Upgrade from Chromium 137 to Chromium 138 #28944

emerick · 2025-05-05T18:40:32Z

Resolves brave/brave-browser#45859

Submitter Checklist:

I confirm that no security/privacy review is needed and no other type of reviews are needed, or that I have requested them
There is a ticket for my issue
Used Github auto-closing keywords in the PR description above
Wrote a good PR/commit description
Squashed any review feedback or "fixup" commits before merge, so that history is a record of what happened in the repo, not your PR
Added appropriate labels (QA/Yes or QA/No; release-notes/include or release-notes/exclude; OS/...) to the associated issue
Checked the PR locally:
- npm run test -- brave_browser_tests, npm run test -- brave_unit_tests wiki
- npm run presubmit wiki, npm run gn_check, npm run tslint
Ran git rebase master (if needed)

Reviewer Checklist:

A security review is not needed, or a link to one is included in the PR description
New files have MPL-2.0 license header
Adequate test coverage exists to prevent regressions
Major classes, functions and non-trivial code blocks are well-commented
Changes in component dependencies are properly reflected in gn
Code follows the style guide
Test plan is specified in PR before merging

After-merge Checklist:

The associated issue milestone is set to the smallest version that the
changes has landed on
All relevant documentation has been updated, for instance:

Test Plan:

brave-builds · 2025-05-05T23:24:58Z

A Storybook has been deployed to preview UI for the latest push

brave-builds · 2025-05-07T21:57:56Z

Warning

You have got a presubmit warning. Please address it if possible.

-------------------------
[Warning] chromium_src:
  Ignoring symbol BRAVE_ENUM_ITEMS_FOR_SWITCH:
  Symbol is used internally in chromium_src/components/permissions/permission_request.cc
  Symbol is NOT found in /home/ubuntu/workspace/ore-build-pr-noplatform_PR-28944/src/components/permissions/permission_request.cc.

brave-builds · 2025-05-07T21:57:56Z

Warning

You have got a presubmit warning. Please address it if possible.

-------------------------
[Warning] chromium_src:
  Ignoring symbol BRAVE_ENUM_ITEMS_FOR_SWITCH:
  Symbol is used internally in chromium_src/components/permissions/permission_request.cc
  Symbol is NOT found in /home/ubuntu/workspace/ore-build-pr-noplatform_PR-28944/src/components/permissions/permission_request.cc.

brave-builds · 2025-05-07T21:57:57Z

Warning

You have got a presubmit warning. Please address it if possible.

-------------------------
[Warning] chromium_src:
  Ignoring symbol BRAVE_ENUM_ITEMS_FOR_SWITCH_DESKTOP:
  Symbol is used internally in chromium_src/components/permissions/permission_request.cc
  Symbol is NOT found in /home/ubuntu/workspace/ore-build-pr-noplatform_PR-28944/src/components/permissions/permission_request.cc.

brave-builds · 2025-05-07T21:57:58Z

Warning

You have got a presubmit warning. Please address it if possible.

-------------------------
[Warning] chromium_src:
  Ignoring symbol BRAVE_ENUM_ITEMS_FOR_SWITCH_ANDROID:
  Symbol is used internally in chromium_src/components/permissions/permission_request.cc
  Symbol is NOT found in /home/ubuntu/workspace/ore-build-pr-noplatform_PR-28944/src/components/permissions/permission_request.cc.

github-actions · 2025-05-09T00:21:03Z

browser/widevine/widevine_permission_request.cc

+              std::make_unique<permissions::ContentSettingPermissionResolver>(
+                  permissions::RequestType::kWidevine),
+              false,
+              web_contents->GetVisibleURL()),


_{reported by reviewdog 🐶}
[semgrep] GetVisibleURL usages should be vet by the security-team. Most of the time you want the last committed entry/url

Source: https://github.com/brave/security-action/blob/main/assets/semgrep_rules/client/get-visible-entry.yaml

Cc @thypon @diracdeltas @bridiver

github-actions · 2025-05-09T00:27:17Z

browser/widevine/widevine_permission_request.cc

+              std::make_unique<permissions::ContentSettingPermissionResolver>(
+                  permissions::RequestType::kWidevine),
+              false,
+              web_contents->GetVisibleURL()),


_{reported by reviewdog 🐶}
[semgrep] GetVisibleURL usages should be vet by the security-team. Most of the time you want the last committed entry/url

Source: https://github.com/brave/security-action/blob/main/assets/semgrep_rules/client/get-visible-entry.yaml

Cc @thypon @diracdeltas @bridiver

github-actions · 2025-05-09T08:22:11Z

android/java/org/chromium/chrome/browser/crypto_wallet/util/Utils.java

            return ProfileManager.getLastUsedRegularProfile();
+        } else {
+            return assertNonNull(
+                    ProfileManager.getLastUsedRegularProfile().getPrimaryOtrProfile(true));


_{reported by reviewdog 🐶}
[semgrep] Static methods to access the profile will become a problem when android allows multiple profiles. Also these methods can be dangerous when we need to distinguish between the regular and incognito profile (services factories, etc...)

