   }
   return mask;
 }
 
-mojom::blink::WebSandboxFlags ParseSandboxPolicy(
+network::mojom::blink::WebSandboxFlags ParseSandboxPolicy(
     const SpaceSplitString& policy,
     String& invalid_tokens_error_message) {
   // http://www.w3.org/TR/html5/the-iframe-element.html#attr-iframe-sandbox
   // Parse the unordered set of unique space-separated tokens.
-  mojom::blink::WebSandboxFlags flags = mojom::blink::WebSandboxFlags::kAll;
+  network::mojom::blink::WebSandboxFlags flags =
+      network::mojom::blink::WebSandboxFlags::kAll;
   unsigned length = policy.size();
   unsigned number_of_token_errors = 0;
   StringBuilder token_errors;
 
+  using SandboxFlags = network::mojom::blink::WebSandboxFlags;
+
   for (unsigned index = 0; index < length; index++) {
     // Turn off the corresponding sandbox flag if it's set as "allowed".
     String sandbox_token(policy[index]);
     if (EqualIgnoringASCIICase(sandbox_token, "allow-same-origin")) {
-      flags = flags & ~mojom::blink::WebSandboxFlags::kOrigin;
+      flags = flags & ~SandboxFlags::kOrigin;
     } else if (EqualIgnoringASCIICase(sandbox_token, "allow-forms")) {
-      flags = flags & ~mojom::blink::WebSandboxFlags::kForms;
+      flags = flags & ~SandboxFlags::kForms;
     } else if (EqualIgnoringASCIICase(sandbox_token, "allow-scripts")) {
-      flags = flags & ~mojom::blink::WebSandboxFlags::kScripts;
-      flags = flags & ~mojom::blink::WebSandboxFlags::kAutomaticFeatures;
+      flags = flags & ~SandboxFlags::kScripts;
+      flags = flags & ~SandboxFlags::kAutomaticFeatures;
     } else if (EqualIgnoringASCIICase(sandbox_token, "allow-top-navigation")) {
-      flags = flags & ~mojom::blink::WebSandboxFlags::kTopNavigation;
+      flags = flags & ~SandboxFlags::kTopNavigation;
     } else if (EqualIgnoringASCIICase(sandbox_token, "allow-popups")) {
-      flags = flags & ~mojom::blink::WebSandboxFlags::kPopups;
+      flags = flags & ~SandboxFlags::kPopups;
     } else if (EqualIgnoringASCIICase(sandbox_token, "allow-pointer-lock")) {
-      flags = flags & ~mojom::blink::WebSandboxFlags::kPointerLock;
+      flags = flags & ~SandboxFlags::kPointerLock;
     } else if (EqualIgnoringASCIICase(sandbox_token,
                                       "allow-orientation-lock")) {
-      flags = flags & ~mojom::blink::WebSandboxFlags::kOrientationLock;
+      flags = flags & ~SandboxFlags::kOrientationLock;
     } else if (EqualIgnoringASCIICase(sandbox_token,
                                       "allow-popups-to-escape-sandbox")) {
-      flags = flags & ~mojom::blink::WebSandboxFlags::
-                          kPropagatesToAuxiliaryBrowsingContexts;
+      flags = flags & ~SandboxFlags::kPropagatesToAuxiliaryBrowsingContexts;
     } else if (EqualIgnoringASCIICase(sandbox_token, "allow-modals")) {
-      flags = flags & ~mojom::blink::WebSandboxFlags::kModals;
+      flags = flags & ~SandboxFlags::kModals;
     } else if (EqualIgnoringASCIICase(sandbox_token, "allow-presentation")) {
-      flags = flags & ~mojom::blink::WebSandboxFlags::kPresentationController;
+      flags = flags & ~SandboxFlags::kPresentationController;
     } else if (EqualIgnoringASCIICase(
                    sandbox_token, "allow-top-navigation-by-user-activation")) {
-      flags = flags &
-              ~mojom::blink::WebSandboxFlags::kTopNavigationByUserActivation;
+      flags = flags & ~SandboxFlags::kTopNavigationByUserActivation;
     } else if (EqualIgnoringASCIICase(sandbox_token, "allow-downloads")) {
-      flags = flags & ~mojom::blink::WebSandboxFlags::kDownloads;
+      flags = flags & ~SandboxFlags::kDownloads;
     } else if (RuntimeEnabledFeatures::StorageAccessAPIEnabled() &&
                EqualIgnoringASCIICase(
                    sandbox_token, "allow-storage-access-by-user-activation")) {
-      flags = flags &
-              ~mojom::blink::WebSandboxFlags::kStorageAccessByUserActivation;
+      flags = flags & ~SandboxFlags::kStorageAccessByUserActivation;
     } else {
       token_errors.Append(token_errors.IsEmpty() ? "'" : ", '");
       token_errors.Append(sandbox_token);
@@ -143,17 +148,19 @@
 
 // Removes a certain set of flags from |sandbox_flags| for which we have feature
 // policies implemented.
-mojom::blink::WebSandboxFlags GetSandboxFlagsNotImplementedAsFeaturePolicy(
-    mojom::blink::WebSandboxFlags sandbox_flags) {
+network::mojom::blink::WebSandboxFlags
+GetSandboxFlagsNotImplementedAsFeaturePolicy(
+    network::mojom::blink::WebSandboxFlags sandbox_flags) {
   // Punch all the sandbox flags which are converted to feature policy.
   return sandbox_flags & ~SandboxFlagsImplementedByFeaturePolicy();
 }
 
 void ApplySandboxFlagsToParsedFeaturePolicy(
-    mojom::blink::WebSandboxFlags sandbox_flags,
+    network::mojom::blink::WebSandboxFlags sandbox_flags,
     ParsedFeaturePolicy& parsed_feature_policy) {
   for (const auto& pair : SandboxFlagsWithFeaturePolicies()) {
-    if ((sandbox_flags & pair.first) != mojom::blink::WebSandboxFlags::kNone)
+    if ((sandbox_flags & pair.first) !=
+        network::mojom::blink::WebSandboxFlags::kNone)
       DisallowFeatureIfNotPresent(pair.second, parsed_feature_policy);
   }
 }

diff --git a/third_party/blink/renderer/core/frame/sandbox_flags.h b/third_party/blink/renderer/core/frame/sandbox_flags.h
index 817d836..87bae2e 100644
--- a/third_party/blink/renderer/core/frame/sandbox_flags.h
+++ b/third_party/blink/renderer/core/frame/sandbox_flags.h

@@ -27,16 +27,15 @@
 #ifndef THIRD_PARTY_BLINK_RENDERER_CORE_FRAME_SANDBOX_FLAGS_H_
 #define THIRD_PARTY_BLINK_RENDERER_CORE_FRAME_SANDBOX_FLAGS_H_
 
+#include "services/network/public/mojom/web_sandbox_flags.mojom-blink-forward.h"
 #include "third_party/blink/public/common/feature_policy/feature_policy.h"
-#include "third_party/blink/public/common/frame/sandbox_flags.h"
-#include "third_party/blink/public/mojom/feature_policy/feature_policy.mojom-blink-forward.h"
 #include "third_party/blink/public/mojom/feature_policy/feature_policy_feature.mojom-blink-forward.h"
 #include "third_party/blink/renderer/core/dom/space_split_string.h"
 #include "third_party/blink/renderer/platform/wtf/forward.h"
 
 namespace blink {
 using SandboxFlagFeaturePolicyPairs =
-    Vector<std::pair<mojom::blink::WebSandboxFlags,
+    Vector<std::pair<network::mojom::blink::WebSandboxFlags,
                      mojom::blink::FeaturePolicyFeature>>;
 
 // Returns a vector of pairs of sandbox flags and the corresponding feature
@@ -44,21 +43,23 @@
 // yet migrated to using feature policies.
 const SandboxFlagFeaturePolicyPairs& SandboxFlagsWithFeaturePolicies();
 
-mojom::blink::WebSandboxFlags ParseSandboxPolicy(
+network::mojom::blink::WebSandboxFlags ParseSandboxPolicy(
     const SpaceSplitString& policy,
     String& invalid_tokens_error_message);
 
 // With FeaturePolicyForSandbox most sandbox flags will be represented with
 // features. This method returns the part of sandbox flags which were not mapped
 // to corresponding features.
-mojom::blink::WebSandboxFlags GetSandboxFlagsNotImplementedAsFeaturePolicy(
-    mojom::blink::WebSandboxFlags);
+network::mojom::blink::WebSandboxFlags
+    GetSandboxFlagsNotImplementedAsFeaturePolicy(
+        network::mojom::blink::WebSandboxFlags);
 
 // Applies the sandbox flags as parsed feature policies; If a flag is present
 // both in the provided flags and in the parsed feature as a feature policy,
 // the parsed policy takes precedence.
-void ApplySandboxFlagsToParsedFeaturePolicy(mojom::blink::WebSandboxFlags,
-                                            ParsedFeaturePolicy&);
+void ApplySandboxFlagsToParsedFeaturePolicy(
+    network::mojom::blink::WebSandboxFlags,
+    ParsedFeaturePolicy&);
 
 }  // namespace blink
 

diff --git a/third_party/blink/renderer/core/frame/web_local_frame_impl.cc b/third_party/blink/renderer/core/frame/web_local_frame_impl.cc
index f0255b4..8944b0e 100644
--- a/third_party/blink/renderer/core/frame/web_local_frame_impl.cc
+++ b/third_party/blink/renderer/core/frame/web_local_frame_impl.cc

@@ -95,6 +95,8 @@
 #include "build/build_config.h"
 #include "mojo/public/cpp/bindings/pending_associated_receiver.h"
 #include "mojo/public/cpp/bindings/pending_associated_remote.h"
+#include "services/network/public/cpp/web_sandbox_flags.h"
+#include "services/network/public/mojom/web_sandbox_flags.mojom-blink.h"
 #include "third_party/blink/public/common/frame/frame_owner_element_type.h"
 #include "third_party/blink/public/mojom/feature_policy/feature_policy.mojom-blink.h"
 #include "third_party/blink/public/mojom/frame/media_player_action.mojom-blink.h"
@@ -1648,7 +1650,7 @@
     InterfaceRegistry* interface_registry,
     WebFrame* opener,
     const WebString& name,
-    mojom::blink::WebSandboxFlags sandbox_flags,
+    network::mojom::blink::WebSandboxFlags sandbox_flags,
     const FeaturePolicy::FeatureState& opener_feature_state) {
   return WebLocalFrameImpl::CreateMainFrame(
       web_view, client, interface_registry, opener, name, sandbox_flags,
@@ -1671,7 +1673,7 @@
     InterfaceRegistry* interface_registry,
     WebFrame* opener,
     const WebString& name,
-    mojom::blink::WebSandboxFlags sandbox_flags,
+    network::mojom::blink::WebSandboxFlags sandbox_flags,
     const FeaturePolicy::FeatureState& opener_feature_state) {
   auto* frame = MakeGarbageCollected<WebLocalFrameImpl>(
       util::PassKey<WebLocalFrameImpl>(), WebTreeScopeType::kDocument, client,
@@ -1702,8 +1704,8 @@
       client, interface_registry);
   web_frame->SetParent(previous_web_frame->Parent());
   web_frame->SetOpener(previous_web_frame->Opener());
-  mojom::blink::WebSandboxFlags sandbox_flags =
-      mojom::blink::WebSandboxFlags::kNone;
+  network::mojom::blink::WebSandboxFlags sandbox_flags =
+      network::mojom::blink::WebSandboxFlags::kNone;
   FeaturePolicy::FeatureState feature_state;
   if (!previous_frame->Owner()) {
     // Provisional main frames need to force sandbox flags.  This is necessary
@@ -1808,7 +1810,7 @@
     FrameOwner* owner,
     const AtomicString& name,
     WindowAgentFactory* window_agent_factory,
-    mojom::blink::WebSandboxFlags sandbox_flags,
+    network::mojom::blink::WebSandboxFlags sandbox_flags,
     const FeaturePolicy::FeatureState& opener_feature_state) {
   SetCoreFrame(MakeGarbageCollected<LocalFrame>(local_frame_client_.Get(), page,
                                                 owner, window_agent_factory,
@@ -2288,11 +2290,12 @@
   GetFrame()->CopyImageAtViewportPoint(IntPoint(pos_in_viewport));
 }
 
-mojom::blink::WebSandboxFlags
+network::mojom::blink::WebSandboxFlags
 WebLocalFrameImpl::EffectiveSandboxFlagsForTesting() const {
   if (!GetFrame())
-    return mojom::blink::WebSandboxFlags::kNone;
-  SandboxFlags flags = GetFrame()->Loader().EffectiveSandboxFlags();
+    return network::mojom::blink::WebSandboxFlags::kNone;
+  network::mojom::blink::WebSandboxFlags flags =
+      GetFrame()->Loader().EffectiveSandboxFlags();
   if (RuntimeEnabledFeatures::FeaturePolicyForSandboxEnabled()) {
     // When some of sandbox flags set in the 'sandbox' attribute are implemented
     // as policies they are removed form the FrameOwner's sandbox flags to avoid
@@ -2309,7 +2312,7 @@
                    ->sandbox_flags_converted_to_feature_policies();
     }
   }
-  return static_cast<mojom::blink::WebSandboxFlags>(flags);
+  return flags;
 }
 
 bool WebLocalFrameImpl::IsAllowedToDownload() const {
@@ -2328,8 +2331,8 @@
            GetFrame()->Owner()->GetFramePolicy().allowed_to_download;
   }
   return (GetFrame()->Loader().PendingEffectiveSandboxFlags() &
-          mojom::blink::WebSandboxFlags::kDownloads) ==
-         mojom::blink::WebSandboxFlags::kNone;
+          network::mojom::blink::WebSandboxFlags::kDownloads) ==
+         network::mojom::blink::WebSandboxFlags::kNone;
 }
 
 void WebLocalFrameImpl::UsageCountChromeLoadTimes(const WebString& metric) {

diff --git a/third_party/blink/renderer/core/frame/web_local_frame_impl.h b/third_party/blink/renderer/core/frame/web_local_frame_impl.h
index a8d2023b..27ede277 100644
--- a/third_party/blink/renderer/core/frame/web_local_frame_impl.h
+++ b/third_party/blink/renderer/core/frame/web_local_frame_impl.h

@@ -39,6 +39,7 @@
 #include "base/util/type_safety/pass_key.h"
 #include "mojo/public/cpp/bindings/pending_associated_receiver.h"
 #include "mojo/public/cpp/bindings/pending_associated_remote.h"
+#include "services/network/public/mojom/web_sandbox_flags.mojom-blink.h"
 #include "third_party/blink/public/mojom/ad_tagging/ad_frame.mojom-blink-forward.h"
 #include "third_party/blink/public/mojom/devtools/devtools_agent.mojom-blink-forward.h"
 #include "third_party/blink/public/mojom/frame/find_in_page.mojom-blink-forward.h"
@@ -237,7 +238,7 @@
       const WebVector<WebString>& words) override;
   void SetContentSettingsClient(WebContentSettingsClient*) override;
   void ReloadImage(const WebNode&) override;
-  mojom::blink::WebSandboxFlags EffectiveSandboxFlagsForTesting()
+  network::mojom::blink::WebSandboxFlags EffectiveSandboxFlagsForTesting()
       const override;
   bool IsAllowedToDownload() const override;
   bool FindForTesting(int identifier,
@@ -335,8 +336,8 @@
       FrameOwner*,
       const AtomicString& name,
       WindowAgentFactory*,
-      mojom::blink::WebSandboxFlags sandbox_flags =
-          mojom::blink::WebSandboxFlags::kNone,
+      network::mojom::blink::WebSandboxFlags sandbox_flags =
+          network::mojom::blink::WebSandboxFlags::kNone,
       const FeaturePolicy::FeatureState& opener_feature_state =
           FeaturePolicy::FeatureState());
   LocalFrame* GetFrame() const { return frame_.Get(); }
@@ -345,13 +346,14 @@
   void WillDetachParent();
   void CollectGarbageForTesting();
 
-  static WebLocalFrameImpl* CreateMainFrame(WebView*,
-                                            WebLocalFrameClient*,
-                                            InterfaceRegistry*,
-                                            WebFrame* opener,
-                                            const WebString& name,
-                                            mojom::blink::WebSandboxFlags,
-                                            const FeaturePolicy::FeatureState&);
+  static WebLocalFrameImpl* CreateMainFrame(
+      WebView*,
+      WebLocalFrameClient*,
+      InterfaceRegistry*,
+      WebFrame* opener,
+      const WebString& name,
+      network::mojom::blink::WebSandboxFlags,
+      const FeaturePolicy::FeatureState&);
   static WebLocalFrameImpl* CreateProvisional(WebLocalFrameClient*,
                                               InterfaceRegistry*,
                                               WebFrame*,

diff --git a/third_party/blink/renderer/core/html/forms/html_form_element.cc b/third_party/blink/renderer/core/html/forms/html_form_element.cc
index 0a4292b..bc7b44a 100644
--- a/third_party/blink/renderer/core/html/forms/html_form_element.cc
+++ b/third_party/blink/renderer/core/html/forms/html_form_element.cc

@@ -266,7 +266,8 @@
     return;
   }
 
-  if (GetDocument().IsSandboxed(mojom::blink::WebSandboxFlags::kForms)) {
+  if (GetDocument().IsSandboxed(
+          network::mojom::blink::WebSandboxFlags::kForms)) {
     GetDocument().AddConsoleMessage(MakeGarbageCollected<ConsoleMessage>(
         mojom::ConsoleMessageSource::kSecurity,
         mojom::ConsoleMessageLevel::kError,
@@ -523,7 +524,8 @@
   DCHECK(submission->Form());
   if (submission->Action().IsEmpty())
     return;
-  if (GetDocument().IsSandboxed(mojom::blink::WebSandboxFlags::kForms)) {
+  if (GetDocument().IsSandboxed(
+          network::mojom::blink::WebSandboxFlags::kForms)) {
     // FIXME: This message should be moved off the console once a solution to
     // https://bugs.webkit.org/show_bug.cgi?id=103274 exists.
     GetDocument().AddConsoleMessage(MakeGarbageCollected<ConsoleMessage>(

diff --git a/third_party/blink/renderer/core/html/forms/text_control_element.cc b/third_party/blink/renderer/core/html/forms/text_control_element.cc
index 3792c003..760634f 100644
--- a/third_party/blink/renderer/core/html/forms/text_control_element.cc
+++ b/third_party/blink/renderer/core/html/forms/text_control_element.cc

@@ -43,6 +43,7 @@
 #include "third_party/blink/renderer/core/editing/selection_template.h"
 #include "third_party/blink/renderer/core/editing/serializers/serialization.h"
 #include "third_party/blink/renderer/core/editing/set_selection_options.h"
+#include "third_party/blink/renderer/core/editing/spellcheck/spell_checker.h"
 #include "third_party/blink/renderer/core/editing/text_affinity.h"
 #include "third_party/blink/renderer/core/editing/visible_position.h"
 #include "third_party/blink/renderer/core/frame/local_frame.h"
@@ -773,6 +774,13 @@
              params.name == html_names::kDisabledAttr) {
     DisabledOrReadonlyAttributeChanged(params.name);
     HTMLFormControlElementWithState::ParseAttribute(params);
+    if (params.new_value.IsNull())
+      return;
+
+    if (HTMLElement* inner_editor = InnerEditorElement()) {
+      if (auto* frame = GetDocument().GetFrame())
+        frame->GetSpellChecker().RemoveSpellingAndGrammarMarkers(*inner_editor);
+    }
   } else {
     HTMLFormControlElementWithState::ParseAttribute(params);
   }

diff --git a/third_party/blink/renderer/core/html/html_anchor_element.cc b/third_party/blink/renderer/core/html/html_anchor_element.cc
index 52212db..a366e2ff 100644
--- a/third_party/blink/renderer/core/html/html_anchor_element.cc
+++ b/third_party/blink/renderer/core/html/html_anchor_element.cc

@@ -81,7 +81,8 @@
         should_intervene_download = true;
     }
   }
-  if (document.IsSandboxed(mojom::blink::WebSandboxFlags::kDownloads)) {
+  if (document.IsSandboxed(
+          network::mojom::blink::WebSandboxFlags::kDownloads)) {
     UseCounter::Count(document, WebFeature::kDownloadInSandbox);
     if (RuntimeEnabledFeatures::BlockingDownloadsInSandboxEnabled())
       should_intervene_download = true;

diff --git a/third_party/blink/renderer/core/html/html_frame_element_base.cc b/third_party/blink/renderer/core/html/html_frame_element_base.cc
index c4018d9..ac51562 100644
--- a/third_party/blink/renderer/core/html/html_frame_element_base.cc
+++ b/third_party/blink/renderer/core/html/html_frame_element_base.cc

@@ -23,6 +23,8 @@
 
 #include "third_party/blink/renderer/core/html/html_frame_element_base.h"
 
+#include "services/network/public/cpp/web_sandbox_flags.h"
+#include "services/network/public/mojom/web_sandbox_flags.mojom-blink.h"
 #include "third_party/blink/renderer/bindings/core/v8/binding_security.h"
 #include "third_party/blink/renderer/bindings/core/v8/script_controller.h"
 #include "third_party/blink/renderer/bindings/core/v8/script_event_listener.h"
@@ -162,9 +164,10 @@
 HTMLFrameElementBase::GetOriginForFeaturePolicy() const {
   // Sandboxed frames have a unique origin.
   if ((GetFramePolicy().sandbox_flags &
-       mojom::blink::WebSandboxFlags::kOrigin) !=
-      mojom::blink::WebSandboxFlags::kNone)
+       network::mojom::blink::WebSandboxFlags::kOrigin) !=
+      network::mojom::blink::WebSandboxFlags::kNone) {
     return SecurityOrigin::CreateUniqueOpaque();
+  }
 
   // If the frame will inherit its origin from the owner, then use the owner's
   // origin when constructing the container policy.

diff --git a/third_party/blink/renderer/core/html/html_frame_owner_element.cc b/third_party/blink/renderer/core/html/html_frame_owner_element.cc
index 9be3773..e7a51a4 100644
--- a/third_party/blink/renderer/core/html/html_frame_owner_element.cc
+++ b/third_party/blink/renderer/core/html/html_frame_owner_element.cc

@@ -274,7 +274,7 @@
 }
 
 void HTMLFrameOwnerElement::SetSandboxFlags(
-    mojom::blink::WebSandboxFlags flags) {
+    network::mojom::blink::WebSandboxFlags flags) {
   frame_policy_.sandbox_flags = flags;
   // Recalculate the container policy in case the allow-same-origin flag has
   // changed.

diff --git a/third_party/blink/renderer/core/html/html_frame_owner_element.h b/third_party/blink/renderer/core/html/html_frame_owner_element.h
index 92cb4da9..fd2751a 100644
--- a/third_party/blink/renderer/core/html/html_frame_owner_element.h
+++ b/third_party/blink/renderer/core/html/html_frame_owner_element.h

@@ -140,7 +140,7 @@
  protected:
   HTMLFrameOwnerElement(const QualifiedName& tag_name, Document&);
 
-  void SetSandboxFlags(mojom::blink::WebSandboxFlags);
+  void SetSandboxFlags(network::mojom::blink::WebSandboxFlags);
   void SetAllowedToDownload(bool allowed) {
     frame_policy_.allowed_to_download = allowed;
   }

diff --git a/third_party/blink/renderer/core/html/html_iframe_element.cc b/third_party/blink/renderer/core/html/html_iframe_element.cc
index 8056ae5..e4307f3 100644
--- a/third_party/blink/renderer/core/html/html_iframe_element.cc
+++ b/third_party/blink/renderer/core/html/html_iframe_element.cc

@@ -24,7 +24,9 @@
 
 #include "third_party/blink/renderer/core/html/html_iframe_element.h"
 
+#include "services/network/public/cpp/web_sandbox_flags.h"
 #include "services/network/public/mojom/trust_tokens.mojom-blink.h"
+#include "services/network/public/mojom/web_sandbox_flags.mojom-blink.h"
 #include "third_party/blink/public/mojom/feature_policy/feature_policy.mojom-blink.h"
 #include "third_party/blink/renderer/bindings/core/v8/v8_html_iframe_element.h"
 #include "third_party/blink/renderer/core/css/css_property_names.h"
@@ -151,22 +153,22 @@
     String invalid_tokens;
     bool feature_policy_for_sandbox =
         RuntimeEnabledFeatures::FeaturePolicyForSandboxEnabled();
-    mojom::blink::WebSandboxFlags current_flags =
+    network::mojom::blink::WebSandboxFlags current_flags =
         value.IsNull()
-            ? mojom::blink::WebSandboxFlags::kNone
+            ? network::mojom::blink::WebSandboxFlags::kNone
             : ParseSandboxPolicy(sandbox_->TokenSet(), invalid_tokens);
     SetAllowedToDownload(
-        (current_flags & mojom::blink::WebSandboxFlags::kDownloads) ==
-        mojom::blink::WebSandboxFlags::kNone);
+        (current_flags & network::mojom::blink::WebSandboxFlags::kDownloads) ==
+        network::mojom::blink::WebSandboxFlags::kNone);
     // With FeaturePolicyForSandbox, sandbox flags are represented as part of
     // the container policies. However, not all sandbox flags are yet converted
     // and for now the residue will stay around in the stored flags.
     // (see https://crbug.com/812381).
-    mojom::blink::WebSandboxFlags sandbox_to_set = current_flags;
+    network::mojom::blink::WebSandboxFlags sandbox_to_set = current_flags;
     sandbox_flags_converted_to_feature_policies_ =
-        mojom::blink::WebSandboxFlags::kNone;
+        network::mojom::blink::WebSandboxFlags::kNone;
     if (feature_policy_for_sandbox &&
-        current_flags != mojom::blink::WebSandboxFlags::kNone) {
+        current_flags != network::mojom::blink::WebSandboxFlags::kNone) {
       // Residue sandbox which will not be mapped to feature policies.
       sandbox_to_set =
           GetSandboxFlagsNotImplementedAsFeaturePolicy(current_flags);
@@ -318,11 +320,11 @@
     // If the frame is sandboxed at all, then warn if feature policy attributes
     // will override the sandbox attributes.
     if (messages && (sandbox_flags_converted_to_feature_policies_ &
-                     mojom::blink::WebSandboxFlags::kNavigation) !=
-                        mojom::blink::WebSandboxFlags::kNone) {
+                     network::mojom::blink::WebSandboxFlags::kNavigation) !=
+                        network::mojom::blink::WebSandboxFlags::kNone) {
       for (const auto& pair : SandboxFlagsWithFeaturePolicies()) {
         if ((sandbox_flags_converted_to_feature_policies_ & pair.first) !=
-                mojom::blink::WebSandboxFlags::kNone &&
+                network::mojom::blink::WebSandboxFlags::kNone &&
             IsFeatureDeclared(pair.second, container_policy)) {
           messages->push_back(String::Format(
               "Allow and Sandbox attributes both mention '%s'. Allow will take "

diff --git a/third_party/blink/renderer/core/html/html_iframe_element.h b/third_party/blink/renderer/core/html/html_iframe_element.h
index 5040896..533dd1d 100644
--- a/third_party/blink/renderer/core/html/html_iframe_element.h
+++ b/third_party/blink/renderer/core/html/html_iframe_element.h

@@ -25,6 +25,7 @@
 #define THIRD_PARTY_BLINK_RENDERER_CORE_HTML_HTML_IFRAME_ELEMENT_H_
 
 #include "services/network/public/mojom/trust_tokens.mojom-blink-forward.h"
+#include "services/network/public/mojom/web_sandbox_flags.mojom-blink.h"
 #include "third_party/blink/public/common/feature_policy/feature_policy.h"
 #include "third_party/blink/public/common/frame/frame_owner_element_type.h"
 #include "third_party/blink/renderer/core/core_export.h"
@@ -62,8 +63,8 @@
     return FrameOwnerElementType::kIframe;
   }
 
-  mojom::blink::WebSandboxFlags sandbox_flags_converted_to_feature_policies()
-      const {
+  network::mojom::blink::WebSandboxFlags
+  sandbox_flags_converted_to_feature_policies() const {
     return sandbox_flags_converted_to_feature_policies_;
   }
 
@@ -111,8 +112,9 @@
   // This represents a subset of sandbox flags set through 'sandbox' attribute
   // that will be converted to feature policies as part of the container
   // policies.
-  mojom::blink::WebSandboxFlags sandbox_flags_converted_to_feature_policies_ =
-      mojom::blink::WebSandboxFlags::kNone;
+  network::mojom::blink::WebSandboxFlags
+      sandbox_flags_converted_to_feature_policies_ =
+          network::mojom::blink::WebSandboxFlags::kNone;
 
   network::mojom::ReferrerPolicy referrer_policy_;
 };

diff --git a/third_party/blink/renderer/core/html/html_plugin_element.cc b/third_party/blink/renderer/core/html/html_plugin_element.cc
index a1564b5..0842af9b 100644
--- a/third_party/blink/renderer/core/html/html_plugin_element.cc
+++ b/third_party/blink/renderer/core/html/html_plugin_element.cc

@@ -732,7 +732,8 @@
 
 bool HTMLPlugInElement::AllowedToLoadPlugin(const KURL& url,
                                             const String& mime_type) {
-  if (GetDocument().IsSandboxed(mojom::blink::WebSandboxFlags::kPlugins)) {
+  if (GetDocument().IsSandboxed(
+          network::mojom::blink::WebSandboxFlags::kPlugins)) {
     GetDocument().AddConsoleMessage(MakeGarbageCollected<ConsoleMessage>(
         mojom::ConsoleMessageSource::kSecurity,
         mojom::ConsoleMessageLevel::kError,

diff --git a/third_party/blink/renderer/core/html/imports/html_import_loader.cc b/third_party/blink/renderer/core/html/imports/html_import_loader.cc
index 063eff4..a921505 100644
--- a/third_party/blink/renderer/core/html/imports/html_import_loader.cc
+++ b/third_party/blink/renderer/core/html/imports/html_import_loader.cc

@@ -96,8 +96,13 @@
     const ResourceResponse& response) {
   DCHECK(controller_);
   DCHECK(!imports_.IsEmpty());
+  Document* master = controller_->Master();
   document_ = MakeGarbageCollected<HTMLDocument>(
-      DocumentInit::CreateWithImportsController(controller_)
+      DocumentInit::Create()
+          .WithImportsController(controller_)
+          .WithContextDocument(master->ContextDocument())
+          .WithRegistrationContext(master->RegistrationContext())
+          .WithContentSecurityPolicy(master->GetContentSecurityPolicy())
           .WithURL(response.CurrentRequestUrl()));
   document_->OpenForNavigation(kAllowAsynchronousParsing, response.MimeType(),
                                "UTF-8");

diff --git a/third_party/blink/renderer/core/html/lazy_load_image_observer_test.cc b/third_party/blink/renderer/core/html/lazy_load_image_observer_test.cc
index f52c648..196253af 100644
--- a/third_party/blink/renderer/core/html/lazy_load_image_observer_test.cc
+++ b/third_party/blink/renderer/core/html/lazy_load_image_observer_test.cc

@@ -322,15 +322,6 @@
                          LazyLoadImagesSimTest,
                          ::testing::Bool() /*is_lazyload_image_enabled*/);
 
-void ExpectResourceIsFullImage(Resource* resource) {
-  EXPECT_TRUE(resource);
-  EXPECT_TRUE(resource->IsLoaded());
-  EXPECT_FALSE(
-      resource->GetResourceRequest().HttpHeaderFields().Contains("range"));
-  EXPECT_EQ(ResourceType::kImage, resource->GetType());
-  EXPECT_FALSE(ToImageResource(resource)->ShouldShowLazyImagePlaceholder());
-}
-
 class ScopedDataSaverSetting {
  public:
   explicit ScopedDataSaverSetting(bool is_data_saver_enabled)
@@ -503,8 +494,6 @@
   EXPECT_FALSE(ConsoleMessages().Contains("unset onload"));
 
   eager_resource.Complete(full_image);
-  ExpectResourceIsFullImage(GetDocument().Fetcher()->CachedResource(
-      KURL("https://example.com/eager.png")));
 
