Skip to content

chore: cherry-pick 64 changes from angle, chromium, pdfium, skia and v8 - #55147

Merged
VerteDinde merged 3 commits into
43-x-yfrom
security-backport/43-x-y/39495350711
Oct 21, 2026
Merged

chore: cherry-pick 64 changes from angle, chromium, pdfium, skia and v8#55147
VerteDinde merged 3 commits into
43-x-yfrom
security-backport/43-x-y/39495350711

Conversation

@electron-security-backports

@electron-security-backports electron-security-backports Bot commented Oct 20, 2026

Copy link
Copy Markdown

Description of Change

Warning

Changes outside patches/ — besides the cherry-picks below, this PR edits Electron source directly. These edits were written by the backport automation as ports of upstream fixes (they are not upstream cherry-picks), so review them line by line:

  • shell/browser/electron_browser_client.cc (modified) — fix: port upstream WebUI URL loader factory origin-lock change to ElectronBrowserClient's chrome:// subresource factory
  • shell/browser/file_system_access/file_system_access_permission_context.cc (modified) — fix: port upstream File System Access fix for third-party-context handle use to Electron's FSA permission context

Backports the following changes:

  • 0b43596f5117 from angle — D3D11: Expand 3D texture depth in MakeValidSize
  • 386bb0e11d39 from angle — MSL: Correctly identify uint >= 0 condition as an infinite loop
  • 3adcc064145b from angle — HLSL: Fix name collision due to lack of delimiter
  • 48a16bd63d2d from angle — D3D11: Fix InputLayoutCache key for disabled and multiview attributes
  • 5b683ed30122 from angle — Optimize robust init check during GenerateMipmap
  • 5cbd3b1344b5 from angle — GL/D3D11: Clamp multiview-adjusted attribute divisor
  • 67691470653a from angle — D3D11: Fix uniform and structured buffer partial update and zeroing
  • 8988bdf12f3b from angle — D3D11: Fix stale vertex and index buffer pointers
  • 906ad3fd3071 from angle — D3D11: Fix UNPACK_ROW_LENGTH handling in fast PBO unpack
  • 97941c8fa290 from angle — Vulkan: Don't ghost images if base level has changed
  • b5bab166e6a7 from angle — D3D11: Sync image from storage before CPU CopyTexSubImage
  • bea9f5ec4d25 from angle — Translator: Fix off-by-one error in variable-size check
  • d219c4f45f93 from angle — Always robust init all levels of immutable textures
  • dfeede58b618 from angle — Translator: Fold constant switch statements
  • e1d22eff1e8f from angle — D3D11: Do not sync incomplete texture images from storage
  • 01430d2a3d7c from chromium — [FSA] Block handle use in third-party contexts
  • 01c4bf3467db from chromium — Fix CHECK_EQ in CachedMetadataSender::Create for unbound writer
  • 80a340bf4db5 from chromium — [M150-LTS] Avoid flat tree traversal when unlocking a display lock
  • 14df19403b03 from chromium — Defer XMLDocumentParser::Finish() while inside ParseChunk
  • 2ddf8c2004f3 from chromium — [M152] Validate opaque origins on synchronous about:blank commits
  • 73dd2febfaa5 from chromium — [M150] Do not expose pseudo-elements through LargestContentfulPaint API
  • 519cf27a368e from chromium — [M150] Harden ElementSMILAnimations::Apply() against removals during iteration
  • 28e2d315f844 from chromium — [HiC] Invalidate filters when an element moves into canvas
  • 2ed13d0826b0 from chromium — [Net][CPRS] Improve lifetime management in CPRRequest
  • e193ceb7de13 from chromium — [M150-LTS] Prevent attaching WebRtcAudioRenderer to terminated audio device
  • 46d63b00ac54 from chromium — Fix SoftwareImageDecodeCache UAF
  • 2f0c9930c59b from chromium — [M150-LTS] c-v: Harden display locking + VT interactions