Source: https://github.com/brave/security-action/blob/main/assets/semgrep_rules/client/android-profile-static.yaml

Cc @bridiver

This is part of a broader modularisation of the browser, and it should only affect inclusion paths, namespacing, and gn deps. Chromium changes: https://chromium.googlesource.com/chromium/src/+/88975c35e41b18a6a94e5c1093001bb7b9cbbf42 commit 88975c35e41b18a6a94e5c1093001bb7b9cbbf42 Author: Alexis Hetu <[email protected]> Date: Mon May 26 05:43:21 2025 -0700 Move ImportedBookmarkEntry to components/ This CL moves the 2 following files: - imported_bookmark_entry.h - imported_bookmark_entry.cc from "chrome/common/importer/" to "components/user_data_importer/common/". The CL itself is noop, it is only adjusting the code for the file location and namespace changes. Bug: 407587751 Change-Id: I6fa486ff92cdd2d36a3aeb879111d90c518b0974 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6578818 Commit-Queue: Colin Blundell <[email protected]> Reviewed-by: Ken Buchanan <[email protected]> Reviewed-by: Colin Blundell <[email protected]> Auto-Submit: Alexis Hétu <[email protected]> Cr-Commit-Position: refs/heads/main@{#1465477}

Chromium change: https://source.chromium.org/chromium/chromium/src/+/e463135800447a2dbe772ba070e03cef518bee58 commit e463135800447a2dbe772ba070e03cef518bee58 Author: Sylvain Defresne <[email protected]> Date: Thu May 15 00:59:16 2025 -0700 [ios] Use ScopedProfileKeepAliveIOS to manage ProfileIOS lifetime Instead of explicitly calling `UnloadProfile(...)` to unload a profile on `ProfileManagerIOS`, use `ScopedProfileKeepAliveIOS` to manage the lifetime of the objects. This removes the code to manually unload the profiles as it is difficult to have both work together and the manual version can always be emulated by using `ScopedProfileKeepAliveIOS`.

The use of warnings in B🚀 is reserved for things that are truly atypical. With broken patches during 3way merge, a warning is being always issued becuase the main reason for broken patches was not accounted for when checking for unknown reasons for broken patches.

…th m

…dBuilderFeedCard.java

@simonhong

This function was removed upstream, so @simonhong reworked our override to account for this. Chromium changes: https://chromium.googlesource.com/chromium/src/+/1b2ba827b56fbf2b0ae7105e96e320b6421915a0 commit 1b2ba827b56fbf2b0ae7105e96e320b6421915a0 Author: Steven Luong <[email protected]> Date: Thu May 1 14:45:59 2025 -0700 [SxS] Loosen coupling between split tab menu and the active tab Currently split tab icons are determined based on the assumption the active tab is in a split. This CL determines which icon to show based on which tab in a split was last active instead of which one is currently active. There are also multiple instances of retrieving the active tab from the tab strip model to get the split id. This CL puts this logic into a single function to remove code duplication and makes it easier to add code to support cases when the menu should be shown but the active tab is not in a split (ex. opening tab context menu on an inactive split tab). Bug: 403350993 Change-Id: I9b212c5a51f1f6099a1a08c203ca4247545e829f Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6498652 Commit-Queue: Steven Luong <[email protected]> Reviewed-by: Alison Gale <[email protected]> Reviewed-by: Eshwar Stalin <[email protected]> Cr-Commit-Position: refs/heads/main@{#1454685}

It was a name overlapping with the one from `obj/third_party/androidx/androidx_credentials_credentials_java/res/drawable/ic_password.xml` Chromium change probably: https://source.chromium.org/chromium/chromium/src/+/dc70a40afac9726a01aa7c5330e0c51c2dc58a4b [DC] Move the DigitalCredentialsCreationDelegateImpl to the public code The androidx library has been released to the public and hence no need to keep it in the internal code. This CL is introducing minor behavioral changes limited to Null checks. The diff between the version in the internal code and this one is in http://go/webdiff#key=iVg4KJsYe0Gu Follow-up CLs will remove the internal pieces. Bug: 415967212 Change-Id: Ief2df4b1654d9d2ea54506d9c846ea02dbbe0597 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6523383

