public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
* [rpms/chromium] f44: - Update to 150.0.7871.124
@ 2026-07-15 12:58 Than Ngo
0 siblings, 0 replies; only message in thread
From: Than Ngo @ 2026-07-15 12:58 UTC (permalink / raw)
To: git-commits
A new commit has been pushed.
Repo : rpms/chromium
Branch : f44
Commit : 6a33b22870b5602a6538a2631f730138a4418fb1
Author : Than Ngo <than@redhat.com>
Date : 2026-07-15T14:56:52+02:00
Stats : +885/-3 in 6 file(s)
URL : https://src.fedoraproject.org/rpms/chromium/c/6a33b22870b5602a6538a2631f730138a4418fb1?branch=f44
Log:
- Update to 150.0.7871.124
* CVE-2026-15764: Use after free in Ozone
* CVE-2026-15765: Use after free in Ozone
* CVE-2026-15766: Uninitialized Use in Skia
* CVE-2026-15767: Heap buffer overflow in libyuv
* CVE-2026-15768: Insufficient policy enforcement in HTML-in-Canvas
* CVE-2026-15769: Insufficient validation of untrusted input in Linux Toolkit Theming
* CVE-2026-15770: Uninitialized Use in V8
* CVE-2026-15771: Insufficient validation of untrusted input in Media
* CVE-2026-15772: Use after free in GPU
* CVE-2026-15773: Use after free in Core
* CVE-2026-15774: Use after free in Skia
* CVE-2026-15775: Insufficient policy enforcement in V8
* CVE-2026-15776: Type Confusion in V8
* CVE-2026-15777: Use after free in UI
* CVE-2026-15778: Insufficient validation of untrusted input in Navigation
- Backport patches to improve auto darkmode
---
diff --git a/chromium-150-Add-size-threshold-for-classifying-SVG-documents-for-auto-dark-mode.patch b/chromium-150-Add-size-threshold-for-classifying-SVG-documents-for-auto-dark-mode.patch
new file mode 100644
index 0000000..6adadbb
--- /dev/null
+++ b/chromium-150-Add-size-threshold-for-classifying-SVG-documents-for-auto-dark-mode.patch
@@ -0,0 +1,372 @@
+commit b5934b11cfc2948f8b97ebb0997aab5f77e2fe2c
+Author: Prashant Nevase <pnevase@microsoft.com>
+Date: Mon Jul 13 04:10:00 2026 -0700
+
+ Add size threshold for classifying SVG documents for auto dark mode.
+
+ Large standalone SVG documents are treated as content (illustrations/
+ photos) and left untouched by auto dark mode, while small ones like
+ icons are considered for auto dark mode.
+
+ Nested SVGs are handled via a stack of auto dark mode paused states on
+ GraphicsContext, managed by ScopedAutoDarkModeState. An icon-sized
+ inner SVG re-enables inversion even inside a paused (large) container,
+ and the outer state is restored on scope exit. Images remain gated by
+ their own size classification rather than the paused state.
+
+ Bug: 449909524
+ Change-Id: Ifd8b68ec9a30ad66c116cf41d510eead499d3bd6
+ Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8036120
+ Reviewed-by: Stephen Chenney <schenney@chromium.org>
+ Commit-Queue: Prashant Nevase <pnevase@microsoft.com>
+ Cr-Commit-Position: refs/heads/main@{#1661044}
+
+diff --git a/third_party/blink/renderer/core/paint/paint_auto_dark_mode.cc b/third_party/blink/renderer/core/paint/paint_auto_dark_mode.cc
+index 658f6a4e4f6f..e4b5a8155148 100644
+--- a/third_party/blink/renderer/core/paint/paint_auto_dark_mode.cc
++++ b/third_party/blink/renderer/core/paint/paint_auto_dark_mode.cc
+@@ -69,6 +69,25 @@ ImageAutoDarkMode ImageClassifierHelper::GetImageAutoDarkMode(
+ GetImageTypeWithZoom(layout_zoom, dest_rect, src_rect));
+ }
+
++// static
++DarkModeFilter::ImageType ImageClassifierHelper::GetSVGDocumentType(
++ LocalFrame& local_frame,
++ const gfx::Rect& size) {
++ // |size| includes the layout zoom factor (page zoom and DSF). Undo it so the
++ // size threshold matches bitmap images, whose classification is unaffected by
++ // page zoom and DSF.
++ const float layout_zoom = local_frame.LayoutZoomFactor();
++ const float unzoomed_width =
++ layout_zoom > 0.f ? size.width() / layout_zoom : size.width();
++ const float unzoomed_height =
++ layout_zoom > 0.f ? size.height() / layout_zoom : size.height();
++ if (unzoomed_width <= kMaxImageLength && unzoomed_height <= kMaxImageLength) {
++ return DarkModeFilter::ImageType::kIcon;
++ }
++
++ return DarkModeFilter::ImageType::kPhoto;
++}
++
+ // static
+ DarkModeFilter::ImageType ImageClassifierHelper::GetImageTypeForTesting(
+ const gfx::RectF& dest_rect,
+diff --git a/third_party/blink/renderer/core/paint/paint_auto_dark_mode.h b/third_party/blink/renderer/core/paint/paint_auto_dark_mode.h
+index afd57eee2b45..a21d1472cde6 100644
+--- a/third_party/blink/renderer/core/paint/paint_auto_dark_mode.h
++++ b/third_party/blink/renderer/core/paint/paint_auto_dark_mode.h
+@@ -39,6 +39,10 @@ class ImageClassifierHelper {
+ DarkModeFilter::ElementRole role =
+ DarkModeFilter::ElementRole::kBackground);
+
++ CORE_EXPORT static DarkModeFilter::ImageType GetSVGDocumentType(
++ LocalFrame& local_frame,
++ const gfx::Rect& size);
++
+ CORE_EXPORT static DarkModeFilter::ImageType GetImageTypeForTesting(
+ const gfx::RectF& dest_rect,
+ const gfx::RectF& src_rect,
+diff --git a/third_party/blink/renderer/core/paint/paint_auto_dark_mode_test.cc b/third_party/blink/renderer/core/paint/paint_auto_dark_mode_test.cc
+index cf05ea1a9e8a..337aff8fe996 100644
+--- a/third_party/blink/renderer/core/paint/paint_auto_dark_mode_test.cc
++++ b/third_party/blink/renderer/core/paint/paint_auto_dark_mode_test.cc
+@@ -4,8 +4,13 @@
+
+ #include "third_party/blink/renderer/core/paint/paint_auto_dark_mode.h"
+
++#include <memory>
++
+ #include "testing/gtest/include/gtest/gtest.h"
++#include "third_party/blink/renderer/core/frame/local_frame.h"
++#include "third_party/blink/renderer/core/testing/dummy_page_holder.h"
+ #include "third_party/blink/renderer/platform/graphics/dark_mode_settings.h"
++#include "third_party/blink/renderer/platform/testing/task_environment.h"
+ #include "ui/gfx/geometry/rect.h"
+
+ namespace blink {
+@@ -72,6 +77,18 @@ class PaintAutoDarkModeTest : public testing::Test {
+ ImageClassifierHelper::GetImageTypeForTesting(dest_rect, src_rect,
+ layout_zoom)));
+ }
++
++ DarkModeFilter::ImageType GetSVGDocumentType(float layout_zoom,
++ const gfx::Rect& size) {
++ LocalFrame& frame = page_holder_->GetFrame();
++ frame.SetLayoutZoomFactor(layout_zoom);
++ return ImageClassifierHelper::GetSVGDocumentType(frame, size);
++ }
++
++ private:
++ test::TaskEnvironment task_environment_;
++ std::unique_ptr<DummyPageHolder> page_holder_ =
++ std::make_unique<DummyPageHolder>(gfx::Size(800, 600));
+ };
+
+ TEST_F(PaintAutoDarkModeTest, ShouldApplyFilterToImage) {
+@@ -154,4 +171,30 @@ TEST_F(PaintAutoDarkModeTest,
+ TestApplyFilterToImageIrrespectiveOfPageZoom(screen_info);
+ }
+
++TEST_F(PaintAutoDarkModeTest, SVGDocumentImage) {
++ // Both dimensions are at or below the icon threshold (kMaxImageLength == 64).
