diff --git a/DEPS b/DEPS
index 3c0ef688..1280cad 100644
--- a/DEPS
+++ b/DEPS

@@ -303,7 +303,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling V8
   # and whatever else without interference from each other.
-  'v8_revision': 'ff043353c7e2af4e94ca4a4086cfce063e0e08ec',
+  'v8_revision': '77f35f055a1543f51099fcea9575f83304d60de5',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling ANGLE
   # and whatever else without interference from each other.
@@ -351,7 +351,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling freetype
   # and whatever else without interference from each other.
-  'freetype_revision': 'fc051dc0beb44acc3a082b65b689dd38657fff54',
+  'freetype_revision': '738905b34bd1f5a8ff51bd2bc8e38a2d8be9bfd6',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling freetype
   # and whatever else without interference from each other.
@@ -415,7 +415,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling feed
   # and whatever else without interference from each other.
-  'dawn_revision': '9733be39e18186961d503e064874afe3e9ceb8d1',
+  'dawn_revision': '9fd4a731474f66c1ce5465f9b13919ad7487315d',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling feed
   # and whatever else without interference from each other.
@@ -519,11 +519,11 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling llvm-libc
   # and whatever else without interference from each other.
-  'llvm_libc_revision':    'ff75100b45027c70e17770cb80e720193b742c76',
+  'llvm_libc_revision':    'a2f7b489cd4fecf856eb3739cc5a341545022896',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling llvm-libc
   # and whatever else without interference from each other.
-  'compiler_rt_revision': 'fd2d6af9160159f6a70af612e93faba530a2283b',
+  'compiler_rt_revision': '989fc59a095ba0e691f5bd893e33478336dc18dc',
 
   # If you change this, also update the libc++ revision in
   # //buildtools/deps_revisions.gni.
@@ -1521,7 +1521,7 @@
 
   'src/clank': {
     'url': Var('chrome_git') + '/clank/internal/apps.git' + '@' +
-    '56b7e90cf310037bfa006cd102e987e6247069fc',
+    '2dbc9aa95eddeb69a73546f3076874c682375331',
     'condition': 'checkout_android and checkout_src_internal',
   },
 
@@ -2878,7 +2878,7 @@
       'dep_type': 'cipd',
   },
 
-  'src/third_party/vulkan-deps': '{chromium_git}/vulkan-deps@5f9183df4e99d153dcf2de173ddfd47034f72601',
+  'src/third_party/vulkan-deps': '{chromium_git}/vulkan-deps@9a8d0205ed06a556ff17d4097afc218c993ec260',
   'src/third_party/glslang/src': '{chromium_git}/external/github.com/KhronosGroup/glslang@05cfcc1613c28c1274036f53616d66324f7cd383',
   'src/third_party/spirv-cross/src': '{chromium_git}/external/github.com/KhronosGroup/SPIRV-Cross@b8fcf307f1f347089e3c46eb4451d27f32ebc8d3',
   'src/third_party/spirv-headers/src': '{chromium_git}/external/github.com/KhronosGroup/SPIRV-Headers@50daff941d88609b4d2ad076eae558e727f8e5cd',
@@ -2887,7 +2887,7 @@
   'src/third_party/vulkan-loader/src': '{chromium_git}/external/github.com/KhronosGroup/Vulkan-Loader@22c0f133e6675f9313c12fb5e58337f8fa9b9195',
   'src/third_party/vulkan-tools/src': '{chromium_git}/external/github.com/KhronosGroup/Vulkan-Tools@d671923090e4dc74c0ebdb10c6e09fa0826e1fe9',
   'src/third_party/vulkan-utility-libraries/src': '{chromium_git}/external/github.com/KhronosGroup/Vulkan-Utility-Libraries@54c9baf20802a13279e23fa4cb0528dd5cf16064',
-  'src/third_party/vulkan-validation-layers/src': '{chromium_git}/external/github.com/KhronosGroup/Vulkan-ValidationLayers@4b8f3caab2cf0ace618ba857364346aed6297d29',
+  'src/third_party/vulkan-validation-layers/src': '{chromium_git}/external/github.com/KhronosGroup/Vulkan-ValidationLayers@ce9b7e404fe1a312ff4c07961dc6f8a2fd925d44',
 
   'src/third_party/vulkan_memory_allocator':
     Var('chromium_git') + '/external/github.com/GPUOpen-LibrariesAndSDKs/VulkanMemoryAllocator.git' + '@' + '56300b29fbfcc693ee6609ddad3fdd5b7a449a21',
@@ -2932,7 +2932,7 @@
     Var('chromium_git') + '/webpagereplay.git' + '@' + Var('webpagereplay_revision'),
 
   'src/third_party/webrtc':
-    Var('webrtc_git') + '/src.git' + '@' + '345051055056e62fd7c011f56e4db800790e899b',
+    Var('webrtc_git') + '/src.git' + '@' + '74932424d457e2ad5e70c914b3cdd55bec759d6a',
 
   # Wuffs' canonical repository is at github.com/google/wuffs, but we use
   # Skia's mirror of Wuffs, the same as in upstream Skia's DEPS file.
@@ -3065,7 +3065,7 @@
     'packages': [
       {
         'package': 'chromeos_internal/apps/help_app/app',
-        'version': 'L9h2H9lHgTnR_bakdoSyh5SuHUJQP2kTyri4nylQzpoC',
+        'version': 'EAAQA9qexggZC8JxHnUvbFSiC_sWL9RtxzE90Twyxp4C',
       },
     ],
     'condition': 'checkout_chromeos and checkout_src_internal',
@@ -3076,7 +3076,7 @@
     'packages': [
       {
         'package': 'chromeos_internal/apps/media_app/app',
-        'version': 'UX-RYcRwa_VgUSPVJUR1HvV2NRTR4yTtxhoJT3S8aOgC',
+        'version': '7UcYt7Be4ZKo4woY47ZC5J9Mwmc7qVMnADv2RryFiusC',
       },
     ],
     'condition': 'checkout_chromeos and checkout_src_internal',
@@ -3109,7 +3109,7 @@
     'packages': [
       {
         'package': 'chromeos_internal/apps/projector_app/app',
-        'version': '9R50jJPUGiOAx220WUHv94AsI2g4u_Ne03DyqDaTR6kC',
+        'version': 'qnUuqZLgBkSQ-LGRFCVJvE057zWEX6q9oUHKJuy0kXIC',
       },
     ],
     'condition': 'checkout_chromeos and checkout_src_internal',
@@ -4718,7 +4718,7 @@
 
   'src/ios_internal':  {
       'url': Var('chrome_git') + '/chrome/ios_internal.git' + '@' +
-        '76ec58ad727d6e9acfcc265d631282ab84a73300',
+        '59a93a5717e2d1a9e523d986e012bde44aa5faa2',
       'condition': 'checkout_ios and checkout_src_internal',
   },
 

diff --git a/chrome/VERSION b/chrome/VERSION
index 1337f75..c175bdd 100644
--- a/chrome/VERSION
+++ b/chrome/VERSION

@@ -1,4 +1,4 @@
 MAJOR=139
 MINOR=0
-BUILD=7240
+BUILD=7242
 PATCH=0

diff --git a/chrome/android/expectations/lint-suppressions.xml b/chrome/android/expectations/lint-suppressions.xml
index 0640bb14..5bfea8bf 100644
--- a/chrome/android/expectations/lint-suppressions.xml
+++ b/chrome/android/expectations/lint-suppressions.xml

@@ -339,6 +339,9 @@
     <ignore regexp="The resource `R.string.feed_setting_option` appears to be unused"/>
     <ignore regexp="The resource `R.string.feed_section_on` appears to be unused"/>
 
+    <!-- TODO(crbug.com/424217546): 1 string: Remove once these are used. -->
+    <ignore regexp="The resource `R.string.ntp_custom_links_help_pin` appears to be unused"/>
+
     <!-- Endnote: Please specify number of suppressions when adding more -->
   </issue>
   <issue id="VectorPath" severity="ignore"/>

diff --git a/chrome/android/profiles/newest.txt b/chrome/android/profiles/newest.txt
index 896d554..43386cd 100644
--- a/chrome/android/profiles/newest.txt
+++ b/chrome/android/profiles/newest.txt

@@ -1 +1 @@
-chromeos-chrome-amd64-139.0.7234.0_rc-r1-merged.afdo.bz2
+chromeos-chrome-amd64-139.0.7238.0_rc-r1-merged.afdo.bz2

diff --git a/chrome/app/generated_resources.grd b/chrome/app/generated_resources.grd
index 1770cfb..70e00c7 100644
--- a/chrome/app/generated_resources.grd
+++ b/chrome/app/generated_resources.grd

@@ -7655,6 +7655,9 @@
       <message name="IDS_NTP_CUSTOM_LINKS_CANT_REMOVE" desc="A catchall error message for when the shortcut cannot be removed. (On the New Tab Page)">
        Can't remove shortcut
       </message>
+      <message name="IDS_NTP_CUSTOM_LINKS_HELP_PIN" desc="The in-product help text instructing the user on how to pin a shortcut (On the New Tab Page)">
+        Tap and hold to pin shortcuts
+      </message>
       <message name="IDS_NTP_CONFIRM_MSG_SHORTCUT_REMOVED" desc="The title of the shortcut removed confirmation message when removing a custom link. (On the New Tab Page)">
         Shortcut removed
       </message>

diff --git a/chrome/app/generated_resources_grd/IDS_NTP_CUSTOM_LINKS_HELP_PIN.png.sha1 b/chrome/app/generated_resources_grd/IDS_NTP_CUSTOM_LINKS_HELP_PIN.png.sha1
new file mode 100644
index 0000000..ef1dac0
--- /dev/null
+++ b/chrome/app/generated_resources_grd/IDS_NTP_CUSTOM_LINKS_HELP_PIN.png.sha1

@@ -0,0 +1 @@
+f954cbf8af363d75d7c7cbc312ba6ada2ebd5bd7
\ No newline at end of file

diff --git a/chrome/app/resources/generated_resources_ca.xtb b/chrome/app/resources/generated_resources_ca.xtb
index 5a2d088..8f1bafe 100644
--- a/chrome/app/resources/generated_resources_ca.xtb
+++ b/chrome/app/resources/generated_resources_ca.xtb

@@ -2220,6 +2220,7 @@
 <translation id="2514326558286966059">Desbloqueja el dispositiu més ràpidament amb l'empremta digital</translation>
 <translation id="2514465118223423406">Quan es connecti un ratolí</translation>
 <translation id="2514938842036917377">Amb aquesta acció se suprimiran <ph name="TOTAL_USAGE" /> de dades emmagatzemades per <ph name="SITE_NAME" />, pels llocs web relacionats i per les aplicacions instal·lades</translation>
+<translation id="2515489088825102986">Més informació sobre aquesta funció i la teva privadesa</translation>
 <translation id="2515586267016047495">Alt</translation>
 <translation id="251722524540674480">Confirma el teu nom d'usuari</translation>
 <translation id="2517472476991765520">Escaneja</translation>
@@ -3421,6 +3422,7 @@
 <translation id="3387829698079331264">Sense permís per saber quan estàs utilitzant el dispositiu de manera activa</translation>
 <translation id="3388094447051599208">La safata de sortida és quasi plena</translation>
 <translation id="3388788256054548012">Aquest fitxer està encriptat. Demana al propietari que el desencripti.</translation>
+<translation id="3389326266972418853">Més informació sobre el canvi automàtic de contrasenyes</translation>
 <translation id="3390013585654699824">Detalls de l'aplicació</translation>
 <translation id="3390442085511866400">Desa el &amp;fotograma com a...</translation>
 <translation id="3390530051434634135">Nota: <ph name="NOTE" /></translation>
@@ -5368,6 +5370,7 @@
 <translation id="4744268813103118742">Ves al lloc web</translation>
 <translation id="4744571849207727284">Excel</translation>
 <translation id="4744981231093950366">{NUM_TABS,plural, =1{Activa el so del lloc web}other{Activa el so dels llocs web}}</translation>
+<translation id="4745096442457817087">La contrasenya s'ha trobat en una violació de les dades públiques</translation>
 <translation id="4745500401920035244">L'administrador ha fet un canvi que desactiva alguns perfils antics en tot el sistema. Ja no pots accedir a aquest perfil, però encara el pots suprimir.</translation>
 <translation id="474609389162964566">Accedeix al teu Assistent amb "Hey Google"</translation>
 <translation id="4746757725581505837">Estàs a punt de suprimir les dades de <ph name="BRAND" /> desades en aquest dispositiu</translation>
@@ -10019,6 +10022,7 @@
 <translation id="8077579734294125741">Altres perfils de Chrome</translation>
 <translation id="8077749280021225629">Suprimeix també les dades de navegació (<ph name="URL" />). En fer-ho, se't tancarà la sessió del domini <ph name="DOMAIN" />. <ph name="LEARN_MORE" /></translation>
 <translation id="80790299200510644">Cerca d'imatges</translation>
+<translation id="8079606020824373126">El gestor de contrasenyes de Google pot actualitzar el teu compte amb una contrasenya segura i desar-la a <ph name="EMAIL" />. <ph name="PASSWORD_CHANGE" /></translation>
 <translation id="80798452873915119">Els llocs web poden demanar permís per gestionar finestres en totes les pantalles</translation>
 <translation id="8080028325999236607">Tanca totes les pestanyes</translation>
 <translation id="8081989000209387414">Vols desactivar la depuració d'ADB?</translation>

diff --git a/chrome/app/resources/generated_resources_es.xtb b/chrome/app/resources/generated_resources_es.xtb
index c3845ed..7187885 100644
--- a/chrome/app/resources/generated_resources_es.xtb
+++ b/chrome/app/resources/generated_resources_es.xtb

@@ -9753,7 +9753,7 @@
 <translation id="7904526211178107182">Permite que los puertos de Linux estén disponibles para otros dispositivos de tu red.</translation>
 <translation id="7906440585529721295">Los datos locales se eliminarán</translation>
 <translation id="7907502219904644296">Cambiar acceso</translation>
-<translation id="7907837847548254634">Destacar brevemente el objeto seleccionado</translation>
+<translation id="7907837847548254634">Destacar brevemente el objeto enfocado</translation>
 <translation id="7908378463497120834">Lo sentimos, pero al menos una partición del dispositivo de almacenamiento externo no se ha podido montar.</translation>
 <translation id="7908835530772972485">Eliminar los datos al cerrar todas las ventanas</translation>
 <translation id="7909324225945368569">Cambiar el nombre de tu perfil</translation>

diff --git a/chrome/app/resources/generated_resources_iw.xtb b/chrome/app/resources/generated_resources_iw.xtb
index 225f7363..061b4ee 100644
--- a/chrome/app/resources/generated_resources_iw.xtb
+++ b/chrome/app/resources/generated_resources_iw.xtb