   Compositor().BeginFrame();
   test::RunPendingTasks();
@@ -523,12 +512,7 @@
   EXPECT_FALSE(ConsoleMessages().Contains("unset onload"));
 
   auto_resource->Complete(full_image);
-  ExpectResourceIsFullImage(GetDocument().Fetcher()->CachedResource(
-      KURL("https://example.com/auto.png")));
-
   unset_resource->Complete(full_image);
-  ExpectResourceIsFullImage(GetDocument().Fetcher()->CachedResource(
-      KURL("https://example.com/unset.png")));
 
   Compositor().BeginFrame();
   test::RunPendingTasks();
@@ -544,8 +528,6 @@
   EXPECT_TRUE(ConsoleMessages().Contains("unset onload"));
 
   lazy_resource->Complete(full_image);
-  ExpectResourceIsFullImage(GetDocument().Fetcher()->CachedResource(
-      KURL("https://example.com/lazy.png")));
 
   Compositor().BeginFrame();
   test::RunPendingTasks();
@@ -621,8 +603,6 @@
   partial_image.Append(full_image.data(), 2048U);
 
   eager_resource.Complete(full_image);
-  ExpectResourceIsFullImage(GetDocument().Fetcher()->CachedResource(
-      KURL("https://example.com/eager.png")));
 
   Compositor().BeginFrame();
   test::RunPendingTasks();
@@ -643,18 +623,11 @@
 
   if (!RuntimeEnabledFeatures::LazyImageLoadingEnabled()) {
     lazy_resource->Complete(full_image);
-    ExpectResourceIsFullImage(GetDocument().Fetcher()->CachedResource(
-        KURL("https://example.com/lazy.png")));
   }
 
   if (!IsAutomaticLazyImageLoadingExpected()) {
     auto_resource->Complete(full_image);
-    ExpectResourceIsFullImage(GetDocument().Fetcher()->CachedResource(
-        KURL("https://example.com/auto.png")));
-
     unset_resource->Complete(full_image);
-    ExpectResourceIsFullImage(GetDocument().Fetcher()->CachedResource(
-        KURL("https://example.com/unset.png")));
   }
 
   if (lazy_image_loading_feature_status !=
@@ -679,20 +652,13 @@
     EXPECT_FALSE(ConsoleMessages().Contains("lazy onload"));
 
     lazy_resource->Complete(full_image);
-    ExpectResourceIsFullImage(GetDocument().Fetcher()->CachedResource(
-        KURL("https://example.com/lazy.png")));
 
     if (IsAutomaticLazyImageLoadingExpected()) {
       EXPECT_FALSE(ConsoleMessages().Contains("auto onload"));
       EXPECT_FALSE(ConsoleMessages().Contains("unset onload"));
 
       auto_resource->Complete(full_image);
-      ExpectResourceIsFullImage(GetDocument().Fetcher()->CachedResource(
-          KURL("https://example.com/auto.png")));
-
       unset_resource->Complete(full_image);
-      ExpectResourceIsFullImage(GetDocument().Fetcher()->CachedResource(
-          KURL("https://example.com/unset.png")));
     }
 
     Compositor().BeginFrame();
@@ -813,8 +779,6 @@
     Compositor().BeginFrame();
     test::RunPendingTasks();
     full_resource.Complete(ReadTestImage());
-    ExpectResourceIsFullImage(GetDocument().Fetcher()->CachedResource(
-        KURL("https://example.com/image.png")));
     test::RunPendingTasks();
 
     EXPECT_TRUE(ConsoleMessages().Contains("main body onload"));
@@ -839,8 +803,6 @@
     EXPECT_FALSE(ConsoleMessages().Contains("image onload"));
 
     full_resource.Complete(ReadTestImage());
-    ExpectResourceIsFullImage(GetDocument().Fetcher()->CachedResource(
-        KURL("https://example.com/image.png")));
 
     Compositor().BeginFrame();
     test::RunPendingTasks();
@@ -880,8 +842,6 @@
   test::RunPendingTasks();
 
   full_resource.Complete(ReadTestImage());
-  ExpectResourceIsFullImage(GetDocument().Fetcher()->CachedResource(
-      KURL("https://example.com/image.png")));
 
   Compositor().BeginFrame();
   test::RunPendingTasks();
@@ -911,8 +871,6 @@
   test::RunPendingTasks();
 
   full_resource.Complete(ReadTestImage());
-  ExpectResourceIsFullImage(GetDocument().Fetcher()->CachedResource(
-      KURL("https://example.com/image.png")));
 
   Compositor().BeginFrame();
   test::RunPendingTasks();
@@ -942,8 +900,6 @@
   test::RunPendingTasks();
 
   full_resource.Complete(ReadTestImage());
-  ExpectResourceIsFullImage(GetDocument().Fetcher()->CachedResource(
-      KURL("https://example.com/image.png")));
 
   Compositor().BeginFrame();
   test::RunPendingTasks();
@@ -1025,8 +981,6 @@
 
   // One image should be loaded fully, even though it is below viewport.
   img1.Complete(ReadTestImage());
-  ExpectResourceIsFullImage(GetDocument().Fetcher()->CachedResource(
-      KURL("https://example.com/image.png?id=1")));
   test::RunPendingTasks();
 
   EXPECT_TRUE(ConsoleMessages().Contains("main body onload"));
@@ -1043,8 +997,6 @@
   test::RunPendingTasks();
   img2.Complete(ReadTestImage());
 
-  ExpectResourceIsFullImage(GetDocument().Fetcher()->CachedResource(
-      KURL("https://example.com/image.png?id=2")));
   test::RunPendingTasks();
 
   EXPECT_TRUE(ConsoleMessages().Contains("main body onload"));
@@ -1080,8 +1032,6 @@
   EXPECT_FALSE(ConsoleMessages().Contains("my_image onload"));
 
   image_resource.Complete(ReadTestImage());
-  ExpectResourceIsFullImage(GetDocument().Fetcher()->CachedResource(
-      KURL("https://example.com/image.png")));
 
   Compositor().BeginFrame();
   test::RunPendingTasks();
@@ -1119,8 +1069,6 @@
   EXPECT_FALSE(ConsoleMessages().Contains("my_image onload"));
 
   image_resource.Complete(ReadTestImage());
-  ExpectResourceIsFullImage(GetDocument().Fetcher()->CachedResource(
-      KURL("https://example.com/image.png")));
 
   test::RunPendingTasks();
 
@@ -1203,21 +1151,9 @@
   Vector<char> partial_image;
   partial_image.Append(full_image.data(), 2048U);
 
-  Document* child_frame_document =
-      To<HTMLIFrameElement>(GetDocument().getElementById("child_frame"))
-          ->contentDocument();
-
   eager_resource.Complete(full_image);
-  ExpectResourceIsFullImage(child_frame_document->Fetcher()->CachedResource(
-      KURL("https://example.com/eager.png")));
-
   auto_resource.Complete(full_image);
-  ExpectResourceIsFullImage(child_frame_document->Fetcher()->CachedResource(
-      KURL("https://example.com/auto.png")));
-
   unset_resource.Complete(full_image);
-  ExpectResourceIsFullImage(child_frame_document->Fetcher()->CachedResource(
-      KURL("https://example.com/unset.png")));
 
   Compositor().BeginFrame();
   test::RunPendingTasks();
@@ -1241,8 +1177,6 @@
   test::RunPendingTasks();
 
   lazy_resource.Complete(full_image);
-  ExpectResourceIsFullImage(child_frame_document->Fetcher()->CachedResource(
-      KURL("https://example.com/lazy.png")));
 
   Compositor().BeginFrame();
   test::RunPendingTasks();

diff --git a/third_party/blink/renderer/core/html/media/autoplay_policy.cc b/third_party/blink/renderer/core/html/media/autoplay_policy.cc
index 9e03caf6..f435e76 100644
--- a/third_party/blink/renderer/core/html/media/autoplay_policy.cc
+++ b/third_party/blink/renderer/core/html/media/autoplay_policy.cc

@@ -379,8 +379,9 @@
 
 bool AutoplayPolicy::ShouldAutoplay() {
   if (element_->GetDocument().IsSandboxed(
-          mojom::blink::WebSandboxFlags::kAutomaticFeatures))
+          network::mojom::blink::WebSandboxFlags::kAutomaticFeatures)) {
     return false;
+  }
   return element_->can_autoplay_ && element_->paused_ && element_->Autoplay();
 }
 

diff --git a/third_party/blink/renderer/core/layout/ng/inline/ng_fragment_items.cc b/third_party/blink/renderer/core/layout/ng/inline/ng_fragment_items.cc
index 0f61428..cb55c4a5 100644
--- a/third_party/blink/renderer/core/layout/ng/inline/ng_fragment_items.cc
+++ b/third_party/blink/renderer/core/layout/ng/inline/ng_fragment_items.cc

@@ -23,7 +23,7 @@
       first_line_text_content_(std::move(builder->first_line_text_content_)) {}
 
 void NGFragmentItems::AssociateWithLayoutObject() const {
-  const Vector<scoped_refptr<NGFragmentItem>>* items = &items_;
+  const Vector<scoped_refptr<const NGFragmentItem>>* items = &items_;
   DCHECK(std::all_of(items->begin(), items->end(), [](const auto& item) {
     return !item->DeltaToNextForSameLayoutObject();
   }));
@@ -62,8 +62,7 @@
   if (items_.size() <= 1)
     return;
   LayoutObject* last_object = nullptr;
-  for (const auto& item : base::span<const scoped_refptr<NGFragmentItem>>(
-           items_.begin() + 1, items_.end())) {
+  for (const auto& item : base::make_span(items_.begin() + 1, items_.end())) {
     if (!ShouldAssociateWithLayoutObject(*item)) {
       // These items are not associated and that no need to clear.
       DCHECK_EQ(item->DeltaToNextForSameLayoutObject(), 0u);

diff --git a/third_party/blink/renderer/core/layout/ng/inline/ng_fragment_items.h b/third_party/blink/renderer/core/layout/ng/inline/ng_fragment_items.h
index c98f6929b..490fee2 100644
--- a/third_party/blink/renderer/core/layout/ng/inline/ng_fragment_items.h
+++ b/third_party/blink/renderer/core/layout/ng/inline/ng_fragment_items.h

@@ -20,7 +20,9 @@
  public:
   NGFragmentItems(NGFragmentItemsBuilder* builder);
 
-  const Vector<scoped_refptr<NGFragmentItem>>& Items() const { return items_; }
+  const Vector<scoped_refptr<const NGFragmentItem>>& Items() const {
+    return items_;
+  }
 
   const String& Text(bool first_line) const {
     return UNLIKELY(first_line) ? first_line_text_content_ : text_content_;
@@ -36,7 +38,7 @@
 
  private:
   // TODO(kojii): inline capacity TBD.
-  Vector<scoped_refptr<NGFragmentItem>> items_;
+  Vector<scoped_refptr<const NGFragmentItem>> items_;
   String text_content_;
   String first_line_text_content_;
 };

diff --git a/third_party/blink/renderer/core/layout/ng/inline/ng_fragment_items_builder.cc b/third_party/blink/renderer/core/layout/ng/inline/ng_fragment_items_builder.cc
index 2c132e1..2b0270c4 100644
--- a/third_party/blink/renderer/core/layout/ng/inline/ng_fragment_items_builder.cc
+++ b/third_party/blink/renderer/core/layout/ng/inline/ng_fragment_items_builder.cc

@@ -37,24 +37,22 @@
 #endif
 
   // Reserve the capacity for (children + line box item).
-  wtf_size_t size_before = items_.size();
-  wtf_size_t capacity = size_before + current_line_.size() + 1;
+  const wtf_size_t size_before = items_.size();
+  const wtf_size_t capacity = size_before + current_line_.size() + 1;
   items_.ReserveCapacity(capacity);
   offsets_.ReserveCapacity(capacity);
 
   // Add an empty item so that the start of the line can be set later.
-  wtf_size_t line_start_index = items_.size();
+  const wtf_size_t line_start_index = items_.size();
   items_.Grow(line_start_index + 1);
   offsets_.push_back(offset);
 
   AddItems(current_line_.begin(), current_line_.end());
 
   // All children are added. Create an item for the start of the line.
-  wtf_size_t item_count = items_.size() - line_start_index;
+  const wtf_size_t item_count = items_.size() - line_start_index;
   items_[line_start_index] =
       base::MakeRefCounted<NGFragmentItem>(line, item_count);
-  // TODO(kojii): We probably need an end marker too for the reverse-order
-  // traversals.
 
   // Keep children's offsets relative to |line|. They will be adjusted later in
   // |ConvertToPhysical()|.
@@ -63,6 +61,9 @@
 #if DCHECK_IS_ON()
   current_line_fragment_ = nullptr;
 #endif
+
+  DCHECK_EQ(items_.size(), offsets_.size());
+  DCHECK_LE(items_.size(), capacity);
 }
 
 void NGFragmentItemsBuilder::AddItems(Child* child_begin, Child* child_end) {
@@ -190,10 +191,10 @@
   first_line_text_content_ = items.Text(true);
 }
 
-const Vector<scoped_refptr<NGFragmentItem>>& NGFragmentItemsBuilder::Items(
-    WritingMode writing_mode,
-    TextDirection direction,
-    const PhysicalSize& outer_size) {
+const Vector<scoped_refptr<const NGFragmentItem>>&
+NGFragmentItemsBuilder::Items(WritingMode writing_mode,
+                              TextDirection direction,
+                              const PhysicalSize& outer_size) {
   ConvertToPhysical(writing_mode, direction, outer_size);
   return items_;
 }
@@ -211,13 +212,13 @@
   // convert their logical offsets.
   const WritingMode line_writing_mode = ToLineWritingMode(writing_mode);
 
-  scoped_refptr<NGFragmentItem>* item_iter = items_.begin();
+  scoped_refptr<const NGFragmentItem>* item_iter = items_.begin();
   const LogicalOffset* offset = offsets_.begin();
   for (; item_iter != items_.end(); ++item_iter, ++offset) {
     DCHECK_NE(offset, offsets_.end());
-    NGFragmentItem* item = item_iter->get();
-    item->SetOffset(offset->ConvertToPhysical(writing_mode, direction,
-                                              outer_size, item->Size()));
+    const NGFragmentItem* item = item_iter->get();
+    const_cast<NGFragmentItem*>(item)->SetOffset(offset->ConvertToPhysical(
+        writing_mode, direction, outer_size, item->Size()));
 
     // Transform children of lines separately from children of the block,
     // because they may have different directions from the block. To do
@@ -235,7 +236,7 @@
           item = item_iter->get();
           // Use `kLtr` because inline items are after bidi-reoder, and that
           // their offset is visual, not logical.
-          item->SetOffset(
+          const_cast<NGFragmentItem*>(item)->SetOffset(
               offset->ConvertToPhysical(line_writing_mode, TextDirection::kLtr,
                                         line_box_bounds.size, item->Size()) +
               line_box_bounds.offset);
@@ -250,7 +251,7 @@
 base::Optional<LogicalOffset> NGFragmentItemsBuilder::LogicalOffsetFor(
     const LayoutObject& layout_object) const {
   DCHECK_EQ(items_.size(), offsets_.size());
-  for (const scoped_refptr<NGFragmentItem>& item : items_) {
+  for (const scoped_refptr<const NGFragmentItem>& item : items_) {
     if (item->GetLayoutObject() == &layout_object)
       return offsets_[&item - items_.begin()];
   }

diff --git a/third_party/blink/renderer/core/layout/ng/inline/ng_fragment_items_builder.h b/third_party/blink/renderer/core/layout/ng/inline/ng_fragment_items_builder.h
index b12b8c1..3739bb9 100644
--- a/third_party/blink/renderer/core/layout/ng/inline/ng_fragment_items_builder.h
+++ b/third_party/blink/renderer/core/layout/ng/inline/ng_fragment_items_builder.h

@@ -73,7 +73,7 @@
   // containing block geometry for OOF-positioned nodes.
   //
   // Once this method has been called, new items cannot be added.
-  const Vector<scoped_refptr<NGFragmentItem>>&
+  const Vector<scoped_refptr<const NGFragmentItem>>&
   Items(WritingMode, TextDirection, const PhysicalSize& outer_size);
 
   // Build a |NGFragmentItems|. The builder cannot build twice because data set
@@ -90,7 +90,7 @@
                          TextDirection direction,
                          const PhysicalSize& outer_size);
 
-  Vector<scoped_refptr<NGFragmentItem>> items_;
+  Vector<scoped_refptr<const NGFragmentItem>> items_;
   Vector<LogicalOffset> offsets_;
   String text_content_;
   String first_line_text_content_;

diff --git a/third_party/blink/renderer/core/layout/ng/inline/ng_inline_cursor.h b/third_party/blink/renderer/core/layout/ng/inline/ng_inline_cursor.h
index 21b4a80aa..8069b7ad 100644
--- a/third_party/blink/renderer/core/layout/ng/inline/ng_inline_cursor.h
+++ b/third_party/blink/renderer/core/layout/ng/inline/ng_inline_cursor.h

@@ -45,7 +45,7 @@
   STACK_ALLOCATED();
 
  public:
-  using ItemsSpan = base::span<const scoped_refptr<NGFragmentItem>>;
+  using ItemsSpan = base::span<const scoped_refptr<const NGFragmentItem>>;
 
   const NGPaintFragment* PaintFragment() const { return paint_fragment_; }
   const NGFragmentItem* Item() const { return item_; }
@@ -170,7 +170,7 @@
   STACK_ALLOCATED();
 
  public:
-  using ItemsSpan = base::span<const scoped_refptr<NGFragmentItem>>;
+  using ItemsSpan = base::span<const scoped_refptr<const NGFragmentItem>>;
 
   explicit NGInlineCursor(const LayoutBlockFlow& block_flow);
   explicit NGInlineCursor(const NGFragmentItems& items);

diff --git a/third_party/blink/renderer/core/layout/ng/ng_box_fragment_builder.cc b/third_party/blink/renderer/core/layout/ng/ng_box_fragment_builder.cc
index e9b6c82..6e1bc0f 100644
--- a/third_party/blink/renderer/core/layout/ng/ng_box_fragment_builder.cc
+++ b/third_party/blink/renderer/core/layout/ng/ng_box_fragment_builder.cc

@@ -78,7 +78,7 @@
 }
 
 void GatherInlineContainerFragmentsFromItems(
-    const Vector<scoped_refptr<NGFragmentItem>>& items,
+    const Vector<scoped_refptr<const NGFragmentItem>>& items,
     const PhysicalOffset& box_offset,
     NGBoxFragmentBuilder::InlineContainingBlockMap* inline_containing_block_map,
     HashMap<const LayoutObject*, LineBoxPair>* containing_linebox_map) {

diff --git a/third_party/blink/renderer/core/loader/appcache/application_cache_host_for_frame.cc b/third_party/blink/renderer/core/loader/appcache/application_cache_host_for_frame.cc
index 551b8d5f..c84e4137 100644
--- a/third_party/blink/renderer/core/loader/appcache/application_cache_host_for_frame.cc
+++ b/third_party/blink/renderer/core/loader/appcache/application_cache_host_for_frame.cc

@@ -208,7 +208,7 @@
     const KURL& manifest_url) {
   LocalFrame* frame = document_loader_->GetFrame();
   Document* document = frame->GetDocument();
-  if (document->IsSandboxed(mojom::blink::WebSandboxFlags::kOrigin)) {
+  if (document->IsSandboxed(network::mojom::blink::WebSandboxFlags::kOrigin)) {
     // Prevent sandboxes from establishing application caches.
     SelectCacheWithoutManifest();
     return;

diff --git a/third_party/blink/renderer/core/loader/document_loader.cc b/third_party/blink/renderer/core/loader/document_loader.cc
index c3a549bf..009f19f 100644
--- a/third_party/blink/renderer/core/loader/document_loader.cc
+++ b/third_party/blink/renderer/core/loader/document_loader.cc

@@ -130,7 +130,9 @@
       service_worker_network_provider_(
           std::move(params_->service_worker_network_provider)),
       was_blocked_by_document_policy_(false),
-      was_blocked_by_csp_(false),
+      content_security_policy_(content_security_policy),
+      // The CSP is null when the CSP check done in the FrameLoader failed.
+      was_blocked_by_csp_(!content_security_policy),
       state_(kNotStarted),
       in_commit_data_(false),
       data_buffer_(SharedBuffer::Create()),
@@ -240,27 +242,20 @@
   loading_url_as_empty_document_ =
       !params_->is_static_data && WillLoadUrlAsEmpty(url_);
 
-  if (!loading_url_as_empty_document_) {
-    content_security_policy_ = content_security_policy;
+  if (was_blocked_by_csp_) {
+    // Loading the document was blocked by the CSP check. Pretend that this was
+    // an empty document instead and don't reuse the original URL. More details
+    // in: https://crbug.com/622385.
+    // TODO(https://crbug.com/555418) Remove this once XFO moves to the browser.
 
-    // The CSP are null when the CSP check done in the FrameLoader failed.
-    if (!content_security_policy_) {
-      // Loading the document was blocked by the CSP check. Pretend that
-      // this was an empty document instead and don't reuse the
-      // original URL (https://crbug.com/622385).
-      // TODO(mkwst):  Remove this once XFO moves to the browser.
-      // https://crbug.com/555418.
-
-      // Update |origin_to_commit_| to contain an opaque origin with precursor
-      // information that is consistent with the final request URL.
-      // Note: We can't use |url_| for the origin calculation because
-      // we need to take into account any redirects that may have occurred.
-      const auto request_url_origin =
-          blink::SecurityOrigin::Create(response_.CurrentRequestUrl());
-      origin_to_commit_ = request_url_origin->DeriveNewOpaqueOrigin();
-
-      was_blocked_by_csp_ = true;
-    }
+    // Update |origin_to_commit_| to contain an opaque origin with precursor
+    // information that is consistent with the final request URL.
+    // Note: this doesn't use |url_| for the origin calculation, because
+    // redirects are not yet accounted for (this happens later in
+    // StartLoadingInternal).
+    const auto request_url_origin =
+        blink::SecurityOrigin::Create(response_.CurrentRequestUrl());
+    origin_to_commit_ = request_url_origin->DeriveNewOpaqueOrigin();
   }
 
   if (was_blocked_by_csp_ || was_blocked_by_document_policy_)
@@ -1815,7 +1810,6 @@
 
   // Verify that certain types are not on main frame requests.
   DCHECK_NE(WebURLRequest::kClientLoFiAutoReload, previews_state_);
-  DCHECK_NE(WebURLRequest::kLazyImageLoadDeferred, previews_state_);
   DCHECK_NE(WebURLRequest::kSubresourceRedirectOn, previews_state_);
 
   static_assert(WebURLRequest::kPreviewsStateLast ==

diff --git a/third_party/blink/renderer/core/loader/document_loader.h b/third_party/blink/renderer/core/loader/document_loader.h
index 4395332e..e44fb746 100644
--- a/third_party/blink/renderer/core/loader/document_loader.h
+++ b/third_party/blink/renderer/core/loader/document_loader.h

@@ -486,15 +486,15 @@
   std::unique_ptr<WebServiceWorkerNetworkProvider>
       service_worker_network_provider_;
 
-  bool was_blocked_by_document_policy_;
   DocumentPolicy::ParsedDocumentPolicy document_policy_;
+  bool was_blocked_by_document_policy_;
 
-  Member<ContentSecurityPolicy> content_security_policy_;
+  const Member<ContentSecurityPolicy> content_security_policy_;
+  const bool was_blocked_by_csp_;
+
   ClientHintsPreferences client_hints_preferences_;
   InitialScrollState initial_scroll_state_;
 
-  bool was_blocked_by_csp_;
-
   enum State { kNotStarted, kProvisional, kCommitted, kSentDidFinishLoad };
   State state_;
 

diff --git a/third_party/blink/renderer/core/loader/empty_clients.h b/third_party/blink/renderer/core/loader/empty_clients.h
index 8ebb995..1d9fcae 100644
--- a/third_party/blink/renderer/core/loader/empty_clients.h
+++ b/third_party/blink/renderer/core/loader/empty_clients.h

@@ -134,7 +134,7 @@
                              const FrameLoadRequest&,
                              const AtomicString&,
                              const WebWindowFeatures&,
-                             mojom::blink::WebSandboxFlags,
+                             network::mojom::blink::WebSandboxFlags,
                              const FeaturePolicy::FeatureState&,
                              const SessionStorageNamespaceId&) override {
     return nullptr;

diff --git a/third_party/blink/renderer/core/loader/frame_fetch_context.cc b/third_party/blink/renderer/core/loader/frame_fetch_context.cc
index 51acc01..753e2c7 100644
--- a/third_party/blink/renderer/core/loader/frame_fetch_context.cc
+++ b/third_party/blink/renderer/core/loader/frame_fetch_context.cc

@@ -448,10 +448,6 @@
   if (request.GetPreviewsState() == WebURLRequest::kPreviewsUnspecified) {
     WebURLRequest::PreviewsState request_previews_state =
         document_loader->GetPreviewsState();
-    // The decision of whether or not to enable Client Lo-Fi is made earlier
-    // in the request lifetime, in LocalFrame::MaybeAllowImagePlaceholder(),
-    // so don't add the Client Lo-Fi bit to the request here.
-    request_previews_state &= ~(WebURLRequest::kLazyImageLoadDeferred);
     if (request_previews_state == WebURLRequest::kPreviewsUnspecified)
       request_previews_state = WebURLRequest::kPreviewsOff;
     request.SetPreviewsState(request_previews_state);

diff --git a/third_party/blink/renderer/core/loader/frame_loader.cc b/third_party/blink/renderer/core/loader/frame_loader.cc
index 48b2fa3..16eb691 100644
--- a/third_party/blink/renderer/core/loader/frame_loader.cc
+++ b/third_party/blink/renderer/core/loader/frame_loader.cc

@@ -46,6 +46,8 @@
 #include "services/metrics/public/cpp/ukm_builders.h"
 #include "services/metrics/public/cpp/ukm_recorder.h"
 #include "services/network/public/cpp/features.h"
+#include "services/network/public/cpp/web_sandbox_flags.h"
+#include "services/network/public/mojom/web_sandbox_flags.mojom-blink.h"
 #include "third_party/blink/public/common/features.h"
 #include "third_party/blink/public/mojom/fetch/fetch_api_request.mojom-blink.h"
 #include "third_party/blink/public/mojom/frame/navigation_initiator.mojom-blink.h"
@@ -61,6 +63,7 @@
 #include "third_party/blink/public/web/web_navigation_params.h"
 #include "third_party/blink/renderer/bindings/core/v8/script_controller.h"
 #include "third_party/blink/renderer/bindings/core/v8/serialization/serialized_script_value.h"
+#include "third_party/blink/renderer/core/dom/document_init.h"
 #include "third_party/blink/renderer/core/dom/element.h"
 #include "third_party/blink/renderer/core/dom/ignore_opens_during_unload_count_incrementer.h"
 #include "third_party/blink/renderer/core/events/page_transition_event.h"
@@ -127,6 +130,40 @@
 
 namespace blink {
 
+namespace {
+
+void ApplyOriginPolicy(ContentSecurityPolicy* csp,
+                       const WebOriginPolicy& origin_policy) {
+  // When this function is called. The following lines of code happen
+  // consecutively:
+  // 1) A new empty set of CSP is created.
+  // 2) CSP(s) from the HTTP response are appended.
+  // 3) CSP(s) from the OriginPolicy are appended. [HERE]
+  //
+  // As a result, at the beginning of this function, the set of CSP must not
+  // contain any OriginPolicy's CSP yet.
+  //
+  // TODO(arthursonzogni): HasPolicyFromSource(...) is used only in this DCHECK,
+  // consider removing this function.
+  DCHECK(!csp->HasPolicyFromSource(
+      network::mojom::ContentSecurityPolicySource::kOriginPolicy));
+
+  for (const auto& policy : origin_policy.content_security_policies) {
+    csp->DidReceiveHeader(
+        policy, network::mojom::ContentSecurityPolicyType::kEnforce,
+        network::mojom::ContentSecurityPolicySource::kOriginPolicy);
+  }
+
+  for (const auto& policy :
+       origin_policy.content_security_policies_report_only) {
+    csp->DidReceiveHeader(
+        policy, network::mojom::ContentSecurityPolicyType::kReport,
+        network::mojom::ContentSecurityPolicySource::kOriginPolicy);
+  }
+}
+
+}  // namespace
+
 bool IsBackForwardLoadType(WebFrameLoadType type) {
   return type == WebFrameLoadType::kBackForward;
 }
@@ -178,7 +215,7 @@
 FrameLoader::FrameLoader(LocalFrame* frame)
     : frame_(frame),
       progress_tracker_(MakeGarbageCollected<ProgressTracker>(frame)),
-      forced_sandbox_flags_(mojom::blink::WebSandboxFlags::kNone),
+      forced_sandbox_flags_(network::mojom::blink::WebSandboxFlags::kNone),
       dispatching_did_clear_window_object_in_main_world_(false),
       detached_(false),
       virtual_time_pauser_(
@@ -212,8 +249,7 @@
                       : base::nullopt;
 
   DocumentLoader* new_document_loader = Client()->CreateDocumentLoader(
-      frame_, kWebNavigationTypeOther,
-      MakeGarbageCollected<ContentSecurityPolicy>(),
+      frame_, kWebNavigationTypeOther, CreateCSPForInitialEmptyDocument(),
       std::move(navigation_params), nullptr /* extra_data */);
 
   CommitDocumentLoader(new_document_loader, base::nullopt, nullptr,
@@ -539,9 +575,10 @@
       return false;
 
     if (frame_->Owner() && ((frame_->Owner()->GetFramePolicy().sandbox_flags &
-                             mojom::blink::WebSandboxFlags::kOrigin) !=
-                            mojom::blink::WebSandboxFlags::kNone))
+                             network::mojom::blink::WebSandboxFlags::kOrigin) !=
+                            network::mojom::blink::WebSandboxFlags::kNone)) {
       return false;
+    }
   }
 
   if (!request.CanDisplay(url)) {
@@ -702,25 +739,33 @@
   network::mojom::blink::CSPSourcePtr initiator_self_source;
   if (origin_document && origin_document->GetContentSecurityPolicy()
                              ->ExperimentalFeaturesEnabled()) {
-    initiator_csp = origin_document->GetContentSecurityPolicy()
-                        ->ExposeForNavigationalChecks();
-    initiator_self_source = origin_document->GetContentSecurityPolicy()
-                                ->GetSelfSource()
-                                ->ExposeForNavigationalChecks();
+    ContentSecurityPolicy* origin_document_csp =
+        origin_document->GetContentSecurityPolicy();
+    CSPSource* origin_document_csp_self_source =
+        origin_document_csp->GetSelfSource();
+
+    initiator_csp = origin_document_csp->ExposeForNavigationalChecks();
+    if (origin_document_csp_self_source) {
+      initiator_self_source =
+          origin_document_csp_self_source->ExposeForNavigationalChecks();
+    }
     origin_document->NavigationInitiator().BindReceiver(
         navigation_initiator.InitWithNewPipeAndPassReceiver());
   }
 
+  // Record the document that has initiated this navigation. It will be used at
+  // navigation commit time for inheritance.
+  // TODO(arthursonzogni): This looks very fragile. It seems easy to confuse the
+  // FrameLoader by starting several navigations in a row. We should get rid of
+  // this.
+  last_origin_document_csp_ = MakeGarbageCollected<ContentSecurityPolicy>();
   if (origin_document && origin_document->GetContentSecurityPolicy()) {
-    last_origin_document_csp_ = MakeGarbageCollected<ContentSecurityPolicy>();
     last_origin_document_csp_->CopyStateFrom(
         origin_document->GetContentSecurityPolicy());
-    last_origin_document_csp_->CopyPluginTypesFrom(
-        origin_document->GetContentSecurityPolicy());
   }
 
-  // Record the latest requiredCSP value that will be used when sending this
-  // request.
+  // Record the latest requiredCSP value that will be used when loading the
+  // document at navigation commit time.
   RecordLatestRequiredCSP();
 
   // TODO(arthursonzogni): 'frame-src' check is disabled on the
@@ -944,20 +989,12 @@
   DCHECK(!StateMachine()->CreatingInitialEmptyDocument());
   HistoryItem* previous_history_item = GetDocumentLoader()->GetHistoryItem();
 