++ EXPECT_EQ(DarkModeFilter::ImageType::kIcon,
++ GetSVGDocumentType(1.0f, gfx::Rect(50, 50)));
++
++ // Either dimension above the threshold classifies the document as a photo.
++ EXPECT_EQ(DarkModeFilter::ImageType::kPhoto,
++ GetSVGDocumentType(1.0f, gfx::Rect(200, 200)));
++ // Only the width exceeds the threshold.
++ EXPECT_EQ(DarkModeFilter::ImageType::kPhoto,
++ GetSVGDocumentType(1.0f, gfx::Rect(100, 50)));
++ // Only the height exceeds the threshold.
++ EXPECT_EQ(DarkModeFilter::ImageType::kPhoto,
++ GetSVGDocumentType(1.0f, gfx::Rect(50, 100)));
++
++ // A 40x40 CSS-sized SVG scaled up by a 5x layout zoom is still an icon after
++ // the zoom is undone.
++ EXPECT_EQ(DarkModeFilter::ImageType::kIcon,
++ GetSVGDocumentType(5.0f, gfx::Rect(200, 200)));
++
++ // A 400x400 CSS-sized SVG scaled down by a 0.25x layout zoom is still a photo
++ // after the zoom is undone.
++ EXPECT_EQ(DarkModeFilter::ImageType::kPhoto,
++ GetSVGDocumentType(0.25f, gfx::Rect(100, 100)));
++}
++
+ } // namespace blink
+diff --git a/third_party/blink/renderer/core/paint/svg_root_painter.cc b/third_party/blink/renderer/core/paint/svg_root_painter.cc
+index 146400e96a69..a93e9e8a96ab 100644
+--- a/third_party/blink/renderer/core/paint/svg_root_painter.cc
++++ b/third_party/blink/renderer/core/paint/svg_root_painter.cc
+@@ -4,12 +4,17 @@
+
+ #include "third_party/blink/renderer/core/paint/svg_root_painter.h"
+
++#include <optional>
++
++#include "third_party/blink/renderer/core/frame/local_frame.h"
+ #include "third_party/blink/renderer/core/layout/svg/layout_svg_foreign_object.h"
+ #include "third_party/blink/renderer/core/layout/svg/layout_svg_root.h"
++#include "third_party/blink/renderer/core/paint/paint_auto_dark_mode.h"
+ #include "third_party/blink/renderer/core/paint/paint_info.h"
+ #include "third_party/blink/renderer/core/paint/paint_layer.h"
+ #include "third_party/blink/renderer/core/paint/paint_layer_painter.h"
+ #include "third_party/blink/renderer/core/svg/svg_svg_element.h"
++#include "third_party/blink/renderer/platform/graphics/graphics_context.h"
+ #include "third_party/blink/renderer/platform/runtime_enabled_features.h"
+
+ namespace blink {
+@@ -64,8 +69,10 @@ AffineTransform SVGRootPainter::TransformToPixelSnappedBorderBox(
+ void SVGRootPainter::PaintReplaced(const PaintInfo& paint_info,
+ const PhysicalOffset& paint_offset) {
+ // An empty viewport disables rendering.
+- if (PixelSnappedSize(paint_offset).IsEmpty())
++ const gfx::Rect snapped_size = PixelSnappedSize(paint_offset);
++ if (snapped_size.IsEmpty()) {
+ return;
++ }
+
+ // An empty viewBox also disables rendering.
+ // (http://www.w3.org/TR/SVG/coords.html#ViewBoxAttribute)
+@@ -78,6 +85,23 @@ void SVGRootPainter::PaintReplaced(const PaintInfo& paint_info,
+ return;
+ }
+
++ std::optional<GraphicsContext::ScopedAutoDarkModeState> dark_mode_state;
++ if (layout_svg_root_.StyleRef().ForceDark()) {
++ // Only treat icon/separator-sized SVG documents as candidates for dark
++ // mode inversion. Larger SVGs are likely content (illustrations/photos)
++ // and should not be force-darkened. This mirrors the size-based image
++ // classification used for bitmaps (kMaxImageLength). SVGs can be nested,
++ // so pause this SVG's dark mode state while painting its children; the
++ // scoper restores the outer state when it goes out of scope. This lets an
++ // icon-sized SVG embedded inside a larger (paused) SVG re-enable inversion
++ // for itself.