@@ -6478,6 +6478,7 @@
 <translation id="5533343601674003130">‏שירות PDF</translation>
 <translation id="5537725057119320332">‏הפעלת Cast</translation>
 <translation id="5539070192556911367">‏לא ניתן להתחבר ל-Google</translation>
+<translation id="5541091577812545428">הסיסמה לא השתנתה</translation>
 <translation id="5542132724887566711">פרופיל</translation>
 <translation id="5542750926112347543">‏קובצי Cookie מ-<ph name="DOMAIN" /> חסומים</translation>
 <translation id="5542949973455282971">מתבצע חיבור אל <ph name="CARRIER_NAME" /></translation>
@@ -8284,6 +8285,7 @@
 <translation id="6841186874966388268">שגיאות</translation>
 <translation id="6842135459748401207">רק מכשירים שמחוברים אל <ph name="USER_EMAIL" /></translation>
 <translation id="6842136130964845393">כדי לוודא שתמיד תהיה לך גישה לסיסמאות השמורות, עליך לאמת את זהותך</translation>
+<translation id="6842670680297285750">תצוגה מפוצלת חדשה עם הכרטיסייה הנוכחית</translation>
 <translation id="6842749380892715807">‏ההורדה האחרונה של הרשימות של אתרי XML הייתה בשעה <ph name="LAST_DATE_DOWNLOAD" />.</translation>
 <translation id="6842868554183332230">לרוב, אתרים יכולים לזהות מתי המכשיר הזה משמש אותך באופן פעיל כדי להגדיר את הזמינות שלך באפליקציות צ'אט</translation>
 <translation id="6843264316370513305">ניפוי באגים ברשת</translation>
@@ -9300,6 +9302,7 @@
 <translation id="7585106857920830898">המערכת בודקת אם הקובץ עומד בדרישות של מדיניות האבטחה של הארגון…</translation>
 <translation id="7586498138629385861">‏Chrome ימשיך לפעול כל עוד יש אפליקציות Chrome פתוחות.</translation>
 <translation id="7587806318633605613">היסטוריית הצעות</translation>
+<translation id="7589448773774086276">תצוגה מפוצלת חדשה עם הכרטיסייה הנוכחית</translation>
 <translation id="7589461650300748890">היי! זהירות.</translation>
 <translation id="7590883480672980941">הגדרות קלט</translation>
 <translation id="7592060599656252486">חלק</translation>
@@ -10249,6 +10252,7 @@
 <translation id="8230134520748321204">האם לשמור את הסיסמה של <ph name="ORIGIN" />?</translation>
 <translation id="8230326817897075865">מחיקת <ph name="CREDENTIAL_TYPE" /></translation>
 <translation id="8230446983261649357">לא לאפשר לאתרים להציג תמונות</translation>
+<translation id="8231438895476693774">הוספת הכרטיסייה לתצוגה מפוצלת חדשה</translation>
 <translation id="823226567613548870">מחיקת הנתונים של <ph name="BRAND" /></translation>
 <translation id="8233028084277069927">פתיחה עכשיו</translation>
 <translation id="8234795456569844941">רוצה לעזור למהנדסים שלנו לפתור את הבעיה הזו? אפשר לספר לנו מה קרה לפני שהוצגה לך הודעת השגיאה לגבי הפרופיל:</translation>
@@ -10261,6 +10265,7 @@
 <translation id="8239932336306009582">לא מורשים לשלוח התראות</translation>
 <translation id="8241040075392580210">צל</translation>
 <translation id="8241338426526905580">אין אישורים</translation>
+<translation id="8241650983304689286">הוספת הכרטיסייה לתצוגה מפוצלת חדשה</translation>
 <translation id="8241806945692107836">קביעת תצורת המכשיר...</translation>
 <translation id="8241868517363889229">לקרוא ולשנות את הסימניות שלך</translation>
 <translation id="8242273718576931540">לא ניתן לחבר את המכשיר שלך לרשת זו. <ph name="BEGIN_LINK_LEARN_MORE" />מידע נוסף<ph name="END_LINK_LEARN_MORE" /></translation>

diff --git a/chrome/browser/extensions/unpacked_installer.cc b/chrome/browser/extensions/unpacked_installer.cc
index 7097c11..b55a9a7 100644
--- a/chrome/browser/extensions/unpacked_installer.cc
+++ b/chrome/browser/extensions/unpacked_installer.cc

@@ -306,7 +306,8 @@
     return true;
   }
   // If there is a "*" in the extension blocklist, then no extensions should be
-  // allowed at all (except explicitly allowlisted extensions).
+  // allowed at all except packed extensions that are explicitly listed in the
+  // allowlist.
   return !ExtensionManagementFactory::GetForBrowserContext(profile_)
               ->BlocklistedByDefault();
 }

diff --git a/chrome/browser/facilitated_payments/ui/chrome_facilitated_payments_client.cc b/chrome/browser/facilitated_payments/ui/chrome_facilitated_payments_client.cc
index d86a6aba..6a81a69 100644
--- a/chrome/browser/facilitated_payments/ui/chrome_facilitated_payments_client.cc
+++ b/chrome/browser/facilitated_payments/ui/chrome_facilitated_payments_client.cc

@@ -186,7 +186,7 @@
 
 void ChromeFacilitatedPaymentsClient::OnPixAccountLinkingPromptAccepted() {
   // TODO(crbug.com/419108993): Add metrics.
-  payments::facilitated::OpenPixAccountLinkingPageInWallet();
+  payments::facilitated::OpenPixAccountLinkingPageInWallet(&GetWebContents());
 }
 
 void ChromeFacilitatedPaymentsClient::RegisterAllowlists() {

diff --git a/chrome/browser/ui/android/strings/translations/android_chrome_strings_ca.xtb b/chrome/browser/ui/android/strings/translations/android_chrome_strings_ca.xtb
index d4c7665..8f643f18 100644
--- a/chrome/browser/ui/android/strings/translations/android_chrome_strings_ca.xtb
+++ b/chrome/browser/ui/android/strings/translations/android_chrome_strings_ca.xtb

@@ -674,6 +674,7 @@
 <translation id="4116038641877404294">Baixa pàgines per utilitzar-les sense connexió</translation>
 <translation id="4121654769234887259">No caldrà que recordis aquesta contrasenya. Es desarà al gestor de contrasenyes de Google per a <ph name="USERNAME" />.</translation>
 <translation id="4124152339699379357">El flux del permís de notificacions s'ha obert a alçada completa</translation>
+<translation id="4129668596244365470">{NUM_REVOKED_PERMISSIONS,plural, =1{Chrome ha aturat les notificacions d'aquest lloc web. Pots revisar-les i gestionar-les.}other{Chrome ha aturat les notificacions d'aquests llocs web. Pots revisar-les i gestionar-les.}}</translation>
 <translation id="4132137475637520539">Permet que s'hi uneixi tothom que tingui l'enllaç</translation>
 <translation id="4135200667068010335">La llista de dispositius amb què es compartirà una pestanya està tancada.</translation>
 <translation id="4137746084635924146">Idioma actual del dispositiu</translation>
@@ -936,6 +937,7 @@
 <translation id="5267572070504076962">Activa Navegació segura per obtenir protecció contra llocs web perillosos</translation>
 <translation id="5271967389191913893">El dispositiu no pot obrir el contingut que s'ha de baixar.</translation>
 <translation id="5273031377282080577">El teu administrador gestiona aquesta opció de configuració.</translation>
+<translation id="5287338992381051621">{NUM_REVOKED_PERMISSIONS,plural, =1{S'ha cancel·lat la subscripció a un lloc web no utilitzat}other{S'ha cancel·lat la subscripció a # llocs web no utilitzats}}</translation>
 <translation id="5292796745632149097">Envia a</translation>
 <translation id="5301876394151419436">Has iniciat la sessió com a <ph name="EMAIL" />. Pots aturar la sincronització en qualsevol moment a la configuració. És possible que Google personalitzi la Cerca i altres serveis en funció del teu historial.</translation>
 <translation id="5304593522240415983">Aquest camp no pot estar en blanc</translation>

diff --git a/chrome/browser/ui/color/chrome_color_id.h b/chrome/browser/ui/color/chrome_color_id.h
index 10e86f2..7c3d746 100644
--- a/chrome/browser/ui/color/chrome_color_id.h
+++ b/chrome/browser/ui/color/chrome_color_id.h

@@ -360,7 +360,7 @@
   E_CPONLY(kColorOmniboxResultsBackground) \
   E_CPONLY(kColorOmniboxResultsBackgroundHovered) \
   E_CPONLY(kColorOmniboxResultsBackgroundSelected) \
-  E_CPONLY(kColorOmniboxResultsBackgroundIPH) \
+  E_CPONLY(kColorOmniboxResultsBackgroundIph) \
   E_CPONLY(kColorOmniboxResultsButtonBorder) \
   E_CPONLY(kColorOmniboxResultsButtonIcon) \
   E_CPONLY(kColorOmniboxResultsButtonIconSelected) \

diff --git a/chrome/browser/ui/color/omnibox_color_mixer.cc b/chrome/browser/ui/color/omnibox_color_mixer.cc
index 4150ad6..1b3a5df1 100644
--- a/chrome/browser/ui/color/omnibox_color_mixer.cc
+++ b/chrome/browser/ui/color/omnibox_color_mixer.cc

@@ -24,7 +24,8 @@
 // The contrast for omnibox colors in high contrast mode.
 constexpr float kOmniboxHighContrastRatio = 6.0f;
 
-// Apply updates to the Omnibox text color tokens per GM3 spec.
+// Apply updates to the Omnibox text color tokens per GM3 spec. Not called when
+// using high contrast mode or a custom theme.
 void ApplyGM3OmniboxTextColor(ui::ColorMixer& mixer,
                               const ui::ColorProviderKey& key) {
   mixer[kColorOmniboxText] = {ui::kColorSysOnSurface};
@@ -57,6 +58,7 @@
       kColorOmniboxResultsTextSecondary};
 }
 
+// Not called when using high contrast mode or a custom theme.
 void ApplyCR2023OmniboxIconColors(ui::ColorMixer& mixer,
                                   const ui::ColorProviderKey& key) {
   mixer[kColorOmniboxActionIcon] = {ui::kColorSysOnSurfaceSubtle};
@@ -81,6 +83,7 @@
 }
 
 // Apply updates to the Omnibox "expanded state" color tokens per CR2023 spec.
+// Not called when using high contrast mode or a custom theme.
 void ApplyCR2023OmniboxExpandedStateColors(ui::ColorMixer& mixer,
                                            const ui::ColorProviderKey& key) {
   // Update focus bar color.
@@ -88,6 +91,7 @@
 
   // Update omnibox popup background color.
   mixer[kColorOmniboxResultsBackground] = {ui::kColorSysBase};
+  mixer[kColorOmniboxResultsBackgroundIph] = {ui::kColorSysSurface2};
 
   // Update suggestion hover fill colors.
   mixer[kColorOmniboxResultsBackgroundHovered] = ui::GetResultingPaintColor(
@@ -232,7 +236,8 @@
   // Results background, chip, button, and focus colors.
   mixer[kColorOmniboxResultsBackground] =
       ui::GetColorWithMaxContrast(kColorOmniboxText);
-  mixer[kColorOmniboxResultsBackgroundIPH] = {ui::kColorSysSurface2};
+  mixer[kColorOmniboxResultsBackgroundIph] = {
+      kColorOmniboxResultsBackgroundHovered};
   mixer[kColorOmniboxResultsBackgroundHovered] = ui::BlendTowardMaxContrast(
       kColorOmniboxResultsBackground, gfx::kGoogleGreyAlpha200);
   mixer[kColorOmniboxResultsBackgroundSelected] = ui::BlendTowardMaxContrast(

diff --git a/chrome/browser/ui/omnibox/omnibox_theme.h b/chrome/browser/ui/omnibox/omnibox_theme.h
index 6803fc9..93dc30d 100644
--- a/chrome/browser/ui/omnibox/omnibox_theme.h
+++ b/chrome/browser/ui/omnibox/omnibox_theme.h

@@ -20,7 +20,7 @@
       kColorOmniboxResultsBackground,
       kColorOmniboxResultsBackgroundHovered,
       kColorOmniboxResultsBackgroundSelected,
-      kColorOmniboxResultsBackgroundIPH,
+      kColorOmniboxResultsBackgroundIph,
   });
   return kIds[static_cast<size_t>(state)];
 }

diff --git a/chrome/build/android-arm32.pgo.txt b/chrome/build/android-arm32.pgo.txt
index ddcd498..3df86fa 100644
--- a/chrome/build/android-arm32.pgo.txt
+++ b/chrome/build/android-arm32.pgo.txt

@@ -1 +1 @@
-chrome-android32-main-1749923799-a76393e3ddc55791984956fe17fead6c23239718-6eeb1aa223289e1f2486fe6f17acc7bdcef68842.profdata
+chrome-android32-main-1750009617-bbfeebdfad78b22da897197df9e2c2884d7eca3d-f6ac3cb5a4c11c6645de8f6c2268c1194015d70f.profdata

diff --git a/chrome/build/android-arm64.pgo.txt b/chrome/build/android-arm64.pgo.txt
index f102be25..89d189822 100644
--- a/chrome/build/android-arm64.pgo.txt
+++ b/chrome/build/android-arm64.pgo.txt

@@ -1 +1 @@
-chrome-android64-main-1749936946-f28576b083ff8e83af51a3d9cc75f60ae87bde58-e989edc60cb134e7b10844ebe9ec7d13f4fec5d1.profdata
+chrome-android64-main-1750015598-6439d4f9c5744cd57ff1dced75e3f34ff3ed5902-09516d32715f9bd80489f60c53c77b1021081774.profdata

diff --git a/chrome/build/linux.pgo.txt b/chrome/build/linux.pgo.txt
index 38b0810..48f40bd 100644
--- a/chrome/build/linux.pgo.txt
+++ b/chrome/build/linux.pgo.txt

@@ -1 +1 @@
-chrome-linux-main-1749901391-dc58f8dd73fdccb9d95fa29a465e4b00d9cee65f-2a614db4292ef9996a5c888232c3ca999e41691f.profdata
+chrome-linux-main-1750009617-6eb2c7fe91c4b06a5af3e2e13402bf081fe3de6f-f6ac3cb5a4c11c6645de8f6c2268c1194015d70f.profdata

diff --git a/chrome/build/mac-arm.pgo.txt b/chrome/build/mac-arm.pgo.txt
index 4bfc45c..292d89f 100644
--- a/chrome/build/mac-arm.pgo.txt
+++ b/chrome/build/mac-arm.pgo.txt

@@ -1 +1 @@
-chrome-mac-arm-main-1749937799-6b7275d5fea46f00dc11cf89f8f59f0ad21fc679-e62aeae7695b7ed941419d0a59a1382c958652a0.profdata
+chrome-mac-arm-main-1750015598-0ff44c5aac07a439ed53c4c5fd045b028bab5526-09516d32715f9bd80489f60c53c77b1021081774.profdata

diff --git a/chrome/build/mac.pgo.txt b/chrome/build/mac.pgo.txt
index 1420485..094de419 100644
--- a/chrome/build/mac.pgo.txt
+++ b/chrome/build/mac.pgo.txt

@@ -1 +1 @@
-chrome-mac-main-1749923799-37bfb08d6a053bcb69713081a3c2a6bcb8b3cfd2-6eeb1aa223289e1f2486fe6f17acc7bdcef68842.profdata
+chrome-mac-main-1750009617-05adae8e20951b03b0ea348000c68b4285cafb40-f6ac3cb5a4c11c6645de8f6c2268c1194015d70f.profdata

diff --git a/chrome/build/win-arm64.pgo.txt b/chrome/build/win-arm64.pgo.txt
index 4c1abf0..926728de 100644
--- a/chrome/build/win-arm64.pgo.txt
+++ b/chrome/build/win-arm64.pgo.txt

@@ -1 +1 @@
-chrome-win-arm64-main-1749923799-318770060da5831b1e724fc291b99c662986e749-6eeb1aa223289e1f2486fe6f17acc7bdcef68842.profdata
+chrome-win-arm64-main-1749967031-d1c7b5ce762613d774449d613e40ca3d704ac388-1ef2b77bb4414969924929ac44548cef351a11a7.profdata

diff --git a/chrome/build/win32.pgo.txt b/chrome/build/win32.pgo.txt
index d8947bb5..b50a314 100644
--- a/chrome/build/win32.pgo.txt
+++ b/chrome/build/win32.pgo.txt

