diff --git a/DEPS b/DEPS
index a5ea80c..3f093aa 100644
--- a/DEPS
+++ b/DEPS
@@ -299,15 +299,15 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling Skia
   # and whatever else without interference from each other.
-  'skia_revision': '9b91a4116d136dc888f003e14d89b6d513e99202',
+  'skia_revision': 'b4f7192604f39670b83e9ab7f69586b687974e9c',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling V8
   # and whatever else without interference from each other.
-  'v8_revision': '037d626d067ec2de19df63cd9f11786dcd69d38f',
+  'v8_revision': '80222be30bc5320f41be244ea2e8a061a41b5d60',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling ANGLE
   # and whatever else without interference from each other.
-  'angle_revision': '5bc6bf325690953357be131fddf24b8e720cfe1a',
+  'angle_revision': 'ef6d14737424d38124a533d7ee3698e9c9ba100c',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling SwiftShader
   # and whatever else without interference from each other.
@@ -326,7 +326,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling Fuchsia sdk
   # and whatever else without interference from each other.
-  'fuchsia_version': 'version:11.20230225.1.1',
+  'fuchsia_version': 'version:11.20230226.2.1',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling google-toolbox-for-mac
   # and whatever else without interference from each other.
@@ -370,7 +370,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling catapult
   # and whatever else without interference from each other.
-  'catapult_revision': '9c6c41afcf180e0bf068129b75da62e535f37629',
+  'catapult_revision': '8a26fb906ec1c2acb00aeeab74c284f8993ab867',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling CrossBench
   # and whatever else without interference from each other.
@@ -386,7 +386,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling devtools-frontend
   # and whatever else without interference from each other.
-  'devtools_frontend_revision': '120a1e8e38dfc634bb6a9ad9379029f1c4c20fc5',
+  'devtools_frontend_revision': '353a414e91cec040d12b3c0d2312c49d7dc92c4e',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling libprotobuf-mutator
   # and whatever else without interference from each other.
@@ -426,7 +426,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling feed
   # and whatever else without interference from each other.
-  'dawn_revision': '0be37e0c508d41e2186616d642dc61a544389c3a',
+  'dawn_revision': '67a3918bd8f14b9a23ccb5db3264f5b9916b1b57',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling feed
   # and whatever else without interference from each other.
@@ -764,7 +764,7 @@
 
   'src/clank': {
     'url': 'https://chrome-internal.googlesource.com/clank/internal/apps.git' + '@' +
-    '722f66cdac2700c33e47b4cc3513d2d1f1a81865',
+    'dfa227b883f9b92e454ee3a2ceef7a1bb1a31507',
     'condition': 'checkout_android and checkout_src_internal',
   },
 
@@ -863,7 +863,7 @@
       'packages': [
         {
           'package': 'chromium/rts/model/linux-amd64',
-          'version': 'JeXnUskpoCWRBr4lJzmSEJoWJSNr1Q9AH78D-8cDBy0C',
+          'version': '5WbUil4KanfX4HN2rMFZwLHg0y6GiUTM3F3g6zGqMaAC',
         },
       ],
       'dep_type': 'cipd',
@@ -874,7 +874,7 @@
       'packages': [
         {
           'package': 'chromium/rts/model/mac-amd64',
-          'version': '88n2b8yoQtPCxlMXsoTBnBJZNnJjSEjesuCiNAnERPIC',
+          'version': 'HK8Sx9zMLY0YK0i3TaCoIVYKzqCmEsUuQvJDkoV10KYC',
         },
       ],
       'dep_type': 'cipd',
@@ -885,7 +885,7 @@
       'packages': [
         {
           'package': 'chromium/rts/model/windows-amd64',
-          'version': 'mXbvUKqMz5wrshxbG10HSWm9Xw-ZVoOFxcBm8BZnAkwC',
+          'version': 'GoOkuqQKE1qa6a0uZ5xURpZuf9_VVCxC7brsZY5IwlgC',
         },
       ],
       'dep_type': 'cipd',
@@ -953,7 +953,7 @@
     'packages': [
       {
           'package': 'chromium/third_party/androidx',
-          'version': 'F5NYfthfngE6fmCZchMd0133XW15UCBALwEBue8MuIsC',
+          'version': 'ipyrDoi1axPtZAfhhhTWjy5kpuJ3Mq6XrE4SAB5v5V8C',
       },
     ],
     'condition': 'checkout_android',
@@ -1212,7 +1212,7 @@
     Var('chromium_git') + '/devtools/devtools-frontend' + '@' + Var('devtools_frontend_revision'),
 
   'src/third_party/devtools-frontend-internal': {
-      'url': 'https://chrome-internal.googlesource.com/devtools/devtools-internal.git' + '@' + '38c0619f644ebf98b511feb2b9983e3874f8188d',
+      'url': 'https://chrome-internal.googlesource.com/devtools/devtools-internal.git' + '@' + '99a1c9c5ff90cf08f35a0bd811600ce86413c5e9',
     'condition': 'checkout_src_internal',
   },
 
@@ -1869,7 +1869,7 @@
     Var('chromium_git') + '/external/github.com/gpuweb/cts.git' + '@' + '6c8361e98f1daba65902f5e2fc1297893ac14b67',
 
   'src/third_party/webrtc':
-    Var('webrtc_git') + '/src.git' + '@' + '0b57f209d5f4c83c48aa64fa98aa81ec91a27808',
+    Var('webrtc_git') + '/src.git' + '@' + '2d57f38c1cf3f5a37fbc8e10f5ea3deae7598f5b',
 
   # Wuffs' canonical repository is at github.com/google/wuffs, but we use
   # Skia's mirror of Wuffs, the same as in upstream Skia's DEPS file.
@@ -1939,7 +1939,7 @@
     Var('chromium_git') + '/v8/v8.git' + '@' +  Var('v8_revision'),
 
   'src-internal': {
-    'url': 'https://chrome-internal.googlesource.com/chrome/src-internal.git@da8bb1b7dc2ee7ec7ac5b16818ed6b629f84d404',
+    'url': 'https://chrome-internal.googlesource.com/chrome/src-internal.git@4562de81d76f976670be3bafd97e0d1bd0a0a6e1',
     'condition': 'checkout_src_internal',
   },
 
@@ -1969,7 +1969,7 @@
     'packages': [
       {
         'package': 'chromeos_internal/apps/help_app/app',
-        'version': 'vD37vodWcG1_A4Cx9dUI9vkiMjkR8_UoCenGT38QqUcC',
+        'version': 'eU5X-VehYPtAQxzv5lideggcdXmRcSwDW2aiKSZFCwUC',
       },
     ],
     'condition': 'checkout_chromeos and checkout_src_internal',
@@ -1991,7 +1991,7 @@
     'packages': [
       {
         'package': 'chromeos_internal/apps/projector_app/app',
-        'version': 'jJgajghcNfduuOM5VkfaD3rjsNPgnwxhEwWbo8Nxlq0C',
+        'version': 'OGxbuNrsjt61W6mrd_RU9ar3--MLssnWRxHdbEK3aD0C',
       },
     ],
     'condition': 'checkout_chromeos and checkout_src_internal',
diff --git a/ash/drag_drop/drag_drop_controller.cc b/ash/drag_drop/drag_drop_controller.cc
index 184b7df4..9628ef8f 100644
--- a/ash/drag_drop/drag_drop_controller.cc
+++ b/ash/drag_drop/drag_drop_controller.cc
@@ -628,6 +628,10 @@
   e.set_flags(event.flags());
   ui::Event::DispatcherApi(&e).set_target(target);
 
+  for (aura::client::DragDropClientObserver& observer : observers_) {
+    observer.OnDragCompleted(e);
+  }
+
   if (delegate) {
     delegate_drop_cb_animation = delegate->GetDropCallbackWithAnimation(e);
     delegate_drop_cb = delegate->GetDropCallback(e);
@@ -642,7 +646,6 @@
   const bool is_tab_drag_drop = (tab_drag_drop_delegate_.get() != nullptr);
 
   DCHECK_EQ(drag_window_, target);
-  aura::WindowTracker window_tracker({drag_window_, drag_window_->parent()});
 
   DropIfAllowed(
       drag_data_.get(), current_drag_info_,
@@ -652,19 +655,6 @@
           std::move(delegate_drop_cb), std::move(delegate_drop_cb_animation),
           std::move(tab_drag_drop_delegate_), std::move(drag_cancel)));
 
-  // During the drop, the event target (or its ancestors) might have
-  // been destroyed, eg by the client reaction. Adapt the DropTargetEvent
-  // accordingly.
-  //
-  // TODO(https://crbug.com/1160925): Avoid nested RunLoop in exo
-  // DataDevice::GetDropCallback() - remove the block below when it is fixed.
-  if (!window_tracker.Contains(drag_window_) ||
-      !window_tracker.Contains(drag_window_->parent())) {
-    ui::Event::DispatcherApi(&e).set_target(nullptr);
-  }
-
-  for (aura::client::DragDropClientObserver& observer : observers_)
-    observer.OnDragCompleted(e);
   Cleanup();
 
   // Tab drag-n-drop should never be async.
@@ -706,8 +696,9 @@
   if (toplevel_window_drag_delegate_)
     toplevel_window_drag_delegate_->OnToplevelWindowDragCancelled();
 
-  for (aura::client::DragDropClientObserver& observer : observers_)
+  for (aura::client::DragDropClientObserver& observer : observers_) {
     observer.OnDragCancelled();
+  }
   Cleanup();
 
   StartCanceledAnimation(drag_cancel_animation_duration);
@@ -826,7 +817,7 @@
     aura::client::DragDropDelegate::DropCallback drop_cb,
     aura::client::DragDropDelegate::DropCallbackWithAnimation drop_cb_animation,
     std::unique_ptr<TabDragDropDelegate> tab_drag_drop_delegate,
-    base::ScopedClosureRunner drag_cancel) {
+    base::ScopedClosureRunner cancel_drag_callback) {
   // Event copy constructor dooesn't copy the target. That's why we set it here.
   // DragDropController observes the `drag_window_`, so if it's destroyed, the
   // target will be set to nullptr.
@@ -860,7 +851,14 @@
   if (toplevel_window_drag_delegate_) {
     operation_ = toplevel_window_drag_delegate_->OnToplevelWindowDragDropped();
   }
-  drag_cancel.ReplaceClosure(base::DoNothing());
+
+  for (aura::client::DragDropClientObserver& observer : observers_) {
+    observer.OnDropCompleted(operation_);
+  }
+
+  // Replace `cancel_drag_callback` with an empty closure. Drop completed, so no
+  // need to cancel the drop.
+  cancel_drag_callback.ReplaceClosure(base::DoNothing());
 }
 
 void DragDropController::CancelIfInProgress() {
diff --git a/ash/drag_drop/drag_drop_controller.h b/ash/drag_drop/drag_drop_controller.h
index 0be258cc..030b196 100644
--- a/ash/drag_drop/drag_drop_controller.h
+++ b/ash/drag_drop/drag_drop_controller.h
@@ -159,9 +159,9 @@
 
   void CleanupPendingLongTap();
 
-  // Helper method to perform the drop if allowed by
-  // DataTransferPolicyController. If it's run, `drag_cancel` will be replaced.
-  // Otherwise `drag_cancel` will run to cancel the drag.
+  // Performs data drop. NOTE: this method does not run in an async drop if
+  // disallowed by `ui::DataTransferPolicyController`. `cancel_drag_callback`
+  // runs if this method does not run.
   void PerformDrop(const gfx::Point drop_location_in_screen,
                    ui::DropTargetEvent event,
                    std::unique_ptr<ui::OSExchangeData> drag_data,
@@ -169,7 +169,7 @@
                    aura::client::DragDropDelegate::DropCallbackWithAnimation
                        drop_cb_animation,
                    std::unique_ptr<TabDragDropDelegate> tab_drag_drop_delegate,
-                   base::ScopedClosureRunner drag_cancel);
+                   base::ScopedClosureRunner cancel_drag_callback);
 
   void CancelIfInProgress();
 
diff --git a/ash/drag_drop/drag_drop_controller_unittest.cc b/ash/drag_drop/drag_drop_controller_unittest.cc
index bd69949..04695d3 100644
--- a/ash/drag_drop/drag_drop_controller_unittest.cc
+++ b/ash/drag_drop/drag_drop_controller_unittest.cc
@@ -8,6 +8,7 @@
 
 #include "ash/constants/ash_features.h"
 #include "ash/drag_drop/drag_image_view.h"
+#include "ash/drag_drop/mock_drag_drop_observer.h"
 #include "ash/drag_drop/toplevel_window_drag_delegate.h"
 #include "ash/public/cpp/test/test_new_window_delegate.h"
 #include "ash/shell.h"
@@ -249,14 +250,6 @@
   std::u16string drag_string_;
 };
 
-class MockObserver : public aura::client::DragDropClientObserver {
- public:
-  // aura::client::DragDropClientObserver
-  MOCK_METHOD(void, OnDragStarted, (), (override));
-  MOCK_METHOD(void, OnDragUpdated, (const ui::DropTargetEvent&), (override));
-  MOCK_METHOD(void, OnDragCompleted, (const ui::DropTargetEvent&), (override));
-};
-
 class TestObserver : public aura::client::DragDropClientObserver {
  public:
   enum class State { kNotInvoked, kDragStartedInvoked, kDragEndedInvoked };
@@ -1249,8 +1242,8 @@
 }
 