This fixes menu footer buttons. Chromium change: https://source.chromium.org/chromium/chromium/src/+/fa431a3660de796f7aa18130fd8a6da39f1cc1d7 [Icon Button] Migrate app menu icon buttons Migrated the app menu top row icons from ChromeImageButtons to Material Buttons. The highlight (ripple) is now a perfect circle instead of rectangle. Bug: 405189559 Change-Id: I0376bf0ecf7f5b734dad2d7e8c69200834c54248 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6477118

The `update-counter-text` WebUI listener was renamed to `browsing-data-counter-text-update`. We hook into this code to provide the "counter" sublabels for the "Clear Browsing Data on Exit" dialog. Chromium change: https://source.chromium.org/chromium/chromium/src/+/5d91cbf0c11a3757cef76db44c2d29b5ac4a124e commit 5d91cbf0c11a3757cef76db44c2d29b5ac4a124e Author: Zaina Al-Mashni <[email protected]> Date: Fri May 9 14:41:27 2025 -0700 [Settings] Hook the counters with the CBD dialog checkboxes This change uses the ClearBrowsingDataBrowserProxy to trigger the browsing data counters on time period changes and updates each checkbox's subLabel with the result. It also updates the registered advanced and basic counters in the ClearBrowsingDataHandler based on the kDbdRevampDesktop flag status. Screenshot: https://screenshot.googleplex.com/5P8p9uz2LeQUgje Bug: 397187800 Change-Id: If0db18f856a55477fb9563d1dbc3924f750af9d9 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6513117 Reviewed-by: Martin Šrámek <[email protected]> Commit-Queue: Zaina Al-Mashni <[email protected]> Reviewed-by: Rainhard Findling <[email protected]> Cr-Commit-Position: refs/heads/main@{#1458360}

…://settings Now that `EnableCertManagementUIV2` is launched we no longer need to maintain the old override to delete the `chromeCertificates` link. Chromium change: https://source.chromium.org/chromium/chromium/src/+/ed3377471e1c04dcc5cb7047d611f645b831d612 commit ed3377471e1c04dcc5cb7047d611f645b831d612 Author: dpapad <[email protected]> Date: Wed May 21 17:49:52 2025 -0700 Settings: Cleanup dead code after launch of EnableCertManagementUIV2. Bug: 390333881 Change-Id: I375a5617e91ea69652722efa887b0c98770d0ec3 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6568874 Commit-Queue: Matt Mueller <[email protected]> Commit-Queue: Demetrios Papadopoulos <[email protected]> Auto-Submit: Demetrios Papadopoulos <[email protected]> Reviewed-by: Matt Mueller <[email protected]> Cr-Commit-Position: refs/heads/main@{#1463820}

…utton in brave://settings/cookies We no longer show any of the radio buttons on the brave://settings/cookies page, so we can remove this code which was hiding one of the radio button options. Also, hide the "Advanced" header as we currently hide all of the advanced settings so that section is empty. This change happened prior to cr138, but we're cleaning it up here as it was noticed during testing. Chromium change: https://source.chromium.org/chromium/chromium/src/+/d3779b3905edf74c86c1714731574f63c3a2d486 commit d3779b3905edf74c86c1714731574f63c3a2d486 Author: Maggie Jennings <[email protected]> Date: Thu Feb 20 12:42:02 2025 -0800 [CCM] Finalized strings for settings pt.1 - Settings go/ccm-unification-prd Desktop screenshot w/ new content: https://screenshot.googleplex.com/4V4U8LU5th6Mffj Clank screenshot: https://screenshot.googleplex.com/4ACqpQ5H6MWYZ9A Wordflow: https://wordflow.corp.google.com/project/180286/version/115#WORDFLOW_SCREEN_ID=341669 Bug: b:370008370 Change-Id: Idc9854a5d1fc1d38700de380cc7ffb5a46dda942 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6269999 Auto-Submit: Maggie Jennings <[email protected]> Reviewed-by: Fiona Macintosh <[email protected]> Reviewed-by: Michelle Abreo <[email protected]> Commit-Queue: Maggie Jennings <[email protected]> Cr-Commit-Position: refs/heads/main@{#1422735}

Chromium updated some TabStyle method. https://chromium-review.googlesource.com/c/chromium/src/+/6518822

Use SharedPreferencesManager instead to access app-wide SharedPreferences from //src/chrome