++ const bool pause_dark_mode =
++ ImageClassifierHelper::GetSVGDocumentType(*layout_svg_root_.GetFrame(),
++ snapped_size) !=
++ DarkModeFilter::ImageType::kIcon;
++ dark_mode_state.emplace(paint_info.context, pause_dark_mode);
++ }
++
+ for (LayoutObject* child = layout_svg_root_.FirstChild(); child;
+ child = child->NextSibling()) {
+ if (auto* foreign_object = DynamicTo<LayoutSVGForeignObject>(child)) {
+diff --git a/third_party/blink/renderer/platform/graphics/graphics_context.cc b/third_party/blink/renderer/platform/graphics/graphics_context.cc
+index 92d59af081ed..df395fc243fe 100644
+--- a/third_party/blink/renderer/platform/graphics/graphics_context.cc
++++ b/third_party/blink/renderer/platform/graphics/graphics_context.cc
+@@ -77,7 +77,7 @@ namespace {
+ SkColor4f DarkModeColor(GraphicsContext& context,
+ const SkColor4f& color,
+ const AutoDarkMode& auto_dark_mode) {
+- if (auto_dark_mode.enabled) {
++ if (auto_dark_mode.enabled && !context.IsAutoDarkModePaused()) {
+ return context.GetDarkModeFilter()->InvertColorIfNeeded(
+ color, auto_dark_mode.role,
+ SkColor4f::FromColor(auto_dark_mode.contrast_color));
+@@ -189,7 +189,7 @@ class GraphicsContext::DarkModeFlags final {
+ DarkModeFlags(GraphicsContext* context,
+ const AutoDarkMode& auto_dark_mode,
+ const cc::PaintFlags& flags) {
+- if (auto_dark_mode.enabled) {
++ if (auto_dark_mode.enabled && !context->IsAutoDarkModePaused()) {
+ dark_mode_flags_ = context->GetDarkModeFilter()->ApplyToFlagsIfNeeded(
+ flags, auto_dark_mode.role,
+ SkColor4f::FromColor(auto_dark_mode.contrast_color));
+@@ -248,6 +248,9 @@ DarkModeFilter* GraphicsContext::GetDarkModeFilterForImage(
+ const ImageAutoDarkMode& auto_dark_mode) {
+ if (!auto_dark_mode.enabled)
+ return nullptr;
++ // Images are gated by their own size classification, not by the context's
++ // auto dark mode paused state, so an icon-sized image is still inverted even
++ // while dark mode is paused for its container.
+ DarkModeFilter* dark_mode_filter = GetDarkModeFilter();
+ if (!dark_mode_filter->ShouldApplyFilterToImage(auto_dark_mode.image_type))
+ return nullptr;
+diff --git a/third_party/blink/renderer/platform/graphics/graphics_context.h b/third_party/blink/renderer/platform/graphics/graphics_context.h
+index 046098e79578..f072e24b1e22 100644
+--- a/third_party/blink/renderer/platform/graphics/graphics_context.h
++++ b/third_party/blink/renderer/platform/graphics/graphics_context.h
+@@ -213,6 +213,34 @@ class PLATFORM_EXPORT GraphicsContext {
+ DarkModeFilter* GetDarkModeFilterForImage(
+ const ImageAutoDarkMode& auto_dark_mode);
+
++ // Pushes a dark mode inversion pause state on construction and pops it on
++ // destruction, guaranteeing pushes and pops are always balanced. See the
++ // comment on IsAutoDarkModePaused() for the semantics of the pause states.
++ class ScopedAutoDarkModeState {
++ STACK_ALLOCATED();
++
++ public:
++ ScopedAutoDarkModeState(GraphicsContext& context, bool paused)
++ : context_(context) {
++ context_.PushAutoDarkModeState(paused);
++ }
++ ScopedAutoDarkModeState(const ScopedAutoDarkModeState&) = delete;
++ ScopedAutoDarkModeState& operator=(const ScopedAutoDarkModeState&) = delete;
++ ~ScopedAutoDarkModeState() { context_.PopAutoDarkModeState(); }
++
++ private:
++ GraphicsContext& context_;
++ };
++
++ // Dark mode color/flags inversion pause state. While the latest pushed state
++ // is true, inversion is paused regardless of the per-draw |enabled| flag.
++ // Nested scopes can override the pause state of their ancestors: the pushed
++ // state applies until it is popped, after which the previous state takes
++ // effect again. Use ScopedAutoDarkModeState to manage the states.
++ bool IsAutoDarkModePaused() const {
++ return !auto_dark_mode_states_.empty() && auto_dark_mode_states_.back();
++ }
++
+ void SetDarkModeFilterForTest(std::unique_ptr<DarkModeFilter>);
+
+ // ---------- State management methods -----------------
+@@ -511,6 +539,16 @@ class PLATFORM_EXPORT GraphicsContext {
+ return paint_state_;
+ }
+
++ // Managed exclusively through ScopedAutoDarkModeState to keep pushes and pops
++ // balanced.
++ void PushAutoDarkModeState(bool paused) {
++ auto_dark_mode_states_.push_back(paused);
++ }
++ void PopAutoDarkModeState() {
++ DCHECK(!auto_dark_mode_states_.empty());
++ auto_dark_mode_states_.pop_back();
++ }
++
+ template <typename DrawTextFunc>
+ void DrawTextPasses(const DrawTextFunc&);
+
+@@ -571,6 +609,7 @@ class PLATFORM_EXPORT GraphicsContext {
+
+ std::unique_ptr<DarkModeFilter> dark_mode_filter_;
+
++ Vector<bool> auto_dark_mode_states_;
+ bool printing_ = false;
+ bool printing_internal_headers_and_footers_ = false;
+ bool in_drawing_recorder_ = false;
+diff --git a/third_party/blink/renderer/platform/graphics/graphics_context_test.cc b/third_party/blink/renderer/platform/graphics/graphics_context_test.cc
+index d09676bb92ad..e8504cb54106 100644
+--- a/third_party/blink/renderer/platform/graphics/graphics_context_test.cc
++++ b/third_party/blink/renderer/platform/graphics/graphics_context_test.cc
+@@ -198,5 +198,77 @@ TEST_F(GraphicsContextDarkModeTest, InvertLightnessLAB) {
+ EXPECT_EQ(0xff7f7f7f, bitmap_.getColor(3, 0));
+ }
+
++TEST_F(GraphicsContextDarkModeTest, ScopedAutoDarkModeStatePaused) {
++ PaintController paint_controller;
++ GraphicsContext context(paint_controller);
++ DarkModeSettings settings;
++ context.SetDarkModeFilterForTest(std::make_unique<DarkModeFilter>(settings));
++ AutoDarkMode auto_dark_mode(DarkModeFilter::ElementRole::kBackground,
++ /*enabled=*/true);
++
++ EXPECT_FALSE(context.IsAutoDarkModePaused());
++
++ context.BeginRecording();
++ {
++ // Pausing suppresses inversion, so black stays black.
++ GraphicsContext::ScopedAutoDarkModeState paused(context, /*paused=*/true);
++ EXPECT_TRUE(context.IsAutoDarkModePaused());
++ context.FillRect(gfx::RectF(0, 0, 1, 1), Color::kBlack, auto_dark_mode);
++
++ {
++ // A nested scope overrides the ancestor, re-enabling inversion so black
++ // becomes white.
++ GraphicsContext::ScopedAutoDarkModeState resumed(context,
++ /*paused=*/false);
++ EXPECT_FALSE(context.IsAutoDarkModePaused());
++ context.FillRect(gfx::RectF(1, 0, 1, 1), Color::kBlack, auto_dark_mode);
++ }
++
++ // The outer paused state is restored when the nested scope exits.
++ EXPECT_TRUE(context.IsAutoDarkModePaused());
++ }
++
++ // Back to the default (not paused) state after all scopes exit; inversion
++ // applies again, so black becomes white.
