Skip to content

152.0.7977.167..152.0.7977.169

chromium.googlesource.com • October 16, 2026

commit 92a6f15143569cf59b340472d0b5030465d95722 152.0.7977.169 author ben joyce Wed Oct 14 18:20:05 2026 committer Chromium LUCI CQ Wed Oct 14 18:20:05 2026 [M152] Move some windows compilator builders to windows 11 This moves the bots and and their associated CI builders to win11. Moves win-arm64-dbg to windows-default, win-arm64-compile-dbg, and win_chromium_compile_dbg_ng so they can be overwritten here and on branch builders when cherryicked. win-libfuzzer-asan-rel and Win Builder (dbg) don't get overwritten as they are on windows_any now and on branch builders. We're moving to windows-11 and will follow the following plan: -Before landing this CL, move infra groups to win-11, having win10 and win11 builder bots available. -Cherry pick change to branches. -Remove the win10 builder pools after transition. -After the builders have migrated, the windows default will be moved to windows 11 and clear windows-default.json. Moves: try bots: win-arm64-compile-dbg win-arm64-dbg win_chromium_compile_dbg_ng win-libfuzzer-asan-rel CI bots Win Builder (dbg) Libfuzzer Upload Windows ASan win-arm64-dbg (cherry picked from commit 8ab16762f0891baf1aecc4c0060c14fffcae3097) TAG=agy CONV=86717aa9-d153-4b86-8571-f904a0f06214 Merge-Approval-Bypass: Infra builder fix for M152 Bug: 441256678 Change-Id: Iffdd787bd001e9838e668ccb539964898e3a06c3 Reviewed-on: Reviewed-by: Ben Pastene Commit-Queue: Benjamin Joyce (Ben) Cr-Commit-Position: refs/branch-heads/7977@{#2838} Cr-Branched-From: b7fe14017379ddffae396d944fb8b59a5896c261-refs/heads/main@{#1669021} infra/config/PACKAGE.lock [ diff ] infra/config/PACKAGE.star [ diff ] infra/config/dev.star [ diff ] infra/config/generated/luci/cr-buildbucket.cfg [ diff ] infra/config/lib/windows-default.json [Added - diff ] infra/config/main.star [ diff ] infra/config/subprojects/chromium/try/tryserver.chromium.win.star [ diff ]

infra/config/PACKAGE.lock [ diff ]

infra/config/PACKAGE.star [ diff ]

infra/config/dev.star [ diff ]

infra/config/generated/luci/cr-buildbucket.cfg [ diff ]

infra/config/lib/windows-default.json [Added - diff ]

infra/config/main.star [ diff ]

infra/config/subprojects/chromium/try/tryserver.chromium.win.star [ diff ]

commit 14eacc365cc2d2bdb15f8b2a4f4850d697823cbe author Jonathan Ross Wed Oct 14 12:50:09 2026 committer Chromium LUCI CQ Wed Oct 14 12:50:09 2026 [M152] Guard TextInputManager against re-entrant destruction during notify Original change's description: > Guard TextInputManager against re-entrant destruction during notify > > TextInputManager::UpdateTextInputState() notifies observers in the > middle of updating its state. When a newly focused view replaces the > active view, it first notifies observers that the previously active > view lost its text input state. RenderWidgetHostViewAura forwards this > to InputMethod::OnTextInputTypeChanged(), where third-party IMEs can > run a nested message loop. Tasks run there, such as window.close(), can > destroy the WebContents, which owns the TextInputManager, or destroy the > newly focused view. UpdateTextInputState() then continued with > `active_view_ = view` on the freed TextInputManager, or went on to use > the freed view. > > 77d3b67459722 made RenderWidgetHostViewAura robust to destruction during > these IME callouts, but its caller here was not. > > Add a WeakPtrFactory to TextInputManager, and after each notification > in UpdateTextInputState() return early if `this` has been destroyed or > `view` is no longer registered. This also covers the final > notification, after which `active_view_` was read without checking > that `this` was still alive. > > Bug: 568937999 > Change-Id: I751acf24c8a4c426bd7198d478333eed2ebf3f87 > Reviewed-on: > Commit-Queue: Jonathan Ross > Reviewed-by: Aman Verma > Cr-Commit-Position: refs/heads/main@{#1713881} (cherry picked from commit 1ecc753ba08893dfa91cfa98b3dbea6439fe0dde) Bug: 572073614,568937999 Change-Id: I751acf24c8a4c426bd7198d478333eed2ebf3f87 Reviewed-on: Commit-Queue: Jonathan Ross Reviewed-by: Aman Verma Cr-Commit-Position: refs/branch-heads/7977@{#2837} Cr-Branched-From: b7fe14017379ddffae396d944fb8b59a5896c261-refs/heads/main@{#1669021} content/browser/renderer_host/text_input_manager.cc [ diff ] content/browser/renderer_host/text_input_manager.h [ diff ] content/browser/renderer_host/text_input_manager_unittest.cc [ diff ]