  • 3ab9f85874d9 from chromium — [M150-LTS] Remove redundant IsHidden() check in FrameCaret::PaintCaret()
  • 15cfaf3d3261 from chromium — [M150-LTS][canvas2d] Obtain PaintCanvas and state after style resolution in DrawTextInternal
  • 2d04a51fffd0 from chromium — [M150] [FSA] Validate paths in DeserializeHandle
  • 6bc3005112c9 from chromium — [net] Validate server certificate before generating auth token
  • 6cd7214ad1aa from chromium — [ServiceWorker] Defer clone completion callback in SimpleBufferManager
  • c0e830bdda6e from chromium — [M150-LTS] Prevent cross-frame selection on GestureLongPress
  • 73c78a52d2b7 from chromium — [HiC] Disallow SVG masks on SVG content in readback-allowed mode
  • 83ce9f18d704 from chromium — [a11y] Mark image dirty directly when removing image map
  • 8b38650ae0b4 from chromium — bluetooth: Fix UAF in BluetoothPairingBlueZ on synchronous cancel
  • 0e25d492d813 from chromium — [M150-LTS] Don't rebuild date-time edit fields when layout parameters are unchanged.
  • 928928c148a5 from chromium — Preserve CacheStorageSideDataWriter across response clones
  • 97aa60e7d182 from chromium — [Views] Prevent potential UAF in NativeWidgetAura::Show()
  • fa4d1be86a1c from chromium — [M150-LTS] Don't use a deleted source RenderFrameHost in WebContentsImpl::OpenURL
  • 86cca8f0478c from chromium — [M150-LTS] gpu: Restore GL context/surface after WrappedSkImageBacking MakeCurrent
  • 6c38d4ec50ea from chromium — [M150-LTS] Do not optimize RTC encoded stream transfer if context is destroyed
  • b35403786d67 from chromium — [a11y] Validate renderer-provided AXNodeIDs at browser entry points
  • b7664cfc49cc from chromium — gpu: Reject separate GL texture mode for WebGPU/Vulkan GL interop
  • cbbfea7e38d4 from chromium — [ServiceWorker] Defer completion callback in DataPipeConnector::Finish
  • cc183492c23b from chromium — media: Safely drain promises in CdmPromiseAdapter::Clear
  • 738f50bbfc2b from chromium — [M152] Enforce cross-origin access control in WebUIURLLoaderFactory
  • 7f1931770c35 from chromium — [M150-LTS] Sync separate GL texture content on write access in ExternalVkImageBacking
  • e2c5a77f477b from chromium — [FSA] Refactor read permission checks into 'CheckReadAccess()'
  • 8841f4cd2383 from chromium — [M152] Plumb CacheStorageSideDataWriter capability remote for code cache
  • 15248c94bc3d from chromium — [M150] [a11y] Copy title attribute value in AXNodeObject
  • ac3cf1684db0 from pdfium — CHECK on FFE teardown if embedder is inside a callback.
  • e764cc088a62 from pdfium — Guard against re-entrant destruction of the CJS_Runtime
  • 02b14267cb02 from skia — [ganesh] Imagination FBO workaround v2
  • 16ff4874adfe from v8 — [maglev] Do not cache the_hole in loaded_context_constants_
  • 17f229f3ea06 from v8 — [parser] Restore parse restriction when reparsing Function constructor top-level
  • 243b68bea40f from v8 — [ic] Check access check and array prototype chain in element handlers
  • 37a6d6f0213e from v8 — [maglev] Mark sloppy eval context extension slot as mutable
  • 49b69c460a6f from v8 — [maglev range analysis] Fix phi ranges in resumable loops
  • 9f911f052703 from v8 — [scopes] Mark saved class variable as MaybeAssigned
  • af7d1483a5da from v8 — [interpreter] Initialize private accessors early in BuildClassLiteral
  • bd5b925e0678 from v8 — [turbolev] Migrations can change maps
  • c0543d0cbd16 from v8 — [ast] Normalize one-byte content in AstValueFactory and StringTable
  • e1ac1f641ab1 from v8 — [M154][compiler][objects] Record CompilationKind and outer_language_mode in ScriptFlags

Checklist

Release Notes

Notes: Backported fixes from upstream ANGLE, Chromium, PDFium, Skia and V8.