 TEST_F(DragDropControllerTest, DragObserverEvents) {
-  testing::StrictMock<MockObserver> observer;
-  drag_drop_controller_->AddObserver(&observer);
+  testing::StrictMock<MockDragDropObserver> observer(
+      drag_drop_controller_.get());
 
   {
     auto data = CreateDragData(/*with_image=*/false);
@@ -1281,6 +1274,7 @@
             EXPECT_EQ(&event.data(), data_ptr);
           }));
       EXPECT_CALL(observer, OnDragCompleted);
+      EXPECT_CALL(observer, OnDropCompleted);
     }
 
     drag_drop_controller_->Drop(window, e);
@@ -1698,6 +1692,24 @@
   EXPECT_FALSE(tab_window1->HasObserver(drag_drop_controller_.get()));
 }
 
+TEST_F(DragDropControllerTest, DragImageWidgetNotCreatedIfNoImage) {
+  std::unique_ptr<views::Widget> widget = CreateFramelessWidget();
+  aura::Window* window = widget->GetNativeWindow();
+
+  auto data = CreateDragData(/*with_image=*/false);
+  drag_drop_controller_->StartDragAndDrop(
+      std::move(data), window->GetRootWindow(), window, gfx::Point(5, 5),
+      ui::DragDropTypes::DRAG_MOVE, ui::mojom::DragEventSource::kMouse);
+  EXPECT_FALSE(GetDragImageWindow());
+  drag_drop_controller_->DragCancel();
+
+  data = CreateDragData(/*with_image=*/true);
+  drag_drop_controller_->StartDragAndDrop(
+      std::move(data), window->GetRootWindow(), window, gfx::Point(5, 5),
+      ui::DragDropTypes::DRAG_MOVE, ui::mojom::DragEventSource::kMouse);
+  EXPECT_TRUE(GetDragImageWindow());
+}
+
 namespace {
 
 class MockDataTransferPolicyController
@@ -1721,144 +1733,202 @@
 
 }  // namespace
 
-TEST_F(DragDropControllerTest, DlpAllowDragDrop) {
-  std::unique_ptr<aura::Window> window(CreateTestWindowInShellWithDelegate(
-      aura::test::TestWindowDelegate::CreateSelfDestroyingDelegate(), -1,
-      gfx::Rect(0, 0, 100, 100)));
-  EventTargetTestDelegate delegate(window.get());
-  aura::client::SetDragDropDelegate(window.get(), &delegate);
+// Verifies drag-and-drop with a data transfer policy controller.
+class DragDropControllerDlpTest : public DragDropControllerTest {
+ public:
+  // DragDropControllerTest:
+  void SetUp() override {
+    DragDropControllerTest::SetUp();
 
-  MockDataTransferPolicyController dlp_contoller;
+    window_.reset(CreateTestWindowInShellWithDelegate(
+        aura::test::TestWindowDelegate::CreateSelfDestroyingDelegate(),
+        /*id=*/-1, gfx::Rect(0, 0, 100, 100)));
+    delegate_ = std::make_unique<EventTargetTestDelegate>(window_.get());
+    aura::client::SetDragDropDelegate(window_.get(), delegate_.get());
+    drag_and_drop_observer_ = std::make_unique<NiceMock<MockDragDropObserver>>(
+        drag_drop_controller_.get());
+  }
 
-  // Posted task will be run when the inner loop runs in StartDragAndDrop.
-  ui::test::EventGenerator generator(window->GetRootWindow(), window.get());
-  generator.PressLeftButton();
+  void TearDown() override {
+    drag_and_drop_observer_.reset();
+    delegate_.reset();
+    window_.reset();
 
-  auto data = CreateDragData(/*with_image=*/false);
+    DragDropControllerTest::TearDown();
+  }
 
-  // Drop.
-  EXPECT_CALL(dlp_contoller, DropIfAllowed(_, _, _))
+  // Performs drag-and-drop on `window_` with the specified drag data. Data drop
+  // is allowed or not by `dlp_contoller_`.
+  void PerformDlpDragAndDrop(std::unique_ptr<ui::OSExchangeData> drag_data) {
+    // Posted task will be run when the inner loop runs in StartDragAndDrop.
+    ui::test::EventGenerator generator(window_->GetRootWindow(), window_.get());
+    generator.PressLeftButton();
+
+    drag_drop_controller_->StartDragAndDrop(
+        std::move(drag_data), window_->GetRootWindow(), window_.get(),
+        gfx::Point(5, 5), ui::DragDropTypes::DRAG_MOVE,
+        ui::mojom::DragEventSource::kMouse);
+
+    // For drag enter
+    generator.MoveMouseBy(0, 1);
+    // For drag update
+    generator.MoveMouseBy(0, 1);
+    // For perform drop
+    generator.ReleaseLeftButton();
+  }
+
+  // A mock data transfer policy controller. Customized to allow/disallow data
+  // drop in tests.
+  MockDataTransferPolicyController dlp_contoller_;
+
+  std::unique_ptr<EventTargetTestDelegate> delegate_;
+
+  std::unique_ptr<aura::Window> window_;
+
+  // A mock drag-and-drop observer to verify the API function calling order.
+  std::unique_ptr<NiceMock<MockDragDropObserver>> drag_and_drop_observer_;
+};
+
+// Tests when drop is allowed synchronously.
+TEST_F(DragDropControllerDlpTest, AllowedSyncDragDrop) {
+  {
+    testing::InSequence s;
+    EXPECT_CALL(*drag_and_drop_observer_, OnDragStarted);
+    EXPECT_CALL(*drag_and_drop_observer_, OnDragCompleted);
+    EXPECT_CALL(*drag_and_drop_observer_,
+                OnDropCompleted(ui::mojom::DragOperation::kMove));
+  }
+
+  // Configure `dlp_controller_` to allow sync drop.
+  EXPECT_CALL(dlp_contoller_, DropIfAllowed(_, _, _))
       .WillOnce([&](const ui::OSExchangeData* drag_data,
                     const ui::DataTransferEndpoint* data_dst,
                     base::OnceClosure drop_cb) { std::move(drop_cb).Run(); });
 
-  drag_drop_controller_->StartDragAndDrop(
-      std::move(data), window->GetRootWindow(), window.get(), gfx::Point(5, 5),
-      ui::DragDropTypes::DRAG_MOVE, ui::mojom::DragEventSource::kMouse);
-
-  // For drag enter
-  generator.MoveMouseBy(0, 1);
-  // For drag update
-  generator.MoveMouseBy(0, 1);
-  // For perform drop
-  generator.ReleaseLeftButton();
+  PerformDlpDragAndDrop(CreateDragData(/*with_image=*/false));
 
   EXPECT_EQ(EventTargetTestDelegate::State::kPerformDropInvoked,
-            delegate.state());
+            delegate_->state());
 }
 
-TEST_F(DragDropControllerTest, DlpDisallowDragDrop) {
-  std::unique_ptr<aura::Window> window(CreateTestWindowInShellWithDelegate(
-      aura::test::TestWindowDelegate::CreateSelfDestroyingDelegate(), -1,
-      gfx::Rect(0, 0, 100, 100)));
-  EventTargetTestDelegate delegate(window.get());
-  aura::client::SetDragDropDelegate(window.get(), &delegate);
+// Tests when drag is cancelled before drop.
+TEST_F(DragDropControllerDlpTest, CancelDragBeforeDrop) {
+  // Observers should not be notified of drop completion since the async drop
+  // should be interrupted by a new drag-and-drop session.
+  EXPECT_CALL(*drag_and_drop_observer_, OnDropCompleted).Times(0);
 
-  MockDataTransferPolicyController dlp_contoller;
+  {
+    testing::InSequence s;
+    EXPECT_CALL(*drag_and_drop_observer_, OnDragStarted);
+    EXPECT_CALL(*drag_and_drop_observer_, OnDragCancelled);
+  }
 
-  // Posted task will be run when the inner loop runs in StartDragAndDrop.
-  ui::test::EventGenerator generator(window->GetRootWindow(), window.get());
+  // Drag to `window_`.
+  ui::test::EventGenerator generator(window_->GetRootWindow(), window_.get());
   generator.PressLeftButton();
-
-  auto data = CreateDragData(/*with_image=*/true);
-
-  EXPECT_CALL(dlp_contoller, DropIfAllowed(_, _, _));
-
   drag_drop_controller_->StartDragAndDrop(
-      std::move(data), window->GetRootWindow(), window.get(), gfx::Point(5, 5),
-      ui::DragDropTypes::DRAG_MOVE, ui::mojom::DragEventSource::kMouse);
+      CreateDragData(/*with_image=*/true), window_->GetRootWindow(),
+      window_.get(), gfx::Point(5, 5), ui::DragDropTypes::DRAG_MOVE,
+      ui::mojom::DragEventSource::kMouse);
+  generator.MoveMouseBy(0, 1);
 
-  // For drag enter
-  generator.MoveMouseBy(0, 1);
-  // For drag update
-  generator.MoveMouseBy(0, 1);
-  // For perform drop
+  // Cancel before drop.
+  drag_drop_controller_->DragCancel();
   generator.ReleaseLeftButton();
 
   // There is a non-empty drag image, an animation is expected to be run for
   // cancellation.
   EXPECT_TRUE(cancel_animation());
   EXPECT_TRUE(GetDragImageWindow());
-  EXPECT_EQ(EventTargetTestDelegate::State::kDragExitInvoked, delegate.state());
+  EXPECT_EQ(EventTargetTestDelegate::State::kDragExitInvoked,
+            delegate_->state());
 }
 
-TEST_F(DragDropControllerTest, DlpAsyncDrop) {
-  std::unique_ptr<aura::Window> window(CreateTestWindowInShellWithDelegate(
-      aura::test::TestWindowDelegate::CreateSelfDestroyingDelegate(), -1,
-      gfx::Rect(0, 0, 100, 100)));
-  EventTargetTestDelegate delegate(window.get());
-  aura::client::SetDragDropDelegate(window.get(), &delegate);
+// Tests when drop is allowed asynchronously.
+TEST_F(DragDropControllerDlpTest, AllowedAsyncDrop) {
+  {
+    testing::InSequence s;
+    EXPECT_CALL(*drag_and_drop_observer_, OnDragStarted);
+    EXPECT_CALL(*drag_and_drop_observer_, OnDragCompleted);
+    EXPECT_CALL(*drag_and_drop_observer_, OnDropCompleted);
+  }
 
-  MockDataTransferPolicyController dlp_contoller;
-
-  // Posted task will be run when the inner loop runs in StartDragAndDrop.
-  ui::test::EventGenerator generator(window->GetRootWindow(), window.get());
-  generator.PressLeftButton();
-
-  auto data = CreateDragData(/*with_image=*/true);
-
+  // Hold the drop callback passed to `dlp_controller_` then run this drop
+  // callback later. It emulates a successful async drop.
   base::OnceClosure drop_callback;
-
-  // Hold Drop.
-  EXPECT_CALL(dlp_contoller, DropIfAllowed(_, _, _))
+  EXPECT_CALL(dlp_contoller_, DropIfAllowed(_, _, _))
       .WillOnce([&](const ui::OSExchangeData* drag_data,
                     const ui::DataTransferEndpoint* data_dst,
                     base::OnceClosure drop_cb) {
         drop_callback = std::move(drop_cb);
       });
 
-  drag_drop_controller_->StartDragAndDrop(
-      std::move(data), window->GetRootWindow(), window.get(), gfx::Point(5, 5),
-      ui::DragDropTypes::DRAG_MOVE, ui::mojom::DragEventSource::kMouse);
+  PerformDlpDragAndDrop(CreateDragData(/*with_image=*/true));
+  std::move(drop_callback).Run();
 
-  // For drag enter
-  generator.MoveMouseBy(0, 1);
-  // For drag update
-  generator.MoveMouseBy(0, 1);
-  // For perform drop
-  generator.ReleaseLeftButton();
+  // Check that there is no drag-and-drop in progress after the async drop.
+  EXPECT_FALSE(drag_drop_controller_->IsDragDropInProgress());
+}
 
+// Tests when the first drop is allowed after the second drag-and-drop session
+// starts.
+TEST_F(DragDropControllerDlpTest, InterruptedAsyncDrop) {
+  // Since the second drag-and-drop session starts before the first drop is
+  // completed, an observer should not be notified of the first drop completion.
+  EXPECT_CALL(*drag_and_drop_observer_, OnDropCompleted).Times(0);
+  {
+    testing::InSequence s;
+    EXPECT_CALL(*drag_and_drop_observer_, OnDragStarted);
+    EXPECT_CALL(*drag_and_drop_observer_, OnDragCompleted);
+    EXPECT_CALL(*drag_and_drop_observer_, OnDragStarted);
+  }
+
+  base::OnceClosure drop_callback;
+  EXPECT_CALL(dlp_contoller_, DropIfAllowed(_, _, _))
+      .WillOnce([&](const ui::OSExchangeData* drag_data,
+                    const ui::DataTransferEndpoint* data_dst,
+                    base::OnceClosure drop_cb) {
+        drop_callback = std::move(drop_cb);
+      });
+
+  PerformDlpDragAndDrop(CreateDragData(/*with_image=*/true));
   EXPECT_FALSE(cancel_animation());
   EXPECT_FALSE(GetDragImageWindow());
 
