)]}'
{
  "log": [
    {
      "commit": "cf69254aedcca414092f3520da6c32975382b527",
      "tree": "5cc3f86596108176ae80189c9dff46103716069c",
      "parents": [
        "cd0cafe05e095f47ce0f4a58d80b17789b6e3f41"
      ],
      "author": {
        "name": "Marwan Tammam",
        "email": "quarz@chromium.org",
        "time": "Wed Sep 23 04:20:13 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Wed Sep 23 04:30:28 2026"
      },
      "message": "Add Sandbox::kPlatformRuntime utility sandbox type\n\nIntroduces a dedicated sandbox type for a utility process that will host\nthe platform runtime library.\n\nBug: b:558690675\nChange-Id: If16af978bfa9427ba9a5bb099968f76914944955\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8422093\nReviewed-by: Alex Gough \u003cajgo@chromium.org\u003e\nAuto-Submit: Marwan Tammam \u003cquarz@chromium.org\u003e\nCommit-Queue: Marwan Tammam \u003cquarz@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1703174}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: f4743e0c55892a42a9cfd2aa0b9cfd03253e83d5\n"
    },
    {
      "commit": "cd0cafe05e095f47ce0f4a58d80b17789b6e3f41",
      "tree": "58737e84125e3ceabc288c07caef999cab3c21ec",
      "parents": [
        "edd4fc65d9870cfbe599bf8c7f90ebe388f644d4"
      ],
      "author": {
        "name": "Stefan Smolen",
        "email": "ssmole@microsoft.com",
        "time": "Wed Sep 23 01:59:39 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Wed Sep 23 02:05:55 2026"
      },
      "message": "[basic sandbox] Add APIs missing from basic_sandbox.def\n\nThe API shim was not including every export listed in basic_sandbox.def,\nwhich means that new API calls of those APIs will cause build errors with\n`is_basic_api_shim \u003d true`.\n\nBug: 533049438\nChange-Id: I2efe411634b84bd9f12912a83e34f0dcddac58ce\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8435678\nCommit-Queue: Stefan Smolen \u003cssmole@microsoft.com\u003e\nReviewed-by: Ben Bamesberger \u003cbenb@microsoft.com\u003e\nCr-Commit-Position: refs/heads/main@{#1703141}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: db99325be7760e1b00aa7efd20d7de32bc8a979e\n"
    },
    {
      "commit": "edd4fc65d9870cfbe599bf8c7f90ebe388f644d4",
      "tree": "39aba10e17c8467c792b8d4fd28170ad227697dc",
      "parents": [
        "57fffeb2cd5280408b42ca3c48214cb02959a73f"
      ],
      "author": {
        "name": "Bryan Oltman",
        "email": "bryanoltman@google.com",
        "time": "Tue Sep 22 19:15:35 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Tue Sep 22 19:20:39 2026"
      },
      "message": "[macOS] Restrict GPU process\u0027s Darwin user dir access\n\nThis CL restricts the GPU process\u0027s access to the shared Darwin per-user\ndirectories (`_CS_DARWIN_USER_DIR`, `_CS_DARWIN_USER_TEMP_DIR`, and\n`_CS_DARWIN_USER_CACHE_DIR`, which default to `/var/folders/.../0/`,\n`/var/folders/.../T/`, and `/var/folders/.../C/`) to directories used by\nthe Metal compiler and the CoreML model compiler used by WebNN.\n\nFor the Metal compiler, we allow access to the Darwin user cache\ndirectory for files named functions.data, functions.list,\nlibraries.data, and libraries.list in the com.apple.metal subdirectory.\n\nFor the CoreML model compiler, we (unfortunately) need to allow broad\naccess to the Darwin user temp directory to support its\n`compileModelAtUrl` family of functions, which access the base tmep\ndirectory.\n\nCq-Include-Trybots: luci.chromium.try:mac13-arm64-rel,mac14-arm64-rel,mac15-arm64-rel,mac14-tests,mac13-tests,mac15-x64-rel-tests;luci.chrome.try:mac-rel-ready\nBug: 528379972\nChange-Id: Ie77ac1182054b4057b4aa690d8adfee1e12abf84\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8414585\nReviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\nCommit-Queue: Bryan Oltman \u003cbryanoltman@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1702863}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 24042e7540ca9bd0e1f5c93db0a6223ddb6b1a89\n"
    },
    {
      "commit": "57fffeb2cd5280408b42ca3c48214cb02959a73f",
      "tree": "61cff9fd180b26d8c889547f61a55e821bbbc0bf",
      "parents": [
        "46d0eb0ab4663cfe64c537adb08694f72db47b96"
      ],
      "author": {
        "name": "James Hawkins",
        "email": "jhawkins@google.com",
        "time": "Tue Sep 22 02:52:53 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Tue Sep 22 03:00:07 2026"
      },
      "message": "presubmit: Fast-path nested PRESUBMITs in subsystems (part 8 of 8)\n\nUse InputApi.HasAffectedFiles() to early-return from test and linter\nrunners when no relevant files are affected across subsystems:\n- android_webview/tools/\n- base/tracing/\n- buildtools/checkdeps/\n- ios/ (build/bots/scripts, build/bots/scripts/plugin, chrome/browser/flags)\n- media/\n- mojo/\n- net/tools/dafsa/\n- sandbox/win/tests/basic_process/\n- services/network/build/scripts/\n- ui/ (chromeos/styles, file_manager, webui/resources/tools)\n\nBenchmark (mojo/public/cpp/bindings/BUILD.gn, mojo/ PRESUBMIT):\n- Baseline (origin/main): 4.31s ± 0.03s\n- Optimized (CL branch):  225ms ± 7ms\n- Savings: -4.08s (-94.8%, 19.13x speedup)\n\nOverall series benchmark (all 8 CLs combined):\n- Multi-subsystem change (touching files across all 8 subsystems):\n  Baseline (origin/main): 60.44s ± 0.74s\n  Optimized (series):     14.17s ± 0.20s\n  Savings: -46.26s (-76.5%, 4.26x speedup)\n- Standard root build edit (build/config/compiler/BUILD.gn):\n  Baseline (origin/main): 569ms ± 8ms\n  Optimized (series):     470ms ± 6ms\n  Savings: -100ms (-17.5%, 1.21x speedup)\n\nBug: 534712288\nTest: python3 -m py_compile **/PRESUBMIT.py\nChange-Id: I7be6cd134f5297c15c13b55b87fed7faf8d488e2\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8414903\nReviewed-by: Rohit Rao \u003crohitrao@chromium.org\u003e\nReviewed-by: Nico Weber \u003cthakis@chromium.org\u003e\nReviewed-by: David Benjamin \u003cdavidben@chromium.org\u003e\nReviewed-by: Eric Orth \u003cericorth@chromium.org\u003e\nReviewed-by: Colin Blundell \u003cblundell@chromium.org\u003e\nReviewed-by: Richard Coles \u003ctorne@chromium.org\u003e\nReviewed-by: Rasika Navarange \u003crasikan@google.com\u003e\nReviewed-by: Tom Sepez \u003ctsepez@chromium.org\u003e\nCommit-Queue: James Hawkins \u003cjhawkins@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1702336}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 26d5aedc087f792c74713eaa536a310d247b90e2\n"
    },
    {
      "commit": "46d0eb0ab4663cfe64c537adb08694f72db47b96",
      "tree": "c6d41ed2e8101cbb24946acc82e10fe723ef8d2a",
      "parents": [
        "293083355b9144f3f7276d26e763e56b05f591aa"
      ],
      "author": {
        "name": "Matthew Denton",
        "email": "mpdenton@chromium.org",
        "time": "Mon Sep 21 20:58:18 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Mon Sep 21 21:09:27 2026"
      },
      "message": "linux sandbox: Reject sys_old_mmap on i386 in baseline policy\n\nOn i386, __NR_mmap (90) is the legacy sys_old_mmap, which takes a single\npointer to an argument struct rather than passing flags in a register.\nBecause seccomp cannot inspect the struct, RestrictMmapFlags() was\nchecking an unrelated register and the intended flag restrictions did\nnot apply.\n\nReturn ENOSYS for __NR_mmap on i386 instead, mirroring the existing\ntreatment of clone3. This is safe because glibc on i386 uses __NR_mmap2,\nwhich passes flags in a register and remains filtered by\nRestrictMmapFlags().\n\nThis resolves and removes the TODO(crbug.com/40528912) for this block.\n\nFixed: 502376419\nChange-Id: I72aa30fa6400d5dd1085f759725a7e58037bf860\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8416553\nCommit-Queue: Matthew Denton \u003cmpdenton@chromium.org\u003e\nReviewed-by: Elly \u003cellyjones@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1702035}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 258d9c2bd051202056371589143d0051baac0640\n"
    },
    {
      "commit": "293083355b9144f3f7276d26e763e56b05f591aa",
      "tree": "24db2c9524c34a28592c75eab52c66553e76c2d6",
      "parents": [
        "dbf2bb8ff62037f6123609ad33b28ea0b6b9e289"
      ],
      "author": {
        "name": "Dibyajyoti Pal",
        "email": "dibyapal@chromium.org",
        "time": "Mon Sep 21 20:27:59 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Mon Sep 21 20:36:55 2026"
      },
      "message": "Revert \"vr: run the XR device service in the sandbox on Linux\"\n\nThis reverts commit 5b3e4fb22be574766824e33a23b7f11f06c53080.\n\nReason for revert: Causes the tree to become red, due to unresolved dependencies in the linux-cast-arm-rel bot.\n\nFailure Link: https://ci.chromium.org/ui/p/chromium/builders/ci/linux-cast-arm-rel/106619/overview\n\nOriginal change\u0027s description:\n\u003e vr: run the XR device service in the sandbox on Linux\n\u003e\n\u003e Run the isolated XR device service in the kXrCompositing sandbox on\n\u003e Linux, as Windows does, instead of the generic utility sandbox.\n\u003e\n\u003e - Add an XR seccomp policy (bpf_xr_policy_linux) extending the GPU\n\u003e   policy with what OpenXR runtimes need: AF_UNIX sockets, plus flock\n\u003e   and get_robust_list for SteamVR, and kill() restricted to signal 0\n\u003e   (liveness probes; there is no PID namespace, so real signals stay\n\u003e   refused). readlink() stays brokered, and the hook grants the\n\u003e   ancestor directories the loader\u0027s realpath() walks.\n\u003e - Broker connect(2) and bind(2) instead of allowing them, so the XR\n\u003e   process can only reach the active runtime\u0027s sockets and only bind\n\u003e   the runtime\u0027s own names. seccomp cannot read the sockaddr, so the\n\u003e   new COMMAND_CONNECT/COMMAND_BIND pass the name and fd to the broker,\n\u003e   which checks the name against a per-runtime allow-list. Abstract\n\u003e   names are spelled \"@name\" and matched by prefix, which SteamVR needs\n\u003e   for its per-instance endpoints.\n\u003e - Add a pre-sandbox hook (isolated_xr_device/xr_sandbox_hook_linux)\n\u003e   that warms the OpenXR/Vulkan driver closure and grants broker access\n\u003e   before the sandbox engages. /dev/shm is create-only as in the GPU\n\u003e   process, widened to read/write only for SteamVR (its manifest sets\n\u003e   VALVE_runtime_is_steamvr), whose IPC opens server-created objects.\n\u003e - Route kXrSandbox to kXrCompositing on Linux.\n\u003e - Only launch the service when OpenXR is enabled (the feature or\n\u003e   --force-webxr-runtime\u003dopenxr), so a page calling isSessionSupported()\n\u003e   does not start it for nothing (kOpenXR is off by default on Linux).\n\u003e - Handle kXrCompositing in UtilityProcessSandboxBrowserTest, which\n\u003e   switches over every sandbox type; it forks from the unsandboxed\n\u003e   zygote and seccomps itself in the hook.\n\u003e\n\u003e Bug: 506004811\n\u003e Change-Id: I05a1aa0e8b291e648c130fc00fae1d0119af8db0\n\u003e Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8127854\n\u003e Reviewed-by: Nasko Oskov \u003cnasko@chromium.org\u003e\n\u003e Reviewed-by: Tom Sepez \u003ctsepez@chromium.org\u003e\n\u003e Commit-Queue: Elly \u003cellyjones@chromium.org\u003e\n\u003e Reviewed-by: Brandon Jones \u003cbajones@chromium.org\u003e\n\u003e Cr-Commit-Position: refs/heads/main@{#1701938}\n\nBug: 506004811\nNo-Presubmit: true\nNo-Tree-Checks: true\nNo-Try: true\nChange-Id: Ib17ecda277e9538714e6cbec3dc4a421d3cb8282\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8434229\nBot-Commit: rubber-stamper@appspot.gserviceaccount.com \u003crubber-stamper@appspot.gserviceaccount.com\u003e\nAuto-Submit: Dibyajyoti Pal \u003cdibyapal@chromium.org\u003e\nOwners-Override: Dibyajyoti Pal \u003cdibyapal@chromium.org\u003e\nCommit-Queue: rubber-stamper@appspot.gserviceaccount.com \u003crubber-stamper@appspot.gserviceaccount.com\u003e\nCr-Commit-Position: refs/heads/main@{#1702007}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 4ef52340f03be743186f0549cd9597f955f1f335\n"
    },
    {
      "commit": "dbf2bb8ff62037f6123609ad33b28ea0b6b9e289",
      "tree": "7793420db67c8bb94d24897d7bcda19ea716ba78",
      "parents": [
        "0645958392c1da0b37e39fa7e32139642d4a7106"
      ],
      "author": {
        "name": "utzcoz",
        "email": "utzcoz@gmail.com",
        "time": "Mon Sep 21 18:55:03 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Mon Sep 21 19:05:23 2026"
      },
      "message": "vr: run the XR device service in the sandbox on Linux\n\nRun the isolated XR device service in the kXrCompositing sandbox on\nLinux, as Windows does, instead of the generic utility sandbox.\n\n- Add an XR seccomp policy (bpf_xr_policy_linux) extending the GPU\n  policy with what OpenXR runtimes need: AF_UNIX sockets, plus flock\n  and get_robust_list for SteamVR, and kill() restricted to signal 0\n  (liveness probes; there is no PID namespace, so real signals stay\n  refused). readlink() stays brokered, and the hook grants the\n  ancestor directories the loader\u0027s realpath() walks.\n- Broker connect(2) and bind(2) instead of allowing them, so the XR\n  process can only reach the active runtime\u0027s sockets and only bind\n  the runtime\u0027s own names. seccomp cannot read the sockaddr, so the\n  new COMMAND_CONNECT/COMMAND_BIND pass the name and fd to the broker,\n  which checks the name against a per-runtime allow-list. Abstract\n  names are spelled \"@name\" and matched by prefix, which SteamVR needs\n  for its per-instance endpoints.\n- Add a pre-sandbox hook (isolated_xr_device/xr_sandbox_hook_linux)\n  that warms the OpenXR/Vulkan driver closure and grants broker access\n  before the sandbox engages. /dev/shm is create-only as in the GPU\n  process, widened to read/write only for SteamVR (its manifest sets\n  VALVE_runtime_is_steamvr), whose IPC opens server-created objects.\n- Route kXrSandbox to kXrCompositing on Linux.\n- Only launch the service when OpenXR is enabled (the feature or\n  --force-webxr-runtime\u003dopenxr), so a page calling isSessionSupported()\n  does not start it for nothing (kOpenXR is off by default on Linux).\n- Handle kXrCompositing in UtilityProcessSandboxBrowserTest, which\n  switches over every sandbox type; it forks from the unsandboxed\n  zygote and seccomps itself in the hook.\n\nBug: 506004811\nChange-Id: I05a1aa0e8b291e648c130fc00fae1d0119af8db0\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8127854\nReviewed-by: Nasko Oskov \u003cnasko@chromium.org\u003e\nReviewed-by: Tom Sepez \u003ctsepez@chromium.org\u003e\nCommit-Queue: Elly \u003cellyjones@chromium.org\u003e\nReviewed-by: Brandon Jones \u003cbajones@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1701938}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 5b3e4fb22be574766824e33a23b7f11f06c53080\n"
    },
    {
      "commit": "0645958392c1da0b37e39fa7e32139642d4a7106",
      "tree": "24db2c9524c34a28592c75eab52c66553e76c2d6",
      "parents": [
        "d2bd483f36cdfd9645f3244a629b484a504d0bfe"
      ],
      "author": {
        "name": "Isaac Ahouma",
        "email": "iahouma@google.com",
        "time": "Fri Sep 18 17:36:32 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Fri Sep 18 18:07:03 2026"
      },
      "message": "Revert \"Fix sandbox initialization for OnDeviceModelExecution on Linux\"\n\nThis reverts commit 28871b4af455d4dc4446ccc5aa764a950e074c82.\n\nReason for revert: We believe this broke our CI:\nhttps://ci.chromium.org/ui/p/chrome/builders/try/optimization_guide-linux/10324\n\nFailure Link: https://ci.chromium.org/ui/p/chrome/builders/try/optimization_guide-linux/10324\n\nOriginal change\u0027s description:\n\u003e Fix sandbox initialization for OnDeviceModelExecution on Linux\n\u003e\n\u003e On Linux and ChromeOS, driver warming in on_device_model::PreSandboxInit\n\u003e spawns background driver threads. Previously, PreSandboxInit was called\n\u003e in UtilityMain before sandbox initialization. This created threads\n\u003e before SandboxLinux::StartBrokerProcess called fork(), which is unsafe\n\u003e in a multi-threaded process. Additionally, the spawned threads caused\n\u003e InitializeSandbox to fail to engage Seccomp-BPF.\n\u003e\n\u003e This CL fixes the issues by:\n\u003e\n\u003e 1. Deferring PreSandboxInit on Linux/ChromeOS into PreSandboxHook,\n\u003e    executing it immediately after StartBrokerProcess has safely forked\n\u003e    the broker while the process is strictly single-threaded.\n\u003e 2. Setting allow_threads_during_sandbox_init \u003d true and\n\u003e    check_for_open_directories \u003d false in AddSandboxLinuxOptions,\n\u003e    allowing StartSeccompBPF to apply the filter across all driver\n\u003e    threads via TSYNC.\n\u003e 3. Adding checks in RunOnDeviceModel to ensure PreSandboxInit was\n\u003e    called and that Seccomp-BPF is active on supported kernels.\n\u003e 4. Re-enabling the seccomp_bpf_started verification for\n\u003e    Sandbox::kOnDeviceModelExecution in\n\u003e    UtilityProcessSandboxBrowserTest.\n\u003e\n\u003e Bug: 499278708\n\u003e Change-Id: I907b1f7568fae0c591da53a253bd4e5dd2df52a8\n\u003e Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8387676\n\u003e Reviewed-by: Nasko Oskov \u003cnasko@chromium.org\u003e\n\u003e Reviewed-by: Matthew Denton \u003cmpdenton@chromium.org\u003e\n\u003e Commit-Queue: Francois Pierre Doray \u003cfdoray@chromium.org\u003e\n\u003e Auto-Submit: Francois Pierre Doray \u003cfdoray@chromium.org\u003e\n\u003e Cr-Commit-Position: refs/heads/main@{#1700011}\n\nBug: 499278708\nNo-Presubmit: true\nNo-Tree-Checks: true\nNo-Try: true\nChange-Id: I25218533e223ff66dadbbc6d830fd956944c705e\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8423698\nCommit-Queue: Dave Tapuska \u003cdtapuska@chromium.org\u003e\nBot-Commit: rubber-stamper@appspot.gserviceaccount.com \u003crubber-stamper@appspot.gserviceaccount.com\u003e\nReviewed-by: Tom Sepez \u003ctsepez@chromium.org\u003e\nReviewed-by: Ben Scarlato \u003cakhna@google.com\u003e\nReviewed-by: Dave Tapuska \u003cdtapuska@chromium.org\u003e\nAuto-Submit: Isaac Ahouma \u003ciahouma@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1700927}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 5aa97a8c8c61c1061824a66e721f1a84798f2900\n"
    },
    {
      "commit": "d2bd483f36cdfd9645f3244a629b484a504d0bfe",
      "tree": "087b31650c1a6c893938dfc70c067db17bb26b86",
      "parents": [
        "bffc7e2231db8bb52720fc6386076d9b0ab5b401"
      ],
      "author": {
        "name": "Arthur Sonzogni",
        "email": "arthursonzogni@chromium.org",
        "time": "Fri Sep 18 16:29:12 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Fri Sep 18 16:36:21 2026"
      },
      "message": "Spanification: Use std::array in sandbox/linux.\n\nMigrate C-style arrays with unsafe accesses to std::array and\nbase::span across sandbox/linux to modernize storage and eliminate\nunsafe indexing.\n\nThis is split from a large CL removing ~800 UNSAFE_TODOs. Using data\nfrom http://x20web/~arthursonzogni/state-of-spanification, a swarm of\nGemini agents resolved the reported C-style array unsafe accesses.\n\nBug: 559576258\nChange-Id: Ia95e41a45f77d5004a2efae91829f77fb83f2435\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8419114\nAuto-Submit: Arthur Sonzogni \u003carthursonzogni@chromium.org\u003e\nReviewed-by: Kyle Charbonneau \u003ckylechar@chromium.org\u003e\nReviewed-by: Tom Sepez \u003ctsepez@chromium.org\u003e\nCommit-Queue: Tom Sepez \u003ctsepez@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1700847}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 68cbd4c278fd7292fe351e737ed7a7b536c8ac2f\n"
    },
    {
      "commit": "bffc7e2231db8bb52720fc6386076d9b0ab5b401",
      "tree": "edd1d037242d92e5b61fd2cf48aa7785931e345c",
      "parents": [
        "842e18ca9d578103130e228c45136a670bf6856c"
      ],
      "author": {
        "name": "François Doray",
        "email": "fdoray@chromium.org",
        "time": "Thu Sep 17 18:53:45 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Thu Sep 17 19:02:29 2026"
      },
      "message": "Fix sandbox initialization for OnDeviceModelExecution on Linux\n\nOn Linux and ChromeOS, driver warming in on_device_model::PreSandboxInit\nspawns background driver threads. Previously, PreSandboxInit was called\nin UtilityMain before sandbox initialization. This created threads\nbefore SandboxLinux::StartBrokerProcess called fork(), which is unsafe\nin a multi-threaded process. Additionally, the spawned threads caused\nInitializeSandbox to fail to engage Seccomp-BPF.\n\nThis CL fixes the issues by:\n\n1. Deferring PreSandboxInit on Linux/ChromeOS into PreSandboxHook,\n   executing it immediately after StartBrokerProcess has safely forked\n   the broker while the process is strictly single-threaded.\n2. Setting allow_threads_during_sandbox_init \u003d true and\n   check_for_open_directories \u003d false in AddSandboxLinuxOptions,\n   allowing StartSeccompBPF to apply the filter across all driver\n   threads via TSYNC.\n3. Adding checks in RunOnDeviceModel to ensure PreSandboxInit was\n   called and that Seccomp-BPF is active on supported kernels.\n4. Re-enabling the seccomp_bpf_started verification for\n   Sandbox::kOnDeviceModelExecution in\n   UtilityProcessSandboxBrowserTest.\n\nBug: 499278708\nChange-Id: I907b1f7568fae0c591da53a253bd4e5dd2df52a8\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8387676\nReviewed-by: Nasko Oskov \u003cnasko@chromium.org\u003e\nReviewed-by: Matthew Denton \u003cmpdenton@chromium.org\u003e\nCommit-Queue: Francois Pierre Doray \u003cfdoray@chromium.org\u003e\nAuto-Submit: Francois Pierre Doray \u003cfdoray@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1700011}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 28871b4af455d4dc4446ccc5aa764a950e074c82\n"
    },
    {
      "commit": "842e18ca9d578103130e228c45136a670bf6856c",
      "tree": "8726438d8e47e407ed0cdc2a4d21dbb2a69e309a",
      "parents": [
        "1e4fde5e34a347ed0ba99367faf48cdfc6441b3a"
      ],
      "author": {
        "name": "Stefan Smolen",
        "email": "ssmole@microsoft.com",
        "time": "Thu Sep 17 18:39:34 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Thu Sep 17 18:45:12 2026"
      },
      "message": "[sandbox] Add Basic Process API report skill\n\nThis API report skill describes to an AI agent how to run and interpret\nthe current test and API shim which emulates the basic sandbox under an\naudit configuration, then generate a report on the information inside,\nsimilar to what has been provided in:\nhttps://docs.google.com/document/d/1yxk90nIgffg3UavsmeUquDoyksUfr40uz9geFGN9qQY/edit?tab\u003dt.p87dye3n3ft0\n\nBug: 533049438\nChange-Id: If436366eb892487f7f8f811347c85156413d0f5f\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8421059\nReviewed-by: Will Harris \u003cwfh@chromium.org\u003e\nCommit-Queue: Stefan Smolen \u003cssmole@microsoft.com\u003e\nCr-Commit-Position: refs/heads/main@{#1700001}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 3c2071a51dde2af6b988a5e7142cc878ba42679e\n"
    },
    {
      "commit": "1e4fde5e34a347ed0ba99367faf48cdfc6441b3a",