@electron-security-backports electron-security-backports Bot added 43-x-y backport-check-skip Skip trop's backport validity checking security 🔒 semver/patch backwards-compatible bug fixes labels Oct 20, 2026
claude added 2 commits October 20, 2026 23:22
@claude
fixup: adapt ANGLE D3D picks to M150 Windows code
4effaad 
The Windows builds failed in two places that the Linux-only verify
could not catch:

* cherry-pick-0b43596f5117 changes d3d11::MakeValidSize to a 7-arg
  by-reference signature. Upstream had already removed the feature
  level 9_3 path in TextureStorage11::copySubresourceLevel, but this
  branch still has it, so its 5-arg call no longer compiled
  (TextureStorage11.cpp:744, "too few arguments to function call").
  Convert that call to the new signature, passing TextureType::_2D and
  scratch depth/levelOffset so only width/height are adjusted, exactly
  as before.

* cherry-pick-e1d22eff1e8f removes the "unused" TextureD3D::hasDirtyImages().
  Upstream had already deleted the D3D9 backend, but on M150
  Renderer9::setTexture still calls it (Renderer9.cpp:1128, x86 build).
  Drop that removal hunk; it is not part of the fix.

cherry-pick-b5bab166e6a7 is regenerated only for its TextureD3D.h index
and hunk offsets. Verified the full patches/angle series applies with
`git am --3way` on ANGLE c5bf49e78850 (DEPS for 150.0.7871.250).

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01S9dadvYp98UrTf4Cy1D5Jc
@claude
chore: fix clang-format in electron_browser_client.cc
7bba4a8 
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01S9dadvYp98UrTf4Cy1D5Jc
@claude
claude Bot marked this pull request as ready for review October 21, 2026 00:41
@claude
claude Bot requested a review from a team as a code owner October 21, 2026 00:41
@VerteDinde
VerteDinde enabled auto-merge (squash) October 21, 2026 01:37
@VerteDinde
VerteDinde merged commit 1c0ee21 into 43-x-y Oct 21, 2026
73 checks passed
@VerteDinde
VerteDinde deleted the security-backport/43-x-y/39495350711 branch October 21, 2026 01:38
@release-clerk

release-clerk Bot commented Oct 21, 2026

Copy link
Copy Markdown

Release Notes Persisted

Backported fixes from upstream ANGLE, Chromium, PDFium, Skia and V8.

shaanmajid added a commit to shaan-forks/clients that referenced this pull request Oct 22, 2026
@shaanmajid
[deps] Platform: Update electron to v43.8.3
daeecaf 
Electron 43.8.1 adds the eMudhra intermediate SPKI blocklist entries and applies the blocklist to Node TLS (electron/electron#55126, backported in #55130). 43.8.3 is the latest 43.x patch and also carries upstream Chromium security backports (electron/electron#55147).
shariqh added a commit to shariqh/agent-inbox that referenced this pull request Oct 24, 2026
@shariqh
Retarget Electron to 43.8.3, the newest 43.x release
2f61ff9 
Electron 43.8.3 keeps 43.8.1's fix for GHSA-jr5w-w6x2-84p9 (the compromised
eMudhra intermediate certificates) and adds electron/electron#55147: 64
cherry-picks from upstream ANGLE, Chromium, PDFium, Skia and V8, including
use-after-free fixes and "[net] Validate server certificate before
generating auth token". 43.8.2 changed only a test (electron/electron#55122).
43.8.3 still embeds Node 24.22.0 and stays on NODE_MODULE_VERSION 148.

Move every pin from 43.8.1 to 43.8.3:
- package.json devDependency and allowScripts entry, package-lock.json
  (regenerated with npm install --save-exact [email protected]);
- release/linux-inputs.json, release/macos-inputs.json and
  release/windows-inputs.json electron.version, and PINNED_ELECTRON_VERSION
  in scripts/windows-release-inputs.mjs;
- the linux-inputs.json SHA-256 pinned by the AppImage (x64/arm64) and DEB
  contracts and their tests;
- the tests that compare against the real pins, and the release docs.

