120.0.6099.63: new chromium version

[github-actions]

indicate 10 bugs, but the other 5 no-shows!

• [$10000][1497984] High CVE-2023-6508: Use after free in Media Stream

[BreakoutBox] Check validity of context before enqueuing frames.
https://chromium-review.googlesource.com/c/chromium/src/+/4997039
[BreakoutBox] Use KeepAlive to prevent lifetime race with audio delivery
https://chromium-review.googlesource.com/c/chromium/src/+/5009864

• [$1000][1494565] High CVE-2023-6509: Use after free in Side Panel Search

Fix region search controller using dangling browser pointer.
https://chromium-review.googlesource.com/c/chromium/src/+/4973698

so, we need to use chrome::FindBrowserWithTab(web contents)

• [$1000][1480152] Medium CVE-2023-6510: Use after free in Media Capture.
• [$2000][1478613] Low CVE-2023-6511: Inappropriate implementation in Autofill.

not found

• [$1000][1457702] Low CVE-2023-6512: Inappropriate implementation in Web Browser UI

content: pass initiator origin through for context menu
https://chromium-review.googlesource.com/c/chromium/src/+/4763411

low for security but high for privacy!

[uazo]

commit: 8930409
builder: https://github.com/uazo/cromite/actions/runs/7114962862
release: https://github.com/uazo/cromite/releases/tag/v120.0.6099.63-8930409029b2bd18512f65011d5a0e2ffde08225
docker image: 120.0.6099.63-8930409029b2bd18512f65011d5a0e2ffde08225

changes:

• bump to 120.0.6099.63
• Add a new flag for kPartialLowEndModeOnMidRangeDevices #586 default disabled
• Improve the browser sandbox by using the new flags on android 7998846
• Disable kPrivacySandboxFirstPartySetsUI this flag allows sites linked to the First Party Set feature to be displayed, the FPS is disabled by default in cromite. The FPS is a privacy sandbox feature that, against a declared list in https://github.com/GoogleChrome/related-website-sets, makes the browser consider different sites as the same site, allowing an interchange of information between different domains. Since there is no way for website to ask the user for consent to share data, the feature is removed. the list, in chromium, is downloaded via the component update, another feature disabled in cromite.
• Disable SpeculationRulesPrefetchProxy disable unsupported anonymous-client-ip-when-cross-origin mode without infrastructure
• decoupled activation flag with adblock site setting first step for disabling the legacy adblock by default. the flag in ui now activates or disables the auto-update list and is no longer linked to the adblock site setting.
• disable feature engagement the feature engagement registers the use of chromium functionality in the device. in cromite it has been deactivated, as there is no need for such information.
• removed support for heuristic enabling of third-party cookies it has been made possible, in chromium, to temporarily re-enable the use of third-party cookies based on whether the site behaves using certain patterns. in cromite that behaviour is disabled.
• [Windows] Cromite hangs when setting "Clear Data on Exit"  #572 fix hang in settings ui
• Shown by default the list of variations with the text format in chrome://version in chrome://version the entry 'Active Variations' was an intelligible code, it has now been modified to show what it is.

[NF075]

Request to Update of latest ref Chrome version
120.0.6099.71.
Released few hours ago.
For security fix. Windows, Linux , Mac.
Don't find or Google don't publish what security fix or bug.
If you agree, think is needed. Possible, and, you have time.
Thx...

[Miizuo]

This is great but download speed are slow how do I fix it? Maximum I can get around 100-700kbps it suck ...I try on other browser I can get 1-12mbps

[basilgello]

@uazo I built Cromite for minsdk 24 - one change required. Mind incorporating the change into next builds?

sed -i '/default_min_sdk = /s/26/24/' $WORKSPACE/chromium/src/build/config/android/config.gni

[aliaziz7]

Please add system WebView

[basilgello]

I built webview as well. Took 4 new patches to make it work.

[ramon501]

i cannot install this latest version on my android 7.1.1

[basilgello]

This version requires 8.0+. Patch is simple, but @uazo mentioned he did not want to keep dupporting 7.x. Hope he re-visits the decision.