      "tree": "bb102f9e90cf16fb118fe2f336da372a44128280",
      "parents": [
        "70bb188642db5203a5edf00246ee3712f2a45f2a"
      ],
      "author": {
        "name": "Arthur Sonzogni",
        "email": "arthursonzogni@chromium.org",
        "time": "Thu Sep 17 08:41:53 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Thu Sep 17 08:46:52 2026"
      },
      "message": "Remove redundant UNSAFE_TODO wrappers\n\nRemoves UNSAFE_TODO() macro invocations that are no longer needed\nbecause the underlying code is now safe under -Wunsafe-buffer-usage.\n\nThis change was automatically generated by\ntools/clang/unsafe_todo_remover/unsafe_todo_remover.py.\n\nDoc: https://docs.google.com/document/d/1h8HYBuIef3AHwXiDLAQphE74clvVmVG2hj1Ty7BvNzs/edit?tab\u003dt.lv3b7nxb2fz4\nFixed: 475236716\nChange-Id: I7c91139db5e172f8d3ee522a26143e2b70a659b6\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8397612\nCommit-Queue: Colin Blundell \u003cblundell@chromium.org\u003e\nOwners-Override: Colin Blundell \u003cblundell@chromium.org\u003e\nReviewed-by: Colin Blundell \u003cblundell@chromium.org\u003e\nAuto-Submit: Arthur Sonzogni \u003carthursonzogni@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1699613}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 9b88afcb8d50beebc9dbffc9d16aac054eaf759d\n"
    },
    {
      "commit": "70bb188642db5203a5edf00246ee3712f2a45f2a",
      "tree": "160c2397ce0e3c55a999faa97a6dc8b8bb153e55",
      "parents": [
        "1d5dfa691d52a2a3bd79c873924c5aa263e8dae1"
      ],
      "author": {
        "name": "maciek swiech",
        "email": "drmasquatch@google.com",
        "time": "Wed Sep 16 21:46:57 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Wed Sep 16 21:58:40 2026"
      },
      "message": "Document firewall hole process model and add baseline socket tests\n\nDocument the process isolation model and lifeline file descriptor\nmanagement for the ChromeOS firewall hole component. The browser\nprocess mediates firewall hole requests with PermissionBroker, while\nrenderer processes remain isolated by namespace and syscall\nrestrictions.\n\nAdd unit tests for BaselinePolicy to verify that socket creation and\nconnection syscalls (socket, connect, bind, listen) consistently return\nEPERM under seccomp-bpf filtering.\n\nOriginal CL by: yyanagisawa@google.com\n\nTAG\u003dagy\n\nBug: 552401703\nChange-Id: I8fb3064aea960e967c52ffad7f855461582a9d42\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8381277\nCommit-Queue: maciek swiech \u003cdrmasquatch@google.com\u003e\nReviewed-by: Hidehiko Abe \u003chidehiko@chromium.org\u003e\nReviewed-by: Elly \u003cellyjones@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1699278}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: a4d8152ab05cce785a2d2b43b4b7a68df491abae\n"
    },
    {
      "commit": "1d5dfa691d52a2a3bd79c873924c5aa263e8dae1",
      "tree": "41ce77a0adbf98abb0507d3d551d6d7d48d5091d",
      "parents": [
        "b916e67c46e0af5791d981fb314cc6e22ed9db22"
      ],
      "author": {
        "name": "Phillis Tang",
        "email": "phillis@chromium.org",
        "time": "Wed Sep 16 20:30:27 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Wed Sep 16 20:58:33 2026"
      },
      "message": "webnn: use base tmp dir for compiler process\n\nSince we didn\u0027t find a way to use process isolated sub-directory for\nsigned builds for CoreML compileModelAtURL, revert to use base\ndarwin-user-temp-dir for compiler process sandboxing.\n\nBug: 524263705\nChange-Id: I4fcbb4ade9d542f20e3d948b766749fbdd3717f1\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8410889\nReviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\nCommit-Queue: Phillis Tang \u003cphillis@chromium.org\u003e\nReviewed-by: Bryan Oltman \u003cbryanoltman@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1699224}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 2ac9126184a336f000eba7ce4f0d213ba14179d2\n"
    },
    {
      "commit": "b916e67c46e0af5791d981fb314cc6e22ed9db22",
      "tree": "73dd80da3fc8ed88c1b435ee0615819571af1c6a",
      "parents": [
        "3287411d7ffb96f97e2936805b71d2534bec5320"
      ],
      "author": {
        "name": "Hans Wennborg",
        "email": "hans@chromium.org",
        "time": "Wed Sep 16 06:52:20 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Wed Sep 16 07:13:51 2026"
      },
      "message": "[build] Enable stack clash protection on 64-bit Android\n\nUpstream Clang recently enabled stack clash protection by default on\nAArch64, x86/64 and RISC-V Android [1]. This change applies that to\nChromium as well, by dropping the -fno-stack-clash-protection flag we\nwere passing so far.\n\n[1] https://github.com/llvm/llvm-project/pull/209279\n\nBug: 556790370\nChange-Id: I9bb9b7c14920a0f30fd2cb9419ec2dc450d3c771\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8411427\nReviewed-by: Matthew Denton \u003cmpdenton@chromium.org\u003e\nReviewed-by: Nico Weber \u003cthakis@chromium.org\u003e\nReviewed-by: Andrew Grieve \u003cagrieve@chromium.org\u003e\nCommit-Queue: Hans Wennborg \u003chans@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1698686}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 092781136a4d5d6b8ff75fda1c23a2aab27b6701\n"
    },
    {
      "commit": "3287411d7ffb96f97e2936805b71d2534bec5320",
      "tree": "0cfa7d1d8df029e60a03f300539ec1f1ad7ba7fc",
      "parents": [
        "2e4668e03d98a87241edc2c100a04d6c2b32ee98"
      ],
      "author": {
        "name": "Stefan Smolen",
        "email": "ssmole@microsoft.com",
        "time": "Tue Sep 15 00:01:53 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Tue Sep 15 00:07:03 2026"
      },
      "message": "[basic_process] Add a echo service test utilizing basic process APIs\n\nAdd a reusable tool for rewriting non-skipped PE import descriptors to a\nforwarding DLL.\n\nAdd the default-off is_basic_api_shim argument and generated buildflag\nheader alongside the PE import rewriting primitive used by the Basic\nProcess stack.\n\nAdd a Windows-only non-component content_browsertests fixture that\nrewrites a renamed test executable and launches exactly one unsandboxed\nEchoService child through it. Normal browser and utility launches remain\nunchanged.\n\nBug: 533049438\nChange-Id: I6d54b7b4ed537b5f4ec7be6c778ee6b9db18e19b\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8307274\nReviewed-by: Nico Weber \u003cthakis@chromium.org\u003e\nCommit-Queue: Stefan Smolen \u003cssmole@microsoft.com\u003e\nCr-Commit-Position: refs/heads/main@{#1697645}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: e9e6f4d14b42da4700df6101740abc8a8bcf9a28\n"
    },
    {
      "commit": "2e4668e03d98a87241edc2c100a04d6c2b32ee98",
      "tree": "02f68716e140fb7a62d9d7771945744c23b43741",
      "parents": [
        "3f9e9876816032a088d16ddc67d11cee7234eafc"
      ],
      "author": {
        "name": "Bryan Oltman",
        "email": "bryanoltman@google.com",
        "time": "Fri Sep 11 23:13:48 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Fri Sep 11 23:21:21 2026"
      },
      "message": "[macOS] Clean up MacSandboxOdmeUserDirAccess feature\n\nThis feature was introduced as a killswitch for a change that blocked\nthe On-Device Model Execution process from accessing the Darwin user\ndirectories. It was submitted as https://crrev.com/c/7958375 and was\npromoted to the Stable channel in release 151.0.7922.34. Seeing as we\nhaven\u0027t heard any reports of this change causing problems, it should be\nsafe to remove the feature and use the default behavior.\n\nBug: 527915149\nChange-Id: I28a428e5d00f977105549b3afa3250315a65a57f\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8392520\nReviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\nCommit-Queue: Mark Mentovai \u003cmark@chromium.org\u003e\nAuto-Submit: Bryan Oltman \u003cbryanoltman@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1696702}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: cec5395278c018214aedfd031ffd0c0188b20eb7\n"
    },
    {
      "commit": "3f9e9876816032a088d16ddc67d11cee7234eafc",
      "tree": "936ef39bb521b57b379a656857c6bb98aff67382",
      "parents": [
        "2fc48a031bfd307d88b53783d826ab42f55a6f6b"
      ],
      "author": {
        "name": "Devon Loehr",
        "email": "dloehr@google.com",
        "time": "Fri Sep 11 21:22:32 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Fri Sep 11 21:27:29 2026"
      },
      "message": "Standardize mojom arguments for which bindings are generated\n\nThis CL standardizes the way we specify which bindings are generated\nby mojom targets. Rather than idiosyncratic `disable_variants` and\n`cpp_only`, we now have several `generate_*` flags that can be set\nfor different binding types independently. By default, C++ and\njavascript bindings are generated by default; all other types are\nopt-in (most notably blink).\n\nIn the future, we can likely switch javascript to be off-by-default\nas well, but that\u0027s a substantial change and this is already a\nlarge CL.\n\nAX-Relnotes: n/a.\nChange-Id: I7e47aae8a6a95bd65c544665de9b8564240f064f\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8379633\nOwners-Override: Daniel Cheng \u003cdcheng@chromium.org\u003e\nReviewed-by: Daniel Cheng \u003cdcheng@chromium.org\u003e\nCommit-Queue: Devon Loehr \u003cdloehr@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1696607}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 106c397dad8cdaf039cea4e20146d1562c39ac90\n"
    },
    {
      "commit": "2fc48a031bfd307d88b53783d826ab42f55a6f6b",
      "tree": "01e965aa96d128e59a943b664f1d2c00dfb02243",
      "parents": [
        "88f1d4382a8aca67de65f24c43d3d485131bed2d"
      ],
      "author": {
        "name": "Bryan Oltman",
        "email": "bryanoltman@google.com",
        "time": "Fri Sep 11 20:12:37 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Fri Sep 11 20:39:14 2026"
      },
      "message": "Revert \"[macOS] Use sandboxed subdirectories for the GPU child process\"\n\nThis reverts commit ee781affc03766363d35a6bdb65a1db359ee1a7d.\n\nReason for revert: DIRHELPER_USER_DIR_SUFFIX is not respected in our signed builds, meaning that this change has the effect of disabling the GPU cache.\n\nFailure Link: N/A\n\nOriginal change\u0027s description:\n\u003e [macOS] Use sandboxed subdirectories for the GPU child process\n\u003e\n\u003e This CL restricts the GPU process\u0027s access to the shared Darwin per-user\n\u003e directories (`_CS_DARWIN_USER_DIR`, `_CS_DARWIN_USER_TEMP_DIR`, and\n\u003e `_CS_DARWIN_USER_CACHE_DIR`, which default to `/var/folders/.../0/`,\n\u003e `/var/folders/.../T/`, and `/var/folders/.../C/`) to GPU isolated\n\u003e subdirectories.\n\u003e\n\u003e Key changes:\n\u003e\n\u003e 1. Update the GPU process\u0027s seatbelt profile to tighten the current\n\u003e    broad access to the Darwin user directories to sandboxed\n\u003e    subdirectories. This is accomplished using the\n\u003e    DIRHELPER_USER_DIR_SUFFIX\n\u003e    environment variable, which the macOS dirhelper utility appends to\n\u003e    the default `_CS_DARWIN` directory paths.\n\u003e 2. Allow different process types to specify whether whether they need\n\u003e    the sandboxed directories mentioned above. This will allow child\n\u003e    processes other than the GPU to take advantage of this functionality\n\u003e    should they need it in the future.\n\u003e 3. Disables the flaky\n\u003e    conformance/extensions/khr-parallel-shader-compile.html test on Intel\n\u003e    Macs.\n\u003e\n\u003e This change is gated by the `kMacGpuSandboxDarwinUserDirs` feature flag.\n\u003e\n\u003e Cq-Include-Trybots: luci.chromium.try:mac13-arm64-rel,mac14-arm64-rel,mac15-arm64-rel,mac14-tests,mac13-tests,mac15-x64-rel-tests;luci.chrome.try:mac-rel-ready\n\u003e Change-Id: Id621693080084bf780f034cd0a65dc7e94753a78\n\u003e Fixed: 528379972,520019273,516947138,521559611,521486621,516893912,520755056\n\u003e Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8279765\n\u003e Reviewed-by: Alex Gough \u003cajgo@chromium.org\u003e\n\u003e Reviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\n\u003e Reviewed-by: Avi Drissman \u003cavi@chromium.org\u003e\n\u003e Commit-Queue: Bryan Oltman \u003cbryanoltman@google.com\u003e\n\u003e Cr-Commit-Position: refs/heads/main@{#1694962}\n\nBug: 528379972,520019273,516947138,521559611,521486621,516893912,520755056\nCq-Include-Trybots: luci.chromium.try:mac13-arm64-rel,mac14-arm64-rel,mac15-arm64-rel,mac14-tests,mac13-tests,mac15-x64-rel-tests;luci.chrome.try:mac-rel-ready\nChange-Id: I0dc0fc32b8ccbe13690d6c14930811d75eee048f\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8395246\nReviewed-by: Dave Tapuska \u003cdtapuska@chromium.org\u003e\nReviewed-by: Alex Gough \u003cajgo@chromium.org\u003e\nCommit-Queue: Alex Gough \u003cajgo@chromium.org\u003e\nReviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\nAuto-Submit: Bryan Oltman \u003cbryanoltman@google.com\u003e\nReviewed-by: Daniel Cheng \u003cdcheng@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1696539}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 1cf539c6a166981ed2d5e3c76ed310b3ee95df3f\n"
    },
    {
      "commit": "88f1d4382a8aca67de65f24c43d3d485131bed2d",
      "tree": "88f7301224add3e4efb5ade35b52e539d6f817dc",
      "parents": [
        "d80ab98ab70eab5035f8fdd3240cb34054494b2a"
      ],
      "author": {
        "name": "Arthur Sonzogni",
        "email": "arthursonzogni@chromium.org",
        "time": "Fri Sep 11 11:22:20 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Fri Sep 11 11:27:01 2026"
      },
      "message": "Remove redundant UNSAFE_TODO wrappers in sandbox/linux\n\nRemoves UNSAFE_TODO() macro invocations that are no longer needed\nbecause the underlying code is now safe under -Wunsafe-buffer-usage.\n\nThis change was automatically generated by\ntools/clang/unsafe_todo_remover/unsafe_todo_remover.py.\n\nDoc: https://docs.google.com/document/d/1h8HYBuIef3AHwXiDLAQphE74clvVmVG2hj1Ty7BvNzs/edit?tab\u003dt.lv3b7nxb2fz4\nFixed: 475236716\nChange-Id: Iea80270a7eb84cf67c32c859267870e452493132\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8366784\nAuto-Submit: Arthur Sonzogni \u003carthursonzogni@chromium.org\u003e\nReviewed-by: Elly \u003cellyjones@chromium.org\u003e\nCommit-Queue: Arthur Sonzogni \u003carthursonzogni@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1696114}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 2e223a43a4b3740e11f16cf06bd9f9c91ec32acd\n"
    },
    {
      "commit": "d80ab98ab70eab5035f8fdd3240cb34054494b2a",
      "tree": "8429a1eeb2d8991c211beb20be2007ff0ef61873",
      "parents": [
        "9ad436b8a79b6aee6be75496f8432603d7a2eeb7"
      ],
      "author": {
        "name": "Will Harris",
        "email": "wfh@chromium.org",
        "time": "Thu Sep 10 17:16:22 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Thu Sep 10 17:24:38 2026"
      },
      "message": "Remove the WinSboxHighGPUJobMemoryLimits feature\n\nThis has been fully launched and the feature enabled by default since\nM152.\n\nTherefore, remove the feature entirely and enable all the code by\ndefault.\n\nFixed: 376720478\nChange-Id: Id806a9722504c28e35d98e1e181e73b86e181a04\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8383276\nReviewed-by: Hu, Ningxin \u003cningxin.hu@intel.com\u003e\nCommit-Queue: Will Harris \u003cwfh@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1695481}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: b46ad1fe0f6f934a3f3cd274098c8df5ad3925f1\n"
    },
    {
      "commit": "9ad436b8a79b6aee6be75496f8432603d7a2eeb7",
      "tree": "19f6058ff1a541f1f6aaa02758216f0c066461bf",
      "parents": [
        "70d02ccb0ee3b53061a5e5b56d417c5a5075b48f"
      ],
      "author": {
        "name": "Bryan Kim",
        "email": "bryankim@google.com",
        "time": "Thu Sep 10 01:00:04 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Thu Sep 10 01:05:22 2026"
      },
      "message": "[Stale Flag Cleanup] OutOfProcessVideoDecoding\n\nRemove stale base::Feature flag OutOfProcessVideoDecoding using\nfeature-flag-removal skill.\n\nAlso updating the buildflags names to be consistent with the flag\ncleanup that is being done.\n\nBug: 356234178\nChange-Id: I51b3e867fa584342adf25c48f24f97cd3e71bf0a\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8103103\nReviewed-by: Pilar Molina Lopez \u003cpmolinalopez@chromium.org\u003e\nCommit-Queue: Bryan Kim \u003cbryankim@google.com\u003e\nReviewed-by: Mark Foltz \u003cmfoltz@chromium.org\u003e\nReviewed-by: Will Harris \u003cwfh@chromium.org\u003e\nReviewed-by: Dale Curtis \u003cdalecurtis@chromium.org\u003e\nReviewed-by: Rakina Zata Amni \u003crakina@chromium.org\u003e\nReviewed-by: Elly \u003cellyjones@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1695062}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 9191209ca46662b867f2acf73fc0bb50876bfc08\n"
    },
    {
      "commit": "70d02ccb0ee3b53061a5e5b56d417c5a5075b48f",
      "tree": "49fbf770cc0e4ea3699ff51247004e266b18cdc9",
      "parents": [
        "a15191bb09586019df88952106f6fc4f0297442c"
      ],
      "author": {
        "name": "Bryan Oltman",
        "email": "bryanoltman@google.com",
        "time": "Wed Sep 09 23:00:43 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Thu Sep 10 00:47:35 2026"
      },
      "message": "[macOS] Use sandboxed subdirectories for the GPU child process\n\nThis CL restricts the GPU process\u0027s access to the shared Darwin per-user\ndirectories (`_CS_DARWIN_USER_DIR`, `_CS_DARWIN_USER_TEMP_DIR`, and\n`_CS_DARWIN_USER_CACHE_DIR`, which default to `/var/folders/.../0/`,\n`/var/folders/.../T/`, and `/var/folders/.../C/`) to GPU isolated\nsubdirectories.\n\nKey changes:\n\n1. Update the GPU process\u0027s seatbelt profile to tighten the current\n   broad access to the Darwin user directories to sandboxed\n   subdirectories. This is accomplished using the\n   DIRHELPER_USER_DIR_SUFFIX\n   environment variable, which the macOS dirhelper utility appends to\n   the default `_CS_DARWIN` directory paths.\n2. Allow different process types to specify whether whether they need\n   the sandboxed directories mentioned above. This will allow child\n   processes other than the GPU to take advantage of this functionality\n   should they need it in the future.\n3. Disables the flaky\n   conformance/extensions/khr-parallel-shader-compile.html test on Intel\n   Macs.\n\nThis change is gated by the `kMacGpuSandboxDarwinUserDirs` feature flag.\n\nCq-Include-Trybots: luci.chromium.try:mac13-arm64-rel,mac14-arm64-rel,mac15-arm64-rel,mac14-tests,mac13-tests,mac15-x64-rel-tests;luci.chrome.try:mac-rel-ready\nChange-Id: Id621693080084bf780f034cd0a65dc7e94753a78\nFixed: 528379972,520019273,516947138,521559611,521486621,516893912,520755056\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8279765\nReviewed-by: Alex Gough \u003cajgo@chromium.org\u003e\nReviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\nReviewed-by: Avi Drissman \u003cavi@chromium.org\u003e\nCommit-Queue: Bryan Oltman \u003cbryanoltman@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1694962}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: ee781affc03766363d35a6bdb65a1db359ee1a7d\n"
    },
    {
      "commit": "a15191bb09586019df88952106f6fc4f0297442c",
      "tree": "374fe35db47b72bcba986f6ca6b311d2c7c3191b",
      "parents": [
        "6e906530e39116febda86a20aef18170ffd88b6e"
      ],
      "author": {
        "name": "Devon Loehr",
        "email": "dloehr@google.com",
        "time": "Tue Sep 08 23:05:28 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Tue Sep 08 23:11:06 2026"
      },
      "message": "Clean up supporting code for WinSDK 26100\n\nNow that we require building with the newest windows SDK (28000), we\ncan remove some code changes that were only used to support 26100\nduring the transition. Specifically, we now hard-fail if we no longer\nload `msdia140.dll`, which is required by `dbghelp.dll` in the 28000\nSDK but not in prior versions.\n\nThis CL also changes `ProcessDenyLowIntegrityRunner` to set its\nintegrity level on a delay, to match the behavior of\n`ProcessDenyBelowLowIntegrityRunner`. This is needed because\n`dbghelp.dll` can be loaded in a low-integrity process, but\n`msdia140.dll` cannot be.\n\nBug: 534305839\nChange-Id: I54676a2a3d8ace8696019fb28f58861eee222b19\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8264209\nReviewed-by: Will Harris \u003cwfh@chromium.org\u003e\nCommit-Queue: Devon Loehr \u003cdloehr@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1694150}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: cc290400c5fa73ff052048b51e9d5b14edcd3c10\n"
    },
    {
      "commit": "6e906530e39116febda86a20aef18170ffd88b6e",
      "tree": "075420b72b242ea7e99ee5b41326bbe38d19189c",
      "parents": [
        "6254e4403e2057f6fca8eb18dc640f94a0704e22"
      ],
      "author": {
        "name": "Bryan Oltman",
        "email": "bryanoltman@google.com",
        "time": "Tue Sep 08 22:33:49 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Tue Sep 08 22:45:44 2026"
      },
      "message": "[macOS] Remove kMacSandboxNetworkUserDirAccess feature\n\nThis CL removes the kMacSandboxNetworkUserDirAccess killswitch feature\nintroduced in https://crrev.com/c/7983514. The change was promoted to\nthe Stable channel in 151.0.7922.34 and should be safe to remove.\n\nBug: 527885521,527885521\nChange-Id: Id2b09dc85bf5f84db4e570aa5530fab1a6746133\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8374003\nReviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\nCommit-Queue: Bryan Oltman \u003cbryanoltman@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1694126}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: b0741813d5fd3ed6d1643f5035b766369962cce9\n"
    },
    {
      "commit": "6254e4403e2057f6fca8eb18dc640f94a0704e22",
      "tree": "cebd3a02b6e518b6f0a909608921435f8d07ffac",
      "parents": [
        "6834a1161113f547d28529be711db7bfae47ea2e"
      ],
      "author": {
        "name": "Stefan Smolen",
        "email": "ssmole@microsoft.com",
        "time": "Wed Sep 02 21:12:47 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Wed Sep 02 21:32:57 2026"
      },
      "message": "Make ssmole@microsoft.com a sandbox/win/owners\n\nChange-Id: I0107f28156717bee0297fb96c528ba6a7fe2513c\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8315851\nReviewed-by: Will Harris \u003cwfh@chromium.org\u003e\nCommit-Queue: Stefan Smolen \u003cssmole@microsoft.com\u003e\nReviewed-by: Alex Gough \u003cajgo@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1691089}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: a882ff0d733f0f4b5c8216915325561409c27bb7\n"
    },
    {
      "commit": "6834a1161113f547d28529be711db7bfae47ea2e",
      "tree": "a44b9df142f9a5647dcb26911f232722b99df2ab",
      "parents": [
        "38c61404e954946660c29c00ac7af6b4d1f92db5"
      ],
      "author": {
        "name": "Mahmoud Rashad",
        "email": "mmrashad@google.com",