-  data = std::make_unique<ui::OSExchangeData>();
+  auto data = std::make_unique<ui::OSExchangeData>();
   data->SetString(u"I am being dragged 2");
   drag_drop_controller_->StartDragAndDrop(
-      std::move(data), window->GetRootWindow(), window.get(), gfx::Point(5, 5),
-      ui::DragDropTypes::DRAG_MOVE, ui::mojom::DragEventSource::kMouse);
+      std::move(data), window_->GetRootWindow(), window_.get(),
+      gfx::Point(5, 5), ui::DragDropTypes::DRAG_MOVE,
+      ui::mojom::DragEventSource::kMouse);
 
+  // Run `drop_callback` after the second drag-and-drop starts.
   std::move(drop_callback).Run();
 
   EXPECT_EQ(EventTargetTestDelegate::State::kDragUpdateInvoked,
-            delegate.state());
+            delegate_->state());
 }
 
-TEST_F(DragDropControllerTest, DragImageWidgetNotCreatedIfNoImage) {
-  std::unique_ptr<views::Widget> widget = CreateFramelessWidget();
-  aura::Window* window = widget->GetNativeWindow();
+// Tests when drop is disallowed asyncly.
+TEST_F(DragDropControllerDlpTest, DlpDisallowAsyncDrop) {
+  {
+    testing::InSequence s;
+    EXPECT_CALL(*drag_and_drop_observer_, OnDragStarted);
+    EXPECT_CALL(*drag_and_drop_observer_, OnDragCompleted);
+    EXPECT_CALL(*drag_and_drop_observer_, OnDragCancelled);
+  }
 
-  auto data = CreateDragData(/*with_image=*/false);
-  drag_drop_controller_->StartDragAndDrop(
-      std::move(data), window->GetRootWindow(), window, gfx::Point(5, 5),
-      ui::DragDropTypes::DRAG_MOVE, ui::mojom::DragEventSource::kMouse);
-  EXPECT_FALSE(GetDragImageWindow());
-  drag_drop_controller_->DragCancel();
+  // Hold the drop callback passed to `dlp_controller_`. Because `drop_callback`
+  // does not run, it emulates an async disallowed drop.
+  base::OnceClosure drop_callback;
+  EXPECT_CALL(dlp_contoller_, DropIfAllowed(_, _, _))
+      .WillOnce([&](const ui::OSExchangeData* drag_data,
+                    const ui::DataTransferEndpoint* data_dst,
+                    base::OnceClosure drop_cb) {
+        drop_callback = std::move(drop_cb);
+      });
 
-  data = CreateDragData(/*with_image=*/true);
-  drag_drop_controller_->StartDragAndDrop(
-      std::move(data), window->GetRootWindow(), window, gfx::Point(5, 5),
-      ui::DragDropTypes::DRAG_MOVE, ui::mojom::DragEventSource::kMouse);
-  EXPECT_TRUE(GetDragImageWindow());
+  PerformDlpDragAndDrop(CreateDragData(/*with_image=*/true));
 }
 
 class MouseOrTouchDragDropControllerTest
diff --git a/ash/drag_drop/mock_drag_drop_observer.h b/ash/drag_drop/mock_drag_drop_observer.h
index 2e336e4..a97f662 100644
--- a/ash/drag_drop/mock_drag_drop_observer.h
+++ b/ash/drag_drop/mock_drag_drop_observer.h
@@ -14,6 +14,10 @@
 }  // namespace aura::client
 
 namespace ui {
+namespace mojom {
+enum class DragOperation;
+}  // namespace mojom
+
 class DropTargetEvent;
 }  // namespace ui
 
@@ -33,6 +37,12 @@
               OnDragUpdated,
               (const ui::DropTargetEvent& event),
               (override));
+  MOCK_METHOD(void,
+              OnDragCompleted,
+              (const ui::DropTargetEvent& event),
+              (override));
+  MOCK_METHOD(void, OnDragCancelled, (), (override));
+  MOCK_METHOD(void, OnDropCompleted, (ui::mojom::DragOperation), (override));
 
  private:
   base::ScopedObservation<aura::client::DragDropClient,
diff --git a/ash/test/ash_test_util.cc b/ash/test/ash_test_util.cc
index aee34ab..542bcafa 100644
--- a/ash/test/ash_test_util.cc
+++ b/ash/test/ash_test_util.cc
@@ -45,11 +45,8 @@
       base::BindOnce(&SnapshotCallback, &run_loop, &image));
   run_loop.Run();
   auto data = image.As1xPNGBytes();
-  int data_size = static_cast<int>(data->size());
-  DCHECK_GT(data_size, 0);
-  int written_size = base::WriteFile(
-      file_path, reinterpret_cast<const char*>(data->front()), data_size);
-  return written_size == data_size;
+  DCHECK_GT(data->size(), 0u);
+  return base::WriteFile(file_path, *data);
 }
 
 void GiveItSomeTimeForDebugging(base::TimeDelta time_duration) {
diff --git a/cc/layers/heads_up_display_layer.cc b/cc/layers/heads_up_display_layer.cc
index 6d865fc2..26bf0bb 100644
--- a/cc/layers/heads_up_display_layer.cc
+++ b/cc/layers/heads_up_display_layer.cc
@@ -26,7 +26,6 @@
   }
   DCHECK(typeface_.Read(*this).get());
   SetIsDrawable(true);
-  SetDrawsContent(HasDrawableContent());
 }
 
 HeadsUpDisplayLayer::~HeadsUpDisplayLayer() = default;
diff --git a/cc/layers/layer.cc b/cc/layers/layer.cc
index a10911e..32f1f1fc 100644
--- a/cc/layers/layer.cc
+++ b/cc/layers/layer.cc
@@ -1408,7 +1408,7 @@
     return;
 
   inputs_.Write(*this).is_drawable = is_drawable;
-  SetDrawsContent(HasDrawableContent());
+  UpdateDrawsContent();
 }
 
 void Layer::SetHideLayerAndSubtree(bool hide) {
@@ -1543,7 +1543,8 @@
   return inputs_.Read(*this).is_drawable;
 }
 
-void Layer::SetDrawsContent(bool value) {
+void Layer::UpdateDrawsContent() {
+  bool value = HasDrawableContent();
   DCHECK(inputs_.Read(*this).is_drawable || !value);
   if (!SetBitFlag(value, kDrawsContentFlagMask, /*invalidate=*/true))
     return;
diff --git a/cc/layers/layer.h b/cc/layers/layer.h
index e76a228..1066b6b 100644
--- a/cc/layers/layer.h
+++ b/cc/layers/layer.h
@@ -599,7 +599,6 @@
   // the layer itself has no content to contribute, even though the layer was
   // given SetIsDrawable(true).
   bool draws_content() const { return GetBitFlag(kDrawsContentFlagMask); }
-  void SetDrawsContent(bool value);
 
   // Returns the number of layers in this layers subtree (excluding itself) for
   // which DrawsContent() is true.
@@ -866,6 +865,10 @@
   // they should return the value from this base class method.
   virtual bool HasDrawableContent() const;
 
+  // Updates draws_content() according to the current HasDrawableContent().
+  // This should be called when HasDrawableContent() changes.
+  void UpdateDrawsContent();
+
   // Called when the layer's number of drawable descendants changes.
   void AddDrawableDescendants(int num);
 
diff --git a/cc/layers/layer_unittest.cc b/cc/layers/layer_unittest.cc
index 3e32161..dcf15b1d 100644
--- a/cc/layers/layer_unittest.cc
+++ b/cc/layers/layer_unittest.cc
@@ -1494,7 +1494,7 @@
 
   void SetFakeDrawsContent(bool fake_draws_content) {
     fake_draws_content_ = fake_draws_content;
-    SetDrawsContent(HasDrawableContent());
+    UpdateDrawsContent();
   }
 
  private:
diff --git a/cc/layers/picture_layer.cc b/cc/layers/picture_layer.cc
index 9859e46..85b4412 100644
--- a/cc/layers/picture_layer.cc
+++ b/cc/layers/picture_layer.cc
@@ -206,7 +206,7 @@
 
 void PictureLayer::ClearClient() {
   picture_layer_inputs_.client = nullptr;
-  SetDrawsContent(HasDrawableContent());
+  UpdateDrawsContent();
 }
 
 void PictureLayer::SetNearestNeighbor(bool nearest_neighbor) {
diff --git a/cc/layers/surface_layer.cc b/cc/layers/surface_layer.cc
index f85d61c..cbcd4d5a 100644
--- a/cc/layers/surface_layer.cc
+++ b/cc/layers/surface_layer.cc
@@ -78,7 +78,7 @@
   } else if (!deadline_policy.use_existing_deadline()) {
     deadline_in_frames_.Write(*this) = deadline_policy.deadline_in_frames();
   }
-  SetDrawsContent(HasDrawableContent());
+  UpdateDrawsContent();
   SetNeedsCommit();
 }
 
diff --git a/cc/layers/texture_layer.cc b/cc/layers/texture_layer.cc
index 034d642..18f4b9a 100644
--- a/cc/layers/texture_layer.cc
+++ b/cc/layers/texture_layer.cc
@@ -42,7 +42,7 @@
 void TextureLayer::ClearClient() {
   client_.Write(*this) = nullptr;
   ClearTexture();
-  SetDrawsContent(HasDrawableContent());
+  UpdateDrawsContent();
 }
 
 void TextureLayer::ClearTexture() {
@@ -134,7 +134,7 @@
   else
     SetNeedsPushProperties();
 
-  SetDrawsContent(HasDrawableContent());
+  UpdateDrawsContent();
 }
 
 void TextureLayer::SetTransferableResource(
diff --git a/cc/layers/ui_resource_layer.cc b/cc/layers/ui_resource_layer.cc
index 3dee67c..97a1f23a 100644
--- a/cc/layers/ui_resource_layer.cc
+++ b/cc/layers/ui_resource_layer.cc
@@ -70,7 +70,7 @@
   // Recreate the resource held against the new LTH.
   RecreateUIResourceIdFromBitmap();
 
-  SetDrawsContent(HasDrawableContent());
+  UpdateDrawsContent();
 }
 
 void UIResourceLayer::SetBitmap(const SkBitmap& bitmap) {
@@ -123,7 +123,7 @@
 
 void UIResourceLayer::SetUIResourceIdInternal(UIResourceId resource_id) {
   resource_id_.Write(*this) = resource_id;
-  SetDrawsContent(HasDrawableContent());
+  UpdateDrawsContent();
   SetNeedsCommit();
 }
 
diff --git a/cc/slim/layer.cc b/cc/slim/layer.cc
index 60e8c4a9..5a6de094 100644
--- a/cc/slim/layer.cc
+++ b/cc/slim/layer.cc
@@ -257,7 +257,7 @@
     return;
   }
   is_drawable_ = drawable;
-  SetDrawsContent(HasDrawableContent());
+  UpdateDrawsContent();
 }
 
 void Layer::SetBackgroundColor(SkColor4f color) {
@@ -312,11 +312,8 @@
   return cc_layer() ? cc_layer()->draws_content() : draws_content_;
 }
 
-void Layer::SetDrawsContent(bool value) {
-  if (cc_layer()) {
-    cc_layer()->SetDrawsContent(value);
-    return;
-  }
+void Layer::UpdateDrawsContent() {
+  bool value = HasDrawableContent();
   if (draws_content_ == value) {
     return;
   }
diff --git a/cc/slim/layer.h b/cc/slim/layer.h
index e987d388..715da64 100644
--- a/cc/slim/layer.h
+++ b/cc/slim/layer.h
@@ -162,7 +162,6 @@
   // the layer itself has no content to contribute, even though the layer was
   // given SetIsDrawable(true).
   bool draws_content() const;
-  void SetDrawsContent(bool value);
 
   // Set or get if this layer and its subtree should be part of the compositor's
   // output to the screen. When set to true, the layer's subtree does not appear
@@ -192,7 +191,10 @@
 
   // Called by LayerTree.
   gfx::Transform ComputeTransformToParent();
+
+  void UpdateDrawsContent();
   virtual bool HasDrawableContent() const;
+
   virtual void AppendQuads(viz::CompositorRenderPass& render_pass,
                            FrameData& data,
                            const gfx::Transform& transform,
diff --git a/cc/slim/slim_layer_unittest.cc b/cc/slim/slim_layer_unittest.cc
index aeac8cd..27aefed7d 100644
--- a/cc/slim/slim_layer_unittest.cc
+++ b/cc/slim/slim_layer_unittest.cc
@@ -118,9 +118,8 @@
   EXPECT_EQ(layer->transform_origin(), gfx::Point3F(1.f, 2.f, 3.f));
 
   layer->SetIsDrawable(true);
-  layer->SetDrawsContent(true);
   EXPECT_TRUE(layer->draws_content());
-  layer->SetDrawsContent(false);
+  layer->SetIsDrawable(false);
   EXPECT_FALSE(layer->draws_content());
 
   layer->SetBackgroundColor(SkColors::kGray);
diff --git a/cc/slim/ui_resource_layer.cc b/cc/slim/ui_resource_layer.cc
index c199311..fac58b2 100644
--- a/cc/slim/ui_resource_layer.cc
+++ b/cc/slim/ui_resource_layer.cc
@@ -116,7 +116,7 @@
 