++ EXPECT_FALSE(context.IsAutoDarkModePaused());
++ context.FillRect(gfx::RectF(2, 0, 1, 1), Color::kBlack, auto_dark_mode);
++
++ canvas_->drawPicture(context.EndRecording());
++
++ EXPECT_EQ(SK_ColorBLACK, bitmap_.getColor(0, 0));
++ EXPECT_EQ(SK_ColorWHITE, bitmap_.getColor(1, 0));
++ EXPECT_EQ(SK_ColorWHITE, bitmap_.getColor(2, 0));
++}
++
++TEST_F(GraphicsContextDarkModeTest,
++ BitmapImageIgnoresAutoDarkModePausedStates) {
++ PaintController paint_controller;
++ GraphicsContext context(paint_controller);
++ DarkModeSettings settings;
++ context.SetDarkModeFilterForTest(std::make_unique<DarkModeFilter>(settings));
++
++ ImageAutoDarkMode icon(DarkModeFilter::ElementRole::kBackground,
++ /*enabled=*/true, DarkModeFilter::ImageType::kIcon);
++ ImageAutoDarkMode photo(DarkModeFilter::ElementRole::kBackground,
++ /*enabled=*/true, DarkModeFilter::ImageType::kPhoto);
++
++ // Not paused: icons are inverted, photos are not.
++ EXPECT_FALSE(context.IsAutoDarkModePaused());
++ EXPECT_NE(nullptr, context.GetDarkModeFilterForImage(icon));
++ EXPECT_EQ(nullptr, context.GetDarkModeFilterForImage(photo));
++
++ {
++ // Paused: the icon is still inverted, and the photo is still untouched.
++ GraphicsContext::ScopedAutoDarkModeState paused(context, /*paused=*/true);
++ EXPECT_TRUE(context.IsAutoDarkModePaused());
++ EXPECT_NE(nullptr, context.GetDarkModeFilterForImage(icon));
++ EXPECT_EQ(nullptr, context.GetDarkModeFilterForImage(photo));
++ }
++
++ // A disabled image auto dark mode never returns a filter.
++ EXPECT_EQ(nullptr,
++ context.GetDarkModeFilterForImage(ImageAutoDarkMode::Disabled()));
++}
++
+ } // namespace
+ } // namespace blink
diff --git a/chromium-150-Make-dark-mode-apply-filter-to-images-irrespective-of-layout-zoom.patch b/chromium-150-Make-dark-mode-apply-filter-to-images-irrespective-of-layout-zoom.patch
new file mode 100644
index 0000000..8ecaed0
--- /dev/null
+++ b/chromium-150-Make-dark-mode-apply-filter-to-images-irrespective-of-layout-zoom.patch
@@ -0,0 +1,204 @@
+commit cf9588e0655663e301915e53ec5a8df8ae874ce4
+Author: Prashant Nevase <pnevase@microsoft.com>
+Date: Fri Jun 19 06:19:47 2026 -0700
+
+ Make dark mode apply filter to images irrespective of layout zoom
+
+ The layout zoom factor combines page zoom with the device scale factor.
+ When zoom is applied, the page size scales accordingly, and images are
+ drawn relative to the new page size. This should account for the higher
+ icon threshold ratio compared with the 1x scale. Otherwise, the same
+ image may receive different dark mode filters at different scales,
+ creating a poor user experience. To avoid this, dark mode image
+ classification should remain consistent across layout zoom factors.
+
+ CSS zoom is still considered, because it changes the ratio of drawn
+ image size to display size in 1x scale.
+
+ Bug: 449909524
+ Change-Id: Ia420007b278a1f592c353557d4cbf66a7c575c42
+ Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7961660
+ Reviewed-by: Stephen Chenney <schenney@chromium.org>
+ Commit-Queue: Prashant Nevase <pnevase@microsoft.com>
+ Auto-Submit: Prashant Nevase <pnevase@microsoft.com>
+ Cr-Commit-Position: refs/heads/main@{#1649638}
+
+diff --git a/third_party/blink/renderer/core/paint/paint_auto_dark_mode.cc b/third_party/blink/renderer/core/paint/paint_auto_dark_mode.cc
+index 1246f179f9b19..5b34283d7a556 100644
+--- a/third_party/blink/renderer/core/paint/paint_auto_dark_mode.cc
++++ b/third_party/blink/renderer/core/paint/paint_auto_dark_mode.cc
+@@ -41,6 +41,7 @@ DarkModeFilter::ImageType GetImageType(float dest_to_device_ratio,
+
+ float GetRatio(const display::ScreenInfo& screen_info,
+ const gfx::RectF& dest_rect) {
++ // Compute device rect in device pixels.
+ const gfx::SizeF& device_rect = gfx::ScaleSize(
+ gfx::SizeF(screen_info.rect.size()), screen_info.device_scale_factor);
+
+@@ -48,6 +49,27 @@ float GetRatio(const display::ScreenInfo& screen_info,
+ dest_rect.height() / device_rect.height());
+ }
+
++// Classifies an image after undoing the frame's layout zoom factor.
++// |dest_rect| comes from layout geometry and includes layout zoom (page zoom
++// and potentially DSF) and CSS zoom. Undo only layout zoom so page zoom and
++// DSF do not affect classification, while CSS zoom still does. |src_rect| is
++// derived from the image's intrinsic pixel size and is already
++// zoom-independent, so it must be left untouched.