Depending on a feature setting, the tab search button is now rehomed to the toolbar so support that. Chromium change: https://source.chromium.org/chromium/chromium/src/+/9cd72e1a9429531600a4ae310fdb6863cb39fe37 commit 9cd72e1a9429531600a4ae310fdb6863cb39fe37 Author: Eshwar Stalin <[email protected]> Date: Thu May 15 08:55:41 2025 -0700 Enable Tab Search Rehoming on ToT Change-Id: Id8a92bbcee8eac7cc328aad488940ff24824b9e9 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6550038 Reviewed-by: Alison Gale <[email protected]> Commit-Queue: Alison Gale <[email protected]> Cr-Commit-Position: refs/heads/main@{#1460759}

This patching is not needed in 138 anymore, as it has landed in upstream. Chromium changes: https://chromium.googlesource.com/chromium/src/+/4b7e1adf413943fc48c8ce865511079fed271cf8 commit 4b7e1adf413943fc48c8ce865511079fed271cf8 Author: Maksim Moskvitin <[email protected]> Date: Fri May 23 06:17:53 2025 -0700 Revert "Sync ProcessorEntity: Upgrade remaining DCHECKs" This reverts commit 6752bab9ae006f82bdd1bf73a475ffffd2fa2d00. Reason for revert: Still crashing on M137 Bug: 408182457, 419310731 Original change's description: > Sync ProcessorEntity: Upgrade remaining DCHECKs > > This CL upgrades most of the remaining DCHECKs in ProcessorEntity to > proper CHECKs, mostly with base::NotFatalUntil::M141. > A few that are obviously-valid don't have NotFatalUntil, and one that > is questionable is just removed. > > Also includes some minor other cleanups, like inlining a one-line > helper method with a single call site. > > Bug: 408182457 > Change-Id: I7e385de3b6d2953ff9cac62f40e3ebb5651219b8 > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6461075 > Reviewed-by: Maksim Moskvitin <[email protected]> > Commit-Queue: Marc Treib <[email protected]> > Cr-Commit-Position: refs/heads/main@{#1448230} Bug: 408182457 Change-Id: Ib5d538c4ebd2aabb9cb0cd27416fba02187945cc Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6578201 Auto-Submit: Maksim Moskvitin <[email protected]> Commit-Queue: Mikel Astiz <[email protected]> Commit-Queue: Maksim Moskvitin <[email protected]> Reviewed-by: Mikel Astiz <[email protected]> Cr-Commit-Position: refs/heads/main@{#1464694}

mkarolin · 2025-06-05T13:51:47Z

browser/component_updater/brave_component_updater_configurator.cc

+  base::FilePath path = base::PathService::CheckedGet(chrome::DIR_USER_DATA);
+  crx_cache_ = base::MakeRefCounted<update_client::CrxCache>(
+      path.AppendASCII("component_crx_cache"));


Upstream seems to not want to crash here and operates without cache, do we not want to do the same?

base::FilePath path; bool result = base::PathService::Get(chrome::DIR_USER_DATA, &path); crx_cache_ = base::MakeRefCounted<update_client::CrxCache>( result ? std::optional<base::FilePath>( path.AppendASCII("component_crx_cache")) : std::nullopt);

Good catch, fixed here 30e15de.

brave-builds · 2025-06-05T14:34:06Z

Warning

You have got a presubmit warning. Please address it if possible.

A banned function was used.
    browser/component_updater/brave_component_updater_configurator.cc:67:
      Prefer using base::PathService::CheckedGet() instead

kylehickinson

iOS++

mkarolin · 2025-06-05T15:03:37Z

chromium_src/components/ntp_tiles/most_visited_sites.cc

+// Replace MaybeStartFetch with an innocuous call, as we don't want to download
+// the popular sites
+#define MaybeStartFetch(...) sections()
+#define BRAVE_MOST_VISITED_SITES_CREATE_POPULAR_SITES_SECTIONS return sections;


Not 100% sure, but would it be possible instead of patching to override popular_sites_(...) popular_sites_(nullptr)?

Yep, that seems to work, thanks for pointing out that trick again! 37c8a83

goodov · 2025-06-05T14:43:30Z

components/brave_user_agent/browser/brave_user_agent_component_installer.cc

-  crypto::SHA256HashString(decoded_public_key, component_hash_.data(),
-                           component_hash_.size());
+  auto decoded_public_key =
+      base::Base64Decode(kBraveUserAgentExceptionsComponentBase64PublicKey);


this should be an already calculated sha256 hash at compile-time stored in uint8_t[].