        "time": "Mon Aug 31 22:04:03 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Mon Aug 31 22:14:36 2026"
      },
      "message": "Fix unsafe buffer usage in sandbox/linux/services/proc_util.cc\n\nReplaced strcmp and strncmp with std::string_view to fix unsafe buffer\noperations.\n\nInitial patchet generated by headless gemini-cli using:\n//agents/prompts/projects/spanification/run.py\n\nFixed: 455561662\nChange-Id: I6b31b679097cebdacdf2bd3e014e63813f3522d8\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7082593\nReviewed-by: Ben Scarlato \u003cakhna@google.com\u003e\nCommit-Queue: Mahmoud Rashad \u003cmmrashad@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1689323}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 3135423df30f4f52d16e64d61a1be8a03e784ac3\n"
    },
    {
      "commit": "38c61404e954946660c29c00ac7af6b4d1f92db5",
      "tree": "113a830f38d6957c2d97e8e9757936161d0f787d",
      "parents": [
        "61ba54e9a2ac3c471318e48ba8f0bdaaf03eedd6"
      ],
      "author": {
        "name": "utzcoz",
        "email": "utzcoz@gmail.com",
        "time": "Fri Aug 28 18:01:50 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Fri Aug 28 18:06:35 2026"
      },
      "message": "sandbox: skip uprobe/uretprobe in SandboxBPF.SyntheticPolicy\n\nSyntheticPolicy installs a filter that returns a synthetic errno for\nevery syscall number and asserts each one reports it. On recent\nkernels two x86-64 syscall numbers never reach the filter: the kernel\nexecutes uretprobe(2) (passthrough merged in 2025, ~6.15) and\nuprobe(2) (~6.18) without consulting seccomp, because they are kernel\nimplementation details of uprobes that default container policies -\nwhich return errno for unlisted syscalls - were breaking in every\nuprobed process. Invoked from outside a real probe trampoline,\nuretprobe(2) raises SIGILL and uprobe(2) fails with its own errno, so\non such kernels the test dies with signal 4 or asserts on the\nunexpected errno.\n\nSkip both numbers in the loop, and define them in the x86-64 syscall\nheader (the build sysroot\u0027s kernel headers predate them).\n\nBug: 553918183\nChange-Id: Ic7e641e5b7e453b09b9c70ee0ea84881dd33115b\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8304617\nCommit-Queue: Tom Sepez \u003ctsepez@chromium.org\u003e\nReviewed-by: Tom Sepez \u003ctsepez@chromium.org\u003e\nReviewed-by: Alex Gough \u003cajgo@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1688157}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 0f1b5f6879bc36319c1d518e9347f4620ae53bfd\n"
    },
    {
      "commit": "61ba54e9a2ac3c471318e48ba8f0bdaaf03eedd6",
      "tree": "0480afdeb9b94d03af956f88a2a218e92fe83bd1",
      "parents": [
        "e7468b2bf8343597ce6eb407f91a2cfe8fff0538"
      ],
      "author": {
        "name": "Joe Mason",
        "email": "joenotcharles@google.com",
        "time": "Thu Aug 27 03:50:43 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Thu Aug 27 03:55:02 2026"
      },
      "message": "Replace KiBU/MiBU/etc with KiB/MiB/etc for sandbox/policy/win\n\nThe base::KiBU() family of functions have been deprecated and replaced\nwith base::KiB().\n\nMechanically converted with:\n\ngit grep -l base::[KMGTPE]iBU|xargs sed -i\n\"s/base::\\([KMGTPE]\\)iBU/base::\\1iB/g\"\n\nThis CL was uploaded by git cl split.\n\nBug: 448661443\nChange-Id: Icf19c0a7fea73fa61da60a508bc5d8697f928e98\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8257547\nCommit-Queue: Joe Mason \u003cjoenotcharles@google.com\u003e\nReviewed-by: Will Harris \u003cwfh@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1686935}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 2d2645167c2e90359eb5a3370ed62a7af1c30c5c\n"
    },
    {
      "commit": "e7468b2bf8343597ce6eb407f91a2cfe8fff0538",
      "tree": "a1e24b59d2cbb50df5dbd44e4882958bcbe86d7f",
      "parents": [
        "e3c5d845f77f9ffff3439eb47ae035c1cf32aa52"
      ],
      "author": {
        "name": "Jeffrey Yu",
        "email": "yuje@chromium.org",
        "time": "Tue Aug 25 07:10:39 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Tue Aug 25 07:14:22 2026"
      },
      "message": "[net] Remove kAddressTrackerLinuxIsProxied flag\n\nThe net::features::kAddressTrackerLinuxIsProxied feature flag has been\nenabled by default. This CL removes the flag and cleans up the\nassociated code, always assuming the feature is enabled.\n\nConsequently, AddressTrackerLinux is always proxied/brokered on Linux,\nand the network service no longer needs to run it directly, which\nimproves the Linux network service sandbox.\n\nWe also remove the now-obsolete //net dependency in sandbox/policy since\nwe no longer need to check the feature flag there.\n\n      NetworkServiceConnectionTypeSyncedBrowserTest.*\n\nBug: b:356624159\nTest: AddressMapLinuxBrowserTest.*,\nChange-Id: I754eb10b3d941f6e28c9f3d122334f0292dd1c17\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7887860\nReviewed-by: Adam Rice \u003cricea@chromium.org\u003e\nReviewed-by: Kenichi Ishibashi \u003cbashi@chromium.org\u003e\nAuto-Submit: Jeffrey Yu \u003cyuje@chromium.org\u003e\nCommit-Queue: Kenichi Ishibashi \u003cbashi@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1685277}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 88276310dd6288c08d65736d18f29662c063a6e9\n"
    },
    {
      "commit": "e3c5d845f77f9ffff3439eb47ae035c1cf32aa52",
      "tree": "0fc7ffad2ae48b2ac2f28a81f8cde51d65fa94bc",
      "parents": [
        "7cee0c2beca60606076616488fe7e361a88e9d66"
      ],
      "author": {
        "name": "Mahmoud Rashad",
        "email": "mmrashad@google.com",
        "time": "Mon Aug 24 18:02:41 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Mon Aug 24 18:07:03 2026"
      },
      "message": "Fix unsafe buffer usage in setuid_sandbox_host.cc\n\nReplaced a raw pointer loop over kSUIDUnsafeEnvironmentVariables with a\nrange-based for loop over a base::span. This ensures safe access to the\narray and resolves the unsafe buffer usage warning.\n\nInitial patchset generated by headless gemini-cli using:\n//agents/prompts/projects/spanification/run.py\n\nFixed: 457304340\nChange-Id: I134fe17e569d31d96f67fea4b356a5cd9d035ea2\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7109399\nReviewed-by: Elly \u003cellyjones@chromium.org\u003e\nCommit-Queue: Mahmoud Rashad \u003cmmrashad@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1684852}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 633121b9cdd70ae5bfdf897a3ae85c0f569aaa55\n"
    },
    {
      "commit": "7cee0c2beca60606076616488fe7e361a88e9d66",
      "tree": "c412f88419c2d72b06dc7a45f35cd6bc381ff457",
      "parents": [
        "9fe45cb3abc8491cb0fdeb616c2e00d480686cb4"
      ],
      "author": {
        "name": "Avi Drissman",
        "email": "avi@chromium.org",
        "time": "Fri Aug 21 23:33:43 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Fri Aug 21 23:37:57 2026"
      },
      "message": "Update sandbox .sb files for a macOS 13 minimum\n\nChromium requires macOS 13; update the .sb files accordingly.\n\nBug: none\nChange-Id: I66db3cd7ce89ad374e374954c778ae7a6a6a6964\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8272124\nCommit-Queue: Avi Drissman \u003cavi@chromium.org\u003e\nReviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1684302}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: e54bf6723b8f86bf6917ea2e904d52781245cb36\n"
    },
    {
      "commit": "9fe45cb3abc8491cb0fdeb616c2e00d480686cb4",
      "tree": "66beceaf3a482bb81a96b920a08685f88eb4cfd0",
      "parents": [
        "1f39137045960083d732b4f5c415a1de1383e738"
      ],
      "author": {
        "name": "Bryan Oltman",
        "email": "bryanoltman@google.com",
        "time": "Fri Aug 21 19:58:55 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Fri Aug 21 20:02:26 2026"
      },
      "message": "[macoOS] Removes the kMacSandboxDistributedNotifications feature\n\nThis feature was released in 150 and no related issues have surfaced.\nRemove the feature and use the default behavior.\n\nBug: 513454805\nChange-Id: I76cea4d315c9ab33b5e143cc771792c54d937951\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8281185\nReviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\nCommit-Queue: Bryan Oltman \u003cbryanoltman@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1684147}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 698ef05b8d29a10ad0ed6640cf866cf293cc9b49\n"
    },
    {
      "commit": "1f39137045960083d732b4f5c415a1de1383e738",
      "tree": "bb201a3b06bfe2034e5dd443fc067940422e0ab8",
      "parents": [
        "125c2275f54d5b8c39efa3c365c8666e98f8d511"
      ],
      "author": {
        "name": "Lily Chen",
        "email": "chlily@chromium.org",
        "time": "Mon Aug 17 20:20:00 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Mon Aug 17 20:23:29 2026"
      },
      "message": "Revert \"[macOS] Use process-isolated subdirectories for the GPU child process\"\n\nThis reverts commit 184ba1c1ecc60dc52f1b6480b14828b8311e67fb.\n\nReason for revert: speculative fix for many failing Mac browser tests\n\nFailure Link:\nhttps://ci.chromium.org/ui/p/chromium/builders/ci/mac15-x64-rel-tests/21010/overview\nhttps://ci.chromium.org/ui/p/chrome/builders/ci/mac64/303516/overview\n\nOriginal change\u0027s description:\n\u003e [macOS] Use process-isolated subdirectories for the GPU child process\n\u003e\n\u003e This CL restricts the GPU process\u0027s access to the shared Darwin per-user\n\u003e directories (`_CS_DARWIN_USER_DIR`, `_CS_DARWIN_USER_TEMP_DIR`, and\n\u003e `_CS_DARWIN_USER_CACHE_DIR`, which default to `/var/folders/.../0/`,\n\u003e `/var/folders/.../T/`, and `/var/folders/.../C/`) to isolated\n\u003e per-process subdirectories, created at process launch time.\n\u003e\n\u003e Key changes:\n\u003e\n\u003e 1. Update the GPU process\u0027s seatbelt profile to tighten the current\n\u003e    broad access to the Darwin user directories to a process-isolated\n\u003e    subdirectories. This is accomplished using the\n\u003e    DIRHELPER_USER_DIR_SUFFIX\n\u003e    environment variable, which the macOS dirhelper utility appends to\n\u003e    the default `_CS_DARWIN` directory paths.\n\u003e 2. Allow different process types to specify whether whether they need\n\u003e    the isolated directories mentioned above. This will allow child\n\u003e    processes other than the GPU to take advantage of this functionality\n\u003e    should they need it in the future.\n\u003e 3. Disables the flaky\n\u003e    conformance/extensions/khr-parallel-shader-compile.html test on Intel\n\u003e    Macs.\n\u003e\n\u003e This change is gated by the `kMacGpuSandboxDarwinUserDirs` feature flag.\n\u003e\n\u003e This is a roll-forward of https://crrev.com/c/7965675 with fixes:\n\u003e\n\u003e 1. common.sb has been updated to allow issuance of sandbox extensions\n\u003e    for the new Metal shader cache location, fixing some of the CI\n\u003e    failures caused by the original CL.\n\u003e 2. `ChildProcessLauncherHelper::CreateProcessIsolatedDarwinUserDirs`\n\u003e    uses `CreateUniqueTempDirUnderPath` (with the Darwin user temp dir\n\u003e    as the path) instead of `CreateUniqueTempDir` to avoid providing a\n\u003e    subdir of MAC_CHROMIUM_TMPDIR as the sandboxed Darwin user temp dir.\n\u003e 3. More WPT test expectation updates.\n\u003e\n\u003e Fixed: 528379972,520019273,516947138,521559611,521486621,516893912\n\u003e Cq-Include-Trybots: luci.chromium.try:mac15-x64-rel-tests\n\u003e Change-Id: I0572c413180723aed8369b959335aef099b4ab6a\n\u003e Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8209919\n\u003e Reviewed-by: Avi Drissman \u003cavi@chromium.org\u003e\n\u003e Commit-Queue: Bryan Oltman \u003cbryanoltman@google.com\u003e\n\u003e Reviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\n\u003e Cr-Commit-Position: refs/heads/main@{#1679814}\n\nBug: 547819999,528379972,520019273,516947138,521559611,521486621,516893912\nCq-Include-Trybots: luci.chromium.try:mac15-x64-rel-tests\nChange-Id: I3ee17dedbeb18ff3bc142d8a877065c5bda39fae\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8263476\nBot-Commit: rubber-stamper@appspot.gserviceaccount.com \u003crubber-stamper@appspot.gserviceaccount.com\u003e\nCommit-Queue: Lily Chen \u003cchlily@chromium.org\u003e\nOwners-Override: Lily Chen \u003cchlily@chromium.org\u003e\nReviewed-by: Bryan Oltman \u003cbryanoltman@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1680732}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 9e99f5a70fe686c819d0c354ac580c3aaf5efd9e\n"
    },
    {
      "commit": "125c2275f54d5b8c39efa3c365c8666e98f8d511",
      "tree": "e92013128859a304a4b16a94118b20251bc93f6b",
      "parents": [
        "f1b146552f84bdda07c3ba5a56af3c0116e3b393"
      ],
      "author": {
        "name": "Bryan Oltman",
        "email": "bryanoltman@google.com",
        "time": "Fri Aug 14 19:34:10 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Fri Aug 14 19:37:05 2026"
      },
      "message": "[macOS] Use process-isolated subdirectories for the GPU child process\n\nThis CL restricts the GPU process\u0027s access to the shared Darwin per-user\ndirectories (`_CS_DARWIN_USER_DIR`, `_CS_DARWIN_USER_TEMP_DIR`, and\n`_CS_DARWIN_USER_CACHE_DIR`, which default to `/var/folders/.../0/`,\n`/var/folders/.../T/`, and `/var/folders/.../C/`) to isolated\nper-process subdirectories, created at process launch time.\n\nKey changes:\n\n1. Update the GPU process\u0027s seatbelt profile to tighten the current\n   broad access to the Darwin user directories to a process-isolated\n   subdirectories. This is accomplished using the\n   DIRHELPER_USER_DIR_SUFFIX\n   environment variable, which the macOS dirhelper utility appends to\n   the default `_CS_DARWIN` directory paths.\n2. Allow different process types to specify whether whether they need\n   the isolated directories mentioned above. This will allow child\n   processes other than the GPU to take advantage of this functionality\n   should they need it in the future.\n3. Disables the flaky\n   conformance/extensions/khr-parallel-shader-compile.html test on Intel\n   Macs.\n\nThis change is gated by the `kMacGpuSandboxDarwinUserDirs` feature flag.\n\nThis is a roll-forward of https://crrev.com/c/7965675 with fixes:\n\n1. common.sb has been updated to allow issuance of sandbox extensions\n   for the new Metal shader cache location, fixing some of the CI\n   failures caused by the original CL.\n2. `ChildProcessLauncherHelper::CreateProcessIsolatedDarwinUserDirs`\n   uses `CreateUniqueTempDirUnderPath` (with the Darwin user temp dir\n   as the path) instead of `CreateUniqueTempDir` to avoid providing a\n   subdir of MAC_CHROMIUM_TMPDIR as the sandboxed Darwin user temp dir.\n3. More WPT test expectation updates.\n\nFixed: 528379972,520019273,516947138,521559611,521486621,516893912\nCq-Include-Trybots: luci.chromium.try:mac15-x64-rel-tests\nChange-Id: I0572c413180723aed8369b959335aef099b4ab6a\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8209919\nReviewed-by: Avi Drissman \u003cavi@chromium.org\u003e\nCommit-Queue: Bryan Oltman \u003cbryanoltman@google.com\u003e\nReviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1679814}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 184ba1c1ecc60dc52f1b6480b14828b8311e67fb\n"
    },
    {
      "commit": "f1b146552f84bdda07c3ba5a56af3c0116e3b393",
      "tree": "bb201a3b06bfe2034e5dd443fc067940422e0ab8",
      "parents": [
        "9e38a92ed052f20b0959c8e7de808539d95865ca"
      ],
      "author": {
        "name": "Yue She",
        "email": "yueshe@google.com",
        "time": "Fri Aug 14 18:40:28 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Fri Aug 14 18:44:38 2026"
      },
      "message": "Reland \"Reland \"[mac] Enable aperitif on helper executables.\"\"\n\nThis is a reland of commit 62716c1f59e0b0f5375abb2ee955e26e470af79f\n\nReason for reland: adding libaperitif.dylib to signing list\n\nOriginal change\u0027s description:\n\u003e Reland \"[mac] Enable aperitif on helper executables.\"\n\u003e\n\u003e This is a reland of commit dfa0e77c016df17590e562dc975ac0ca0f64ff39\n\u003e\n\u003e Original change\u0027s description:\n\u003e \u003e [mac] Enable aperitif on helper executables.\n\u003e \u003e\n\u003e \u003e This CL sets up \"Aperitified\" helper executables, as well as putting\n\u003e \u003e these behind a feature flag. This does mean that we will be shipping\n\u003e \u003e two versions of each helper, one that is linked w/ dlopen() and one\n\u003e \u003e linked w/ libaperitif. This will allow us to do A/B testing on the\n\u003e \u003e performance improvements of libaperitif.\n\u003e \u003e\n\u003e \u003e This CL also modifies the aperitif_unittest. Previously it looped\n\u003e \u003e through every initializer printed with DYLD_PRINT_INITIALIZERS, but\n\u003e \u003e now it stops the loop once it sees libaperitif is initialized.\n\u003e \u003e\n\u003e \u003e Bug: 40794783\n\u003e \u003e Change-Id: I1eee5a7fa4b5aa50e64adb8cf00e89f2ade4b701\n\u003e \u003e Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7970768\n\u003e \u003e Reviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\n\u003e \u003e Reviewed-by: Avi Drissman \u003cavi@chromium.org\u003e\n\u003e \u003e Reviewed-by: Tom Sepez \u003ctsepez@chromium.org\u003e\n\u003e \u003e Commit-Queue: Liza Burakova \u003cliza@chromium.org\u003e\n\u003e \u003e Cr-Commit-Position: refs/heads/main@{#1676768}\n\u003e\n\u003e Bug: 40794783\n\u003e Change-Id: Ice4ab35a832aeaabe6d555dc424959f854b9ac6b\n\u003e Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8242707\n\u003e Reviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\n\u003e Reviewed-by: Yue She \u003cyueshe@google.com\u003e\n\u003e Reviewed-by: Avi Drissman \u003cavi@chromium.org\u003e\n\u003e Reviewed-by: Tom Sepez \u003ctsepez@chromium.org\u003e\n\u003e Commit-Queue: Liza Burakova \u003cliza@chromium.org\u003e\n\u003e Cr-Commit-Position: refs/heads/main@{#1679014}\n\nBug: 40794783\nChange-Id: Ia52ceea3207eb38d5a9657b964cb01856a3b08c2\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8257183\nReviewed-by: Tom Sepez \u003ctsepez@chromium.org\u003e\nReviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\nReviewed-by: Avi Drissman \u003cavi@chromium.org\u003e\nCommit-Queue: Yue She \u003cyueshe@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1679745}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 95c20af3e1d6cecc4793af5afd949eafe00a1622\n"
    },
    {
      "commit": "9e38a92ed052f20b0959c8e7de808539d95865ca",
      "tree": "1621212ae7276dc21c1c585a53e9e2a5df076968",
      "parents": [
        "618789ce127df546601ef461141f51ae5f9ce07a"
      ],
      "author": {
        "name": "Volodymyr Plotkin",
        "email": "vplotkin@google.com",
        "time": "Fri Aug 14 13:30:21 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Fri Aug 14 13:33:27 2026"
      },
      "message": "Revert \"Reland \"[mac] Enable aperitif on helper executables.\"\"\n\nThis reverts commit 62716c1f59e0b0f5375abb2ee955e26e470af79f.\n\nReason for revert: Breaks official mac-universalizer signing b/546422406\n\nFailure Link: http://sponge2/b2761f1e-bfec-40ba-81aa-ca6fbc072fd2\n\nOriginal change\u0027s description:\n\u003e Reland \"[mac] Enable aperitif on helper executables.\"\n\u003e\n\u003e This is a reland of commit dfa0e77c016df17590e562dc975ac0ca0f64ff39\n\u003e\n\u003e Original change\u0027s description:\n\u003e \u003e [mac] Enable aperitif on helper executables.\n\u003e \u003e\n\u003e \u003e This CL sets up \"Aperitified\" helper executables, as well as putting\n\u003e \u003e these behind a feature flag. This does mean that we will be shipping\n\u003e \u003e two versions of each helper, one that is linked w/ dlopen() and one\n\u003e \u003e linked w/ libaperitif. This will allow us to do A/B testing on the\n\u003e \u003e performance improvements of libaperitif.\n\u003e \u003e\n\u003e \u003e This CL also modifies the aperitif_unittest. Previously it looped\n\u003e \u003e through every initializer printed with DYLD_PRINT_INITIALIZERS, but\n\u003e \u003e now it stops the loop once it sees libaperitif is initialized.\n\u003e \u003e\n\u003e \u003e Bug: 40794783\n\u003e \u003e Change-Id: I1eee5a7fa4b5aa50e64adb8cf00e89f2ade4b701\n\u003e \u003e Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7970768\n\u003e \u003e Reviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\n\u003e \u003e Reviewed-by: Avi Drissman \u003cavi@chromium.org\u003e\n\u003e \u003e Reviewed-by: Tom Sepez \u003ctsepez@chromium.org\u003e\n\u003e \u003e Commit-Queue: Liza Burakova \u003cliza@chromium.org\u003e\n\u003e \u003e Cr-Commit-Position: refs/heads/main@{#1676768}\n\u003e\n\u003e Bug: 40794783\n\u003e Change-Id: Ice4ab35a832aeaabe6d555dc424959f854b9ac6b\n\u003e Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8242707\n\u003e Reviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\n\u003e Reviewed-by: Yue She \u003cyueshe@google.com\u003e\n\u003e Reviewed-by: Avi Drissman \u003cavi@chromium.org\u003e\n\u003e Reviewed-by: Tom Sepez \u003ctsepez@chromium.org\u003e\n\u003e Commit-Queue: Liza Burakova \u003cliza@chromium.org\u003e\n\u003e Cr-Commit-Position: refs/heads/main@{#1679014}\n\nBug: 40794783\nNo-Presubmit: true\nNo-Tree-Checks: true\nNo-Try: true\nChange-Id: I50895e4319c6fa13338be49743d9c3507206f529\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8255311\nBot-Commit: rubber-stamper@appspot.gserviceaccount.com \u003crubber-stamper@appspot.gserviceaccount.com\u003e\nReviewed-by: Yue She \u003cyueshe@google.com\u003e\nOwners-Override: Mark Mentovai \u003cmark@chromium.org\u003e\nReviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\nAuto-Submit: Volodymyr Plotkin \u003cvplotkin@google.com\u003e\nCommit-Queue: Mark Mentovai \u003cmark@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1679492}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 3809a089e372acecd0efa646cea36c555e98d830\n"
    },
    {
      "commit": "618789ce127df546601ef461141f51ae5f9ce07a",
      "tree": "bb201a3b06bfe2034e5dd443fc067940422e0ab8",
      "parents": [
        "c45c430e09c4841fa0894a89e7f3c0b9bdf9a128"
      ],
      "author": {
        "name": "Phillis Tang",
        "email": "phillis@chromium.org",
        "time": "Fri Aug 14 00:21:52 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Fri Aug 14 00:25:44 2026"
      },
      "message": "webnn: setup coreml compiler sandbox rules\n\nSetup sandboxing rules for the WebNN CoreML backend compiler service.\nThe current rules allow the compiler service to run CoreML model compile\nAPI to compile model to darwin-user-temp-dir.\n\nBug: 524263705\nChange-Id: I297bdd1ca48450e90d252d3bb3e9725ec352790b\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8163822\nReviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\nReviewed-by: Bryan Oltman \u003cbryanoltman@google.com\u003e\nCommit-Queue: Phillis Tang \u003cphillis@chromium.org\u003e\nReviewed-by: Alex Gough \u003cajgo@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1679213}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 5e04fe944317ce9f6de7d7d83ea4c61018d8e83e\n"