   Layer::SetLayerTree(tree);
   RefreshResource();
-  SetDrawsContent(HasDrawableContent());
+  UpdateDrawsContent();
 }
 
 bool UIResourceLayer::HasDrawableContent() const {
@@ -134,7 +134,7 @@
     return;
   }
   resource_id_ = resource_id;
-  SetDrawsContent(HasDrawableContent());
+  UpdateDrawsContent();
   NotifyPropertyChanged();
 }
 
diff --git a/chrome/VERSION b/chrome/VERSION
index 7d945fc..3f40433 100644
--- a/chrome/VERSION
+++ b/chrome/VERSION
@@ -1,4 +1,4 @@
 MAJOR=113
 MINOR=0
-BUILD=5618
+BUILD=5620
 PATCH=0
diff --git a/chrome/android/profiles/arm.newest.txt b/chrome/android/profiles/arm.newest.txt
index 767ce9d..1db2d640 100644
--- a/chrome/android/profiles/arm.newest.txt
+++ b/chrome/android/profiles/arm.newest.txt
@@ -1 +1 @@
-chromeos-chrome-arm-112.0.5614.0_rc-r1-merged.afdo.bz2
+chromeos-chrome-arm-113.0.5618.0_rc-r1-merged.afdo.bz2
diff --git a/chrome/android/profiles/newest.txt b/chrome/android/profiles/newest.txt
index 8ce2119..cbc6fbcc 100644
--- a/chrome/android/profiles/newest.txt
+++ b/chrome/android/profiles/newest.txt
@@ -1 +1 @@
-chromeos-chrome-amd64-112.0.5614.0_rc-r1-merged.afdo.bz2
+chromeos-chrome-amd64-113.0.5618.0_rc-r1-merged.afdo.bz2
diff --git a/chrome/browser/autofill/content_autofill_driver_browsertest.cc b/chrome/browser/autofill/content_autofill_driver_browsertest.cc
index 203db76..5c2c0a8 100644
--- a/chrome/browser/autofill/content_autofill_driver_browsertest.cc
+++ b/chrome/browser/autofill/content_autofill_driver_browsertest.cc
@@ -18,6 +18,7 @@
 #include "components/autofill/content/browser/content_autofill_client.h"
 #include "components/autofill/content/browser/content_autofill_driver.h"
 #include "components/autofill/content/browser/content_autofill_driver_factory.h"
+#include "components/autofill/content/browser/test_autofill_client_injector.h"
 #include "components/autofill/content/browser/test_content_autofill_client.h"
 #include "components/autofill/core/browser/browser_autofill_manager.h"
 #include "components/autofill/core/common/autofill_features.h"
@@ -90,23 +91,8 @@
   }
 
   void SetUpOnMainThread() override {
-    content::WebContents* web_contents =
-        browser()->tab_strip_model()->GetActiveWebContents();
-    ASSERT_TRUE(web_contents != nullptr);
-
-    auto autofill_client =
-        std::make_unique<testing::NiceMock<MockAutofillClient>>(web_contents);
-    autofill_client_ = autofill_client.get();
-    web_contents->SetUserData(autofill_client_->UserDataKey(),
-                              std::move(autofill_client));
-
-    password_manager::ContentPasswordManagerDriverFactoryTestApi(
-        password_manager::ContentPasswordManagerDriverFactory::FromWebContents(
-            web_contents))
-        .SetAutofillClient(autofill_client_);
-
-    Observe(web_contents);
-    prefs::RegisterProfilePrefs(autofill_client_->GetPrefRegistry());
+    Observe(web_contents());
+    prefs::RegisterProfilePrefs(autofill_client().GetPrefRegistry());
 
     // Serve both a.com and b.com (and any other domain).
     host_resolver()->AddRule("*", "127.0.0.1");
@@ -115,9 +101,8 @@
 
   void TearDownOnMainThread() override {
     // Verify the expectations here, because closing the browser may incur
-    // other calls in `autofill_client_` e.g., HideAutofillPopup().
-    testing::Mock::VerifyAndClearExpectations(autofill_client_);
-    web_contents()->RemoveUserData(autofill_client_->UserDataKey());
+    // other calls in `autofill_client()` e.g., HideAutofillPopup().
+    testing::Mock::VerifyAndClearExpectations(&autofill_client());
   }
 
   void OnVisibilityChanged(content::Visibility visibility) override {
@@ -153,8 +138,14 @@
     return browser()->tab_strip_model()->GetActiveWebContents();
   }
 
+  testing::NiceMock<MockAutofillClient>& autofill_client() {
+    auto* client = autofill_client_injector_[web_contents()];
+    CHECK(client);
+    return *client;
+  }
+
   ContentAutofillDriverFactory* autofill_driver_factory() {
-    return autofill_client_->GetAutofillDriverFactory();
+    return autofill_client().GetAutofillDriverFactory();
   }
 
  protected:
@@ -163,13 +154,14 @@
   base::OnceClosure same_document_navigation_callback_;
   base::OnceClosure subframe_navigation_callback_;
 
-  raw_ptr<testing::NiceMock<MockAutofillClient>> autofill_client_;
+  TestAutofillClientInjector<testing::NiceMock<MockAutofillClient>>
+      autofill_client_injector_;
   content::test::PrerenderTestHelper prerender_helper_;
 };
 
 IN_PROC_BROWSER_TEST_F(ContentAutofillDriverBrowserTest,
                        SwitchTabAndHideAutofillPopup) {
-  EXPECT_CALL(*autofill_client_,
+  EXPECT_CALL(autofill_client(),
               HideAutofillPopup(PopupHidingReason::kTabGone));
 
   scoped_refptr<content::MessageLoopRunner> runner =
@@ -189,7 +181,7 @@
   // The Autofill popup should be hidden for same document navigations. It may
   // called twice because the zoom changed event may also fire for same-page
   // navigations.
-  EXPECT_CALL(*autofill_client_,
+  EXPECT_CALL(autofill_client(),
               HideAutofillPopup(PopupHidingReason::kNavigation))
       .Times(testing::AtLeast(1));
 
@@ -213,13 +205,13 @@
   int host_id = content::RenderFrameHost::kNoFrameTreeNodeId;
 
   {
-    EXPECT_CALL(*autofill_client_,
+    EXPECT_CALL(autofill_client(),
                 HideAutofillPopup(PopupHidingReason::kNavigation))
         .Times(0);
     host_id = prerender_helper().AddPrerender(prerender_url);
   }
 
-  EXPECT_CALL(*autofill_client_,
+  EXPECT_CALL(autofill_client(),
               HideAutofillPopup(PopupHidingReason::kNavigation))
       .Times(testing::AtLeast(1));
 
@@ -236,7 +228,7 @@
   ASSERT_TRUE(ui_test_utils::NavigateToURL(browser(), url));
 
   // The Autofill popup should NOT be hidden for subframe navigations.
-  EXPECT_CALL(*autofill_client_, HideAutofillPopup).Times(0);
+  EXPECT_CALL(autofill_client(), HideAutofillPopup).Times(0);
 
   scoped_refptr<content::MessageLoopRunner> runner =
       new content::MessageLoopRunner;
@@ -253,7 +245,7 @@
 IN_PROC_BROWSER_TEST_F(ContentAutofillDriverBrowserTest,
                        TestPageNavigationHidingAutofillPopup) {
   // HideAutofillPopup is called once for each navigation.
-  EXPECT_CALL(*autofill_client_,
+  EXPECT_CALL(autofill_client(),
               HideAutofillPopup(PopupHidingReason::kNavigation))
       .Times(2);
 
diff --git a/chrome/browser/ui/webui/sandbox/sandbox_handler.cc b/chrome/browser/ui/webui/sandbox/sandbox_handler.cc
index dc170b2..03f61ae 100644
--- a/chrome/browser/ui/webui/sandbox/sandbox_handler.cc
+++ b/chrome/browser/ui/webui/sandbox/sandbox_handler.cc
@@ -86,8 +86,6 @@
   features.Append(
       FeatureToValue(sandbox::policy::features::kRendererAppContainer));
   features.Append(
-      FeatureToValue(sandbox::policy::features::kSharedSandboxPolicies));
-  features.Append(
       FeatureToValue(sandbox::policy::features::kWinSboxAllowSystemFonts));
   features.Append(FeatureToValue(
       sandbox::policy::features::kWinSboxDisableExtensionPoints));
diff --git a/chrome/build/linux.pgo.txt b/chrome/build/linux.pgo.txt
index f58058f..a1bbf4b 100644
--- a/chrome/build/linux.pgo.txt
+++ b/chrome/build/linux.pgo.txt
@@ -1 +1 @@
-chrome-linux-main-1677325687-e9ed98a1c0172f665267b0180b30b66fb5642377.profdata
+chrome-linux-main-1677433889-82b36ee885514074beccdfef2261d6acb63710b0.profdata
diff --git a/chrome/build/mac-arm.pgo.txt b/chrome/build/mac-arm.pgo.txt
index dca0653f..4634766 100644
--- a/chrome/build/mac-arm.pgo.txt
+++ b/chrome/build/mac-arm.pgo.txt
@@ -1 +1 @@
-chrome-mac-arm-main-1677338906-b9c0e5becf8509eaa629709ab75159c28529bd65.profdata
+chrome-mac-arm-main-1677433889-51cd7763160cf894ac2e3f04d83603492c7053b8.profdata
diff --git a/chrome/build/mac.pgo.txt b/chrome/build/mac.pgo.txt
index e9151f6e..39ab4e4 100644
--- a/chrome/build/mac.pgo.txt
+++ b/chrome/build/mac.pgo.txt
@@ -1 +1 @@
-chrome-mac-main-1677325687-b4a26b2af72a0856f88475dedfd3b1d6bbedc4b2.profdata
+chrome-mac-main-1677433889-271889b8db6785298212cd0239abb7a9aa808d8f.profdata
diff --git a/chrome/build/win32.pgo.txt b/chrome/build/win32.pgo.txt
index acd9a31..9683ad7 100644
--- a/chrome/build/win32.pgo.txt
+++ b/chrome/build/win32.pgo.txt
@@ -1 +1 @@
-chrome-win32-main-1677336968-237a841210a2e72d37c32a254b7ddffaaf07ade8.profdata
+chrome-win32-main-1677433889-e45a432e14196d597293a9def389f2a5106c47f2.profdata
diff --git a/chrome/build/win64.pgo.txt b/chrome/build/win64.pgo.txt
index ebdaead..08eb08ce 100644
--- a/chrome/build/win64.pgo.txt
+++ b/chrome/build/win64.pgo.txt
@@ -1 +1 @@
-chrome-win64-main-1677325687-322ee1904efb0a9e8b7f5bde4c45c12a650bd9a9.profdata
+chrome-win64-main-1677433889-133af8ab76ea97f41f12ff8681a4f38c2e5294b6.profdata
diff --git a/chromeos/CHROMEOS_LKGM b/chromeos/CHROMEOS_LKGM
index 7326223..1392890 100644
--- a/chromeos/CHROMEOS_LKGM
+++ b/chromeos/CHROMEOS_LKGM
@@ -1 +1 @@
-15359.0.0
\ No newline at end of file
+15364.0.0
\ No newline at end of file
diff --git a/components/certificate_transparency/data/log_list.json b/components/certificate_transparency/data/log_list.json
index 0893924..c3b60a7 100644
--- a/components/certificate_transparency/data/log_list.json
+++ b/components/certificate_transparency/data/log_list.json
@@ -1,6 +1,6 @@
 {
-  "version": "19.22",
-  "log_list_timestamp": "2023-02-25T12:56:28Z",
+  "version": "19.23",
+  "log_list_timestamp": "2023-02-26T12:55:38Z",
   "operators": [
     {
       "name": "Google",
diff --git a/content/browser/devtools/protocol/target_handler.cc b/content/browser/devtools/protocol/target_handler.cc
index 2a4010833..ca413bf 100644
--- a/content/browser/devtools/protocol/target_handler.cc
+++ b/content/browser/devtools/protocol/target_handler.cc
@@ -619,9 +619,12 @@
   CleanupPointers();
   agent_host_ = nullptr;
   auto_attacher_ = nullptr;
-  if (is_deferring_)
+  if (is_deferring_) {
+    is_deferring_ = false;
     Resume();
-  is_deferring_ = false;
+    // DO NOT ADD CODE after this. The callback above might have destroyed the
+    // NavigationHandle that owns this NavigationThrottle.
+  }
 }
 
 class TargetHandler::TargetFilter {
diff --git a/content/browser/renderer_host/navigation_request.cc b/content/browser/renderer_host/navigation_request.cc
index 85de1611..1f508b13 100644
--- a/content/browser/renderer_host/navigation_request.cc
+++ b/content/browser/renderer_host/navigation_request.cc
@@ -8699,10 +8699,14 @@
   // ended, so the navigation can resume if it is currently waiting for this
   // signal.
   renderer_cancellation_window_ended_ = true;
+  renderer_cancellation_listener_.reset();
   if (renderer_cancellation_window_ended_callback_) {
     std::move(renderer_cancellation_window_ended_callback_).Run();
+    // DO NOT ADD CODE after this. The callback triggers
+    // RendererCancellationThrottle::NavigationCancellationWindowEnded() and
+    // eventually NavigationThrottle::Resume(), which might have destroyed the
+    // NavigationRequest.
   }
-  renderer_cancellation_listener_.reset();
 }
 