-  bool loading_url_as_empty_document =
-      !navigation_params->is_static_data &&
-      DocumentLoader::WillLoadUrlAsEmpty(navigation_params->url);
-
-  // Check if the CSP of the response allow should block the new document from
+  // Check if the CSP of the response should block the new document from
   // committing before unloading the current document. This will allow to report
   // violations and display console messages properly.
-  ContentSecurityPolicy* content_security_policy;
-  if (!loading_url_as_empty_document) {
-    content_security_policy =
-        CreateCSP(navigation_params->url,
-                  navigation_params->response.ToResourceResponse(),
-                  navigation_params->origin_policy);
-  }
+  ContentSecurityPolicy* content_security_policy = CreateCSP(
+      navigation_params->url, navigation_params->response.ToResourceResponse(),
+      navigation_params->origin_policy, last_origin_document_csp_.Release());
 
   base::Optional<Document::UnloadEventTiming> unload_timing;
   FrameSwapScope frame_swap_scope(frame_owner);
@@ -1424,11 +1461,12 @@
   // be considered when deciding whether to reuse it.
   // Spec:
   // https://html.spec.whatwg.org/C/#initialise-the-document-object
-  if ((csp &&
-       (csp->GetSandboxMask() & mojom::blink::WebSandboxFlags::kOrigin) !=
-           mojom::blink::WebSandboxFlags::kNone) ||
-      ((EffectiveSandboxFlags() & mojom::blink::WebSandboxFlags::kOrigin) !=
-       mojom::blink::WebSandboxFlags::kNone)) {
+  if ((csp && (csp->GetSandboxMask() &
+               network::mojom::blink::WebSandboxFlags::kOrigin) !=
+                  network::mojom::blink::WebSandboxFlags::kNone) ||
+      ((EffectiveSandboxFlags() &
+        network::mojom::blink::WebSandboxFlags::kOrigin) !=
+       network::mojom::blink::WebSandboxFlags::kNone)) {
     return false;
   }
 
@@ -1494,6 +1532,16 @@
   // The frame might be detached at this point.
 }
 
+void FrameLoader::ForceSandboxFlags(
+    network::mojom::blink::WebSandboxFlags flags) {
+  forced_sandbox_flags_ |= flags;
+}
+
+void FrameLoader::SetFrameOwnerSandboxFlags(
+    network::mojom::blink::WebSandboxFlags flags) {
+  frame_owner_sandbox_flags_ = flags;
+}
+
 void FrameLoader::DispatchDidClearDocumentOfWindowObject() {
   DCHECK(frame_->GetDocument());
   if (state_machine_.CreatingInitialEmptyDocument())
@@ -1529,8 +1577,9 @@
   Client()->DispatchDidClearWindowObjectInMainWorld();
 }
 
-SandboxFlags FrameLoader::EffectiveSandboxFlags() const {
-  SandboxFlags flags = forced_sandbox_flags_;
+network::mojom::blink::WebSandboxFlags FrameLoader::EffectiveSandboxFlags()
+    const {
+  network::mojom::blink::WebSandboxFlags flags = forced_sandbox_flags_;
   if (frame_->Owner()) {
     // Cannot use flags in frame_owner->GetFramePolicy().sandbox_flags, because
     // frame_owner's frame policy is volatile and can be changed by javascript
@@ -1546,8 +1595,9 @@
   return flags;
 }
 
-SandboxFlags FrameLoader::PendingEffectiveSandboxFlags() const {
-  SandboxFlags flags = forced_sandbox_flags_;
+network::mojom::blink::WebSandboxFlags
+FrameLoader::PendingEffectiveSandboxFlags() const {
+  network::mojom::blink::WebSandboxFlags flags = forced_sandbox_flags_;
   if (FrameOwner* frame_owner = frame_->Owner())
     flags |= frame_owner->GetFramePolicy().sandbox_flags;
   // Frames need to inherit the sandbox flags of their parent frame.
@@ -1692,72 +1742,115 @@
          client_navigation_->is_history_navigation_in_new_frame;
 }
 
+ContentSecurityPolicy* FrameLoader::CreateCSPForInitialEmptyDocument() const {
+  ContentSecurityPolicy* csp = MakeGarbageCollected<ContentSecurityPolicy>();
+
+  Frame* owner_frame = frame_->Tree().Parent() ? frame_->Tree().Parent()
+                                               : frame_->Client()->Opener();
+  if (owner_frame) {
+    ContentSecurityPolicy* owner_csp =
+        owner_frame->GetSecurityContext()->GetContentSecurityPolicy();
+    csp->CopyStateFrom(owner_csp);
+  }
+
+  return csp;
+}
+
 ContentSecurityPolicy* FrameLoader::CreateCSP(
     const KURL& url,
     const ResourceResponse& response,
-    const base::Optional<WebOriginPolicy>& origin_policy) {
-  auto* csp = MakeGarbageCollected<ContentSecurityPolicy>();
-
+    const base::Optional<WebOriginPolicy>& origin_policy,
+    ContentSecurityPolicy* initiator_csp) {
+  // about:srcdoc inherits CSP from its parent.
   if (url.IsAboutSrcdocURL()) {
-    // about:srcdoc always inherits CSP from its parent.
-    ContentSecurityPolicy* parent_csp = frame_->Tree()
-                                            .Parent()
-                                            ->GetSecurityContext()
-                                            ->GetContentSecurityPolicy();
-    csp->CopyStateFrom(parent_csp);
-    csp->CopyPluginTypesFrom(parent_csp);
+    ContentSecurityPolicy* csp = MakeGarbageCollected<ContentSecurityPolicy>();
+    csp->CopyStateFrom(frame_->Tree()
+                           .Parent()
+                           ->GetSecurityContext()
+                           ->GetContentSecurityPolicy());
     return csp;
   }
 
+  // Documents with a local-scheme inherits CSP from their navigation initiator.
+  bool is_local_scheme = url.IsEmpty() || url.ProtocolIsAbout() ||
+                         url.ProtocolIsData() || url.ProtocolIs("blob") ||
+                         url.ProtocolIs("filesystem");
+  if (is_local_scheme) {
+    if (initiator_csp)
+      return initiator_csp;
+    return MakeGarbageCollected<ContentSecurityPolicy>();
+  }
+
+  // In the main case (outside of the ones above), CSP(s) are NOT inherited.
+  // Otherwise, it would allow a malicious parent/opener to block some
+  // iframe/popup's script at a fine-grained level.
+
+  ContentSecurityPolicy* csp = MakeGarbageCollected<ContentSecurityPolicy>();
   csp->SetOverrideURLForSelf(response.CurrentRequestUrl());
 
-  if (!frame_->GetSettings()->BypassCSP()) {
-    csp->DidReceiveHeaders(ContentSecurityPolicyResponseHeaders(response));
+  if (frame_->GetSettings()->BypassCSP())
+    return csp;  // Empty CSP.
 
-    // Handle OriginPolicy. We can skip the entire block if the OP policies have
-    // already been passed down.
-    if (origin_policy.has_value() &&
-        !csp->HasPolicyFromSource(
-            network::mojom::ContentSecurityPolicySource::kOriginPolicy)) {
-      for (const auto& policy : origin_policy->content_security_policies) {
-        csp->DidReceiveHeader(
-            policy, network::mojom::ContentSecurityPolicyType::kEnforce,
-            network::mojom::ContentSecurityPolicySource::kOriginPolicy);
-      }
+  // Parse CSP from the HTTP response.
+  csp->DidReceiveHeaders(ContentSecurityPolicyResponseHeaders(response));
 
-      for (const auto& policy :
-           origin_policy->content_security_policies_report_only) {
-        csp->DidReceiveHeader(
-            policy, network::mojom::ContentSecurityPolicyType::kReport,
-            network::mojom::ContentSecurityPolicySource::kOriginPolicy);
-      }
-    }
-  }
+  // Retrieve CSP stored in the OriginPolicy.
+  if (origin_policy)
+    ApplyOriginPolicy(csp, origin_policy.value());
+
+  // Check CSP frame-ancestor:
   if (!base::FeatureList::IsEnabled(
           network::features::kOutOfBlinkFrameAncestors)) {
-    if (!csp->AllowAncestors(frame_, response.CurrentRequestUrl())) {
-      return nullptr;
-    }
+    if (!csp->AllowAncestors(frame_, response.CurrentRequestUrl()))
+      return nullptr;  // Document blocked.
   }
 
-  if (!frame_->GetSettings()->BypassCSP() && !RequiredCSP().IsEmpty()) {
-    const SecurityOrigin* parent_security_origin =
-        frame_->Tree().Parent()->GetSecurityContext()->GetSecurityOrigin();
-    if (parent_security_origin &&
-        ContentSecurityPolicy::ShouldEnforceEmbeddersPolicy(
-            response, parent_security_origin)) {
-      csp->AddPolicyFromHeaderValue(
-          RequiredCSP(), network::mojom::ContentSecurityPolicyType::kEnforce,
-          network::mojom::ContentSecurityPolicySource::kHTTP);
-    } else {
-      auto* required_csp = MakeGarbageCollected<ContentSecurityPolicy>();
-      required_csp->AddPolicyFromHeaderValue(
-          RequiredCSP(), network::mojom::ContentSecurityPolicyType::kEnforce,
-          network::mojom::ContentSecurityPolicySource::kHTTP);
-      if (!required_csp->Subsumes(*csp))
-        return nullptr;
-    }
+  // Plugin inherits plugin's CSP from their navigation initiator.
+  DocumentInit::Type document_type =
+      DocumentInit::ComputeDocumentType(frame_, url, response.MimeType());
+  if (document_type == DocumentInit::Type::kPlugin) {
+    Frame* owner_frame = frame_->Tree().Parent() ? frame_->Tree().Parent()
+                                                 : frame_->Client()->Opener();
+    ContentSecurityPolicy* owner_csp =
+        owner_frame
+            ? owner_frame->GetSecurityContext()->GetContentSecurityPolicy()
+            : nullptr;
+    // TODO(andypaicu): This should always inherit the origin document's plugin
+    // types but because this could be a OOPIF document it might not have
+    // access. In this situation we fallback on using the parent/opener:
+    ContentSecurityPolicy* inherited_csp =
+        initiator_csp ? initiator_csp : owner_csp;
+    if (inherited_csp)
+      csp->CopyPluginTypesFrom(inherited_csp);
   }
+
+  // When the embedder used the 'required-csp', its embeddee must either:
+  // 1) Use the 'allow-csp' header for opting in inheriting them.
+  // 2) Ensure its own CSP subsume them, or it will be blocked.
+  //
+  // See:
+  // - https://w3c.github.io/webappsec-cspee/#required-csp-header
+  // - https://w3c.github.io/webappsec-cspee/#allow-csp-from-header
+  if (RequiredCSP().IsEmpty())
+    return csp;
+
+  const SecurityOrigin* parent_security_origin =
+      frame_->Tree().Parent()->GetSecurityContext()->GetSecurityOrigin();
+  if (parent_security_origin &&
+      ContentSecurityPolicy::ShouldEnforceEmbeddersPolicy(
+          response, parent_security_origin)) {
+    csp->AddPolicyFromHeaderValue(
+        RequiredCSP(), network::mojom::ContentSecurityPolicyType::kEnforce,
+        network::mojom::ContentSecurityPolicySource::kHTTP);
+  } else {
+    auto* required_csp = MakeGarbageCollected<ContentSecurityPolicy>();
+    required_csp->AddPolicyFromHeaderValue(
+        RequiredCSP(), network::mojom::ContentSecurityPolicyType::kEnforce,
+        network::mojom::ContentSecurityPolicySource::kHTTP);
+    if (!required_csp->Subsumes(*csp))
+      return nullptr;  // Document blocked.
+  }
+
   return csp;
 }
 

diff --git a/third_party/blink/renderer/core/loader/frame_loader.h b/third_party/blink/renderer/core/loader/frame_loader.h
index bda3ebc..e42d969 100644
--- a/third_party/blink/renderer/core/loader/frame_loader.h
+++ b/third_party/blink/renderer/core/loader/frame_loader.h

@@ -37,6 +37,7 @@
 
 #include "base/bind_helpers.h"
 #include "base/macros.h"
+#include "services/network/public/mojom/web_sandbox_flags.mojom-blink-forward.h"
 #include "third_party/blink/public/common/user_agent/user_agent_metadata.h"
 #include "third_party/blink/public/mojom/loader/request_context_frame_type.mojom-blink-forward.h"
 #include "third_party/blink/public/platform/scheduler/web_scoped_virtual_time_pauser.h"
@@ -47,7 +48,6 @@
 #include "third_party/blink/renderer/core/core_export.h"
 #include "third_party/blink/renderer/core/dom/document.h"
 #include "third_party/blink/renderer/core/frame/frame_types.h"
-#include "third_party/blink/renderer/core/frame/sandbox_flags.h"
 #include "third_party/blink/renderer/core/loader/frame_loader_state_machine.h"
 #include "third_party/blink/renderer/core/loader/frame_loader_types.h"
 #include "third_party/blink/renderer/core/loader/history_item.h"
@@ -142,28 +142,24 @@
 
   // The following sandbox flags will be forced, regardless of changes to the
   // sandbox attribute of any parent frames.
-  void ForceSandboxFlags(mojom::blink::WebSandboxFlags flags) {
-    forced_sandbox_flags_ |= flags;
-  }
+  void ForceSandboxFlags(network::mojom::blink::WebSandboxFlags flags);
 
   // Set frame_owner's effective sandbox flags, which are sandbox flags value
   // at the beginning of navigation.
-  void SetFrameOwnerSandboxFlags(mojom::blink::WebSandboxFlags flags) {
-    frame_owner_sandbox_flags_ = flags;
-  }
+  void SetFrameOwnerSandboxFlags(network::mojom::blink::WebSandboxFlags flags);
 
   // Includes the collection of forced, inherited, and FrameOwner's sandbox
   // flags, where the FrameOwner's flag is snapshotted from the last committed
   // navigation. Note: with FeaturePolicyForSandbox the frame owner's sandbox
   // flags only includes the flags which are *not* implemented as feature
   // policies already present in the FrameOwner's ContainerPolicy.
-  mojom::blink::WebSandboxFlags EffectiveSandboxFlags() const;
+  network::mojom::blink::WebSandboxFlags EffectiveSandboxFlags() const;
 
   // Includes the collection of forced, inherited, and FrameOwner's sandbox
   // flags. Note: with FeaturePolicyForSandbox the frame owner's sandbox flags
   // only includes the flags which are *not* implemented as feature policies
   // already present in the FrameOwner's ContainerPolicy.
-  mojom::blink::WebSandboxFlags PendingEffectiveSandboxFlags() const;
+  network::mojom::blink::WebSandboxFlags PendingEffectiveSandboxFlags() const;
 
   // Modifying itself is done based on |fetch_client_settings_object|.
   // |document_for_logging| is used only for logging, use counters,
@@ -235,9 +231,6 @@
   void DidDropNavigation();
   void MarkAsLoading();
 
-  ContentSecurityPolicy* GetLastOriginDocumentCSP() {
-    return last_origin_document_csp_.Get();
-  }
   bool ShouldReuseDefaultView(const scoped_refptr<const SecurityOrigin>&,
                               const ContentSecurityPolicy*);
 
@@ -291,17 +284,21 @@
                             HistoryItem* previous_history_item,
                             CommitReason);
 
+  // Creates CSP for the initial empty document. They are inherited from the
+  // owner document (parent or opener).
+  ContentSecurityPolicy* CreateCSPForInitialEmptyDocument() const;
+
   // Creates CSP based on |response| and checks that they allow loading |url|.
   // Returns nullptr if the check fails.
   ContentSecurityPolicy* CreateCSP(
       const KURL& url,
       const ResourceResponse& response,
-      const base::Optional<WebOriginPolicy>& origin_policy);
+      const base::Optional<WebOriginPolicy>& origin_policy,
+      ContentSecurityPolicy* initiator_csp);
 
   LocalFrameClient* Client() const;
 
   Member<LocalFrame> frame_;
-  AtomicString required_csp_;
 
   // FIXME: These should be std::unique_ptr<T> to reduce build times and
   // simplify header dependencies unless performance testing proves otherwise.
@@ -322,15 +319,15 @@
   };
   std::unique_ptr<ClientNavigationState> client_navigation_;
 
-  mojom::blink::WebSandboxFlags forced_sandbox_flags_;
+  network::mojom::blink::WebSandboxFlags forced_sandbox_flags_;
   // A snapshot value of frame_owner's sandbox flags states at the beginning of
   // navigation. For main frame which does not have a frame owner, the value is
   // base::nullopt.
   // The snapshot value is needed because of potential racing conditions on
   // sandbox attribute on iframe element.
   // crbug.com/1026627
-  base::Optional<mojom::blink::WebSandboxFlags> frame_owner_sandbox_flags_ =
-      base::nullopt;
+  base::Optional<network::mojom::blink::WebSandboxFlags>
+      frame_owner_sandbox_flags_ = base::nullopt;
 
   bool dispatching_did_clear_window_object_in_main_world_;
   bool detached_;
@@ -339,8 +336,13 @@
 
   WebScopedVirtualTimePauser virtual_time_pauser_;
 
+  // The CSP of the latest document that has initiated a navigation in this
+  // frame. TODO(arthursonzogni): This looks fragile. The FrameLoader might be
+  // confused by several navigations submitted in a row.
   Member<ContentSecurityPolicy> last_origin_document_csp_;
 
+  AtomicString required_csp_;
+
   // The origins for which a legacy TLS version warning has been printed. The
   // size of this set is capped, after which no more warnings are printed.
   HashSet<String> tls_version_warning_origins_;

diff --git a/third_party/blink/renderer/core/loader/resource/font_resource.cc b/third_party/blink/renderer/core/loader/resource/font_resource.cc
index 0a601bd..53320e7 100644
--- a/third_party/blink/renderer/core/loader/resource/font_resource.cc
+++ b/third_party/blink/renderer/core/loader/resource/font_resource.cc

@@ -175,11 +175,6 @@
     client->FontLoadLongLimitExceeded(this);
 }
 
-void FontResource::AllClientsAndObserversRemoved() {
-  font_data_ = nullptr;
-  Resource::AllClientsAndObserversRemoved();
-}
-
 void FontResource::NotifyFinished() {
   font_load_short_limit_.Cancel();
   font_load_long_limit_.Cancel();

diff --git a/third_party/blink/renderer/core/loader/resource/font_resource.h b/third_party/blink/renderer/core/loader/resource/font_resource.h
index d31b28d..713dc38 100644
--- a/third_party/blink/renderer/core/loader/resource/font_resource.h
+++ b/third_party/blink/renderer/core/loader/resource/font_resource.h

@@ -55,7 +55,6 @@
 
   void SetRevalidatingRequest(const ResourceRequestHead&) override;
 
-  void AllClientsAndObserversRemoved() override;
   void StartLoadLimitTimersIfNecessary(base::SingleThreadTaskRunner*);
 
   String OtsParsingMessage() const { return ots_parsing_message_; }
@@ -134,4 +133,4 @@
 
 }  // namespace blink
 
-#endif
+#endif  // THIRD_PARTY_BLINK_RENDERER_CORE_LOADER_RESOURCE_FONT_RESOURCE_H_

diff --git a/third_party/blink/renderer/core/loader/resource/image_resource.cc b/third_party/blink/renderer/core/loader/resource/image_resource.cc
index 74948a86..7a63037 100644
--- a/third_party/blink/renderer/core/loader/resource/image_resource.cc
+++ b/third_party/blink/renderer/core/loader/resource/image_resource.cc

@@ -97,9 +97,6 @@
   bool ShouldShowPlaceholder() const override {
     return resource_->ShouldShowPlaceholder();
   }
-  bool ShouldShowLazyImagePlaceholder() const override {
-    return resource_->ShouldShowLazyImagePlaceholder();
-  }
   bool IsCacheValidator() const override {
     return resource_->IsCacheValidator();
   }
@@ -157,21 +154,14 @@
   STACK_ALLOCATED();
 
  public:
-  explicit ImageResourceFactory(const FetchParameters& fetch_params)
-      : NonTextResourceFactory(ResourceType::kImage),
-        fetch_params_(&fetch_params) {}
+  explicit ImageResourceFactory()
+      : NonTextResourceFactory(ResourceType::kImage) {}
 
   Resource* Create(const ResourceRequest& request,
                    const ResourceLoaderOptions& options) const override {
     return MakeGarbageCollected<ImageResource>(
-        request, options, ImageResourceContent::CreateNotStarted(),
-        fetch_params_->GetImageRequestBehavior() ==
-            FetchParameters::kAllowPlaceholder);
+        request, options, ImageResourceContent::CreateNotStarted());
   }
-
- private:
-  // Weak, unowned pointer. Must outlive |this|.
-  const FetchParameters* fetch_params_;
 };
 
 ImageResource* ImageResource::Fetch(FetchParameters& params,
@@ -183,7 +173,7 @@
   }
 
   ImageResource* resource = ToImageResource(
-      fetcher->RequestResource(params, ImageResourceFactory(params), nullptr));
+      fetcher->RequestResource(params, ImageResourceFactory(), nullptr));
 
   // If the fetch originated from user agent CSS we should mark it as a user
   // agent resource.
@@ -197,8 +187,7 @@
     const FetchParameters& params) const {
   // If the image is a placeholder, but this fetch doesn't allow a
   // placeholder, then do not reuse this resource.
-  if (params.GetImageRequestBehavior() != FetchParameters::kAllowPlaceholder &&
-      placeholder_option_ != PlaceholderOption::kDoNotReloadPlaceholder) {
+  if (placeholder_option_ != PlaceholderOption::kDoNotReloadPlaceholder) {
     return MatchStatus::kImagePlaceholder;
   }
 
@@ -218,7 +207,7 @@
 ImageResource* ImageResource::Create(const ResourceRequest& request) {
   ResourceLoaderOptions options;
   return MakeGarbageCollected<ImageResource>(
-      request, options, ImageResourceContent::CreateNotStarted(), false);
+      request, options, ImageResourceContent::CreateNotStarted());
 }
 
 ImageResource* ImageResource::CreateForTest(const KURL& url) {
@@ -236,14 +225,11 @@
 
 ImageResource::ImageResource(const ResourceRequest& resource_request,
                              const ResourceLoaderOptions& options,
-                             ImageResourceContent* content,
-                             bool is_placeholder)
+                             ImageResourceContent* content)
     : Resource(resource_request, ResourceType::kImage, options),
       content_(content),
       is_scheduling_reload_(false),
-      placeholder_option_(
-          is_placeholder ? PlaceholderOption::kShowAndReloadPlaceholderAlways
-                         : PlaceholderOption::kDoNotReloadPlaceholder) {
+      placeholder_option_(PlaceholderOption::kDoNotReloadPlaceholder) {
   DCHECK(GetContent());
   RESOURCE_LOADING_DVLOG(1)
       << "MakeGarbageCollected<ImageResource>(ResourceRequest) " << this;
@@ -529,21 +515,6 @@
   return false;
 }
 
-bool ImageResource::ShouldShowLazyImagePlaceholder() const {
-  switch (placeholder_option_) {
-    case PlaceholderOption::kShowAndReloadPlaceholderAlways:
-    case PlaceholderOption::kShowAndDoNotReloadPlaceholder:
-      return RuntimeEnabledFeatures::LazyImageLoadingEnabled() &&
-             (GetResourceRequest().GetPreviewsState() &
-              WebURLRequest::kLazyImageLoadDeferred);
-    case PlaceholderOption::kReloadPlaceholderOnDecodeError:
-    case PlaceholderOption::kDoNotReloadPlaceholder:
-      return false;
-  }
-  NOTREACHED();
-  return false;
-}
-
 bool ImageResource::ShouldReloadBrokenPlaceholder() const {
   switch (placeholder_option_) {
     case PlaceholderOption::kShowAndReloadPlaceholderAlways:

diff --git a/third_party/blink/renderer/core/loader/resource/image_resource.h b/third_party/blink/renderer/core/loader/resource/image_resource.h
index 129be3d..8634ad6 100644
--- a/third_party/blink/renderer/core/loader/resource/image_resource.h
+++ b/third_party/blink/renderer/core/loader/resource/image_resource.h

@@ -65,8 +65,7 @@
 
   ImageResource(const ResourceRequest&,
                 const ResourceLoaderOptions&,
-                ImageResourceContent*,
-                bool is_placeholder);
+                ImageResourceContent*);
   ~ImageResource() override;
 
   ImageResourceContent* GetContent();
@@ -101,7 +100,6 @@
   void MultipartDataReceived(const char*, size_t) final;
 
   bool ShouldShowPlaceholder() const;
-  bool ShouldShowLazyImagePlaceholder() const;
 
   // If the ImageResource came from a user agent CSS stylesheet then we should
   // flag it so that it can persist beyond navigation.

diff --git a/third_party/blink/renderer/core/loader/resource/image_resource_content.cc b/third_party/blink/renderer/core/loader/resource/image_resource_content.cc
index 854baaa..379f044 100644
--- a/third_party/blink/renderer/core/loader/resource/image_resource_content.cc
+++ b/third_party/blink/renderer/core/loader/resource/image_resource_content.cc

@@ -45,7 +45,6 @@
   bool IsSchedulingReload() const override { return false; }
   const ResourceResponse& GetResponse() const override { return response_; }
   bool ShouldShowPlaceholder() const override { return false; }
-  bool ShouldShowLazyImagePlaceholder() const override { return false; }
   bool IsCacheValidator() const override { return false; }
   bool SchedulingReloadOrShouldReloadBrokenPlaceholder() const override {
     return false;
@@ -121,14 +120,6 @@
   return content;
 }
 
-ImageResourceContent* ImageResourceContent::CreateLazyImagePlaceholder() {
-  ImageResourceContent* content = MakeGarbageCollected<ImageResourceContent>();
-  content->content_status_ = ResourceStatus::kCached;
-  content->image_ =
-      PlaceholderImage::CreateForLazyImages(content, IntSize(1, 1));
-  return content;
-}
-
 ImageResourceContent* ImageResourceContent::Fetch(FetchParameters& params,
                                                   ResourceFetcher* fetcher) {
   // TODO(hiroshige): Remove direct references to ImageResource by making
@@ -449,19 +440,13 @@
       if (size_available_ == Image::kSizeUnavailable && !all_data_received)
         return UpdateImageResult::kNoDecodeError;
 
-      if ((info_->ShouldShowPlaceholder() ||
-           info_->ShouldShowLazyImagePlaceholder()) &&
-          all_data_received) {
+      if (info_->ShouldShowPlaceholder() && all_data_received) {
         if (image_ && !image_->IsNull()) {
           IntSize dimensions = image_->Size();
           ClearImage();
-          if (info_->ShouldShowLazyImagePlaceholder()) {
-            image_ = PlaceholderImage::CreateForLazyImages(this, dimensions);
-          } else {
-            image_ = PlaceholderImage::Create(
-                this, dimensions,
-                EstimateOriginalImageSizeForPlaceholder(info_->GetResponse()));
-          }
+          image_ = PlaceholderImage::Create(
+              this, dimensions,
+              EstimateOriginalImageSizeForPlaceholder(info_->GetResponse()));
         }
       }
 

diff --git a/third_party/blink/renderer/core/loader/resource/image_resource_content.h b/third_party/blink/renderer/core/loader/resource/image_resource_content.h
index 9e9fe6c..72db3c60 100644
--- a/third_party/blink/renderer/core/loader/resource/image_resource_content.h
+++ b/third_party/blink/renderer/core/loader/resource/image_resource_content.h

@@ -56,8 +56,6 @@
   // Creates ImageResourceContent from an already loaded image.
   static ImageResourceContent* CreateLoaded(scoped_refptr<blink::Image>);
 
-  static ImageResourceContent* CreateLazyImagePlaceholder();
-
   static ImageResourceContent* Fetch(FetchParameters&, ResourceFetcher*);
 
   explicit ImageResourceContent(scoped_refptr<blink::Image> = nullptr);

diff --git a/third_party/blink/renderer/core/loader/resource/image_resource_info.h b/third_party/blink/renderer/core/loader/resource/image_resource_info.h
index f459616..3aaaabb 100644
--- a/third_party/blink/renderer/core/loader/resource/image_resource_info.h
+++ b/third_party/blink/renderer/core/loader/resource/image_resource_info.h

@@ -33,7 +33,6 @@
   virtual bool IsSchedulingReload() const = 0;
   virtual const ResourceResponse& GetResponse() const = 0;
   virtual bool ShouldShowPlaceholder() const = 0;
-  virtual bool ShouldShowLazyImagePlaceholder() const = 0;
   virtual bool IsCacheValidator() const = 0;
   virtual bool SchedulingReloadOrShouldReloadBrokenPlaceholder() const = 0;
   enum DoesCurrentFrameHaveSingleSecurityOrigin {

diff --git a/third_party/blink/renderer/core/loader/resource/image_resource_test.cc b/third_party/blink/renderer/core/loader/resource/image_resource_test.cc
index db3f892..3ded490 100644
--- a/third_party/blink/renderer/core/loader/resource/image_resource_test.cc
+++ b/third_party/blink/renderer/core/loader/resource/image_resource_test.cc

@@ -198,164 +198,11 @@
   image_resource->FinishForTest();
 }
 
-void TestThatReloadIsStartedThenServeReload(
-    const KURL& test_url,
-    ImageResource* image_resource,
-    ImageResourceContent* content,
-    MockImageResourceObserver* observer,
-    bool placeholder_before_reload) {
-  const char* data = reinterpret_cast<const char*>(kJpegImage2);
-  constexpr size_t kDataLength = sizeof(kJpegImage2);
-  constexpr int kImageWidth = 50;
-  constexpr int kImageHeight = 50;
-
-  // Checks that |imageResource| and |content| are ready for non-placeholder
-  // reloading.
-  EXPECT_EQ(ResourceStatus::kPending, image_resource->GetStatus());
-  EXPECT_FALSE(image_resource->ResourceBuffer());
-  EXPECT_EQ(placeholder_before_reload, image_resource->ShouldShowPlaceholder());
-  EXPECT_EQ(g_null_atom,
-            image_resource->GetResourceRequest().HttpHeaderField("range"));
-  EXPECT_EQ(content, image_resource->GetContent());
-  EXPECT_FALSE(content->HasImage());
-
-  // Checks |observer| before reloading.
-  const int original_image_changed_count = observer->ImageChangedCount();
-  const bool already_notified_finish = observer->ImageNotifyFinishedCalled();
-  const int image_width_on_image_notify_finished =
-      observer->ImageWidthOnImageNotifyFinished();
-  ASSERT_NE(kImageWidth, image_width_on_image_notify_finished);
-
-  // Does Reload.
-  ResourceResponse resource_response(test_url);
-  resource_response.SetMimeType("image/jpeg");
-  resource_response.SetExpectedContentLength(kDataLength);
-  image_resource->Loader()->DidReceiveResponse(
-      WrappedResourceResponse(resource_response));
-  image_resource->Loader()->DidReceiveData(data, kDataLength);
-  image_resource->Loader()->DidFinishLoading(base::TimeTicks(), kDataLength,
-                                             kDataLength, kDataLength, false);
-
-  // Checks |imageResource|'s status after reloading.
-  EXPECT_EQ(ResourceStatus::kCached, image_resource->GetStatus());
-  EXPECT_FALSE(image_resource->ErrorOccurred());
-  EXPECT_EQ(kDataLength, image_resource->EncodedSize());
-
-  // Checks |observer| after reloading that it is notified of updates/finish.
-  EXPECT_LT(original_image_changed_count, observer->ImageChangedCount());
-  EXPECT_EQ(kImageWidth, observer->ImageWidthOnLastImageChanged());
-  EXPECT_TRUE(observer->ImageNotifyFinishedCalled());
-  if (!already_notified_finish) {
-    // If imageNotifyFinished() has not been called before the reloaded
-    // response is served, then imageNotifyFinished() should be called with
-    // the new image (of width |imageWidth|).
-    EXPECT_EQ(kImageWidth, observer->ImageWidthOnImageNotifyFinished());
-  }
-
-  // Checks |content| receives the correct image.
-  EXPECT_TRUE(content->HasImage());
-  EXPECT_FALSE(content->GetImage()->IsNull());
-  EXPECT_EQ(kImageWidth, content->GetImage()->width());
-  EXPECT_EQ(kImageHeight, content->GetImage()->height());
-  EXPECT_FALSE(content->GetImage()->PaintImageForCurrentFrame().is_multipart());
-}
-
 AtomicString BuildContentRange(size_t range_length, size_t total_length) {
   return AtomicString(String("bytes 0-" + String::Number(range_length - 1) +
                              "/" + String::Number(total_length)));
 }
 