@@ -1 +1 @@
-chrome-win32-main-1749923799-f198787c291e168e56c050263ca6695d8b900c02-6eeb1aa223289e1f2486fe6f17acc7bdcef68842.profdata
+chrome-win32-main-1749988628-4287abccd4efa8b9e34c1b13d84ee64289a1b8cf-8e8a0caa003533ccb469c4a67aef1241fe241952.profdata

diff --git a/chrome/build/win64.pgo.txt b/chrome/build/win64.pgo.txt
index 51e1985..9f771456 100644
--- a/chrome/build/win64.pgo.txt
+++ b/chrome/build/win64.pgo.txt

@@ -1 +1 @@
-chrome-win64-main-1749923799-60fdcfa6ac86a4a5a0efbeca04bdaf5de0b77e71-6eeb1aa223289e1f2486fe6f17acc7bdcef68842.profdata
+chrome-win64-main-1749999351-2255fb30d49c619811527c22d680e8d62ad24fda-76e12975326cf471fe76aeb19ca5ecdbffc1f9fc.profdata

diff --git a/chromeos/CHROMEOS_LKGM b/chromeos/CHROMEOS_LKGM
index e65d32b..a0e040a 100644
--- a/chromeos/CHROMEOS_LKGM
+++ b/chromeos/CHROMEOS_LKGM

@@ -1 +1 @@
-16319.0.0-1069594
\ No newline at end of file
+16320.0.0-1069610
\ No newline at end of file

diff --git a/chromeos/profiles/atom.afdo.newest.txt b/chromeos/profiles/atom.afdo.newest.txt
index 20841108..9f8be4da 100644
--- a/chromeos/profiles/atom.afdo.newest.txt
+++ b/chromeos/profiles/atom.afdo.newest.txt

@@ -1 +1 @@
-chromeos-chrome-amd64-atom-139-7204.17-1749436011-benchmark-139.0.7234.0-r1-redacted.afdo.xz
+chromeos-chrome-amd64-atom-139-7204.17-1749436011-benchmark-139.0.7238.0-r1-redacted.afdo.xz

diff --git a/chromeos/profiles/bigcore.afdo.newest.txt b/chromeos/profiles/bigcore.afdo.newest.txt
index f173ad1..b24306d 100644
--- a/chromeos/profiles/bigcore.afdo.newest.txt
+++ b/chromeos/profiles/bigcore.afdo.newest.txt

@@ -1 +1 @@
-chromeos-chrome-amd64-bigcore-139-7204.8-1749436445-benchmark-139.0.7234.0-r1-redacted.afdo.xz
+chromeos-chrome-amd64-bigcore-139-7204.8-1749436445-benchmark-139.0.7238.0-r1-redacted.afdo.xz

diff --git a/clank b/clank
index 56b7e90..2dbc9aa 160000
--- a/clank
+++ b/clank

@@ -1 +1 @@
-Subproject commit 56b7e90cf310037bfa006cd102e987e6247069fc
+Subproject commit 2dbc9aa95eddeb69a73546f3076874c682375331

diff --git a/components/autofill/core/browser/foundations/browser_autofill_manager.cc b/components/autofill/core/browser/foundations/browser_autofill_manager.cc
index 8c1470e..52a4a0c 100644
--- a/components/autofill/core/browser/foundations/browser_autofill_manager.cc
+++ b/components/autofill/core/browser/foundations/browser_autofill_manager.cc

@@ -993,7 +993,7 @@
     autofill_field->set_is_autofilled(false);
     autofill_field->set_previously_autofilled(true);
     if (logger) {
-      logger->OnEditedAutofilledField(autofill_field->global_id());
+      logger->OnEditedAutofilledField(field_id);
     }
     if (AutofillAiDelegate* delegate = client().GetAutofillAiDelegate();
         delegate &&
@@ -1003,7 +1003,7 @@
     }
   } else {
     if (logger) {
-      logger->OnEditedNonFilledField(autofill_field->global_id());
+      logger->OnEditedNonFilledField(field_id);
     }
   }
   UpdateInitialInteractionTimestamp(timestamp);
@@ -1022,7 +1022,6 @@
 SuggestionsContext BrowserAutofillManager::BuildSuggestionsContext(
     const FormData& form,
     const FormStructure* form_structure,
-    const FormFieldData& field,
     const AutofillField* autofill_field,
     AutofillSuggestionTriggerSource trigger_source) {
   SuggestionsContext context;
@@ -1088,7 +1087,7 @@
     context.do_not_generate_autofill_suggestions = true;
     // If the user begins typing, we interpret that as dismissing the warning.
     // No suggestions are allowed, but the warning is no longer shown.
-    if (field.properties_mask() & kUserTyped) {
+    if (autofill_field->properties_mask() & kUserTyped) {
       context.suppress_reason = SuppressReason::kInsecureForm;
     } else {
       context.should_show_mixed_content_warning = true;
@@ -1168,13 +1167,13 @@
       std::make_unique<IbanSuggestionGenerator>());
 
   SuggestionsContext context = BuildSuggestionsContext(
-      form, form_structure, field, autofill_field, trigger_source);
+      form, form_structure, autofill_field, trigger_source);
 
   auto barrier_callback = base::BarrierCallback<std::pair<
       FillingProduct, std::vector<SuggestionGenerator::SuggestionData>>>(
       suggestion_generators_.size(),
       base::BindOnce(&BrowserAutofillManager::OnSuggestionDataFetched,
-                     weak_ptr_factory_.GetWeakPtr(), form, field,
+                     weak_ptr_factory_.GetWeakPtr(), form.global_id(), field_id,
                      trigger_source, context));
 
   for (const auto& suggestion_generator : suggestion_generators_) {
@@ -1184,8 +1183,8 @@
 }
 
 void BrowserAutofillManager::OnSuggestionDataFetched(
-    const FormData& form,
-    const FormFieldData& field,
+    const FormGlobalId& form_id,
+    const FieldGlobalId& field_id,
     AutofillSuggestionTriggerSource trigger_source,
     SuggestionsContext context,
     std::vector<std::pair<FillingProduct,
@@ -1196,13 +1195,13 @@
           suggestion_generators_.size(),
           base::BindOnce(
               &BrowserAutofillManager::OnIndividualSuggestionsGenerated,
-              weak_ptr_factory_.GetWeakPtr(), form, field, trigger_source,
+              weak_ptr_factory_.GetWeakPtr(), form_id, field_id, trigger_source,
               context));
 
   FormStructure* form_structure = nullptr;
   AutofillField* autofill_field = nullptr;
-  if (!GetCachedFormAndField(form.global_id(), field.global_id(),
-                             &form_structure, &autofill_field)) {
+  if (!GetCachedFormAndField(form_id, field_id, &form_structure,
+                             &autofill_field)) {
     // Form is not autofillable, or either the form or the field cannot be
     // found.
     return;
@@ -1215,8 +1214,8 @@
 }
 
 void BrowserAutofillManager::OnIndividualSuggestionsGenerated(
-    const FormData& form,
-    const FormFieldData& field,
+    const FormGlobalId& form_id,
+    const FieldGlobalId& field_id,
     AutofillSuggestionTriggerSource trigger_source,
     SuggestionsContext context,
     std::vector<SuggestionGenerator::ReturnedSuggestions>
@@ -1230,8 +1229,8 @@
                        filling_suggestions.end());
   }
 
-  OnGenerateSuggestionsComplete(form, field, trigger_source, context, true,
-                                suggestions, std::nullopt);
+  OnGenerateSuggestionsComplete(form_id, field_id, trigger_source, context,
+                                true, suggestions, std::nullopt);
   // Suggestion generators lifespan should be limited to only when they are
   // needed.
   suggestion_generators_.clear();
@@ -1258,7 +1257,7 @@
                                       &form_structure, &autofill_field);
 
   SuggestionsContext context = BuildSuggestionsContext(
-      form, form_structure, field, autofill_field, trigger_source);
+      form, form_structure, autofill_field, trigger_source);
   context.field_is_relevant_for_plus_addresses =
       IsPlusAddressesManuallyTriggered(trigger_source) ||
       (!context.should_show_mixed_content_warning &&
@@ -1291,9 +1290,10 @@
     AutofillSuggestionTriggerSource trigger_source,
     SuggestionsContext context,
     std::vector<std::string> plus_addresses) {
-  OnGenerateSuggestionsCallback callback = base::BindOnce(
-      &BrowserAutofillManager::OnGenerateSuggestionsComplete,
-      weak_ptr_factory_.GetWeakPtr(), form, field, trigger_source, context);
+  OnGenerateSuggestionsCallback callback =
+      base::BindOnce(&BrowserAutofillManager::OnGenerateSuggestionsComplete,
+                     weak_ptr_factory_.GetWeakPtr(), form.global_id(),
+                     field.global_id(), trigger_source, context);
 
   FormStructure* form_structure = nullptr;
   AutofillField* autofill_field = nullptr;
@@ -1399,8 +1399,8 @@
 
     MixPlusAddressAndAddressSuggestions(
         std::move(plus_address_suggestions), std::move(suggestions),
-        suggestions_context, password_form_classification.type, form, field,
-        std::move(callback));
+        suggestions_context, password_form_classification.type,
+        form.global_id(), field.global_id(), std::move(callback));
 
     return;
   }
@@ -1477,7 +1477,7 @@
           OnGeneratedPlusAddressAndSingleFieldFillSuggestions,
       weak_ptr_factory_.GetWeakPtr(),
       AutofillPlusAddressDelegate::SuggestionContext::kAutocomplete,
-      password_form_classification.type, form, field,
+      password_form_classification.type, form.global_id(), field,
       should_offer_single_field_form_fill, std::move(callback),
       std::move(plus_address_suggestions));
 
@@ -1525,7 +1525,7 @@
     OnGeneratedPlusAddressAndSingleFieldFillSuggestions(
         AutofillPlusAddressDelegate::SuggestionContext suggestions_context,
         PasswordFormClassification::Type password_form_type,
-        const FormData& form,
+        const FormGlobalId& form_id,
         const FormFieldData& field,
         bool should_offer_single_field_form_fill,
         OnGenerateSuggestionsCallback callback,
@@ -1566,7 +1566,7 @@
 
   if (!plus_address_suggestions.empty()) {
     client().GetPlusAddressDelegate()->OnPlusAddressSuggestionShown(
-        *this, form.global_id(), field.global_id(), suggestions_context,
+        *this, form_id, field.global_id(), suggestions_context,
         password_form_type, suggestions[0].type);
 
     // Include ManagePlusAddressSuggestion item.
@@ -1582,8 +1582,8 @@
 }
 
 void BrowserAutofillManager::OnGenerateSuggestionsComplete(
-    const FormData& form,
-    const FormFieldData& field,
+    const FormGlobalId& form_id,
+    const FieldGlobalId& field_id,
     AutofillSuggestionTriggerSource trigger_source,
     const SuggestionsContext& context,
     bool show_suggestions,
@@ -1595,7 +1595,7 @@
   FormStructure* form_structure = nullptr;
   AutofillField* autofill_field = nullptr;
   bool form_and_field_cached = GetCachedFormAndField(
-      form.global_id(), field.global_id(), &form_structure, &autofill_field);
+      form_id, field_id, &form_structure, &autofill_field);
   if (trigger_source ==
           AutofillSuggestionTriggerSource::kFormControlElementClicked &&
       form_and_field_cached) {
@@ -1632,7 +1632,7 @@
 
   if (show_suggestions) {
     // Send Autofill suggestions (could be an empty list).
-    external_delegate_->OnSuggestionsReturned(field.global_id(), suggestions,
+    external_delegate_->OnSuggestionsReturned(field_id, suggestions,
                                               std::move(ranking_context));
   }
 }
@@ -1642,8 +1642,8 @@
     std::vector<Suggestion> address_suggestions,
     AutofillPlusAddressDelegate::SuggestionContext suggestions_context,
     PasswordFormClassification::Type password_form_type,
-    const FormData& form,
-    const FormFieldData& field,
+    const FormGlobalId& form_id,
+    const FieldGlobalId& field_id,
     OnGenerateSuggestionsCallback callback) {
   if (plus_address_suggestions.empty()) {
     std::move(callback).Run(/*show_suggestions=*/true,
@@ -1652,8 +1652,8 @@
   }
 
   client().GetPlusAddressDelegate()->OnPlusAddressSuggestionShown(
-      *this, form.global_id(), field.global_id(), suggestions_context,
-      password_form_type, plus_address_suggestions[0].type);
+      *this, form_id, field_id, suggestions_context, password_form_type,
+      plus_address_suggestions[0].type);
   if (address_suggestions.empty()) {
     plus_address_suggestions.emplace_back(SuggestionType::kSeparator);
     plus_address_suggestions.push_back(
@@ -1975,7 +1975,7 @@
 
   const FormFieldData& field = CHECK_DEREF(form.FindFieldByGlobalId(field_id));
   SuggestionsContext context =
-      BuildSuggestionsContext(form, form_structure, field, autofill_field,
+      BuildSuggestionsContext(form, form_structure, autofill_field,
                               AutofillSuggestionTriggerSource::kUnspecified);
   autofill_metrics::SuggestionRankingContext ranking_context;
 
@@ -2544,7 +2544,8 @@
                                     *profile, trigger_source,
                                     refill_trigger_reason.has_value());
             MaybeShowPlusAddressEmailOverrideNotification(
-                safe_filled_autofill_fields, *profile, form_structure);
+                safe_filled_autofill_fields, *profile,
+                form_structure.global_id());
           },
           [&](const CreditCard* credit_card) {
             LogAndRecordCreditCardFill(form_structure, trigger_autofill_field,
@@ -2680,7 +2681,7 @@
 void BrowserAutofillManager::MaybeShowPlusAddressEmailOverrideNotification(
     base::span<const AutofillField*> safe_filled_autofill_fields,
     const AutofillProfile& filled_profile,
-    const FormStructure& form_structure) {
+    const FormGlobalId& form_id) {
   // `filled_profile` might have had its email overridden, which is what makes
   // it different from `original_profile`.
   const AutofillProfile* original_profile =
@@ -2721,8 +2722,7 @@
     client().ShowPlusAddressEmailOverrideNotification(
         base::UTF16ToUTF8(original_email),
         base::BindOnce(&BrowserAutofillManager::OnEmailOverrideUndone,
-                       weak_ptr_factory_.GetWeakPtr(), original_email,
-                       form_structure.global_id(),
+                       weak_ptr_factory_.GetWeakPtr(), original_email, form_id,
                        email_autofill_field->global_id()));
   }
 }

diff --git a/components/autofill/core/browser/foundations/browser_autofill_manager.h b/components/autofill/core/browser/foundations/browser_autofill_manager.h
index df77192..ad7b9cb1 100644
--- a/components/autofill/core/browser/foundations/browser_autofill_manager.h
+++ b/components/autofill/core/browser/foundations/browser_autofill_manager.h

@@ -452,7 +452,6 @@
   SuggestionsContext BuildSuggestionsContext(
       const FormData& form,
       const FormStructure* form_structure,
-      const FormFieldData& field,
       const AutofillField* autofill_field,
       AutofillSuggestionTriggerSource trigger_source);
 