All 75 entries of the electron package's checksums.json match the official
v43.8.3 SHASUMS256.txt. That is a bump-time cross-check: packager() gets
no download options, so the build checks each zip only against the
release's live SHASUMS256.txt (#363 will pin it to checksums.json).

Electron carried the #53393 patches only in 43.6.0 to 43.7.11. From 43.8.0,
43.8.3 included, the #135 fix comes from Node 24.22.0 itself. The abort
diagnosis in scripts/electron-sqlite-check.mjs now says so, and its test
checks the wording.

Co-authored-by: Copilot <[email protected]>
Copilot-Session: 9e7ec7a7-8690-49e5-9d55-492fedc3027a
@shariqh shariqh mentioned this pull request Oct 24, 2026
Merged
shariqh added a commit to shariqh/agent-inbox that referenced this pull request Oct 24, 2026
@shariqh
Update Electron to 43.8.3 for its security fixes (#360)
1324073 
Electron 43.8.1 contains the fix for GHSA-jr5w-w6x2-84p9, the
mitigation for compromised eMudhra intermediate certificates. It also
makes link-opened windows use the opener's session and webPreferences
(electron/electron#55049), and setCertificateVerifyProc is no longer
skipped for a request issued concurrently with the first request to a
host (electron/electron#55047). 43.8.3, the newest 43.x release, adds
electron/electron#55147: 64 upstream cherry-picks from ANGLE,
Chromium, PDFium, Skia and V8, including use-after-free fixes and
"[net] Validate server certificate before generating auth token". It
embeds the same Node.js 24.22.0, so the modules ABI stays 148.

Update every pin together so the release-input gates agree, as #191
did:
- the package.json devDependency and allowScripts entry, and
  package-lock.json (npm install --save-exact [email protected]);
- electron.version in release/linux-inputs.json,
  release/macos-inputs.json and release/windows-inputs.json, and
  PINNED_ELECTRON_VERSION in scripts/windows-release-inputs.mjs;
- the linux-inputs.json SHA-256 pinned by the AppImage (x64, arm64)
  and DEB contracts, and their tests;
- the tests that compare with the real pins, and the release docs.
Test placeholders that never compare with the real pin, and
historical records, keep 43.8.0.

How Electron's downloads are checked: the release build does not use
the npm package's checksums.json. The three thin-app builders call
packager() without a download or electronZipDir option, so
@electron/get checks each zip only against the release's live
SHASUMS256.txt. At bump time all 75 checksums.json entries matched
the official v43.8.3 SHASUMS256.txt, and the five packaged zips also
match GitHub's asset digests. Pinning the build to checksums.json is
tracked in #363.

The #135 fix now comes from Node.js itself: Electron dropped its
electron/electron#53393 backport when 43.8.0 moved to Node.js 24.22.0
(electron/electron#55003), because 24.22.0 carries the cleanup-hook
registry fix. 43.7.11 is the last release with the patches.
docs/macos-release.md and the electron-sqlite-check abort message now
say so. nodejs/node#65446 is still open, and the portable runtime
keeps its 24.18.1 hold (#362).

Every packaging job's allocation-driven SQLite check passed under
Electron 43.8.3 with Node v24.22.0 (ABI 148): the Linux folders,
AppImage and DEB on x64 and arm64, both macOS thin apps (native Intel
included), and the Windows native folder and MSI folders. The
Electron executable still needs glibc 2.25 on Linux x64 and arm64.

Supersedes #355.

Co-authored-by: Copilot <[email protected]>
Copilot-Session: 9e7ec7a7-8690-49e5-9d55-492fedc3027a
@badcuban badcuban mentioned this pull request Oct 26, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@VerteDinde VerteDinde VerteDinde approved these changes
@dsanders11 dsanders11 dsanders11 approved these changes

Assignees

No one assigned

Labels

43-x-y backport-check-skip Skip trop's backport validity checking security 🔒 semver/patch backwards-compatible bug fixes

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@VerteDinde @dsanders11 @claude