Good point, fixed here 4042030.

goodov · 2025-06-05T15:04:34Z

extensions/BUILD.gn

@@ -8,8 +8,7 @@ import("//extensions/buildflags/buildflags.gni")
 if (is_android || is_ios) {
  source_set("common") {
    sources = [
-      "//extensions/common/constants.cc",
-
+      # "//extensions/common/constants.cc",


shouldn't we add //build:chromeos_buildflags to deps instead?

cc: @AlexeyBarabash

@goodov
yes, we should, fixed at f118fe2

mkarolin

strings++

emerick assigned emerick, AlexeyBarabash and cdesouza-chromium May 5, 2025

emerick added CI/run-network-audit Run network-audit CI/run-audit-deps Check for known npm/cargo vulnerabilities (audit_deps) CI/run-upstream-tests Run upstream unit and browser tests on Linux and Windows (otherwise only on Linux) labels May 5, 2025

github-actions bot added CI/storybook-url Deploy storybook and provide a unique URL for each build feature/web3/wallet feature/web3/wallet/core needs-security-review labels May 5, 2025

github-actions bot assigned bridiver, kdenhartog and thypon May 5, 2025

emerick force-pushed the cr138 branch from 8907c99 to 9c1be3c Compare May 6, 2025 16:08

emerick force-pushed the cr138 branch 2 times, most recently from 3d24600 to 865369f Compare May 8, 2025 01:55

cdesouza-chromium force-pushed the cr138 branch from a5b8f3b to a31a099 Compare May 9, 2025 00:08

github-actions bot reviewed May 9, 2025

View reviewed changes

github-actions bot assigned diracdeltas May 9, 2025

github-actions bot reviewed May 9, 2025

View reviewed changes

cdesouza-chromium force-pushed the cr138 branch from bf2088f to a6939bf Compare May 9, 2025 12:12

emerick force-pushed the cr138 branch from a6939bf to 000f7cf Compare May 9, 2025 15:23

cdesouza-chromium force-pushed the cr138 branch 2 times, most recently from 732e509 to 067fbc8 Compare May 12, 2025 17:55

cdesouza-chromium and others added 19 commits June 5, 2025 14:09

[cr138][Android] Removed home button from top toolbar

d1b6176

Fixed presubmit warnings: Non-public, non-static field names start wi…

94b3b9f

…th m

Suppressed checkstyle SetTextColorAndSetTextSizeCheck warning for Car…

51a249a

…dBuilderFeedCard.java

Fixed presubmit checkstyle warnings: Static field names start with s

907bf27

Updated BraveTabStyle overridings

f034e98

Chromium updated some TabStyle method. https://chromium-review.googlesource.com/c/chromium/src/+/6518822

Fixed some UseSharedPreferencesManagerFromChromeCheck presubmit warnings

38ec92f

Use SharedPreferencesManager instead to access app-wide SharedPreferences from //src/chrome

Update patches from Chromium 137.0.7151.68 to Chromium 138.0.7204.15.

068b1a4

Updated strings for Chromium 138.0.7204.15.

cc07912

cdesouza-chromium force-pushed the cr138 branch from 56aa621 to 1414434 Compare June 5, 2025 13:09

mkarolin reviewed Jun 5, 2025

View reviewed changes

fixup! [cr138] Incorporate changes to CrxCache lifetime

30e15de

kylehickinson approved these changes Jun 5, 2025

View reviewed changes

mkarolin reviewed Jun 5, 2025

View reviewed changes

goodov approved these changes Jun 5, 2025

View reviewed changes

AlexeyBarabash and others added 3 commits June 5, 2025 19:03

fixup! Fixed gn check error

f118fe2

fixup! [cr138] Unsafe SHA256HashString variant deleted

4042030

fixup! [cr138] kUsePopularSitesSuggestions deleted upstream

37c8a83

mkarolin approved these changes Jun 5, 2025

View reviewed changes

Upgrade from Chromium 137 to Chromium 138 #28944

Are you sure you want to change the base?

Upgrade from Chromium 137 to Chromium 138 #28944

Conversation

emerick commented May 5, 2025 • edited by mkarolin Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Submitter Checklist:

Reviewer Checklist:

After-merge Checklist:

Test Plan:

Uh oh!

brave-builds commented May 5, 2025

Uh oh!

brave-builds commented May 7, 2025

Uh oh!

brave-builds commented May 7, 2025

Uh oh!

brave-builds commented May 7, 2025

Uh oh!

brave-builds commented May 7, 2025

Uh oh!

github-actions bot May 9, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot May 9, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot May 9, 2025

Choose a reason for hiding this comment

Uh oh!

mkarolin Jun 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

brave-builds commented Jun 5, 2025

Uh oh!

kylehickinson left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mkarolin left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

emerick commented May 5, 2025 •

edited by mkarolin

Loading

mkarolin Jun 5, 2025 •

edited

Loading