    },
    {
      "commit": "c45c430e09c4841fa0894a89e7f3c0b9bdf9a128",
      "tree": "8e759c79a106d28b664bed35494ed6a923be5065",
      "parents": [
        "297ca3f3ab8fedd7fce1e24716e4bac6b662ec81"
      ],
      "author": {
        "name": "Liza Burakova",
        "email": "liza@chromium.org",
        "time": "Thu Aug 13 18:57:51 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Thu Aug 13 19:02:18 2026"
      },
      "message": "Reland \"[mac] Enable aperitif on helper executables.\"\n\nThis is a reland of commit dfa0e77c016df17590e562dc975ac0ca0f64ff39\n\nOriginal change\u0027s description:\n\u003e [mac] Enable aperitif on helper executables.\n\u003e\n\u003e This CL sets up \"Aperitified\" helper executables, as well as putting\n\u003e these behind a feature flag. This does mean that we will be shipping\n\u003e two versions of each helper, one that is linked w/ dlopen() and one\n\u003e linked w/ libaperitif. This will allow us to do A/B testing on the\n\u003e performance improvements of libaperitif.\n\u003e\n\u003e This CL also modifies the aperitif_unittest. Previously it looped\n\u003e through every initializer printed with DYLD_PRINT_INITIALIZERS, but\n\u003e now it stops the loop once it sees libaperitif is initialized.\n\u003e\n\u003e Bug: 40794783\n\u003e Change-Id: I1eee5a7fa4b5aa50e64adb8cf00e89f2ade4b701\n\u003e Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7970768\n\u003e Reviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\n\u003e Reviewed-by: Avi Drissman \u003cavi@chromium.org\u003e\n\u003e Reviewed-by: Tom Sepez \u003ctsepez@chromium.org\u003e\n\u003e Commit-Queue: Liza Burakova \u003cliza@chromium.org\u003e\n\u003e Cr-Commit-Position: refs/heads/main@{#1676768}\n\nBug: 40794783\nChange-Id: Ice4ab35a832aeaabe6d555dc424959f854b9ac6b\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8242707\nReviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\nReviewed-by: Yue She \u003cyueshe@google.com\u003e\nReviewed-by: Avi Drissman \u003cavi@chromium.org\u003e\nReviewed-by: Tom Sepez \u003ctsepez@chromium.org\u003e\nCommit-Queue: Liza Burakova \u003cliza@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1679014}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 62716c1f59e0b0f5375abb2ee955e26e470af79f\n"
    },
    {
      "commit": "297ca3f3ab8fedd7fce1e24716e4bac6b662ec81",
      "tree": "74faf50749af5f597e3b8cbc2a986c00cc17f8f6",
      "parents": [
        "22990fe3bbeb58945111bc6166d336a9c575b561"
      ],
      "author": {
        "name": "Adem Derinel",
        "email": "derinel@google.com",
        "time": "Tue Aug 11 07:25:18 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Tue Aug 11 07:28:42 2026"
      },
      "message": "Revert \"[mac] Enable aperitif on helper executables.\"\n\nThis reverts commit dfa0e77c016df17590e562dc975ac0ca0f64ff39.\n\nReason for revert: b/544963541\n\nFailure Link: https://ci.chromium.org/ui/test/chromium/%3A%2F%2Fchrome%2Ftest%5C%3Aunit_tests!gtest%3A%3AAperitifTest%23InitializerOrder?q\u003dV%3Abucket%3Dci+V%3Abuilder%3DMac%2520ASan%252064%2520Tests%2520%281%29+V%3Aos%3DMac-15+V%3Atest_suite%3Dunit_tests\n\nOriginal change\u0027s description:\n\u003e [mac] Enable aperitif on helper executables.\n\u003e\n\u003e This CL sets up \"Aperitified\" helper executables, as well as putting\n\u003e these behind a feature flag. This does mean that we will be shipping\n\u003e two versions of each helper, one that is linked w/ dlopen() and one\n\u003e linked w/ libaperitif. This will allow us to do A/B testing on the\n\u003e performance improvements of libaperitif.\n\u003e\n\u003e This CL also modifies the aperitif_unittest. Previously it looped\n\u003e through every initializer printed with DYLD_PRINT_INITIALIZERS, but\n\u003e now it stops the loop once it sees libaperitif is initialized.\n\u003e\n\u003e Bug: 40794783\n\u003e Change-Id: I1eee5a7fa4b5aa50e64adb8cf00e89f2ade4b701\n\u003e Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7970768\n\u003e Reviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\n\u003e Reviewed-by: Avi Drissman \u003cavi@chromium.org\u003e\n\u003e Reviewed-by: Tom Sepez \u003ctsepez@chromium.org\u003e\n\u003e Commit-Queue: Liza Burakova \u003cliza@chromium.org\u003e\n\u003e Cr-Commit-Position: refs/heads/main@{#1676768}\n\nBug: 40794783, 544963541\nNo-Presubmit: true\nNo-Tree-Checks: true\nNo-Try: true\nBug: 40794783\nChange-Id: Ibdc1d6abd3029bd1959eed5ce0b049428a281009\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8233260\nBot-Commit: rubber-stamper@appspot.gserviceaccount.com \u003crubber-stamper@appspot.gserviceaccount.com\u003e\nAuto-Submit: Adem Derinel \u003cderinel@google.com\u003e\nCommit-Queue: rubber-stamper@appspot.gserviceaccount.com \u003crubber-stamper@appspot.gserviceaccount.com\u003e\nOwners-Override: Adem Derinel \u003cderinel@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1677012}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 9c6fc942af8949f57a05e43946c873b21a5c8d7f\n"
    },
    {
      "commit": "22990fe3bbeb58945111bc6166d336a9c575b561",
      "tree": "8e759c79a106d28b664bed35494ed6a923be5065",
      "parents": [
        "9c8b3249ed811fe344dda7cb20e7223f1ce4367f"
      ],
      "author": {
        "name": "Liza Burakova",
        "email": "liza@chromium.org",
        "time": "Mon Aug 10 22:46:48 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Mon Aug 10 22:52:24 2026"
      },
      "message": "[mac] Enable aperitif on helper executables.\n\nThis CL sets up \"Aperitified\" helper executables, as well as putting\nthese behind a feature flag. This does mean that we will be shipping\ntwo versions of each helper, one that is linked w/ dlopen() and one\nlinked w/ libaperitif. This will allow us to do A/B testing on the\nperformance improvements of libaperitif.\n\nThis CL also modifies the aperitif_unittest. Previously it looped\nthrough every initializer printed with DYLD_PRINT_INITIALIZERS, but\nnow it stops the loop once it sees libaperitif is initialized.\n\nBug: 40794783\nChange-Id: I1eee5a7fa4b5aa50e64adb8cf00e89f2ade4b701\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7970768\nReviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\nReviewed-by: Avi Drissman \u003cavi@chromium.org\u003e\nReviewed-by: Tom Sepez \u003ctsepez@chromium.org\u003e\nCommit-Queue: Liza Burakova \u003cliza@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1676768}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: dfa0e77c016df17590e562dc975ac0ca0f64ff39\n"
    },
    {
      "commit": "9c8b3249ed811fe344dda7cb20e7223f1ce4367f",
      "tree": "74faf50749af5f597e3b8cbc2a986c00cc17f8f6",
      "parents": [
        "25aab982238e590092c929262dba9140f7e0460a"
      ],
      "author": {
        "name": "Victor Hugo Vianna Silva",
        "email": "victorvianna@google.com",
        "time": "Wed Aug 05 21:26:40 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Wed Aug 05 21:29:54 2026"
      },
      "message": "Fix include guard presubmit warnings\n\n`git cl presubmit --all` reported 185 CheckForIncludeGuards warnings on\nheaders that predate the check or drifted from it.\n\nBug: 542921651\nChange-Id: I765467f184ee89b8ba9bf9889756e175512f6b73\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8203984\nOwners-Override: Avi Drissman \u003cavi@chromium.org\u003e\nCommit-Queue: Victor Vianna \u003cvictorvianna@google.com\u003e\nSLSA-Policy-Verified: SLSA Policy Verification Service \u003cdevtools-gerritcodereview-exitgate@google.com\u003e\nReviewed-by: Avi Drissman \u003cavi@chromium.org\u003e\nAuto-Submit: Victor Vianna \u003cvictorvianna@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1674510}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: f9c7fc25182a632b7bdc6d1941781cad49c86440\n"
    },
    {
      "commit": "25aab982238e590092c929262dba9140f7e0460a",
      "tree": "c73a93834d5145b6aea2cec1ce42d91d67b70a6b",
      "parents": [
        "fcac155e61971a22cd157804aaccd8972635a421"
      ],
      "author": {
        "name": "Aliaksei Bahdzevich",
        "email": "thelex@google.com",
        "time": "Wed Aug 05 13:32:54 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Wed Aug 05 13:36:43 2026"
      },
      "message": "Revert \"[macOS] Use process-isolated subdirectories for the GPU child process\"\n\nThis reverts commit c2706c3317723e987f85322a25ed475bdfe3a719.\n\nReason for revert: Causing mac64 builder to fail\n\nFailure Link: https://ci.chromium.org/ui/p/chrome/builders/ci/mac64/301795/overview\n\nOriginal change\u0027s description:\n\u003e [macOS] Use process-isolated subdirectories for the GPU child process\n\u003e\n\u003e This CL restricts the GPU process\u0027s access to the shared Darwin per-user\n\u003e directories (`_CS_DARWIN_USER_DIR`, `_CS_DARWIN_USER_TEMP_DIR`, and\n\u003e `_CS_DARWIN_USER_CACHE_DIR`, which default to `/var/folders/.../0/`,\n\u003e `/var/folders/.../T/`, and `/var/folders/.../C/`) to isolated\n\u003e per-process subdirectories, created at process launch time.\n\u003e\n\u003e Key changes:\n\u003e\n\u003e 1. Update the GPU process\u0027s seatbelt profile to tighten the current\n\u003e    broad access to the Darwin user directories to a process-isolated\n\u003e    subdirectories. This is accomplished using the\n\u003e    DIRHELPER_USER_DIR_SUFFIX\n\u003e    environment variable, which the macOS dirhelper utility appends to\n\u003e    the default `_CS_DARWIN` directory paths.\n\u003e 2. Allow different process types to specify whether whether they need\n\u003e    the isolated directories mentioned above. This will allow child\n\u003e    processes other than the GPU to take advantage of this functionality\n\u003e    should they need it in the future.\n\u003e 3. Disables the flaky\n\u003e    conformance/extensions/khr-parallel-shader-compile.html test on Intel\n\u003e    Macs.\n\u003e\n\u003e This change is gated by the `kMacGpuSandboxDarwinUserDirs` feature flag.\n\u003e\n\u003e Include-Ci-Only-Tests: true\n\u003e Fixed: 528379972\n\u003e Change-Id: Icbcdb93889b46dc8645b1f9bed68649174d19134\n\u003e Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7965675\n\u003e Reviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\n\u003e Reviewed-by: Camille Lamy \u003cclamy@chromium.org\u003e\n\u003e Cr-Commit-Position: refs/heads/main@{#1673842}\n\nBug: 528379972\nNo-Presubmit: true\nNo-Tree-Checks: true\nNo-Try: true\nChange-Id: I245c9b82d0d6613f56d1e2416c98adc6f5cc6ba1\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8202167\nBot-Commit: rubber-stamper@appspot.gserviceaccount.com \u003crubber-stamper@appspot.gserviceaccount.com\u003e\nCommit-Queue: Keren Zhu \u003ckerenzhu@chromium.org\u003e\nOwners-Override: Keren Zhu \u003ckerenzhu@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1674094}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 08120a049a0c0dab3246bcf947f379fee33037b9\n"
    },
    {
      "commit": "fcac155e61971a22cd157804aaccd8972635a421",
      "tree": "fc4fe5ce2a54d8901752ca6632878f96562236f6",
      "parents": [
        "2ac1ce33d6a51dc3e2ddbbf2d71a062c9bc598bd"
      ],
      "author": {
        "name": "Bryan Oltman",
        "email": "bryanoltman@google.com",
        "time": "Wed Aug 05 01:48:25 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Wed Aug 05 01:52:55 2026"
      },
      "message": "[macOS] Use process-isolated subdirectories for the GPU child process\n\nThis CL restricts the GPU process\u0027s access to the shared Darwin per-user\ndirectories (`_CS_DARWIN_USER_DIR`, `_CS_DARWIN_USER_TEMP_DIR`, and\n`_CS_DARWIN_USER_CACHE_DIR`, which default to `/var/folders/.../0/`,\n`/var/folders/.../T/`, and `/var/folders/.../C/`) to isolated\nper-process subdirectories, created at process launch time.\n\nKey changes:\n\n1. Update the GPU process\u0027s seatbelt profile to tighten the current\n   broad access to the Darwin user directories to a process-isolated\n   subdirectories. This is accomplished using the\n   DIRHELPER_USER_DIR_SUFFIX\n   environment variable, which the macOS dirhelper utility appends to\n   the default `_CS_DARWIN` directory paths.\n2. Allow different process types to specify whether whether they need\n   the isolated directories mentioned above. This will allow child\n   processes other than the GPU to take advantage of this functionality\n   should they need it in the future.\n3. Disables the flaky\n   conformance/extensions/khr-parallel-shader-compile.html test on Intel\n   Macs.\n\nThis change is gated by the `kMacGpuSandboxDarwinUserDirs` feature flag.\n\nInclude-Ci-Only-Tests: true\nFixed: 528379972\nChange-Id: Icbcdb93889b46dc8645b1f9bed68649174d19134\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7965675\nReviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\nReviewed-by: Camille Lamy \u003cclamy@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1673842}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: c2706c3317723e987f85322a25ed475bdfe3a719\n"
    },
    {
      "commit": "2ac1ce33d6a51dc3e2ddbbf2d71a062c9bc598bd",
      "tree": "c73a93834d5145b6aea2cec1ce42d91d67b70a6b",
      "parents": [
        "727326f0ea00b17d35a199380dc311b4ee607ad1"
      ],
      "author": {
        "name": "Bryan Oltman",
        "email": "bryanoltman@google.com",
        "time": "Tue Aug 04 20:07:40 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Tue Aug 04 20:12:21 2026"
      },
      "message": "Revert \"Remove file-issue-extension permission from gpu seatbelt profile\"\n\nThis reverts commit 2701413522262a4b49624ecbc95226435c80b61e.\n\nReason for revert: dawn tests failing on macOS 14.4.1 (`vpython3 tools/utr -p chromium -B try -b dawn-mac-x64-deps-rel -t \"webgpu_swiftshader_blink_web_tests_with_backend_validation on AMD 0x7340 GPU on Mac Retina\" compile-and-test -- --gtest_filter\u003dwpt_internal/webgpu/web_platform/canvas/copy_element_image_to_texture-clipped.https.html`)\n\nFailure Link: https://chromium-swarm.appspot.com/task?id\u003d79e6b96ad6f6d710\n\nOriginal change\u0027s description:\n\u003e Remove file-issue-extension permission from gpu seatbelt profile\n\u003e\n\u003e As per the discussion in the linked bug, this permissions was originally\n\u003e granted to fix an issue affecting macOS version between 14.2.1 and\n\u003e 14.3.1 (https://g-issues.chromium.org/issues/41485470#comment8). The\n\u003e issue may have affected earlier versions of macOS 14, but specifically\n\u003e did not affect 13.6.4\n\u003e (https://g-issues.chromium.org/issues/41485470#comment10).\n\u003e\n\u003e Furthermore, the issue seems to have only manifested on bots\n\u003e (https://g-issues.chromium.org/issues/41485470#comment32), which\n\u003e execute tests in a directory that does not have `/Users` as an\n\u003e ancestor.\n\u003e\n\u003e This CL simply removes the permission, as it\u0027s not clear there was\n\u003e ever a user-facing impact and we do not have any bots running affected\n\u003e versions of macOS.\n\u003e\n\u003e Fixed: 517249110\n\u003e Change-Id: I5aefbbc6bb1381232a5fa26386cd733790884913\n\u003e Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8131180\n\u003e Reviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\n\u003e Commit-Queue: Bryan Oltman \u003cbryanoltman@google.com\u003e\n\u003e Cr-Commit-Position: refs/heads/main@{#1665672}\n\nBug: 517249110\nChange-Id: I7fc05cc4b94fa1067c21f1d8bdfa29b1283764b8\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8192637\nReviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\nCommit-Queue: Bryan Oltman \u003cbryanoltman@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1673618}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 006487cd473e8d75743ab5e6e5f7705ec8606a11\n"
    },
    {
      "commit": "727326f0ea00b17d35a199380dc311b4ee607ad1",
      "tree": "6579b807a8f0b6778a7059bce7680ddd86fadb89",
      "parents": [
        "a9e64af164a0bad2d71a1336c83b2e374e35fdc7"
      ],
      "author": {
        "name": "Devon Loehr",
        "email": "dloehr@google.com",
        "time": "Wed Jul 29 18:05:16 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Wed Jul 29 18:10:31 2026"
      },
      "message": "Start loading msdia140.dll when loading dbghelp.dll\n\nIn the newest windows SDK versions, dbghelp.dll now depends on\nmsdia140.dll, which is also present in more locations in the toolchain\npackage. However, dbghelp loads msdia dynamically at runtime, so we\nneed to ensure it\u0027s prewarmed before entering the sandbox.\n\nWe also need to make sure that we copy the dll to the out directory.\nSince GN expects steps to always have the same output, we copy some\nversion of the dll even for older SDK versions, where it will usually\nbe ignored.\n\nBug: 534305839\nChange-Id: Ic7d76e728a2942bdd28f0a3fbda88c5167e06214\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8125374\nReviewed-by: Avi Drissman \u003cavi@chromium.org\u003e\nReviewed-by: Alex Gough \u003cajgo@chromium.org\u003e\nCommit-Queue: Devon Loehr \u003cdloehr@google.com\u003e\nReviewed-by: Nico Weber \u003cthakis@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1670418}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 5b107640bfc27738593a545105bb887844cce688\n"
    },
    {
      "commit": "a9e64af164a0bad2d71a1336c83b2e374e35fdc7",
      "tree": "21629019f031843a19553be993fe58a65e15c5f0",
      "parents": [
        "8f54579476219ba0ff155c55520fa226941acce1"
      ],
      "author": {
        "name": "Mohannad Farrag",
        "email": "aymanm@google.com",
        "time": "Wed Jul 29 15:17:52 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Wed Jul 29 15:20:52 2026"
      },
      "message": "Add GRO to fieldtrial_testing_config\n\nGRO is only supported on Linux and its derivatives (e.g. Android and\nChromeOS). So enable it in the fieldtrial so I can go ahead with the\nexperimentation. In order for this to pass, GRO socketopt must be\nallowed in the sandbox so I\u0027m doing both in the same CL.\n\nBug: 515333601\nChange-Id: Ib2e2e7857ea423ff917af06b944dd50005a0dd21\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8158642\nReviewed-by: Ben Scarlato \u003cakhna@google.com\u003e\nReviewed-by: Etienne Dechamps \u003cedechamps@google.com\u003e\nCommit-Queue: Mohannad Farrag \u003caymanm@google.com\u003e\nAuto-Submit: Mohannad Farrag \u003caymanm@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1670267}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 7daf5842f98dc7584545c3c22fc074d1e031cc4d\n"
    },
    {
      "commit": "8f54579476219ba0ff155c55520fa226941acce1",
      "tree": "df7b23f6ed9bb19c6d0ead201c56a1451b4da121",
      "parents": [
        "af0b56ae50156f5d0b802ce98a6eb82b0683f2a1"
      ],
      "author": {
        "name": "Will Harris",
        "email": "wfh@chromium.org",
        "time": "Wed Jul 29 03:43:32 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Wed Jul 29 03:47:01 2026"
      },
      "message": "Enable WinSboxModuleTamperingProtection by default\n\nThis feature is shipping shortly, so enable the feature in the code.\n\nBug: 499921564\nChange-Id: I9818a6737f4b94961d19bb92ad665956858959f4\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8154781\nCommit-Queue: Will Harris \u003cwfh@chromium.org\u003e\nReviewed-by: Alex Gough \u003cajgo@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1669973}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 51a1fadc7f8429be578f8e222fb95d6ebb9962ff\n"
    },
    {
      "commit": "af0b56ae50156f5d0b802ce98a6eb82b0683f2a1",
      "tree": "d2b7142173dda97f5240e9084ab662b18f9a212a",
      "parents": [
        "8dcfa325304eaf28956bc614a59c0738e74e16b2"
      ],
      "author": {
        "name": "Arthur Sonzogni",
        "email": "arthursonzogni@chromium.org",
        "time": "Tue Jul 28 16:37:13 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Tue Jul 28 16:40:46 2026"
      },
      "message": "[unsafe-buffers] Update allow_unsafe_buffers in sandbox/ SUID C files\n\nKeep #pragma allow_unsafe_buffers in sandbox.c and\nsuid_unsafe_environment_variables.h with a comment explaining that\nthey are C files and cannot use C++ base/compiler_specific.h.\n\nBug: 351564777, 501112808\nChange-Id: If8e067c2b8ba06e9b37d3ffd0eb757c9269b8ff3\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8152727\nReviewed-by: Elly \u003cellyjones@chromium.org\u003e\nCommit-Queue: Arthur Sonzogni \u003carthursonzogni@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1669571}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 4fd6491fed66a940a9c96b4003798212cae6c996\n"
    },
    {
      "commit": "8dcfa325304eaf28956bc614a59c0738e74e16b2",
      "tree": "a862cac88770c5bd4e84872ceabb7a0eef9daf5a",
      "parents": [
        "86344cd80725dea60e3c4e17beb8c7616710ea75"
      ],
      "author": {
        "name": "Greg Thompson",
        "email": "grt@chromium.org",
        "time": "Tue Jul 28 15:24:54 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Tue Jul 28 15:28:11 2026"
      },
      "message": "[sandbox/linux] Fix directory traversal vulnerability\n\nBrokerFilePermission::ValidatePath failed to reject paths ending with\nthe `/.` (current directory) self-reference. This allowed an attacker to\nrequest `/tmp/.`, which bypassed ValidatePath() but still successfully\nmatched the base::StartsWith() check for the `/tmp/` recursive\npermission in MatchPath(), improperly granting a dirfd to the root\ncapability. BrokerFilePermission now rejects paths containing `/../` or\n`/./`, as well as trailing `/..` and `/.` references.\n\nFixed: 500311587\nChange-Id: If6beb2361a8a69c6f6a3955aa38c6585d102f3cb\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8160841\nReviewed-by: Elly \u003cellyjones@chromium.org\u003e\nAuto-Submit: Greg Thompson \u003cgrt@chromium.org\u003e\nCommit-Queue: Elly \u003cellyjones@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1669516}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 4298968d02fa7a24dccc65b03071af84c5418c38\n"
    },
    {
      "commit": "86344cd80725dea60e3c4e17beb8c7616710ea75",
      "tree": "a4ebaf19e1d240345830c9e766841a9ac2c175d9",
      "parents": [
        "997a324ea58a60dfadf6b704115de384bac94040"
      ],
      "author": {
        "name": "Will Harris",
        "email": "wfh@chromium.org",
        "time": "Fri Jul 24 01:58:33 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Fri Jul 24 02:02:48 2026"
      },
      "message": "Enable WinSboxHighGPUJobMemoryLimits by default\n\nThis feature is launching shortly, so enable the feature by default in\nChromium.\n\nUpdate some tests too, so they understand the feature state and have the\ncorrect expectations.\n\nBug: 376720478\nChange-Id: Id376f6f5a9d10c462f01a61f29aec4a24de9d96b\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8134608\nReviewed-by: Alex Gough \u003cajgo@chromium.org\u003e\nCommit-Queue: Will Harris \u003cwfh@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1667590}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 75356963ee8f47d1272d099f39a8671d34f3893c\n"
    },