[uazo]

Patch is simple

Patch is simple, now. As soon as they remove the specific code for a7, it will no longer be.

[uazo]

Took 4 new patches to make it work.

but how did you test it?

[basilgello]

1. If you are on LineageOS, its stock browser Jelly uses WebView. If you are not, you can install jQuarks viewer (LineageOS Jelly browser +adsBlocker +tiles +offline_.mht +...)
   https://f-droid.org/packages/com.oF2pks.jquarks/

2. Visit https://browserleaks.com/ip

3. Check user-agent to be 120.0

[basilgello]

Patch is simple, now

I already said and can repeat again: I will be maintaining this patchset till my tablet breaks. I write this in public so other people can join our efforts.

[uazo]

If you are on LineageOS, its stock browser Jelly uses WebView.

I like it, I will try it. could you show me the modifications to be made?

I already said and can repeat again: I will be maintaining this patchset till my tablet breaks

Sorry, I did not understand that.
you are welcome!

sed -i '/default_min_sdk = /s/26/24/' $WORKSPACE/chromium/src/build/config/android/config.gni

^^^ but this is not good.

I can help you set up the necessary infrastructure to generate patches, if you deem it necessary.

[basilgello]

The webview patches:

0001-android_webview-Fix-build-after-field-trials-patch.patch
0002-android-webview-Fix-autofil-and-aw_content_client.patch
0003-android_webview-Drop-AWVariationSeedFetcher-service.patch
0004-Fix-WebView-build.patch

And the ROM has to have the patch applied like here: syphyr/android_vendor_cm-1@2d9535a

The signature in this patch belongs to my key, but I will show you how to generate signature for your key.

Also I will adapt https://github.com/arovlad/bromite-webview-overlay so end-users of custom ROMs can install the flashable zip with TWRP and get working Cromite Webview. Either syphyr's patch or flashable zip will be enough to make Cromite WebView working.

Build vommand:

ninja -C out/arm64 system_webview_apk

[basilgello]

I can help you set up the necessary infrastructure to generate patches, if you deem it necessary.

Perfect. Let me format that one patch properly.

[uazo]

thank you, all very interesting.
I'll finish something I'm doing and then I'll look at them. I'll let you know.

[basilgello]

Sorry, I did not understand that.

My tablet is 8 year old but there are many other people with similar devices. Even DivestOS still builds 14.1 branch using the patches that me, @syphyr, @MSe1969 and Tad are porting. While I have the tablet in my hands, I will do my best to keep it updated.

[MSe1969]

@basilgello is right, we work together and I'll join the efforts to make further back-ports, if necessary.

[syphyr]

I am also ready to help support nougat maintenance. Currently, 120.0.6099.63 (browser and webview) is running perfectly on nougat with no modifications to the source code, except for changing minimum supported api number. Official nougat support did not need to be dropped yet.

[uazo]

@basilgello I am trying to compile. but 0004-Fix-WebView-build.patch but this patch is not very correct, because it changes the behaviour of all generate_jni() targets and I do not think this is the best solution.

diff --git a/android_webview/lib/BUILD.gn b/android_webview/lib/BUILD.gn
index b7c2d29503..8399a62339 100644
--- a/android_webview/lib/BUILD.gn
+++ b/android_webview/lib/BUILD.gn
@@ -50,6 +50,7 @@ source_set("lib") {
     "//tools/v8_context_snapshot:buildflags",
     "//ui/base",
     "//ui/events:gesture_detection",
+    "//chrome/browser/preferences:jni_headers",
   ]

I have currently corrected it this way, but it is not clear to me (for now :) why the deps is wrong.
EDIT: maybe I found it, the error is in 'Add option to force tablet UI' patch

[basilgello]

@uazo Patch 0004 was quite a hacky fix because I tried to propagate generate_final_jni = false header from bromite's gni but failed to do that. For me it looks now that generate_final_jni is not a configurable parameter but I can be wrong.

[uazo]

the bug is in the patch I indicated, which is just wrong, I will solve it.

[uazo]

@basilgello these are the patch changes needed for the webview build.
thank you for your persistence! You also made me find a bug in another patch

[uazo]

next version #600