@@ -484,8 +483,8 @@
   // It schedules the generation of the individual suggestions for each
   // `FillingProduct` and calls `OnIndividualSuggestionsGenerated` when done.
   void OnSuggestionDataFetched(
-      const FormData& form,
-      const FormFieldData& field,
+      const FormGlobalId& form_id,
+      const FieldGlobalId& field_id,
       AutofillSuggestionTriggerSource trigger_source,
       SuggestionsContext context,
       std::vector<std::pair<FillingProduct,
@@ -496,8 +495,8 @@
   // suggestions. It combines the returned suggestions respecting their
   // priorities and calls `OnGenerateSuggestionsComplete` to show them.
   void OnIndividualSuggestionsGenerated(
-      const FormData& form,
-      const FormFieldData& field,
+      const FormGlobalId& form_id,
+      const FieldGlobalId& field_id,
       AutofillSuggestionTriggerSource trigger_source,
       SuggestionsContext context,
       std::vector<SuggestionGenerator::ReturnedSuggestions>
@@ -535,7 +534,7 @@
   void OnGeneratedPlusAddressAndSingleFieldFillSuggestions(
       AutofillPlusAddressDelegate::SuggestionContext suggestions_context,
       PasswordFormClassification::Type password_form_type,
-      const FormData& form,
+      const FormGlobalId& form,
       const FormFieldData& field,
       bool should_offer_single_field_form_fill,
       OnGenerateSuggestionsCallback callback,
@@ -555,8 +554,8 @@
   // shown. `ranking_context` contains information regarding the ranking of
   // suggestions and is used for metrics logging.
   void OnGenerateSuggestionsComplete(
-      const FormData& form,
-      const FormFieldData& field,
+      const FormGlobalId& form_id,
+      const FieldGlobalId& field_id,
       AutofillSuggestionTriggerSource trigger_source,
       const SuggestionsContext& context,
       bool show_suggestions,
@@ -572,8 +571,8 @@
       std::vector<Suggestion> address_suggestions,
       AutofillPlusAddressDelegate::SuggestionContext suggestions_context,
       PasswordFormClassification::Type password_form_type,
-      const FormData& form,
-      const FormFieldData& field,
+      const FormGlobalId& form_id,
+      const FieldGlobalId& field_id,
       OnGenerateSuggestionsCallback callback);
 
   // Returns an appropriate EventFormLogger, depending on the given `field`'s
@@ -627,7 +626,7 @@
   void MaybeShowPlusAddressEmailOverrideNotification(
       base::span<const AutofillField*> safe_filled_autofill_fields,
       const AutofillProfile& filled_profile,
-      const FormStructure& form_structure);
+      const FormGlobalId& form_id);
 
   // Delegates to perform external processing (display, selection) on
   // our behalf.

diff --git a/components/certificate_transparency/data/log_list.json b/components/certificate_transparency/data/log_list.json
index d298645..d241998 100644
--- a/components/certificate_transparency/data/log_list.json
+++ b/components/certificate_transparency/data/log_list.json

@@ -1,6 +1,6 @@
 {
-  "version": "55.5",
-  "log_list_timestamp": "2025-06-14T12:54:07Z",
+  "version": "55.6",
+  "log_list_timestamp": "2025-06-15T13:01:36Z",
   "operators": [
     {
       "name": "Google",

diff --git a/components/facilitated_payments/android/BUILD.gn b/components/facilitated_payments/android/BUILD.gn
index 1e2ffd5c0..500036b0 100644
--- a/components/facilitated_payments/android/BUILD.gn
+++ b/components/facilitated_payments/android/BUILD.gn

@@ -21,6 +21,7 @@
     "//components/facilitated_payments/core/utils",
     "//components/signin/public/identity_manager",
     "//content/public/browser",
+    "//ui/android",
   ]
 }
 

diff --git a/components/facilitated_payments/android/DEPS b/components/facilitated_payments/android/DEPS
index dcd87d30..754832e 100644
--- a/components/facilitated_payments/android/DEPS
+++ b/components/facilitated_payments/android/DEPS

@@ -2,4 +2,5 @@
   "+components/signin/public",
   "+content/public/browser",
   "+content/public/test",
+  "+ui/android",
 ]

diff --git a/components/facilitated_payments/android/device_delegate_android.cc b/components/facilitated_payments/android/device_delegate_android.cc
index 03632e35..d02fe3d 100644
--- a/components/facilitated_payments/android/device_delegate_android.cc
+++ b/components/facilitated_payments/android/device_delegate_android.cc

@@ -5,6 +5,8 @@
 #include "components/facilitated_payments/android/device_delegate_android.h"
 
 #include "base/android/jni_android.h"
+#include "content/public/browser/web_contents.h"
+#include "ui/android/window_android.h"
 
 // Must come after all headers that specialize FromJniType() / ToJniType().
 #include "components/facilitated_payments/android/java/jni_headers/DeviceDelegate_jni.h"
@@ -16,8 +18,15 @@
   return Java_DeviceDelegate_isWalletEligibleForPixAccountLinking(env);
 }
 
-void OpenPixAccountLinkingPageInWallet() {
-  // TODO(crbug.com/419728706): Open the account linking page in Wallet.
+void OpenPixAccountLinkingPageInWallet(content::WebContents* web_contents) {
+  if (!web_contents || !web_contents->GetNativeView() ||
+      !web_contents->GetNativeView()->GetWindowAndroid()) {
+    // TODO(crbug.com/419108993): Log metrics.
+    return;
+  }
+  JNIEnv* env = base::android::AttachCurrentThread();
+  Java_DeviceDelegate_openPixAccountLinkingPageInWallet(
+      env, web_contents->GetTopLevelNativeWindow()->GetJavaObject());
 }
 
 }  // namespace payments::facilitated

diff --git a/components/facilitated_payments/android/device_delegate_android.h b/components/facilitated_payments/android/device_delegate_android.h
index 9de4527..988a9ee 100644
--- a/components/facilitated_payments/android/device_delegate_android.h
+++ b/components/facilitated_payments/android/device_delegate_android.h

@@ -5,6 +5,8 @@
 #ifndef COMPONENTS_FACILITATED_PAYMENTS_ANDROID_DEVICE_DELEGATE_ANDROID_H_
 #define COMPONENTS_FACILITATED_PAYMENTS_ANDROID_DEVICE_DELEGATE_ANDROID_H_
 
+#include "content/public/browser/web_contents.h"
+
 namespace payments::facilitated {
 
 // Returns true if Google Wallet is installed, and its version supports Pix
@@ -12,7 +14,7 @@
 bool IsWalletEligibleForPixAccountLinking();
 
 // Opens the Pix account linking page in Google Wallet.
-void OpenPixAccountLinkingPageInWallet();
+void OpenPixAccountLinkingPageInWallet(content::WebContents* web_contents);
 
 }  // namespace payments::facilitated
 

diff --git a/components/facilitated_payments/android/java/BUILD.gn b/components/facilitated_payments/android/java/BUILD.gn
index 7e179f94..974ca76 100644
--- a/components/facilitated_payments/android/java/BUILD.gn
+++ b/components/facilitated_payments/android/java/BUILD.gn

@@ -22,6 +22,7 @@
     "//content/public/android:content_full_java",
     "//third_party/androidx:androidx_annotation_annotation_java",
     "//third_party/jni_zero:jni_zero_java",
+    "//ui/android:ui_no_recycler_view_java",
   ]
   srcjar_deps = [ ":jni_headers" ]
 }

diff --git a/components/facilitated_payments/android/java/DEPS b/components/facilitated_payments/android/java/DEPS
index 69269bc..acaeac4 100644
--- a/components/facilitated_payments/android/java/DEPS
+++ b/components/facilitated_payments/android/java/DEPS

@@ -1,3 +1,4 @@
 include_rules = [
   "+content/public/android",
+  "+ui/android",
 ]

diff --git a/components/facilitated_payments/android/java/src/org/chromium/components/facilitated_payments/DeviceDelegate.java b/components/facilitated_payments/android/java/src/org/chromium/components/facilitated_payments/DeviceDelegate.java
index 9fcf114..aef5f17a 100644
--- a/components/facilitated_payments/android/java/src/org/chromium/components/facilitated_payments/DeviceDelegate.java
+++ b/components/facilitated_payments/android/java/src/org/chromium/components/facilitated_payments/DeviceDelegate.java

@@ -4,19 +4,29 @@
 
 package org.chromium.components.facilitated_payments;
 
+import android.content.ActivityNotFoundException;
+import android.content.Context;
+import android.content.Intent;
 import android.content.pm.PackageInfo;
+import android.net.Uri;
+
+import androidx.annotation.VisibleForTesting;
 
 import org.jni_zero.CalledByNative;
 import org.jni_zero.JNINamespace;
 
 import org.chromium.base.PackageUtils;
 import org.chromium.build.annotations.NullMarked;
+import org.chromium.ui.base.WindowAndroid;
 
 /** A JNI bridge to allow the native side to interact with the Android device. */
 @JNINamespace("payments::facilitated")
 @NullMarked
 public class DeviceDelegate {
     private static final String GOOGLE_WALLET_PACKAGE_NAME = "com.google.android.apps.walletnfcrel";
+    // Deeplink to the Pix account linking page on Google Wallet.
+    private static final String GOOGLE_WALLET_ADD_PIX_ACCOUNT_LINK =
+            "https://wallet.google.com/gw/app/addbankaccount";
     // Minimum Google Wallet version that supports Pix account linking.
     private static final long PIX_MIN_SUPPORTED_WALLET_VERSION = 931593518;
 
@@ -42,4 +52,24 @@
         return PackageUtils.packageVersionCode(walletPackageInfo)
                 >= PIX_MIN_SUPPORTED_WALLET_VERSION;
     }
+
+    @CalledByNative
+    @VisibleForTesting(otherwise = VisibleForTesting.PRIVATE)
+    static void openPixAccountLinkingPageInWallet(WindowAndroid windowAndroid) {
+        if (windowAndroid == null) {
+            return;
+        }
+        Context context = windowAndroid.getContext().get();
+        if (context == null) {
+            return;
+        }
+        Intent intent = new Intent(Intent.ACTION_VIEW);
+        intent.setData(Uri.parse(GOOGLE_WALLET_ADD_PIX_ACCOUNT_LINK));
+        intent.setPackage(GOOGLE_WALLET_PACKAGE_NAME);
+        try {
+            context.startActivity(intent);
+        } catch (ActivityNotFoundException e) {
+            // TODO(crbug.com/419108993): Log metrics.
+        }
+    }
 }

diff --git a/components/facilitated_payments/android/junit/BUILD.gn b/components/facilitated_payments/android/junit/BUILD.gn
index 1e77aff9..8b6e99cd 100644
--- a/components/facilitated_payments/android/junit/BUILD.gn
+++ b/components/facilitated_payments/android/junit/BUILD.gn

@@ -7,6 +7,7 @@
 
 robolectric_library("junit") {
   sources = [
+    "src/org/chromium/components/facilitated_payments/DeviceDelegateTest.java",
     "src/org/chromium/components/facilitated_payments/FacilitatedPaymentsApiClientBridgeUnitTest.java",
     "src/org/chromium/components/facilitated_payments/FacilitatedPaymentsApiClientUnitTest.java",
     "src/org/chromium/components/facilitated_payments/SecurePayloadTest.java",
@@ -22,5 +23,6 @@
     "//third_party/jni_zero:jni_zero_java",
     "//third_party/junit:junit",
     "//third_party/mockito:mockito_java",
+    "//ui/android:ui_no_recycler_view_java",
   ]
 }

diff --git a/components/facilitated_payments/android/junit/src/org/chromium/components/facilitated_payments/DeviceDelegateTest.java b/components/facilitated_payments/android/junit/src/org/chromium/components/facilitated_payments/DeviceDelegateTest.java
new file mode 100644
index 0000000..92079c28
--- /dev/null
+++ b/components/facilitated_payments/android/junit/src/org/chromium/components/facilitated_payments/DeviceDelegateTest.java

@@ -0,0 +1,100 @@
+// Copyright 2025 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+package org.chromium.components.facilitated_payments;
+
+import static org.junit.Assert.assertEquals;
+import static org.mockito.Mockito.any;
+import static org.mockito.Mockito.doThrow;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import android.content.ActivityNotFoundException;
+import android.content.Context;
+import android.content.Intent;
+import android.net.Uri;
+
+import androidx.test.filters.SmallTest;
+
+import org.junit.Before;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.ArgumentCaptor;
+import org.mockito.Mock;
+import org.mockito.junit.MockitoJUnit;
+import org.mockito.junit.MockitoRule;
+
+import org.chromium.base.test.BaseRobolectricTestRunner;
+import org.chromium.base.test.util.Batch;
+import org.chromium.ui.base.WindowAndroid;
+
+import java.lang.ref.WeakReference;
+
+/** Tests for {@link DeviceDelegate}. */
+@RunWith(BaseRobolectricTestRunner.class)
+@Batch(Batch.UNIT_TESTS)
+@SmallTest
+public class DeviceDelegateTest {
+    private static final String GOOGLE_WALLET_PACKAGE_NAME = "com.google.android.apps.walletnfcrel";
+    private static final String GOOGLE_WALLET_ADD_PIX_ACCOUNT_LINK =
+            "https://wallet.google.com/gw/app/addbankaccount";
+
+    @Rule public MockitoRule mRule = MockitoJUnit.rule();
+
+    @Mock private WindowAndroid mMockWindowAndroid;
+    @Mock private Context mMockContext;
+
+    @Before
+    public void setUp() {
+        when(mMockWindowAndroid.getContext()).thenReturn(new WeakReference<Context>(mMockContext));
+    }
+
+    @Test
+    public void testOpenPixAccountLinkingPageInWallet_Success() {
+        DeviceDelegate.openPixAccountLinkingPageInWallet(mMockWindowAndroid);
+
+        // Capture the Intent passed to startActivity
+        ArgumentCaptor<Intent> intentCaptor = ArgumentCaptor.forClass(Intent.class);
+        verify(mMockContext).startActivity(intentCaptor.capture());
+
+        // Assert the properties of the captured Intent
+        Intent capturedIntent = intentCaptor.getValue();
+        assertEquals(Intent.ACTION_VIEW, capturedIntent.getAction());
+        assertEquals(Uri.parse(GOOGLE_WALLET_ADD_PIX_ACCOUNT_LINK), capturedIntent.getData());
+        assertEquals(GOOGLE_WALLET_PACKAGE_NAME, capturedIntent.getPackage());
+    }
+
+    @Test
+    public void testOpenPixAccountLinkingPageInWallet_NullWindowAndroid() {
+        DeviceDelegate.openPixAccountLinkingPageInWallet(null);
+
+        // Verify that startActivity() was never called if WindowAndroid is null.
+        verify(mMockContext, never()).startActivity(any(Intent.class));
+    }
+
+    @Test
+    public void testOpenPixAccountLinkingPageInWallet_NullContext() {
+        when(mMockWindowAndroid.getContext()).thenReturn(new WeakReference<>(null));
+
+        DeviceDelegate.openPixAccountLinkingPageInWallet(mMockWindowAndroid);
+
+        verify(mMockContext, never()).startActivity(any(Intent.class));
+    }
+
+    @Test
+    public void testOpenPixAccountLinkingPageInWallet_ActivityNotFound() {
+        // Simulate ActivityNotFoundException
+        doThrow(new ActivityNotFoundException())
+                .when(mMockContext)
+                .startActivity(any(Intent.class));
+
+        // Call the method, expecting it to catch the exception
+        DeviceDelegate.openPixAccountLinkingPageInWallet(mMockWindowAndroid);
+
+        // Verify startActivity was called (even though it threw).
+        verify(mMockContext).startActivity(any(Intent.class));
+    }
+}

diff --git a/components/facilitated_payments/core/browser/pix_account_linking_manager.cc b/components/facilitated_payments/core/browser/pix_account_linking_manager.cc
index 0fddb2e0..96b07ff5 100644
--- a/components/facilitated_payments/core/browser/pix_account_linking_manager.cc
+++ b/components/facilitated_payments/core/browser/pix_account_linking_manager.cc