++DarkModeFilter::ImageType GetImageTypeWithZoom(
++ const display::ScreenInfo& screen_info,
++ float zoom,
++ const gfx::RectF& dest_rect,
++ const gfx::RectF& src_rect) {
++ gfx::RectF unzoomed_dest_rect = dest_rect;
++ if (zoom > 0.f && zoom != 1.f) {
++ unzoomed_dest_rect.Scale(1.f / zoom);
++ }
++
++ return GetImageType(GetRatio(screen_info, unzoomed_dest_rect),
++ gfx::ToEnclosingRect(unzoomed_dest_rect),
++ gfx::ToEnclosingRect(src_rect));
++}
++
+ } // namespace
+
+ // static
+@@ -63,20 +85,19 @@ ImageAutoDarkMode ImageClassifierHelper::GetImageAutoDarkMode(
+ const display::ScreenInfo& screen_info =
+ local_frame.GetChromeClient().GetScreenInfo(local_frame);
+
+- return ImageAutoDarkMode(role, style.ForceDark(),
+- GetImageType(GetRatio(screen_info, dest_rect),
+- gfx::ToEnclosingRect(dest_rect),
+- gfx::ToEnclosingRect(src_rect)));
++ const float layout_zoom = local_frame.LayoutZoomFactor();
++ return ImageAutoDarkMode(
++ role, style.ForceDark(),
++ GetImageTypeWithZoom(screen_info, layout_zoom, dest_rect, src_rect));
+ }
+
+ // static
+ DarkModeFilter::ImageType ImageClassifierHelper::GetImageTypeForTesting(
+ display::ScreenInfo& screen_info,
+ const gfx::RectF& dest_rect,
+- const gfx::RectF& src_rect) {
+- return GetImageType(GetRatio(screen_info, dest_rect),
+- gfx::ToEnclosingRect(dest_rect),
+- gfx::ToEnclosingRect(src_rect));
++ const gfx::RectF& src_rect,
++ float zoom) {
++ return GetImageTypeWithZoom(screen_info, zoom, dest_rect, src_rect);
+ }
+
+ } // namespace blink
+diff --git a/third_party/blink/renderer/core/paint/paint_auto_dark_mode.h b/third_party/blink/renderer/core/paint/paint_auto_dark_mode.h
+index f3eda0113391a..9bf8df1c33a84 100644
+--- a/third_party/blink/renderer/core/paint/paint_auto_dark_mode.h
++++ b/third_party/blink/renderer/core/paint/paint_auto_dark_mode.h
+@@ -42,7 +42,8 @@ class ImageClassifierHelper {
+ CORE_EXPORT static DarkModeFilter::ImageType GetImageTypeForTesting(
+ display::ScreenInfo& screen_info,
+ const gfx::RectF& dest_rect,
+- const gfx::RectF& src_rect);
++ const gfx::RectF& src_rect,
++ float zoom = 1.0f);
+ };
+
+ } // namespace blink
+diff --git a/third_party/blink/renderer/core/paint/paint_auto_dark_mode_test.cc b/third_party/blink/renderer/core/paint/paint_auto_dark_mode_test.cc
+index 705a304de1ce7..77ff0f069188e 100644
+--- a/third_party/blink/renderer/core/paint/paint_auto_dark_mode_test.cc
++++ b/third_party/blink/renderer/core/paint/paint_auto_dark_mode_test.cc
+@@ -10,7 +10,69 @@
+
+ namespace blink {
+
+-class PaintAutoDarkModeTest : public testing::Test {};
++class PaintAutoDarkModeTest : public testing::Test {
++ public:
++ void TestApplyFilterToImageIrrespectiveOfPageZoom(
++ display::ScreenInfo screen_info) {
++ DarkModeSettings settings;
++ DarkModeFilter filter(settings);
++
++ float page_zoom = 1.0f;
++ float layout_zoom = 1.0f;
++ float css_zoom = 1.0f;
++ gfx::RectF src_rect;
++ gfx::RectF dest_rect;
++
++ // A 50x50 CSS icon gets filtered even if |dest_rect| becomes larger 250x250
++ // than threshold size in larger zoom levels.
++ src_rect = gfx::RectF(50, 50);
++ page_zoom = 5.0f;
++ css_zoom = 1.0f;
++ layout_zoom = page_zoom * screen_info.device_scale_factor;
++ dest_rect =
++ gfx::RectF(50 * layout_zoom * css_zoom, 50 * layout_zoom * css_zoom);
++ EXPECT_TRUE(filter.ShouldApplyFilterToImage(
++ ImageClassifierHelper::GetImageTypeForTesting(screen_info, dest_rect,
++ src_rect, layout_zoom)));
++
++ // A 50x50 CSS icon with css zoom 5.0f becomes 250x250 and does not get
++ // filterred as |dest_rect| is larger than threshold size.
++ src_rect = gfx::RectF(50, 50);
++ page_zoom = 5.0f;
++ css_zoom = 5.0f;
++ layout_zoom = page_zoom * screen_info.device_scale_factor;
++ dest_rect =
++ gfx::RectF(50 * layout_zoom * css_zoom, 50 * layout_zoom * css_zoom);
++ EXPECT_FALSE(filter.ShouldApplyFilterToImage(
++ ImageClassifierHelper::GetImageTypeForTesting(screen_info, dest_rect,
++ src_rect, layout_zoom)));
++
++ // An image with 200x200 CSS size gets classified as photo and does not get
++ // filtered, even if |dest_rect| becomes smaller 50x50 than threshold size
++ // in smaller zoom levels.
++ src_rect = gfx::RectF(200, 200);
++ page_zoom = 0.25f;
++ css_zoom = 1.0f;
++ layout_zoom = page_zoom * screen_info.device_scale_factor;
++ dest_rect =
++ gfx::RectF(200 * layout_zoom * css_zoom, 200 * layout_zoom * css_zoom);
++ EXPECT_FALSE(filter.ShouldApplyFilterToImage(
++ ImageClassifierHelper::GetImageTypeForTesting(screen_info, dest_rect,
++ src_rect, layout_zoom)));
++
++ // An image with 200x200 CSS size becomes 20x20 CSS size and gets classified
++ // as icon as the CSS size is below the threshold.
++ src_rect = gfx::RectF(200, 200);
++ page_zoom = 0.25f;
++ css_zoom = 0.1f;
++ layout_zoom = page_zoom * screen_info.device_scale_factor;
++ dest_rect =
++ gfx::RectF(200 * layout_zoom * css_zoom, 200 * layout_zoom * css_zoom);
++ EXPECT_TRUE(filter.ShouldApplyFilterToImage(
++ ImageClassifierHelper::GetImageTypeForTesting(screen_info, dest_rect,
++ src_rect, layout_zoom)));
++ }
++};
+
+ TEST_F(PaintAutoDarkModeTest, ShouldApplyFilterToImage) {
+ DarkModeSettings settings;
+@@ -77,4 +139,21 @@ TEST_F(PaintAutoDarkModeTest, ShouldApplyFilterToImageOnMobile) {
+ screen_info, gfx::RectF(180, 180), gfx::RectF(180, 180))));
+ }
+
++TEST_F(PaintAutoDarkModeTest, ShouldApplyFilterToImageIrrespectiveOfPageZoom) {
++ display::ScreenInfo screen_info;
++ screen_info.rect = gfx::Rect(1920, 1080);
++ screen_info.device_scale_factor = 1.0f;
++
++ TestApplyFilterToImageIrrespectiveOfPageZoom(screen_info);
++}
++
++TEST_F(PaintAutoDarkModeTest,
++ ShouldApplyFilterToImageIrrespectiveOfPageZoomOnMobile) {
++ display::ScreenInfo screen_info;
++ screen_info.rect = gfx::Rect(360, 780);
++ screen_info.device_scale_factor = 3.0f;
++
++ TestApplyFilterToImageIrrespectiveOfPageZoom(screen_info);
++}
++
+ } // namespace blink
diff --git a/chromium-150-Use-64px-css-pixels-absolute-threshold-for-dark-image-classification.patch b/chromium-150-Use-64px-css-pixels-absolute-threshold-for-dark-image-classification.patch
new file mode 100644
index 0000000..6dc9b17
--- /dev/null
+++ b/chromium-150-Use-64px-css-pixels-absolute-threshold-for-dark-image-classification.patch
@@ -0,0 +1,281 @@
+commit 2c0b79c57c1726f359bcd87137474e854b1aeb38
+Author: Prashant Nevase <pnevase@microsoft.com>
+Date: Thu Jun 25 08:11:34 2026 -0700
+
+ Use 64px css pixels absolute threshold for dark image classification.