 bool NavigationRequest::ShouldWaitForRendererCancellationWindowToEnd() {
diff --git a/content/test/gpu/PRESUBMIT.py b/content/test/gpu/PRESUBMIT.py
index 527807f..154c58f 100644
--- a/content/test/gpu/PRESUBMIT.py
+++ b/content/test/gpu/PRESUBMIT.py
@@ -143,7 +143,7 @@
   """Checks that run_pytype.py's paths are in sync with PRESUBMIT.py's"""
   filepath = input_api.os_path.join(input_api.PresubmitLocalPath(),
                                     'run_pytype.py')
-  with open(filepath) as infile:
+  with open(filepath, encoding='utf-8') as infile:
     contents = infile.read()
   # Grab the EXTRA_PATHS_COMPONENTS = [...] portion as a string.
   match = input_api.re.search(r'(EXTRA_PATHS_COMPONENTS\s*=\s*[^=]*\]\n)',
diff --git a/content/test/gpu/gpu_tests/test_expectations/webgl2_conformance_expectations.txt b/content/test/gpu/gpu_tests/test_expectations/webgl2_conformance_expectations.txt
index acf1f83c..a63f61c2 100644
--- a/content/test/gpu/gpu_tests/test_expectations/webgl2_conformance_expectations.txt
+++ b/content/test/gpu/gpu_tests/test_expectations/webgl2_conformance_expectations.txt
@@ -632,7 +632,7 @@
 crbug.com/1382796 [ android android-pixel-4 angle-opengles passthrough ] deqp/functional/gles3/primitiverestart/00.html [ RetryOnFailure ]
 crbug.com/1382796 [ android android-pixel-4 angle-opengles passthrough ] deqp/functional/gles3/textureshadow/* [ RetryOnFailure ]
 crbug.com/1382796 [ android android-pixel-4 ] conformance/textures/image_bitmap_from_video/* [ RetryOnFailure ]
-crbug.com/1382796 [ android android-pixel-4 ] conformance/textures/video/* [ RetryOnFailure ]
+crbug.com/1382796 [ android android-pixel-4 angle-opengles passthrough ] conformance/textures/video/* [ RetryOnFailure ]
 crbug.com/1382796 [ android android-pixel-4 ] conformance2/textures/image_bitmap_from_video/* [ RetryOnFailure ]
 crbug.com/1382796 [ android android-pixel-4 angle-opengles passthrough ] conformance2/textures/video/* [ RetryOnFailure ]
 # finder:group-end
@@ -683,7 +683,6 @@
 crbug.com/1241183 [ chromeos chromeos-board-amd64-generic passthrough ] conformance2/textures/misc/immutable-tex-render-feedback.html [ Failure ]
 crbug.com/1399117 [ chromeos chromeos-board-amd64-generic passthrough ] WebglExtension_WEBGL_provoking_vertex [ Skip ]
 crbug.com/1401968 [ chromeos chromeos-board-amd64-generic passthrough ] conformance2/textures/video/tex-3d-rgb16f-rgb-half_float.html [ RetryOnFailure ]
-crbug.com/1401968 [ chromeos chromeos-board-amd64-generic passthrough ] conformance2/textures/video/tex-3d-rg32f-rg-float.html [ RetryOnFailure ]
 
 
 # Must investigate ChromeOS failures with passthrough command decoder.
diff --git a/fuchsia_web/webengine/browser/navigation_policy_throttle.cc b/fuchsia_web/webengine/browser/navigation_policy_throttle.cc
index b4b51960..0c869c3 100644
--- a/fuchsia_web/webengine/browser/navigation_policy_throttle.cc
+++ b/fuchsia_web/webengine/browser/navigation_policy_throttle.cc
@@ -47,29 +47,35 @@
 
 void NavigationPolicyThrottle::OnNavigationPolicyProviderDisconnected(
     content::NavigationThrottle::ThrottleCheckResult check_result) {
-  if (is_paused_) {
-    CancelDeferredNavigation(check_result);
-    is_paused_ = false;
-  }
-
   policy_handler_ = nullptr;
+
+  if (is_paused_) {
+    is_paused_ = false;
+    CancelDeferredNavigation(check_result);
+    // DO NOT ADD CODE after this. The callback above will destroy the
+    // NavigationHandle that owns this NavigationThrottle.
+  }
 }
 
 void NavigationPolicyThrottle::OnRequestedNavigationEvaluated(
     fuchsia::web::NavigationDecision decision) {
   DCHECK(is_paused_);
+  is_paused_ = false;
 
   switch (decision.Which()) {
     case fuchsia::web::NavigationDecision::kProceed:
       Resume();
+      // DO NOT ADD CODE after this. The callback above might have destroyed
+      // the NavigationHandle that owns this NavigationThrottle.
       break;
     case fuchsia::web::NavigationDecision::kAbort:
       CancelDeferredNavigation(content::NavigationThrottle::CANCEL);
+      // DO NOT ADD CODE after this. The callback above will destroy the
+      // NavigationHandle that owns this NavigationThrottle.
       break;
     default:
       NOTREACHED();
   }
-  is_paused_ = false;
 }
 
 content::NavigationThrottle::ThrottleCheckResult
diff --git a/ios/google_internal/frameworks/ChromeInternal.framework.dSYM.ios.zip.sha1 b/ios/google_internal/frameworks/ChromeInternal.framework.dSYM.ios.zip.sha1
index 858e0a7..14ef4769 100644
--- a/ios/google_internal/frameworks/ChromeInternal.framework.dSYM.ios.zip.sha1
+++ b/ios/google_internal/frameworks/ChromeInternal.framework.dSYM.ios.zip.sha1
@@ -1 +1 @@
-cabd0d44e79f4dfb83ae0d8269e9738e4f1f71bc
\ No newline at end of file
+3835eaadf7a9a498e852e4c695834ffdb1d64080
\ No newline at end of file
diff --git a/ios/google_internal/frameworks/ChromeSSOInternal.framework.dSYM.ios.zip.sha1 b/ios/google_internal/frameworks/ChromeSSOInternal.framework.dSYM.ios.zip.sha1
index 46b27454..aa3cf58 100644
--- a/ios/google_internal/frameworks/ChromeSSOInternal.framework.dSYM.ios.zip.sha1
+++ b/ios/google_internal/frameworks/ChromeSSOInternal.framework.dSYM.ios.zip.sha1
@@ -1 +1 @@
-d6587c6797bbe643ebe2f754ff9ea2e113b845d9
\ No newline at end of file
+2e439d58f293734e5682bd1ffa2509458d9a3467
\ No newline at end of file
diff --git a/ios/google_internal/frameworks/chrome_internal_dynamic_framework.ios.zip.sha1 b/ios/google_internal/frameworks/chrome_internal_dynamic_framework.ios.zip.sha1
index 6beae87..66a9761 100644
--- a/ios/google_internal/frameworks/chrome_internal_dynamic_framework.ios.zip.sha1
+++ b/ios/google_internal/frameworks/chrome_internal_dynamic_framework.ios.zip.sha1
@@ -1 +1 @@
-50c57f5b5ca591dbf08c79bb42f104321f7d78d1
\ No newline at end of file
+acbaea9bbb1a59470ae9c2a2d1b83e1c3332d4a6
\ No newline at end of file
diff --git a/ios/google_internal/frameworks/chrome_internal_dynamic_framework.iossimulator.zip.sha1 b/ios/google_internal/frameworks/chrome_internal_dynamic_framework.iossimulator.zip.sha1
index fadf6de..bab4c23 100644
--- a/ios/google_internal/frameworks/chrome_internal_dynamic_framework.iossimulator.zip.sha1
+++ b/ios/google_internal/frameworks/chrome_internal_dynamic_framework.iossimulator.zip.sha1
@@ -1 +1 @@
-d22756691e95609c53c9fc0a14fcec741626c810
\ No newline at end of file
+1666bc711715c7d8175ea2389adb8365376b3094
\ No newline at end of file
diff --git a/ios/google_internal/frameworks/chrome_sso_internal_dynamic_framework.ios.zip.sha1 b/ios/google_internal/frameworks/chrome_sso_internal_dynamic_framework.ios.zip.sha1
index d00545d..2eaca2f 100644
--- a/ios/google_internal/frameworks/chrome_sso_internal_dynamic_framework.ios.zip.sha1
+++ b/ios/google_internal/frameworks/chrome_sso_internal_dynamic_framework.ios.zip.sha1
@@ -1 +1 @@
-1ad14f5c3d261b778975f777e6779c4b67fbcbca
\ No newline at end of file
+ecfeae56926f5aa33d0a6faff847adf3880e59ba
\ No newline at end of file
diff --git a/ios/google_internal/frameworks/chrome_sso_internal_dynamic_framework.iossimulator.zip.sha1 b/ios/google_internal/frameworks/chrome_sso_internal_dynamic_framework.iossimulator.zip.sha1
index 83454c6f..107bc9e 100644
--- a/ios/google_internal/frameworks/chrome_sso_internal_dynamic_framework.iossimulator.zip.sha1
+++ b/ios/google_internal/frameworks/chrome_sso_internal_dynamic_framework.iossimulator.zip.sha1
@@ -1 +1 @@
-826a642c3812164042fb79c8d1ff6a2bb85cf4c3
\ No newline at end of file
+780e8ca0413c6de6593531a5cb727f1755d2e80a
\ No newline at end of file
diff --git a/ios/google_internal/frameworks/chrome_test_internal_dynamic_framework.ios.zip.sha1 b/ios/google_internal/frameworks/chrome_test_internal_dynamic_framework.ios.zip.sha1
index 9396706..2d2eded8 100644
--- a/ios/google_internal/frameworks/chrome_test_internal_dynamic_framework.ios.zip.sha1
+++ b/ios/google_internal/frameworks/chrome_test_internal_dynamic_framework.ios.zip.sha1
@@ -1 +1 @@
-ed4fad8107412ee37be0c9813a1a74fbf945c483
\ No newline at end of file
+57ff52aedd92bf9f918254f9dfb649fa63db7de9
\ No newline at end of file
diff --git a/ios/google_internal/frameworks/chrome_test_internal_dynamic_framework.iossimulator.zip.sha1 b/ios/google_internal/frameworks/chrome_test_internal_dynamic_framework.iossimulator.zip.sha1
index fc9eae1..b948565 100644
--- a/ios/google_internal/frameworks/chrome_test_internal_dynamic_framework.iossimulator.zip.sha1
+++ b/ios/google_internal/frameworks/chrome_test_internal_dynamic_framework.iossimulator.zip.sha1
@@ -1 +1 @@
-44f40462231c20f846c4c5c8328e87bea1d32acd
\ No newline at end of file
+efcc3142a7bb06604f745d3c89563de3b17c0838
\ No newline at end of file
diff --git a/ios/google_internal/frameworks/remoting_internal_dynamic_framework.ios.zip.sha1 b/ios/google_internal/frameworks/remoting_internal_dynamic_framework.ios.zip.sha1
index 7f76cf3d..5cc744e9 100644
--- a/ios/google_internal/frameworks/remoting_internal_dynamic_framework.ios.zip.sha1
+++ b/ios/google_internal/frameworks/remoting_internal_dynamic_framework.ios.zip.sha1
@@ -1 +1 @@
-18788b0aa059d18d50abeb481505a56c58a226b5
\ No newline at end of file
+dd1d8a1ac4d9ebae36e3fe601ed5b9bde017f310
\ No newline at end of file
diff --git a/ios/google_internal/frameworks/remoting_internal_dynamic_framework.iossimulator.zip.sha1 b/ios/google_internal/frameworks/remoting_internal_dynamic_framework.iossimulator.zip.sha1
index 4750b55..af675fe 100644
--- a/ios/google_internal/frameworks/remoting_internal_dynamic_framework.iossimulator.zip.sha1
+++ b/ios/google_internal/frameworks/remoting_internal_dynamic_framework.iossimulator.zip.sha1
@@ -1 +1 @@
-1eeb7e5f8107e121bc280e2d6c6dec009fcedc32
\ No newline at end of file
+74031a5163ec14d6351e716deb400e4b53a16724
\ No newline at end of file
diff --git a/ios/google_internal/frameworks/web_view_shell_internal_dynamic_framework.ios.zip.sha1 b/ios/google_internal/frameworks/web_view_shell_internal_dynamic_framework.ios.zip.sha1
index c0fa1ea..cd2a984 100644
--- a/ios/google_internal/frameworks/web_view_shell_internal_dynamic_framework.ios.zip.sha1
+++ b/ios/google_internal/frameworks/web_view_shell_internal_dynamic_framework.ios.zip.sha1
@@ -1 +1 @@
-4ddb88a74ecc22cdbd697e2ad8c380008ca2cc4f
\ No newline at end of file
+2aa29d51b443f0eb6f904297ced52236f7cf47d3
\ No newline at end of file
diff --git a/ios/google_internal/frameworks/web_view_shell_internal_dynamic_framework.iossimulator.zip.sha1 b/ios/google_internal/frameworks/web_view_shell_internal_dynamic_framework.iossimulator.zip.sha1
index d166286..9150da8 100644
--- a/ios/google_internal/frameworks/web_view_shell_internal_dynamic_framework.iossimulator.zip.sha1
+++ b/ios/google_internal/frameworks/web_view_shell_internal_dynamic_framework.iossimulator.zip.sha1
@@ -1 +1 @@
-4bad42f04164f3561bacb57071d3bfec93c5abb1
\ No newline at end of file
+13e345756ffb7e2bceb8bf97fb1307b12c532275
\ No newline at end of file
diff --git a/net/http/transport_security_state_static.pins b/net/http/transport_security_state_static.pins
index 41f3265..44fc59da 100644
--- a/net/http/transport_security_state_static.pins
+++ b/net/http/transport_security_state_static.pins
@@ -43,9 +43,9 @@
 #   hash function for preloaded entries again (we have already done so once).
 #
 