content/browser/renderer_host/text_input_manager.cc [ diff ]

content/browser/renderer_host/text_input_manager.h [ diff ]

content/browser/renderer_host/text_input_manager_unittest.cc [ diff ]

commit 73cff6ea543eb7d6286bb4afeac6de9b412db32b author chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com Wed Oct 14 08:32:36 2026 committer chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com Wed Oct 14 08:32:36 2026 Roll commits from side projects in M152 Roll src/v8 in M152 from f2f6cc0c1c8c to e51a6bf02e52 Commits rolled: Generated by: Merge-Approval-Bypass: Chrome DEPS-autoroller Change-Id: I6d447792b15a34f26ab871024a4c633d8fbea87f Reviewed-on: Bot-Commit: chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com Cr-Commit-Position: refs/branch-heads/7977@{#2836} Cr-Branched-From: b7fe14017379ddffae396d944fb8b59a5896c261-refs/heads/main@{#1669021} DEPS [ diff ] v8 [ diff ]

commit 25c50eee95a76ca35a2db5760f16279400472bfb author Rakina Zata Amni Wed Oct 14 02:45:15 2026 committer Chromium LUCI CQ Wed Oct 14 02:45:15 2026 [M152] Guard BeginNavigation() against self-deletion during prerender checks Original change's description: > Guard BeginNavigation() against self-deletion during prerender checks > > NavigationRequest::BeginNavigation() calls > MaybeStartPrerenderingActivationChecks(), which queries > PrerenderHostRegistry::FindPotentialHostToActivate(). When a candidate > PrerenderHost matches the URL (e.g. via a No-Vary- > hint) but cannot be activated (such as during a BackForwardCache > restore ), FindPotentialHostToActivate() cancels that host. > > Cancelling the running PrerenderHost can synchronously start a queued > pending prerender, whose start can trigger side effects > (such as evicting the BackForwardCached entry being restored via > RestartBackForwardCachedNavigationAsync()) that synchronously reset > and destroy the in-flight NavigationRequest on the primary FrameTree > while BeginNavigation() is still on the stack. > > Guard the call to MaybeStartPrerenderingActivationChecks() in > NavigationRequest::BeginNavigation() with a WeakPtr check and return > early if `this` was destroyed, matching the pattern used in > NavigationRequest::BeginNavigationImpl(). > > TAG=agy > CONV=0a6e1b34-3eb6-4c7f-b0e4-e0f83dc8c7f9 > > Bug: 568719351 > Change-Id: If18df8e1d9e4ff8e5b34305dfeb3ab39f05222ff > Fixed: 568719351 > Reviewed-on: > Reviewed-by: Alex Moshchuk > Commit-Queue: Rakina Zata Amni > Cr-Commit-Position: refs/heads/main@{#1712087} (cherry picked from commit d50992ebe4421079a6f9782c7e8a4d0eb3f14c5f) Bug: 571382470,568719351,568719351 Change-Id: If18df8e1d9e4ff8e5b34305dfeb3ab39f05222ff Reviewed-on: Auto-Submit: chrome-cherry-picker@chops-service-accounts.iam.gserviceaccount.com Bot-Commit: [email protected] Commit-Queue: rubber-stamper@appspot.gserviceaccount.com Cr-Commit-Position: refs/branch-heads/7977@{#2835} Cr-Branched-From: b7fe14017379ddffae396d944fb8b59a5896c261-refs/heads/main@{#1669021} content/browser/preloading/prerender/prerender_browsertest.cc [ diff ] content/browser/renderer_host/navigation_request.cc [ diff ]