    {
      "commit": "997a324ea58a60dfadf6b704115de384bac94040",
      "tree": "ac410b6a1e3f279691a41692765a1caf9380abee",
      "parents": [
        "361c10db79042622119e1d91f99ce3eda3ddbf7e"
      ],
      "author": {
        "name": "Julia Hansbrough",
        "email": "flowerhack@google.com",
        "time": "Thu Jul 23 07:41:45 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Thu Jul 23 07:45:09 2026"
      },
      "message": "[finch] Remove the three-argument BASE_FEATURE macro everywhere it is\nsafe to do so.\n\nUsage of the three-argument BASE_FEATURE macro is discouraged in current\ncode.\n\nWe have some legacy callsites for the three-argument macro that can\u0027t be\nseamlessly updatdd, because the C++ identifier doesn\u0027t match the Feature\nname (e.g. the C++ identifier isn\u0027t just the feature name prepended with\na \"k\").\n\nHowever, we have some ~130 callsites where they DO match, and so we\ncould simply be using the two-argument macro.\n\nLet\u0027s update all those callsites accordingly.\n\nBug: 530271065\nChange-Id: I943f63ea1b62ba7b8f8952bf57b7f60608ad2717\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8033026\nCommit-Queue: Colin Blundell \u003cblundell@chromium.org\u003e\nReviewed-by: Thomas Lukaszewicz \u003ctluk@chromium.org\u003e\nReviewed-by: Alexei Svitkine \u003casvitkine@chromium.org\u003e\nReviewed-by: Kentaro Hara \u003charaken@chromium.org\u003e\nOwners-Override: Colin Blundell \u003cblundell@chromium.org\u003e\nReviewed-by: Bo Liu \u003cboliu@chromium.org\u003e\nReviewed-by: Colin Blundell \u003cblundell@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1666880}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: a410d4615c83e62d027c8708907213bed2598fbe\n"
    },
    {
      "commit": "361c10db79042622119e1d91f99ce3eda3ddbf7e",
      "tree": "8cd18b2e15d7599de14476bd36bb309a92a63dd4",
      "parents": [
        "b061f8b8beaced209d1a33650e07a4d168227d5a"
      ],
      "author": {
        "name": "Bryan Oltman",
        "email": "bryanoltman@google.com",
        "time": "Tue Jul 21 19:08:09 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Tue Jul 21 19:12:19 2026"
      },
      "message": "Remove file-issue-extension permission from gpu seatbelt profile\n\nAs per the discussion in the linked bug, this permissions was originally\ngranted to fix an issue affecting macOS version between 14.2.1 and\n14.3.1 (https://g-issues.chromium.org/issues/41485470#comment8). The\nissue may have affected earlier versions of macOS 14, but specifically\ndid not affect 13.6.4\n(https://g-issues.chromium.org/issues/41485470#comment10).\n\nFurthermore, the issue seems to have only manifested on bots\n(https://g-issues.chromium.org/issues/41485470#comment32), which\nexecute tests in a directory that does not have `/Users` as an\nancestor.\n\nThis CL simply removes the permission, as it\u0027s not clear there was\never a user-facing impact and we do not have any bots running affected\nversions of macOS.\n\nFixed: 517249110\nChange-Id: I5aefbbc6bb1381232a5fa26386cd733790884913\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8131180\nReviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\nCommit-Queue: Bryan Oltman \u003cbryanoltman@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1665672}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 2701413522262a4b49624ecbc95226435c80b61e\n"
    },
    {
      "commit": "b061f8b8beaced209d1a33650e07a4d168227d5a",
      "tree": "d25789053aa9096afd9d4955ff59faf8e5eadd87",
      "parents": [
        "a663ede4bbdd538be40ded88eb54d283ceda6be0"
      ],
      "author": {
        "name": "Karim El Harim",
        "email": "karimelharim@gmail.com",
        "time": "Mon Jul 13 16:10:28 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Mon Jul 13 16:12:34 2026"
      },
      "message": "[sandbox/linux] Fix off-by-one DCHECK in BrokerSimpleMessage::WriteBytes\n\nWriteBytes() checks write_next_offset_ + bytes.size() \u003c\nmessage_.size(), which rejects a write that exactly fills the message\nbuffer. The bounds check in AddDataToMessage()/AddIntToMessage()\n(safe_length \u003e message_.size()) and the DCHECK_LE in ReadBytes() both\naccept the exact-fill case, so an entry sized to exactly fill the\nbuffer trips the DCHECK despite being in bounds. Use DCHECK_LE to\nmatch. DCHECK-only; no release behavior change.\n\nThe DCHECK was introduced together with the WriteBytes() helper in the\nspanification in crrev.com/c/7276084.\n\nAdd a regression test that exactly fills the message buffer; under\nDCHECKs it fails before this fix and passes after.\n\nDeveloped on Windows, where this Linux-only target does not build, so\nlocal validation was by inspection; a CQ dry run of\nsandbox_linux_unittests (BrokerSimpleMessage.*) would be appreciated.\n\nThis CL also adds me to AUTHORS (individual CLA signed). The entry\npreviously rode CL 8046740; it moved here so that exactly one open CL\ncarries it.\n\nR\u003dmpdenton@chromium.org\n\nBug: 508092637\nChange-Id: I6279125f3ea0c299d7da9249b655f3458f1eac54\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8051224\nReviewed-by: Matthew Denton \u003cmpdenton@chromium.org\u003e\nReviewed-by: Elly \u003cellyjones@chromium.org\u003e\nCommit-Queue: Elly \u003cellyjones@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1661155}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 90487eb8ebdb130f28392cbe71d97ea00231ef8d\n"
    },
    {
      "commit": "a663ede4bbdd538be40ded88eb54d283ceda6be0",
      "tree": "ee37e34952885eb9e9461ee609ce7b0c0c412bc8",
      "parents": [
        "37c67f39561b2f7988352dfa7df51f0992b4c543"
      ],
      "author": {
        "name": "Jianfeng Liu",
        "email": "liujianfeng1994@gmail.com",
        "time": "Mon Jul 13 02:10:08 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Mon Jul 13 02:11:46 2026"
      },
      "message": "media: make enable of v4l2/vaapi on linux possible\n\nV4L2 and VA-API are mutually exclusive upstream: the GN args forbid\nbuilding with both use_v4l2_codec and use_vaapi set, and a number of\nsource files assume the two are never compiled together (the\npreprocessor uses #if/#elif chains, the sandbox computes a single policy\ntype, etc.). That makes it impossible to ship a single Linux build that\ncan target both a V4L2-based and a VA-API-based video pipeline at once.\n\nLift the mutual exclusion and select the active backend at runtime,\ncentralized in media::ActiveLinuxVideoDecoderType() (decoder.h), which\nthe decoder, encoder, image processor, video frame mapper and mojo media\nclients all consult so the whole pipeline agrees on one backend. The\ndefault is VA-API; a new base::Feature, kPreferV4L2VideoAcceleration\n(disabled by default), switches to V4L2 when enabled.\n\nThe build-time mutual-exclusion assert in media/gpu/BUILD.gn and\nmedia/gpu/chromeos/BUILD.gn is removed, and the #if/#elif chains that\nassumed exclusivity (fourcc, image_processor_factory,\nvideo_decoder_pipeline, gpu_video_encode_accelerator_factory,\nvideo_frame_mapper_factory, gpu_mojo_media_client_{cros,linux},\noop_video_decoder_factory_service) are rewritten as independent #if\nblocks so both code paths compile when both flags are on.\n\nThe hardware video decoding/encoding sandboxes also assumed a single\nbackend. They now grant the union of the broker permissions and seccomp\nfilters that either backend needs, since the runtime choice is not\nvisible at sandbox-build time (and broker permissions are immutable once\nthe sandbox is up). This widens the attack surface of a mixed build\ncompared to a single-backend build; the relevant call sites call this\nout in comments.\n\nThe mixed-build decoding sandbox preserves the existing Intel/AMD split\nfor the VA-API half: ComputePolicyType() selects kVaapiAndV4L2 (Intel\nVA-API + V4L2) or kVaapiOnAMDAndV4L2 (AMD VA-API + V4L2) based on\nuse_amd_specific_policies.\n\nbrowser video decoding  with default flags (VA-API) and with\n--enable-features\u003dPreferV4L2VideoAcceleration (V4L2).\n\nBug: 530450488\nTest: Built with use_vaapi\u003dtrue use_v4l2_codec\u003dtrue. Ran\nChange-Id: Id62dbbe42d93e8422a66dccccba94eabe84787f7\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8061367\nCommit-Queue: Jianfeng Liu \u003cliujianfeng1994@gmail.com\u003e\nReviewed-by: Ted (Chromium) Meyer \u003ctmathmeyer@chromium.org\u003e\nReviewed-by: Ben Scarlato \u003cakhna@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1660921}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 8c1f628030183bcf5874245f6c15cbe28ca80036\n"
    },
    {
      "commit": "37c67f39561b2f7988352dfa7df51f0992b4c543",
      "tree": "16e51ecf0b59319693df58c306712e75c32e9589",
      "parents": [
        "91b71b3e5cd1d2bfdd614c29c0d30dd9c68859ca"
      ],
      "author": {
        "name": "Arthur Sonzogni",
        "email": "arthursonzogni@chromium.org",
        "time": "Fri Jul 10 14:24:47 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Fri Jul 10 14:26:53 2026"
      },
      "message": "[unsafe-buffers] Sandbox: Use std::array in baseline_policy_unittest\n\nConvert kTestString and read_buf to std::array in\nbaseline_policy_unittest.cc. This allows us to remove the UNSAFE_TODO\nwrappers introduced in the parent CL:8035239.\n\nBug: 40285824\nChange-Id: I19299bb9522db80277bda6c2e347bce6a4a98881\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8064266\nReviewed-by: Will Harris \u003cwfh@chromium.org\u003e\nCommit-Queue: Arthur Sonzogni \u003carthursonzogni@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1660251}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: b58a3d752b770114d176b617d371a923821d9103\n"
    },
    {
      "commit": "91b71b3e5cd1d2bfdd614c29c0d30dd9c68859ca",
      "tree": "a8b04b15a50c374a772d7731f1d558b49d307e85",
      "parents": [
        "3e19954e214a50feedd38c772e363c394d8096de"
      ],
      "author": {
        "name": "Joshua Peraza",
        "email": "jperaza@google.com",
        "time": "Thu Jul 09 12:20:41 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Thu Jul 09 12:22:51 2026"
      },
      "message": "Fix unsafe buffer usage in seccomp_broker_process_unittest.cc\n\nRefactored buffer handling in seccomp broker integration tests to use\nmodern C++ and Chromium idioms. Key changes include:\n- Replaced raw pointer and size parameters in `Syscaller::Readlink`\n  with `base::span\u003cchar\u003e`.\n- Converted C-style arrays to `std::array`.\n- Replaced `memcmp` and `memset` with `base::span` comparisons and\n  `std::ranges::fill`.\n- Used `base::SpanReader` to safely parse `inotify_event` structures.\n\nThese changes eliminate several `UNSAFE_TODO` markers and improve\noverall memory safety by leveraging bounds-checked containers.\n\nInitial patchset generated by headless gemini-cli using:\n//agents/prompts/projects/spanification/run.py\n\nFixed: 506879694\nChange-Id: Ic5741e76ec75e6317d6fa1152e67fc69db51c006\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7790227\nReviewed-by: Matthew Denton \u003cmpdenton@chromium.org\u003e\nCommit-Queue: Arthur Sonzogni \u003carthursonzogni@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1659482}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: ca4e7b38b991a24bb88383b125d30fadea0a9447\n"
    },
    {
      "commit": "3e19954e214a50feedd38c772e363c394d8096de",
      "tree": "48c240d50d5ec503f7d4db6bffe9331ee60d7ace",
      "parents": [
        "588d3217052ebfcae3abab7dd8db1ff4b9cbc5ab"
      ],
      "author": {
        "name": "Arthur Sonzogni",
        "email": "arthursonzogni@chromium.org",
        "time": "Wed Jul 08 15:19:34 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Wed Jul 08 15:22:47 2026"
      },
      "message": "[unsafe-buffers] Remove allow_unsafe_buffers from sandbox/\n\nThis is a mechanical change transitioning the last few files in sandbox/\nfrom coarse, file-level pragmas to fine-grained, instruction-level\nUNSAFE_TODO() macros.\n\nBug: 351564777, 501112808\nDoc: go/complete_unsafe_todo_migration\nChange-Id: Ie018f5d447476d25e57901e1317be8f65cf151bd\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8035239\nAuto-Submit: Arthur Sonzogni \u003carthursonzogni@chromium.org\u003e\nReviewed-by: Will Harris \u003cwfh@chromium.org\u003e\nCommit-Queue: Will Harris \u003cwfh@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1658776}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: ea018b8384df874e50c8b47e61233bad30822ca5\n"
    },
    {
      "commit": "588d3217052ebfcae3abab7dd8db1ff4b9cbc5ab",
      "tree": "f2fe891e2186ee29cb8580eed6cdc341b71c55b8",
      "parents": [
        "72d193317eb3e505aee8e2413006ffd0051780c0"
      ],
      "author": {
        "name": "yoshiki iguchi",
        "email": "yoshiki@google.com",
        "time": "Thu Jul 02 12:44:43 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Thu Jul 02 12:46:21 2026"
      },
      "message": "Clean up: Fix 5 wrong escapes in 1 DEPS files in sandbox\n\nAccording to the checkdeps doc, the period (.) should be escaped with\ntwo backslashes (\\\\), but sometimes it was done with one backslash (\\)\nwrongly.\n\nThis CL fixes these wrong escapes.\n\nSee the checkdeps doc for the detailed format:\nhttps://chromium.googlesource.com/chromium/src/+/master/buildtools/checkdeps/README.md\n\nTest: Passed CQ\nTest: Ran `/buildtools/checkdeps/checkdeps.py`\nChange-Id: I2383f6b6c0a2cb97d5d454d0355e26c680cfb026\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7882512\nCommit-Queue: Mark Mentovai \u003cmark@chromium.org\u003e\nAuto-Submit: Yoshiki IGUCHI \u003cyoshiki@chromium.org\u003e\nReviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1656034}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: b05f02867daef952785febd1c5d057b8a8bd99c6\n"
    },
    {
      "commit": "72d193317eb3e505aee8e2413006ffd0051780c0",
      "tree": "5a734cebd116c9c7eec290d986ba4fc7dfc4eee9",
      "parents": [
        "c83dc7945a7fdbc7d59792d4049217d4f8f676b0"
      ],
      "author": {
        "name": "Victor Hugo Vianna Silva",
        "email": "victorvianna@google.com",
        "time": "Wed Jul 01 15:36:34 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Wed Jul 01 15:38:26 2026"
      },
      "message": "Fix macOS 27 build of `chrome` target\n\nsandbox::Seatbelt::kProfilePureComputation is unused, so can be\nremoved.\n\nFixed: 530141405\nChange-Id: Idcca8b7863c2b10821d8eae5bca782c80be6fe70\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8025516\nAuto-Submit: Victor Vianna \u003cvictorvianna@google.com\u003e\nReviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\nCommit-Queue: Mark Mentovai \u003cmark@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1655528}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 6c0a651f9cf91d07c87be8feba854a38a311aba6\n"
    },
    {
      "commit": "c83dc7945a7fdbc7d59792d4049217d4f8f676b0",
      "tree": "b801178081f9b4f21955ece70f26dd468070d837",
      "parents": [
        "6d5856b4d3b2c866fd60aec854b52b4d9f1cffe7"
      ],
      "author": {
        "name": "Liza Burakova",
        "email": "liza@chromium.org",
        "time": "Wed Jul 01 15:12:48 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Wed Jul 01 15:15:19 2026"
      },
      "message": "Add UNSAFE_BUFFERS macros to C API calls.\n\nThe unsafe buffers plugin was modified upstream to now guard\ntype size queries on incomplete types. As a result we\u0027re now seeing\nwarnings in these two locations from the plugin.\n\nThe syscall broker has to pass a raw pointer into a syscall, and the\ncrashpad API is a C-style API so it makes sense to suppress both of\nthese.\n\nBug: 529689763\nChange-Id: Ib9361ca061043bcf9ebd87b18cff5815a19fc58f\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8026394\nReviewed-by: Colin Blundell \u003cblundell@chromium.org\u003e\nAuto-Submit: Liza Burakova \u003cliza@chromium.org\u003e\nReviewed-by: Matthew Denton \u003cmpdenton@chromium.org\u003e\nCommit-Queue: Liza Burakova \u003cliza@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1655514}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 5866f94ae7ca7620873a096f2cbda3e5e7a7e47a\n"
    },
    {
      "commit": "6d5856b4d3b2c866fd60aec854b52b4d9f1cffe7",
      "tree": "53819e32861fdf607428aa7adc67689edc9582e1",
      "parents": [
        "b004489cb005b9879445b26149b5b74b8501376c"
      ],
      "author": {
        "name": "mingmingtasd",
        "email": "mingming1.xu@intel.com",
        "time": "Tue Jun 30 01:05:23 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Tue Jun 30 01:07:03 2026"
      },
      "message": "WebNN: Add a dedicated flag to disable the WebNN compiler process sandbox\n\nAdd --disable-webnn-compiler-sandbox to disable only the WebNN compiler\nprocess sandbox without affecting other sandboxed processes. This is\nuseful for debugging and development scenarios where --no-sandbox is too\nbroad.\n\nThe flag is plumbed through ContentBrowserClient following the same\npattern as ShouldSandboxAudioService/NetworkService. PreSandboxInit()\nand switch propagation are decoupled from sandbox_type so they work\ncorrectly when the sandbox is overridden. The flag is also added to the\nbad flags list to show the security warning infobar.\n\nBug: 527276309,502249078\nChange-Id: I7344f5d652a09be740217e9b852fa494a5e3eb1d\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8001093\nReviewed-by: Reilly Grant \u003creillyg@chromium.org\u003e\nReviewed-by: Alex Gough \u003cajgo@chromium.org\u003e\nReviewed-by: Avi Drissman \u003cavi@chromium.org\u003e\nReviewed-by: Hu, Ningxin \u003cningxin.hu@intel.com\u003e\nCommit-Queue: Xu, Mingming1 \u003cmingming1.xu@intel.com\u003e\nCr-Commit-Position: refs/heads/main@{#1654507}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: f887faf2f10883b6c19eed2852ced221c0b30cc5\n"
    },
    {
      "commit": "b004489cb005b9879445b26149b5b74b8501376c",
      "tree": "315bb339920d72c2b096a3e4aa228e0335daf5c0",
      "parents": [
        "7868c25dcc0afeab964867039c408247f534922f"
      ],
      "author": {
        "name": "Sam Maier",
        "email": "smaier@google.com",
        "time": "Mon Jun 29 22:22:44 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Mon Jun 29 22:24:47 2026"
      },
      "message": "Reland \"Fix Javaless Renderer bugs\"\n\nThis reverts commit 4ee163e6d5ca5434b35917847ca09ef9de243822.\n\nReason for revert: Missed chromecast dep removal, now done\n\nOriginal change\u0027s description:\n\u003e Revert \"Fix Javaless Renderer bugs\"\n\u003e\n\u003e This reverts commit 89fe9f088d7a9d2004596b3da7653e5fbef21418.\n\u003e\n\u003e Reason for revert:\n\u003e LUCI Bisection has identified this change as the culprit of a build failure. See the analysis: https://ci.chromium.org/ui/p/chromium/bisection/compile-analysis/b/8677641089075382913\n\u003e\n\u003e Sample failed build: https://ci.chromium.org/b/8677641089075382913\n\u003e\n\u003e If this is a false positive, please report it at http://b.corp.google.com/createIssue?component\u003d1199205\u0026description\u003dAnalysis%3A+https%3A%2F%2Fchromium-review.googlesource.com%2Fc%2Fchromium%2Fsrc%2F%2B%2F8008103\u0026format\u003dPLAIN\u0026priority\u003dP3\u0026title\u003dWrongly+blamed+https%3A%2F%2Fci.chromium.org%2Fui%2Fp%2Fchromium%2Fbisection%2Fcompile-analysis%2Fb%2F8677641089075382913\u0026type\u003dBUG\n\u003e\n\u003e Original change\u0027s description:\n\u003e \u003e Fix Javaless Renderer bugs\n\u003e \u003e\n\u003e \u003e 1) Moves javaless_child_process_service into the main content/app target\n\u003e \u003e    so not everyone needs to depend onto it.\n\u003e \u003e 2) Add a weak symbol to javaless_child_process_service in case no\n\u003e \u003e    NativeInitializationHook is needed for a target\n\u003e \u003e 3) Early return on some DNS config calls that require android\n\u003e \u003e    permissions and thus already return false for all sandboxed isolated\n\u003e \u003e    services.\n\u003e \u003e 4) Add some extra code to sandbox.cc that matches Android\u0027s\n\u003e \u003e    implementation to check whether a process is sandboxed.\n\u003e \u003e\n\u003e \u003e Bug: 529318456\n\u003e \u003e Change-Id: I1c924bacc623cf6f5c8066279a1db37c6a6a6964\n\u003e \u003e Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8008103\n\u003e \u003e Reviewed-by: Alex Gough \u003cajgo@chromium.org\u003e\n\u003e \u003e Reviewed-by: Stefano Duo \u003cstefanoduo@google.com\u003e\n\u003e \u003e Reviewed-by: Andrew Grieve \u003cagrieve@chromium.org\u003e\n\u003e \u003e Commit-Queue: Sam Maier \u003csmaier@google.com\u003e\n\u003e \u003e Owners-Override: Sam Maier \u003csmaier@google.com\u003e\n\u003e \u003e Cr-Commit-Position: refs/heads/main@{#1654158}\n\u003e \u003e\n\u003e\n\u003e Bug: 529318456\n\u003e No-Presubmit: true\n\u003e No-Tree-Checks: true\n\u003e No-Try: true\n\u003e Change-Id: Ie2717385efe0fde170bea3526486acadeb4e7b40\n\u003e Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8020955\n\u003e Bot-Commit: luci-bisection@appspot.gserviceaccount.com \u003cluci-bisection@appspot.gserviceaccount.com\u003e\n\u003e Commit-Queue: luci-bisection@appspot.gserviceaccount.com \u003cluci-bisection@appspot.gserviceaccount.com\u003e\n\u003e Owners-Override: luci-bisection@appspot.gserviceaccount.com \u003cluci-bisection@appspot.gserviceaccount.com\u003e\n\u003e Cr-Commit-Position: refs/heads/main@{#1654160}\n\nBug: 529318456\nChange-Id: Id524edce69ef415ede43883c3155b0a8a22b87c0\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8017831\nReviewed-by: Peter Wen \u003cwnwen@chromium.org\u003e\nOwners-Override: Sam Maier \u003csmaier@google.com\u003e\nReviewed-by: Yaron Friedman \u003cyfriedman@chromium.org\u003e\nCommit-Queue: Yaron Friedman \u003cyfriedman@chromium.org\u003e\nAuto-Submit: Sam Maier \u003csmaier@google.com\u003e\nCommit-Queue: Sam Maier \u003csmaier@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1654404}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: dcefd60f2022cec9bcca2517a4052b0083fbf8b0\n"
    },
    {
      "commit": "7868c25dcc0afeab964867039c408247f534922f",
      "tree": "7d131e133f5dc2416613a7a4d1aca16632d04548",
      "parents": [
        "860639705d61c89587a6f8c15aa546dff12cec64"
      ],
      "author": {
        "name": "luci-bisection@appspot.gserviceaccount.com",
        "email": "luci-bisection@appspot.gserviceaccount.com",
        "time": "Mon Jun 29 17:31:11 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Mon Jun 29 17:33:10 2026"
      },