-# Last updated: 2023-02-25 12:56 UTC
+# Last updated: 2023-02-26 12:55 UTC
 PinsListTimestamp
-1677329788
+1677416138
 
 TestSPKI
 sha256/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
diff --git a/sandbox/policy/features.cc b/sandbox/policy/features.cc
index d9c6354..930deb4 100644
--- a/sandbox/policy/features.cc
+++ b/sandbox/policy/features.cc
@@ -40,11 +40,6 @@
              "RendererAppContainer",
              base::FEATURE_DISABLED_BY_DEFAULT);
 
-// Enables shared/fixed policy for Windows sandbox policies.
-BASE_FEATURE(kSharedSandboxPolicies,
-             "SharedSandboxPolicies",
-             base::FEATURE_ENABLED_BY_DEFAULT);
-
 // Emergency "off switch" for renderer environment filtering, this feature can
 // be removed around the M113 timeline. See https://crbug.com/1403087.
 BASE_FEATURE(kRendererFilterEnvironment,
diff --git a/sandbox/policy/features.h b/sandbox/policy/features.h
index f187b14..9e6ca56d 100644
--- a/sandbox/policy/features.h
+++ b/sandbox/policy/features.h
@@ -24,7 +24,6 @@
 SANDBOX_POLICY_EXPORT BASE_DECLARE_FEATURE(kGpuAppContainer);
 SANDBOX_POLICY_EXPORT BASE_DECLARE_FEATURE(kGpuLPAC);
 SANDBOX_POLICY_EXPORT BASE_DECLARE_FEATURE(kRendererAppContainer);
-SANDBOX_POLICY_EXPORT BASE_DECLARE_FEATURE(kSharedSandboxPolicies);
 SANDBOX_POLICY_EXPORT BASE_DECLARE_FEATURE(kRendererFilterEnvironment);
 SANDBOX_POLICY_EXPORT BASE_DECLARE_FEATURE(kWinSboxAllowSystemFonts);
 #endif  // BUILDFLAG(IS_WIN)
diff --git a/sandbox/policy/win/sandbox_win.cc b/sandbox/policy/win/sandbox_win.cc
index 3aeae83..20ca797 100644
--- a/sandbox/policy/win/sandbox_win.cc
+++ b/sandbox/policy/win/sandbox_win.cc
@@ -1018,11 +1018,7 @@
                                 process);
   }
 
-  std::string tag;
-  if (base::FeatureList::IsEnabled(features::kSharedSandboxPolicies))
-    tag = delegate->GetSandboxTag();
-
-  auto policy = g_broker_services->CreatePolicy(tag);
+  auto policy = g_broker_services->CreatePolicy(delegate->GetSandboxTag());
   ResultCode result = GeneratePolicyForSandboxedProcess(
       cmd_line, process_type, handles_to_inherit, delegate, policy.get());
   if (SBOX_ALL_OK != result)
diff --git a/testing/buildbot/OWNERS b/testing/buildbot/OWNERS
index f66d3e7..2280c941 100644
--- a/testing/buildbot/OWNERS
+++ b/testing/buildbot/OWNERS
@@ -68,6 +68,10 @@
 per-file *openscreen*.json=mfoltz@chromium.org
 per-file *openscreen*.json=rwkeane@google.com
 
+# Code Coverage
+per-file chromium.coverage.json=jeffyoon@google.com
+per-file chromium.coverage.json=pasthana@google.com
+
 # Any non-trivial change to a *.pyl file has corresponding changes to at least
 # one *.json file. Consequently, any change to a *.pyl file will still need
 # approval according to the per-file OWNERS rules above. Giving '*' ownership
diff --git a/testing/buildbot/chromium.chromiumos.json b/testing/buildbot/chromium.chromiumos.json
index cd3919d2..c3b8a05 100644
--- a/testing/buildbot/chromium.chromiumos.json
+++ b/testing/buildbot/chromium.chromiumos.json
@@ -5818,9 +5818,9 @@
       {
         "args": [
           "--test-launcher-filter-file=../../testing/buildbot/filters/linux-lacros.interactive_ui_tests.filter;../../testing/buildbot/filters/linux-lacros.interactive_ui_tests.skew.filter",
-          "--ash-chrome-path-override=../../lacros_version_skew_tests_v113.0.5616.0/test_ash_chrome"
+          "--ash-chrome-path-override=../../lacros_version_skew_tests_v113.0.5619.0/test_ash_chrome"
         ],
-        "description": "Run with ash-chrome version 113.0.5616.0",
+        "description": "Run with ash-chrome version 113.0.5619.0",
         "isolate_profile_data": true,
         "merge": {
           "args": [],
@@ -5832,8 +5832,8 @@
           "cipd_packages": [
             {
               "cipd_package": "chromium/testing/linux-ash-chromium/x86_64/ash.zip",
-              "location": "lacros_version_skew_tests_v113.0.5616.0",
-              "revision": "version:113.0.5616.0"
+              "location": "lacros_version_skew_tests_v113.0.5619.0",
+              "revision": "version:113.0.5619.0"
             }
           ],
           "dimension_sets": [
@@ -5989,9 +5989,9 @@
       {
         "args": [
           "--test-launcher-filter-file=../../testing/buildbot/filters/linux-lacros.lacros_chrome_browsertests.skew.filter",
-          "--ash-chrome-path-override=../../lacros_version_skew_tests_v113.0.5616.0/test_ash_chrome"
+          "--ash-chrome-path-override=../../lacros_version_skew_tests_v113.0.5619.0/test_ash_chrome"
         ],
-        "description": "Run with ash-chrome version 113.0.5616.0",
+        "description": "Run with ash-chrome version 113.0.5619.0",
         "isolate_profile_data": true,
         "merge": {
           "args": [],
@@ -6003,8 +6003,8 @@
           "cipd_packages": [
             {
               "cipd_package": "chromium/testing/linux-ash-chromium/x86_64/ash.zip",
-              "location": "lacros_version_skew_tests_v113.0.5616.0",
-              "revision": "version:113.0.5616.0"
+              "location": "lacros_version_skew_tests_v113.0.5619.0",
+              "revision": "version:113.0.5619.0"
             }
           ],
           "dimension_sets": [
@@ -6141,9 +6141,9 @@
       {
         "args": [
           "--test-launcher-filter-file=../../testing/buildbot/filters/linux-lacros.lacros_chrome_browsertests.skew.filter",
-          "--ash-chrome-path-override=../../lacros_version_skew_tests_v113.0.5616.0/test_ash_chrome"
+          "--ash-chrome-path-override=../../lacros_version_skew_tests_v113.0.5619.0/test_ash_chrome"
         ],
-        "description": "Run with ash-chrome version 113.0.5616.0",
+        "description": "Run with ash-chrome version 113.0.5619.0",
         "isolate_profile_data": true,
         "merge": {
           "args": [],
@@ -6155,8 +6155,8 @@
           "cipd_packages": [
             {
               "cipd_package": "chromium/testing/linux-ash-chromium/x86_64/ash.zip",
-              "location": "lacros_version_skew_tests_v113.0.5616.0",
-              "revision": "version:113.0.5616.0"
+              "location": "lacros_version_skew_tests_v113.0.5619.0",
+              "revision": "version:113.0.5619.0"
             }
           ],
           "dimension_sets": [
diff --git a/testing/buildbot/chromium.coverage.json b/testing/buildbot/chromium.coverage.json
index 0b8c847..ea24134 100644
--- a/testing/buildbot/chromium.coverage.json
+++ b/testing/buildbot/chromium.coverage.json
@@ -20486,9 +20486,9 @@
       {
         "args": [
           "--test-launcher-filter-file=../../testing/buildbot/filters/linux-lacros.interactive_ui_tests.filter;../../testing/buildbot/filters/linux-lacros.interactive_ui_tests.skew.filter",
-          "--ash-chrome-path-override=../../lacros_version_skew_tests_v113.0.5616.0/test_ash_chrome"
+          "--ash-chrome-path-override=../../lacros_version_skew_tests_v113.0.5619.0/test_ash_chrome"
         ],
-        "description": "Run with ash-chrome version 113.0.5616.0",
+        "description": "Run with ash-chrome version 113.0.5619.0",
         "isolate_profile_data": true,
         "merge": {
           "args": [],
@@ -20500,8 +20500,8 @@
           "cipd_packages": [
             {
               "cipd_package": "chromium/testing/linux-ash-chromium/x86_64/ash.zip",
-              "location": "lacros_version_skew_tests_v113.0.5616.0",
-              "revision": "version:113.0.5616.0"
+              "location": "lacros_version_skew_tests_v113.0.5619.0",
+              "revision": "version:113.0.5619.0"
             }
           ],
           "dimension_sets": [
@@ -20657,9 +20657,9 @@
       {
         "args": [
           "--test-launcher-filter-file=../../testing/buildbot/filters/linux-lacros.lacros_chrome_browsertests.skew.filter",
-          "--ash-chrome-path-override=../../lacros_version_skew_tests_v113.0.5616.0/test_ash_chrome"
+          "--ash-chrome-path-override=../../lacros_version_skew_tests_v113.0.5619.0/test_ash_chrome"
         ],
-        "description": "Run with ash-chrome version 113.0.5616.0",
+        "description": "Run with ash-chrome version 113.0.5619.0",
         "isolate_profile_data": true,
         "merge": {
           "args": [],
@@ -20671,8 +20671,8 @@
           "cipd_packages": [
             {
               "cipd_package": "chromium/testing/linux-ash-chromium/x86_64/ash.zip",
-              "location": "lacros_version_skew_tests_v113.0.5616.0",
-              "revision": "version:113.0.5616.0"
+              "location": "lacros_version_skew_tests_v113.0.5619.0",
+              "revision": "version:113.0.5619.0"
             }
           ],
           "dimension_sets": [
@@ -20809,9 +20809,9 @@
       {
         "args": [
           "--test-launcher-filter-file=../../testing/buildbot/filters/linux-lacros.lacros_chrome_browsertests.skew.filter",
-          "--ash-chrome-path-override=../../lacros_version_skew_tests_v113.0.5616.0/test_ash_chrome"
+          "--ash-chrome-path-override=../../lacros_version_skew_tests_v113.0.5619.0/test_ash_chrome"
         ],
-        "description": "Run with ash-chrome version 113.0.5616.0",
+        "description": "Run with ash-chrome version 113.0.5619.0",
         "isolate_profile_data": true,
         "merge": {
           "args": [],
@@ -20823,8 +20823,8 @@
           "cipd_packages": [
             {
               "cipd_package": "chromium/testing/linux-ash-chromium/x86_64/ash.zip",
-              "location": "lacros_version_skew_tests_v113.0.5616.0",
-              "revision": "version:113.0.5616.0"
+              "location": "lacros_version_skew_tests_v113.0.5619.0",
+              "revision": "version:113.0.5619.0"
             }
           ],
           "dimension_sets": [
diff --git a/testing/buildbot/chromium.fyi.json b/testing/buildbot/chromium.fyi.json
index 4e53565..8f061b3 100644
--- a/testing/buildbot/chromium.fyi.json
+++ b/testing/buildbot/chromium.fyi.json
@@ -48776,9 +48776,9 @@
       {
         "args": [
           "--test-launcher-filter-file=../../testing/buildbot/filters/linux-lacros.interactive_ui_tests.filter;../../testing/buildbot/filters/linux-lacros.interactive_ui_tests.skew.filter",
-          "--ash-chrome-path-override=../../lacros_version_skew_tests_v113.0.5616.0/test_ash_chrome"
+          "--ash-chrome-path-override=../../lacros_version_skew_tests_v113.0.5619.0/test_ash_chrome"
         ],
-        "description": "Run with ash-chrome version 113.0.5616.0",
+        "description": "Run with ash-chrome version 113.0.5619.0",
         "merge": {
           "args": [],
           "script": "//testing/merge_scripts/standard_gtest_merge.py"
@@ -48789,8 +48789,8 @@
           "cipd_packages": [
             {
               "cipd_package": "chromium/testing/linux-ash-chromium/x86_64/ash.zip",
-              "location": "lacros_version_skew_tests_v113.0.5616.0",
-              "revision": "version:113.0.5616.0"
+              "location": "lacros_version_skew_tests_v113.0.5619.0",
+              "revision": "version:113.0.5619.0"
             }
           ],
           "dimension_sets": [
@@ -48947,9 +48947,9 @@
       {
         "args": [
           "--test-launcher-filter-file=../../testing/buildbot/filters/linux-lacros.lacros_chrome_browsertests.skew.filter",
-          "--ash-chrome-path-override=../../lacros_version_skew_tests_v113.0.5616.0/test_ash_chrome"
+          "--ash-chrome-path-override=../../lacros_version_skew_tests_v113.0.5619.0/test_ash_chrome"
         ],
-        "description": "Run with ash-chrome version 113.0.5616.0",
+        "description": "Run with ash-chrome version 113.0.5619.0",
         "merge": {
           "args": [],
           "script": "//testing/merge_scripts/standard_gtest_merge.py"
@@ -48960,8 +48960,8 @@
           "cipd_packages": [
             {
               "cipd_package": "chromium/testing/linux-ash-chromium/x86_64/ash.zip",
-              "location": "lacros_version_skew_tests_v113.0.5616.0",
-              "revision": "version:113.0.5616.0"
+              "location": "lacros_version_skew_tests_v113.0.5619.0",
+              "revision": "version:113.0.5619.0"
             }
           ],
           "dimension_sets": [
@@ -49099,9 +49099,9 @@
       {
         "args": [
           "--test-launcher-filter-file=../../testing/buildbot/filters/linux-lacros.lacros_chrome_browsertests.skew.filter",
-          "--ash-chrome-path-override=../../lacros_version_skew_tests_v113.0.5616.0/test_ash_chrome"
+          "--ash-chrome-path-override=../../lacros_version_skew_tests_v113.0.5619.0/test_ash_chrome"
         ],
-        "description": "Run with ash-chrome version 113.0.5616.0",
+        "description": "Run with ash-chrome version 113.0.5619.0",
         "merge": {
           "args": [],
           "script": "//testing/merge_scripts/standard_gtest_merge.py"
@@ -49112,8 +49112,8 @@
           "cipd_packages": [
             {
               "cipd_package": "chromium/testing/linux-ash-chromium/x86_64/ash.zip",
-              "location": "lacros_version_skew_tests_v113.0.5616.0",
-              "revision": "version:113.0.5616.0"
+              "location": "lacros_version_skew_tests_v113.0.5619.0",
+              "revision": "version:113.0.5619.0"
             }
           ],
           "dimension_sets": [
@@ -50637,9 +50637,9 @@
       {
         "args": [
           "--test-launcher-filter-file=../../testing/buildbot/filters/linux-lacros.interactive_ui_tests.filter;../../testing/buildbot/filters/linux-lacros.interactive_ui_tests.skew.filter",
-          "--ash-chrome-path-override=../../lacros_version_skew_tests_v113.0.5616.0/test_ash_chrome"
+          "--ash-chrome-path-override=../../lacros_version_skew_tests_v113.0.5619.0/test_ash_chrome"
         ],
-        "description": "Run with ash-chrome version 113.0.5616.0",
+        "description": "Run with ash-chrome version 113.0.5619.0",
         "merge": {
           "args": [],
           "script": "//testing/merge_scripts/standard_gtest_merge.py"
@@ -50650,8 +50650,8 @@
           "cipd_packages": [
             {
               "cipd_package": "chromium/testing/linux-ash-chromium/x86_64/ash.zip",
-              "location": "lacros_version_skew_tests_v113.0.5616.0",
-              "revision": "version:113.0.5616.0"
+              "location": "lacros_version_skew_tests_v113.0.5619.0",
+              "revision": "version:113.0.5619.0"
             }
           ],
           "dimension_sets": [
@@ -50808,9 +50808,9 @@
       {
         "args": [
           "--test-launcher-filter-file=../../testing/buildbot/filters/linux-lacros.lacros_chrome_browsertests.skew.filter",
-          "--ash-chrome-path-override=../../lacros_version_skew_tests_v113.0.5616.0/test_ash_chrome"
+          "--ash-chrome-path-override=../../lacros_version_skew_tests_v113.0.5619.0/test_ash_chrome"
         ],
-        "description": "Run with ash-chrome version 113.0.5616.0",
+        "description": "Run with ash-chrome version 113.0.5619.0",
         "merge": {
           "args": [],
           "script": "//testing/merge_scripts/standard_gtest_merge.py"
@@ -50821,8 +50821,8 @@
           "cipd_packages": [
             {
               "cipd_package": "chromium/testing/linux-ash-chromium/x86_64/ash.zip",
-              "location": "lacros_version_skew_tests_v113.0.5616.0",
-              "revision": "version:113.0.5616.0"
+              "location": "lacros_version_skew_tests_v113.0.5619.0",
+              "revision": "version:113.0.5619.0"
             }
           ],
           "dimension_sets": [
@@ -50960,9 +50960,9 @@
       {
         "args": [
           "--test-launcher-filter-file=../../testing/buildbot/filters/linux-lacros.lacros_chrome_browsertests.skew.filter",
-          "--ash-chrome-path-override=../../lacros_version_skew_tests_v113.0.5616.0/test_ash_chrome"
+          "--ash-chrome-path-override=../../lacros_version_skew_tests_v113.0.5619.0/test_ash_chrome"
         ],
-        "description": "Run with ash-chrome version 113.0.5616.0",
+        "description": "Run with ash-chrome version 113.0.5619.0",
         "merge": {
           "args": [],
           "script": "//testing/merge_scripts/standard_gtest_merge.py"
@@ -50973,8 +50973,8 @@
           "cipd_packages": [
             {
               "cipd_package": "chromium/testing/linux-ash-chromium/x86_64/ash.zip",
-              "location": "lacros_version_skew_tests_v113.0.5616.0",
-              "revision": "version:113.0.5616.0"
+              "location": "lacros_version_skew_tests_v113.0.5619.0",
+              "revision": "version:113.0.5619.0"
             }
           ],
           "dimension_sets": [
@@ -51746,9 +51746,9 @@
       {
         "args": [
           "--test-launcher-filter-file=../../testing/buildbot/filters/linux-lacros.interactive_ui_tests.filter;../../testing/buildbot/filters/linux-lacros.interactive_ui_tests.skew.filter",
-          "--ash-chrome-path-override=../../lacros_version_skew_tests_v113.0.5616.0/test_ash_chrome"
+          "--ash-chrome-path-override=../../lacros_version_skew_tests_v113.0.5619.0/test_ash_chrome"
         ],
-        "description": "Run with ash-chrome version 113.0.5616.0",
+        "description": "Run with ash-chrome version 113.0.5619.0",
         "merge": {
           "args": [],
           "script": "//testing/merge_scripts/standard_gtest_merge.py"
@@ -51759,8 +51759,8 @@
           "cipd_packages": [
             {
               "cipd_package": "chromium/testing/linux-ash-chromium/x86_64/ash.zip",
-              "location": "lacros_version_skew_tests_v113.0.5616.0",
-              "revision": "version:113.0.5616.0"
+              "location": "lacros_version_skew_tests_v113.0.5619.0",
+              "revision": "version:113.0.5619.0"
             }
           ],
           "dimension_sets": [
diff --git a/testing/buildbot/chromium.memory.json b/testing/buildbot/chromium.memory.json
index 5aeb690..21d8f58 100644
--- a/testing/buildbot/chromium.memory.json
+++ b/testing/buildbot/chromium.memory.json
@@ -18533,12 +18533,12 @@
       {
         "args": [
           "--test-launcher-filter-file=../../testing/buildbot/filters/linux-lacros.interactive_ui_tests.filter;../../testing/buildbot/filters/linux-lacros.interactive_ui_tests.skew.filter",
-          "--ash-chrome-path-override=../../lacros_version_skew_tests_v113.0.5616.0/test_ash_chrome",
+          "--ash-chrome-path-override=../../lacros_version_skew_tests_v113.0.5619.0/test_ash_chrome",
           "--test-launcher-print-test-stdio=always",
           "--combine-ash-logs-on-bots",
           "--asan-symbolize-output"
         ],
-        "description": "Run with ash-chrome version 113.0.5616.0",
+        "description": "Run with ash-chrome version 113.0.5619.0",
         "isolate_profile_data": true,
         "merge": {
           "args": [],
@@ -18550,8 +18550,8 @@
           "cipd_packages": [
             {
               "cipd_package": "chromium/testing/linux-ash-chromium/x86_64/ash.zip",
-              "location": "lacros_version_skew_tests_v113.0.5616.0",
-              "revision": "version:113.0.5616.0"
+              "location": "lacros_version_skew_tests_v113.0.5619.0",
+              "revision": "version:113.0.5619.0"
             }
           ],
           "dimension_sets": [
@@ -18724,12 +18724,12 @@
       {
         "args": [
           "--test-launcher-filter-file=../../testing/buildbot/filters/linux-lacros.lacros_chrome_browsertests.skew.filter",
-          "--ash-chrome-path-override=../../lacros_version_skew_tests_v113.0.5616.0/test_ash_chrome",
+          "--ash-chrome-path-override=../../lacros_version_skew_tests_v113.0.5619.0/test_ash_chrome",
           "--test-launcher-print-test-stdio=always",
           "--combine-ash-logs-on-bots",
           "--asan-symbolize-output"
         ],
-        "description": "Run with ash-chrome version 113.0.5616.0",
+        "description": "Run with ash-chrome version 113.0.5619.0",
         "isolate_profile_data": true,
         "merge": {
           "args": [],
@@ -18741,8 +18741,8 @@
           "cipd_packages": [
             {
               "cipd_package": "chromium/testing/linux-ash-chromium/x86_64/ash.zip",
-              "location": "lacros_version_skew_tests_v113.0.5616.0",
-              "revision": "version:113.0.5616.0"
+              "location": "lacros_version_skew_tests_v113.0.5619.0",
+              "revision": "version:113.0.5619.0"
             }
           ],
           "dimension_sets": [
@@ -18891,12 +18891,12 @@
       {
         "args": [
           "--test-launcher-filter-file=../../testing/buildbot/filters/linux-lacros.lacros_chrome_browsertests.skew.filter",
-          "--ash-chrome-path-override=../../lacros_version_skew_tests_v113.0.5616.0/test_ash_chrome",
+          "--ash-chrome-path-override=../../lacros_version_skew_tests_v113.0.5619.0/test_ash_chrome",
           "--test-launcher-print-test-stdio=always",
           "--combine-ash-logs-on-bots",
           "--asan-symbolize-output"
         ],
-        "description": "Run with ash-chrome version 113.0.5616.0",
+        "description": "Run with ash-chrome version 113.0.5619.0",
         "isolate_profile_data": true,
         "merge": {
           "args": [],
@@ -18908,8 +18908,8 @@
           "cipd_packages": [
             {
               "cipd_package": "chromium/testing/linux-ash-chromium/x86_64/ash.zip",
-              "location": "lacros_version_skew_tests_v113.0.5616.0",
-              "revision": "version:113.0.5616.0"
+              "location": "lacros_version_skew_tests_v113.0.5619.0",
+              "revision": "version:113.0.5619.0"
             }
           ],
           "dimension_sets": [
diff --git a/testing/buildbot/variants.pyl b/testing/buildbot/variants.pyl
index a8a272f..62e7ab6d 100644
--- a/testing/buildbot/variants.pyl
+++ b/testing/buildbot/variants.pyl
@@ -22,16 +22,16 @@
   },
   'LACROS_VERSION_SKEW_CANARY': {
     'args': [
-      '--ash-chrome-path-override=../../lacros_version_skew_tests_v113.0.5616.0/test_ash_chrome',
+      '--ash-chrome-path-override=../../lacros_version_skew_tests_v113.0.5619.0/test_ash_chrome',
     ],
-    'description': 'Run with ash-chrome version 113.0.5616.0',
+    'description': 'Run with ash-chrome version 113.0.5619.0',
     'identifier': 'Lacros version skew testing ash canary',
     'swarming': {
       'cipd_packages': [
         {
           'cipd_package': 'chromium/testing/linux-ash-chromium/x86_64/ash.zip',
-          'location': 'lacros_version_skew_tests_v113.0.5616.0',
-          'revision': 'version:113.0.5616.0',
+          'location': 'lacros_version_skew_tests_v113.0.5619.0',
+          'revision': 'version:113.0.5619.0',
         },
       ],
     },
diff --git a/testing/variations/fieldtrial_testing_config.json b/testing/variations/fieldtrial_testing_config.json
index 1f868fd..355d94b 100644
--- a/testing/variations/fieldtrial_testing_config.json
+++ b/testing/variations/fieldtrial_testing_config.json
@@ -11070,21 +11070,6 @@
             ]
         }
     ],
-    "SharedSandboxPoliciesWindows": [
-        {
-            "platforms": [
-                "windows"
-            ],
-            "experiments": [
-                {
-                    "name": "Enabled",
-                    "enable_features": [
-                        "SharedSandboxPolicies"
-                    ]
-                }
-            ]
-        }
-    ],
     "SharingHubDesktopScreenshots": [
         {
             "platforms": [
diff --git a/third_party/blink/renderer/modules/accessibility/ax_node_object.cc b/third_party/blink/renderer/modules/accessibility/ax_node_object.cc
index bb34258..52c2f6a 100644
--- a/third_party/blink/renderer/modules/accessibility/ax_node_object.cc
+++ b/third_party/blink/renderer/modules/accessibility/ax_node_object.cc
@@ -4115,8 +4115,8 @@
   HTMLImageElement* curr_image_element = DynamicTo<HTMLImageElement>(GetNode());
   DCHECK(curr_image_element);
   DCHECK(curr_image_element->IsLink());
-  String usemap = curr_image_element->FastGetAttribute(html_names::kUsemapAttr);
-  DCHECK(!usemap.empty());
+  DCHECK(
+      !curr_image_element->FastGetAttribute(html_names::kUsemapAttr).empty());
 