@@ -44,11 +44,13 @@
 
 void PixAccountLinkingManager::OnAccepted() {
   // TODO(crbug.com/419108993): Add metrics.
+  client_->DismissPrompt();
   client_->OnPixAccountLinkingPromptAccepted();
 }
 
 void PixAccountLinkingManager::OnDeclined() {
   // TODO(crbug.com/419108993): Add metrics.
+  client_->DismissPrompt();
   client_->GetPaymentsDataManager()
       ->SetFacilitatedPaymentsPixAccountLinkingUserPref(/* enabled= */ false);
 }

diff --git a/components/facilitated_payments/core/browser/pix_account_linking_manager_unittest.cc b/components/facilitated_payments/core/browser/pix_account_linking_manager_unittest.cc
index 06e04d6..1a4a74d8 100644
--- a/components/facilitated_payments/core/browser/pix_account_linking_manager_unittest.cc
+++ b/components/facilitated_payments/core/browser/pix_account_linking_manager_unittest.cc

@@ -85,6 +85,7 @@
 }
 
 TEST_F(PixAccountLinkingManagerTest, OnAccepted) {
+  EXPECT_CALL(client(), DismissPrompt);
   EXPECT_CALL(client(), OnPixAccountLinkingPromptAccepted);
 
   test_api().OnAccepted();
@@ -95,6 +96,8 @@
   ASSERT_TRUE(autofill::prefs::IsFacilitatedPaymentsPixAccountLinkingEnabled(
       pref_service_.get()));
 
+  EXPECT_CALL(client(), DismissPrompt);
+
   test_api().OnDeclined();
 
   // Verify that declining the prompt disables the account linking user pref.

diff --git a/components/policy/resources/templates/policy_definitions/Extensions/ExtensionInstallBlocklist.yaml b/components/policy/resources/templates/policy_definitions/Extensions/ExtensionInstallBlocklist.yaml
index 71ab98f1..58db0d8 100644
--- a/components/policy/resources/templates/policy_definitions/Extensions/ExtensionInstallBlocklist.yaml
+++ b/components/policy/resources/templates/policy_definitions/Extensions/ExtensionInstallBlocklist.yaml

@@ -2,7 +2,7 @@
 desc: |-
   Allows you to specify which extensions the users can NOT install. Extensions already installed will be disabled if blocked, without a way for the user to enable them. Once an extension disabled due to the blocklist is removed from it, it will automatically get re-enabled.
 
-            A blocklist value of '*' means all extensions are blocked unless they are explicitly listed in the allowlist.
+            A blocklist value of '*' means all extensions are blocked by default. Extensions that are explicitly listed in the allowlist are allowed if they are signed (packed). All unpacked extensions are blocked.
 
             If this policy is left not set the user can install any extension in <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph>.
 example_value:

diff --git a/components/strings/components_strings_iw.xtb b/components/strings/components_strings_iw.xtb
index 0153e2a..0b457cf3 100644
--- a/components/strings/components_strings_iw.xtb
+++ b/components/strings/components_strings_iw.xtb

@@ -868,6 +868,7 @@
           <ph name="END_LIST" /></translation>
 <translation id="2448295565072560657">ציוד היקפי שמחובר למכשיר הזה לאחר התחברות לחשבון שלך</translation>
 <translation id="2450019289047528273">‏אמצעי תשלום ומידע אחר מ-Google Wallet</translation>
+<translation id="2451201933352935301">האתר <ph name="URL" /> מבקש הרשאה לנהל את החלונות בכל המסכים</translation>
 <translation id="2451607499823206582">במעקב</translation>
 <translation id="2452098632681057184">אקולוגיה וסביבה</translation>
 <translation id="2452837234288608067">לא ניתן היה לעזור בבקשה הזו. אפשר לנסות שוב.</translation>

diff --git a/content/app/android/content_child_process_service_delegate.cc b/content/app/android/content_child_process_service_delegate.cc
index 2d242683..0924a028 100644
--- a/content/app/android/content_child_process_service_delegate.cc
+++ b/content/app/android/content_child_process_service_delegate.cc

@@ -19,6 +19,7 @@
 #include "content/public/common/content_descriptors.h"
 #include "content/public/common/content_switches.h"
 #include "gpu/command_buffer/service/texture_owner.h"
+#include "gpu/ipc/common/android/scoped_surface_request_conduit.h"
 #include "gpu/ipc/common/gpu_surface_lookup.h"
 #include "ui/gl/android/scoped_java_surface.h"
 #include "ui/gl/android/scoped_java_surface_control.h"
@@ -36,7 +37,8 @@
 
 // TODO(sievers): Use two different implementations of this depending on if
 // we're in a renderer or gpu process.
-class ChildProcessSurfaceManager : public gpu::GpuSurfaceLookup,
+class ChildProcessSurfaceManager : public gpu::ScopedSurfaceRequestConduit,
+                                   public gpu::GpuSurfaceLookup,
                                    public input::InputTokenForwarder {
  public:
   ChildProcessSurfaceManager() {}
@@ -53,6 +55,18 @@
     service_impl_.Reset(service_impl);
   }
 
+  // Overriden from ScopedSurfaceRequestConduit:
+  void ForwardSurfaceOwnerForSurfaceRequest(
+      const base::UnguessableToken& request_token,
+      const gpu::TextureOwner* texture_owner) override {
+    JNIEnv* env = base::android::AttachCurrentThread();
+
+    content::
+        Java_ContentChildProcessServiceDelegate_forwardSurfaceForSurfaceRequest(
+            env, service_impl_, request_token,
+            texture_owner->CreateJavaSurface().j_surface());
+  }
+
   // Overridden from GpuSurfaceLookup:
   gpu::SurfaceRecord AcquireJavaSurface(int surface_id) override {
     JNIEnv* env = base::android::AttachCurrentThread();
@@ -117,6 +131,8 @@
 
   gpu::GpuSurfaceLookup::InitInstance(
       g_child_process_surface_manager.Pointer());
+  gpu::ScopedSurfaceRequestConduit::SetInstance(
+      g_child_process_surface_manager.Pointer());
   input::InputTokenForwarder::SetInstance(
       g_child_process_surface_manager.Pointer());
 }

diff --git a/content/browser/BUILD.gn b/content/browser/BUILD.gn
index d712f3f5..e503df62 100644
--- a/content/browser/BUILD.gn
+++ b/content/browser/BUILD.gn

@@ -3331,6 +3331,8 @@
       "android/page_proxy.h",
       "android/render_widget_host_connector.cc",
       "android/render_widget_host_connector.h",
+      "android/scoped_surface_request_manager.cc",
+      "android/scoped_surface_request_manager.h",
       "android/select_popup.cc",
       "android/select_popup.h",
       "android/selection/composited_touch_handle_drawable.cc",

diff --git a/content/browser/android/gpu_process_callback.cc b/content/browser/android/gpu_process_callback.cc
index 9831312a..071ff49 100644
--- a/content/browser/android/gpu_process_callback.cc
+++ b/content/browser/android/gpu_process_callback.cc

@@ -8,6 +8,7 @@
 #include "base/android/scoped_java_ref.h"
 #include "base/android/unguessable_token_android.h"
 #include "base/logging.h"
+#include "content/browser/android/scoped_surface_request_manager.h"
 #include "content/common/android/surface_wrapper.h"
 #include "content/public/browser/browser_thread.h"
 #include "gpu/ipc/common/gpu_surface_tracker.h"
@@ -18,6 +19,18 @@
 
 namespace content {
 
+void JNI_GpuProcessCallback_CompleteScopedSurfaceRequest(
+    JNIEnv* env,
+    base::UnguessableToken& request_token,
+    const base::android::JavaParamRef<jobject>& surface) {
+  DCHECK(!BrowserThread::CurrentlyOn(BrowserThread::UI));
+
+  base::android::ScopedJavaGlobalRef<jobject> jsurface;
+  jsurface.Reset(env, surface);
+  ScopedSurfaceRequestManager::GetInstance()->FulfillScopedSurfaceRequest(
+      request_token, gl::ScopedJavaSurface(jsurface, /*auto_release=*/true));
+}
+
 base::android::ScopedJavaLocalRef<jobject>
 JNI_GpuProcessCallback_GetViewSurface(
     JNIEnv* env,

diff --git a/content/browser/android/scoped_surface_request_manager.cc b/content/browser/android/scoped_surface_request_manager.cc
new file mode 100644
index 0000000..3702fcc3
--- /dev/null
+++ b/content/browser/android/scoped_surface_request_manager.cc

@@ -0,0 +1,94 @@
+// Copyright 2016 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/android/scoped_surface_request_manager.h"
+
+#include "base/functional/bind.h"
+#include "content/public/browser/browser_task_traits.h"
+#include "content/public/browser/browser_thread.h"
+#include "gpu/command_buffer/service/texture_owner.h"
+
+namespace content {
+
+// static
+ScopedSurfaceRequestManager* ScopedSurfaceRequestManager::GetInstance() {
+  return base::Singleton<
+      ScopedSurfaceRequestManager,
+      base::LeakySingletonTraits<ScopedSurfaceRequestManager>>::get();
+}
+
+base::UnguessableToken
+ScopedSurfaceRequestManager::RegisterScopedSurfaceRequest(
+    ScopedSurfaceRequestCB request_cb) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+  DCHECK(!request_cb.is_null());
+
+  base::UnguessableToken request_token = base::UnguessableToken::Create();
+
+  DCHECK(!request_callbacks_.count(request_token));
+  request_callbacks_.insert(
+      std::make_pair(request_token, std::move(request_cb)));
+
+  return request_token;
+}
+
+void ScopedSurfaceRequestManager::UnregisterScopedSurfaceRequest(
+    const base::UnguessableToken& request_token) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+  GetAndUnregisterInternal(request_token);
+}
+
+ScopedSurfaceRequestManager::ScopedSurfaceRequestCB
+ScopedSurfaceRequestManager::GetAndUnregisterInternal(
+    const base::UnguessableToken& request_token) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+  DCHECK(!request_token.is_empty());
+
+  ScopedSurfaceRequestManager::ScopedSurfaceRequestCB request;
+
+  auto it = request_callbacks_.find(request_token);
+  if (it != request_callbacks_.end()) {
+    request = std::move(it->second);
+    request_callbacks_.erase(it);
+  }
+
+  return request;
+}
+
+void ScopedSurfaceRequestManager::ForwardSurfaceOwnerForSurfaceRequest(
+    const base::UnguessableToken& request_token,
+    const gpu::TextureOwner* texture_owner) {
+  FulfillScopedSurfaceRequest(request_token,
+                              texture_owner->CreateJavaSurface());
+}
+
+void ScopedSurfaceRequestManager::FulfillScopedSurfaceRequest(
+    const base::UnguessableToken& request_token,
+    gl::ScopedJavaSurface surface) {
+  // base::Unretained is safe because the lifetime of this object is tied to
+  // the lifetime of the browser process.
+  GetUIThreadTaskRunner({})->PostTask(
+      FROM_HERE,
+      base::BindOnce(&ScopedSurfaceRequestManager::CompleteRequestOnUiThread,
+                     base::Unretained(this), request_token,
+                     std::move(surface)));
+}
+
+void ScopedSurfaceRequestManager::CompleteRequestOnUiThread(
+    const base::UnguessableToken& request_token,
+    gl::ScopedJavaSurface surface) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+
+  ScopedSurfaceRequestManager::ScopedSurfaceRequestCB request =
+      GetAndUnregisterInternal(request_token);
+
+  if (!request.is_null())
+    std::move(request).Run(std::move(surface));
+}
+
+ScopedSurfaceRequestManager::ScopedSurfaceRequestManager() {}
+
+ScopedSurfaceRequestManager::~ScopedSurfaceRequestManager() {}
+
+}  // namespace content

diff --git a/content/browser/android/scoped_surface_request_manager.h b/content/browser/android/scoped_surface_request_manager.h
new file mode 100644
index 0000000..42f9839
--- /dev/null
+++ b/content/browser/android/scoped_surface_request_manager.h

@@ -0,0 +1,87 @@
+// Copyright 2016 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_ANDROID_SCOPED_SURFACE_REQUEST_MANAGER_H_
+#define CONTENT_BROWSER_ANDROID_SCOPED_SURFACE_REQUEST_MANAGER_H_
+
+#include <unordered_map>
+
+#include "base/functional/callback.h"
+#include "base/memory/singleton.h"
+#include "base/unguessable_token.h"
+#include "content/common/content_export.h"
+#include "gpu/ipc/common/android/scoped_surface_request_conduit.h"
+#include "ui/gl/android/scoped_java_surface.h"
+
+namespace content {
+
+class CONTENT_EXPORT ScopedSurfaceRequestManager
+    : public gpu::ScopedSurfaceRequestConduit {
+ public:
+  static ScopedSurfaceRequestManager* GetInstance();
+
+  ScopedSurfaceRequestManager(const ScopedSurfaceRequestManager&) = delete;
+  ScopedSurfaceRequestManager& operator=(const ScopedSurfaceRequestManager&) =
+      delete;
+
+  using ScopedSurfaceRequestCB =
+      base::OnceCallback<void(gl::ScopedJavaSurface)>;
+
+  // Registers a request, and returns the |request_token| that should be used to
+  // call Fulfill at a later time. The caller is responsible for unregistering
+  // the request, if it is destroyed before the request is fulfilled.
+  // It is the requester's responsibility to check the validity of the final
+  // ScopedJavaSurface (as passing an empty surface is a valid operation).
+  // Must be called on the UI thread.
+  base::UnguessableToken RegisterScopedSurfaceRequest(
+      ScopedSurfaceRequestCB request_cb);
+
+  // Unregisters a request registered under |request_token| if it exists,
+  // no-ops otherwise.
+  // Must be called on the UI thread.
+  void UnregisterScopedSurfaceRequest(
+      const base::UnguessableToken& request_token);
+
+  // Unregisters and runs the request callback identified by |request_token| if
+  // one exists, no-ops otherwise.
+  // Passing an empty |surface| is a valid operation that will complete the
+  // request.
+  // Can be called from any thread. The request will be posted to the UI thread.
+  void FulfillScopedSurfaceRequest(const base::UnguessableToken& request_token,
+                                   gl::ScopedJavaSurface surface);
+
+  // Implementation of ScopedSurfaceRequestConduit.
+  // To be used in the single process case.
+  // Can be called from any thread.
+  void ForwardSurfaceOwnerForSurfaceRequest(
+      const base::UnguessableToken& request_token,
+      const gpu::TextureOwner* texture_owner) override;
+
+  void clear_requests_for_testing() { request_callbacks_.clear(); }
+
+  int request_count_for_testing() { return request_callbacks_.size(); }
+
+ private:
+  friend struct base::DefaultSingletonTraits<ScopedSurfaceRequestManager>;
+
+  // Unregisters and returns the request identified by |request_token|.
+  ScopedSurfaceRequestCB GetAndUnregisterInternal(
+      const base::UnguessableToken& request_token);
+
+  void CompleteRequestOnUiThread(const base::UnguessableToken& request_token,
+                                 gl::ScopedJavaSurface surface);
+
+  // Map used to hold references to the registered callbacks.
+  std::unordered_map<base::UnguessableToken,
+                     ScopedSurfaceRequestCB,
+                     base::UnguessableTokenHash>
+      request_callbacks_;
+
+  ScopedSurfaceRequestManager();
+  ~ScopedSurfaceRequestManager() override;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_ANDROID_SCOPED_SURFACE_REQUEST_MANAGER_H_

diff --git a/content/browser/android/scoped_surface_request_manager_unittest.cc b/content/browser/android/scoped_surface_request_manager_unittest.cc
new file mode 100644
index 0000000..55e2cae
--- /dev/null
+++ b/content/browser/android/scoped_surface_request_manager_unittest.cc