      "message": "Revert \"Fix Javaless Renderer bugs\"\n\nThis reverts commit 89fe9f088d7a9d2004596b3da7653e5fbef21418.\n\nReason for revert:\nLUCI Bisection has identified this change as the culprit of a build failure. See the analysis: https://ci.chromium.org/ui/p/chromium/bisection/compile-analysis/b/8677641089075382913\n\nSample failed build: https://ci.chromium.org/b/8677641089075382913\n\nIf this is a false positive, please report it at http://b.corp.google.com/createIssue?component\u003d1199205\u0026description\u003dAnalysis%3A+https%3A%2F%2Fchromium-review.googlesource.com%2Fc%2Fchromium%2Fsrc%2F%2B%2F8008103\u0026format\u003dPLAIN\u0026priority\u003dP3\u0026title\u003dWrongly+blamed+https%3A%2F%2Fci.chromium.org%2Fui%2Fp%2Fchromium%2Fbisection%2Fcompile-analysis%2Fb%2F8677641089075382913\u0026type\u003dBUG\n\nOriginal change\u0027s description:\n\u003e Fix Javaless Renderer bugs\n\u003e\n\u003e 1) Moves javaless_child_process_service into the main content/app target\n\u003e    so not everyone needs to depend onto it.\n\u003e 2) Add a weak symbol to javaless_child_process_service in case no\n\u003e    NativeInitializationHook is needed for a target\n\u003e 3) Early return on some DNS config calls that require android\n\u003e    permissions and thus already return false for all sandboxed isolated\n\u003e    services.\n\u003e 4) Add some extra code to sandbox.cc that matches Android\u0027s\n\u003e    implementation to check whether a process is sandboxed.\n\u003e\n\u003e Bug: 529318456\n\u003e Change-Id: I1c924bacc623cf6f5c8066279a1db37c6a6a6964\n\u003e Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8008103\n\u003e Reviewed-by: Alex Gough \u003cajgo@chromium.org\u003e\n\u003e Reviewed-by: Stefano Duo \u003cstefanoduo@google.com\u003e\n\u003e Reviewed-by: Andrew Grieve \u003cagrieve@chromium.org\u003e\n\u003e Commit-Queue: Sam Maier \u003csmaier@google.com\u003e\n\u003e Owners-Override: Sam Maier \u003csmaier@google.com\u003e\n\u003e Cr-Commit-Position: refs/heads/main@{#1654158}\n\u003e\n\nBug: 529318456\nNo-Presubmit: true\nNo-Tree-Checks: true\nNo-Try: true\nChange-Id: Ie2717385efe0fde170bea3526486acadeb4e7b40\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8020955\nBot-Commit: luci-bisection@appspot.gserviceaccount.com \u003cluci-bisection@appspot.gserviceaccount.com\u003e\nCommit-Queue: luci-bisection@appspot.gserviceaccount.com \u003cluci-bisection@appspot.gserviceaccount.com\u003e\nOwners-Override: luci-bisection@appspot.gserviceaccount.com \u003cluci-bisection@appspot.gserviceaccount.com\u003e\nCr-Commit-Position: refs/heads/main@{#1654160}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 4ee163e6d5ca5434b35917847ca09ef9de243822\n"
    },
    {
      "commit": "860639705d61c89587a6f8c15aa546dff12cec64",
      "tree": "315bb339920d72c2b096a3e4aa228e0335daf5c0",
      "parents": [
        "90bdb7142fdea7da1da8639e3e0322b55f18b59c"
      ],
      "author": {
        "name": "Sam Maier",
        "email": "smaier@google.com",
        "time": "Mon Jun 29 17:07:42 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Mon Jun 29 17:09:43 2026"
      },
      "message": "Fix Javaless Renderer bugs\n\n1) Moves javaless_child_process_service into the main content/app target\n   so not everyone needs to depend onto it.\n2) Add a weak symbol to javaless_child_process_service in case no\n   NativeInitializationHook is needed for a target\n3) Early return on some DNS config calls that require android\n   permissions and thus already return false for all sandboxed isolated\n   services.\n4) Add some extra code to sandbox.cc that matches Android\u0027s\n   implementation to check whether a process is sandboxed.\n\nBug: 529318456\nChange-Id: I1c924bacc623cf6f5c8066279a1db37c6a6a6964\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8008103\nReviewed-by: Alex Gough \u003cajgo@chromium.org\u003e\nReviewed-by: Stefano Duo \u003cstefanoduo@google.com\u003e\nReviewed-by: Andrew Grieve \u003cagrieve@chromium.org\u003e\nCommit-Queue: Sam Maier \u003csmaier@google.com\u003e\nOwners-Override: Sam Maier \u003csmaier@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1654158}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 89fe9f088d7a9d2004596b3da7653e5fbef21418\n"
    },
    {
      "commit": "90bdb7142fdea7da1da8639e3e0322b55f18b59c",
      "tree": "7d131e133f5dc2416613a7a4d1aca16632d04548",
      "parents": [
        "42737446aad4b7a1cfc0568c3fcaef604b6032ea"
      ],
      "author": {
        "name": "mingmingtasd",
        "email": "mingming1.xu@intel.com",
        "time": "Mon Jun 29 04:15:29 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Mon Jun 29 04:16:57 2026"
      },
      "message": "WebNN: Align WebNN Compiler job memory limit with the renderer process\n\nSet the job memory limit for the WebNN Compiler process sandbox\n(Sandbox::kWebNNModelCompilation) to 1 TB on Windows, matching the\nrenderer process limit. The reason is that renderer process hosts WebNN\nCPU model compilation; WebNN compiler process sandbox is as tighten as\nrenderer process\u0027 sandbox. Previously it used a physical-memory-based\nscaling heuristic capped at 64 GB, which could be too low for large\nmodel compilations.\n\nBug: 502616233,502249078\nChange-Id: Ie25de73fac3e3a321f3c3270296469d2639c7778\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7997893\nCommit-Queue: Xu, Mingming1 \u003cmingming1.xu@intel.com\u003e\nReviewed-by: Rafael Cintron \u003crafael.cintron@microsoft.com\u003e\nReviewed-by: Alex Gough \u003cajgo@chromium.org\u003e\nReviewed-by: Hu, Ningxin \u003cningxin.hu@intel.com\u003e\nReviewed-by: Reilly Grant \u003creillyg@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1653854}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 47a04cacb6fcb2477e7c9ff5afbc449d076d5587\n"
    },
    {
      "commit": "42737446aad4b7a1cfc0568c3fcaef604b6032ea",
      "tree": "6ce8fa7bed612c0dfbdbe76d60ab722ba8011bbd",
      "parents": [
        "a9d727a8b62acf9cd716c8a340a8ae551d06972d"
      ],
      "author": {
        "name": "Mohannad Farrag",
        "email": "aymanm@google.com",
        "time": "Fri Jun 26 15:43:34 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Fri Jun 26 15:45:32 2026"
      },
      "message": "sandbox: Allow recvmmsg in seccomp sandbox on Linux\n\nThis allows the recvmmsg system call in the seccomp sandbox on Linux,\nwhich is required for the new QUIC ReadMultiple API.\n\nAlso allows recvmmsg_time64 on 32-bit platforms, which is implicitly\nused by glibc for Y2038 safety when calling recvmmsg.\n\nBug: 515333601\nChange-Id: Ic8fb553f5014e71cbbe8fc9bf5af225afc5378fd\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7992621\nCommit-Queue: Mohannad Farrag \u003caymanm@google.com\u003e\nReviewed-by: Ben Scarlato \u003cakhna@google.com\u003e\nAuto-Submit: Mohannad Farrag \u003caymanm@google.com\u003e\nReviewed-by: Adam Rice \u003cricea@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1653188}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 3d3de2644a6d9275be330b0d15c1cd63d2a02c0a\n"
    },
    {
      "commit": "a9d727a8b62acf9cd716c8a340a8ae551d06972d",
      "tree": "4005b6f9a40cc27a27b57495f511b077af9f3203",
      "parents": [
        "859a4872ff8e67b463d56e0a9605bc62385336fb"
      ],
      "author": {
        "name": "Bryan Oltman",
        "email": "bryanoltman@google.com",
        "time": "Thu Jun 25 20:47:39 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Thu Jun 25 20:49:36 2026"
      },
      "message": "[macOS] Guard ODME process directory access behind flag\n\nThe sandboxed on-device model execution process has broad read and write\npermissions for the user directory, as well as the user\u0027s cache and temp\ndirectories. This access could lead to security issues, and it is not\nclear that they are still necessary. These elevated permissions were\nadded when the sandbox profile was first introduced in\nhttps://crrev.com/c/5015229, and seem to have been inherited from the\ngpu.sb file. Narrower exceptions (like the Metal shader cache directory\nfor the specific helper bundle ID) are already explicitly handled via\nmaybe-allow-metal-shader-cache-access in common.sb.\n\nI\u0027m unable to trigger any sandbox logs with these permissions removed on\nthe hardware I have available to me (running 26.5.1 and 27 beta 2). The\nmodel loading and mock prompt execution flows on\nchrome://on-device-internals were used with these permissions\nrestricted, and they succeeded without triggering any OS sandbox\nviolations or initialization failures.\n\nThis change is gated with the kMacSandboxOdmeUserDirAccess feature, and\nshould be updated to either restrict the file access granted to the\non-device model execution process to include only the needed directories\nonce we know what those are or removed entirely if this access is no\nlonger needed.\n\nFixed: 527915149\nChange-Id: I8cc31a5b5b5adaaebd38b44bab3dae4820d0f406\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7958375\nCommit-Queue: Bryan Oltman \u003cbryanoltman@google.com\u003e\nReviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1652692}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 1883a1d1686efaa9f45d981128e7bfbbdf8e1f15\n"
    },
    {
      "commit": "859a4872ff8e67b463d56e0a9605bc62385336fb",
      "tree": "fbdf6dee2584e3c7253be7f39b2dc5a01c8176b9",
      "parents": [
        "18a3f72c8583c20bc052f54ceddd111d2319c584"
      ],
      "author": {
        "name": "Bryan Oltman",
        "email": "bryanoltman@google.com",
        "time": "Thu Jun 25 16:07:21 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Thu Jun 25 16:09:32 2026"
      },
      "message": "[macOS] Guard network process directory access behind flag\n\nThe sandboxed network process has broad read and write permissions for\nthe user cache and temp dirs. This access could lead to security issues,\nand it is not clear that they are still necessary. These elevated\npermissions were added before the the release of the earliest macOS\nversion that we still support, and I\u0027m unable to trigger any sandbox\nlogs with these permissions removed on the hardware I have available to\nme (running 26.5.1 and 27 beta 2). No reason is given for the addition\nof darwin-user-cache-dir, and darwin-user-temp-dir was added due to\nhttps://crbug.com/40099129 (Unable to view \u0027Stop logging to disk\u0027 option\non Mac 10.14.6). I\u0027ve verified that this bug does not reproduce on a\nlocal build with these sandbox permissions removed.\n\nThis change is gated with the kMacSandboxNetworkUserDirAccess feature,\nand should be updated to either restrict the file access granted to the\nGPU process to include only the needed directories once we know what\nthose are, or removed entirely if this access is no longer needed.\n\nFixed: 527885521\nChange-Id: I2a2ecec48688027478acac620fe1dd63e27e66f0\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7983514\nCommit-Queue: Bryan Oltman \u003cbryanoltman@google.com\u003e\nReviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1652469}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 39a2dda84313c3bdb796260a884c3bf501370c29\n"
    },
    {
      "commit": "18a3f72c8583c20bc052f54ceddd111d2319c584",
      "tree": "aab10fb6c4d02969e935bcbffc47ca7acb4859cd",
      "parents": [
        "974cb223bd024249acc0b79c738ef358ccab71a5"
      ],
      "author": {
        "name": "Rafael Cintron",
        "email": "rafael.cintron@microsoft.com",
        "time": "Wed Jun 17 15:00:49 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Wed Jun 17 15:03:58 2026"
      },
      "message": "[WebNN] Tighten model-compilation utility sandbox to USER_LOCKDOWN\n\nThe kWebNNModelCompilation sandbox added in 1adb86c8ac1a was a clone of\nthe GPU-process policy, which caps out at USER_LIMITED. Model\ncompilation, on the other hand, just needs to load run the third-party\nexecution-provider preload helper (today the ONNX Runtime; LiteRT and\nother backends may follow), and then sit doing pure compute. So we can\nlock it down further.\n\nDrive the process through three stages:\n\n1. Process creation (broker, utility_sandbox_delegate_win.cc):\n   * Less Privileged App Container \"cr.sb.wnn\" with capabilities:\n       - lpacChromeInstallFiles  (added by SetupAppContainerProfile\u0027s\n         common path)\n       - registryRead            (ditto)\n       - chromeInstallFiles      (impersonation capability, for access\n         checks against chrome.exe\u0027s install directory at process\n         creation time)\n   * Token: USER_RESTRICTED_SAME_ACCESS initially.\n   * MITIGATION_WIN32K_DISABLE as a *startup* mitigation via\n     AddWin32kLockdownPolicy(), so the kernel rejects every Win32k\n     syscall from the child\u0027s first instruction of user code.\n   * JobLevel::kLockdown with no UI exceptions.\n   * SetLockdownDefaultDacl() to tighten the default DACL on kernel\n     objects this process creates so that other processes can\u0027t open\n     handles into them.\n   * Delayed MITIGATION_DYNAMIC_CODE_DISABLE (added via the common\n     network/audio/iconreader path in GenerateConfigForSandboxedProcess).\n\n2. Process creation (chrome layer,\n   chrome/browser/chrome_content_browser_client.cc::PreSpawnChild()):\n   * Startup MITIGATION_FORCE_MS_SIGNED_BINS via enforce_code_integrity\n     \u003d true, the same path used by the renderer, network, and\n     JIT-enabled service processes. The chrome layer pairs the\n     mitigation with AllowExtraDll() for chrome.dll and chrome_elf.dll\n     so the loader can still map those two Google-signed DLLs at\n     startup; subsequent attempts by the preload helper to pull in\n     unsigned vendor / AV / IME / shim DLLs are denied with\n     STATUS_INVALID_IMAGE_HASH. Enabled by default; pass\n     --allow-third-party-modules to disable (the same switch that\n     disables the delayed MITIGATION_FORCE_MS_SIGNED_BINS in\n     sandbox::policy::SandboxWin). This arm is also compiled out in\n     component builds, under ASAN, and when chrome.exe itself is the\n     module being loaded, so a developer build still works.\n\n3. Pre-LowerToken (child, content/utility/utility_main.cc):\n   Right before LowerToken(), the kWebNNModelCompilation branch calls\n   webnn::PreSandboxInit() to load and one-time-initialize the\n   third-party execution-provider preload helper. The current\n   implementation calls\n   webnn::ort::PlatformFunctions::EnsureInitialized(); as additional\n   backends come online webnn::PreSandboxInit() is their extension\n   point. LowerToken() then engages USER_LOCKDOWN and the delayed\n   mitigations.\n\nWhy LPAC:\n\nUSER_LIMITED\u0027s restricting set {Users, Everyone, RESTRICTED} does not\ninclude the user\u0027s own SID, which would block writes under\nC:\\Users\\\u003cuser\u003e\\*. However, it also blocks *reads* of paths whose ACLs\ndo not contain BUILTIN\\Users, which is exactly the case for per-user\ninstalls under C:\\Users\\\u003cuser\u003e\\AppData\\Local\\... and developer builds\nunder C:\\Users\\\u003cuser\u003e\\chromium\\src\\out\\... . LPAC instead reaches\nChrome\u0027s install directory via the lpacChromeInstallFiles capability\nACEs the installer already places on it.\n\nEnabling LPAC also flips DisableDefaultPolicy() to true (LPAC sandboxes\nin this delegate always disable the default policy), so\nAddDefaultConfigForSandboxedProcess() no longer runs.\nWebNNModelCompilationInitializeConfig is now responsible for the entire\nper-process configuration; the LPAC\u0027s capability SIDs and its own\nintegrity-level semantics replace the default INTEGRITY_LEVEL_LOW /\nINTEGRITY_LEVEL_UNTRUSTED + lockdown DACL + kDeviceApi handle closure\nthat non-LPAC utility processes inherit.\n\nBug: 500769395\nChange-Id: I9354caae9afca64c3ed2eef2a40dcee9797d54ef\nCq-Include-Trybots: luci.chromium.try:win11-blink-rel, mac14.arm64-blink-rel, mac14-blink-rel, mac15.arm64-blink-rel, mac15-blink-rel, linux-blink-rel\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7831437\nReviewed-by: Stefan Smolen \u003cssmole@microsoft.com\u003e\nCommit-Queue: Rafael Cintron \u003crafael.cintron@microsoft.com\u003e\nReviewed-by: Hu, Ningxin \u003cningxin.hu@intel.com\u003e\nReviewed-by: Alex Gough \u003cajgo@chromium.org\u003e\nReviewed-by: Avi Drissman \u003cavi@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1648320}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 5bb6464b27fce6ed3e2062cd4f2f624ca2bd9c66\n"
    },
    {
      "commit": "974cb223bd024249acc0b79c738ef358ccab71a5",
      "tree": "1b04509f135be73c218364606a7ab26c03663b76",
      "parents": [
        "db7ad29144efff68d6b986f3057d4ac128b46b07"
      ],
      "author": {
        "name": "Richard Townsend",
        "email": "ritownsend@google.com",
        "time": "Tue Jun 16 17:44:01 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Tue Jun 16 17:46:16 2026"
      },
      "message": "fix: UsePerformanceHelper affinity mode\n\nBefore the cleanup[1], we detected the SoC model and allowed\naffinity changes on Google SoCs. The cleanup removed this check and\nrelied solely on IsEligibleForBigCoreAffinityChange. However,\nIsEligibleForBigCoreAffinityChange returns true only if at least\nthree distinct CPU frequencies are detected. It seems this\ninformation can\u0027t be read once the sandbox is active.\n\nFix the issue by caching the values early in startup.\n\nAlso simplify the sandbox tests to prevent intermittent, flaky\nerrors.\n\n[1] crev.com/940fa9ee3b90c6d23593ab18219cbdcbbea1b5f4\n\nBug: 517465598, 464505581\n\nChange-Id: Iecad7d302348e619d550fc5e3e4a3bf8a96e1c97\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7946241\nReviewed-by: Kentaro Hara \u003charaken@chromium.org\u003e\nReviewed-by: Ben Scarlato \u003cakhna@google.com\u003e\nCommit-Queue: Richard Townsend \u003critownsend@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1647713}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: ce9f9305ae9131eec094f1a8aad76e90471a70ea\n"
    },
    {
      "commit": "db7ad29144efff68d6b986f3057d4ac128b46b07",
      "tree": "f31cc26d505564bd5ebdd3baf2bf6d5e9c9dc4e8",
      "parents": [
        "0bc587e3fec1f118486702ef3579d491da5041b7"
      ],
      "author": {
        "name": "Avi Drissman",
        "email": "avi@chromium.org",
        "time": "Tue Jun 16 14:41:00 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Tue Jun 16 14:43:00 2026"
      },
      "message": "Remove code supporting macOS 12 from sandbox\n\nChromium no longer supports macOS 12.\n\nBug: 473856754\nChange-Id: I635b19138114112d25461230537e582b6a6a6964\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7921546\nReviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\nCommit-Queue: Avi Drissman \u003cavi@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1647545}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 05445ba537148abcbd843998b0d0e0e3573b13f5\n"
    },
    {
      "commit": "0bc587e3fec1f118486702ef3579d491da5041b7",
      "tree": "404cda6f550dc127b25eef9c4824e718aaf1b8fe",
      "parents": [
        "43b6b0c1c6fefc08932707be88bd1cfa50b377b3"
      ],
      "author": {
        "name": "Evan Liu",
        "email": "evliu@google.com",
        "time": "Fri Jun 05 02:05:20 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Fri Jun 05 02:08:06 2026"
      },
      "message": "Harden Speech Recognition Utility Process Sandbox on Windows\n\nThis CL addresses several security gaps related to the SODA (Speech\nOn-Device API) utility process:\n\n1. Interface Binding Check: BindSpeechRecognitionContextHandler now\nverifies that the user has explicitly enabled Live Caption or Headless\nCaption before binding the Mojo interface, preventing unsolicited\nconnections from compromised renderers.\n\n2. Sandbox Hardening (Windows): The kSpeechRecognition sandbox policy is\nstrengthened by enabling Win32k lockdown and Arbitrary Code Guard (ACG /\nMITIGATION_DYNAMIC_CODE_DISABLE).\n\n3. Handle Validation: Adds a missing NULL check in SodaClientImpl::Reset\nto safely handle initialization failures and ensure consistent internal\nstate.\n\nFixed: 513852202\nChange-Id: Ida417199cd0501f6c26cbff26c32d4823e231b04\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7896183\nReviewed-by: Will Harris \u003cwfh@chromium.org\u003e\nCommit-Queue: Evan Liu \u003cevliu@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1642088}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 20696bc7300449a01888d3d51dd60160f0e9f80d\n"
    },
    {
      "commit": "43b6b0c1c6fefc08932707be88bd1cfa50b377b3",
      "tree": "cc9eadf4f2a37a1bb4bd6a6ce7ab7f40623e2e48",
      "parents": [
        "b97abb934bdd93c84e36ee2b595d79010e182e69"
      ],
      "author": {
        "name": "Etienne Pierre-doray",
        "email": "etiennep@chromium.org",
        "time": "Wed Jun 03 14:43:54 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Wed Jun 03 14:45:59 2026"
      },
      "message": "[tracing] Migrate async track events to more appropriate alternatives in sandbox/win\n\nThis CL changes async events on custom tracks (TRACE_EVENT_BEGIN/_END)\nto synchronous events.\n\nThere\u0027s a cost to using async events:\n- async events take a lot of vertical space in tracing UI\n- async events looses context of where the start and end happen\n- custom track are tricky to use, and  Track::FromPointer is problematic because it can alias when pointers are reused.\nhttps://chromium.googlesource.com/chromium/src.git/+/HEAD/docs/trace_events.md#asynchronous-events\n\nAs a general rule of thumb synchronous events are more appropriate when a slice is well nested in a function.\n\nThis CL was uploaded by git cl split.\n\nBug: 432427382\nChange-Id: Iaf9a2426b4bf773dab27169faf69402893d97f1a\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7871612\nReviewed-by: Alex Gough \u003cajgo@chromium.org\u003e\nCommit-Queue: Etienne Pierre-Doray \u003cetiennep@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1640927}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: f51e1724fb49571e596eb9878178e700be5c8a1d\n"
    },
    {
      "commit": "b97abb934bdd93c84e36ee2b595d79010e182e69",
      "tree": "408c21e0782960f80365437af6e4664fa45eeca3",
      "parents": [
        "7596fc42155575b26a56ebb3fb8eb654a650d780"
      ],
      "author": {
        "name": "Joe Mason",
        "email": "joenotcharles@google.com",
        "time": "Wed Jun 03 05:26:20 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Wed Jun 03 05:28:45 2026"
      },
      "message": "Migrate SysInfo::AmountOfPhysicalMemory callers to AmountOfTotalPhysicalMemory in sandbox/policy/win\n\nConvert callers of base::SysInfo::AmountOfPhysicalMemory to use\nAmountOfTotalPhysicalMemory. In cases where the caller expects a\nByteCount, convert the result using AsDeprecatedByteCount() to minimize\nunrelated changes.\n\nThis CL was uploaded by git cl split.\n\nThis CL was uploaded by an experimental version of git cl split\n(https://crbug.com/389069356).\n\nR\u003dajgo@chromium.org\n\nTAG\u003dagy\nCONV\u003d0f63b45d-cf24-4852-82b7-233c5d9bb873\n\nBug: 448661443\nChange-Id: If7ddd22a6f0ef6008bdc0a488ae80bfc445af49d\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7869862\nAuto-Submit: Joe Mason \u003cjoenotcharles@google.com\u003e\nReviewed-by: Alex Gough \u003cajgo@chromium.org\u003e\nCommit-Queue: Joe Mason \u003cjoenotcharles@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1640711}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 762f2d35669b3d9a918820d25b1919338fdbadc7\n"
    },
    {
      "commit": "7596fc42155575b26a56ebb3fb8eb654a650d780",
      "tree": "cf560ebf13e566f99ad9f76498ec24d08e420d6f",
      "parents": [