   // Even though several images can point to the same map via usemap, only
   // use one reported via HTMLImageMapElement::ImageElement(), which is always
diff --git a/third_party/blink/renderer/modules/accessibility/ax_object.cc b/third_party/blink/renderer/modules/accessibility/ax_object.cc
index 4e5236b9..364a311e 100644
--- a/third_party/blink/renderer/modules/accessibility/ax_object.cc
+++ b/third_party/blink/renderer/modules/accessibility/ax_object.cc
@@ -932,15 +932,6 @@
     return false;
   }
 
-  // Image map parent-child relationships work as follows:
-  // - The image is the parent
-  // - The DOM children of the associated <map> are the children
-  // This is accomplished by having GetParentNodeForComputeParent() return the
-  // <img> instead of the <map> for the map's children.
-  if (IsA<HTMLMapElement>(node)) {
-    return false;
-  }
-
   // An image cannot be the natural DOM parent of another AXObject, it can only
   // have <area> children, which are from another part of the DOM tree.
   if (IsA<HTMLImageElement>(node)) {
@@ -952,7 +943,15 @@
 
 // static
 bool AXObject::CanHaveChildren(Element& element) {
-  DCHECK(!IsA<HTMLMapElement>(element));
+  // Image map parent-child relationships work as follows:
+  // - The image is the parent
+  // - The DOM children of the associated <map> are the children
+  // This is accomplished by having GetParentNodeForComputeParent() return the
+  // <img> instead of the <map> for the map's children.
+  if (IsA<HTMLMapElement>(element)) {
+    return false;
+  }
+
   // Placeholder gets exposed as an attribute on the input accessibility node,
   // so there's no need to add its text children. Placeholder text is a separate
   // node that gets removed when it disappears, so this will only be present if
diff --git a/third_party/blink/renderer/modules/accessibility/ax_object_cache_impl.cc b/third_party/blink/renderer/modules/accessibility/ax_object_cache_impl.cc
index 5b06ff7..c3b58733 100644
--- a/third_party/blink/renderer/modules/accessibility/ax_object_cache_impl.cc
+++ b/third_party/blink/renderer/modules/accessibility/ax_object_cache_impl.cc
@@ -1615,6 +1615,15 @@
     if (node->IsPseudoElement()) {
       DeferTreeUpdate(&AXObjectCacheImpl::EnsureMarkDirtyWithCleanLayout, node);
     }
+    // If an image is removed, ensure it's entire subtree is deleted as there
+    // may have been children supplied via a map.
+    if (IsA<HTMLImageElement>(node)) {
+      if (AXObject* ax_image = SafeGet(node)) {
+        RemoveSubtree(ax_image);
+        return;
+      }
+    }
+
     Remove(node);
     return;
   }
@@ -1677,6 +1686,14 @@
   Remove(ax_id);
 }
 
+void AXObjectCacheImpl::RemoveSubtree(AXObject* object) {
+  DCHECK(object);
+  for (AXObject* child : object->CachedChildrenIncludingIgnored()) {
+    RemoveSubtree(child);
+  }
+  Remove(object);
+}
+
 AXID AXObjectCacheImpl::GenerateAXID() const {
   static AXID last_used_id = 0;
 
@@ -2095,13 +2112,26 @@
   // descendants of the attached node, thus ChildrenChangedWithCleanLayout()
   // must be called. It handles ignored logic, ensuring that the first ancestor
   // that should have this as a child will be updated.
-  ChildrenChangedWithCleanLayout(
-      Get(LayoutTreeBuilderTraversal::Parent(*node)));
+  ChildrenChangedWithCleanLayout(LayoutTreeBuilderTraversal::Parent(*node));
 
   // If an image map area is added, we need to update children on the image.
   if (IsA<HTMLAreaElement>(node))
     ChildrenChangedWithCleanLayout(AXObject::ComputeNonARIAParent(*this, node));
 
+  // Rare edge case: if an image is added, it could have changed the order of
+  // images with the same usemap in the document. Only the first image for a
+  // given <map> should have the <area> children. Therefore, get the current
+  // primary image before it's updated, and ensure its children are
+  // recalculated.
+  if (IsA<HTMLImageElement>(node)) {
+    if (HTMLMapElement* map = AXObject::GetMapForImage(node)) {
+      HTMLImageElement* primary_image_element = map->ImageElement();
+      if (node != primary_image_element) {
+        ChildrenChangedWithCleanLayout(SafeGet(primary_image_element));
+      }
+    }
+  }
+
   // Once we have reached the threshold number of roles that forces a data
   // table, invalidate the AXTable if it was previously a layout table, so that
   // its subtree recomputes roles.
diff --git a/third_party/blink/renderer/modules/accessibility/ax_object_cache_impl.h b/third_party/blink/renderer/modules/accessibility/ax_object_cache_impl.h
index d027cee..bd7f0c571 100644
--- a/third_party/blink/renderer/modules/accessibility/ax_object_cache_impl.h
+++ b/third_party/blink/renderer/modules/accessibility/ax_object_cache_impl.h
@@ -161,6 +161,7 @@
   void Remove(Document*) override;
   void Remove(AbstractInlineTextBox*) override;
   void Remove(AXObject*);  // Calls more specific Remove methods as necessary.
+  void RemoveSubtree(AXObject* object);
 
   // For any ancestor that could contain the passed-in AXObject* in their cached
   // children, clear their children and set needs to update children on them.
diff --git a/third_party/blink/web_tests/FlagExpectations/highdpi b/third_party/blink/web_tests/FlagExpectations/highdpi
index b725aaa..933e884 100644
--- a/third_party/blink/web_tests/FlagExpectations/highdpi
+++ b/third_party/blink/web_tests/FlagExpectations/highdpi
@@ -264,7 +264,6 @@
 crbug.com/1179565 svg/text/text-outline-2.html [ Failure ]
 crbug.com/1179565 svg/text/text-outline-rgba.html [ Failure ]
 crbug.com/1179585 svg/text/textpath-outline.svg [ Failure ]
-crbug.com/1179565 svg/text/textpath-pattern.svg [ Failure ]
 crbug.com/1179565 svg/text/tspan-multiple-outline.svg [ Failure ]
 crbug.com/1179565 svg/transforms/change-transform-origin-css.xhtml [ Failure ]
 crbug.com/1179565 svg/transforms/change-transform-origin-presentation-attribute.xhtml [ Failure ]
diff --git a/third_party/blink/web_tests/SlowTests b/third_party/blink/web_tests/SlowTests
index a309fa81..56a5c1b 100644
--- a/third_party/blink/web_tests/SlowTests
+++ b/third_party/blink/web_tests/SlowTests
@@ -693,7 +693,6 @@
 crbug.com/874695 [ Debug Mac12 ] media/video-controls-visibility-multimodal-mouse-after-touch.html [ Slow ]
 crbug.com/874695 [ Release ] media/video-controls-visibility-multimodal-mouse-after-touch.html [ Slow ]
 crbug.com/874695 [ Release ] media/video-controls-visibility-multimodal-touch-after-mouse.html [ Slow ]
-crbug.com/874695 [ Debug Mac12 ] media/video-played-collapse.html [ Slow ]
 crbug.com/874695 [ Release ] media/video-played-collapse.html [ Slow ]
 crbug.com/874695 paint/invalidation/filters/filter-repaint-accelerated-child-with-filter-child.html [ Slow ]
 crbug.com/874695 paint/invalidation/filters/filter-repaint-accelerated-on-accelerated-filter.html [ Slow ]
diff --git a/third_party/blink/web_tests/TestExpectations b/third_party/blink/web_tests/TestExpectations
index 2ce3e4b6..3a948a3 100644
--- a/third_party/blink/web_tests/TestExpectations
+++ b/third_party/blink/web_tests/TestExpectations
@@ -2930,7 +2930,7 @@
 crbug.com/626703 [ Win ] virtual/partitioned-cookies/http/tests/inspector-protocol/network/disabled-cache-navigation.js [ Failure ]
 
 # ====== New tests from wpt-importer added here ======
-crbug.com/626703 virtual/plz-dedicated-worker/external/wpt/html/cross-origin-embedder-policy/credentialless/dedicated-worker.https.window.html [ Timeout Failure ]
+crbug.com/626703 virtual/plz-dedicated-worker/external/wpt/html/cross-origin-embedder-policy/credentialless/dedicated-worker.https.window.html [ Failure Timeout ]
 crbug.com/626703 [ Linux ] external/wpt/html/semantics/links/hyperlink-auditing/headers.optional.html [ Timeout ]
 crbug.com/626703 [ Mac13 ] external/wpt/html/semantics/links/hyperlink-auditing/headers.optional.html [ Timeout ]
 crbug.com/626703 [ Linux ] external/wpt/IndexedDB/idb-explicit-commit.any.html [ Timeout ]
diff --git a/third_party/blink/web_tests/external/WPT_BASE_MANIFEST_8.json b/third_party/blink/web_tests/external/WPT_BASE_MANIFEST_8.json
index c3e1e7f..8f2ee7a 100644
--- a/third_party/blink/web_tests/external/WPT_BASE_MANIFEST_8.json
+++ b/third_party/blink/web_tests/external/WPT_BASE_MANIFEST_8.json
@@ -265222,16 +265222,6 @@
    }
   },
   "support": {
-   ".cache": {
-    "gitignore2.json": [
-     "0cbfded8f62b2916c038fc6b3ce43a61ce18aaad",
-     []
-    ],
-    "mtime.json": [
-     "7128177bcc7233162b50353d09ba99b3e79fab26",
-     []
-    ]
-   },
    ".gitignore": [
     "d93e645d547894b50149d3726de2654957b6e06f",
     []
@@ -537920,6 +537910,13 @@
          {}
         ]
        ],
+       "input-maxlength-emoji.html": [
+        "068abad9363065afff404b3e30f33615ca6e5111",
+        [
+         null,
+         {}
+        ]
+       ],
        "input-number-validity-dynamic-value-no-change.html": [
         "2100fb7fb618336e77a5478f51b960a7725d02c4",
         [
diff --git a/third_party/blink/web_tests/external/wpt/html/semantics/forms/constraints/input-maxlength-emoji.html b/third_party/blink/web_tests/external/wpt/html/semantics/forms/constraints/input-maxlength-emoji.html
new file mode 100644
index 0000000..068abad
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/html/semantics/forms/constraints/input-maxlength-emoji.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Tests pasting an emoji in a text field with a maxlength attribute</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<link rel="help" href="https://bugs.webkit.org/show_bug.cgi?id=252900">
+<input id="target" type="text" maxlength="10" />
+<script>
+test(function() {
+  let target = document.getElementById("target");
+  target.focus();
+  document.execCommand("InsertHTML", false, "👨‍👩‍👧‍👦");
+  assert_equals(target.value, "👨‍👩‍👧‍");
+}, "Emoji gets truncated due to maxlength attribute");
+</script>
diff --git a/ui/aura/client/drag_drop_client_observer.h b/ui/aura/client/drag_drop_client_observer.h
index a464dac8..a4d48ab 100644
--- a/ui/aura/client/drag_drop_client_observer.h
+++ b/ui/aura/client/drag_drop_client_observer.h
@@ -9,12 +9,24 @@
 #include "ui/aura/aura_export.h"
 
 namespace ui {
+namespace mojom {
+enum class DragOperation;
+}  // namespace mojom
+
 class DropTargetEvent;
 }  // namespace ui
 
 namespace aura {
 namespace client {
 
+// Observes drag-and-drop sessions. NOTE: drop could be asynchronous. Therefore,
+// an active async drop could be interrupted by a new drag-and-drop session. In
+// this case, observers are NOT notified of the interrupted async drop.
+// Some possible calling orders are listed below:
+// 1. Sync/async drop completion: `OnDragStarted()` -> `OnDragUpdated()` ->
+// `OnDragCompleted()` -> `OnDropCompleted()`.
+// 2. Async drop cancellation: OnDragStarted()` -> `OnDragUpdated()` ->
+// `OnDragCompleted()` -> `OnDragCancelled()`.
 class AURA_EXPORT DragDropClientObserver {
  public:
   virtual ~DragDropClientObserver() = default;
@@ -29,11 +41,20 @@
   virtual void OnDragCompleted(const ui::DropTargetEvent& event) {}
 
   // Called when dragging is cancelled.
-  //
-  // NOTE: Drag 'n drop cancellations may be processed asynchronously.
+  // NOTE:
+  // 1. Drag 'n drop cancellations may be processed asynchronously.
   // Hence, this hook might be called before the action is actually processed.
+  // 2. This method is called in a disallowed async drop. In this case,
+  // `OnDragCancelled()` is called after `OnDragCompleted()`.
   virtual void OnDragCancelled() {}
 
+  // Called when drop is completed. `drag_operation` indicates the operation
+  // when drop completes.
+  // NOTE: drop completion could be performed asynchronously. When an async drop
+  // is completed after a new drag-and-drop session starts, this method is not
+  // called for this drop.
+  virtual void OnDropCompleted(ui::mojom::DragOperation drag_operation) {}
+
 #if BUILDFLAG(IS_CHROMEOS_ASH)
   // Called when the set of currently selected drag operation changes during the
   // drag. |action| is a bitmask of the actions selected by the client. This is