content/browser/preloading/prerender/prerender_browsertest.cc [ diff ]

content/browser/renderer_host/navigation_request.cc [ diff ]

commit 2c141ff11a42d4dd74d00d7181ed88f49e5e8975 author Mason Freed Tue Oct 13 23:03:32 2026 committer Chromium LUCI CQ Tue Oct 13 23:03:32 2026 [M152] Don't hold a reference to the id attribute across UpdateId() Original change's description: > Don't hold a reference to the id attribute across UpdateId() > > Element::InsertedInto() took a reference into the element's attribute > storage via GetIdAttribute() and passed it to UpdateId(). UpdateId() > notifies id target observers, and those can update style and layout. > For example, a focused whose datalist became usable > rebuilds its shadow tree and calls RevealSelection(). If that update > builds a instance tree that clones the element, cloning > serializes the element's dirty style attribute and appends it to the > attribute storage. When that reallocates the storage, the reference > dangles, and the remaining reads of the id in UpdateId() access freed > memory. > > This CL copies the id into a local AtomicString before calling > UpdateId(). RemovedFrom() passes the id to UpdateId() the same way, so > it gets the same change. Recent fixes for similar bugs in > ElementRuleCollector and HTMLAnchorElementBase::NavigateToHyperlink() > used the same approach. > > Fixed: 567638392 > Change-Id: I1ebac072098091e5dc9d8898f2bced3cf0c3bbcc > Reviewed-on: > Auto-Submit: Mason Freed > Reviewed-by: David Baron > Commit-Queue: Mason Freed > Cr-Commit-Position: refs/heads/main@{#1715019} (cherry picked from commit 90ae142e4c7c5fb94683a6e027f9492d06711abd) Bug: 572091637,567638392 Change-Id: I1ebac072098091e5dc9d8898f2bced3cf0c3bbcc Reviewed-on: Bot-Commit: [email protected] Commit-Queue: rubber-stamper@appspot.gserviceaccount.com Auto-Submit: chrome-cherry-picker@chops-service-accounts.iam.gserviceaccount.com Cr-Commit-Position: refs/branch-heads/7977@{#2834} Cr-Branched-From: b7fe14017379ddffae396d944fb8b59a5896c261-refs/heads/main@{#1669021} third_party/blink/renderer/core/dom/element.cc [ diff ] third_party/blink/web_tests/external/wpt/html/semantics/forms/the-datalist-element/list-id-insertion-crash.html [Added - diff ]

third_party/blink/renderer/core/dom/element.cc [ diff ]

third_party/blink/web_tests/external/wpt/html/semantics/forms/the-datalist-element/list-id-insertion-crash.html [Added - diff ]

commit 53e5354f38702e4f06951ca1184e813e7742fca1 author Robert Flack Tue Oct 13 22:03:30 2026 committer Chromium LUCI CQ Tue Oct 13 22:03:30 2026 [M152] Fix pre-interpolation composition with mismatched underlying values Original change's description: > Fix pre-interpolation composition with mismatched underlying values > > When converting non-neutral additive or accumulative keyframes, > InvalidatableInterpolation::MaybeConvertPairwise and > ConvertSingleKeyframe should only pass underlying_value_owner.Value() to > with a matching InterpolationType. > > This fixes issues when animating a registered custom property whose > underlying value may be absent, or not convertible by any > InterpolationType, or produced by a different InterpolationType. > > Bug: 566496747 > Change-Id: Ide25c19ff4a63c8e000f90c26fcd4dc1a5b7bc65 > Reviewed-on: > Commit-Queue: Robert Flack > Reviewed-by: Kevin Ellis > Cr-Commit-Position: refs/heads/main@{#1713374} (cherry picked from commit 544a340956293550ca5eeb89d7a046879527df18) Bug: 571383401,566496747 Change-Id: Ide25c19ff4a63c8e000f90c26fcd4dc1a5b7bc65 Reviewed-on: Bot-Commit: [email protected] Commit-Queue: rubber-stamper@appspot.gserviceaccount.com Auto-Submit: chrome-cherry-picker@chops-service-accounts.iam.gserviceaccount.com Cr-Commit-Position: refs/branch-heads/7977@{#2833} Cr-Branched-From: b7fe14017379ddffae396d944fb8b59a5896c261-refs/heads/main@{#1669021} third_party/blink/renderer/core/animation/css_custom_list_interpolation_type.cc [ diff ] third_party/blink/renderer/core/animation/css_transform_interpolation_type.cc [ diff ] third_party/blink/renderer/core/animation/invalidatable_interpolation.cc [ diff ] third_party/blink/web_tests/animations/custom-properties/custom-list-type-interpolation.html [ diff ] third_party/blink/web_tests/external/wpt/css/css-properties-values-api/animation/custom-property-animation-list-type-mismatch.html [ diff ] third_party/blink/web_tests/external/wpt/css/css-properties-values-api/animation/custom-property-animation-transform-list-multiple-values.html [ diff ]

third_party/blink/renderer/core/animation/css_custom_list_interpolation_type.cc [ diff ]

third_party/blink/renderer/core/animation/css_transform_interpolation_type.cc [ diff ]

third_party/blink/renderer/core/animation/invalidatable_interpolation.cc [ diff ]

third_party/blink/web_tests/animations/custom-properties/custom-list-type-interpolation.html [ diff ]

third_party/blink/web_tests/external/wpt/css/css-properties-values-api/animation/custom-property-animation-list-type-mismatch.html [ diff ]

third_party/blink/web_tests/external/wpt/css/css-properties-values-api/animation/custom-property-animation-transform-list-multiple-values.html [ diff ]

commit 72af4a3518a8e57de2c65da5e45f13b68a78b4e5 author chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com Tue Oct 13 09:32:33 2026 committer chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com Tue Oct 13 09:32:33 2026 Roll commits from side projects in M152 Roll src/v8 in M152 from a11d960c1c22 to f2f6cc0c1c8c Commits rolled: Generated by: Merge-Approval-Bypass: Chrome DEPS-autoroller Change-Id: I02603a3d3b44e17894fecb2ae4845c757f021f19 Reviewed-on: Bot-Commit: chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com Cr-Commit-Position: refs/branch-heads/7977@{#2832} Cr-Branched-From: b7fe14017379ddffae396d944fb8b59a5896c261-refs/heads/main@{#1669021} DEPS [ diff ] v8 [ diff ]

commit ef1ce85f6dbc0471fbf7154a539bdbf53c0d73c7 author chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com Tue Oct 13 01:06:58 2026 committer chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com Tue Oct 13 01:06:58 2026 Incrementing VERSION to 152.0.7977.169 Merge-Approval-Bypass: Chrome release infra Change-Id: I1307ea9c7bae777a93d2dd5e370a8ef163492930 Reviewed-on: Bot-Commit: chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com Cr-Commit-Position: refs/branch-heads/7977@{#2831} Cr-Branched-From: b7fe14017379ddffae396d944fb8b59a5896c261-refs/heads/main@{#1669021} chrome/VERSION [ diff ]

chrome/VERSION [ diff ]

commit c46b9381b0d9dc18f8a5c00b4d6d9d5b9c5c3392 152.0.7977.168 author Dale Curtis Mon Oct 12 23:09:00 2026 committer Chromium LUCI CQ Mon Oct 12 23:09:00 2026 [M152] Cancel have_enough_after_lazy_load_cb_ in WebMediaPlayerImpl::Shutdown() Original change's description: > Cancel have_enough_after_lazy_load_cb_ in WebMediaPlayerImpl::Shutdown() > > When a lazy-loaded video suspends during startup, OnPipelineSuspended() > posts have_enough_after_lazy_load_cb_ with a 250ms delay using > base::Unretained(demuxer_manager_.get()). > > Previously, WebMediaPlayerImpl::Shutdown() moved demuxer_manager_ to > DestructionHelper without cancelling have_enough_after_lazy_load_cb_. > Because ~WebMediaPlayerImpl() is posted asynchronously via DeleteSoon, > if demuxer_manager_ is destroyed and the 250ms delayed task runs before > ~WebMediaPlayerImpl(), DemuxerManager::StopPreloading() is invoked on a > freed DemuxerManager. > > Cancel have_enough_after_lazy_load_cb_ in WebMediaPlayerImpl::Shutdown() > before transferring ownership of demuxer_manager_ to DestructionHelper. > > Fixed: 568719352 > Change-Id: Ia70f3549f38985bfd7bdb57d33ebe3ac6d6664ec > Reviewed-on: > Commit-Queue: Dale Curtis > Auto-Submit: Dale Curtis > Reviewed-by: Thomas Guilbert > Commit-Queue: Thomas Guilbert > Cr-Commit-Position: refs/heads/main@{#1714912} (cherry picked from commit 839f33256e792606993c2fae501babe68cd31921) Bug: 572074066,568719352 Change-Id: Ia70f3549f38985bfd7bdb57d33ebe3ac6d6664ec Reviewed-on: Auto-Submit: chrome-cherry-picker@chops-service-accounts.iam.gserviceaccount.com Commit-Queue: Dale Curtis Reviewed-by: Frank Liberato Cr-Commit-Position: refs/branch-heads/7977@{#2830} Cr-Branched-From: b7fe14017379ddffae396d944fb8b59a5896c261-refs/heads/main@{#1669021} third_party/blink/renderer/platform/media/web_media_player_impl.cc [ diff ]

third_party/blink/renderer/platform/media/web_media_player_impl.cc [ diff ]

commit 8f6b08ed92cf26ea7c6b877fa7e03033e091acc8 author Dale Curtis Mon Oct 12 23:00:05 2026 committer Chromium LUCI CQ Mon Oct 12 23:00:05 2026 [M152] Avoid synchronous PipelineController destruction in WMPI::Shutdown() Original change's description: > Avoid synchronous PipelineController destruction in WMPI::Shutdown() > > WebMediaPlayerImpl::OnPipelineSuspended() reports memory usage to V8 via > external_memory_accounter_.Update(), which can synchronously trigger a > V8 GC. If the HTMLMediaElement is unreachable, its pre-finalizer runs > ClearMediaPlayer() -> WebMediaPlayerImpl::Shutdown(). Resetting > pipeline_controller_ inside Shutdown() destroys PipelineController while > PipelineController::OnPipelineStatus() is still on the call stack, > causing a use-after-free when OnPipelineStatus() subsequently calls > Dispatch(). > > pipeline_controller_.reset() was originally added in Shutdown() (in > 1be6d5215b1d) because PipelineImpl::RendererWrapper::DestroyRenderer() > did not reset default_renderer_. If the pipeline was stopped before > renderer initialization, default_renderer_ stayed alive until > ~RendererWrapper() (triggered by ~PipelineImpl()), outliving > DestructionHelper. > > Fix this by resetting default_renderer_ in > RendererWrapper::DestroyRenderer() (and when discarding a mismatched > default_renderer_ in CreateRendererInternal()), and removing > pipeline_controller_.reset() from WebMediaPlayerImpl::Shutdown() so > pipeline_controller_ is destroyed with ~WebMediaPlayerImpl(). > > Bug: 570638834, 341254296 > Change-Id: Iafbebc701219c097f37d9d92e1b497c98e44834c > Reviewed-on: > Reviewed-by: Frank Liberato > Commit-Queue: Dale Curtis > Cr-Commit-Position: refs/heads/main@{#1714751} (cherry picked from commit 4399ef090615497888215ca0a04a9b03d4c2afae) Bug: 572073177,570638834,341254296 Change-Id: Iafbebc701219c097f37d9d92e1b497c98e44834c Reviewed-on: Auto-Submit: chrome-cherry-picker@chops-service-accounts.iam.gserviceaccount.com Reviewed-by: Frank Liberato Commit-Queue: Dale Curtis Cr-Commit-Position: refs/branch-heads/7977@{#2829} Cr-Branched-From: b7fe14017379ddffae396d944fb8b59a5896c261-refs/heads/main@{#1669021} media/base/pipeline_impl.cc [ diff ] media/base/pipeline_impl_unittest.cc [ diff ] third_party/blink/renderer/platform/media/web_media_player_impl.cc [ diff ]

media/base/pipeline_impl.cc [ diff ]

media/base/pipeline_impl_unittest.cc [ diff ]

third_party/blink/renderer/platform/media/web_media_player_impl.cc [ diff ]

commit 007113ee58660d0702a994b225649ea2ca120256 author S Ganesh Mon Oct 12 22:08:20 2026 committer Chromium LUCI CQ Mon Oct 12 22:08:20 2026 [M152] [mojo]: Validate ipcz transport handles and sender trust Original change's description: > [mojo]: Validate ipcz transport handles and sender trust > > Sending handles between processes on Windows requires either the > sender or the receiver to duplicate the handle into its peer process > using DuplicateHandle(). Handles sent over ipcz are marked as kSender > (meaning the sender still owns the handle and the receiver is > responsible for duplicating it) or kRecipient (meaning the sender has > already duplicated the handle into the receiver) to coordinate this > handle transfer, since only one side should duplicate the handle. > Moreover, duplicating a handle into another process is a powerful > capability: if one side is more privileged, the convention is for the > more privileged side to duplicate handles. > > When using a Mojo isolated connection, both sides are considered > brokers. Optionally, one side can mark the other as untrusted using > MOJO_SEND_INVITATION_FLAG_UNTRUSTED_PROCESS - in that case, the > untrusted side should never be duplicating handles into its peer. > However, two places in ipcz_driver::Transport failed to enforce safety > invariants around handle duplication: > > 1. DecodeHandle() accepted HandleOwner::kRecipient handles from any > kBroker peer (unless the receiving endpoint itself was marked > elevated). Even though the untrusted sending broker could not > actually duplicate handles into the receiving process, it could > still guess numeric HANDLE values that happened to name pre-existing > handles in the receiving process's handle table. > 2. Transport::Deserialize() allowed even untrusted peers to name a > transport's remote_process_. > > Changes: > - DecodeHandle() no longer allows kRecipient handles from > explicitly-untrusted broker peers - this is encapsulated in > Transport::CanAcceptReceiverOwnedHandles(). > - Transport::Deserialize() only allows remote processes to be > specified if the sender is a non-broker and the receiver is a broker > (as in the case of mojo::DirectReceiver) or if the peer is not > marked as kUntrusted. This is encapsulated in > Transport::CanAcceptRemoteProcessFromPeer(). > - In the updater service, CreateServerEndpointOptions() previously > set MOJO_SEND_INVITATION_FLAG_UNTRUSTED_PROCESS for every caller of > every install. Now that DecodeHandle() rejects kRecipient handles > from untrusted peers, that declaration is made per caller, and only > by a system install (where callers cross a privilege boundary): a > new EndpointOptions::send_invitation_flags_callback lets > NamedMojoMessagePipeServer choose the invitation flags for each > connecting client, and the updater declares a caller untrusted if > its token is below High integrity. Such a caller cannot open the > SYSTEM server process and so never pre-duplicated legitimately. An > elevated administrator or SYSTEM caller is not declared untrusted > and keeps today's behavior. User installs, where both ends are > equally privileged, declare nothing. > - To match the stricter checks in DecodeHandle(), > UpdateServiceProxyMojoImpl uses MOJO_SEND_INVITATION_FLAG_ELEVATED > when connecting to a system install on Windows. This keeps the more > privileged side doing the duplication even for callers capable of > opening the server process, and keeps such callers working should > the server's classification ever be tightened. > > Compatibility: clients built before this change keep working against > a server built after it. A caller below High integrity cannot open the > SYSTEM server process and therefore already sends kSender, which the > server duplicates; a forged kRecipient handle from it is now refused. > An elevated caller is not declared untrusted, so its pre-duplicated > handles - including the link memory handle carried by the isolated > connection handshake itself - are accepted as before. This matters > because standalone installers bundle an older updater and run it > elevated against whichever version is active. > > TAG=agy > CONV=f1f0f9e4-5cf6-48fb-aa22-494d1abe9ed1 > > Bug: 564573066, 565252396 > Test: mojo_unittests, components_unittests, ipc_tests, updater_tests > Change-Id: I4236c7a0a9104b010300e79ac1b63d9bc0c8887e > Reviewed-on: > Reviewed-by: Andrea Orru > Commit-Queue: S Ganesh > Reviewed-by: Daniel Cheng > Reviewed-by: Noah Rose Ledesma > Cr-Commit-Position: refs/heads/main@{#1713945} (cherry picked from commit d003e09e940872de8f3e564be750ea58e4e60987) Bug: 572073965,564573066,565252396 Change-Id: I4236c7a0a9104b010300e79ac1b63d9bc0c8887e Reviewed-on: Reviewed-by: Andrea Orru Reviewed-by: Noah Rose Ledesma Commit-Queue: S Ganesh Cr-Commit-Position: refs/branch-heads/7977@{#2828} Cr-Branched-From: b7fe14017379ddffae396d944fb8b59a5896c261-refs/heads/main@{#1669021} chrome/updater/BUILD.gn [ diff ] chrome/updater/app/server/update_service_stub.cc [ diff ] chrome/updater/ipc/ipc_security.h [ diff ] chrome/updater/ipc/ipc_security_linux.cc [ diff ] chrome/updater/ipc/ipc_security_mac.cc [ diff ] chrome/updater/ipc/ipc_security_win.cc [ diff ] chrome/updater/ipc/ipc_security_win_unittest.cc [Added - diff ] chrome/updater/ipc/update_service_proxy_mojo.cc [ diff ] components/named_mojo_ipc_server/endpoint_options.h [ diff ] components/named_mojo_ipc_server/named_mojo_ipc_server_unittest.cc [ diff ] components/named_mojo_ipc_server/named_mojo_message_pipe_server.cc [ diff ] mojo/core/ipcz_driver/transport.cc [ diff ] mojo/core/ipcz_driver/transport.h [ diff ] mojo/core/ipcz_driver/transport_test.cc [ diff ]

chrome/updater/BUILD.gn [ diff ]

chrome/updater/app/server/update_service_stub.cc [ diff ]

chrome/updater/ipc/ipc_security.h [ diff ]

chrome/updater/ipc/ipc_security_linux.cc [ diff ]

chrome/updater/ipc/ipc_security_mac.cc [ diff ]

chrome/updater/ipc/ipc_security_win.cc [ diff ]

chrome/updater/ipc/ipc_security_win_unittest.cc [Added - diff ]

chrome/updater/ipc/update_service_proxy_mojo.cc [ diff ]

components/named_mojo_ipc_server/endpoint_options.h [ diff ]

components/named_mojo_ipc_server/named_mojo_ipc_server_unittest.cc [ diff ]

components/named_mojo_ipc_server/named_mojo_message_pipe_server.cc [ diff ]

mojo/core/ipcz_driver/transport.cc [ diff ]

mojo/core/ipcz_driver/transport.h [ diff ]

mojo/core/ipcz_driver/transport_test.cc [ diff ]

commit f5a3be152393c8b330c67d7500057952592d6cef author chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com Mon Oct 12 21:59:02 2026 committer chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com Mon Oct 12 21:59:02 2026 Incrementing VERSION to 152.0.7977.168 Merge-Approval-Bypass: Chrome release infra Change-Id: I1ddaaa93efc74629697cd09fe4162c2056198a5e Reviewed-on: Bot-Commit: chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com Cr-Commit-Position: refs/branch-heads/7977@{#2827} Cr-Branched-From: b7fe14017379ddffae396d944fb8b59a5896c261-refs/heads/main@{#1669021} chrome/VERSION [ diff ]

chrome/VERSION [ diff ]