        "026845c3bbb697b60e1bda699f99e6f47bba236f"
      ],
      "author": {
        "name": "Richard Townsend",
        "email": "ritownsend@google.com",
        "time": "Tue Jun 02 18:15:22 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Tue Jun 02 18:17:43 2026"
      },
      "message": "fix: remove incorrect flag from sandbox/ test\n\nThe intent of the test was to pass only if a particular feature flag was\nset. [1] simplified the flag\u0027s behaviour, since we\u0027ve disentangled that\nCPU affinity experiment from another, but this wasn\u0027t picked up.\n\n[1] https://chromium-review.googlesource.com/c/chromium/src/+/7860382\n\nBug: 464505581\nChange-Id: Ieaf62261edde3d15515debb64e43157fd61115a9\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7881488\nCommit-Queue: Richard Townsend \u003critownsend@google.com\u003e\nReviewed-by: Ben Scarlato \u003cakhna@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1640323}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 401bb76b0ba879bed55e2270a32349e87f7bb7ef\n"
    },
    {
      "commit": "026845c3bbb697b60e1bda699f99e6f47bba236f",
      "tree": "e7611127b94d799da050b8735e8188289c8d0ee1",
      "parents": [
        "ea341c6a1ebbcc65a551edc381c4d8e81deb89cd"
      ],
      "author": {
        "name": "Masa Fujita",
        "email": "massan@google.com",
        "time": "Mon Jun 01 18:06:36 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Mon Jun 01 18:09:04 2026"
      },
      "message": "Disable BaselinePolicyAndroid.SchedSetAffinity_Maybe_Allowed\n\nWe are disabling BaselinePolicyAndroid.SchedSetAffinity_Maybe_Allowed\nas it has been flaky.\n\nhttps://ci.chromium.org/ui/test/chromium/%3A%2F%2Fsandbox%2Flinux%5C%3Asandbox_linux_unittests!gtest%3A%3ABaselinePolicyAndroid%23SchedSetAffinity_Maybe_Allowed?q\u003dVHash%3Aeecda6478354dbe2\n\nBug: 518561648\nChange-Id: Ie744bbbc65f84d31c2fafa986436ab77e061ff1b\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7888996\nReviewed-by: Henrique Nakashima \u003chnakashima@chromium.org\u003e\nOwners-Override: Henrique Nakashima \u003chnakashima@chromium.org\u003e\nCommit-Queue: Henrique Nakashima \u003chnakashima@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1639529}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 757e97a2fcee9f6a792b8d8681565d765098301a\n"
    },
    {
      "commit": "ea341c6a1ebbcc65a551edc381c4d8e81deb89cd",
      "tree": "a4d604007a9bb1845132c3f86b773994f898370f",
      "parents": [
        "534adc71ea6b6d4a918f23dda0b0f9125de0fe41"
      ],
      "author": {
        "name": "Filipa Senra",
        "email": "fsenra@google.com",
        "time": "Fri May 29 12:24:13 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Fri May 29 12:26:05 2026"
      },
      "message": "[Gardener] Disable SchedGetAffinity_Maybe_Allowed test.\n\nFailures in several builds, https://ci.chromium.org/ui/test/chromium/%3A%2F%2Fsandbox%2Flinux%5C%3Asandbox_linux_unittests!gtest%3A%3ABaselinePolicyAndroid%23SchedGetAffinity_Maybe_Allowed.\n\nBug: 517465598\nChange-Id: I4c45556227d64c54d7fd1c336a9b6041d1fb05f5\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7883227\nOwners-Override: Filipa Senra \u003cfsenra@google.com\u003e\nCommit-Queue: Filipa Senra \u003cfsenra@google.com\u003e\nReviewed-by: Oleh Lamzin \u003clamzin@google.com\u003e\nAuto-Submit: Filipa Senra \u003cfsenra@google.com\u003e\nReviewed-by: Martin Šrámek \u003cmsramek@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1638409}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 67229357efab4b3eeecd36243eceab279a023e3e\n"
    },
    {
      "commit": "534adc71ea6b6d4a918f23dda0b0f9125de0fe41",
      "tree": "61c920f2605e730b622232ae91745cd3574426e7",
      "parents": [
        "9c0871b0bce934fbb600e098f79584bf70c4ba8c"
      ],
      "author": {
        "name": "Ivana Žužić",
        "email": "izuzic@google.com",
        "time": "Thu May 28 17:03:46 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Thu May 28 17:05:55 2026"
      },
      "message": "Revert \"[Gardening] Fix BaselinePolicyAndroid affinity test\"\n\nThis reverts commit cc49845de15e83dde753b6007ac285f6c700e50e.\n\nReason for revert: This was a speculative fix and it didn\u0027t work.\nRecent failure: https://ci.chromium.org/ui/p/chrome/builders/ci/android-14-arm64-rel-tests/4242/overview\n\nOriginal change\u0027s description:\n\u003e [Gardening] Fix BaselinePolicyAndroid affinity test\n\u003e\n\u003e The seccomp-bpf policy in BaselinePolicyAndroid grants access to\n\u003e sched_getaffinity and sched_setaffinity based on CPU topology\n\u003e eligibility (base::IsEligibleForBigCoreAffinityChange()).\n\u003e\n\u003e However, the corresponding unit tests in\n\u003e baseline_policy_android_unittest.cc checked the feature flag\n\u003e base::kRestrictBigCoreThreadAffinity instead of the eligibility logic.\n\u003e\n\u003e This mismatch caused test failures in environments that are eligible for\n\u003e affinity changes but do not have the feature flag enabled, as the system\n\u003e calls succeeded instead of returning EPERM.\n\u003e\n\u003e This CL updates the test assertions to check the device\u0027s eligibility\n\u003e instead of the feature state.\n\u003e\n\u003e Bug: 517465598\n\u003e Change-Id: If35b5e49368ed1674de78ab6f29810f1af9a42d4\n\u003e Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7881599\n\u003e Auto-Submit: Ivana Žužić \u003cizuzic@google.com\u003e\n\u003e Reviewed-by: Friedrich Hauser \u003cfriedrichh@chromium.org\u003e\n\u003e Commit-Queue: Friedrich Hauser \u003cfriedrichh@chromium.org\u003e\n\u003e Owners-Override: Ivana Žužić \u003cizuzic@google.com\u003e\n\u003e Cr-Commit-Position: refs/heads/main@{#1637640}\n\nBug: 517465598\nNo-Presubmit: true\nNo-Tree-Checks: true\nNo-Try: true\nChange-Id: Iaa7f6f0cd539c341d88c680806591a7bcd97e0ad\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7880198\nCommit-Queue: Ivana Žužić \u003cizuzic@google.com\u003e\nCommit-Queue: rubber-stamper@appspot.gserviceaccount.com \u003crubber-stamper@appspot.gserviceaccount.com\u003e\nBot-Commit: rubber-stamper@appspot.gserviceaccount.com \u003crubber-stamper@appspot.gserviceaccount.com\u003e\nOwners-Override: Ivana Žužić \u003cizuzic@google.com\u003e\nReviewed-by: Ben Scarlato \u003cakhna@google.com\u003e\nAuto-Submit: Ivana Žužić \u003cizuzic@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1637778}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 45e41b7be3149fe9a2c3b9fb4641399124ee6b81\n"
    },
    {
      "commit": "9c0871b0bce934fbb600e098f79584bf70c4ba8c",
      "tree": "bed2c4670ef503e327a432f0b8ca8c84a791b96e",
      "parents": [
        "d7337e58477eed88017d6db9ab7384eb8a550b5d"
      ],
      "author": {
        "name": "Ivana Žužić",
        "email": "izuzic@google.com",
        "time": "Thu May 28 13:07:56 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Thu May 28 13:12:15 2026"
      },
      "message": "[Gardening] Fix BaselinePolicyAndroid affinity test\n\nThe seccomp-bpf policy in BaselinePolicyAndroid grants access to\nsched_getaffinity and sched_setaffinity based on CPU topology\neligibility (base::IsEligibleForBigCoreAffinityChange()).\n\nHowever, the corresponding unit tests in\nbaseline_policy_android_unittest.cc checked the feature flag\nbase::kRestrictBigCoreThreadAffinity instead of the eligibility logic.\n\nThis mismatch caused test failures in environments that are eligible for\naffinity changes but do not have the feature flag enabled, as the system\ncalls succeeded instead of returning EPERM.\n\nThis CL updates the test assertions to check the device\u0027s eligibility\ninstead of the feature state.\n\nBug: 517465598\nChange-Id: If35b5e49368ed1674de78ab6f29810f1af9a42d4\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7881599\nAuto-Submit: Ivana Žužić \u003cizuzic@google.com\u003e\nReviewed-by: Friedrich Hauser \u003cfriedrichh@chromium.org\u003e\nCommit-Queue: Friedrich Hauser \u003cfriedrichh@chromium.org\u003e\nOwners-Override: Ivana Žužić \u003cizuzic@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1637640}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: cc49845de15e83dde753b6007ac285f6c700e50e\n"
    },
    {
      "commit": "d7337e58477eed88017d6db9ab7384eb8a550b5d",
      "tree": "61c920f2605e730b622232ae91745cd3574426e7",
      "parents": [
        "4c39da162f625f357cdc03ff8a11c3353c00efa0"
      ],
      "author": {
        "name": "Richard Townsend",
        "email": "ritownsend@google.com",
        "time": "Wed May 27 15:29:49 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Wed May 27 15:33:44 2026"
      },
      "message": "Remove setPreferPowerEfficiency experiment\n\nField data indicated that this wasn\u0027t as effective as regular CPU\naffinity.\n\nBug: 464505581\nChange-Id: I4c621642f9dee35f33d736021a094ce1848eaf0a\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7860382\nCommit-Queue: Richard Townsend \u003critownsend@google.com\u003e\nReviewed-by: Joe Mason \u003cjoenotcharles@google.com\u003e\nReviewed-by: Kyle Charbonneau \u003ckylechar@chromium.org\u003e\nReviewed-by: Elly \u003cellyjones@chromium.org\u003e\nReviewed-by: Kentaro Hara \u003charaken@chromium.org\u003e\nReviewed-by: Etienne Pierre-Doray \u003cetiennep@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1636980}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 940fa9ee3b90c6d23593ab18219cbdcbbea1b5f4\n"
    },
    {
      "commit": "4c39da162f625f357cdc03ff8a11c3353c00efa0",
      "tree": "b68c50d4cc2f45116a9d530076b9595edb3c79a2",
      "parents": [
        "d197319ad43976d4b4fe687e21e96257bb65b2f5"
      ],
      "author": {
        "name": "Joe Mason",
        "email": "joenotcharles@google.com",
        "time": "Mon May 25 16:17:38 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Mon May 25 16:31:36 2026"
      },
      "message": "Migrate SysInfo::AmountOfPhysicalMemory callers to AmountOfTotalPhysicalMemory in sandbox/policy/linux\n\nConvert callers of base::SysInfo::AmountOfPhysicalMemory to use\nAmountOfTotalPhysicalMemory. In cases where the caller expects a\nByteCount, convert the result using AsDeprecatedByteCount() to minimize\nunrelated changes.\n\nThis CL was uploaded by git cl split.\n\nThis CL was uploaded by an experimental version of git cl split\n(https://crbug.com/389069356).\n\nR\u003dellyjones@chromium.org\n\nTAG\u003dagy\nCONV\u003d0f63b45d-cf24-4852-82b7-233c5d9bb873\n\nBug: 448661443\nChange-Id: I6eb71a9278718161c42b4a16ae8ff4ee8aeb9558\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7872677\nAuto-Submit: Joe Mason \u003cjoenotcharles@google.com\u003e\nReviewed-by: Elly \u003cellyjones@chromium.org\u003e\nCommit-Queue: Elly \u003cellyjones@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1635746}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 0d6d366861f69447e03997ab967fe33ff9285981\n"
    },
    {
      "commit": "d197319ad43976d4b4fe687e21e96257bb65b2f5",
      "tree": "5b32b6949ecfee01249fb68e0c2ad030b2659d01",
      "parents": [
        "d407c402bc92e24e4fefecec27a22c6598c8c7c0"
      ],
      "author": {
        "name": "Bryan Oltman",
        "email": "bryanoltman@google.com",
        "time": "Wed May 20 19:17:09 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Wed May 20 19:20:18 2026"
      },
      "message": "[macOS] Deny distributed notifications in the renderer sandbox\n\nHarden the renderer sandbox by denying the ability to post distributed\nnotifications and looking up the distributed notification service.\n\nThis change includes a feature, kMacSandboxDistributedNotifications\n(disabled by default), that can be used as a killswitch if needed.\n\nFixed: 513454805\nChange-Id: I82a9c46a2f9e921be7f5b286fdbbb9c2bcc6b643\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7858672\nReviewed-by: Mark Mentovai \u003cmark@chromium.org\u003e\nCommit-Queue: Bryan Oltman \u003cbryanoltman@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1633749}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: cd96f38a97b7dc0524c55a35d209065ef0be03b8\n"
    },
    {
      "commit": "d407c402bc92e24e4fefecec27a22c6598c8c7c0",
      "tree": "738ab0e00b4a2b833ee3b5e988fbbbf6a9122aea",
      "parents": [
        "1ec95929e5c5d6c4388472cd44664be1f37ec93a"
      ],
      "author": {
        "name": "Matt Stark",
        "email": "msta@google.com",
        "time": "Tue May 19 07:55:08 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Tue May 19 07:59:03 2026"
      },
      "message": "Run `gn format` on all BUILD.gn files.\n\nNO_IFTTT\u003dFormatting change only\n\nLink: https://chromium-review.googlesource.com/id/I94ec311d69c76b9f85351c08b4d3bd216a6a6964\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7858711\nReviewed-by: Takuto Ikuta \u003ctikuta@chromium.org\u003e\nOwners-Override: Takuto Ikuta \u003ctikuta@chromium.org\u003e\nCommit-Queue: Matt Stark \u003cmsta@google.com\u003e\nSLSA-Policy-Verified: SLSA Policy Verification Service \u003cdevtools-gerritcodereview-exitgate@google.com\u003e\nReviewed-by: Junji Watanabe \u003cjwata@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1632679}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: ad14f9bebfdee678ba25da9430c2d5c3b00d6a11\n"
    },
    {
      "commit": "1ec95929e5c5d6c4388472cd44664be1f37ec93a",
      "tree": "f172a366f33c3f2e7f82d511875204fb2bde0205",
      "parents": [
        "272ebff906f655bc5951e333ab3177f1379282b0"
      ],
      "author": {
        "name": "Emily Stark",
        "email": "estark@google.com",
        "time": "Thu May 14 23:53:00 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Thu May 14 23:57:03 2026"
      },
      "message": "Move test-only GetNtPathFromWin32Path into test file\n\nThis function appears to only be used in a couple tests, so move it into\nthe test file to avoid any confusion about whether it has security\nconsequences.\n\nBug: 512919802\nChange-Id: Id8e272f060450b4cc5bd50faf0cd2779bdbc18f2\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7846335\nCommit-Queue: Emily Stark \u003cestark@chromium.org\u003e\nReviewed-by: Will Harris \u003cwfh@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1630907}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: ba15804e0999cab6686af217101050a174a16ef1\n"
    },
    {
      "commit": "272ebff906f655bc5951e333ab3177f1379282b0",
      "tree": "6b754606fc75fe5ed90dd603a1453b5d6ba7c1d7",
      "parents": [
        "f8acb8c15965924de365958ee4d3e0cfdaebc104"
      ],
      "author": {
        "name": "Andrew Paseltiner",
        "email": "apaseltiner@chromium.org",
        "time": "Wed Apr 29 19:36:37 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Wed Apr 29 19:38:33 2026"
      },
      "message": "Reland \"Fix mmap seccomp policy in speech recognition sandbox\"\n\nThis is a reland of commit d732652538cc407ab189c0dbd4804793b13b510a.\n\nThe speech recognition policy test uses __NR_mmap, which is not\navailable on some architectures (e.g., ARM, which uses __NR_mmap2\ninstead). This caused build failures on the chromeos-arm-generic-dbg\nbuilder.\n\nThis CL guards the entire test file with #if defined(__NR_mmap) to\nensure it only compiles on architectures where the syscall is available.\nThis matches the pattern used in the production policy implementation.\n\nOriginal change\u0027s description:\n\u003e Fix mmap seccomp policy in speech recognition sandbox\n\u003e\n\u003e The Linux speech recognition sandbox policy incorrectly used a C++\n\u003e ternary operator with a BPF DSL expression. This caused the expression\n\u003e to be evaluated as a boolean during policy generation, which\n\u003e unconditionally evaluated to true. As a result, mmap was always allowed,\n\u003e bypassing baseline security restrictions.\n\u003e\n\u003e This CL fixes the logic by refactoring the baseline RestrictMmapFlags()\n\u003e helper to support an optional extra_allowed_mask. The speech recognition\n\u003e policy now uses this helper with MAP_POPULATE. This eliminates\n\u003e duplication of the baseline flag mask and ensures the speech recognition\n\u003e sandbox stays in sync with baseline security updates, while correctly\n\u003e allowing the required MAP_POPULATE flag.\n\u003e\n\u003e Fixed: 502023400\n\u003e Change-Id: Id4db89418b21d11aa5590115c84ad64c8e838a00\n\u003e Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7800739\n\u003e Commit-Queue: Andrew Paseltiner \u003capaseltiner@chromium.org\u003e\n\u003e Reviewed-by: Ben Scarlato \u003cakhna@google.com\u003e\n\u003e Reviewed-by: Will Harris \u003cwfh@chromium.org\u003e\n\u003e Cr-Commit-Position: refs/heads/main@{#1622456}\n\nFixed: 502023400\nChange-Id: I253ed2b15127dde71489e6219364cfa183896d0c\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7800978\nReviewed-by: Ben Scarlato \u003cakhna@google.com\u003e\nCommit-Queue: Andrew Paseltiner \u003capaseltiner@chromium.org\u003e\nReviewed-by: Will Harris \u003cwfh@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1622647}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: e38655623b2ca9ddb59df5a54e9ba549f6ca8bcb\n"
    },
    {
      "commit": "f8acb8c15965924de365958ee4d3e0cfdaebc104",
      "tree": "1d2b8ebbbfac099acb2d356c9af21652efb84fa7",
      "parents": [
        "37259f7555cb32bb29e85db3ad84ba1022c6370a"
      ],
      "author": {
        "name": "Ian Wells",
        "email": "iwells@chromium.org",
        "time": "Wed Apr 29 16:24:20 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Wed Apr 29 16:26:19 2026"
      },
      "message": "Revert \"Fix mmap seccomp policy in speech recognition sandbox\"\n\nThis reverts commit d732652538cc407ab189c0dbd4804793b13b510a.\n\nReason for revert: suspected cause of compile failure that closed the tree: https://ci.chromium.org/ui/p/chromium/builders/ci/chromeos-arm-generic-dbg/131289/overview\n\nOriginal change\u0027s description:\n\u003e Fix mmap seccomp policy in speech recognition sandbox\n\u003e\n\u003e The Linux speech recognition sandbox policy incorrectly used a C++\n\u003e ternary operator with a BPF DSL expression. This caused the expression\n\u003e to be evaluated as a boolean during policy generation, which\n\u003e unconditionally evaluated to true. As a result, mmap was always allowed,\n\u003e bypassing baseline security restrictions.\n\u003e\n\u003e This CL fixes the logic by refactoring the baseline RestrictMmapFlags()\n\u003e helper to support an optional extra_allowed_mask. The speech recognition\n\u003e policy now uses this helper with MAP_POPULATE. This eliminates\n\u003e duplication of the baseline flag mask and ensures the speech recognition\n\u003e sandbox stays in sync with baseline security updates, while correctly\n\u003e allowing the required MAP_POPULATE flag.\n\u003e\n\u003e Fixed: 502023400\n\u003e Change-Id: Id4db89418b21d11aa5590115c84ad64c8e838a00\n\u003e Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7800739\n\u003e Commit-Queue: Andrew Paseltiner \u003capaseltiner@chromium.org\u003e\n\u003e Reviewed-by: Ben Scarlato \u003cakhna@google.com\u003e\n\u003e Reviewed-by: Will Harris \u003cwfh@chromium.org\u003e\n\u003e Cr-Commit-Position: refs/heads/main@{#1622456}\n\nBug: 502023400\nNo-Presubmit: true\nNo-Tree-Checks: true\nNo-Try: true\nChange-Id: Id042bc8b9f47550999e19b11b700e4ccfe5e32f9\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7803989\nBot-Commit: rubber-stamper@appspot.gserviceaccount.com \u003crubber-stamper@appspot.gserviceaccount.com\u003e\nCommit-Queue: Ian Wells \u003ciwells@chromium.org\u003e\nAuto-Submit: Ian Wells \u003ciwells@chromium.org\u003e\nOwners-Override: Ian Wells \u003ciwells@chromium.org\u003e\nReviewed-by: Ian Wells \u003ciwells@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1622502}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 867d78b2beca419f30e347620e1c768093d67e3d\n"
    },
    {
      "commit": "37259f7555cb32bb29e85db3ad84ba1022c6370a",
      "tree": "f4151b115c178523c804b0b3df9358e3de61438d",
      "parents": [
        "d072df6ff77fec8a22c84bcb2599daa3d2b4eff2"
      ],
      "author": {
        "name": "Andrew Paseltiner",
        "email": "apaseltiner@chromium.org",
        "time": "Wed Apr 29 14:59:14 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Wed Apr 29 15:02:02 2026"
      },
      "message": "Fix mmap seccomp policy in speech recognition sandbox\n\nThe Linux speech recognition sandbox policy incorrectly used a C++\nternary operator with a BPF DSL expression. This caused the expression\nto be evaluated as a boolean during policy generation, which\nunconditionally evaluated to true. As a result, mmap was always allowed,\nbypassing baseline security restrictions.\n\nThis CL fixes the logic by refactoring the baseline RestrictMmapFlags()\nhelper to support an optional extra_allowed_mask. The speech recognition\npolicy now uses this helper with MAP_POPULATE. This eliminates\nduplication of the baseline flag mask and ensures the speech recognition\nsandbox stays in sync with baseline security updates, while correctly\nallowing the required MAP_POPULATE flag.\n\nFixed: 502023400\nChange-Id: Id4db89418b21d11aa5590115c84ad64c8e838a00\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7800739\nCommit-Queue: Andrew Paseltiner \u003capaseltiner@chromium.org\u003e\nReviewed-by: Ben Scarlato \u003cakhna@google.com\u003e\nReviewed-by: Will Harris \u003cwfh@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1622456}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: d732652538cc407ab189c0dbd4804793b13b510a\n"
    },
    {
      "commit": "d072df6ff77fec8a22c84bcb2599daa3d2b4eff2",
      "tree": "1d2b8ebbbfac099acb2d356c9af21652efb84fa7",
      "parents": [
        "2c9c12ee09371b8f9875f837ef85483a727ea43b"
      ],
      "author": {
        "name": "mingmingtasd",
        "email": "mingming1.xu@intel.com",
        "time": "Wed Apr 29 03:49:58 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Wed Apr 29 03:51:53 2026"
      },
      "message": "WebNN: Add kWebNNModelCompilation sandbox type\n\nAdd a new sandbox type `kWebNNModelCompilation` for the upcoming\nWebNN Compiler utility process, which will handle ORT graph\ncompilation isolated from the GPU process.\n\nThe sandbox configuration mirrors the GPU process sandbox:\n- Token level: USER_LIMITED (same as GPU process)\n- Integrity level: LOW\n- Job level: kLimitedUser with display-related UI restrictions\n- DACL lockdown with restricting random SID\n- AppContainer (LPAC) is NOT enabled, as GPU/NPU hardware\n  accelerator drivers are incompatible with it\n\nAlso:\n- Register the new sandbox type in sandbox_type.cc mappings\n- Add GetSandboxTypeInEnglish and job memory limit in\n  sandbox_win.cc\n- Forward WebNN-specific command-line switches (e.g.\n  --webnn-ort-logging-level) to kWebNNModelCompilation\n  processes only\n- Add switch cases in chrome_content_browser_client.cc for\n  GetAppContainerSidForSandboxType and PreSpawnChild\n\nThis is the first CL split from [1].\n\n[1] https://chromium-review.googlesource.com/c/chromium/src/+/7714177\n\nBug: 502249078\nChange-Id: I351319d96eb7e43c5e66e64b80560e9553f2f0d5\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7759629\nReviewed-by: Reilly Grant \u003creillyg@chromium.org\u003e\nCommit-Queue: Xu, Mingming1 \u003cmingming1.xu@intel.com\u003e\nReviewed-by: Alex Gough \u003cajgo@chromium.org\u003e\nReviewed-by: Hu, Ningxin \u003cningxin.hu@intel.com\u003e\nCr-Commit-Position: refs/heads/main@{#1622211}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 1adb86c8ac1a409b9b9f83a9abfc88e42c4c225b\n"