-void TestThatIsPlaceholderRequestAndServeResponse(
-    const KURL& url,
-    ImageResource* image_resource,
-    MockImageResourceObserver* observer) {
-  // Checks that |imageResource| is requesting for placeholder.
-  EXPECT_TRUE(image_resource->ShouldShowPlaceholder());
-  EXPECT_EQ("bytes=0-2047",
-            image_resource->GetResourceRequest().HttpHeaderField("range"));
-  EXPECT_EQ(0, observer->ImageChangedCount());
-
-  // Serves partial response that is sufficient for creating a placeholder.
-  ResourceResponse resource_response(url);
-  resource_response.SetMimeType("image/jpeg");
-  resource_response.SetExpectedContentLength(
-      kJpegImageSubrangeWithDimensionsLength);
-  resource_response.SetHttpStatusCode(206);
-  resource_response.SetHttpHeaderField(
-      "content-range", BuildContentRange(kJpegImageSubrangeWithDimensionsLength,
-                                         sizeof(kJpegImage)));
-  image_resource->Loader()->DidReceiveResponse(
-      WrappedResourceResponse(resource_response));
-  image_resource->Loader()->DidReceiveData(
-      reinterpret_cast<const char*>(kJpegImage),
-      kJpegImageSubrangeWithDimensionsLength);
-  image_resource->Loader()->DidFinishLoading(
-      base::TimeTicks(), kJpegImageSubrangeWithDimensionsLength,
-      kJpegImageSubrangeWithDimensionsLength,
-      kJpegImageSubrangeWithDimensionsLength, false);
-
-  // Checks that |imageResource| is successfully loaded, showing a placeholder.
-  EXPECT_EQ(ResourceStatus::kCached, image_resource->GetStatus());
-  EXPECT_EQ(kJpegImageSubrangeWithDimensionsLength,
-            image_resource->EncodedSize());
-
-  EXPECT_LT(0, observer->ImageChangedCount());
-  EXPECT_EQ(kJpegImageWidth, observer->ImageWidthOnLastImageChanged());
-  EXPECT_TRUE(observer->ImageNotifyFinishedCalled());
-  EXPECT_EQ(kJpegImageWidth, observer->ImageWidthOnImageNotifyFinished());
-  ASSERT_TRUE(image_resource->GetContent()->HasImage());
-  EXPECT_EQ(kJpegImageWidth, image_resource->GetContent()->GetImage()->width());
-  EXPECT_EQ(kJpegImageHeight,
-            image_resource->GetContent()->GetImage()->height());
-
-  // A placeholder image.
-  EXPECT_TRUE(image_resource->ShouldShowPlaceholder());
-  EXPECT_FALSE(IsA<BitmapImage>(image_resource->GetContent()->GetImage()));
-  EXPECT_FALSE(IsA<SVGImage>(image_resource->GetContent()->GetImage()));
-}
-
-void TestThatIsNotPlaceholderRequestAndServeResponse(
-    const KURL& url,
-    ImageResource* image_resource,
-    MockImageResourceObserver* observer) {
-  // Checks that |imageResource| is NOT requesting for placeholder.
-  EXPECT_FALSE(image_resource->ShouldShowPlaceholder());
-  EXPECT_EQ(g_null_atom,
-            image_resource->GetResourceRequest().HttpHeaderField("range"));
-  EXPECT_EQ(0, observer->ImageChangedCount());
-
-  // Serves full response.
-  ResourceResponse resource_response(url);
-  resource_response.SetMimeType("image/jpeg");
-  resource_response.SetExpectedContentLength(sizeof(kJpegImage));
-  image_resource->Loader()->DidReceiveResponse(
-      WrappedResourceResponse(resource_response));
-  image_resource->Loader()->DidReceiveData(
-      reinterpret_cast<const char*>(kJpegImage), sizeof(kJpegImage));
-  image_resource->Loader()->DidFinishLoading(
-      base::TimeTicks(), sizeof(kJpegImage), sizeof(kJpegImage),
-      sizeof(kJpegImage), false);
-
-  // Checks that |imageResource| is successfully loaded,
-  // showing a non-placeholder image.
-  EXPECT_EQ(ResourceStatus::kCached, image_resource->GetStatus());
-  EXPECT_EQ(sizeof(kJpegImage), image_resource->EncodedSize());
-
-  EXPECT_LT(0, observer->ImageChangedCount());
-  EXPECT_EQ(kJpegImageWidth, observer->ImageWidthOnLastImageChanged());
-  EXPECT_TRUE(observer->ImageNotifyFinishedCalled());
-  EXPECT_EQ(kJpegImageWidth, observer->ImageWidthOnImageNotifyFinished());
-  ASSERT_TRUE(image_resource->GetContent()->HasImage());
-  EXPECT_EQ(kJpegImageWidth, image_resource->GetContent()->GetImage()->width());
-  EXPECT_EQ(kJpegImageHeight,
-            image_resource->GetContent()->GetImage()->height());
-
-  // A non-placeholder bitmap image.
-  EXPECT_FALSE(image_resource->ShouldShowPlaceholder());
-  EXPECT_TRUE(IsA<BitmapImage>(image_resource->GetContent()->GetImage()));
-  EXPECT_FALSE(IsA<SVGImage>(image_resource->GetContent()->GetImage()));
-}
-
 ResourceFetcher* CreateFetcher() {
   auto* properties = MakeGarbageCollected<TestResourceFetcherProperties>();
   return MakeGarbageCollected<ResourceFetcher>(ResourceFetcherInit(
@@ -639,30 +486,6 @@
   EXPECT_TRUE(IsA<BitmapImage>(image_resource->GetContent()->GetImage()));
 }
 
-TEST(ImageResourceReloadTest, ReloadIfLoFiOrPlaceholderForPlaceholder) {
-  KURL test_url(kTestURL);
-  ScopedMockedURLLoad scoped_mocked_url_load(test_url, GetTestFilePath());
-
-  ResourceFetcher* fetcher = CreateFetcher();
-  FetchParameters params{ResourceRequest(test_url)};
-  params.SetAllowImagePlaceholder();
-  ImageResource* image_resource = ImageResource::Fetch(params, fetcher);
-  EXPECT_EQ(FetchParameters::kAllowPlaceholder,
-            params.GetImageRequestBehavior());
-  auto observer =
-      std::make_unique<MockImageResourceObserver>(image_resource->GetContent());
-
-  TestThatIsPlaceholderRequestAndServeResponse(test_url, image_resource,
-                                               observer.get());
-
-  image_resource->ReloadIfLoFiOrPlaceholderImage(fetcher,
-                                                 Resource::kReloadAlways);
-
-  TestThatReloadIsStartedThenServeReload(test_url, image_resource,
-                                         image_resource->GetContent(),
-                                         observer.get(), false);
-}
-
 TEST(ImageResourceTest, SVGImage) {
   KURL url("http://127.0.0.1:8000/foo");
   ImageResource* image_resource = ImageResource::CreateForTest(url);
@@ -1065,419 +888,6 @@
   EXPECT_FALSE(image_resource->IsLoading());
 }
 
-TEST(ImageResourceTest, FetchDisallowPlaceholder) {
-  KURL test_url(kTestURL);
-  ScopedMockedURLLoad scoped_mocked_url_load(test_url, GetTestFilePath());
-
-  FetchParameters params{ResourceRequest(test_url)};
-  ImageResource* image_resource = ImageResource::Fetch(params, CreateFetcher());
-  EXPECT_EQ(FetchParameters::kNone, params.GetImageRequestBehavior());
-  auto observer =
-      std::make_unique<MockImageResourceObserver>(image_resource->GetContent());
-
-  TestThatIsNotPlaceholderRequestAndServeResponse(test_url, image_resource,
-                                                  observer.get());
-}
-
-TEST(ImageResourceTest, FetchAllowPlaceholderDataURL) {
-  KURL test_url("data:image/jpeg;base64," + Base64Encode(kJpegImage));
-  FetchParameters params{ResourceRequest(test_url)};
-  params.SetAllowImagePlaceholder();
-  ImageResource* image_resource = ImageResource::Fetch(params, CreateFetcher());
-  EXPECT_EQ(FetchParameters::kNone, params.GetImageRequestBehavior());
-  EXPECT_EQ(g_null_atom,
-            image_resource->GetResourceRequest().HttpHeaderField("range"));
-  EXPECT_FALSE(image_resource->ShouldShowPlaceholder());
-}
-
-TEST(ImageResourceTest, FetchAllowPlaceholderPostRequest) {
-  KURL test_url(kTestURL);
-  ScopedMockedURLLoad scoped_mocked_url_load(test_url, GetTestFilePath());
-  ResourceRequest resource_request(test_url);
-  resource_request.SetHttpMethod(http_names::kPOST);
-  FetchParameters params(std::move(resource_request));
-  params.SetAllowImagePlaceholder();
-  ImageResource* image_resource = ImageResource::Fetch(params, CreateFetcher());
-  EXPECT_EQ(FetchParameters::kNone, params.GetImageRequestBehavior());
-  EXPECT_EQ(g_null_atom,
-            image_resource->GetResourceRequest().HttpHeaderField("range"));
-  EXPECT_FALSE(image_resource->ShouldShowPlaceholder());
-
-  image_resource->Loader()->Cancel();
-}
-
-TEST(ImageResourceTest, FetchAllowPlaceholderExistingRangeHeader) {
-  KURL test_url(kTestURL);
-  ScopedMockedURLLoad scoped_mocked_url_load(test_url, GetTestFilePath());
-  ResourceRequest resource_request(test_url);
-  resource_request.SetHttpHeaderField("range", "bytes=128-255");
-  FetchParameters params(std::move(resource_request));
-  params.SetAllowImagePlaceholder();
-  ImageResource* image_resource = ImageResource::Fetch(params, CreateFetcher());
-  EXPECT_EQ(FetchParameters::kNone, params.GetImageRequestBehavior());
-  EXPECT_EQ("bytes=128-255",
-            image_resource->GetResourceRequest().HttpHeaderField("range"));
-  EXPECT_FALSE(image_resource->ShouldShowPlaceholder());
-
-  image_resource->Loader()->Cancel();
-}
-
-TEST(ImageResourceTest, FetchAllowPlaceholderSuccessful) {
-  KURL test_url(kTestURL);
-  ScopedMockedURLLoad scoped_mocked_url_load(test_url, GetTestFilePath());
-
-  FetchParameters params{ResourceRequest(test_url)};
-  params.SetAllowImagePlaceholder();
-  ImageResource* image_resource = ImageResource::Fetch(params, CreateFetcher());
-  EXPECT_EQ(FetchParameters::kAllowPlaceholder,
-            params.GetImageRequestBehavior());
-  auto observer =
-      std::make_unique<MockImageResourceObserver>(image_resource->GetContent());
-
-  TestThatIsPlaceholderRequestAndServeResponse(test_url, image_resource,
-                                               observer.get());
-}
-
-TEST(ImageResourceTest, FetchAllowPlaceholderUnsuccessful) {
-  KURL test_url(kTestURL);
-  ScopedMockedURLLoad scoped_mocked_url_load(test_url, GetTestFilePath());
-
-  FetchParameters params{ResourceRequest(test_url)};
-  params.SetAllowImagePlaceholder();
-  ImageResource* image_resource = ImageResource::Fetch(params, CreateFetcher());
-  EXPECT_EQ(FetchParameters::kAllowPlaceholder,
-            params.GetImageRequestBehavior());
-  EXPECT_EQ("bytes=0-2047",
-            image_resource->GetResourceRequest().HttpHeaderField("range"));
-  EXPECT_TRUE(image_resource->ShouldShowPlaceholder());
-  auto observer =
-      std::make_unique<MockImageResourceObserver>(image_resource->GetContent());
-
-  const char kBadData[] = "notanimageresponse";
-
-  ResourceResponse bad_response(test_url);
-  bad_response.SetMimeType("image/jpeg");
-  bad_response.SetExpectedContentLength(sizeof(kBadData));
-  bad_response.SetHttpStatusCode(206);
-  bad_response.SetHttpHeaderField(
-      "content-range", BuildContentRange(sizeof(kBadData), sizeof(kJpegImage)));
-
-  image_resource->Loader()->DidReceiveResponse(
-      WrappedResourceResponse(bad_response));
-
-  EXPECT_EQ(0, observer->ImageChangedCount());
-
-  image_resource->Loader()->DidReceiveData(kBadData, sizeof(kBadData));
-
-  // The dimensions could not be extracted, so the full original image should be
-  // loading.
-  EXPECT_FALSE(observer->ImageNotifyFinishedCalled());
-  EXPECT_EQ(2, observer->ImageChangedCount());
-  EXPECT_FALSE(image_resource->ShouldShowPlaceholder());
-
-  TestThatReloadIsStartedThenServeReload(test_url, image_resource,
-                                         image_resource->GetContent(),
-                                         observer.get(), false);
-}
-
-TEST(ImageResourceTest, FetchAllowPlaceholderPartialContentWithoutDimensions) {
-  const struct {
-    WebURLRequest::PreviewsState initial_previews_state;
-    WebURLRequest::PreviewsState expected_reload_previews_state;
-    bool placeholder_before_reload;
-    bool placeholder_after_reload;
-  } tests[] = {
-      {WebURLRequest::kPreviewsUnspecified, WebURLRequest::kPreviewsNoTransform,
-       false},
-  };
-
-  for (const auto& test : tests) {
-    KURL test_url(kTestURL);
-    ScopedMockedURLLoad scoped_mocked_url_load(test_url, GetTestFilePath());
-
-    ResourceRequest resource_request(test_url);
-    resource_request.SetPreviewsState(test.initial_previews_state);
-    FetchParameters params(std::move(resource_request));
-
-    params.SetAllowImagePlaceholder();
-    ImageResource* image_resource =
-        ImageResource::Fetch(params, CreateFetcher());
-    EXPECT_EQ(FetchParameters::kAllowPlaceholder,
-              params.GetImageRequestBehavior());
-    EXPECT_EQ("bytes=0-2047",
-              image_resource->GetResourceRequest().HttpHeaderField("range"));
-    EXPECT_TRUE(image_resource->ShouldShowPlaceholder());
-    auto observer = std::make_unique<MockImageResourceObserver>(
-        image_resource->GetContent());
-
-    // TODO(hiroshige): Make the range request header and partial content length
-    // consistent. https://crbug.com/689760.
-    ResourceResponse partial_response(test_url);
-    partial_response.SetMimeType("image/jpeg");
-    partial_response.SetExpectedContentLength(
-        kJpegImageSubrangeWithoutDimensionsLength);
-    partial_response.SetHttpStatusCode(206);
-    partial_response.SetHttpHeaderField(
-        "content-range",
-        BuildContentRange(kJpegImageSubrangeWithoutDimensionsLength,
-                          sizeof(kJpegImage)));
-
-    image_resource->Loader()->DidReceiveResponse(
-        WrappedResourceResponse(partial_response));
-    image_resource->Loader()->DidReceiveData(
-        reinterpret_cast<const char*>(kJpegImage),
-        kJpegImageSubrangeWithoutDimensionsLength);
-
-    EXPECT_EQ(0, observer->ImageChangedCount());
-
-    image_resource->Loader()->DidFinishLoading(
-        base::TimeTicks(), kJpegImageSubrangeWithoutDimensionsLength,
-        kJpegImageSubrangeWithoutDimensionsLength,
-        kJpegImageSubrangeWithoutDimensionsLength, false);
-
-    EXPECT_FALSE(observer->ImageNotifyFinishedCalled());
-    EXPECT_EQ(2, observer->ImageChangedCount());
-
-    TestThatReloadIsStartedThenServeReload(
-        test_url, image_resource, image_resource->GetContent(), observer.get(),
-        test.placeholder_before_reload);
-
-    EXPECT_EQ(test.expected_reload_previews_state,
-              image_resource->GetResourceRequest().GetPreviewsState());
-  }
-}
-
-TEST(ImageResourceTest, FetchAllowPlaceholderThenDisallowPlaceholder) {
-  KURL test_url(kTestURL);
-  ScopedMockedURLLoad scoped_mocked_url_load(test_url, GetTestFilePath());
-
-  ResourceFetcher* fetcher = CreateFetcher();
-
-  FetchParameters placeholder_params{ResourceRequest(test_url)};
-  placeholder_params.SetAllowImagePlaceholder();
-  ImageResource* image_resource =
-      ImageResource::Fetch(placeholder_params, fetcher);
-  auto observer =
-      std::make_unique<MockImageResourceObserver>(image_resource->GetContent());
-
-  FetchParameters non_placeholder_params{ResourceRequest(test_url)};
-  ImageResource* image_resource2 =
-      ImageResource::Fetch(non_placeholder_params, fetcher);
-  auto observer2 = std::make_unique<MockImageResourceObserver>(
-      image_resource2->GetContent());
-
-  ImageResource* image_resource3 =
-      ImageResource::Fetch(non_placeholder_params, fetcher);
-  auto observer3 = std::make_unique<MockImageResourceObserver>(
-      image_resource3->GetContent());
-
-  // |imageResource| remains a placeholder, while following non-placeholder
-  // requests start non-placeholder loading with a separate ImageResource.
-  ASSERT_NE(image_resource, image_resource2);
-  ASSERT_NE(image_resource->Loader(), image_resource2->Loader());
-  ASSERT_NE(image_resource->GetContent(), image_resource2->GetContent());
-  ASSERT_EQ(image_resource2, image_resource3);
-
-  EXPECT_FALSE(observer->ImageNotifyFinishedCalled());
-  EXPECT_FALSE(observer2->ImageNotifyFinishedCalled());
-  EXPECT_FALSE(observer3->ImageNotifyFinishedCalled());
-
-  // Checks that |imageResource2| (and |imageResource3|) loads a
-  // non-placeholder image.
-  TestThatIsNotPlaceholderRequestAndServeResponse(test_url, image_resource2,
-                                                  observer2.get());
-  EXPECT_TRUE(observer3->ImageNotifyFinishedCalled());
-
-  // Checks that |imageResource| will loads a placeholder image.
-  TestThatIsPlaceholderRequestAndServeResponse(test_url, image_resource,
-                                               observer.get());
-
-  // |imageResource2| is still a non-placeholder image.
-  EXPECT_FALSE(image_resource2->ShouldShowPlaceholder());
-  EXPECT_TRUE(IsA<BitmapImage>(image_resource2->GetContent()->GetImage()));
-}
-
-TEST(ImageResourceTest,
-     FetchAllowPlaceholderThenDisallowPlaceholderAfterLoaded) {
-  KURL test_url(kTestURL);
-  ScopedMockedURLLoad scoped_mocked_url_load(test_url, GetTestFilePath());
-
-  ResourceFetcher* fetcher = CreateFetcher();
-  FetchParameters placeholder_params{ResourceRequest(test_url)};
-  placeholder_params.SetAllowImagePlaceholder();
-  ImageResource* image_resource =
-      ImageResource::Fetch(placeholder_params, fetcher);
-  auto observer =
-      std::make_unique<MockImageResourceObserver>(image_resource->GetContent());
-
-  TestThatIsPlaceholderRequestAndServeResponse(test_url, image_resource,
-                                               observer.get());
-
-  FetchParameters non_placeholder_params{ResourceRequest(test_url)};
-  ImageResource* image_resource2 =
-      ImageResource::Fetch(non_placeholder_params, fetcher);
-  auto observer2 = std::make_unique<MockImageResourceObserver>(
-      image_resource2->GetContent());
-
-  ImageResource* image_resource3 =
-      ImageResource::Fetch(non_placeholder_params, fetcher);
-  auto observer3 = std::make_unique<MockImageResourceObserver>(
-      image_resource3->GetContent());
-
-  EXPECT_FALSE(observer2->ImageNotifyFinishedCalled());
-  EXPECT_FALSE(observer3->ImageNotifyFinishedCalled());
-
-  // |imageResource| remains a placeholder, while following non-placeholder
-  // requests start non-placeholder loading with a separate ImageResource.
-  ASSERT_NE(image_resource, image_resource2);
-  ASSERT_EQ(image_resource2, image_resource3);
-
-  TestThatIsNotPlaceholderRequestAndServeResponse(test_url, image_resource2,
-                                                  observer2.get());
-  EXPECT_TRUE(observer3->ImageNotifyFinishedCalled());
-}
-
-TEST(ImageResourceTest, FetchAllowPlaceholderFullResponseDecodeSuccess) {
-  const struct {
-    int status_code;
-    AtomicString content_range;
-  } tests[] = {
-      {200, g_null_atom},
-      {404, g_null_atom},
-      {206, BuildContentRange(sizeof(kJpegImage), sizeof(kJpegImage))},
-  };
-  for (const auto& test : tests) {
-    KURL test_url(kTestURL);
-    ScopedMockedURLLoad scoped_mocked_url_load(test_url, GetTestFilePath());
-
-    FetchParameters params{ResourceRequest(test_url)};
-    params.SetAllowImagePlaceholder();
-    ImageResource* image_resource =
-        ImageResource::Fetch(params, CreateFetcher());
-    EXPECT_EQ(FetchParameters::kAllowPlaceholder,
-              params.GetImageRequestBehavior());
-    EXPECT_EQ("bytes=0-2047",
-              image_resource->GetResourceRequest().HttpHeaderField("range"));
-    EXPECT_TRUE(image_resource->ShouldShowPlaceholder());
-    auto observer = std::make_unique<MockImageResourceObserver>(
-        image_resource->GetContent());
-
-    ResourceResponse resource_response(test_url);
-    resource_response.SetMimeType("imapge/jpeg");
-    resource_response.SetExpectedContentLength(sizeof(kJpegImage));
-    resource_response.SetHttpStatusCode(test.status_code);
-    if (test.content_range != g_null_atom)
-      resource_response.SetHttpHeaderField("content-range", test.content_range);
-    image_resource->Loader()->DidReceiveResponse(
-        WrappedResourceResponse(resource_response));
-    image_resource->Loader()->DidReceiveData(
-        reinterpret_cast<const char*>(kJpegImage), sizeof(kJpegImage));
-    image_resource->Loader()->DidFinishLoading(
-        base::TimeTicks(), sizeof(kJpegImage), sizeof(kJpegImage),
-        sizeof(kJpegImage), false);
-
-    EXPECT_EQ(ResourceStatus::kCached, image_resource->GetStatus());
-    EXPECT_EQ(sizeof(kJpegImage), image_resource->EncodedSize());
-    EXPECT_FALSE(image_resource->ShouldShowPlaceholder());
-    EXPECT_LT(0, observer->ImageChangedCount());
-    EXPECT_EQ(kJpegImageWidth, observer->ImageWidthOnLastImageChanged());
-    EXPECT_TRUE(observer->ImageNotifyFinishedCalled());
-    EXPECT_EQ(kJpegImageWidth, observer->ImageWidthOnImageNotifyFinished());
-
-    ASSERT_TRUE(image_resource->GetContent()->HasImage());
-    EXPECT_EQ(kJpegImageWidth,
-              image_resource->GetContent()->GetImage()->width());
-    EXPECT_EQ(kJpegImageHeight,
-              image_resource->GetContent()->GetImage()->height());
-    EXPECT_TRUE(IsA<BitmapImage>(image_resource->GetContent()->GetImage()));
-  }
-}
-
-TEST(ImageResourceTest,
-     FetchAllowPlaceholderFullResponseDecodeFailureNoReload) {
-  static const char kBadImageData[] = "bad image data";
-
-  const struct {
-    int status_code;
-    AtomicString content_range;
-    uint32_t data_size;
-  } tests[] = {
-      {200, g_null_atom, sizeof(kBadImageData)},
-      {206, BuildContentRange(sizeof(kBadImageData), sizeof(kBadImageData)),
-       sizeof(kBadImageData)},
-      {204, g_null_atom, 0},
-  };
-  for (const auto& test : tests) {
-    KURL test_url(kTestURL);
-    ScopedMockedURLLoad scoped_mocked_url_load(test_url, GetTestFilePath());
-
-    FetchParameters params{ResourceRequest(test_url)};
-    params.SetAllowImagePlaceholder();
-    ImageResource* image_resource =
-        ImageResource::Fetch(params, CreateFetcher());
-    EXPECT_EQ(FetchParameters::kAllowPlaceholder,
-              params.GetImageRequestBehavior());
-    EXPECT_EQ("bytes=0-2047",
-              image_resource->GetResourceRequest().HttpHeaderField("range"));
-    EXPECT_TRUE(image_resource->ShouldShowPlaceholder());
-    auto observer = std::make_unique<MockImageResourceObserver>(
-        image_resource->GetContent());
-
-    ResourceResponse resource_response(test_url);
-    resource_response.SetMimeType("image/jpeg");
-    resource_response.SetExpectedContentLength(test.data_size);
-    resource_response.SetHttpStatusCode(test.status_code);
-    if (test.content_range != g_null_atom)
-      resource_response.SetHttpHeaderField("content-range", test.content_range);
-    image_resource->Loader()->DidReceiveResponse(
-        WrappedResourceResponse(resource_response));
-    image_resource->Loader()->DidReceiveData(kBadImageData, test.data_size);
-
-    EXPECT_EQ(ResourceStatus::kDecodeError, image_resource->GetStatus());
-    EXPECT_FALSE(image_resource->ShouldShowPlaceholder());
-  }
-}
-
-TEST(ImageResourceTest,
-     FetchAllowPlaceholderFullResponseDecodeFailureWithReload) {
-  const int kStatusCodes[] = {404, 500};
-  for (int status_code : kStatusCodes) {
-    KURL test_url(kTestURL);
-    ScopedMockedURLLoad scoped_mocked_url_load(test_url, GetTestFilePath());
-
-    FetchParameters params{ResourceRequest(test_url)};
-    params.SetAllowImagePlaceholder();
-    ImageResource* image_resource =
-        ImageResource::Fetch(params, CreateFetcher());
-    EXPECT_EQ(FetchParameters::kAllowPlaceholder,
-              params.GetImageRequestBehavior());
-    EXPECT_EQ("bytes=0-2047",
-              image_resource->GetResourceRequest().HttpHeaderField("range"));
-    EXPECT_TRUE(image_resource->ShouldShowPlaceholder());
-    auto observer = std::make_unique<MockImageResourceObserver>(
-        image_resource->GetContent());
-
-    static const char kBadImageData[] = "bad image data";
-
-    ResourceResponse resource_response(test_url);
-    resource_response.SetMimeType("image/jpeg");
-    resource_response.SetExpectedContentLength(sizeof(kBadImageData));
-    resource_response.SetHttpStatusCode(status_code);
-    image_resource->Loader()->DidReceiveResponse(
-        WrappedResourceResponse(resource_response));
-    image_resource->Loader()->DidReceiveData(kBadImageData,
-                                             sizeof(kBadImageData));
-
-    EXPECT_FALSE(observer->ImageNotifyFinishedCalled());
-
-    // The dimensions could not be extracted, and the response code was a 4xx
-    // error, so the full original image should be loading.
-    TestThatReloadIsStartedThenServeReload(test_url, image_resource,
-                                           image_resource->GetContent(),
-                                           observer.get(), false);
-  }
-}
-
 TEST(ImageResourceTest, PeriodicFlushTest) {
   ScopedTestingPlatformSupport<TestingPlatformSupportWithMockScheduler>
       platform;

diff --git a/third_party/blink/renderer/core/page/chrome_client.cc b/third_party/blink/renderer/core/page/chrome_client.cc
index a7c33411..89d0c40a 100644
--- a/third_party/blink/renderer/core/page/chrome_client.cc
+++ b/third_party/blink/renderer/core/page/chrome_client.cc

@@ -126,7 +126,7 @@
     const FrameLoadRequest& r,
     const AtomicString& frame_name,
     const WebWindowFeatures& features,
-    mojom::blink::WebSandboxFlags sandbox_flags,
+    network::mojom::blink::WebSandboxFlags sandbox_flags,
     const FeaturePolicy::FeatureState& opener_feature_state,
     const SessionStorageNamespaceId& session_storage_namespace_id) {
   if (!CanOpenUIElementIfDuringPageDismissal(
@@ -278,7 +278,7 @@
   }
 
   if (frame->GetDocument()->IsSandboxed(
-          mojom::blink::WebSandboxFlags::kModals)) {
+          network::mojom::blink::WebSandboxFlags::kModals)) {
     UseCounter::Count(frame->GetDocument(),
                       WebFeature::kDialogInSandboxedContext);
     frame->Console().AddMessage(MakeGarbageCollected<ConsoleMessage>(

diff --git a/third_party/blink/renderer/core/page/chrome_client.h b/third_party/blink/renderer/core/page/chrome_client.h
index a3dd27d0..ab6d035 100644
--- a/third_party/blink/renderer/core/page/chrome_client.h
+++ b/third_party/blink/renderer/core/page/chrome_client.h

@@ -44,7 +44,6 @@
 #include "third_party/blink/public/web/web_widget_client.h"
 #include "third_party/blink/renderer/core/accessibility/ax_object_cache.h"
 #include "third_party/blink/renderer/core/core_export.h"
-#include "third_party/blink/renderer/core/frame/sandbox_flags.h"
 #include "third_party/blink/renderer/core/html/forms/external_date_time_chooser.h"
 #include "third_party/blink/renderer/core/html/forms/popup_menu.h"
 #include "third_party/blink/renderer/core/layout/geometry/physical_offset.h"
@@ -201,7 +200,7 @@
                      const FrameLoadRequest&,
                      const AtomicString& frame_name,
                      const WebWindowFeatures&,
-                     mojom::blink::WebSandboxFlags,
+                     network::mojom::blink::WebSandboxFlags,
                      const FeaturePolicy::FeatureState&,
                      const SessionStorageNamespaceId&);
   virtual void Show(NavigationPolicy) = 0;
@@ -519,7 +518,7 @@
                                      const FrameLoadRequest&,
                                      const AtomicString& frame_name,
                                      const WebWindowFeatures&,
-                                     mojom::blink::WebSandboxFlags,
+                                     network::mojom::blink::WebSandboxFlags,
                                      const FeaturePolicy::FeatureState&,
                                      const SessionStorageNamespaceId&) = 0;
 

diff --git a/third_party/blink/renderer/core/page/chrome_client_impl.cc b/third_party/blink/renderer/core/page/chrome_client_impl.cc
index 4e27cca6..d411181 100644
--- a/third_party/blink/renderer/core/page/chrome_client_impl.cc
+++ b/third_party/blink/renderer/core/page/chrome_client_impl.cc

@@ -251,7 +251,7 @@
     const FrameLoadRequest& r,
     const AtomicString& name,
     const WebWindowFeatures& features,
-    mojom::blink::WebSandboxFlags sandbox_flags,
+    network::mojom::blink::WebSandboxFlags sandbox_flags,
     const FeaturePolicy::FeatureState& opener_feature_state,
     const SessionStorageNamespaceId& session_storage_namespace_id) {
   if (!web_view_->Client())
@@ -268,8 +268,7 @@
           WebLocalFrameImpl::FromFrame(frame),
           WrappedResourceRequest(r.GetResourceRequest()), features, frame_name,
           static_cast<WebNavigationPolicy>(r.GetNavigationPolicy()),
-          static_cast<mojom::blink::WebSandboxFlags>(sandbox_flags),
-          opener_feature_state, session_storage_namespace_id));
+          sandbox_flags, opener_feature_state, session_storage_namespace_id));
   if (!new_view)
     return nullptr;
   return new_view->GetPage();

diff --git a/third_party/blink/renderer/core/page/chrome_client_impl.h b/third_party/blink/renderer/core/page/chrome_client_impl.h
index 3d616600..8304f072 100644
--- a/third_party/blink/renderer/core/page/chrome_client_impl.h
+++ b/third_party/blink/renderer/core/page/chrome_client_impl.h

@@ -87,7 +87,7 @@
                              const FrameLoadRequest&,
                              const AtomicString& name,
                              const WebWindowFeatures&,
-                             mojom::blink::WebSandboxFlags,
+                             network::mojom::blink::WebSandboxFlags,
                              const FeaturePolicy::FeatureState&,
                              const SessionStorageNamespaceId&) override;
   void Show(NavigationPolicy) override;

diff --git a/third_party/blink/renderer/core/page/chrome_client_impl_test.cc b/third_party/blink/renderer/core/page/chrome_client_impl_test.cc
index 5eedac92..efc5c459 100644
--- a/third_party/blink/renderer/core/page/chrome_client_impl_test.cc
+++ b/third_party/blink/renderer/core/page/chrome_client_impl_test.cc