+
+ The previous ratio-based threshold scaled with the screen size and
+ device scale factor, so the same image could be classified differently
+ depending on the display it was shown on. This produced inconsistent
+ dark mode results across displays of different sizes and device scale
+ factors.
+
+ Replace the screen-size ratio heuristic (kMaxIconRatio) with a single
+ absolute size threshold of 64 CSS pixels for classifying images as icons
+ in auto dark mode. The threshold is compared after undoing the frame's
+ layout zoom factor (page zoom and device scale factor), so
+ classification is stable across devices and page zoom levels while CSS
+ zoom still affects the drawn size and therefore the result.
+
+ This removes the dependency on display::ScreenInfo from the
+ classification path and simplifies GetImageType() to a pure size check.
+
+ Bug: 449909524
+ Change-Id: I447ec7a1f94fed3004889dfe2bd78bf8392ddd61
+ Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8005176
+ Reviewed-by: Stephen Chenney <schenney@chromium.org>
+ Commit-Queue: Prashant Nevase <pnevase@microsoft.com>
+ Cr-Commit-Position: refs/heads/main@{#1652434}
+
+diff --git a/third_party/blink/renderer/core/paint/paint_auto_dark_mode.cc b/third_party/blink/renderer/core/paint/paint_auto_dark_mode.cc
+index 5b34283d7a556..658f6a4e4f6fd 100644
+--- a/third_party/blink/renderer/core/paint/paint_auto_dark_mode.cc
++++ b/third_party/blink/renderer/core/paint/paint_auto_dark_mode.cc
+@@ -5,32 +5,26 @@
+ #include "third_party/blink/renderer/core/paint/paint_auto_dark_mode.h"
+
+ #include "third_party/blink/renderer/core/frame/local_frame.h"
+-#include "third_party/blink/renderer/core/page/chrome_client.h"
+-#include "ui/display/screen_info.h"
+ #include "ui/gfx/geometry/rect.h"
+ #include "ui/gfx/geometry/rect_conversions.h"
+
+ namespace blink {
+
+ namespace {
+-
+-// The maximum ratio of image size to screen size that is considered an icon.
+-constexpr float kMaxIconRatio = 0.13f;
+-constexpr int kMaxImageLength = 50;
++// Images with both width and height smaller than this value are considered
++// icons.
++constexpr int kMaxImageLength = 64;
+ // Images with either dimension less than this value are considered separators.
+ constexpr int kMaxImageSeparatorLength = 8;
+
+ // We need to do image classification first before calling
+ // DarkModeFilter::GenerateImageFilter.
+-DarkModeFilter::ImageType GetImageType(float dest_to_device_ratio,
+- const gfx::Rect& dest_rect,
++DarkModeFilter::ImageType GetImageType(const gfx::Rect& dest_rect,
+ const gfx::Rect& src_rect) {
+- // TODO: Use a viewport relative threshold for the size check instead of
+- // absolute threshold.
+- if (dest_to_device_ratio <= kMaxIconRatio ||
+- (dest_rect.width() <= kMaxImageLength &&
+- dest_rect.height() <= kMaxImageLength))
++ if (dest_rect.width() <= kMaxImageLength &&
++ dest_rect.height() <= kMaxImageLength) {
+ return DarkModeFilter::ImageType::kIcon;
++ }
+
+ if (src_rect.width() <= kMaxImageSeparatorLength ||
+ src_rect.height() <= kMaxImageSeparatorLength)
+@@ -39,34 +33,21 @@ DarkModeFilter::ImageType GetImageType(float dest_to_device_ratio,
+ return DarkModeFilter::ImageType::kPhoto;
+ }
+
+-float GetRatio(const display::ScreenInfo& screen_info,
+- const gfx::RectF& dest_rect) {
+- // Compute device rect in device pixels.
+- const gfx::SizeF& device_rect = gfx::ScaleSize(
+- gfx::SizeF(screen_info.rect.size()), screen_info.device_scale_factor);
+-
+- return std::max(dest_rect.width() / device_rect.width(),
+- dest_rect.height() / device_rect.height());
+-}
+-
+ // Classifies an image after undoing the frame's layout zoom factor.
+ // |dest_rect| comes from layout geometry and includes layout zoom (page zoom
+ // and potentially DSF) and CSS zoom. Undo only layout zoom so page zoom and
+ // DSF do not affect classification, while CSS zoom still does. |src_rect| is
+ // derived from the image's intrinsic pixel size and is already
+ // zoom-independent, so it must be left untouched.
+-DarkModeFilter::ImageType GetImageTypeWithZoom(
+- const display::ScreenInfo& screen_info,
+- float zoom,
+- const gfx::RectF& dest_rect,
+- const gfx::RectF& src_rect) {
++DarkModeFilter::ImageType GetImageTypeWithZoom(float zoom,
++ const gfx::RectF& dest_rect,
++ const gfx::RectF& src_rect) {
+ gfx::RectF unzoomed_dest_rect = dest_rect;
+ if (zoom > 0.f && zoom != 1.f) {
+ unzoomed_dest_rect.Scale(1.f / zoom);
+ }
+
+- return GetImageType(GetRatio(screen_info, unzoomed_dest_rect),
+- gfx::ToEnclosingRect(unzoomed_dest_rect),
++ return GetImageType(gfx::ToEnclosingRect(unzoomed_dest_rect),
+ gfx::ToEnclosingRect(src_rect));
+ }
+
+@@ -82,22 +63,18 @@ ImageAutoDarkMode ImageClassifierHelper::GetImageAutoDarkMode(
+ if (!style.ForceDark())
+ return ImageAutoDarkMode::Disabled();
+
+- const display::ScreenInfo& screen_info =
+- local_frame.GetChromeClient().GetScreenInfo(local_frame);
+-
+ const float layout_zoom = local_frame.LayoutZoomFactor();
+ return ImageAutoDarkMode(
+ role, style.ForceDark(),
+- GetImageTypeWithZoom(screen_info, layout_zoom, dest_rect, src_rect));
++ GetImageTypeWithZoom(layout_zoom, dest_rect, src_rect));
+ }
+
+ // static
+ DarkModeFilter::ImageType ImageClassifierHelper::GetImageTypeForTesting(
+- display::ScreenInfo& screen_info,
+ const gfx::RectF& dest_rect,
+ const gfx::RectF& src_rect,
+ float zoom) {
+- return GetImageTypeWithZoom(screen_info, zoom, dest_rect, src_rect);
++ return GetImageTypeWithZoom(zoom, dest_rect, src_rect);
+ }
+
+ } // namespace blink
+diff --git a/third_party/blink/renderer/core/paint/paint_auto_dark_mode.h b/third_party/blink/renderer/core/paint/paint_auto_dark_mode.h
+index 9bf8df1c33a84..afd57eee2b456 100644
+--- a/third_party/blink/renderer/core/paint/paint_auto_dark_mode.h
++++ b/third_party/blink/renderer/core/paint/paint_auto_dark_mode.h
+@@ -40,7 +40,6 @@ class ImageClassifierHelper {
+ DarkModeFilter::ElementRole::kBackground);
+
+ CORE_EXPORT static DarkModeFilter::ImageType GetImageTypeForTesting(
+- display::ScreenInfo& screen_info,
+ const gfx::RectF& dest_rect,
+ const gfx::RectF& src_rect,
+ float zoom = 1.0f);
+diff --git a/third_party/blink/renderer/core/paint/paint_auto_dark_mode_test.cc b/third_party/blink/renderer/core/paint/paint_auto_dark_mode_test.cc
+index 77ff0f069188e..cf05ea1a9e8af 100644
+--- a/third_party/blink/renderer/core/paint/paint_auto_dark_mode_test.cc
++++ b/third_party/blink/renderer/core/paint/paint_auto_dark_mode_test.cc
+@@ -32,8 +32,8 @@ class PaintAutoDarkModeTest : public testing::Test {
+ dest_rect =
+ gfx::RectF(50 * layout_zoom * css_zoom, 50 * layout_zoom * css_zoom);
+ EXPECT_TRUE(filter.ShouldApplyFilterToImage(
+- ImageClassifierHelper::GetImageTypeForTesting(screen_info, dest_rect,
+- src_rect, layout_zoom)));
++ ImageClassifierHelper::GetImageTypeForTesting(dest_rect, src_rect,
++ layout_zoom)));
+
+ // A 50x50 CSS icon with css zoom 5.0f becomes 250x250 and does not get
+ // filterred as |dest_rect| is larger than threshold size.