    },
    {
      "commit": "2c9c12ee09371b8f9875f837ef85483a727ea43b",
      "tree": "1cd2bd0bc9b55d32c9a5fe376349f4f96eb3eac4",
      "parents": [
        "0b13e471e5ece7e17c428a1d2bc792c630eb03a4"
      ],
      "author": {
        "name": "Primiano Tucci",
        "email": "primiano@chromium.org",
        "time": "Tue Apr 28 12:12:14 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Tue Apr 28 12:14:55 2026"
      },
      "message": "seccomp: Add a test to ensure long term feature detection\n\nSome code in Android Platform uses the combination of\nseccomp(SECCOMP_GET_ACTION_AVAIL, 0. nullptr)\nto detect the presence of a chromium sandbox.\nThis test ensures that in future nobody accidentally\nallows it, breaking the detection on the android side.\nThis still leaves the door open to allowing\nSECCOMP_GET_ACTION_AVAIL in future, as long as the\n4th \u003d\u003d nullptr combination is still trapped with EPERM.\n\nBug: b/507048056\nChange-Id: Ifd19f3b26e9d52d908455d0b2ad3a0916b1f6ff9\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7796500\nReviewed-by: Elly \u003cellyjones@chromium.org\u003e\nAuto-Submit: Primiano Tucci \u003cprimiano@chromium.org\u003e\nCommit-Queue: Primiano Tucci \u003cprimiano@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1621684}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 81349d760b1b2a0393a3699540ac0333367f74d9\n"
    },
    {
      "commit": "0b13e471e5ece7e17c428a1d2bc792c630eb03a4",
      "tree": "50ce054c2a634ae035526e798603a925ce33efe0",
      "parents": [
        "3c404be92189833f8197983dee6842006960f573"
      ],
      "author": {
        "name": "Ho Cheung",
        "email": "hocheung@chromium.org",
        "time": "Tue Apr 21 15:19:53 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Tue Apr 21 15:24:14 2026"
      },
      "message": "[sandbox] Fix SYS_SECCOMP conflict with newer glibc\n\nglibc now exposes SYS_SECCOMP in signal headers, which conflicts with\nChromium\u0027s fallback macro in linux_seccomp.h.\n\nStop defining SYS_SECCOMP in the public compat header and use a local\nfallback in trap.cc instead.\n\nTest: Tested on an Ubuntu 26.04 container using use_sysroot \u003d false.\nBug: 456218403\nChange-Id: I73ddfa85453dd9d524b64b4c1bca4f95b82c9f2b\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7781604\nReviewed-by: Elly \u003cellyjones@chromium.org\u003e\nCommit-Queue: Aaron Teo \u003chocheung@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1618207}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 83a9ccb1265dcdeeb8bf17205e00b751f86641d3\n"
    },
    {
      "commit": "3c404be92189833f8197983dee6842006960f573",
      "tree": "9bb8e9ab14af492749fe98917434b71b6ea9fb5f",
      "parents": [
        "2492a9343d247a882103c2bcefefe7124567c823"
      ],
      "author": {
        "name": "Chris Davis",
        "email": "chrdavis@microsoft.com",
        "time": "Sat Apr 18 15:46:23 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Sat Apr 18 15:48:23 2026"
      },
      "message": "Reland \"Remove dependency on ATL Security objects\"\n\nThis reverts commit 65404b1bc402d294990921bdaec592915072644a.\n\nReason for revert: Same changes but with the patch for elevation\nservice internal unit tests to prevent chrome build break.\n\nOriginal change\u0027s description:\n\u003e Revert \"Remove dependency on ATL Security objects\"\n\u003e\n\u003e This reverts commit 9425684f8e0d4b9066062d5057f0a565f905c6f0.\n\u003e\n\u003e Reason for revert: broke win-chrome and win64-chrome builders: https://ci.chromium.org/ui/p/chrome/builders/ci/win-chrome/38679/overview\n\u003e\n\u003e Original change\u0027s description:\n\u003e \u003e Remove dependency on ATL Security objects\n\u003e \u003e\n\u003e \u003e This CL removes ATL security class dependencies (CSecurityDesc, CDacl,\n\u003e \u003e CAccessToken, CSecurityAttributes, CSid) from chrome/updater and\n\u003e \u003e chrome/enterprise_companion, replacing them with\n\u003e \u003e base::win::SecurityDescriptor, base::win::AccessToken, and\n\u003e \u003e base::win::Sid.\n\u003e \u003e\n\u003e \u003e Key changes:\n\u003e \u003e\n\u003e \u003e Security descriptor refactoring (chrome/updater/util/win_util.cc):\n\u003e \u003e\n\u003e \u003e  - Replace CSecurityDesc/CDacl with base::win::SecurityDescriptor in GetCurrentUserDefaultSecurityDescriptor(),\n\u003e \u003e GetAdminDaclSecurityDescriptor(), and AddCurrentUserAllowedAce().\n\u003e \u003e  - Refactor NamedObjectAttributes to accept SDDL strings instead of CSecurityDesc, managing the absolute security\n\u003e \u003e descriptor lifetime internally.\n\u003e \u003e  - Fix IsCOMCallerAdmin() to use TOKEN_QUERY + CheckTokenMembership (via AccessToken::IsMember) instead of\n\u003e \u003e TOKEN_DUPLICATE + DuplicateImpersonation, which failed with\n\u003e \u003e ERROR_LOGON_SESSION_DOES_NOT_EXIST in system-service COM\n\u003e \u003e  scenarios.\n\u003e \u003e  - Fix CreateForegroundParentWindowForUAC() to correctly compute top-left coordinates for window centering.\n\u003e \u003e  - Replace std::wstring::find() !\u003d npos with std::wstring::contains() in unit tests.\n\u003e \u003e\n\u003e \u003e base::win::SecurityDescriptor enhancement:\n\u003e \u003e\n\u003e \u003e  - Add SetDaclEntry overload accepting AccessToken for convenient ACE creation using the token\u0027s user SID.\n\u003e \u003e\n\u003e \u003e Enterprise companion deduplication (app_server.cc):\n\u003e \u003e\n\u003e \u003e  - Remove duplicate GetLoggedOnUserToken() implementation; reuse updater::GetLoggedOnUserToken() from\n\u003e \u003e chrome/updater/util/win_util.h.\n\u003e \u003e\n\u003e \u003e Test coverage:\n\u003e \u003e\n\u003e \u003e  - Add cross-platform network_fetcher_unittest.cc with 12 tests covering NetworkFetcherFactory proxy configurations\n\u003e \u003e and LoggingNetworkFetcher delegation, error propagation, and header\n\u003e \u003e forwarding.\n\u003e \u003e  - Expand win_util_unittest.cc with tests for NamedObjectAttributes, AddCurrentUserAllowedAce, and\n\u003e \u003e GetCurrentUserDefaultSecurityDescriptor.\n\u003e \u003e\n\u003e \u003e Other cleanups:\n\u003e \u003e\n\u003e \u003e  - Remove components/named_system_lock dependency on ATL CSecurityAttributes.\n\u003e \u003e  - Inline single-use test variables per review feedback.\n\u003e \u003e  - Use base::DoNothing() instead of empty lambdas.\n\u003e \u003e\n\u003e \u003e This is a part of an ongoing effort to remove ATL from Chromium.\n\u003e \u003e\n\u003e \u003e Bug: 41184135\n\u003e \u003e Change-Id: I0e8fdd373193c73fe9e3a933a2fff378d4105589\n\u003e \u003e Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7738372\n\u003e \u003e Reviewed-by: Sorin Jianu \u003csorin@chromium.org\u003e\n\u003e \u003e Commit-Queue: Chris Davis \u003cchrdavis@microsoft.com\u003e\n\u003e \u003e Cr-Commit-Position: refs/heads/main@{#1614798}\n\u003e\n\u003e Bug: 41184135\n\u003e Change-Id: I5486729ff1b5bd3a0422d43ac192905ff5e610f5\n\u003e Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7761458\n\u003e Auto-Submit: Justin Lulejian \u003cjlulejian@chromium.org\u003e\n\u003e Bot-Commit: rubber-stamper@appspot.gserviceaccount.com \u003crubber-stamper@appspot.gserviceaccount.com\u003e\n\u003e Owners-Override: Justin Lulejian \u003cjlulejian@chromium.org\u003e\n\u003e Reviewed-by: Simon Ziegltrum \u003cziegltrum@google.com\u003e\n\u003e Commit-Queue: Justin Lulejian \u003cjlulejian@chromium.org\u003e\n\u003e Cr-Commit-Position: refs/heads/main@{#1615445}\n\nBug: 41184135\nChange-Id: I4b31a426e02c251dc7fcbf98e0940c0d5254be45\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7767058\nReviewed-by: Sorin Jianu \u003csorin@chromium.org\u003e\nReviewed-by: Alex Gough \u003cajgo@chromium.org\u003e\nCommit-Queue: Chris Davis \u003cchrdavis@microsoft.com\u003e\nCr-Commit-Position: refs/heads/main@{#1617098}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: c7f06b9157944d3608361dab75eceeab590ea9ef\n"
    },
    {
      "commit": "2492a9343d247a882103c2bcefefe7124567c823",
      "tree": "1942abebf65a81dc8003b716501c3d65f7430b49",
      "parents": [
        "5d45cbea21d38b7aec3ac82049163576bf30b6d1"
      ],
      "author": {
        "name": "Klaus",
        "email": "Vampirelightsss@gmail.com",
        "time": "Fri Apr 17 21:30:36 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Fri Apr 17 21:35:29 2026"
      },
      "message": "[sandbox] Enable Module Tampering Protection for CIG processes\n\nWhen a kernel driver modifies the child process IAT to inject a\nnon-Microsoft-signed DLL, CIG rejects the load during import\nresolution, causing STATUS_INVALID_IMAGE_HASH and process startup\nfailure.\n\nEnable PROCESS_CREATION_MITIGATION_POLICY2_MODULE_TAMPERING_PROTECTION\n_ALWAYS_ON (Win10 RS3+) alongside CIG. This causes the loader to\ndetect IAT tampering via the SharedOriginal CoW bit and remap a clean\ncopy of the main image before imports are snapped, so the injected\nDLL never enters the import chain.\n\nBug: 499921564\nChange-Id: Ie63fa447abd7cd5e85c29c5f9ed0288a6a94a170\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7725712\nAuto-Submit: Klaus Vampirelights \u003cvampirelightsss@gmail.com\u003e\nReviewed-by: Alex Gough \u003cajgo@chromium.org\u003e\nReviewed-by: James Forshaw \u003cforshaw@chromium.org\u003e\nCommit-Queue: Alex Gough \u003cajgo@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1616862}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 60632edf877f929dab0bd0d553b12356ddf3ec15\n"
    },
    {
      "commit": "5d45cbea21d38b7aec3ac82049163576bf30b6d1",
      "tree": "3f0328b7b7795b6ad363d74c68a98416dfdfe5a4",
      "parents": [
        "d6ded8144a4179b30a32659283822866c9263cf6"
      ],
      "author": {
        "name": "Justin Lulejian",
        "email": "jlulejian@chromium.org",
        "time": "Wed Apr 15 22:12:43 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Wed Apr 15 22:15:27 2026"
      },
      "message": "Revert \"Remove dependency on ATL Security objects\"\n\nThis reverts commit 9425684f8e0d4b9066062d5057f0a565f905c6f0.\n\nReason for revert: broke win-chrome and win64-chrome builders: https://ci.chromium.org/ui/p/chrome/builders/ci/win-chrome/38679/overview\n\nOriginal change\u0027s description:\n\u003e Remove dependency on ATL Security objects\n\u003e\n\u003e This CL removes ATL security class dependencies (CSecurityDesc, CDacl,\n\u003e CAccessToken, CSecurityAttributes, CSid) from chrome/updater and\n\u003e chrome/enterprise_companion, replacing them with\n\u003e base::win::SecurityDescriptor, base::win::AccessToken, and\n\u003e base::win::Sid.\n\u003e\n\u003e Key changes:\n\u003e\n\u003e Security descriptor refactoring (chrome/updater/util/win_util.cc):\n\u003e\n\u003e  - Replace CSecurityDesc/CDacl with base::win::SecurityDescriptor in GetCurrentUserDefaultSecurityDescriptor(),\n\u003e GetAdminDaclSecurityDescriptor(), and AddCurrentUserAllowedAce().\n\u003e  - Refactor NamedObjectAttributes to accept SDDL strings instead of CSecurityDesc, managing the absolute security\n\u003e descriptor lifetime internally.\n\u003e  - Fix IsCOMCallerAdmin() to use TOKEN_QUERY + CheckTokenMembership (via AccessToken::IsMember) instead of\n\u003e TOKEN_DUPLICATE + DuplicateImpersonation, which failed with\n\u003e ERROR_LOGON_SESSION_DOES_NOT_EXIST in system-service COM\n\u003e  scenarios.\n\u003e  - Fix CreateForegroundParentWindowForUAC() to correctly compute top-left coordinates for window centering.\n\u003e  - Replace std::wstring::find() !\u003d npos with std::wstring::contains() in unit tests.\n\u003e\n\u003e base::win::SecurityDescriptor enhancement:\n\u003e\n\u003e  - Add SetDaclEntry overload accepting AccessToken for convenient ACE creation using the token\u0027s user SID.\n\u003e\n\u003e Enterprise companion deduplication (app_server.cc):\n\u003e\n\u003e  - Remove duplicate GetLoggedOnUserToken() implementation; reuse updater::GetLoggedOnUserToken() from\n\u003e chrome/updater/util/win_util.h.\n\u003e\n\u003e Test coverage:\n\u003e\n\u003e  - Add cross-platform network_fetcher_unittest.cc with 12 tests covering NetworkFetcherFactory proxy configurations\n\u003e and LoggingNetworkFetcher delegation, error propagation, and header\n\u003e forwarding.\n\u003e  - Expand win_util_unittest.cc with tests for NamedObjectAttributes, AddCurrentUserAllowedAce, and\n\u003e GetCurrentUserDefaultSecurityDescriptor.\n\u003e\n\u003e Other cleanups:\n\u003e\n\u003e  - Remove components/named_system_lock dependency on ATL CSecurityAttributes.\n\u003e  - Inline single-use test variables per review feedback.\n\u003e  - Use base::DoNothing() instead of empty lambdas.\n\u003e\n\u003e This is a part of an ongoing effort to remove ATL from Chromium.\n\u003e\n\u003e Bug: 41184135\n\u003e Change-Id: I0e8fdd373193c73fe9e3a933a2fff378d4105589\n\u003e Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7738372\n\u003e Reviewed-by: Sorin Jianu \u003csorin@chromium.org\u003e\n\u003e Commit-Queue: Chris Davis \u003cchrdavis@microsoft.com\u003e\n\u003e Cr-Commit-Position: refs/heads/main@{#1614798}\n\nBug: 41184135\nChange-Id: I5486729ff1b5bd3a0422d43ac192905ff5e610f5\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7761458\nAuto-Submit: Justin Lulejian \u003cjlulejian@chromium.org\u003e\nBot-Commit: rubber-stamper@appspot.gserviceaccount.com \u003crubber-stamper@appspot.gserviceaccount.com\u003e\nOwners-Override: Justin Lulejian \u003cjlulejian@chromium.org\u003e\nReviewed-by: Simon Ziegltrum \u003cziegltrum@google.com\u003e\nCommit-Queue: Justin Lulejian \u003cjlulejian@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1615445}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 65404b1bc402d294990921bdaec592915072644a\n"
    },
    {
      "commit": "d6ded8144a4179b30a32659283822866c9263cf6",
      "tree": "a25148844f604ddca8913961fbb8c07772676832",
      "parents": [
        "9da15abe13c3ebc048827e2a667b2f351efe5527"
      ],
      "author": {
        "name": "Chris Davis",
        "email": "chrdavis@microsoft.com",
        "time": "Wed Apr 15 00:24:10 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Wed Apr 15 00:26:38 2026"
      },
      "message": "Remove dependency on ATL Security objects\n\nThis CL removes ATL security class dependencies (CSecurityDesc, CDacl,\nCAccessToken, CSecurityAttributes, CSid) from chrome/updater and\nchrome/enterprise_companion, replacing them with\nbase::win::SecurityDescriptor, base::win::AccessToken, and\nbase::win::Sid.\n\nKey changes:\n\nSecurity descriptor refactoring (chrome/updater/util/win_util.cc):\n\n - Replace CSecurityDesc/CDacl with base::win::SecurityDescriptor in GetCurrentUserDefaultSecurityDescriptor(),\nGetAdminDaclSecurityDescriptor(), and AddCurrentUserAllowedAce().\n - Refactor NamedObjectAttributes to accept SDDL strings instead of CSecurityDesc, managing the absolute security\ndescriptor lifetime internally.\n - Fix IsCOMCallerAdmin() to use TOKEN_QUERY + CheckTokenMembership (via AccessToken::IsMember) instead of\nTOKEN_DUPLICATE + DuplicateImpersonation, which failed with\nERROR_LOGON_SESSION_DOES_NOT_EXIST in system-service COM\n scenarios.\n - Fix CreateForegroundParentWindowForUAC() to correctly compute top-left coordinates for window centering.\n - Replace std::wstring::find() !\u003d npos with std::wstring::contains() in unit tests.\n\nbase::win::SecurityDescriptor enhancement:\n\n - Add SetDaclEntry overload accepting AccessToken for convenient ACE creation using the token\u0027s user SID.\n\nEnterprise companion deduplication (app_server.cc):\n\n - Remove duplicate GetLoggedOnUserToken() implementation; reuse updater::GetLoggedOnUserToken() from\nchrome/updater/util/win_util.h.\n\nTest coverage:\n\n - Add cross-platform network_fetcher_unittest.cc with 12 tests covering NetworkFetcherFactory proxy configurations\nand LoggingNetworkFetcher delegation, error propagation, and header\nforwarding.\n - Expand win_util_unittest.cc with tests for NamedObjectAttributes, AddCurrentUserAllowedAce, and\nGetCurrentUserDefaultSecurityDescriptor.\n\nOther cleanups:\n\n - Remove components/named_system_lock dependency on ATL CSecurityAttributes.\n - Inline single-use test variables per review feedback.\n - Use base::DoNothing() instead of empty lambdas.\n\nThis is a part of an ongoing effort to remove ATL from Chromium.\n\nBug: 41184135\nChange-Id: I0e8fdd373193c73fe9e3a933a2fff378d4105589\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7738372\nReviewed-by: Sorin Jianu \u003csorin@chromium.org\u003e\nCommit-Queue: Chris Davis \u003cchrdavis@microsoft.com\u003e\nCr-Commit-Position: refs/heads/main@{#1614798}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 9425684f8e0d4b9066062d5057f0a565f905c6f0\n"
    },
    {
      "commit": "9da15abe13c3ebc048827e2a667b2f351efe5527",
      "tree": "3f0328b7b7795b6ad363d74c68a98416dfdfe5a4",
      "parents": [
        "68cd6a76c888342f1b3a3afdb93df5e5dacdf485"
      ],
      "author": {
        "name": "Primiano Tucci",
        "email": "primiano@chromium.org",
        "time": "Tue Apr 14 17:58:22 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Tue Apr 14 18:01:28 2026"
      },
      "message": "Allow PI futex operations on Android in the sandbox.\n\nThis change unconditionally allows priority-inheritance\nfutex operations (FUTEX_LOCK_PI, etc.) within the sandbox\non Android. These operations are used by platform code\nfor system tracing.\n\nChange-Id: I940696b5b269dbe13b5b386d37c571dbd1aa3b85\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7748930\nCommit-Queue: Primiano Tucci \u003cprimiano@chromium.org\u003e\nReviewed-by: Elly \u003cellyjones@chromium.org\u003e\nAuto-Submit: Primiano Tucci \u003cprimiano@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1614605}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 8756c7fa10540244b3ef83a4d20df81dede4a54a\n"
    },
    {
      "commit": "68cd6a76c888342f1b3a3afdb93df5e5dacdf485",
      "tree": "bb01fb8e869e835ea15eb7485a3414a4686ec580",
      "parents": [
        "597bd6ba996ab57861e6acfba903efc4fb0ccf14"
      ],
      "author": {
        "name": "Alex Gough",
        "email": "ajgo@chromium.org",
        "time": "Fri Apr 10 08:35:37 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Fri Apr 10 08:38:31 2026"
      },
      "message": "Add akhna \u0026 ellyjones to sandbox/linux/OWNERS\n\nBug: n/a\nChange-Id: I9fa76147f954baaf4fe8267e1b4d7aa15a6becb2\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7741199\nReviewed-by: Nasko Oskov \u003cnasko@chromium.org\u003e\nCommit-Queue: Alex Gough \u003cajgo@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1612692}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: f81757a0de333e5e6bb95224e6fb9c2e97a5df37\n"
    },
    {
      "commit": "597bd6ba996ab57861e6acfba903efc4fb0ccf14",
      "tree": "764529bcafcae2acc642e2bec40f030700c12573",
      "parents": [
        "9bba53455376bef7ed8683d78b14a003d36bd2d9"
      ],
      "author": {
        "name": "Jiawei Shao",
        "email": "jiawei.shao@intel.com",
        "time": "Tue Apr 07 10:11:54 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Tue Apr 07 10:13:38 2026"
      },
      "message": "[Sandbox] Add a feature to remove the job memory limit for GPU\n\nCurrently there is still a memory limit inside sandbox for GPU process,\npreventing us from running the machine learning models with WebGPU that\nneeds a large amount of memory.\n\nThis CL adds a feature to disable the job memory limit for the GPU\nprocess on Windows, by setting it to 1Tb, just like what we are\ndoing for the renderer process.\n\nWith this feature we can better measure the increase in memory usage\nand effect on stability that might occur as a result of this CL.\n\nBug: 376720478\nChange-Id: I4d83149925a279e78a56605cf8ca3f7fd3f3fc4b\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7691133\nReviewed-by: Will Harris \u003cwfh@chromium.org\u003e\nReviewed-by: Kenneth Russell \u003ckbr@chromium.org\u003e\nCommit-Queue: Shao, Jiawei \u003cjiawei.shao@intel.com\u003e\nCr-Commit-Position: refs/heads/main@{#1610644}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 705baec3c63abe88f017437dc2a8bdb88ab84fcb\n"
    },
    {
      "commit": "9bba53455376bef7ed8683d78b14a003d36bd2d9",
      "tree": "888b50b2a55393f514f24c6fd4f36f590defbb41",
      "parents": [
        "37aaf1a253f6a5832178983ff282ef12531f7cbf"
      ],
      "author": {
        "name": "Daniel Cheng",
        "email": "dcheng@chromium.org",
        "time": "Mon Apr 06 15:24:45 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Mon Apr 06 15:27:34 2026"
      },
      "message": "Fix various IWYU errors related to base/logging.h\n\nA followup CL removes base/logging.h from validation_errors.h, which\nreveals a lot of pre-existing IWYU violations of base/logging.h and/or\nheaders included from base/logging.h.\n\nCL largely generated by gemini-cli, using an iterative process and a\nscript to add the most appropriate includes to source files that failed\nto build. Manual fixups for additional issues found via the trybots.\n\nBug: 499476145\nChange-Id: I0c06e20742765161d6a94ba1daae60cbc89a3982\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7730403\nReviewed-by: Takuto Ikuta \u003ctikuta@chromium.org\u003e\nOwners-Override: Takuto Ikuta \u003ctikuta@chromium.org\u003e\nCommit-Queue: Daniel Cheng \u003cdcheng@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1610307}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 3be1f60ad497eb027cf5b261fb36ab0b70f95dbf\n"
    },
    {
      "commit": "37aaf1a253f6a5832178983ff282ef12531f7cbf",
      "tree": "c6e26dd079279d3912939d0cce798e8205c2981c",
      "parents": [
        "68f759838e9ce95f59bb0fb9ac8ee9032dce1927"
      ],
      "author": {
        "name": "Tom Anderson",
        "email": "thomasanderson@chromium.org",
        "time": "Thu Apr 02 19:27:33 2026"
      },
      "committer": {
        "name": "Copybara-Service",
        "email": "copybara-worker@google.com",
        "time": "Thu Apr 02 19:29:52 2026"
      },
      "message": "[sandbox] Update seccomp-bpf filters for arm64 glibc\n\nThis brings linux-arm64-rel-fyi down to 89 test failures from 370.\n\nBug: 493612000\nChange-Id: Iffab6bc1c933a321680e48e5c862256f805f53cc\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7709995\nCommit-Queue: Tom Sepez \u003ctsepez@chromium.org\u003e\nReviewed-by: Tom Sepez \u003ctsepez@chromium.org\u003e\nAuto-Submit: Thomas Anderson \u003cthomasanderson@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1609428}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 29982c503d2649e4212fecebf1e5791639e35620\n"
    }
  ],
  "next": "68f759838e9ce95f59bb0fb9ac8ee9032dce1927"
}