@@ -0,0 +1,193 @@
+// Copyright 2016 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/android/scoped_surface_request_manager.h"
+
+#include "base/functional/bind.h"
+#include "base/memory/raw_ptr.h"
+#include "base/run_loop.h"
+#include "content/public/test/browser_task_environment.h"
+#include "gpu/command_buffer/service/mock_texture_owner.h"
+#include "testing/gtest/include/gtest/gtest.h"
+#include "ui/gl/android/scoped_java_surface.h"
+#include "ui/gl/android/surface_texture.h"
+
+namespace content {
+
+class ScopedSurfaceRequestManagerUnitTest : public testing::Test {
+ public:
+  ScopedSurfaceRequestManagerUnitTest() {
+    manager_ = ScopedSurfaceRequestManager::GetInstance();
+
+    // The need to reset the callbacks because the
+    // ScopedSurfaceRequestManager's lifetime outlive the tests.
+    manager_->clear_requests_for_testing();
+
+    last_received_request_ = 0;
+    dummy_token_ = base::UnguessableToken::CreateForTesting(123, 456);
+
+    mock_texture_owner = base::MakeRefCounted<NiceMock<gpu::MockTextureOwner>>(
+        0, nullptr, nullptr);
+  }
+
+  ScopedSurfaceRequestManagerUnitTest(
+      const ScopedSurfaceRequestManagerUnitTest&) = delete;
+  ScopedSurfaceRequestManagerUnitTest& operator=(
+      const ScopedSurfaceRequestManagerUnitTest&) = delete;
+
+  ScopedSurfaceRequestManager::ScopedSurfaceRequestCB CreateNoopCallback() {
+    return base::BindOnce(&ScopedSurfaceRequestManagerUnitTest::DummyCallback,
+                          base::Unretained(this));
+  }
+
+  ScopedSurfaceRequestManager::ScopedSurfaceRequestCB CreateLoggingCallback() {
+    return base::BindOnce(&ScopedSurfaceRequestManagerUnitTest::LoggingCallback,
+                          base::Unretained(this), kSpecificCallbackId);
+  }
+
+  // No-op callback.
+  void DummyCallback(gl::ScopedJavaSurface surface) {}
+
+  // Callback that updates |last_received_request_| to allow differentiation
+  // between callback instances in tests.
+  void LoggingCallback(int request_id, gl::ScopedJavaSurface surface) {
+    last_received_request_ = request_id;
+  }
+
+  scoped_refptr<NiceMock<gpu::MockTextureOwner>> mock_texture_owner;
+
+  int last_received_request_;
+  const int kSpecificCallbackId = 1357;
+  base::UnguessableToken dummy_token_;
+
+  raw_ptr<ScopedSurfaceRequestManager> manager_;
+
+  content::BrowserTaskEnvironment task_environment_;
+};
+
+// Makes sure we can successfully register a callback.
+TEST_F(ScopedSurfaceRequestManagerUnitTest, RegisterRequest_ShouldSucceed) {
+  EXPECT_EQ(0, manager_->request_count_for_testing());
+
+  base::UnguessableToken token =
+      manager_->RegisterScopedSurfaceRequest(CreateNoopCallback());
+
+  EXPECT_EQ(1, manager_->request_count_for_testing());
+  EXPECT_FALSE(token.is_empty());
+}
+
+// Makes sure we can successfully register multiple callbacks, and that they
+// return distinct request tokens.
+TEST_F(ScopedSurfaceRequestManagerUnitTest,
+       RegisterMultipleRequests_ShouldSucceed) {
+  base::UnguessableToken token1 =
+      manager_->RegisterScopedSurfaceRequest(CreateNoopCallback());
+  base::UnguessableToken token2 =
+      manager_->RegisterScopedSurfaceRequest(CreateNoopCallback());
+
+  EXPECT_EQ(2, manager_->request_count_for_testing());
+  EXPECT_NE(token1, token2);
+}
+
+// Makes sure GetInstance() is idempotent/that the class is a proper singleton.
+TEST_F(ScopedSurfaceRequestManagerUnitTest, VerifySingleton_ShouldSucceed) {
+  EXPECT_EQ(manager_, ScopedSurfaceRequestManager::GetInstance());
+}
+
+// Makes sure we can unregister a callback after registering it.
+TEST_F(ScopedSurfaceRequestManagerUnitTest,
+       GetRegisteredRequest_ShouldSucceed) {
+  base::UnguessableToken token =
+      manager_->RegisterScopedSurfaceRequest(CreateNoopCallback());
+  EXPECT_EQ(1, manager_->request_count_for_testing());
+
+  manager_->UnregisterScopedSurfaceRequest(token);
+
+  EXPECT_EQ(0, manager_->request_count_for_testing());
+}
+
+// Makes sure that unregistering a callback only affects the specified callback.
+TEST_F(ScopedSurfaceRequestManagerUnitTest,
+       GetRegisteredRequestFromMultipleRequests_ShouldSucceed) {
+  base::UnguessableToken token =
+      manager_->RegisterScopedSurfaceRequest(CreateNoopCallback());
+  manager_->RegisterScopedSurfaceRequest(CreateNoopCallback());
+  EXPECT_EQ(2, manager_->request_count_for_testing());
+
+  manager_->UnregisterScopedSurfaceRequest(token);
+
+  EXPECT_EQ(1, manager_->request_count_for_testing());
+}
+
+// Makes sure that unregistration is a noop permitted when there are no
+// registered requests.
+TEST_F(ScopedSurfaceRequestManagerUnitTest,
+       UnregisteredRequest_ShouldReturnNullCallback) {
+  manager_->UnregisterScopedSurfaceRequest(dummy_token_);
+
+  EXPECT_EQ(0, manager_->request_count_for_testing());
+}
+
+// Makes sure that unregistering an invalid |request_token| doesn't affect
+// other registered callbacks.
+TEST_F(ScopedSurfaceRequestManagerUnitTest,
+       GetUnregisteredRequestFromMultipleRequests_ShouldReturnNullCallback) {
+  manager_->RegisterScopedSurfaceRequest(CreateNoopCallback());
+
+  manager_->UnregisterScopedSurfaceRequest(dummy_token_);
+
+  EXPECT_EQ(1, manager_->request_count_for_testing());
+}
+
+// Makes sure that trying to fulfill a request for an invalid |request_token|
+// does nothing, and does not affect other callbacks.
+TEST_F(ScopedSurfaceRequestManagerUnitTest,
+       FulfillUnregisteredRequest_ShouldDoNothing) {
+  manager_->RegisterScopedSurfaceRequest(CreateLoggingCallback());
+
+  manager_->FulfillScopedSurfaceRequest(
+      dummy_token_, mock_texture_owner->CreateJavaSurface());
+
+  EXPECT_EQ(1, manager_->request_count_for_testing());
+  EXPECT_NE(kSpecificCallbackId, last_received_request_);
+}
+
+// Makes sure that trying to fulfill a request fulfills the right request, and
+// does not affect other registered requests.
+TEST_F(ScopedSurfaceRequestManagerUnitTest,
+       FulfillRegisteredRequest_ShouldSucceed) {
+  base::UnguessableToken specific_token =
+      manager_->RegisterScopedSurfaceRequest(CreateLoggingCallback());
+
+  const uint64_t kOtherCallbackId = 5678;
+  manager_->RegisterScopedSurfaceRequest(
+      base::BindOnce(&ScopedSurfaceRequestManagerUnitTest::LoggingCallback,
+                     base::Unretained(this), kOtherCallbackId));
+
+  manager_->FulfillScopedSurfaceRequest(
+      specific_token, mock_texture_owner->CreateJavaSurface());
+
+  base::RunLoop().RunUntilIdle();
+
+  EXPECT_EQ(1, manager_->request_count_for_testing());
+  EXPECT_EQ(kSpecificCallbackId, last_received_request_);
+}
+
+// Makes sure that the ScopedSurfaceRequestConduit implementation properly
+// fulfills requests.
+TEST_F(ScopedSurfaceRequestManagerUnitTest,
+       ForwardSurfaceOwner_ShouldFulfillRequest) {
+  base::UnguessableToken token =
+      manager_->RegisterScopedSurfaceRequest(CreateLoggingCallback());
+
+  manager_->ForwardSurfaceOwnerForSurfaceRequest(token,
+                                                 mock_texture_owner.get());
+
+  base::RunLoop().RunUntilIdle();
+
+  EXPECT_EQ(0, manager_->request_count_for_testing());
+  EXPECT_EQ(kSpecificCallbackId, last_received_request_);
+}
+
+}  // Content

diff --git a/content/browser/browser_main_loop.cc b/content/browser/browser_main_loop.cc
index 3223aba..6f88f00 100644
--- a/content/browser/browser_main_loop.cc
+++ b/content/browser/browser_main_loop.cc

@@ -177,6 +177,7 @@
 #include "content/browser/android/browser_startup_controller.h"
 #include "content/browser/android/input_token_forwarder_manager.h"
 #include "content/browser/android/launcher_thread.h"
+#include "content/browser/android/scoped_surface_request_manager.h"
 #include "content/browser/android/tracing_controller_android.h"
 #include "content/browser/font_unique_name_lookup/font_unique_name_lookup_android.h"
 #include "content/browser/screen_orientation/screen_orientation_delegate_android.h"
@@ -726,6 +727,17 @@
     parts_->PostCreateMainMessageLoop();
 
 #if BUILDFLAG(IS_ANDROID)
+  {
+    TRACE_EVENT0("startup",
+                 "BrowserMainLoop::Subsystem:ScopedSurfaceRequestManager");
+    if (UsingInProcessGpu()) {
+      gpu::ScopedSurfaceRequestConduit::SetInstance(
+          ScopedSurfaceRequestManager::GetInstance());
+      input::InputTokenForwarder::SetInstance(
+          InputTokenForwarderManager::GetInstance());
+    }
+  }
+
   if (!parsed_command_line_->HasSwitch(
           switches::kDisableScreenOrientationLock)) {
     TRACE_EVENT0("startup",

diff --git a/content/public/android/java/src/org/chromium/content/app/ContentChildProcessServiceDelegate.java b/content/public/android/java/src/org/chromium/content/app/ContentChildProcessServiceDelegate.java
index fb2fab4..70f994a8 100644
--- a/content/public/android/java/src/org/chromium/content/app/ContentChildProcessServiceDelegate.java
+++ b/content/public/android/java/src/org/chromium/content/app/ContentChildProcessServiceDelegate.java

@@ -13,16 +13,19 @@
 import android.os.IBinder;
 import android.os.RemoteException;
 import android.util.SparseArray;
+import android.view.Surface;
 import android.window.InputTransferToken;
 
 import androidx.annotation.RequiresApi;
 
 import org.jni_zero.CalledByNative;
 import org.jni_zero.JNINamespace;
+import org.jni_zero.JniType;
 import org.jni_zero.NativeMethods;
 
 import org.chromium.base.Log;
 import org.chromium.base.ThreadUtils;
+import org.chromium.base.UnguessableToken;
 import org.chromium.base.library_loader.IRelroLibInfo;
 import org.chromium.base.library_loader.LibraryLoader;
 import org.chromium.base.memory.MemoryPressureUma;
@@ -167,6 +170,25 @@
 
     @SuppressWarnings("unused")
     @CalledByNative
+    private void forwardSurfaceForSurfaceRequest(
+            @JniType("base::UnguessableToken") UnguessableToken requestToken, Surface surface) {
+        if (mGpuCallback == null) {
+            Log.e(TAG, "No callback interface has been provided.");
+            return;
+        }
+
+        try {
+            mGpuCallback.forwardSurfaceForSurfaceRequest(requestToken, surface);
+        } catch (RemoteException e) {
+            Log.e(TAG, "Unable to call forwardSurfaceForSurfaceRequest: %s", e);
+            return;
+        } finally {
+            surface.release();
+        }
+    }
+
+    @SuppressWarnings("unused")
+    @CalledByNative
     private @Nullable SurfaceWrapper getViewSurface(int surfaceId) {
         if (mGpuCallback == null) {
             Log.e(TAG, "No callback interface has been provided.");

diff --git a/content/public/android/java/src/org/chromium/content/browser/GpuProcessCallback.java b/content/public/android/java/src/org/chromium/content/browser/GpuProcessCallback.java
index 17a4b94..387a87f 100644
--- a/content/public/android/java/src/org/chromium/content/browser/GpuProcessCallback.java
+++ b/content/public/android/java/src/org/chromium/content/browser/GpuProcessCallback.java

@@ -4,9 +4,13 @@
 
 package org.chromium.content.browser;
 
+import android.view.Surface;
+
 import org.jni_zero.JNINamespace;
+import org.jni_zero.JniType;
 import org.jni_zero.NativeMethods;
 
+import org.chromium.base.UnguessableToken;
 import org.chromium.build.annotations.NullMarked;
 import org.chromium.content.browser.input.InputTokenForwarderManager;
 import org.chromium.content.common.IGpuProcessCallback;
@@ -19,6 +23,11 @@
     GpuProcessCallback() {}
 
     @Override
+    public void forwardSurfaceForSurfaceRequest(UnguessableToken requestToken, Surface surface) {
+        GpuProcessCallbackJni.get().completeScopedSurfaceRequest(requestToken, surface);
+    }
+
+    @Override
     public SurfaceWrapper getViewSurface(int surfaceId) {
         return GpuProcessCallbackJni.get().getViewSurface(surfaceId);
     }
@@ -30,6 +39,9 @@
 
     @NativeMethods
     interface Natives {
+        void completeScopedSurfaceRequest(
+                @JniType("base::UnguessableToken") UnguessableToken requestToken, Surface surface);
+
         SurfaceWrapper getViewSurface(int surfaceId);
     }
 }

diff --git a/content/public/android/java/src/org/chromium/content/common/IGpuProcessCallback.aidl b/content/public/android/java/src/org/chromium/content/common/IGpuProcessCallback.aidl
index 8dc34d8..7c25c7e 100644
--- a/content/public/android/java/src/org/chromium/content/common/IGpuProcessCallback.aidl
+++ b/content/public/android/java/src/org/chromium/content/common/IGpuProcessCallback.aidl

@@ -11,6 +11,10 @@
 import org.chromium.content.common.SurfaceWrapper;
 
 interface IGpuProcessCallback {
+
+  oneway void forwardSurfaceForSurfaceRequest(
+      in UnguessableToken requestToken, in Surface surface);
+
   SurfaceWrapper getViewSurface(int surfaceId);
 
   // Send the input transfer token from Viz to Browser so that the Browser can use it later

diff --git a/content/test/BUILD.gn b/content/test/BUILD.gn
index 20b84ac..33c4ce8d 100644
--- a/content/test/BUILD.gn
+++ b/content/test/BUILD.gn

@@ -3488,6 +3488,7 @@
       "../browser/android/java/java_type_unittest.cc",
       "../browser/android/message_payload_unittest.cc",
       "../browser/android/overscroll_controller_android_unittest.cc",
+      "../browser/android/scoped_surface_request_manager_unittest.cc",
       "../browser/font_unique_name_lookup/font_unique_name_lookup_android_unittest.cc",
       "../browser/media/key_system_support_android_unittest.cc",
       "../browser/renderer_host/render_widget_host_view_android_unittest.cc",

diff --git a/gpu/ipc/common/BUILD.gn b/gpu/ipc/common/BUILD.gn
index e5cda8e..2a2ebf1 100644
--- a/gpu/ipc/common/BUILD.gn
+++ b/gpu/ipc/common/BUILD.gn

@@ -177,6 +177,8 @@
     sources += [
       "android/android_hardware_buffer_utils.cc",
       "android/android_hardware_buffer_utils.h",
+      "android/scoped_surface_request_conduit.cc",
+      "android/scoped_surface_request_conduit.h",
       "gpu_surface_lookup.cc",
       "gpu_surface_lookup.h",
       "gpu_surface_tracker.cc",

diff --git a/gpu/ipc/common/android/scoped_surface_request_conduit.cc b/gpu/ipc/common/android/scoped_surface_request_conduit.cc
new file mode 100644
index 0000000..465db93
--- /dev/null
+++ b/gpu/ipc/common/android/scoped_surface_request_conduit.cc

@@ -0,0 +1,29 @@
+// Copyright 2016 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "gpu/ipc/common/android/scoped_surface_request_conduit.h"
+
+#include "base/check.h"
+
+namespace gpu {
+namespace {
+
+ScopedSurfaceRequestConduit* g_instance = nullptr;
+
+}  // namespace
+
+// static
+ScopedSurfaceRequestConduit* ScopedSurfaceRequestConduit::GetInstance() {
+  DCHECK(g_instance);
+  return g_instance;
+}
+
+// static
+void ScopedSurfaceRequestConduit::SetInstance(
+    ScopedSurfaceRequestConduit* instance) {
+  DCHECK(!g_instance || !instance);
+  g_instance = instance;
+}
+
+}  // namespace gpu

diff --git a/gpu/ipc/common/android/scoped_surface_request_conduit.h b/gpu/ipc/common/android/scoped_surface_request_conduit.h
new file mode 100644
index 0000000..ec281a38f
--- /dev/null
+++ b/gpu/ipc/common/android/scoped_surface_request_conduit.h

@@ -0,0 +1,36 @@
+// Copyright 2016 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef GPU_IPC_COMMON_ANDROID_SCOPED_SURFACE_REQUEST_CONDUIT_H_
+#define GPU_IPC_COMMON_ANDROID_SCOPED_SURFACE_REQUEST_CONDUIT_H_
+
+#include "gpu/gpu_export.h"
+
+namespace base {
+class UnguessableToken;
+}
+
+namespace gpu {
+class TextureOwner;
+
+// Allows the forwarding of TextureOwners from the GPU or the browser process
+// to fulfill requests registered by the ScopedSurfaceRequestManager.
+class GPU_EXPORT ScopedSurfaceRequestConduit {
+ public:
+  static ScopedSurfaceRequestConduit* GetInstance();
+  static void SetInstance(ScopedSurfaceRequestConduit* instance);
+
+  // Sends the surface owner to the ScopedSurfaceRequestManager in the browser
+  // process, to fulfill the request registered under the |request_token| key.
+  virtual void ForwardSurfaceOwnerForSurfaceRequest(
+      const base::UnguessableToken& request_token,
+      const TextureOwner* texture_owner) = 0;
+
+ protected:
+  virtual ~ScopedSurfaceRequestConduit() {}
+};
+
+}  // namespace gpu
+
+#endif  // GPU_IPC_COMMON_ANDROID_SCOPED_SURFACE_REQUEST_CONDUIT_H_

diff --git a/ios/chrome/app/strings/resources/ios_strings_iw.xtb b/ios/chrome/app/strings/resources/ios_strings_iw.xtb
index 85b22ae..dd873df 100644
--- a/ios/chrome/app/strings/resources/ios_strings_iw.xtb
+++ b/ios/chrome/app/strings/resources/ios_strings_iw.xtb

@@ -18,6 +18,7 @@
 <translation id="1054745118061919935">לחיצה על המשך מבטאת הסכמה ל<ph name="BEGIN_LINK" />תנאים ולהגבלות<ph name="END_LINK" />.</translation>
 <translation id="10614374240317010">פריטים שאף פעם לא יישמרו</translation>
 <translation id="1062138828266376352">קוד האימות לא השתנה. מומלץ לבדוק את החיבור לאינטרנט ולנסות שוב</translation>
+<translation id="1063070031224282617">צריך לבחור מיקום לשמירת הקובץ "<ph name="BEGIN_BOLD" /><ph name="FILENAME" /><ph name="END_BOLD" />" (<ph name="FILE_SIZE" />)</translation>
 <translation id="1072476005125066234">ביקורות על סמך תחומי העניין שלך</translation>
 <translation id="1074827084851510304">‏בחרת למחוק {password_count} סיסמאות ואת רשימת האתרים והאפליקציות שבחרת לא לשמור בהם אף פעם פרטי כניסה. חשבונות שיצרת לאתרים ולאפליקציות לא יימחקו.</translation>
 <translation id="1076421457278169141">הקוד נסרק</translation>
@@ -592,6 +593,7 @@
 <translation id="3476450923187944815">יש לך גישה לסיסמאות שלך באפליקציות אחרות.</translation>
 <translation id="3488501490964659223">הכרטיסיות נסגרו ונתוני הגלישה נמחקו. המערכת הוציאה אותך מהחשבון</translation>
 <translation id="3493531032208478708"><ph name="BEGIN_LINK" />מידע נוסף<ph name="END_LINK" /> על הצעות לתוכן</translation>
+<translation id="349446645805573740">צריך לבחור מיקום לשמירת הקובץ "<ph name="BEGIN_BOLD" /><ph name="FILENAME" /><ph name="END_BOLD" />"</translation>
 <translation id="3504377992102007712">הגדרות</translation>
 <translation id="35083190962747987">‏פתיחה של ${url}</translation>
 <translation id="3511519535430890904">הוספת הגנה על הגלישה</translation>
@@ -691,6 +693,7 @@
 <translation id="3922395466317605522">התאמה אישית של התפריט</translation>
 <translation id="3929457972718048006">כתובות</translation>
 <translation id="3931215329146376310">{count,plural, =1{סיסמה חדשה לאתר הזה}one{סיסמאות חדשות לאתר הזה}two{סיסמאות חדשות לאתר הזה}other{סיסמאות חדשות לאתר הזה}}</translation>
+<translation id="3934905113567851655">כדי לשנות את הגודל, עושים תנועת צביטה</translation>
 <translation id="3940195383040445971">מעקב אחר המחירים בכרטיסיות</translation>
 <translation id="3941941395924123592">{COUNT,plural, =1{סגירת כרטיסייה אחת ({COUNT})}one{סגירת {COUNT} כרטיסיות}two{סגירת {COUNT} כרטיסיות}other{סגירת {COUNT} כרטיסיות}}</translation>
 <translation id="3948600256434252210">כדי לגלוש במצב פרטי, אפשר להחליק ימינה.</translation>
@@ -1698,6 +1701,7 @@
 <translation id="7925108652071887026">נתוני מילוי אוטומטי</translation>
 <translation id="7926975587469166629">כינוי הכרטיס</translation>
 <translation id="7927711904086083099">לא נבחר</translation>
+<translation id="7927902634113905831">צריך לבחור את החשבון שבו רוצים להשתמש כדי לשמור את הקובץ "<ph name="BEGIN_BOLD" /><ph name="FILENAME" /><ph name="END_BOLD" />" – <ph name="FILESIZE" /></translation>
 <translation id="7930998711684428189">הצגת אזהרה אם סיסמאות נחשפות עקב פרצה באבטחת מידע.</translation>
 <translation id="7933880123415105005">חיפוש ב-<ph name="SEARCH_PROVIDER" /></translation>
 <translation id="7938254975914653459">FaceTime</translation>

diff --git a/ios_internal b/ios_internal
index 76ec58a..59a93a5 160000
--- a/ios_internal
+++ b/ios_internal

@@ -1 +1 @@
-Subproject commit 76ec58ad727d6e9acfcc265d631282ab84a73300
+Subproject commit 59a93a5717e2d1a9e523d986e012bde44aa5faa2

diff --git a/net/http/transport_security_state_static.pins b/net/http/transport_security_state_static.pins
index e8de9fea..574ec797 100644
--- a/net/http/transport_security_state_static.pins
+++ b/net/http/transport_security_state_static.pins

@@ -43,9 +43,9 @@
 #   hash function for preloaded entries again (we have already done so once).
 #
 
-# Last updated: 2025-06-14 12:54 UTC
+# Last updated: 2025-06-15 13:01 UTC
 PinsListTimestamp
-1749905647
+1749992496
 
 TestSPKI
 sha256/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

diff --git a/net/http/transport_security_state_static_pins.json b/net/http/transport_security_state_static_pins.json
index d6597897..beb573d 100644
--- a/net/http/transport_security_state_static_pins.json
+++ b/net/http/transport_security_state_static_pins.json

@@ -31,7 +31,7 @@
 // the 'static_spki_hashes' and 'bad_static_spki_hashes' fields in 'pinsets'
 // refer to, and the timestamp at which the pins list was last updated.
 //
-// Last updated: 2025-06-14 12:54 UTC
+// Last updated: 2025-06-15 13:01 UTC
 //
 {
   "pinsets": [

diff --git a/third_party/blink/web_tests/external/WPT_BASE_MANIFEST_8.json b/third_party/blink/web_tests/external/WPT_BASE_MANIFEST_8.json
index e987c8b0..b255154 100644
--- a/third_party/blink/web_tests/external/WPT_BASE_MANIFEST_8.json
+++ b/third_party/blink/web_tests/external/WPT_BASE_MANIFEST_8.json

@@ -323743,9 +323743,13 @@
      "d55b5faaf11be9aa92df01f814d5ce165b23025f",
      []
     ],
+    "clear-cache-bfcache-partitioning.tentative.https-expected.txt": [
+     "10d9481d34c1939ddfe06d7174bd6fc34fb7bcbd",
+     []
+    ],
     "support": {
      "clear-cache-helper.sub.js": [
-      "5db0caf834cbf6a598f02761beda267dc8f1bcf8",
+      "1e9f2c2c33a7c1394c9c813579bd41d4d6a51f38",
       []
      ],
      "clear-site-data-cache.py": [
@@ -479411,8 +479415,18 @@
     ]
    },
    "clear-site-data": {
-    "clear-cache-bfcache.sub.https.html": [
-     "61d810f453b827946cb6ef943b4509b24e5f3246",
+    "clear-cache-bfcache-partitioning.tentative.https.html": [
+     "02a2f020cbca1a14088f60db27de61b61aae2cf8",
+     [
+      null,
+      {
+       "testdriver": true,
+       "timeout": "long"
+      }
+     ]
+    ],
+    "clear-cache-bfcache.https.html": [
+     "b9967c541f1d89f6343ea47df38b3cbdb722ecc1",
      [
       null,
       {
@@ -544533,7 +544547,7 @@
      ],
      "scrolling": {
       "iframe-chains.html": [
-       "fb7d674aae13eee0569987c2c8d635bded7c7018",
+       "c117210537f7c0afa57afc7e3cd620d06442adb0",
        [
         null,
         {

diff --git a/third_party/blink/web_tests/external/wpt/clear-site-data/clear-cache-bfcache-partitioning.tentative.https-expected.txt b/third_party/blink/web_tests/external/wpt/clear-site-data/clear-cache-bfcache-partitioning.tentative.https-expected.txt
new file mode 100644
index 0000000..10d9481
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/clear-site-data/clear-cache-bfcache-partitioning.tentative.https-expected.txt

@@ -0,0 +1,5 @@
+This is a testharness.js-based test.
+[FAIL] BfCached document should be dropped when containing same-site iframe and that same-site received clear-cache header
+  assert_implements: Should not be BFCached but actually was undefined
+Harness: the test ran to completion.
+

diff --git a/third_party/blink/web_tests/external/wpt/clear-site-data/clear-cache-bfcache-partitioning.tentative.https.html b/third_party/blink/web_tests/external/wpt/clear-site-data/clear-cache-bfcache-partitioning.tentative.https.html
new file mode 100644
index 0000000..02a2f02
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/clear-site-data/clear-cache-bfcache-partitioning.tentative.https.html

@@ -0,0 +1,61 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<meta name="timeout" content="long">
+<title>Clear-Site-Data: cache for bfcache</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/resources/testdriver.js"></script>
+<script src="/resources/testdriver-vendor.js"></script>
+<script src="support/clear-cache-helper.sub.js"></script>
+<script src="/common/dispatcher/dispatcher.js"></script>
+<script src="/common/utils.js"></script>
+<script src="/html/browsers/browsing-the-web/back-forward-cache/resources/helper.sub.js"></script>
+<script type="module">
+
+// cross-site: example.com (iframe: example.net) -> example.net (iframe example.net clear) -> in bfcache
+runBfCacheClearTest(
+  {
+    getUrlParams: {
+      clear: "cache",
+      secondOrigin: true,
+    },
+    targetOrigin: crossSiteOrigin,
+    mode: "iframe",
+    shouldBeCached: true,
+    funcBeforeNavigation: async (url) => {
+      await new Promise(resolve => {
+        const iframe = document.createElement("iframe");
+        iframe.src = url;
+        document.body.appendChild(iframe);
+        iframe.onload = resolve;
+      });
+    },
+    argsBeforeNavigation: [crossSiteOrigin],
+  },
+  "BfCached document not be dropped when containing cross-site iframe and that cross-site received clear-cache header"
+);
+
+// same-site: www.example.com (iframe: www2.example.com) -> www2.example.com (iframe www2.example.com clear) -> bfcache entry gets cleared
+runBfCacheClearTest(
+  {
+    getUrlParams: {
+      clear: "cache",
+      subdomain: true,
+    },
+    targetOrigin: subdomainOrigin,
+    mode: "iframe",
+    shouldBeCached: false,
+    funcBeforeNavigation: async (url) => {
+      await new Promise(resolve => {
+        const iframe = document.createElement("iframe");
+        iframe.src = url;
+        document.body.appendChild(iframe);
+        iframe.onload = resolve;
+      });
+    },
+    argsBeforeNavigation: [subdomainOrigin],
+  },
+  "BfCached document should be dropped when containing same-site iframe and that same-site received clear-cache header"
+);
+
+</script>

diff --git a/third_party/blink/web_tests/external/wpt/clear-site-data/clear-cache-bfcache.https.html b/third_party/blink/web_tests/external/wpt/clear-site-data/clear-cache-bfcache.https.html
new file mode 100644
index 0000000..b9967c5
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/clear-site-data/clear-cache-bfcache.https.html

@@ -0,0 +1,63 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<meta name="timeout" content="long">
+<title>Clear-Site-Data: cache for bfcache</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/resources/testdriver.js"></script>
+<script src="/resources/testdriver-vendor.js"></script>
+<script src="support/clear-cache-helper.sub.js"></script>
+<script src="/common/dispatcher/dispatcher.js"></script>
+<script src="/common/utils.js"></script>
+<script src="/html/browsers/browsing-the-web/back-forward-cache/resources/helper.sub.js"></script>
+<script type="module">
+
+runBfCacheClearTest(
+  {
+    getUrlParams: {
+      clear: "cache",
+    },
+    mode: "iframe",
+    shouldBeCached: false,
+  },
+  "BfCached document shouldn't be cached after receiving clear-cache header from the same origin."
+);
+
+runBfCacheClearTest(
+  {
+    targetOrigin: subdomainOrigin,
+    getUrlParams: {
+      subdomain: true,
+      clear: "cache",
+    },
+    mode: "iframe",
+    shouldBeCached: true,
+  },
+  "BfCached document should be cached after receiving clear-cache header from a subdomain."
+);
+
+runBfCacheClearTest(
+  {
+    targetOrigin: crossSiteOrigin,
+    getUrlParams: {
+      secondOrigin: true,
+      clear: "cache",
+    },
+    mode: "iframe",
+    shouldBeCached: true,
+  },
+  "BfCached document should be cached after receiving clear-cache header from another site."
+);
+
+runBfCacheClearTest(
+  {
+    getUrlParams: {
+      clear: "cache",
+    },
+    mode: "window",
+    shouldBeCached: false,
+  },
+  "BfCached document shouldn't be cached after receiving clear-cache header from another window."
+);
+
+</script>

diff --git a/third_party/blink/web_tests/external/wpt/clear-site-data/clear-cache-bfcache.sub.https.html b/third_party/blink/web_tests/external/wpt/clear-site-data/clear-cache-bfcache.sub.https.html
deleted file mode 100644
index 61d810f4..0000000
--- a/third_party/blink/web_tests/external/wpt/clear-site-data/clear-cache-bfcache.sub.https.html
+++ /dev/null

@@ -1,115 +0,0 @@
-<!DOCTYPE html>
-<meta charset=utf-8>
-<meta name="timeout" content="long">
-<title>Clear-Site-Data: cache for bfcache</title>
-<script src="/resources/testharness.js"></script>
-<script src="/resources/testharnessreport.js"></script>
-<script src="/resources/testdriver.js"></script>
-<script src="/resources/testdriver-vendor.js"></script>
-<script src="support/clear-cache-helper.sub.js"></script>
-<script src="/common/dispatcher/dispatcher.js"></script>
-<script src="/common/utils.js"></script>
-<script src="/html/browsers/browsing-the-web/back-forward-cache/resources/helper.sub.js"></script>
-<script type="module">
-
-const sameOrigin =
-  'https://{{host}}:{{ports[https][0]}}';
-const subdomainOrigin =
-  'https://{{hosts[][www2]}}:{{ports[https][0]}}';
-const crossSiteOrigin =
-  'https://{{hosts[alt][]}}:{{ports[https][0]}}';
-
-// The tests are built on top of the back-forward-cache test harness.
-// Here is the steps for the tests:
-// 1. Open a new window and navigate to a test URL.
-// 2. Navigate the window to a second page.
-// 3. Trigger the clear-site-data header either by window.open() or loading an
-//    iframe from the second page.
-// 4. Navigate back to the first page.
-// 5. Assert that the first page is or is not cached.
-
-function runBfCacheClearTest(params, description) {
-  runBfcacheTest(
-    {
-      targetOrigin: sameOrigin,
-      scripts: ["/clear-site-data/support/clear-cache-helper.sub.js"],
-      funcBeforeBackNavigation: async (getUrlParams, mode) => {
-
-        const cacheHelper = self.crypto.randomUUID();
-        const testUrl = getUrl(cacheHelper, getUrlParams);
-
-        let clearingPromise;
-        if (mode === "window") {
-          clearingPromise = new Promise(resolve => {
-            window.addEventListener("message", resolve, {once: true});
-            window.open(testUrl);
-          });
-        } else if (mode === "iframe") {
-          clearingPromise = new Promise(resolve => {
-            const iframe = document.createElement("iframe");
-            iframe.src = testUrl;
-            document.body.appendChild(iframe);
-            iframe.onload = resolve;
-          });
-        } else {
-          throw new Error("Unsupported mode");
-        }
-
-        await clearingPromise;
-      },
-      argsBeforeBackNavigation: [params.getUrlParams, params.mode],
-      ...params,
-    },
-    description
-  );
-}
-
-runBfCacheClearTest(
-  {
-    getUrlParams: {
-      clear: "cache",
-    },
-    mode: "iframe",
-    shouldBeCached: false,
-  },
-  "BfCached document shouldn't be cached after receiving clear-cache header from the same origin."
-);
-
-runBfCacheClearTest(
-  {
-    targetOrigin: subdomainOrigin,
-    getUrlParams: {
-      subdomain: true,
-      clear: "cache",
-    },
-    mode: "iframe",
-    shouldBeCached: true,
-  },
-  "BfCached document should be cached after receiving clear-cache header from a subdomain."
-);
-
-runBfCacheClearTest(
-  {
-    targetOrigin: crossSiteOrigin,
-    getUrlParams: {
-      secondOrigin: true,
-      clear: "cache",
-    },
-    mode: "iframe",
-    shouldBeCached: true,
-  },
-  "BfCached document should be cached after receiving clear-cache header from another site."
-);
-
-runBfCacheClearTest(
-  {
-    getUrlParams: {
-      clear: "cache",
-    },
-    mode: "window",
-    shouldBeCached: false,
-  },
-  "BfCached document shouldn't be cached after receiving clear-cache header from another window."
-);
-
-</script>

diff --git a/third_party/blink/web_tests/external/wpt/clear-site-data/support/clear-cache-helper.sub.js b/third_party/blink/web_tests/external/wpt/clear-site-data/support/clear-cache-helper.sub.js
index 5db0caf..1e9f2c2 100644
--- a/third_party/blink/web_tests/external/wpt/clear-site-data/support/clear-cache-helper.sub.js
+++ b/third_party/blink/web_tests/external/wpt/clear-site-data/support/clear-cache-helper.sub.js

@@ -3,6 +3,15 @@
 
 "use strict"
 
+const sameOrigin =
+  'https://{{host}}:{{ports[https][0]}}';
+const subdomainOrigin =
+  'https://{{hosts[][www2]}}:{{ports[https][0]}}';
+const crossSiteOrigin =
+  'https://{{hosts[alt][]}}:{{ports[https][0]}}';
+const subomdainCrossSiteOrigin =
+  'https://{{hosts[alt][www2]}}:{{ports[https][0]}}';
+
 /**
  * Constructs a url for an intermediate "bounce" hop which represents a tracker.
  * @param {string} cacheHelper - Unique uuid for this test
@@ -130,3 +139,49 @@
         openTestPageHelper(test, null, testUrls, 0, assert, resolve)
     });
 }
+
+// The tests are built on top of the back-forward-cache test harness.
+// Here is the steps for the tests:
+// 1. Open a new window and navigate to a test URL.
+// 2. Navigate the window to a second page.
+// 3. Trigger the clear-site-data header either by window.open() or loading an
+//    iframe from the second page.
+// 4. Navigate back to the first page.
+// 5. Assert that the first page is or is not cached.
+
+function runBfCacheClearTest(params, description) {
+  runBfcacheTest(
+    {
+      targetOrigin: sameOrigin,
+      scripts: ["/clear-site-data/support/clear-cache-helper.sub.js"],
+      funcBeforeBackNavigation: async (getUrlParams, mode) => {
+
+        const cacheHelper = self.crypto.randomUUID();
+        const testUrl = getUrl(cacheHelper, getUrlParams);
+
+        let clearingPromise;
+        if (mode === "window") {
+          clearingPromise = new Promise(resolve => {
+            window.addEventListener("message", resolve, {once: true});
+            window.open(testUrl);
+          });
+        } else if (mode === "iframe") {
+          clearingPromise = new Promise(resolve => {
+            const iframe = document.createElement("iframe");
+            iframe.src = testUrl;
+            document.body.appendChild(iframe);
+            iframe.onload = resolve;
+          });
+        } else {
+          throw new Error("Unsupported mode");
+        }
+
+        await clearingPromise;
+      },
+      argsBeforeBackNavigation: [params.getUrlParams, params.mode],
+      ...params,
+    },
+    description
+  );
+}
+

diff --git a/third_party/blink/web_tests/external/wpt/dom/events/scrolling/iframe-chains.html b/third_party/blink/web_tests/external/wpt/dom/events/scrolling/iframe-chains.html
index fb7d674..c1172105 100644
--- a/third_party/blink/web_tests/external/wpt/dom/events/scrolling/iframe-chains.html
+++ b/third_party/blink/web_tests/external/wpt/dom/events/scrolling/iframe-chains.html

@@ -1,6 +1,7 @@
 <!DOCTYPE html>
 <html>
 <head>
+<meta name="viewport" content="width=device-width,initial-scale=1.0">
 <script src="/resources/testharness.js"></script>
 <script src="/resources/testharnessreport.js"></script>
 <script src="/resources/testdriver.js"></script>

diff --git a/third_party/compiler-rt/src b/third_party/compiler-rt/src
index fd2d6af..989fc59 160000
--- a/third_party/compiler-rt/src
+++ b/third_party/compiler-rt/src

@@ -1 +1 @@
-Subproject commit fd2d6af9160159f6a70af612e93faba530a2283b
+Subproject commit 989fc59a095ba0e691f5bd893e33478336dc18dc

diff --git a/third_party/dawn b/third_party/dawn
index 9733be3..9fd4a73 160000
--- a/third_party/dawn
+++ b/third_party/dawn

@@ -1 +1 @@
-Subproject commit 9733be39e18186961d503e064874afe3e9ceb8d1
+Subproject commit 9fd4a731474f66c1ce5465f9b13919ad7487315d

diff --git a/third_party/freetype/README.chromium b/third_party/freetype/README.chromium
index 2ae01f99..615c6a7 100644
--- a/third_party/freetype/README.chromium
+++ b/third_party/freetype/README.chromium

@@ -1,7 +1,7 @@
 Name: FreeType
 URL: http://www.freetype.org/
-Version: VER-2-13-3-262-gfc051dc0b
-Revision: fc051dc0beb44acc3a082b65b689dd38657fff54
+Version: VER-2-13-3-264-g738905b34
+Revision: 738905b34bd1f5a8ff51bd2bc8e38a2d8be9bfd6
 CPEPrefix: cpe:/a:freetype:freetype:2.13.3
 License: FTL
 License File: src/docs/FTL.TXT

diff --git a/third_party/freetype/src b/third_party/freetype/src
index fc051dc..738905b 160000
--- a/third_party/freetype/src
+++ b/third_party/freetype/src

@@ -1 +1 @@
-Subproject commit fc051dc0beb44acc3a082b65b689dd38657fff54
+Subproject commit 738905b34bd1f5a8ff51bd2bc8e38a2d8be9bfd6

diff --git a/third_party/llvm-libc/src b/third_party/llvm-libc/src
index ff75100..a2f7b48 160000
--- a/third_party/llvm-libc/src
+++ b/third_party/llvm-libc/src

@@ -1 +1 @@
-Subproject commit ff75100b45027c70e17770cb80e720193b742c76
+Subproject commit a2f7b489cd4fecf856eb3739cc5a341545022896

diff --git a/third_party/vulkan-deps b/third_party/vulkan-deps
index 5f9183d..9a8d020 160000
--- a/third_party/vulkan-deps
+++ b/third_party/vulkan-deps

@@ -1 +1 @@
-Subproject commit 5f9183df4e99d153dcf2de173ddfd47034f72601
+Subproject commit 9a8d0205ed06a556ff17d4097afc218c993ec260

diff --git a/third_party/vulkan-validation-layers/src b/third_party/vulkan-validation-layers/src
index 4b8f3ca..ce9b7e4 160000
--- a/third_party/vulkan-validation-layers/src
+++ b/third_party/vulkan-validation-layers/src

@@ -1 +1 @@
-Subproject commit 4b8f3caab2cf0ace618ba857364346aed6297d29
+Subproject commit ce9b7e404fe1a312ff4c07961dc6f8a2fd925d44

diff --git a/third_party/webrtc b/third_party/webrtc
index 3450510..7493242 160000
--- a/third_party/webrtc
+++ b/third_party/webrtc

@@ -1 +1 @@
-Subproject commit 345051055056e62fd7c011f56e4db800790e899b
+Subproject commit 74932424d457e2ad5e70c914b3cdd55bec759d6a

diff --git a/tools/perf/core/perfetto_binary_roller/binary_deps.json b/tools/perf/core/perfetto_binary_roller/binary_deps.json
index 0261a4d..5b9326679 100644
--- a/tools/perf/core/perfetto_binary_roller/binary_deps.json
+++ b/tools/perf/core/perfetto_binary_roller/binary_deps.json

@@ -6,7 +6,7 @@
         },
         "win": {
             "hash": "ca5569771bdaf64998daa87da60550e4351b79b8",
-            "full_remote_path": "chromium-telemetry/perfetto_binaries/trace_processor_shell/win/20f9ca438357230523c24f4972242beb3f2755d4/trace_processor_shell.exe"
+            "full_remote_path": "chromium-telemetry/perfetto_binaries/trace_processor_shell/win/15b79e4bc067016a592fac0b9875eb0322ea9a1a/trace_processor_shell.exe"
         },
         "linux_arm": {
             "hash": "99f971ca131f6d11c73f4b918099d434bdd8093c",

diff --git a/ui/accessibility/platform/ax_platform_atk_hyperlink.cc b/ui/accessibility/platform/ax_platform_atk_hyperlink.cc
index d3809ec..9de78b8 100644
--- a/ui/accessibility/platform/ax_platform_atk_hyperlink.cc
+++ b/ui/accessibility/platform/ax_platform_atk_hyperlink.cc

@@ -86,17 +86,25 @@
 
 static int AXPlatformAtkHyperlinkGetStartIndex(AtkHyperlink* atk_hyperlink) {
   g_return_val_if_fail(IS_AX_PLATFORM_ATK_HYPERLINK(atk_hyperlink), 0);
-  AXPlatformAtkHyperlink* link = AX_PLATFORM_ATK_HYPERLINK(atk_hyperlink);
+  auto* platform_node =
+      ToAXPlatformNodeAuraLinux(AX_PLATFORM_ATK_HYPERLINK(atk_hyperlink));
+  if (!platform_node) {
+    return 0;
+  }
   std::optional<std::pair<int, int>> indices =
-      link->priv->platform_node->GetEmbeddedObjectIndices();
+      platform_node->GetEmbeddedObjectIndices();
   return indices.has_value() ? indices->first : 0;
 }
 
 static int AXPlatformAtkHyperlinkGetEndIndex(AtkHyperlink* atk_hyperlink) {
   g_return_val_if_fail(IS_AX_PLATFORM_ATK_HYPERLINK(atk_hyperlink), 0);
-  AXPlatformAtkHyperlink* link = AX_PLATFORM_ATK_HYPERLINK(atk_hyperlink);
+  auto* platform_node =
+      ToAXPlatformNodeAuraLinux(AX_PLATFORM_ATK_HYPERLINK(atk_hyperlink));
+  if (!platform_node) {
+    return 0;
+  }
   std::optional<std::pair<int, int>> indices =
-      link->priv->platform_node->GetEmbeddedObjectIndices();
+      platform_node->GetEmbeddedObjectIndices();
   return indices.has_value() ? indices->second : 0;
 }
 

diff --git a/v8 b/v8
index ff04335..77f35f0 160000
--- a/v8
+++ b/v8

@@ -1 +1 @@
-Subproject commit ff043353c7e2af4e94ca4a4086cfce063e0e08ec
+Subproject commit 77f35f055a1543f51099fcea9575f83304d60de5