+@@ -44,8 +44,8 @@ class PaintAutoDarkModeTest : public testing::Test {
+ dest_rect =
+ gfx::RectF(50 * layout_zoom * css_zoom, 50 * layout_zoom * css_zoom);
+ EXPECT_FALSE(filter.ShouldApplyFilterToImage(
+- ImageClassifierHelper::GetImageTypeForTesting(screen_info, dest_rect,
+- src_rect, layout_zoom)));
++ ImageClassifierHelper::GetImageTypeForTesting(dest_rect, src_rect,
++ layout_zoom)));
+
+ // An image with 200x200 CSS size gets classified as photo and does not get
+ // filtered, even if |dest_rect| becomes smaller 50x50 than threshold size
+@@ -57,8 +57,8 @@ class PaintAutoDarkModeTest : public testing::Test {
+ dest_rect =
+ gfx::RectF(200 * layout_zoom * css_zoom, 200 * layout_zoom * css_zoom);
+ EXPECT_FALSE(filter.ShouldApplyFilterToImage(
+- ImageClassifierHelper::GetImageTypeForTesting(screen_info, dest_rect,
+- src_rect, layout_zoom)));
++ ImageClassifierHelper::GetImageTypeForTesting(dest_rect, src_rect,
++ layout_zoom)));
+
+ // An image with 200x200 CSS size becomes 20x20 CSS size and gets classified
+ // as icon as the CSS size is below the threshold.
+@@ -69,8 +69,8 @@ class PaintAutoDarkModeTest : public testing::Test {
+ dest_rect =
+ gfx::RectF(200 * layout_zoom * css_zoom, 200 * layout_zoom * css_zoom);
+ EXPECT_TRUE(filter.ShouldApplyFilterToImage(
+- ImageClassifierHelper::GetImageTypeForTesting(screen_info, dest_rect,
+- src_rect, layout_zoom)));
++ ImageClassifierHelper::GetImageTypeForTesting(dest_rect, src_rect,
++ layout_zoom)));
+ }
+ };
+
+@@ -78,44 +78,40 @@ TEST_F(PaintAutoDarkModeTest, ShouldApplyFilterToImage) {
+ DarkModeSettings settings;
+ DarkModeFilter filter(settings);
+
+- display::ScreenInfo screen_info;
+- screen_info.rect = gfx::Rect(1920, 1080);
+- screen_info.device_scale_factor = 1.0f;
+-
+ // |dst| is smaller than threshold size.
+ EXPECT_TRUE(filter.ShouldApplyFilterToImage(
+- ImageClassifierHelper::GetImageTypeForTesting(
+- screen_info, gfx::RectF(50, 50), gfx::RectF(50, 50))));
++ ImageClassifierHelper::GetImageTypeForTesting(gfx::RectF(50, 50),
++ gfx::RectF(50, 50))));
+
+ // |dst| is smaller than threshold size, even |src| is larger.
+ EXPECT_TRUE(filter.ShouldApplyFilterToImage(
+- ImageClassifierHelper::GetImageTypeForTesting(
+- screen_info, gfx::RectF(50, 50), gfx::RectF(200, 200))));
++ ImageClassifierHelper::GetImageTypeForTesting(gfx::RectF(50, 50),
++ gfx::RectF(200, 200))));
+
+ // |dst| is smaller than threshold size, |src| is smaller.
+ EXPECT_TRUE(filter.ShouldApplyFilterToImage(
+- ImageClassifierHelper::GetImageTypeForTesting(
+- screen_info, gfx::RectF(50, 50), gfx::RectF(20, 20))));
++ ImageClassifierHelper::GetImageTypeForTesting(gfx::RectF(50, 50),
++ gfx::RectF(20, 20))));
+
+ // |src| having very smaller width, even |dst| is larger than threshold size.
+ EXPECT_TRUE(filter.ShouldApplyFilterToImage(
+- ImageClassifierHelper::GetImageTypeForTesting(
+- screen_info, gfx::RectF(200, 5), gfx::RectF(200, 5))));
++ ImageClassifierHelper::GetImageTypeForTesting(gfx::RectF(200, 5),
++ gfx::RectF(200, 5))));
+
+ // |src| having very smaller height, even |dst| is larger than threshold size.
+ EXPECT_TRUE(filter.ShouldApplyFilterToImage(
+- ImageClassifierHelper::GetImageTypeForTesting(
+- screen_info, gfx::RectF(5, 200), gfx::RectF(5, 200))));
++ ImageClassifierHelper::GetImageTypeForTesting(gfx::RectF(5, 200),
++ gfx::RectF(5, 200))));
+
+ // |dst| is larger than threshold size.
+ EXPECT_FALSE(filter.ShouldApplyFilterToImage(
+- ImageClassifierHelper::GetImageTypeForTesting(
+- screen_info, gfx::RectF(200, 200), gfx::RectF(20, 20))));
++ ImageClassifierHelper::GetImageTypeForTesting(gfx::RectF(200, 200),
++ gfx::RectF(20, 20))));
+
+ // |dst| is larger than threshold size.