@@ -31,6 +31,7 @@
 #include "third_party/blink/renderer/core/page/chrome_client_impl.h"
 #include "base/run_loop.h"
 #include "cc/trees/layer_tree_host.h"
+#include "services/network/public/mojom/web_sandbox_flags.mojom-blink.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/blink/public/common/feature_policy/feature_policy.h"
 #include "third_party/blink/public/common/input/web_input_event.h"
@@ -63,7 +64,7 @@
                       const WebWindowFeatures&,
                       const WebString& name,
                       WebNavigationPolicy,
-                      mojom::blink::WebSandboxFlags,
+                      network::mojom::blink::WebSandboxFlags,
                       const FeaturePolicy::FeatureState&,
                       const SessionStorageNamespaceId&) override {
     return web_view_helper_.InitializeWithOpener(opener);
@@ -97,7 +98,7 @@
   WebWindowFeatures features;
   EXPECT_EQ(nullptr, chrome_client_impl_->CreateWindow(
                          frame, request, "", features,
-                         mojom::blink::WebSandboxFlags::kNone,
+                         network::mojom::blink::WebSandboxFlags::kNone,
                          FeaturePolicy::FeatureState(), ""));
 }
 

diff --git a/third_party/blink/renderer/core/page/create_window.cc b/third_party/blink/renderer/core/page/create_window.cc
index 79b3084..556ed037 100644
--- a/third_party/blink/renderer/core/page/create_window.cc
+++ b/third_party/blink/renderer/core/page/create_window.cc

@@ -272,7 +272,7 @@
 
   // Sandboxed frames cannot open new auxiliary browsing contexts.
   if (opener_frame.GetDocument()->IsSandboxed(
-          mojom::blink::WebSandboxFlags::kPopups)) {
+          network::mojom::blink::WebSandboxFlags::kPopups)) {
     // FIXME: This message should be moved off the console once a solution to
     // https://bugs.webkit.org/show_bug.cgi?id=103274 exists.
     opener_frame.GetDocument()->AddConsoleMessage(
@@ -286,12 +286,13 @@
   }
 
   bool propagate_sandbox = opener_frame.GetDocument()->IsSandboxed(
-      mojom::blink::WebSandboxFlags::kPropagatesToAuxiliaryBrowsingContexts);
-  const SandboxFlags sandbox_flags =
+      network::mojom::blink::WebSandboxFlags::
+          kPropagatesToAuxiliaryBrowsingContexts);
+  network::mojom::blink::WebSandboxFlags sandbox_flags =
       propagate_sandbox ? opener_frame.GetDocument()->GetSandboxFlags()
-                        : mojom::blink::WebSandboxFlags::kNone;
+                        : network::mojom::blink::WebSandboxFlags::kNone;
   bool not_sandboxed = opener_frame.GetDocument()->GetSandboxFlags() ==
-                       mojom::blink::WebSandboxFlags::kNone;
+                       network::mojom::blink::WebSandboxFlags::kNone;
   FeaturePolicy::FeatureState opener_feature_state =
       (not_sandboxed || propagate_sandbox) ? opener_frame.GetSecurityContext()
                                                  ->GetFeaturePolicy()

diff --git a/third_party/blink/renderer/core/page/pointer_lock_controller.cc b/third_party/blink/renderer/core/page/pointer_lock_controller.cc
index 8b72cb3..ee66ab8 100644
--- a/third_party/blink/renderer/core/page/pointer_lock_controller.cc
+++ b/third_party/blink/renderer/core/page/pointer_lock_controller.cc

@@ -25,6 +25,7 @@
 
 #include "third_party/blink/renderer/core/page/pointer_lock_controller.h"
 
+#include "services/network/public/mojom/web_sandbox_flags.mojom-blink.h"
 #include "third_party/blink/public/common/input/web_mouse_event.h"
 #include "third_party/blink/public/mojom/input/pointer_lock_result.mojom-blink.h"
 #include "third_party/blink/renderer/bindings/core/v8/script_promise.h"
@@ -71,7 +72,7 @@
   }
 
   if (target->GetDocument().IsSandboxed(
-          mojom::blink::WebSandboxFlags::kPointerLock)) {
+          network::mojom::blink::WebSandboxFlags::kPointerLock)) {
     // FIXME: This message should be moved off the console once a solution to
     // https://bugs.webkit.org/show_bug.cgi?id=103274 exists.
     target->GetDocument().AddConsoleMessage(

diff --git a/third_party/blink/renderer/core/svg/graphics/svg_image.cc b/third_party/blink/renderer/core/svg/graphics/svg_image.cc
index d9dea86e..13ebb14 100644
--- a/third_party/blink/renderer/core/svg/graphics/svg_image.cc
+++ b/third_party/blink/renderer/core/svg/graphics/svg_image.cc

@@ -868,7 +868,7 @@
   }
 
   FrameLoader& loader = frame->Loader();
-  loader.ForceSandboxFlags(mojom::blink::WebSandboxFlags::kAll);
+  loader.ForceSandboxFlags(network::mojom::blink::WebSandboxFlags::kAll);
 
   // SVG Images will always synthesize a viewBox, if it's not available, and
   // thus never see scrollbars.

diff --git a/third_party/blink/renderer/core/workers/worker_or_worklet_global_scope.cc b/third_party/blink/renderer/core/workers/worker_or_worklet_global_scope.cc
index 141b1d0..8e4621b 100644
--- a/third_party/blink/renderer/core/workers/worker_or_worklet_global_scope.cc
+++ b/third_party/blink/renderer/core/workers/worker_or_worklet_global_scope.cc

@@ -4,6 +4,7 @@
 
 #include "third_party/blink/renderer/core/workers/worker_or_worklet_global_scope.h"
 
+#include "services/network/public/mojom/web_sandbox_flags.mojom-blink.h"
 #include "third_party/blink/public/common/features.h"
 #include "third_party/blink/public/mojom/security_context/insecure_request_policy.mojom-blink.h"
 #include "third_party/blink/public/platform/task_type.h"
@@ -97,7 +98,7 @@
   // SecurityContext and FetchClientSettingsObject, e.g. when doing
   // off-the-main-thread shared worker/service worker top-level script fetch.
   // https://crbug.com/924041 https://crbug.com/924043
-  void SetSandboxFlags(SandboxFlags) override {}
+  void SetSandboxFlags(network::mojom::blink::WebSandboxFlags) override {}
   void SetRequireTrustedTypes() override {}
   void AddInsecureRequestPolicy(mojom::blink::InsecureRequestPolicy) override {}
   void DisableEval(const String& error_message) override {}
@@ -423,9 +424,10 @@
   return GetThread()->GetTaskRunner(type);
 }
 
-void WorkerOrWorkletGlobalScope::ApplySandboxFlags(SandboxFlags mask) {
+void WorkerOrWorkletGlobalScope::ApplySandboxFlags(
+    network::mojom::blink::WebSandboxFlags mask) {
   GetSecurityContext().ApplySandboxFlags(mask);
-  if (IsSandboxed(mojom::blink::WebSandboxFlags::kOrigin) &&
+  if (IsSandboxed(network::mojom::blink::WebSandboxFlags::kOrigin) &&
       !GetSecurityOrigin()->IsOpaque()) {
     GetSecurityContext().SetSecurityOrigin(
         GetSecurityOrigin()->DeriveNewOpaqueOrigin());

diff --git a/third_party/blink/renderer/core/workers/worker_or_worklet_global_scope.h b/third_party/blink/renderer/core/workers/worker_or_worklet_global_scope.h
index 5b8588e..5394d73 100644
--- a/third_party/blink/renderer/core/workers/worker_or_worklet_global_scope.h
+++ b/third_party/blink/renderer/core/workers/worker_or_worklet_global_scope.h

@@ -8,6 +8,7 @@
 #include <bitset>
 #include "base/single_thread_task_runner.h"
 #include "services/network/public/mojom/fetch_api.mojom-blink-forward.h"
+#include "services/network/public/mojom/web_sandbox_flags.mojom-blink-forward.h"
 #include "third_party/blink/public/platform/web_url_request.h"
 #include "third_party/blink/renderer/bindings/core/v8/v8_cache_options.h"
 #include "third_party/blink/renderer/core/core_export.h"
@@ -152,7 +153,7 @@
 
   scoped_refptr<base::SingleThreadTaskRunner> GetTaskRunner(TaskType) override;
 
-  void ApplySandboxFlags(SandboxFlags mask);
+  void ApplySandboxFlags(network::mojom::blink::WebSandboxFlags mask);
 
   void SetDefersLoadingForResourceFetchers(bool defers);
 

diff --git a/third_party/blink/renderer/modules/cache_storage/global_cache_storage.cc b/third_party/blink/renderer/modules/cache_storage/global_cache_storage.cc
index 30d6dfc..5921dff 100644
--- a/third_party/blink/renderer/modules/cache_storage/global_cache_storage.cc
+++ b/third_party/blink/renderer/modules/cache_storage/global_cache_storage.cc

@@ -44,7 +44,7 @@
     ExecutionContext* context = fetching_scope.GetExecutionContext();
     if (!context->GetSecurityOrigin()->CanAccessCacheStorage()) {
       if (context->GetSecurityContext().IsSandboxed(
-              mojom::blink::WebSandboxFlags::kOrigin)) {
+              network::mojom::blink::WebSandboxFlags::kOrigin)) {
         exception_state.ThrowSecurityError(
             "Cache storage is disabled because the context is sandboxed and "
             "lacks the 'allow-same-origin' flag.");

diff --git a/third_party/blink/renderer/modules/native_file_system/native_file_system_directory_handle.cc b/third_party/blink/renderer/modules/native_file_system/native_file_system_directory_handle.cc
index ad38666a..cd1cfa5 100644
--- a/third_party/blink/renderer/modules/native_file_system/native_file_system_directory_handle.cc
+++ b/third_party/blink/renderer/modules/native_file_system/native_file_system_directory_handle.cc

@@ -6,6 +6,7 @@
 
 #include "mojo/public/cpp/bindings/pending_remote.h"
 #include "mojo/public/cpp/bindings/remote.h"
+#include "services/network/public/mojom/web_sandbox_flags.mojom-blink.h"
 #include "third_party/blink/public/common/browser_interface_broker_proxy.h"
 #include "third_party/blink/public/mojom/native_file_system/native_file_system_error.mojom-blink.h"
 #include "third_party/blink/public/mojom/native_file_system/native_file_system_manager.mojom-blink.h"
@@ -197,7 +198,7 @@
   ExecutionContext* context = ExecutionContext::From(script_state);
   if (!context->GetSecurityOrigin()->CanAccessNativeFileSystem()) {
     if (context->GetSecurityContext().IsSandboxed(
-            mojom::blink::WebSandboxFlags::kOrigin)) {
+            network::mojom::blink::WebSandboxFlags::kOrigin)) {
       exception_state.ThrowSecurityError(
           "System directory access is denied because the context is "
           "sandboxed and lacks the 'allow-same-origin' flag.");

diff --git a/third_party/blink/renderer/modules/native_file_system/window_native_file_system.cc b/third_party/blink/renderer/modules/native_file_system/window_native_file_system.cc
index e0fe751..664309fe 100644
--- a/third_party/blink/renderer/modules/native_file_system/window_native_file_system.cc
+++ b/third_party/blink/renderer/modules/native_file_system/window_native_file_system.cc

@@ -7,6 +7,7 @@
 #include <utility>
 
 #include "mojo/public/cpp/bindings/remote.h"
+#include "services/network/public/mojom/web_sandbox_flags.mojom-blink.h"
 #include "third_party/blink/public/common/browser_interface_broker_proxy.h"
 #include "third_party/blink/public/mojom/native_file_system/native_file_system_manager.mojom-blink.h"
 #include "third_party/blink/renderer/bindings/core/v8/script_promise_resolver.h"
@@ -77,7 +78,8 @@
   }
 
   if (!document->GetSecurityOrigin()->CanAccessNativeFileSystem()) {
-    if (document->IsSandboxed(mojom::blink::WebSandboxFlags::kOrigin)) {
+    if (document->IsSandboxed(
+            network::mojom::blink::WebSandboxFlags::kOrigin)) {
       exception_state.ThrowSecurityError(
           "Sandboxed documents aren't allowed to show a file picker.");
       return ScriptPromise();

diff --git a/third_party/blink/renderer/modules/peerconnection/rtc_peer_connection.cc b/third_party/blink/renderer/modules/peerconnection/rtc_peer_connection.cc
index f48333f..3484f28c 100644
--- a/third_party/blink/renderer/modules/peerconnection/rtc_peer_connection.cc
+++ b/third_party/blink/renderer/modules/peerconnection/rtc_peer_connection.cc

@@ -2288,7 +2288,7 @@
     }
     // Allowed characters: a-z 0-9 _ and -
     if (encoding.rid.find_first_not_of("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLM"
-                                       "NOPQRSTUVWXYZ012456789-_") !=
+                                       "NOPQRSTUVWXYZ0123456789-_") !=
         std::string::npos) {
       exception_state.ThrowTypeError("Illegal character in rid");
       return nullptr;

diff --git a/third_party/blink/renderer/modules/presentation/presentation_request.cc b/third_party/blink/renderer/modules/presentation/presentation_request.cc
index 9483efa4..93e291d 100644
--- a/third_party/blink/renderer/modules/presentation/presentation_request.cc
+++ b/third_party/blink/renderer/modules/presentation/presentation_request.cc

@@ -60,8 +60,8 @@
     const Vector<String>& urls,
     ExceptionState& exception_state) {
   if (Document::From(execution_context)
-          ->IsSandboxed(
-              mojom::blink::WebSandboxFlags::kPresentationController)) {
+          ->IsSandboxed(network::mojom::blink::WebSandboxFlags::
+                            kPresentationController)) {
     exception_state.ThrowSecurityError(
         "The document is sandboxed and lacks the 'allow-presentation' flag.");
     return nullptr;

diff --git a/third_party/blink/renderer/modules/screen_orientation/screen_orientation.cc b/third_party/blink/renderer/modules/screen_orientation/screen_orientation.cc
index b232b8fb..3a9d1b4b 100644
--- a/third_party/blink/renderer/modules/screen_orientation/screen_orientation.cc
+++ b/third_party/blink/renderer/modules/screen_orientation/screen_orientation.cc

@@ -7,6 +7,7 @@
 #include <memory>
 
 #include "base/stl_util.h"
+#include "services/network/public/mojom/web_sandbox_flags.mojom-blink.h"
 #include "third_party/blink/public/common/screen_orientation/web_screen_orientation_type.h"
 #include "third_party/blink/renderer/bindings/core/v8/script_promise.h"
 #include "third_party/blink/renderer/bindings/core/v8/script_promise_resolver.h"
@@ -161,7 +162,8 @@
     return ScriptPromise();
   }
 
-  if (document->IsSandboxed(mojom::blink::WebSandboxFlags::kOrientationLock)) {
+  if (document->IsSandboxed(
+          network::mojom::blink::WebSandboxFlags::kOrientationLock)) {
     exception_state.ThrowSecurityError(
         "The document is sandboxed and lacks the "
         "'allow-orientation-lock' flag.");

diff --git a/third_party/blink/renderer/modules/service_worker/navigator_service_worker.cc b/third_party/blink/renderer/modules/service_worker/navigator_service_worker.cc
index 668a8deb..7e2bab5 100644
--- a/third_party/blink/renderer/modules/service_worker/navigator_service_worker.cc
+++ b/third_party/blink/renderer/modules/service_worker/navigator_service_worker.cc

@@ -4,6 +4,7 @@
 
 #include "third_party/blink/renderer/modules/service_worker/navigator_service_worker.h"
 
+#include "services/network/public/mojom/web_sandbox_flags.mojom-blink.h"
 #include "third_party/blink/renderer/core/dom/document.h"
 #include "third_party/blink/renderer/core/execution_context/execution_context.h"
 #include "third_party/blink/renderer/core/frame/local_dom_window.h"
@@ -91,7 +92,7 @@
            ->CanAccessServiceWorkers()) {
     String error_message;
     if (frame->GetSecurityContext()->IsSandboxed(
-            mojom::blink::WebSandboxFlags::kOrigin)) {
+            network::mojom::blink::WebSandboxFlags::kOrigin)) {
       error_message =
           "Service worker is disabled because the context is sandboxed and "
           "lacks the 'allow-same-origin' flag.";

diff --git a/third_party/blink/renderer/modules/storage/dom_window_storage.cc b/third_party/blink/renderer/modules/storage/dom_window_storage.cc
index 31e07a88..709572e9 100644
--- a/third_party/blink/renderer/modules/storage/dom_window_storage.cc
+++ b/third_party/blink/renderer/modules/storage/dom_window_storage.cc

@@ -6,6 +6,7 @@
 
 #include "base/feature_list.h"
 #include "base/memory/scoped_refptr.h"
+#include "services/network/public/mojom/web_sandbox_flags.mojom-blink.h"
 #include "third_party/blink/public/common/features.h"
 #include "third_party/blink/renderer/core/dom/document.h"
 #include "third_party/blink/renderer/core/frame/local_dom_window.h"
@@ -64,7 +65,7 @@
   DCHECK(document);
   String access_denied_message = "Access is denied for this document.";
   if (!document->GetSecurityOrigin()->CanAccessSessionStorage()) {
-    if (document->IsSandboxed(mojom::blink::WebSandboxFlags::kOrigin))
+    if (document->IsSandboxed(network::mojom::blink::WebSandboxFlags::kOrigin))
       exception_state.ThrowSecurityError(
           "The document is sandboxed and lacks the 'allow-same-origin' flag.");
     else if (document->Url().ProtocolIs("data"))
@@ -116,7 +117,7 @@
   DCHECK(document);
   String access_denied_message = "Access is denied for this document.";
   if (!document->GetSecurityOrigin()->CanAccessLocalStorage()) {
-    if (document->IsSandboxed(mojom::blink::WebSandboxFlags::kOrigin))
+    if (document->IsSandboxed(network::mojom::blink::WebSandboxFlags::kOrigin))
       exception_state.ThrowSecurityError(
           "The document is sandboxed and lacks the 'allow-same-origin' flag.");
     else if (document->Url().ProtocolIs("data"))

diff --git a/third_party/blink/renderer/platform/graphics/placeholder_image.cc b/third_party/blink/renderer/platform/graphics/placeholder_image.cc
index ab027f0..794ee34f 100644
--- a/third_party/blink/renderer/platform/graphics/placeholder_image.cc
+++ b/third_party/blink/renderer/platform/graphics/placeholder_image.cc

@@ -207,14 +207,12 @@
 
 PlaceholderImage::PlaceholderImage(ImageObserver* observer,
                                    const IntSize& size,
-                                   int64_t original_resource_size,
-                                   bool is_lazy_image)
+                                   int64_t original_resource_size)
     : Image(observer),
       size_(size),
       text_(original_resource_size <= 0
                 ? String()
                 : FormatOriginalResourceSizeBytes(original_resource_size)),
-      is_lazy_image_(is_lazy_image),
       paint_record_content_id_(-1) {}
 
 PlaceholderImage::~PlaceholderImage() = default;
@@ -282,10 +280,6 @@
                                      static_cast<float>(size_.Height())))) {
     return;
   }
-  if (is_lazy_image_) {
-    // Keep the image without any color and text decorations.
-    return;
-  }
 
   PaintFlags flags(base_flags);
   flags.setStyle(PaintFlags::kFill_Style);

diff --git a/third_party/blink/renderer/platform/graphics/placeholder_image.h b/third_party/blink/renderer/platform/graphics/placeholder_image.h
index e1e70680..c6a6f4ff 100644
--- a/third_party/blink/renderer/platform/graphics/placeholder_image.h
+++ b/third_party/blink/renderer/platform/graphics/placeholder_image.h

@@ -26,8 +26,7 @@
 class ImageObserver;
 
 // A generated placeholder image that shows a translucent gray rectangle with
-// the full resource size (for example, 100KB) shown in the center. For
-// LazyImages the placeholder image will be a plain translucent rectangle.
+// the full resource size (for example, 100KB) shown in the center.
 class PLATFORM_EXPORT PlaceholderImage final : public Image {
  public:
   static scoped_refptr<PlaceholderImage> Create(
@@ -35,13 +34,7 @@
       const IntSize& size,
       int64_t original_resource_size) {
     return base::AdoptRef(
-        new PlaceholderImage(observer, size, original_resource_size, false));
-  }
-
-  static scoped_refptr<PlaceholderImage> CreateForLazyImages(
-      ImageObserver* observer,
-      const IntSize& size) {
-    return base::AdoptRef(new PlaceholderImage(observer, size, 0, true));
+        new PlaceholderImage(observer, size, original_resource_size));
   }
 
   ~PlaceholderImage() override;
@@ -70,8 +63,7 @@
  private:
   PlaceholderImage(ImageObserver*,
                    const IntSize&,
-                   int64_t original_resource_size,
-                   bool is_lazy_image);
+                   int64_t original_resource_size);
 
   bool CurrentFrameHasSingleSecurityOrigin() const override;
 
@@ -92,9 +84,6 @@
   const IntSize size_;
   const String text_;
 
-  // This placeholder image is used for lazyloading of images.
-  bool is_lazy_image_;
-
   float icon_and_text_scale_factor_ = 1.0f;
 
   class SharedFont;

diff --git a/third_party/blink/renderer/platform/graphics/placeholder_image_test.cc b/third_party/blink/renderer/platform/graphics/placeholder_image_test.cc
index eb5c062..76e28796 100644
--- a/third_party/blink/renderer/platform/graphics/placeholder_image_test.cc
+++ b/third_party/blink/renderer/platform/graphics/placeholder_image_test.cc

@@ -281,19 +281,6 @@
   }
 }
 
-TEST_F(PlaceholderImageTest, DrawLazyImage) {
-  MockPaintCanvas canvas;
-  EXPECT_CALL(canvas, drawRect(_, _)).Times(0);
-  EXPECT_CALL(canvas, drawImageRect(_, _, _, _, _)).Times(0);
-  EXPECT_CALL(canvas, drawTextBlob(_, _, _, _)).Times(0);
-
-  PlaceholderImage::CreateForLazyImages(nullptr, IntSize(800, 600))
-      ->Draw(&canvas, PaintFlags(), FloatRect(0.0f, 0.0f, 800.0f, 600.0f),
-             FloatRect(0.0f, 0.0f, 800.0f, 600.0f),
-             kDoNotRespectImageOrientation, Image::kClampImageToSourceRect,
-             Image::kUnspecifiedDecode);
-}
-
 TEST_F(PlaceholderImageTest, DrawNonIntersectingSrcRect) {
   MockPaintCanvas canvas;
   EXPECT_CALL(canvas, drawRect(_, _)).Times(0);

diff --git a/third_party/blink/renderer/platform/loader/fetch/fetch_parameters.cc b/third_party/blink/renderer/platform/loader/fetch/fetch_parameters.cc
index d72feae..6d4df25 100644
--- a/third_party/blink/renderer/platform/loader/fetch/fetch_parameters.cc
+++ b/third_party/blink/renderer/platform/loader/fetch/fetch_parameters.cc

@@ -112,40 +112,13 @@
 }
 
 void FetchParameters::SetLazyImageDeferred() {
-  resource_request_.SetPreviewsState(resource_request_.GetPreviewsState() |
-                                     WebURLRequest::kLazyImageLoadDeferred);
   DCHECK_EQ(kNone, image_request_behavior_);
   image_request_behavior_ = kDeferImageLoad;
 }
 
 void FetchParameters::SetLazyImageNonBlocking() {
+  // TODO(domfarolino): [Before merging]: can we DCHECK here.
   image_request_behavior_ = kNonBlockingImage;
 }
 
-void FetchParameters::SetAllowImagePlaceholder() {
-  DCHECK_EQ(kNone, image_request_behavior_);
-  if (!resource_request_.Url().ProtocolIsInHTTPFamily() ||
-      resource_request_.HttpMethod() != "GET" ||
-      !resource_request_.HttpHeaderField("range").IsNull()) {
-    // Make sure that the request isn't marked as using an image preview type,
-    // since without loading an image placeholder, Client Lo-Fi isn't really
-    // in use.
-    resource_request_.SetPreviewsState(resource_request_.GetPreviewsState() &
-                                       ~WebURLRequest::kLazyImageLoadDeferred);
-    return;
-  }
-
-  image_request_behavior_ = kAllowPlaceholder;
-
-  // Fetch the first few bytes of the image. This number is tuned to both (a)
-  // likely capture the entire image for small images and (b) likely contain
-  // the dimensions for larger images.
-  // TODO(sclittle): Calculate the optimal value for this number.
-  resource_request_.SetHttpHeaderField("range", "bytes=0-2047");
-
-  // TODO(sclittle): Indicate somehow (e.g. through a new request bit) to the
-  // embedder that it should return the full resource if the entire resource is
-  // fresh in the cache.
-}
-
 }  // namespace blink

diff --git a/third_party/blink/renderer/platform/loader/fetch/fetch_parameters.h b/third_party/blink/renderer/platform/loader/fetch/fetch_parameters.h
index 24fe425..b2adcf0 100644
--- a/third_party/blink/renderer/platform/loader/fetch/fetch_parameters.h
+++ b/third_party/blink/renderer/platform/loader/fetch/fetch_parameters.h

@@ -58,7 +58,6 @@
   };
   enum ImageRequestBehavior {
     kNone = 0,          // No optimization.
-    kAllowPlaceholder,  // The image is allowed to be a placeholder.
     kDeferImageLoad,    // Defer loading the image from network. Full image
                         // might still load if the request is already-loaded or
                         // in memory cache.
@@ -189,12 +188,6 @@
   void SetLazyImageDeferred();
   void SetLazyImageNonBlocking();
 
-  // Configures the request to load an image placeholder if the request is
-  // eligible (e.g. the url's protocol is HTTP, etc.). If this request is
-  // non-eligible, this method doesn't modify the ResourceRequest. Calling this
-  // method sets image_request_behavior_ to the appropriate value.
-  void SetAllowImagePlaceholder();
-
   // See documentation in blink::ResourceRequest.
   bool IsFromOriginDirtyStyleSheet() const {
     return is_from_origin_dirty_style_sheet_;

diff --git a/third_party/blink/web_tests/TestExpectations b/third_party/blink/web_tests/TestExpectations
index ec553f9..bbb3461 100644
--- a/third_party/blink/web_tests/TestExpectations
+++ b/third_party/blink/web_tests/TestExpectations

@@ -6661,6 +6661,9 @@
 # These tests will pass once the --enable-features=TrustTokens flag is on by default.
 crbug.com/1061765 external/wpt/trust-tokens/end-to-end/* [ Skip ]
 
+# Test flakes
+crbug.com/1066716 http/tests/cache/zero-length-xhr.html [ Pass Timeout ]
+
 # Sheriff 2020-04-04
 crbug.com/1067533 [ Mac10.10 ] external/wpt/shape-detection/idlharness.https.any.sharedworker.html [ Pass Failure ]
 

diff --git a/third_party/blink/web_tests/css3/filters/filter-effect-removed.html b/third_party/blink/web_tests/css3/filters/filter-effect-removed.html
deleted file mode 100644
index d3a1146..0000000
--- a/third_party/blink/web_tests/css3/filters/filter-effect-removed.html
+++ /dev/null

@@ -1,36 +0,0 @@
-<!DOCTYPE html>
-  <svg xmlns="http://www.w3.org/2000/svg" width="0" height="0" version="1.1">
-  <defs id="svgDefs" style="display:none">
-   <filter id="blurY" color-interpolation-filters="sRGB">
-    <feGaussianBlur id="blurEffect" stdDeviation="0 5">
-    </feGaussianBlur>
-   </filter>
-  </defs>
- </svg>
-
-<script>
-  onload = function() {
-    // Render one frame with the blur effect, then remove it.
-    window.requestAnimationFrame(function() {
-      window.requestAnimationFrame(function() {
-        var filterElement = document.getElementById("blurY");
-        var filterEffectElement = document.getElementById("blurEffect");
-        filterElement.removeChild(filterEffectElement);
-
-        // Ensure we draw a frame.
-        document.getElementById("other").style.backgroundColor = "blue";
-
-        if (window.testRunner)
-          testRunner.notifyDone();
-      });
-    });
-
-  }
-
-  if (window.testRunner)
-    testRunner.waitUntilDone();
-</script>
-
-<img src="resources/reference.png" style="filter: url(#blurY);">
-
-<div id="other" style="width: 10px; height: 10px"></div>

diff --git a/third_party/blink/web_tests/editing/spelling/spellcheck-remove-markers.html b/third_party/blink/web_tests/editing/spelling/spellcheck-remove-markers.html
index 8696e38..1640592 100644
--- a/third_party/blink/web_tests/editing/spelling/spellcheck-remove-markers.html
+++ b/third_party/blink/web_tests/editing/spelling/spellcheck-remove-markers.html

@@ -96,4 +96,29 @@
         'Removing "contenteditable" attribute on child still keeps the spelling markers.')
     });
 
+  spellcheck_test(
+    '<textarea>|zz. I have a issue.</textarea>',
+    '',
+    '<textarea>#zz#. I have ~a~ issue.</textarea>',
+    {
+      title: '8) Setup for the initial markers.',
+      callback: sample => spellcheck_test(
+        sample,
+        document => document.querySelector('textarea').setAttribute('readonly', ''),
+        '<textarea readonly>zz. I have a issue.</textarea>',
+        'Setting "readonly" attribute removes spelling markers.')
+    });
+
+  spellcheck_test(
+    '<textarea>|zz. I have a issue.</textarea>',
+    '',
+    '<textarea>#zz#. I have ~a~ issue.</textarea>',
+    {
+      title: '9) Setup for the initial markers.',
+      callback: sample => spellcheck_test(
+        sample,
+        document => document.querySelector('textarea').setAttribute('disabled', ''),
+        '<textarea disabled>zz. I have a issue.</textarea>',
+        'Setting "disabled" attribute removes spelling markers.')
+    });
 </script>

diff --git a/third_party/blink/web_tests/external/WPT_BASE_MANIFEST_7.json b/third_party/blink/web_tests/external/WPT_BASE_MANIFEST_7.json
index 4b95ca2e..01c2e67 100644
--- a/third_party/blink/web_tests/external/WPT_BASE_MANIFEST_7.json
+++ b/third_party/blink/web_tests/external/WPT_BASE_MANIFEST_7.json

@@ -301,6 +301,12 @@
      {}
     ]
    ],
+   "selection/selection-select-all-move-input-crash.html": [
+    [
+     "selection/selection-select-all-move-input-crash.html",
+     {}
+    ]
+   ],
    "svg/animations/end-of-time-crash.html": [
     [
      "svg/animations/end-of-time-crash.html",
@@ -221146,9 +221152,9 @@
      {}
     ]
    ],
-   "css/css-flexbox/percentage-size-quirks-001.html": [
+   "css/css-flexbox/percentage-size-quirks.html": [
     [
-     "css/css-flexbox/percentage-size-quirks-001.html",
+     "css/css-flexbox/percentage-size-quirks.html",
      {}
     ]
    ],
@@ -387405,8 +387411,8 @@
    "8bba5d60f5cae1b93df70c1973a473f163020a51",
    "testharness"
   ],
-  "css/css-flexbox/percentage-size-quirks-001.html": [
-   "0f01c2069726498f9ca5ded6f476f9ed9e96a7ed",
+  "css/css-flexbox/percentage-size-quirks.html": [
+   "1a5c5136bee8eeca54e65ae9bb509c121a98df62",
    "testharness"
   ],
   "css/css-flexbox/percentage-size-subitems-001.html": [
@@ -508557,6 +508563,10 @@
    "9a472a4b2fe5ef4b0e5283e3d957ceefef387ff1",
    "testharness"
   ],
+  "selection/selection-select-all-move-input-crash.html": [
+   "6f692dc5e7d69a30a407f107268c9e012efcd9e3",
+   "crashtest"
+  ],
   "selection/setBaseAndExtent-expected.txt": [
    "496a59e7180b83a167ff2cbfa554e59f1bc9c40b",
    "support"
@@ -522234,7 +522244,7 @@
    "support"
   ],
   "tools/wptrunner/wptrunner/browsers/firefox.py": [
-   "3fbfbfaac81371c774cbb1ac8e96de27fa3c854b",
+   "bfc3ab9a2be5e399738cece75ec8846e069207eb",
    "support"
   ],
   "tools/wptrunner/wptrunner/browsers/firefox_android.py": [

diff --git a/third_party/blink/web_tests/external/wpt/css/css-flexbox/percentage-size-quirks-001.html b/third_party/blink/web_tests/external/wpt/css/css-flexbox/percentage-size-quirks.html
similarity index 95%
rename from third_party/blink/web_tests/external/wpt/css/css-flexbox/percentage-size-quirks-001.html
rename to third_party/blink/web_tests/external/wpt/css/css-flexbox/percentage-size-quirks.html
index 0f01c206..1a5c513 100644
--- a/third_party/blink/web_tests/external/wpt/css/css-flexbox/percentage-size-quirks-001.html
+++ b/third_party/blink/web_tests/external/wpt/css/css-flexbox/percentage-size-quirks.html

@@ -1,8 +1,8 @@
 <title>CSS Flexbox: percentage size in flexbox children in quirks mode</title>
 <link rel="help" href="https://drafts.csswg.org/css-flexbox/#flex-containers">
 <link rel="help" href="https://drafts.csswg.org/css-sizing-3/#percentage-sizing">
-<link rel="help" href="https://bugs.webkit.org/show_bug.cgi?id=81809">
-<meta name="assert" content="This test checks that percentage height/width values in quirks mode are correctly resolved in flexbox children.">
+<link rel="help" href="https://crbug.com/531783">
+<meta name="assert" content="This test checks that percentage height/width values in flexbox children are correctly resolved regardless of quirks mode.">
 <style>
 .flexbox {
     display: flex;

diff --git a/third_party/blink/web_tests/external/wpt/css/filter-effects/filter-effect-remove-unattached.html b/third_party/blink/web_tests/external/wpt/css/filter-effects/filter-effect-remove-unattached.html
new file mode 100644
index 0000000..cfb11af6
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/css/filter-effects/filter-effect-remove-unattached.html

@@ -0,0 +1,40 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<title>CSS Filters: Remove a filter effect from an unattached element</title>
+<link rel="author" title="Ali Juma" href="mailto:ajuma@chromium.org">
+<link rel="help" href="https://drafts.fxtf.org/filter-effects/#FilterProperty">
+<link rel="help" href="https://drafts.fxtf.org/filter-effects-1/#feGaussianBlurElement">
+<link rel="issue" href="https://bugs.chromium.org/p/chromium/issues/detail?id=502026">
+<link rel="match" href="reference/filter-effect-remove-unattached-ref.html">
+<meta name="assert" content="This test ensures that we can remove a filter effect from an unattached element.">
+<script src="/common/reftest-wait.js"></script>
+<svg xmlns="http://www.w3.org/2000/svg" width="0" height="0" version="1.1">
+  <defs id="svgDefs" style="display:none">
+   <filter id="blurY" color-interpolation-filters="sRGB">
+    <feGaussianBlur id="blurEffect" stdDeviation="0 5">
+    </feGaussianBlur>
+   </filter>
+  </defs>
+</svg>
+
+<script>
+  onload = function() {
+    // Render one frame with the blur effect, then remove it.
+    window.requestAnimationFrame(function() {
+      window.requestAnimationFrame(function() {
+        var filterElement = document.getElementById("blurY");
+        var filterEffectElement = document.getElementById("blurEffect");
+        filterElement.removeChild(filterEffectElement);
+
+        // Ensure we draw a frame.
+        document.getElementById("other").style.backgroundColor = "blue";
+        takeScreenshot();
+      });
+    });
+  }
+</script>
+
+<img src="resources/reference.png" style="filter: url(#blurY);">
+
+<div id="other" style="width: 10px; height: 10px"></div>
+</html>
\ No newline at end of file

diff --git a/third_party/blink/web_tests/css3/filters/filter-effect-removed-expected.html b/third_party/blink/web_tests/external/wpt/css/filter-effects/reference/filter-effect-remove-unattached-ref.html
similarity index 81%
rename from third_party/blink/web_tests/css3/filters/filter-effect-removed-expected.html
rename to third_party/blink/web_tests/external/wpt/css/filter-effects/reference/filter-effect-remove-unattached-ref.html
index c9d97e4..5f9f7a7 100644
--- a/third_party/blink/web_tests/css3/filters/filter-effect-removed-expected.html
+++ b/third_party/blink/web_tests/external/wpt/css/filter-effects/reference/filter-effect-remove-unattached-ref.html

@@ -6,6 +6,6 @@
   </defs>
  </svg>
 
-<img src="resources/reference.png" style="filter: url(#blurY);">
+<img src="../resources/reference.png" style="filter: url(#blurY);">
 
 <div id="other" style="width: 10px; height: 10px; background-color: blue;"></div>

diff --git a/third_party/blink/web_tests/external/wpt/css/filter-effects/resources/reference.png b/third_party/blink/web_tests/external/wpt/css/filter-effects/resources/reference.png
new file mode 100644
index 0000000..68641b76
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/css/filter-effects/resources/reference.png
Binary files differ

diff --git a/third_party/blink/web_tests/external/wpt/selection/selection-select-all-move-input-crash.html b/third_party/blink/web_tests/external/wpt/selection/selection-select-all-move-input-crash.html
new file mode 100644
index 0000000..6f692dc5
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/selection/selection-select-all-move-input-crash.html

@@ -0,0 +1,10 @@
+<script>
+  function start() {
+    document.execCommand('selectAll', false)
+    document.documentElement.appendChild(document.getElementById('input'))
+  }
+</script>
+<body onload="start()">
+<input id="input" autofocus>
+<canvas contenteditable="true" hidden></canvas>
+</body>

diff --git a/third_party/blink/web_tests/external/wpt/tools/wptrunner/wptrunner/browsers/firefox.py b/third_party/blink/web_tests/external/wpt/tools/wptrunner/wptrunner/browsers/firefox.py
index 3fbfbfa..bfc3ab9a 100644
--- a/third_party/blink/web_tests/external/wpt/tools/wptrunner/wptrunner/browsers/firefox.py
+++ b/third_party/blink/web_tests/external/wpt/tools/wptrunner/wptrunner/browsers/firefox.py

@@ -319,7 +319,7 @@
         return self.current
 
     def teardown(self, force=False):
-        for instance, skip_marionette in [self.previous, self.current]:
+        for instance in [self.previous, self.current]:
             if instance:
                 instance.stop(force)
                 instance.cleanup()
@@ -345,11 +345,14 @@
         return self.current
 
     def teardown(self, force=False):
-        for instance, skip_marionette in [(self.previous, False), (self.current, False), (self.pending, True)]:
+        for instance, skip_marionette in [(self.previous, False),
+                                          (self.current, False),
+                                          (self.pending, True)]:
             if instance:
                 instance.stop(force, skip_marionette=skip_marionette)
                 instance.cleanup()
 
+
 class BrowserInstance(object):
     shutdown_timeout = 70
 

diff --git a/tools/metrics/histograms/enums.xml b/tools/metrics/histograms/enums.xml
index cecc259..613864e3 100644
--- a/tools/metrics/histograms/enums.xml
+++ b/tools/metrics/histograms/enums.xml

@@ -19741,7 +19741,6 @@
   <int value="473" label="ReportUserIDData"/>
   <int value="474" label="PrintingAllowedColorModes"/>
   <int value="475" label="PrintingAllowedDuplexModes"/>
-  <int value="476" label="PrintingAllowedPageSizes"/>
   <int value="477" label="PrintingColorDefault"/>
   <int value="478" label="PrintingDuplexDefault"/>
   <int value="479" label="PrintingSizeDefault"/>
@@ -38312,6 +38311,7 @@
   <int value="-1248478422" label="enable-zip-archiver-packer"/>
   <int value="-1247631459" label="TerminalSystemAppSplits:disabled"/>
   <int value="-1246840031" label="OptInImeMenu:disabled"/>
+  <int value="-1245617305" label="NewProfilePicker:enabled"/>
   <int value="-1244772303" label="NtpRealboxMatchOmniboxTheme:enabled"/>
   <int value="-1243694853" label="DeferAllScript:disabled"/>
   <int value="-1241868814" label="WebAuthenticationPhoneSupport:disabled"/>
@@ -39232,6 +39232,7 @@
   <int value="-160571071" label="InterestFeedV2:enabled"/>
   <int value="-159877930" label="MaterialDesignUserManager:disabled"/>
   <int value="-158549277" label="enable-embeddedsearch-api"/>
+  <int value="-153299083" label="NewProfilePicker:disabled"/>
   <int value="-152677714" label="AsmJsToWebAssembly:enabled"/>
   <int value="-152632720" label="RuntimeHostPermissions:enabled"/>
   <int value="-147283486" label="enable-network-portal-notification"/>

diff --git a/tools/metrics/histograms/histograms.xml b/tools/metrics/histograms/histograms.xml
index ec65f174..28b14c3 100644
--- a/tools/metrics/histograms/histograms.xml
+++ b/tools/metrics/histograms/histograms.xml

@@ -5914,7 +5914,7 @@
 </histogram>
 
 <histogram name="Apps.AppList.LauncherSearchProvider.QueryTime" units="ms"
-    expires_after="2019-12-31">
+    expires_after="2020-12-31">
   <owner>jennyz@chromium.org</owner>
   <owner>newcomer@chromium.org</owner>
   <summary>
@@ -56847,8 +56847,9 @@
 </histogram>
 
 <histogram name="Feedback.RequestSource" enum="FeedbackSource"
-    expires_after="2020-04-05">
+    expires_after="2022-04-05">
   <owner>afakhry@chromium.org</owner>
+  <owner>cros-telemetry@google.com</owner>
   <summary>Records the source that requested showing the feedback app.</summary>
 </histogram>
 
@@ -147954,8 +147955,9 @@
 </histogram>
 
 <histogram name="Session.ClosedTabCounts" units="operations"
-    expires_after="M81">
+    expires_after="2021-04-19">
   <owner>rohitrao@chromium.org</owner>
+  <owner>marq@chromium.org</owner>
   <summary>
     The number of tabs closed by the user during the current session
     (launch/foregrounding to backgrounding).
@@ -147964,8 +147966,10 @@
   </summary>
 </histogram>
 
-<histogram name="Session.NewTabCounts" units="operations" expires_after="M85">
+<histogram name="Session.NewTabCounts" units="operations"
+    expires_after="2021-04-19">
   <owner>rohitrao@chromium.org</owner>
+  <owner>marq@chromium.org</owner>
   <summary>
     The number of tabs created by the user during the current session
     (launch/foregrounding to backgrounding).
@@ -147975,8 +147979,9 @@
 </histogram>
 
 <histogram name="Session.OpenedTabCounts" units="operations"
-    expires_after="2020-04-19">
+    expires_after="2021-04-19">
   <owner>rohitrao@chromium.org</owner>
+  <owner>marq@chromium.org</owner>
   <summary>
     The number of times the user changed the active tab (this can happen when
     manually selecting a new tab, when a pre-rendered tab is made active, when

diff --git a/tools/metrics/ukm/ukm.xml b/tools/metrics/ukm/ukm.xml
index 3f4b868..d568bda0 100644
--- a/tools/metrics/ukm/ukm.xml
+++ b/tools/metrics/ukm/ukm.xml

@@ -7108,6 +7108,62 @@
       </history>
     </aggregation>
   </metric>
+  <metric name="ForegroundNumInputEvents">
+    <summary>
+      The number of Input Events, recorded each time the page is backgrounded.
+    </summary>
+    <aggregation>
+      <history>
+        <index fields="profile.country"/>
+        <index fields="profile.country,profile.system_ram"/>
+        <index fields="profile.is_dominant_version"/>
+        <index fields="profile.is_latest_version"/>
+        <index fields="profile.system_ram"/>
+        <statistics>
+          <quantiles type="std-percentiles"/>
+        </statistics>
+      </history>
+    </aggregation>
+  </metric>
+  <metric name="ForegroundTotalAdjustedInputDelay">
+    <summary>
+      sum(max(Input Delay - 50, 0)), recorded each time the page is
+      backgrounded. The Input Delay refers to the duration between the hardware
+      timestamp and the start of event processing on the main thread for the
+      meaningful input. In ms.
+    </summary>
+    <aggregation>
+      <history>
+        <index fields="profile.country"/>
+        <index fields="profile.country,profile.system_ram"/>
+        <index fields="profile.is_dominant_version"/>
+        <index fields="profile.is_latest_version"/>
+        <index fields="profile.system_ram"/>
+        <statistics>
+          <quantiles type="std-percentiles"/>
+        </statistics>
+      </history>
+    </aggregation>
+  </metric>
+  <metric name="ForegroundTotalInputDelay">
+    <summary>
+      sum(Input Delay), recorded each time the page is backgrounded. The Input
+      Delay refers to the duration between the hardware timestamp and the start
+      of event processing on the main thread for the meaningful input. In ms.
+    </summary>
+    <aggregation>
+      <history>
+        <index fields="profile.country"/>
+        <index fields="profile.country,profile.system_ram"/>
+        <index fields="profile.is_dominant_version"/>
+        <index fields="profile.is_latest_version"/>
+        <index fields="profile.system_ram"/>
+        <statistics>
+          <quantiles type="std-percentiles"/>
+        </statistics>
+      </history>
+    </aggregation>
+  </metric>
 </event>
 
 <event name="PageInfoBubble">

diff --git a/tools/perf/page_sets/media_cases.py b/tools/perf/page_sets/media_cases.py
index 1cdf9aa..021af83 100644
--- a/tools/perf/page_sets/media_cases.py
+++ b/tools/perf/page_sets/media_cases.py

@@ -166,11 +166,11 @@
     self._background_time = background_time
     tags.append('background')
     tags.append('src')
-    # disable-media-suspend is required since for Android background playback
-    # gets suspended. This flag makes Android work the same way as desktop and
-    # not turn off video playback in the background.
+    # --disable-background-media-suspend is required since for Android,
+    # background playback gets suspended. This flag makes Android work the same
+    # way as desktop and not turn off video playback in the background.
     extra_browser_args = extra_browser_args or []
-    extra_browser_args.append('--disable-media-suspend')
+    extra_browser_args.append('--disable-background-media-suspend')
     super(_BackgroundPlaybackPage, self).__init__(
         url, page_set, tags, extra_browser_args)
 

diff --git a/ui/accessibility/platform/ax_platform_node_auralinux.cc b/ui/accessibility/platform/ax_platform_node_auralinux.cc
index e36c8f7..8fea560 100644
--- a/ui/accessibility/platform/ax_platform_node_auralinux.cc
+++ b/ui/accessibility/platform/ax_platform_node_auralinux.cc

@@ -2552,9 +2552,9 @@
 AtkRole AXPlatformNodeAuraLinux::GetAtkRole() const {
   switch (GetData().role) {
     case ax::mojom::Role::kAlert:
-      return ATK_ROLE_ALERT;
+      return ATK_ROLE_NOTIFICATION;
     case ax::mojom::Role::kAlertDialog:
-      return ATK_ROLE_DIALOG;
+      return ATK_ROLE_ALERT;
     case ax::mojom::Role::kAnchor:
       return ATK_ROLE_LINK;
     case ax::mojom::Role::kComment:

diff --git a/ui/accessibility/platform/ax_platform_node_auralinux_unittest.cc b/ui/accessibility/platform/ax_platform_node_auralinux_unittest.cc
index 9ce1fa7..b120f74 100644
--- a/ui/accessibility/platform/ax_platform_node_auralinux_unittest.cc
+++ b/ui/accessibility/platform/ax_platform_node_auralinux_unittest.cc

@@ -284,6 +284,14 @@
   AtkObject* child_obj(AtkObjectFromNode(child_node));
   ASSERT_TRUE(ATK_IS_OBJECT(child_obj));
   g_object_ref(child_obj);
+  EXPECT_EQ(ATK_ROLE_NOTIFICATION, atk_object_get_role(child_obj));
+  g_object_unref(child_obj);
+
+  child.role = ax::mojom::Role::kAlertDialog;
+  child_node->SetData(child);
+  child_obj = AtkObjectFromNode(child_node);
+  ASSERT_TRUE(ATK_IS_OBJECT(child_obj));
+  g_object_ref(child_obj);
   EXPECT_EQ(ATK_ROLE_ALERT, atk_object_get_role(child_obj));
   g_object_unref(child_obj);
 

diff --git a/ui/base/x/x11_window.cc b/ui/base/x/x11_window.cc
index 62c8122e..29582a63 100644
--- a/ui/base/x/x11_window.cc
+++ b/ui/base/x/x11_window.cc

@@ -644,6 +644,11 @@
   // |bounds_in_pixels_| later.
   bounds_in_pixels_ = bounds_in_pixels;
   ResetWindowRegion();
+
+  // Even if the pixel bounds didn't change this call to the delegate should
+  // still happen. The device scale factor may have changed which effectively
+  // changes the bounds.
+  OnXWindowBoundsChanged(bounds_in_pixels);
 }
 
 bool XWindow::IsXWindowVisible() const {
@@ -722,6 +727,7 @@
 }
 
 void XWindow::SetCursor(::Cursor cursor) {
+  last_cursor_ = cursor;
   XDefineCursor(xdisplay_, xwindow_, cursor);
 }
 

diff --git a/ui/base/x/x11_window.h b/ui/base/x/x11_window.h
index d0f852b1..d565e123 100644
--- a/ui/base/x/x11_window.h
+++ b/ui/base/x/x11_window.h

@@ -169,6 +169,7 @@
   ::Region shape() const { return window_shape_.get(); }
   XID update_counter() const { return update_counter_; }
   XID extended_update_counter() const { return extended_update_counter_; }
+  ::Cursor last_cursor() const { return last_cursor_; }
 
  protected:
   // Updates |xwindow_|'s _NET_WM_USER_TIME if |xwindow_| is active.
@@ -378,6 +379,8 @@
   bool has_pointer_barriers_ = false;
   std::array<XID, 4> pointer_barriers_;
 
+  ::Cursor last_cursor_ = x11::None;
+
   base::WeakPtrFactory<XWindow> resize_weak_factory_{this};
 };
 

diff --git a/ui/gl/gl_surface_egl.cc b/ui/gl/gl_surface_egl.cc
index 5e4f30b8..31d88fa 100644
--- a/ui/gl/gl_surface_egl.cc
+++ b/ui/gl/gl_surface_egl.cc

@@ -38,12 +38,6 @@
 #include "ui/gl/scoped_make_current.h"
 #include "ui/gl/sync_control_vsync_provider.h"
 
-#if defined(USE_X11)
-#include "ui/base/x/x11_display_util.h"
-#include "ui/base/x/x11_util_internal.h"  // nogncheck
-#include "ui/gfx/x/x11.h"
-#endif
-
 #if defined(OS_ANDROID)
 #include <android/native_window_jni.h>
 #include "base/android/build_info.h"

diff --git a/ui/message_center/views/message_view.cc b/ui/message_center/views/message_view.cc
index a400013..5570f833 100644
--- a/ui/message_center/views/message_view.cc
+++ b/ui/message_center/views/message_view.cc

@@ -82,9 +82,6 @@
   views::HighlightPathGenerator::Install(
       this, std::make_unique<HighlightPathGenerator>());
 
-  // TODO(amehfooz): Remove explicit color setting after native theme changes.
-  focus_ring_->SetColor(gfx::kGoogleBlue500);
-
   // Paint to a dedicated layer to make the layer non-opaque.
   SetPaintToLayer();
   layer()->SetFillsBoundsOpaquely(false);

diff --git a/ui/native_theme/native_theme_win.cc b/ui/native_theme/native_theme_win.cc
index 79202ee..268031b 100644
--- a/ui/native_theme/native_theme_win.cc
+++ b/ui/native_theme/native_theme_win.cc

@@ -590,12 +590,14 @@
   if (color_scheme == ColorScheme::kDefault)
     color_scheme = GetDefaultSystemColorScheme();
 
-  return (color_scheme == ColorScheme::kPlatformHighContrast)
-             ? GetPlatformHighContrastColor(color_id)
-             : NativeTheme::GetSystemColor(color_id, color_scheme);
+  base::Optional<SkColor> color;
+  if (color_scheme == ColorScheme::kPlatformHighContrast)
+    color = GetPlatformHighContrastColor(color_id);
+  return color.value_or(NativeTheme::GetSystemColor(color_id, color_scheme));
 }
 
-SkColor NativeThemeWin::GetPlatformHighContrastColor(ColorId color_id) const {
+base::Optional<SkColor> NativeThemeWin::GetPlatformHighContrastColor(
+    ColorId color_id) const {
   switch (color_id) {
     // Window Background
     case kColorId_WindowBackground:
@@ -692,7 +694,7 @@
       return system_colors_[SystemThemeColor::kHighlightText];
 
     default:
-      return gfx::kPlaceholderColor;
+      return base::nullopt;
   }
 }
 

diff --git a/ui/native_theme/native_theme_win.h b/ui/native_theme/native_theme_win.h
index 699d1a3..c6a15a8 100644
--- a/ui/native_theme/native_theme_win.h
+++ b/ui/native_theme/native_theme_win.h

@@ -15,6 +15,7 @@
 #include "base/compiler_specific.h"
 #include "base/macros.h"
 #include "base/no_destructor.h"
+#include "base/optional.h"
 #include "base/win/registry.h"
 #include "third_party/skia/include/core/SkColor.h"
 #include "ui/gfx/geometry/size.h"
@@ -196,7 +197,7 @@
 
   // Returns the platform provided high contrast color for the given
   // |color_id|.
-  SkColor GetPlatformHighContrastColor(ColorId color_id) const;
+  base::Optional<SkColor> GetPlatformHighContrastColor(ColorId color_id) const;
 
   // Dark Mode registry key.
   base::win::RegKey hkcu_themes_regkey_;

diff --git a/ui/platform_window/x11/OWNERS b/ui/platform_window/x11/OWNERS
new file mode 100644
index 0000000..280ba478
--- /dev/null
+++ b/ui/platform_window/x11/OWNERS

@@ -0,0 +1 @@
+thomasanderson@chromium.org

diff --git a/ui/platform_window/x11/x11_window.cc b/ui/platform_window/x11/x11_window.cc
index e42446d..1637dab 100644
--- a/ui/platform_window/x11/x11_window.cc
+++ b/ui/platform_window/x11/x11_window.cc

@@ -208,11 +208,6 @@
   // (possibly synthetic) ConfigureNotify about the actual size and correct
   // |bounds_| later.
   XWindow::SetBounds(bounds_in_pixels);
-
-  // Even if the pixel bounds didn't change this call to the delegate should
-  // still happen. The device scale factor may have changed which effectively
-  // changes the bounds.
-  platform_window_delegate_->OnBoundsChanged(bounds_in_pixels);
 }
 
 gfx::Rect X11Window::GetBounds() {

diff --git a/ui/views/BUILD.gn b/ui/views/BUILD.gn
index d3fa4cd0..e4db994 100644
--- a/ui/views/BUILD.gn
+++ b/ui/views/BUILD.gn

@@ -808,9 +808,14 @@
         ]
       }
       if (is_linux || is_fuchsia) {
-        public += [ "widget/desktop_aura/desktop_window_tree_host_platform.h" ]
-        sources +=
-            [ "widget/desktop_aura/desktop_window_tree_host_platform.cc" ]
+        public += [
+          "widget/desktop_aura/desktop_window_tree_host_platform.h",
+          "widget/desktop_aura/window_move_client_platform.h",
+        ]
+        sources += [
+          "widget/desktop_aura/desktop_window_tree_host_platform.cc",
+          "widget/desktop_aura/window_move_client_platform.cc",
+        ]
         deps += [ "//ui/platform_window/extensions" ]
       }
       if (use_atk) {

diff --git a/ui/views/widget/desktop_aura/desktop_drag_drop_client_aurax11.cc b/ui/views/widget/desktop_aura/desktop_drag_drop_client_aurax11.cc
index 707f2b4..565ac52 100644
--- a/ui/views/widget/desktop_aura/desktop_drag_drop_client_aurax11.cc
+++ b/ui/views/widget/desktop_aura/desktop_drag_drop_client_aurax11.cc

@@ -171,8 +171,11 @@
   // Windows has a specific method, DoDragDrop(), which performs the entire
   // drag. We have to emulate this, so we spin off a nested runloop which will
   // track all cursor movement and reroute events to a specific handler.
-  move_loop_->RunMoveLoop(source_window, cursor_manager_->GetInitializedCursor(
-                                             ui::mojom::CursorType::kGrabbing));
+  move_loop_->RunMoveLoop(
+      !source_window->HasCapture(),
+      source_window->GetHost()->last_cursor().platform(),
+      cursor_manager_->GetInitializedCursor(ui::mojom::CursorType::kGrabbing)
+          .platform());
 
   if (alive) {
     auto resulting_operation = negotiated_operation();
@@ -362,7 +365,8 @@
       cursor_type = ui::mojom::CursorType::kDndLink;
       break;
   }
-  move_loop_->UpdateCursor(cursor_manager_->GetInitializedCursor(cursor_type));
+  move_loop_->UpdateCursor(
+      cursor_manager_->GetInitializedCursor(cursor_type).platform());
 }
 
 void DesktopDragDropClientAuraX11::OnBeginForeignDrag(XID window) {

diff --git a/ui/views/widget/desktop_aura/desktop_drag_drop_client_aurax11_unittest.cc b/ui/views/widget/desktop_aura/desktop_drag_drop_client_aurax11_unittest.cc
index b188e6c9..65aa53d 100644
--- a/ui/views/widget/desktop_aura/desktop_drag_drop_client_aurax11_unittest.cc
+++ b/ui/views/widget/desktop_aura/desktop_drag_drop_client_aurax11_unittest.cc

@@ -77,8 +77,10 @@
   bool IsRunning() const;
 
   // X11MoveLoop:
-  bool RunMoveLoop(aura::Window* window, gfx::NativeCursor cursor) override;
-  void UpdateCursor(gfx::NativeCursor cursor) override;
+  bool RunMoveLoop(bool can_grab_pointer,
+                   ::Cursor old_cursor,
+                   ::Cursor new_cursor) override;
+  void UpdateCursor(::Cursor cursor) override;
   void EndMoveLoop() override;
 
  private:
@@ -216,7 +218,9 @@
   return is_running_;
 }
 
-bool TestMoveLoop::RunMoveLoop(aura::Window* window, gfx::NativeCursor cursor) {
+bool TestMoveLoop::RunMoveLoop(bool can_grab_pointer,
+                               ::Cursor old_cursor,
+                               ::Cursor new_cursor) {
   is_running_ = true;
   base::RunLoop run_loop;
   quit_closure_ = run_loop.QuitClosure();
@@ -224,7 +228,7 @@
   return true;
 }
 
-void TestMoveLoop::UpdateCursor(gfx::NativeCursor cursor) {}
+void TestMoveLoop::UpdateCursor(::Cursor cursor) {}
 
 void TestMoveLoop::EndMoveLoop() {
   if (is_running_) {

diff --git a/ui/views/widget/desktop_aura/desktop_window_tree_host_platform.cc b/ui/views/widget/desktop_aura/desktop_window_tree_host_platform.cc
index f3a3175..97e936c 100644
--- a/ui/views/widget/desktop_aura/desktop_window_tree_host_platform.cc
+++ b/ui/views/widget/desktop_aura/desktop_window_tree_host_platform.cc

@@ -28,6 +28,7 @@
 #include "ui/views/widget/widget_aura_utils.h"
 #include "ui/views/window/native_frame_view.h"
 #include "ui/wm/core/window_util.h"
+#include "ui/wm/public/window_move_client.h"
 
 namespace views {
 
@@ -108,7 +109,8 @@
     internal::NativeWidgetDelegate* native_widget_delegate,
     DesktopNativeWidgetAura* desktop_native_widget_aura)
     : native_widget_delegate_(native_widget_delegate),
-      desktop_native_widget_aura_(desktop_native_widget_aura) {}
+      desktop_native_widget_aura_(desktop_native_widget_aura),
+      window_move_client_(this) {}
 
 DesktopWindowTreeHostPlatform::~DesktopWindowTreeHostPlatform() {
   DCHECK(!platform_window()) << "The host must be closed before destroying it.";
@@ -160,6 +162,10 @@
 
 void DesktopWindowTreeHostPlatform::OnNativeWidgetCreated(
     const Widget::InitParams& params) {
+  // This reroutes RunMoveLoop requests to the DesktopWindowTreeHostPlatform.
+  // The availability of this feature depends on a platform (PlatformWindow)
+  // that implements RunMoveLoop.
+  wm::SetWindowMoveClient(window(), &window_move_client_);
   platform_window()->SetUseNativeFrame(params.type ==
                                            Widget::InitParams::TYPE_WINDOW &&
                                        !params.remove_standard_frame);
@@ -646,6 +652,7 @@
 }
 
 void DesktopWindowTreeHostPlatform::OnClosed() {
+  wm::SetWindowMoveClient(window(), nullptr);
   SetPlatformWindow(nullptr);
   desktop_native_widget_aura_->OnHostClosed();
 }

diff --git a/ui/views/widget/desktop_aura/desktop_window_tree_host_platform.h b/ui/views/widget/desktop_aura/desktop_window_tree_host_platform.h
index 24a5fa9..ea97930 100644
--- a/ui/views/widget/desktop_aura/desktop_window_tree_host_platform.h
+++ b/ui/views/widget/desktop_aura/desktop_window_tree_host_platform.h

@@ -16,6 +16,7 @@
 #include "ui/platform_window/extensions/workspace_extension_delegate.h"
 #include "ui/views/views_export.h"
 #include "ui/views/widget/desktop_aura/desktop_window_tree_host.h"
+#include "ui/views/widget/desktop_aura/window_move_client_platform.h"
 
 namespace views {
 
@@ -161,6 +162,9 @@
   // normal state.
   ui::PlatformWindowState old_state_ = ui::PlatformWindowState::kUnknown;
 
+  // Used for tab dragging in move loop requests.
+  WindowMoveClientPlatform window_move_client_;
+
   base::WeakPtrFactory<DesktopWindowTreeHostPlatform> close_widget_factory_{
       this};
 

diff --git a/ui/views/widget/desktop_aura/desktop_window_tree_host_x11.cc b/ui/views/widget/desktop_aura/desktop_window_tree_host_x11.cc
index 2c94941c..dde9acc3 100644
--- a/ui/views/widget/desktop_aura/desktop_window_tree_host_x11.cc
+++ b/ui/views/widget/desktop_aura/desktop_window_tree_host_x11.cc

@@ -72,12 +72,7 @@
     : DesktopWindowTreeHostLinux(native_widget_delegate,
                                  desktop_native_widget_aura) {}
 
-DesktopWindowTreeHostX11::~DesktopWindowTreeHostX11() {
-  wm::SetWindowMoveClient(window(), nullptr);
-
-  // ~DWTHPlatform notifies the DestkopNativeWidgetAura about destruction and
-  // also destroyes the dispatcher.
-}
+DesktopWindowTreeHostX11::~DesktopWindowTreeHostX11() = default;
 
 ////////////////////////////////////////////////////////////////////////////////
 // DesktopWindowTreeHostX11, DesktopWindowTreeHost implementation:
@@ -96,9 +91,8 @@
 
 void DesktopWindowTreeHostX11::OnNativeWidgetCreated(
     const Widget::InitParams& params) {
-  x11_window_move_client_ = std::make_unique<X11DesktopWindowMoveClient>();
-  wm::SetWindowMoveClient(window(), x11_window_move_client_.get());
-
+  x11_window_move_client_ = std::make_unique<X11DesktopWindowMoveClient>(
+      static_cast<ui::X11Window*>(platform_window()));
   DesktopWindowTreeHostLinux::OnNativeWidgetCreated(params);
 }
 
@@ -116,14 +110,10 @@
     const gfx::Vector2d& drag_offset,
     Widget::MoveLoopSource source,
     Widget::MoveLoopEscapeBehavior escape_behavior) {
-  wm::WindowMoveSource window_move_source =
-      source == Widget::MoveLoopSource::kMouse ? wm::WINDOW_MOVE_SOURCE_MOUSE
-                                               : wm::WINDOW_MOVE_SOURCE_TOUCH;
-  if (x11_window_move_client_->RunMoveLoop(GetContentWindow(), drag_offset,
-                                           window_move_source) ==
-      wm::MOVE_SUCCESSFUL)
+  GetContentWindow()->SetCapture();
+  if (x11_window_move_client_->RunMoveLoop(!GetContentWindow()->HasCapture(),
+                                           drag_offset))
     return Widget::MOVE_LOOP_SUCCESSFUL;
-
   return Widget::MOVE_LOOP_CANCELED;
 }
 

diff --git a/ui/views/widget/desktop_aura/window_move_client_platform.cc b/ui/views/widget/desktop_aura/window_move_client_platform.cc
new file mode 100644
index 0000000..d561307
--- /dev/null
+++ b/ui/views/widget/desktop_aura/window_move_client_platform.cc

@@ -0,0 +1,37 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "ui/views/widget/desktop_aura/window_move_client_platform.h"
+
+#include "ui/views/widget/desktop_aura/desktop_window_tree_host_platform.h"
+
+namespace views {
+
+WindowMoveClientPlatform::WindowMoveClientPlatform(
+    DesktopWindowTreeHostPlatform* host)
+    : host_(host) {}
+
+WindowMoveClientPlatform::~WindowMoveClientPlatform() = default;
+
+wm::WindowMoveResult WindowMoveClientPlatform::RunMoveLoop(
+    aura::Window* source,
+    const gfx::Vector2d& drag_offset,
+    wm::WindowMoveSource move_source) {
+  DCHECK(host_->GetContentWindow()->Contains(source));
+  auto move_loop_result = host_->RunMoveLoop(
+      drag_offset,
+      move_source == wm::WindowMoveSource::WINDOW_MOVE_SOURCE_MOUSE
+          ? Widget::MoveLoopSource::kMouse
+          : Widget::MoveLoopSource::kTouch,
+      Widget::MoveLoopEscapeBehavior::MOVE_LOOP_ESCAPE_BEHAVIOR_HIDE);
+
+  return move_loop_result == Widget::MOVE_LOOP_SUCCESSFUL ? wm::MOVE_SUCCESSFUL
+                                                          : wm::MOVE_CANCELED;
+}
+
+void WindowMoveClientPlatform::EndMoveLoop() {
+  host_->EndMoveLoop();
+}
+
+}  // namespace views

diff --git a/ui/views/widget/desktop_aura/window_move_client_platform.h b/ui/views/widget/desktop_aura/window_move_client_platform.h
new file mode 100644
index 0000000..09d46399
--- /dev/null
+++ b/ui/views/widget/desktop_aura/window_move_client_platform.h

@@ -0,0 +1,37 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef UI_VIEWS_WIDGET_DESKTOP_AURA_WINDOW_MOVE_CLIENT_PLATFORM_H_
+#define UI_VIEWS_WIDGET_DESKTOP_AURA_WINDOW_MOVE_CLIENT_PLATFORM_H_
+
+#include "ui/views/views_export.h"
+#include "ui/wm/public/window_move_client.h"
+
+namespace views {
+
+class DesktopWindowTreeHostPlatform;
+
+// Reroutes move loop requests to DesktopWindowTreeHostPlatform.
+class VIEWS_EXPORT WindowMoveClientPlatform : public wm::WindowMoveClient {
+ public:
+  explicit WindowMoveClientPlatform(DesktopWindowTreeHostPlatform* host);
+  WindowMoveClientPlatform(const WindowMoveClientPlatform& host) = delete;
+  WindowMoveClientPlatform& operator=(const WindowMoveClientPlatform& host) =
+      delete;
+  ~WindowMoveClientPlatform() override;
+
+  // Overridden from wm::WindowMoveClient:
+  wm::WindowMoveResult RunMoveLoop(aura::Window* window,
+                                   const gfx::Vector2d& drag_offset,
+                                   wm::WindowMoveSource move_source) override;
+  void EndMoveLoop() override;
+
+ private:
+  // The RunMoveLoop request is forwarded to this host.
+  DesktopWindowTreeHostPlatform* host_ = nullptr;
+};
+
+}  // namespace views
+
+#endif  // UI_VIEWS_WIDGET_DESKTOP_AURA_WINDOW_MOVE_CLIENT_PLATFORM_H_

diff --git a/ui/views/widget/desktop_aura/x11_desktop_window_move_client.cc b/ui/views/widget/desktop_aura/x11_desktop_window_move_client.cc
index 80b34d0..68c24a2 100644
--- a/ui/views/widget/desktop_aura/x11_desktop_window_move_client.cc
+++ b/ui/views/widget/desktop_aura/x11_desktop_window_move_client.cc

@@ -4,17 +4,15 @@
 
 #include "ui/views/widget/desktop_aura/x11_desktop_window_move_client.h"
 
-#include "base/run_loop.h"
-#include "ui/aura/env.h"
-#include "ui/aura/window.h"
-#include "ui/aura/window_tree_host.h"
 #include "ui/base/x/x11_util.h"
+#include "ui/base/x/x11_window.h"
 #include "ui/events/event.h"
 #include "ui/gfx/x/x11.h"
 
 namespace views {
 
-X11DesktopWindowMoveClient::X11DesktopWindowMoveClient() = default;
+X11DesktopWindowMoveClient::X11DesktopWindowMoveClient(ui::XWindow* window)
+    : window_(window) {}
 
 X11DesktopWindowMoveClient::~X11DesktopWindowMoveClient() = default;
 
@@ -22,31 +20,20 @@
                                                  int flags,
                                                  base::TimeTicks event_time) {
   gfx::Point system_loc = screen_point - window_offset_;
-  host_->SetBoundsInPixels(
-      gfx::Rect(system_loc, host_->GetBoundsInPixels().size()));
+  window_->SetBounds(gfx::Rect(system_loc, window_->bounds().size()));
 }
 
 void X11DesktopWindowMoveClient::OnMouseReleased() {
   EndMoveLoop();
 }
 
-void X11DesktopWindowMoveClient::OnMoveLoopEnded() {
-  host_ = nullptr;
-}
+void X11DesktopWindowMoveClient::OnMoveLoopEnded() {}
 
-////////////////////////////////////////////////////////////////////////////////
-// DesktopWindowTreeHostLinux, wm::WindowMoveClient implementation:
-
-wm::WindowMoveResult X11DesktopWindowMoveClient::RunMoveLoop(
-    aura::Window* source,
-    const gfx::Vector2d& drag_offset,
-    wm::WindowMoveSource move_source) {
+bool X11DesktopWindowMoveClient::RunMoveLoop(bool can_grab_pointer,
+                                             const gfx::Vector2d& drag_offset) {
   window_offset_ = drag_offset;
-  host_ = source->GetHost();
-
-  source->SetCapture();
-  bool success = move_loop_.RunMoveLoop(source, host_->last_cursor());
-  return success ? wm::MOVE_SUCCESSFUL : wm::MOVE_CANCELED;
+  return move_loop_.RunMoveLoop(can_grab_pointer, window_->last_cursor(),
+                                window_->last_cursor());
 }
 
 void X11DesktopWindowMoveClient::EndMoveLoop() {

diff --git a/ui/views/widget/desktop_aura/x11_desktop_window_move_client.h b/ui/views/widget/desktop_aura/x11_desktop_window_move_client.h
index 3305ca5..3d301f7 100644
--- a/ui/views/widget/desktop_aura/x11_desktop_window_move_client.h
+++ b/ui/views/widget/desktop_aura/x11_desktop_window_move_client.h

@@ -12,20 +12,18 @@
 #include "ui/views/views_export.h"
 #include "ui/views/widget/desktop_aura/x11_move_loop_delegate.h"
 #include "ui/views/widget/desktop_aura/x11_whole_screen_move_loop.h"
-#include "ui/wm/public/window_move_client.h"
 
-namespace aura {
-class WindowTreeHost;
+namespace ui {
+class XWindow;
 }
 
 namespace views {
 
 // When we're dragging tabs, we need to manually position our window.
 class VIEWS_EXPORT X11DesktopWindowMoveClient
-    : public views::X11MoveLoopDelegate,
-      public wm::WindowMoveClient {
+    : public views::X11MoveLoopDelegate {
  public:
-  X11DesktopWindowMoveClient();
+  explicit X11DesktopWindowMoveClient(ui::XWindow* window);
   ~X11DesktopWindowMoveClient() override;
 
   // Overridden from X11WholeScreenMoveLoopDelegate:
@@ -35,18 +33,15 @@
   void OnMouseReleased() override;
   void OnMoveLoopEnded() override;
 
-  // Overridden from wm::WindowMoveClient:
-  wm::WindowMoveResult RunMoveLoop(aura::Window* window,
-                                   const gfx::Vector2d& drag_offset,
-                                   wm::WindowMoveSource move_source) override;
-  void EndMoveLoop() override;
+  bool RunMoveLoop(bool can_grab_pointer, const gfx::Vector2d& drag_offset);
+  void EndMoveLoop();
 
  private:
   X11WholeScreenMoveLoop move_loop_{this};
 
   // We need to keep track of this so we can actually move it when reacting to
   // mouse events.
-  aura::WindowTreeHost* host_ = nullptr;
+  ui::XWindow* const window_;
 
   // Our cursor offset from the top left window origin when the drag
   // started. Used to calculate the window's new bounds relative to the current

diff --git a/ui/views/widget/desktop_aura/x11_move_loop.h b/ui/views/widget/desktop_aura/x11_move_loop.h
index b12cbecd..40fe972 100644
--- a/ui/views/widget/desktop_aura/x11_move_loop.h
+++ b/ui/views/widget/desktop_aura/x11_move_loop.h

@@ -6,6 +6,7 @@
 #define UI_VIEWS_WIDGET_DESKTOP_AURA_X11_MOVE_LOOP_H_
 
 #include "ui/gfx/native_widget_types.h"
+#include "ui/gfx/x/x11.h"
 #include "ui/gfx/x/x11_types.h"
 
 namespace views {
@@ -20,10 +21,12 @@
   // the mouse cursor. Returns true if the move-loop is completed successfully.
   // If the pointer-grab fails, or the move-loop is canceled by the user (e.g.
   // by pressing escape), then returns false.
-  virtual bool RunMoveLoop(aura::Window* window, gfx::NativeCursor cursor) = 0;
+  virtual bool RunMoveLoop(bool can_grab_pointer,
+                           ::Cursor old_cursor,
+                           ::Cursor new_cursor) = 0;
 
   // Updates the cursor while the move loop is running.
-  virtual void UpdateCursor(gfx::NativeCursor cursor) = 0;
+  virtual void UpdateCursor(::Cursor cursor) = 0;
 
   // Ends the move loop that's currently in progress.
   virtual void EndMoveLoop() = 0;

diff --git a/ui/views/widget/desktop_aura/x11_move_loop_delegate.h b/ui/views/widget/desktop_aura/x11_move_loop_delegate.h
index b5eee9b..391384a6 100644
--- a/ui/views/widget/desktop_aura/x11_move_loop_delegate.h
+++ b/ui/views/widget/desktop_aura/x11_move_loop_delegate.h

@@ -14,6 +14,8 @@
 // Receives mouse events while the X11MoveLoop is tracking a drag.
 class X11MoveLoopDelegate {
  public:
+  virtual ~X11MoveLoopDelegate() = default;
+
   // Called when we receive a mouse move event.
   virtual void OnMouseMovement(const gfx::Point& screen_point,
                                int flags,

diff --git a/ui/views/widget/desktop_aura/x11_whole_screen_move_loop.cc b/ui/views/widget/desktop_aura/x11_whole_screen_move_loop.cc
index 01509c2..9bcb493 100644
--- a/ui/views/widget/desktop_aura/x11_whole_screen_move_loop.cc
+++ b/ui/views/widget/desktop_aura/x11_whole_screen_move_loop.cc

@@ -16,12 +16,6 @@
 #include "base/single_thread_task_runner.h"
 #include "base/stl_util.h"
 #include "base/threading/thread_task_runner_handle.h"
-#include "ui/aura/client/capture_client.h"
-#include "ui/aura/env.h"
-#include "ui/aura/window.h"
-#include "ui/aura/window_event_dispatcher.h"
-#include "ui/aura/window_tree_host.h"
-#include "ui/base/mojom/cursor_type.mojom-shared.h"
 #include "ui/base/x/x11_pointer_grab.h"
 #include "ui/base/x/x11_util.h"
 #include "ui/events/event.h"
@@ -33,6 +27,7 @@
 #include "ui/events/x/events_x_utils.h"
 #include "ui/events/x/x11_window_event_manager.h"
 #include "ui/gfx/x/x11.h"
+#include "ui/platform_window/x11/x11_window.h"
 
 namespace views {
 
@@ -49,8 +44,7 @@
 X11WholeScreenMoveLoop::X11WholeScreenMoveLoop(X11MoveLoopDelegate* delegate)
     : delegate_(delegate),
       in_move_loop_(false),
-      initial_cursor_(ui::mojom::CursorType::kNull),
-      should_reset_mouse_flags_(false),
+      initial_cursor_(x11::None),
       grab_input_window_(x11::None),
       grabbed_pointer_(false),
       canceled_(false) {}
@@ -129,29 +123,28 @@
   return ui::POST_DISPATCH_PERFORM_DEFAULT;
 }
 
-bool X11WholeScreenMoveLoop::RunMoveLoop(aura::Window* source,
-                                         gfx::NativeCursor cursor) {
+bool X11WholeScreenMoveLoop::RunMoveLoop(bool can_grab_pointer,
+                                         ::Cursor old_cursor,
+                                         ::Cursor new_cursor) {
   DCHECK(!in_move_loop_);  // Can only handle one nested loop at a time.
 
   // Query the mouse cursor prior to the move loop starting so that it can be
   // restored when the move loop finishes.
-  initial_cursor_ = source->GetHost()->last_cursor();
+  initial_cursor_ = old_cursor;
 
   CreateDragInputWindow(gfx::GetXDisplay());
 
-  // Only grab mouse capture of |grab_input_window_| if |source| does not have
-  // capture.
-  // - The caller may intend to transfer capture to a different aura::Window
+  // Only grab mouse capture of |grab_input_window_| if |can_grab_pointer| is
+  // true aka the source that initiated the move loop doesn't have explicit
+  // grab.
+  // - The caller may intend to transfer capture to a different X11Window
   //   when the move loop ends and not release capture.
   // - Releasing capture and X window destruction are both asynchronous. We drop
   //   events targeted at |grab_input_window_| in the time between the move
   //   loop ends and |grab_input_window_| loses capture.
   grabbed_pointer_ = false;
-  if (!source->HasCapture()) {
-    aura::client::CaptureClient* capture_client =
-        aura::client::GetCaptureClient(source->GetRootWindow());
-    CHECK(capture_client->GetGlobalCaptureWindow() == nullptr);
-    grabbed_pointer_ = GrabPointer(cursor);
+  if (can_grab_pointer) {
+    grabbed_pointer_ = GrabPointer(new_cursor);
     if (!grabbed_pointer_) {
       XDestroyWindow(gfx::GetXDisplay(), grab_input_window_);
       return false;
@@ -165,15 +158,6 @@
   nested_dispatcher_ =
       ui::PlatformEventSource::GetInstance()->OverrideDispatcher(this);
 
-  // We are handling a mouse drag outside of the aura::Window system. We must
-  // manually make aura think that the mouse button is pressed so that we don't
-  // draw extraneous tooltips.
-  aura::Env* env = aura::Env::GetInstance();
-  if (!env->IsMouseButtonDown()) {
-    env->set_mouse_button_flags(ui::EF_LEFT_MOUSE_BUTTON);
-    should_reset_mouse_flags_ = true;
-  }
-
   base::WeakPtr<X11WholeScreenMoveLoop> alive(weak_factory_.GetWeakPtr());
 
   in_move_loop_ = true;
@@ -189,9 +173,9 @@
   return !canceled_;
 }
 
-void X11WholeScreenMoveLoop::UpdateCursor(gfx::NativeCursor cursor) {
+void X11WholeScreenMoveLoop::UpdateCursor(::Cursor cursor) {
   if (in_move_loop_)
-    ui::ChangeActivePointerGrabCursor(cursor.platform());
+    ui::ChangeActivePointerGrabCursor(cursor);
 }
 
 void X11WholeScreenMoveLoop::EndMoveLoop() {
@@ -201,12 +185,6 @@
   // Prevent DispatchMouseMovement from dispatching any posted motion event.
   last_motion_in_screen_.reset();
 
-  // We undo our emulated mouse click from RunMoveLoop();
-  if (should_reset_mouse_flags_) {
-    aura::Env::GetInstance()->set_mouse_button_flags(0);
-    should_reset_mouse_flags_ = false;
-  }
-
   // TODO(erg): Is this ungrab the cause of having to click to give input focus
   // on drawn out windows? Not ungrabbing here screws the X server until I kill
   // the chrome process.
@@ -233,12 +211,12 @@
   std::move(quit_closure_).Run();
 }
 
-bool X11WholeScreenMoveLoop::GrabPointer(gfx::NativeCursor cursor) {
+bool X11WholeScreenMoveLoop::GrabPointer(::Cursor cursor) {
   XDisplay* display = gfx::GetXDisplay();
 
   // Pass "owner_events" as false so that X sends all mouse events to
   // |grab_input_window_|.
-  int ret = ui::GrabPointer(grab_input_window_, false, cursor.platform());
+  int ret = ui::GrabPointer(grab_input_window_, false, cursor);
   if (ret != GrabSuccess) {
     DLOG(ERROR) << "Grabbing pointer for dragging failed: "
                 << ui::GetX11ErrorString(display, ret);

diff --git a/ui/views/widget/desktop_aura/x11_whole_screen_move_loop.h b/ui/views/widget/desktop_aura/x11_whole_screen_move_loop.h
index 1fa5bbd..5090077 100644
--- a/ui/views/widget/desktop_aura/x11_whole_screen_move_loop.h
+++ b/ui/views/widget/desktop_aura/x11_whole_screen_move_loop.h

@@ -22,10 +22,6 @@
 #include "ui/views/widget/desktop_aura/x11_move_loop.h"
 #include "ui/views/widget/desktop_aura/x11_move_loop_delegate.h"
 
-namespace aura {
-class Window;
-}
-
 namespace ui {
 class MouseEvent;
 class ScopedEventDispatcher;
@@ -47,14 +43,16 @@
   uint32_t DispatchEvent(const ui::PlatformEvent& event) override;
 
   // X11MoveLoop:
-  bool RunMoveLoop(aura::Window* window, gfx::NativeCursor cursor) override;
-  void UpdateCursor(gfx::NativeCursor cursor) override;
+  bool RunMoveLoop(bool can_grab_pointer,
+                   ::Cursor old_cursor,
+                   ::Cursor new_cursor) override;
+  void UpdateCursor(::Cursor cursor) override;
   void EndMoveLoop() override;
 
  private:
   // Grabs the pointer, setting the mouse cursor to |cursor|. Returns true if
   // successful.
-  bool GrabPointer(gfx::NativeCursor cursor);
+  bool GrabPointer(::Cursor cursor);
 
   void GrabEscKey();
 
@@ -74,9 +72,7 @@
 
   // Cursor in use prior to the move loop starting. Restored when the move loop
   // quits.
-  gfx::NativeCursor initial_cursor_;
-
-  bool should_reset_mouse_flags_;
+  ::Cursor initial_cursor_;
 
   // An invisible InputOnly window. Keyboard grab and sometimes mouse grab
   // are set on this window.

diff --git a/weblayer/browser/android/javatests/src/org/chromium/weblayer/test/FullscreenCallbackTest.java b/weblayer/browser/android/javatests/src/org/chromium/weblayer/test/FullscreenCallbackTest.java
index d2b8344..b05ff4f 100644
--- a/weblayer/browser/android/javatests/src/org/chromium/weblayer/test/FullscreenCallbackTest.java
+++ b/weblayer/browser/android/javatests/src/org/chromium/weblayer/test/FullscreenCallbackTest.java

@@ -69,4 +69,14 @@
         mDelegate.waitForExitFullscreen();
         Assert.assertEquals(1, mDelegate.mExitFullscreenCount);
     }
+
+    @Test
+    @SmallTest
+    public void testExitFullscreenWhenTabDestroyed() {
+        // Destroying the tab should exit fullscreen.
+        TestThreadUtils.runOnUiThreadBlocking(
+                () -> { mActivity.getTab().getBrowser().destroyTab(mActivity.getTab()); });
+        mDelegate.waitForExitFullscreen();
+        Assert.assertEquals(1, mDelegate.mExitFullscreenCount);
+    }
 }

diff --git a/weblayer/browser/android/javatests/src/org/chromium/weblayer/test/NavigationTest.java b/weblayer/browser/android/javatests/src/org/chromium/weblayer/test/NavigationTest.java
index 4e3f099..2a6d8ec9 100644
--- a/weblayer/browser/android/javatests/src/org/chromium/weblayer/test/NavigationTest.java
+++ b/weblayer/browser/android/javatests/src/org/chromium/weblayer/test/NavigationTest.java

@@ -22,6 +22,8 @@
 import org.chromium.base.test.util.CallbackHelper;
 import org.chromium.content_public.browser.test.util.Criteria;
 import org.chromium.content_public.browser.test.util.CriteriaHelper;
+import org.chromium.content_public.browser.test.util.TestThreadUtils;
+import org.chromium.net.test.util.TestWebServer;
 import org.chromium.weblayer.LoadError;
 import org.chromium.weblayer.Navigation;
 import org.chromium.weblayer.NavigationCallback;
@@ -483,6 +485,14 @@
                                 mCallback));
     }
 
+    private void registerNavigationCallback(NavigationCallback callback) {
+        runOnUiThreadBlocking(()
+                                      -> mActivityTestRule.getActivity()
+                                                 .getTab()
+                                                 .getNavigationController()
+                                                 .registerNavigationCallback(callback));
+    }
+
     private void navigateAndWaitForCompletion(String expectedUrl, Runnable navigateRunnable)
             throws Exception {
         int currentCallCount = mCallback.onCompletedCallback.getCallCount();
@@ -516,4 +526,126 @@
 
         return navigationUrl.get();
     }
+
+    @Test
+    @SmallTest
+    public void testStopFromOnNavigationStarted() throws Exception {
+        final InstrumentationActivity activity = mActivityTestRule.launchShellWithUrl(null);
+        final BoundedCountDownLatch doneLatch = new BoundedCountDownLatch(1);
+        NavigationCallback navigationCallback = new NavigationCallback() {
+            @Override
+            public void onNavigationStarted(Navigation navigation) {
+                activity.getTab().getNavigationController().stop();
+                doneLatch.countDown();
+            }
+        };
+        runOnUiThreadBlocking(() -> {
+            NavigationController controller = activity.getTab().getNavigationController();
+            controller.registerNavigationCallback(navigationCallback);
+            controller.navigate(Uri.parse(URL1));
+        });
+        doneLatch.timedAwait();
+    }
+
+    // NavigationCallback implementation that sets a header in either start or redirect.
+    private static final class HeaderSetter extends NavigationCallback {
+        private final String mName;
+        private final String mValue;
+        private final boolean mInStart;
+        public boolean mGotIllegalArgumentException;
+
+        HeaderSetter(String name, String value, boolean inStart) {
+            mName = name;
+            mValue = value;
+            mInStart = inStart;
+        }
+
+        @Override
+        public void onNavigationStarted(Navigation navigation) {
+            if (mInStart) applyHeader(navigation);
+        }
+
+        @Override
+        public void onNavigationRedirected(Navigation navigation) {
+            if (!mInStart) applyHeader(navigation);
+        }
+
+        private void applyHeader(Navigation navigation) {
+            try {
+                navigation.setRequestHeader(mName, mValue);
+            } catch (IllegalArgumentException e) {
+                mGotIllegalArgumentException = true;
+            }
+        }
+    }
+
+    @Test
+    @SmallTest
+    public void testSetRequestHeaderInStart() throws Exception {
+        TestWebServer testServer = TestWebServer.start();
+        InstrumentationActivity activity = mActivityTestRule.launchShellWithUrl(null);
+        String headerName = "header";
+        String headerValue = "value";
+        HeaderSetter setter = new HeaderSetter(headerName, headerValue, true);
+        registerNavigationCallback(setter);
+        String url = testServer.setResponse("/ok.html", "<html>ok</html>", null);
+        mActivityTestRule.navigateAndWait(url);
+        assertFalse(setter.mGotIllegalArgumentException);
+        assertEquals(headerValue, testServer.getLastRequest("/ok.html").headerValue(headerName));
+    }
+
+    @Test
+    @SmallTest
+    public void testSetRequestHeaderInRedirect() throws Exception {
+        TestWebServer testServer = TestWebServer.start();
+        InstrumentationActivity activity = mActivityTestRule.launchShellWithUrl(null);
+        String headerName = "header";
+        String headerValue = "value";
+        HeaderSetter setter = new HeaderSetter(headerName, headerValue, false);
+        registerNavigationCallback(setter);
+        // The destination of the redirect.
+        String finalUrl = testServer.setResponse("/ok.html", "<html>ok</html>", null);
+        // The url that redirects to |finalUrl|.
+        String redirectingUrl = testServer.setRedirect("/redirect.html", finalUrl);
+        Tab tab = mActivityTestRule.getActivity().getTab();
+        NavigationWaiter waiter = new NavigationWaiter(finalUrl, tab, false, false);
+        TestThreadUtils.runOnUiThreadBlocking(
+                () -> { tab.getNavigationController().navigate(Uri.parse(redirectingUrl)); });
+        waiter.waitForNavigation();
+        assertFalse(setter.mGotIllegalArgumentException);
+        assertEquals(headerValue, testServer.getLastRequest("/ok.html").headerValue(headerName));
+    }
+
+    @Test
+    @SmallTest
+    public void testSetRequestHeaderThrowsExceptionInCompleted() throws Exception {
+        mActivityTestRule.launchShellWithUrl(null);
+        boolean gotCompleted[] = new boolean[1];
+        NavigationCallback navigationCallback = new NavigationCallback() {
+            @Override
+            public void onNavigationCompleted(Navigation navigation) {
+                gotCompleted[0] = true;
+                boolean gotException = false;
+                try {
+                    navigation.setRequestHeader("name", "value");
+                } catch (IllegalStateException e) {
+                    gotException = true;
+                }
+                assertTrue(gotException);
+            }
+        };
+        registerNavigationCallback(navigationCallback);
+        mActivityTestRule.navigateAndWait(URL1);
+        assertTrue(gotCompleted[0]);
+    }
+
+    @Test
+    @SmallTest
+    public void testSetRequestHeaderThrowsExceptionWithInvalidValue() throws Exception {
+        mActivityTestRule.launchShellWithUrl(null);
+        HeaderSetter setter = new HeaderSetter("name", "\0", true);
+        registerNavigationCallback(setter);
+        mActivityTestRule.navigateAndWait(URL1);
+        assertTrue(setter.mGotIllegalArgumentException);
+    }
 }

diff --git a/weblayer/browser/browser_impl.cc b/weblayer/browser/browser_impl.cc
index f8beb88..b8ef575 100644
--- a/weblayer/browser/browser_impl.cc
+++ b/weblayer/browser/browser_impl.cc

@@ -244,21 +244,12 @@
   tabs_.erase(iter);
   const bool active_tab_changed = active_tab_ == tab;
   if (active_tab_changed)
-    active_tab_ = nullptr;
+    SetActiveTab(nullptr);
+
 #if defined(OS_ANDROID)
-  if (active_tab_changed) {
-    Java_BrowserImpl_onActiveTabChanged(
-        AttachCurrentThread(), java_impl_,
-        active_tab_ ? static_cast<TabImpl*>(active_tab_)->GetJavaTab()
-                    : nullptr);
-  }
   Java_BrowserImpl_onTabRemoved(AttachCurrentThread(), java_impl_,
                                 tab ? tab_impl->GetJavaTab() : nullptr);
 #endif
-  if (active_tab_changed) {
-    for (BrowserObserver& obs : browser_observers_)
-      obs.OnActiveTabChanged(active_tab_);
-  }
   for (BrowserObserver& obs : browser_observers_)
     obs.OnTabRemoved(tab, active_tab_changed);
   return owned_tab;
@@ -267,6 +258,8 @@
 void BrowserImpl::SetActiveTab(Tab* tab) {
   if (GetActiveTab() == tab)
     return;
+  if (active_tab_)
+    active_tab_->OnLosingActive();
   // TODO: currently the java side sets visibility, this code likely should
   // too and it should be removed from the java side.
   active_tab_ = static_cast<TabImpl*>(tab);

diff --git a/weblayer/browser/content_browser_client_impl.cc b/weblayer/browser/content_browser_client_impl.cc
index 886ea50a..b190fb1 100644
--- a/weblayer/browser/content_browser_client_impl.cc
+++ b/weblayer/browser/content_browser_client_impl.cc

@@ -53,6 +53,7 @@
 #include "weblayer/browser/browser_process.h"
 #include "weblayer/browser/feature_list_creator.h"
 #include "weblayer/browser/i18n_util.h"
+#include "weblayer/browser/navigation_controller_impl.h"
 #include "weblayer/browser/profile_impl.h"
 #include "weblayer/browser/system_network_context_manager.h"
 #include "weblayer/browser/tab_impl.h"
@@ -406,6 +407,18 @@
 ContentBrowserClientImpl::CreateThrottlesForNavigation(
     content::NavigationHandle* handle) {
   std::vector<std::unique_ptr<content::NavigationThrottle>> throttles;
+
+  // This throttle *must* be first as it's responsible for calling to
+  // NavigationController for certain events.
+  TabImpl* tab = TabImpl::FromWebContents(handle->GetWebContents());
+  if (tab) {
+    auto throttle =
+        static_cast<NavigationControllerImpl*>(tab->GetNavigationController())
+            ->CreateNavigationThrottle(handle);
+    if (throttle)
+      throttles.push_back(std::move(throttle));
+  }
+
   throttles.push_back(std::make_unique<SSLErrorNavigationThrottle>(
       handle, std::make_unique<SSLCertReporterImpl>(),
       base::BindOnce(&HandleSSLErrorWrapper), base::BindOnce(&IsInHostedApp)));

diff --git a/weblayer/browser/download_browsertest.cc b/weblayer/browser/download_browsertest.cc
index a6392d17..15918ee 100644
--- a/weblayer/browser/download_browsertest.cc
+++ b/weblayer/browser/download_browsertest.cc

@@ -87,7 +87,8 @@
 
  private:
   // DownloadDelegate implementation:
-  void AllowDownload(const GURL& url,
+  void AllowDownload(Tab* tab,
+                     const GURL& url,
                      const std::string& request_method,
                      base::Optional<url::Origin> request_initiator,
                      AllowDownloadCallback callback) override {

diff --git a/weblayer/browser/download_callback_proxy.cc b/weblayer/browser/download_callback_proxy.cc
index e40063ba..0d35bd1 100644
--- a/weblayer/browser/download_callback_proxy.cc
+++ b/weblayer/browser/download_callback_proxy.cc

@@ -50,6 +50,7 @@
 }
 
 void DownloadCallbackProxy::AllowDownload(
+    Tab* tab,
     const GURL& url,
     const std::string& request_method,
     base::Optional<url::Origin> request_initiator,
@@ -68,8 +69,8 @@
   intptr_t callback_id = reinterpret_cast<intptr_t>(
       new AllowDownloadCallback(std::move(callback)));
   Java_DownloadCallbackProxy_allowDownload(
-      env, java_delegate_, jstring_url, jstring_method,
-      jstring_request_initator, callback_id);
+      env, java_delegate_, static_cast<TabImpl*>(tab)->GetJavaTab(),
+      jstring_url, jstring_method, jstring_request_initator, callback_id);
 }
 
 void DownloadCallbackProxy::DownloadStarted(Download* download) {

diff --git a/weblayer/browser/download_callback_proxy.h b/weblayer/browser/download_callback_proxy.h
index 4af0809..34380f3 100644
--- a/weblayer/browser/download_callback_proxy.h
+++ b/weblayer/browser/download_callback_proxy.h

@@ -28,7 +28,8 @@
                          const std::string& content_disposition,
                          const std::string& mime_type,
                          int64_t content_length) override;
-  void AllowDownload(const GURL& url,
+  void AllowDownload(Tab* tab,
+                     const GURL& url,
                      const std::string& request_method,
                      base::Optional<url::Origin> request_initiator,
                      AllowDownloadCallback callback) override;

diff --git a/weblayer/browser/download_manager_delegate_impl.cc b/weblayer/browser/download_manager_delegate_impl.cc
index 9cd2f254..7e83c6b 100644
--- a/weblayer/browser/download_manager_delegate_impl.cc
+++ b/weblayer/browser/download_manager_delegate_impl.cc

@@ -149,14 +149,16 @@
     bool from_download_cross_origin_redirect,
     bool content_initiated,
     content::CheckDownloadAllowedCallback check_download_allowed_cb) {
+  auto* web_contents = web_contents_getter.Run();
   // If there's no DownloadDelegate, the download is simply dropped.
-  auto* delegate = GetDelegate(web_contents_getter.Run());
-  if (!delegate) {
+  auto* delegate = GetDelegate(web_contents);
+  auto* tab = TabImpl::FromWebContents(web_contents);
+  if (!delegate || !tab) {
     std::move(check_download_allowed_cb).Run(false);
     return;
   }
 
-  delegate->AllowDownload(url, request_method, request_initiator,
+  delegate->AllowDownload(tab, url, request_method, request_initiator,
                           std::move(check_download_allowed_cb));
 }
 

diff --git a/weblayer/browser/java/org/chromium/weblayer_private/DownloadCallbackProxy.java b/weblayer/browser/java/org/chromium/weblayer_private/DownloadCallbackProxy.java
index ad52795..8a6300dec8 100644
--- a/weblayer/browser/java/org/chromium/weblayer_private/DownloadCallbackProxy.java
+++ b/weblayer/browser/java/org/chromium/weblayer_private/DownloadCallbackProxy.java

@@ -4,12 +4,15 @@
 
 package org.chromium.weblayer_private;
 
+import android.Manifest.permission;
+import android.content.pm.PackageManager;
 import android.os.RemoteException;
 import android.webkit.ValueCallback;
 
 import org.chromium.base.annotations.CalledByNative;
 import org.chromium.base.annotations.JNINamespace;
 import org.chromium.base.annotations.NativeMethods;
+import org.chromium.ui.base.WindowAndroid;
 import org.chromium.weblayer_private.interfaces.IDownloadCallbackClient;
 import org.chromium.weblayer_private.interfaces.ObjectWrapper;
 
@@ -51,7 +54,29 @@
     }
 
     @CalledByNative
-    private void allowDownload(String url, String requestMethod, String requestInitiator,
+    private void allowDownload(TabImpl tab, String url, String requestMethod,
+            String requestInitiator, long callbackId) throws RemoteException {
+        WindowAndroid window = tab.getBrowser().getWindowAndroid();
+        if (window.hasPermission(permission.WRITE_EXTERNAL_STORAGE)) {
+            continueAllowDownload(url, requestMethod, requestInitiator, callbackId);
+            return;
+        }
+
+        String[] requestPermissions = new String[] {permission.WRITE_EXTERNAL_STORAGE};
+        window.requestPermissions(requestPermissions, (permissions, grantResults) -> {
+            if (grantResults[0] == PackageManager.PERMISSION_DENIED) {
+                DownloadCallbackProxyJni.get().allowDownload(callbackId, false);
+                return;
+            }
+
+            try {
+                continueAllowDownload(url, requestMethod, requestInitiator, callbackId);
+            } catch (RemoteException e) {
+            }
+        });
+    }
+
+    private void continueAllowDownload(String url, String requestMethod, String requestInitiator,
             long callbackId) throws RemoteException {
         if (WebLayerFactoryImpl.getClientMajorVersion() < 81) {
             DownloadCallbackProxyJni.get().allowDownload(callbackId, true);

diff --git a/weblayer/browser/java/org/chromium/weblayer_private/NavigationImpl.java b/weblayer/browser/java/org/chromium/weblayer_private/NavigationImpl.java
index a2083951..2fbcc094 100644
--- a/weblayer/browser/java/org/chromium/weblayer_private/NavigationImpl.java
+++ b/weblayer/browser/java/org/chromium/weblayer_private/NavigationImpl.java

@@ -113,6 +113,19 @@
                 NavigationImplJni.get().getLoadError(mNativeNavigationImpl, NavigationImpl.this));
     }
 
+    @Override
+    public void setRequestHeader(String name, String value) {
+        if (!NavigationImplJni.get().isValidRequestHeaderName(name)) {
+            throw new IllegalArgumentException("Invalid header");
+        }
+        if (!NavigationImplJni.get().isValidRequestHeaderValue(value)) {
+            throw new IllegalArgumentException("Invalid value");
+        }
+        if (!NavigationImplJni.get().setRequestHeader(mNativeNavigationImpl, this, name, value)) {
+            throw new IllegalStateException();
+        }
+    }
+
     private void throwIfNativeDestroyed() {
         if (mNativeNavigationImpl == 0) {
             throw new IllegalStateException("Using Navigation after native destroyed");
@@ -155,5 +168,9 @@
         boolean isSameDocument(long nativeNavigationImpl, NavigationImpl caller);
         boolean isErrorPage(long nativeNavigationImpl, NavigationImpl caller);
         int getLoadError(long nativeNavigationImpl, NavigationImpl caller);
+        boolean setRequestHeader(
+                long nativeNavigationImpl, NavigationImpl caller, String name, String value);
+        boolean isValidRequestHeaderName(String name);
+        boolean isValidRequestHeaderValue(String value);
     }
 }

diff --git a/weblayer/browser/java/org/chromium/weblayer_private/TopControlsContainerView.java b/weblayer/browser/java/org/chromium/weblayer_private/TopControlsContainerView.java
index 435c18e..1ce5993 100644
--- a/weblayer/browser/java/org/chromium/weblayer_private/TopControlsContainerView.java
+++ b/weblayer/browser/java/org/chromium/weblayer_private/TopControlsContainerView.java

@@ -133,6 +133,10 @@
         setView(null);
         TopControlsContainerViewJni.get().deleteTopControlsContainerView(
                 mNativeTopControlsContainerView, TopControlsContainerView.this);
+        if (mSystemUiFullscreenResizeRunnable != null) {
+            getHandler().removeCallbacks(mSystemUiFullscreenResizeRunnable);
+            mSystemUiFullscreenResizeRunnable = null;
+        }
     }
 
     public long getNativeHandle() {

diff --git a/weblayer/browser/java/org/chromium/weblayer_private/interfaces/INavigation.aidl b/weblayer/browser/java/org/chromium/weblayer_private/interfaces/INavigation.aidl
index 7a7a896..6734b1dc 100644
--- a/weblayer/browser/java/org/chromium/weblayer_private/interfaces/INavigation.aidl
+++ b/weblayer/browser/java/org/chromium/weblayer_private/interfaces/INavigation.aidl

@@ -21,4 +21,6 @@
   boolean isErrorPage() = 5;
 
   int getLoadError() = 6;
+
+  void setRequestHeader(in String name, in String value) = 7;
 }

diff --git a/weblayer/browser/navigation_browsertest.cc b/weblayer/browser/navigation_browsertest.cc
index f3139ce6..516cc01 100644
--- a/weblayer/browser/navigation_browsertest.cc
+++ b/weblayer/browser/navigation_browsertest.cc

@@ -6,6 +6,7 @@
 
 #include "base/files/file_path.h"
 #include "content/public/test/url_loader_interceptor.h"
+#include "net/test/embedded_test_server/controllable_http_response.h"
 #include "net/test/embedded_test_server/embedded_test_server.h"
 #include "weblayer/public/navigation.h"
 #include "weblayer/public/navigation_controller.h"
@@ -19,6 +20,35 @@
 
 namespace {
 
+class StopNavigationObserver : public NavigationObserver {
+ public:
+  StopNavigationObserver(NavigationController* controller, bool stop_in_start)
+      : controller_(controller), stop_in_start_(stop_in_start) {
+    controller_->AddObserver(this);
+  }
+  ~StopNavigationObserver() override { controller_->RemoveObserver(this); }
+
+  void WaitForNavigation() { run_loop_.Run(); }
+
+  // NavigationObserver:
+  void NavigationStarted(Navigation* navigation) override {
+    if (stop_in_start_)
+      controller_->Stop();
+  }
+  void NavigationRedirected(Navigation* navigation) override {
+    if (!stop_in_start_)
+      controller_->Stop();
+  }
+  void NavigationFailed(Navigation* navigation) override { run_loop_.Quit(); }
+
+ private:
+  NavigationController* controller_;
+  // If true Stop() is called in NavigationStarted(), otherwise Stop() is
+  // called in NavigationRedirected().
+  const bool stop_in_start_;
+  base::RunLoop run_loop_;
+};
+
 class OneShotNavigationObserver : public NavigationObserver {
  public:
   explicit OneShotNavigationObserver(Shell* shell) : tab_(shell->tab()) {
@@ -148,4 +178,123 @@
   EXPECT_EQ(observer.navigation_state(), NavigationState::kFailed);
 }
 
+IN_PROC_BROWSER_TEST_F(NavigationBrowserTest, StopInOnStart) {
+  EXPECT_TRUE(embedded_test_server()->Start());
+  StopNavigationObserver observer(shell()->tab()->GetNavigationController(),
+                                  true);
+  shell()->tab()->GetNavigationController()->Navigate(
+      embedded_test_server()->GetURL("/simple_page.html"));
+
+  observer.WaitForNavigation();
+}
+
+IN_PROC_BROWSER_TEST_F(NavigationBrowserTest, StopInOnRedirect) {
+  EXPECT_TRUE(embedded_test_server()->Start());
+  StopNavigationObserver observer(shell()->tab()->GetNavigationController(),
+                                  false);
+  const GURL original_url = embedded_test_server()->GetURL("/simple_page.html");
+  shell()->tab()->GetNavigationController()->Navigate(
+      embedded_test_server()->GetURL("/server-redirect?" +
+                                     original_url.spec()));
+
+  observer.WaitForNavigation();
+}
+
+namespace {
+
+class HeaderInjectorNavigationObserver : public NavigationObserver {
+ public:
+  HeaderInjectorNavigationObserver(Shell* shell,
+                                   const std::string& header_name,
+                                   const std::string& header_value,
+                                   bool inject_in_start)
+      : tab_(shell->tab()),
+        header_name_(header_name),
+        header_value_(header_value),
+        inject_in_start_(inject_in_start) {
+    tab_->GetNavigationController()->AddObserver(this);
+  }
+
+  ~HeaderInjectorNavigationObserver() override {
+    tab_->GetNavigationController()->RemoveObserver(this);
+  }
+
+ private:
+  // NavigationObserver implementation:
+  void NavigationStarted(Navigation* navigation) override {
+    if (inject_in_start_)
+      InjectHeaders(navigation);
+  }
+
+  void NavigationRedirected(Navigation* navigation) override {
+    if (!inject_in_start_)
+      InjectHeaders(navigation);
+  }
+
+  void InjectHeaders(Navigation* navigation) {
+    navigation->SetRequestHeader(header_name_, header_value_);
+  }
+
+  Tab* tab_;
+  const std::string header_name_;
+  const std::string header_value_;
+  // If true, header is set in start, otherwise header is set in redirect.
+  const bool inject_in_start_;
+};
+
+}  // namespace
+
+IN_PROC_BROWSER_TEST_F(NavigationBrowserTest, SetRequestHeader) {
+  net::test_server::ControllableHttpResponse response_1(embedded_test_server(),
+                                                        "", true);
+  net::test_server::ControllableHttpResponse response_2(embedded_test_server(),
+                                                        "", true);
+  ASSERT_TRUE(embedded_test_server()->Start());
+
+  const std::string header_name = "header";
+  const std::string header_value = "value";
+  HeaderInjectorNavigationObserver observer(shell(), header_name, header_value,
+                                            true);
+
+  shell()->LoadURL(embedded_test_server()->GetURL("/simple_page.html"));
+  response_1.WaitForRequest();
+
+  // Header should be present in initial request.
+  EXPECT_EQ(header_value, response_1.http_request()->headers.at(header_name));
+  response_1.Send(
+      "HTTP/1.1 302 Moved Temporarily\r\nLocation: /new_doc\r\n\r\n");
+  response_1.Done();
+
+  // Header should carry through to redirect.
+  response_2.WaitForRequest();
+  EXPECT_EQ(header_value, response_2.http_request()->headers.at(header_name));
+}
+
+IN_PROC_BROWSER_TEST_F(NavigationBrowserTest, SetRequestHeaderInRedirect) {
+  net::test_server::ControllableHttpResponse response_1(embedded_test_server(),
+                                                        "", true);
+  net::test_server::ControllableHttpResponse response_2(embedded_test_server(),
+                                                        "", true);
+  ASSERT_TRUE(embedded_test_server()->Start());
+
+  const std::string header_name = "header";
+  const std::string header_value = "value";
+  HeaderInjectorNavigationObserver observer(shell(), header_name, header_value,
+                                            false);
+  shell()->LoadURL(embedded_test_server()->GetURL("/simple_page.html"));
+  response_1.WaitForRequest();
+
+  // Header should not be present in initial request.
+  EXPECT_FALSE(base::Contains(response_1.http_request()->headers, header_name));
+
+  response_1.Send(
+      "HTTP/1.1 302 Moved Temporarily\r\nLocation: /new_doc\r\n\r\n");
+  response_1.Done();
+
+  response_2.WaitForRequest();
+
+  // Header should be in redirect.
+  EXPECT_EQ(header_value, response_2.http_request()->headers.at(header_name));
+}
+
 }  // namespace weblayer

diff --git a/weblayer/browser/navigation_controller_impl.cc b/weblayer/browser/navigation_controller_impl.cc
index 62f3911..13352653 100644
--- a/weblayer/browser/navigation_controller_impl.cc
+++ b/weblayer/browser/navigation_controller_impl.cc

@@ -4,9 +4,12 @@
 
 #include "weblayer/browser/navigation_controller_impl.h"
 
+#include "base/auto_reset.h"
+#include "base/stl_util.h"
 #include "base/strings/utf_string_conversions.h"
 #include "content/public/browser/navigation_entry.h"
 #include "content/public/browser/navigation_handle.h"
+#include "content/public/browser/navigation_throttle.h"
 #include "content/public/browser/web_contents.h"
 #include "ui/base/page_transition_types.h"
 #include "weblayer/browser/tab_impl.h"
@@ -26,11 +29,75 @@
 
 namespace weblayer {
 
+// NavigationThrottle implementation responsible for stopping the navigation in
+// certain situations. In particular, WebContents::Stop() can not be called from
+// WebContentsObserver::DidStartNavigation() or
+// WebContentsObserver::DidRedirectNavigation() (to do so crashes). To work
+// around this NavigationControllerImpl detects if Stop() is called while
+// processing DidStartNavigation() or DidRedirectNavigation() and sets state in
+// NavigationThrottleImpl such that the navigation is canceled.
+//
+// The call order for starting is WebContents::DidStartNavigation() followed
+// by NavigationThrottle::WillStartRequest(). To make things interesting,
+// the NavigationThrottle is created *after* DidStartNavigation(). OTOH,
+// the call order for redirect is NavigationThrottle::WillRedirectRequest()
+// followed by WebContentsObserver::DidRedirectNavigation(). To ensure the
+// right call order NavigationControllerImpl does nothing in
+// DidRedirectNavigation(), instead this class calls to the
+// NavigationController and then returns cancel if necessary. While redirect
+// handling is initiated from this class, start must be handled from the
+// WebContentsObserver call. This is necessary as some code paths do *not*
+// call to NavigationThrottle::WillStartRequest().
+class NavigationControllerImpl::NavigationThrottleImpl
+    : public content::NavigationThrottle {
+ public:
+  NavigationThrottleImpl(NavigationControllerImpl* controller,
+                         content::NavigationHandle* handle)
+      : NavigationThrottle(handle), controller_(controller) {}
+  NavigationThrottleImpl(const NavigationThrottleImpl&) = delete;
+  NavigationThrottleImpl& operator=(const NavigationThrottleImpl&) = delete;
+  ~NavigationThrottleImpl() override = default;
+
+  void ScheduleCancel() { should_cancel_ = true; }
+
+  // content::NavigationThrottle:
+  ThrottleCheckResult WillStartRequest() override {
+    return should_cancel_ ? CANCEL : PROCEED;
+  }
+
+  ThrottleCheckResult WillRedirectRequest() override {
+    controller_->WillRedirectRequest(this, navigation_handle());
+    return should_cancel_ ? CANCEL : PROCEED;
+  }
+
+  const char* GetNameForLogging() override {
+    return "WebLayerNavigationControllerThrottle";
+  }
+
+ private:
+  NavigationControllerImpl* controller_;
+  bool should_cancel_ = false;
+};
+
 NavigationControllerImpl::NavigationControllerImpl(TabImpl* tab)
     : WebContentsObserver(tab->web_contents()) {}
 
 NavigationControllerImpl::~NavigationControllerImpl() = default;
 
+std::unique_ptr<content::NavigationThrottle>
+NavigationControllerImpl::CreateNavigationThrottle(
+    content::NavigationHandle* handle) {
+  if (!handle->IsInMainFrame())
+    return nullptr;
+
+  auto throttle = std::make_unique<NavigationThrottleImpl>(this, handle);
+  DCHECK(navigation_map_.find(handle) != navigation_map_.end());
+  auto* navigation = navigation_map_[handle].get();
+  if (navigation->should_stop_when_throttle_created())
+    throttle->ScheduleCancel();
+  return throttle;
+}
+
 #if defined(OS_ANDROID)
 void NavigationControllerImpl::SetNavigationControllerImpl(
     JNIEnv* env,
@@ -74,6 +141,29 @@
 }
 #endif
 
+void NavigationControllerImpl::WillRedirectRequest(
+    NavigationThrottleImpl* throttle,
+    content::NavigationHandle* navigation_handle) {
+  DCHECK(navigation_handle->IsInMainFrame());
+  DCHECK(navigation_map_.find(navigation_handle) != navigation_map_.end());
+  auto* navigation = navigation_map_[navigation_handle].get();
+  navigation->set_safe_to_set_request_headers(true);
+  DCHECK(!active_throttle_);
+  base::AutoReset<NavigationThrottleImpl*> auto_reset(&active_throttle_,
+                                                      throttle);
+#if defined(OS_ANDROID)
+  if (java_controller_) {
+    TRACE_EVENT0("weblayer",
+                 "Java_NavigationControllerImpl_navigationRedirected");
+    Java_NavigationControllerImpl_navigationRedirected(
+        AttachCurrentThread(), java_controller_, navigation->java_navigation());
+  }
+#endif
+  for (auto& observer : observers_)
+    observer.NavigationRedirected(navigation);
+  navigation->set_safe_to_set_request_headers(false);
+}
+
 void NavigationControllerImpl::AddObserver(NavigationObserver* observer) {
   observers_.AddObserver(observer);
 }
@@ -117,7 +207,12 @@
 }
 
 void NavigationControllerImpl::Stop() {
-  web_contents()->Stop();
+  if (navigation_starting_)
+    navigation_starting_->set_should_stop_when_throttle_created();
+  else if (active_throttle_)
+    active_throttle_->ScheduleCancel();
+  else
+    web_contents()->Stop();
 }
 
 int NavigationControllerImpl::GetNavigationListSize() {
@@ -147,9 +242,16 @@
   if (!navigation_handle->IsInMainFrame())
     return;
 
+  // This function should not be called reentrantly.
+  DCHECK(!navigation_starting_);
+
+  DCHECK(!base::Contains(navigation_map_, navigation_handle));
   navigation_map_[navigation_handle] =
       std::make_unique<NavigationImpl>(navigation_handle);
   auto* navigation = navigation_map_[navigation_handle].get();
+  base::AutoReset<NavigationImpl*> auto_reset(&navigation_starting_,
+                                              navigation);
+  navigation->set_safe_to_set_request_headers(true);
 #if defined(OS_ANDROID)
   if (java_controller_) {
     JNIEnv* env = AttachCurrentThread();
@@ -166,25 +268,14 @@
 #endif
   for (auto& observer : observers_)
     observer.NavigationStarted(navigation);
+  navigation->set_safe_to_set_request_headers(false);
 }
 
 void NavigationControllerImpl::DidRedirectNavigation(
     content::NavigationHandle* navigation_handle) {
-  if (!navigation_handle->IsInMainFrame())
-    return;
-
-  DCHECK(navigation_map_.find(navigation_handle) != navigation_map_.end());
-  auto* navigation = navigation_map_[navigation_handle].get();
-#if defined(OS_ANDROID)
-  if (java_controller_) {
-    TRACE_EVENT0("weblayer",
-                 "Java_NavigationControllerImpl_navigationRedirected");
-    Java_NavigationControllerImpl_navigationRedirected(
-        AttachCurrentThread(), java_controller_, navigation->java_navigation());
-  }
-#endif
-  for (auto& observer : observers_)
-    observer.NavigationRedirected(navigation);
+  // NOTE: this implementation should remain empty. Real implementation is in
+  // WillRedirectNavigation(). See description of NavigationThrottleImpl for
+  // more information.
 }
 
 void NavigationControllerImpl::ReadyToCommitNavigation(

diff --git a/weblayer/browser/navigation_controller_impl.h b/weblayer/browser/navigation_controller_impl.h
index fdb0000..40fca78 100644
--- a/weblayer/browser/navigation_controller_impl.h
+++ b/weblayer/browser/navigation_controller_impl.h

@@ -19,6 +19,10 @@
 #include "base/android/scoped_java_ref.h"
 #endif
 
+namespace content {
+class NavigationThrottle;
+}
+
 namespace weblayer {
 class TabImpl;
 
@@ -28,6 +32,11 @@
   explicit NavigationControllerImpl(TabImpl* tab);
   ~NavigationControllerImpl() override;
 
+  // Creates the NavigationThrottle used to ensure WebContents::Stop() is called
+  // at safe times. See NavigationControllerImpl for details.
+  std::unique_ptr<content::NavigationThrottle> CreateNavigationThrottle(
+      content::NavigationHandle* handle);
+
 #if defined(OS_ANDROID)
   void SetNavigationControllerImpl(
       JNIEnv* env,
@@ -80,6 +89,13 @@
 #endif
 
  private:
+  class NavigationThrottleImpl;
+
+  // Called from NavigationControllerImpl::WillRedirectRequest(). See
+  // description of NavigationControllerImpl for details.
+  void WillRedirectRequest(NavigationThrottleImpl* throttle,
+                           content::NavigationHandle* navigation_handle);
+
   // NavigationController implementation:
   void AddObserver(NavigationObserver* observer) override;
   void RemoveObserver(NavigationObserver* observer) override;
@@ -119,6 +135,13 @@
   std::map<content::NavigationHandle*, std::unique_ptr<NavigationImpl>>
       navigation_map_;
 
+  // If non-null then processing is inside DidStartNavigation() and
+  // |navigation_starting_| is the NavigationImpl that was created.
+  NavigationImpl* navigation_starting_ = nullptr;
+
+  // Set to non-null while in WillRedirectRequest().
+  NavigationThrottleImpl* active_throttle_ = nullptr;
+
 #if defined(OS_ANDROID)
   base::android::ScopedJavaGlobalRef<jobject> java_controller_;
 #endif

diff --git a/weblayer/browser/navigation_impl.cc b/weblayer/browser/navigation_impl.cc
index f5b33db..76996d7 100644
--- a/weblayer/browser/navigation_impl.cc
+++ b/weblayer/browser/navigation_impl.cc

@@ -6,6 +6,7 @@
 
 #include "content/public/browser/navigation_handle.h"
 #include "net/base/net_errors.h"
+#include "net/http/http_util.h"
 
 #if defined(OS_ANDROID)
 #include "base/android/jni_array.h"
@@ -55,6 +56,19 @@
   return base::android::ToJavaArrayOfStrings(env, jni_redirects);
 }
 
+jboolean NavigationImpl::SetRequestHeader(
+    JNIEnv* env,
+    const base::android::JavaParamRef<jobject>& obj,
+    const base::android::JavaParamRef<jstring>& name,
+    const base::android::JavaParamRef<jstring>& value) {
+  if (!safe_to_set_request_headers_)
+    return false;
+
+  SetRequestHeader(ConvertJavaStringToUTF8(name),
+                   ConvertJavaStringToUTF8(value));
+  return true;
+}
+
 #endif
 
 GURL NavigationImpl::GetURL() {
@@ -110,4 +124,23 @@
   return kOtherError;
 }
 
+void NavigationImpl::SetRequestHeader(const std::string& name,
+                                      const std::string& value) {
+  navigation_handle_->SetRequestHeader(name, value);
+}
+
+#if defined(OS_ANDROID)
+static jboolean JNI_NavigationImpl_IsValidRequestHeaderName(
+    JNIEnv* env,
+    const base::android::JavaParamRef<jstring>& name) {
+  return net::HttpUtil::IsValidHeaderName(ConvertJavaStringToUTF8(name));
+}
+
+static jboolean JNI_NavigationImpl_IsValidRequestHeaderValue(
+    JNIEnv* env,
+    const base::android::JavaParamRef<jstring>& value) {
+  return net::HttpUtil::IsValidHeaderValue(ConvertJavaStringToUTF8(value));
+}
+#endif
+
 }  // namespace weblayer

diff --git a/weblayer/browser/navigation_impl.h b/weblayer/browser/navigation_impl.h
index 2591c00c..deacde7 100644
--- a/weblayer/browser/navigation_impl.h
+++ b/weblayer/browser/navigation_impl.h

@@ -24,6 +24,17 @@
   explicit NavigationImpl(content::NavigationHandle* navigation_handle);
   ~NavigationImpl() override;
 
+  void set_should_stop_when_throttle_created() {
+    should_stop_when_throttle_created_ = true;
+  }
+  bool should_stop_when_throttle_created() const {
+    return should_stop_when_throttle_created_;
+  }
+
+  void set_safe_to_set_request_headers(bool value) {
+    safe_to_set_request_headers_ = value;
+  }
+
 #if defined(OS_ANDROID)
   void SetJavaNavigation(
       JNIEnv* env,
@@ -53,6 +64,10 @@
                    const base::android::JavaParamRef<jobject>& obj) {
     return static_cast<int>(GetLoadError());
   }
+  jboolean SetRequestHeader(JNIEnv* env,
+                            const base::android::JavaParamRef<jobject>& obj,
+                            const base::android::JavaParamRef<jstring>& name,
+                            const base::android::JavaParamRef<jstring>& value);
 
   base::android::ScopedJavaGlobalRef<jobject> java_navigation() {
     return java_navigation_;
@@ -68,9 +83,18 @@
   bool IsSameDocument() override;
   bool IsErrorPage() override;
   LoadError GetLoadError() override;
+  void SetRequestHeader(const std::string& name,
+                        const std::string& value) override;
 
   content::NavigationHandle* navigation_handle_;
 
+  // Used to delay calling Stop() until safe. See
+  // NavigationControllerImpl::NavigationThrottleImpl for details.
+  bool should_stop_when_throttle_created_ = false;
+
+  // Whether SetRequestHeader() is allowed at this time.
+  bool safe_to_set_request_headers_ = false;
+
 #if defined(OS_ANDROID)
   base::android::ScopedJavaGlobalRef<jobject> java_navigation_;
 #endif

diff --git a/weblayer/browser/tab_impl.cc b/weblayer/browser/tab_impl.cc
index ebc0f4b..2e2d074 100644
--- a/weblayer/browser/tab_impl.cc
+++ b/weblayer/browser/tab_impl.cc

@@ -330,6 +330,11 @@
   return browser_ ? browser_->GetPasswordEchoEnabled() : false;
 }
 
+void TabImpl::OnLosingActive() {
+  if (is_fullscreen_)
+    web_contents_->ExitFullscreen(/* will_cause_resize */ false);
+}
+
 bool TabImpl::IsActive() {
   return browser_->GetActiveTab() == this;
 }

diff --git a/weblayer/browser/tab_impl.h b/weblayer/browser/tab_impl.h
index a76e9cc..135b09a0 100644
--- a/weblayer/browser/tab_impl.h
+++ b/weblayer/browser/tab_impl.h

@@ -78,6 +78,9 @@
 
   bool has_new_tab_delegate() const { return new_tab_delegate_ != nullptr; }
 
+  // Called from Browser when this Tab is losing active status.
+  void OnLosingActive();
+
   bool IsActive();
 
   void ShowContextMenu(const content::ContextMenuParams& params);

diff --git a/weblayer/public/download_delegate.h b/weblayer/public/download_delegate.h
index 80344be1..a7ee136 100644
--- a/weblayer/public/download_delegate.h
+++ b/weblayer/public/download_delegate.h

@@ -15,6 +15,7 @@
 
 namespace weblayer {
 class Download;
+class Tab;
 
 using AllowDownloadCallback = base::OnceCallback<void(bool /*allow*/)>;
 
@@ -26,7 +27,8 @@
   // Gives the embedder the opportunity to asynchronously allow or disallow the
   // given download. The download is paused until the callback is run. It's safe
   // to run |callback| synchronously.
-  virtual void AllowDownload(const GURL& url,
+  virtual void AllowDownload(Tab* tab,
+                             const GURL& url,
                              const std::string& request_method,
                              base::Optional<url::Origin> request_initiator,
                              AllowDownloadCallback callback) = 0;

diff --git a/weblayer/public/java/org/chromium/weblayer/Navigation.java b/weblayer/public/java/org/chromium/weblayer/Navigation.java
index 9afb2dd..64b9987a 100644
--- a/weblayer/public/java/org/chromium/weblayer/Navigation.java
+++ b/weblayer/public/java/org/chromium/weblayer/Navigation.java

@@ -125,4 +125,31 @@
             throw new APICallException(e);
         }
     }
+
+    /**
+     * Sets a header for a network request. If a header with the specified name exists it is
+     * overwritten. This method can only be called at two times, from
+     * {@link NavigationCallback.onNavigationStarted} and {@link
+     * NavigationCallback.onNavigationStarted}. When called during start, the header applies to both
+     * the initial network request as well as redirects.
+     *
+     * @param name The name of the header. The name must be rfc 2616 compliant.
+     * @param value The value of the header. The value must not contain '\0', '\n' or '\r'.
+     *
+     * @throws IllegalArgumentException If supplied invalid values.
+     * @throws IllegalStateException If not called during start or a redirect.
+     *
+     * @since 83
+     */
+    public void setRequestHeader(@NonNull String name, @NonNull String value) {
+        ThreadCheck.ensureOnUiThread();
+        if (WebLayer.getSupportedMajorVersionInternal() < 83) {
+            throw new UnsupportedOperationException();
+        }
+        try {
+            mNavigationImpl.setRequestHeader(name, value);
+        } catch (RemoteException e) {
+            throw new APICallException(e);
+        }
+    }
 }

diff --git a/weblayer/public/navigation.h b/weblayer/public/navigation.h
index d5d8d01f..5a7a1ad 100644
--- a/weblayer/public/navigation.h
+++ b/weblayer/public/navigation.h

@@ -5,6 +5,7 @@
 #ifndef WEBLAYER_PUBLIC_NAVIGATION_H_
 #define WEBLAYER_PUBLIC_NAVIGATION_H_
 
+#include <string>
 #include <vector>
 
 class GURL;
@@ -73,6 +74,14 @@
   // Return information about the error, if any, that was encountered while
   // loading the page.
   virtual LoadError GetLoadError() = 0;
+
+  // Set a request's header. If the header is already present, its value is
+  // overwritten. This function can only be called at two times, during start
+  // and redirect. When called during start, the header applies to both the
+  // start and redirect. |name| must be rfc 2616 compliant and |value| must
+  // not contain '\0', '\n' or '\r'.
+  virtual void SetRequestHeader(const std::string& name,
+                                const std::string& value) = 0;
 };
 
 }  // namespace weblayer

diff --git a/weblayer/shell/browser/shell.cc b/weblayer/shell/browser/shell.cc
index 557fad6..0952164 100644
--- a/weblayer/shell/browser/shell.cc
+++ b/weblayer/shell/browser/shell.cc

@@ -144,7 +144,8 @@
   return false;
 }
 
-void Shell::AllowDownload(const GURL& url,
+void Shell::AllowDownload(Tab* tab,
+                          const GURL& url,
                           const std::string& request_method,
                           base::Optional<url::Origin> request_initiator,
                           AllowDownloadCallback callback) {

diff --git a/weblayer/shell/browser/shell.h b/weblayer/shell/browser/shell.h
index 3e1a51b..51cc279f5 100644
--- a/weblayer/shell/browser/shell.h
+++ b/weblayer/shell/browser/shell.h

@@ -95,7 +95,8 @@
                          const std::string& content_disposition,
                          const std::string& mime_type,
                          int64_t content_length) override;
-  void AllowDownload(const GURL& url,
+  void AllowDownload(Tab* tab,
+                     const GURL& url,
                      const std::string& request_method,
                      base::Optional<url::Origin> request_initiator,
                      AllowDownloadCallback callback) override;