+ EXPECT_FALSE(filter.ShouldApplyFilterToImage(
+- ImageClassifierHelper::GetImageTypeForTesting(
+- screen_info, gfx::RectF(20, 200), gfx::RectF(20, 200))));
++ ImageClassifierHelper::GetImageTypeForTesting(gfx::RectF(20, 200),
++ gfx::RectF(20, 200))));
+ }
+
+ // Test for mobile display configuration
+@@ -126,17 +122,19 @@ TEST_F(PaintAutoDarkModeTest, ShouldApplyFilterToImageOnMobile) {
+ display::ScreenInfo screen_info;
+ screen_info.rect = gfx::Rect(360, 780);
+ screen_info.device_scale_factor = 3.0f;
++ const float layout_zoom = screen_info.device_scale_factor;
+
+- // 44x44 css image which is above the physical size threshold
+- // but with in the device ratio threshold
++ // 44x44 CSS icon (132x132 device pixels) is below the threshold and filtered
++ // after undoing the layout zoom (DSF).
+ EXPECT_TRUE(filter.ShouldApplyFilterToImage(
+ ImageClassifierHelper::GetImageTypeForTesting(
+- screen_info, gfx::RectF(132, 132), gfx::RectF(132, 132))));
++ gfx::RectF(132, 132), gfx::RectF(132, 132), layout_zoom)));
+
+- // 60x60 css image
++ // 70x70 CSS image (210x210 device pixels) is above the threshold and not
++ // filtered.
+ EXPECT_FALSE(filter.ShouldApplyFilterToImage(
+ ImageClassifierHelper::GetImageTypeForTesting(
+- screen_info, gfx::RectF(180, 180), gfx::RectF(180, 180))));
++ gfx::RectF(210, 210), gfx::RectF(210, 210), layout_zoom)));
+ }
+
+ TEST_F(PaintAutoDarkModeTest, ShouldApplyFilterToImageIrrespectiveOfPageZoom) {
diff --git a/chromium.conf b/chromium.conf
index f77975e..46e002d 100644
--- a/chromium.conf
+++ b/chromium.conf
@@ -60,7 +60,7 @@ fi
# Web Dark mode
if [ "$WEB_AUTO_DARKMODE_WEBCONTENT" == "on" ] ; then
- darktype="WebContentsForceDark,AutoDarkModeSkipImages"
+ darktype="WebContentsForceDark"
if [ -z "$ENABLE_FEATURES" ] ; then
ENABLE_FEATURES+="$darktype"
else
diff --git a/chromium.spec b/chromium.spec
index 87ac569..fa3182a 100644
--- a/chromium.spec
+++ b/chromium.spec
@@ -271,7 +271,7 @@
%endif
Name: chromium
-Version: 150.0.7871.114
+Version: 150.0.7871.124
Release: 1%{?dist}
Summary: A WebKit (Blink) powered web browser that Google doesn't want you to use
Url: http://www.chromium.org/Home
@@ -527,6 +527,9 @@ Patch601: chromium-150-Omit-ar-from-inputs-when-resolved-via-PATH.patch
Patch602: chromium-150-Fix-get_path_info-on-empty-ar-in-unbundle-toolchain.patch
# Darkmode
Patch603: chromium-150-Add-AutoDarkModeSkipImages-flag-to-bypass-image-dark-mode.patch
+Patch604: chromium-150-Make-dark-mode-apply-filter-to-images-irrespective-of-layout-zoom.patch
+Patch605: chromium-150-Use-64px-css-pixels-absolute-threshold-for-dark-image-classification.patch
+Patch606: chromium-150-Add-size-threshold-for-classifying-SVG-documents-for-auto-dark-mode.patch
# Use chromium-latest.py to generate clean tarball from released build tarballs, found here:
# http://build.chromium.org/buildbot/official/
@@ -1248,6 +1251,9 @@ Qt6 UI for chromium.
%patch -P602 -p1 -b .Fix-get_path_info-on-empty-ar-in-unbundle-toolchain
# Darkmode
%patch -P603 -p1 -b .Add-AutoDarkModeSkipImages-flag-to-bypass-image-dark-mode
+%patch -P604 -p1 -b .Make-dark-mode-apply-filter-to-images-irrespective-of-layout-zoom
+%patch -P605 -p1 -b .Use-64px-css-pixels-absolute-threshold-for-dark-image-classification
+%patch -P606 -p1 -b .Add-size-threshold-for-classifying-SVG-documents-for-auto-dark-mode
# Change shebang in all relevant files in this directory and all subdirectories
# See `man find` for how the `-exec command {} +` syntax works
@@ -1922,6 +1928,25 @@ fi
%endif
%changelog
+* Wed Jul 15 2026 Than Ngo <than@redhat.com> - 150.0.7871.124-1
+- Update to 150.0.7871.124
+ * CVE-2026-15764: Use after free in Ozone
+ * CVE-2026-15765: Use after free in Ozone
+ * CVE-2026-15766: Uninitialized Use in Skia
+ * CVE-2026-15767: Heap buffer overflow in libyuv
+ * CVE-2026-15768: Insufficient policy enforcement in HTML-in-Canvas
+ * CVE-2026-15769: Insufficient validation of untrusted input in Linux Toolkit Theming
+ * CVE-2026-15770: Uninitialized Use in V8
+ * CVE-2026-15771: Insufficient validation of untrusted input in Media
+ * CVE-2026-15772: Use after free in GPU
+ * CVE-2026-15773: Use after free in Core
+ * CVE-2026-15774: Use after free in Skia
+ * CVE-2026-15775: Insufficient policy enforcement in V8
+ * CVE-2026-15776: Type Confusion in V8
+ * CVE-2026-15777: Use after free in UI
+ * CVE-2026-15778: Insufficient validation of untrusted input in Navigation
+- Backport patches to improve auto darkmode
+
* Thu Jul 09 2026 Than Ngo <than@redhat.com> - 150.0.7871.114-1
- Update to 150.0.7871.114
* CVE-2026-15112: Use after free in Ozone
diff --git a/sources b/sources
index 57a651f..6a96ef4 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
SHA512 (node-v22.22.0-stripped.tar.gz) = f32a8a73063b3c78cbacf941e11dd529ebcf2618b3ba661966312e49ee9870c43a3acf256e8d331a4b0b621b16a501810c02a3ad763c75884cc250addca8e106
-SHA512 (chromium-150.0.7871.114-clean.tar.xz) = 6959284a198f4690e79c047d36209f0809a0a1ecea3eb0fa0d9fb8c54b3bd7756e5563de3d011c298c45c3619ddf36d4e141f81ceb7f6ff1a084d2afe83c5bb1
+SHA512 (chromium-150.0.7871.124-clean.tar.xz) = f7d0c5297f64bc13098f6f79105050bf38bb84c764143f5d3c425ce73234189cfe3c201b2b933cd1b7423ea8c16ccd7c0b4c32978f03d8fe261326453d77de5d
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2026-07-15 12:58 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-07-15 12:58 [rpms/chromium] f44: - Update to 150.0.7871.124 Than Ngo
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox