safetynet/docs/native-runtime

Chromium 152 WebRTC binder backport

Status: source patch prepared and checked; not compiled or runtime verified. Do not distribute this patch as a proven security fix until the acceptance gates below pass against the resulting binary.

Exact basis and provenance

The adjacent patch targets Chromium 152.0.7977.130, used by Electron 44.7.0. It backports Chromium commit 46fcf3faed9db394de7046a100301f64c2842f0e (CL8485457, bug565837691). Upstream files retain their Chromium copyright notices.

The upstream change fixes a native renderer termination when nested local-scheme frames request a missing WebRTC binder under Connection-Allowlist. It registers the binders consistently, checks the current document policy when binding, and uses no-op mDNS/socket implementations to fail without creating network sockets. It is a temporary transport denial, not WebRTC payload inspection.

Only two context adaptations were needed: insert the policy helper before the older utilities file's namespace close, and place the conditional mDNS include beside the existing connection-policy include. The original implementation, unit tests, WPT tests and GN entries are preserved. The older public RenderFrameHost header exposes both APIs used by the helper: HasPolicyContainerHost() and GetConnectionAllowlists().

On 2026-10-13, the 16 exact touched paths were retrieved individually from the official Chromium tag into an ignored scratch repository. Unmodified tag files were restored, with LF line endings, and this command completed with exit0:

git -C artifacts/rtc-patch-check apply --check C:/Users/karl/Safetynet/docs/native-runtime/chromium-152-webrtc-binder-backport.patch

This proves textual applicability to the tagged files. It does not establish compilation, compatibility with Electron's existing patches, or runtime safety. Repeat the check against the complete Electron-patched source checkout.

Host readiness

Measured host: Ryzen7800X3D, eight exposed logical processors, 16GB RAM (about 4.5GB free during inspection), and 266.6GiB free on NTFS C:. Installed VS2022 Build Tools17.14 includes x64 C++ tools but lacks the ATL/MFC component. SDK rc.exe is26100.7705; symstore.exe is28000.2957. No native checkout or depot_tools/gclient/GN/Ninja installation was found on PATH.

The version-specific Chromium requirements specify at least8GB RAM and100GB disk, recommend more than16GB RAM, and require C++ plus ATL/MFC and SDK26100.7705. This host meets the minimum resources but requires toolchain completion. Plan substantially more memory and disk headroom for comfortable builds; actual full-checkout and output size remains unmeasured. Do not automatically disable endpoint antivirus or change global Git settings.

Build procedure

Follow Electron Windows prerequisites and Electron GN/patch instructions. Use a separate short path such as C:/src/electron44, outside this application. Install missing ATL/MFC and depot_tools first. No large downloads or dependency changes were performed while preparing this review artifact.

1. Set DEPOT_TOOLS_WIN_TOOLCHAIN=0 in the build process and prepend depot_tools to that process's PATH. Keep the application workspace unchanged.
2. Configure gclient with unmanaged src/electron pointing at the official Electron repository. Bootstrap its source, check out exact v44.7.0 in src/electron, then sync with branch heads and tags. Confirm its DEPS pins Chromium152.0.7977.130 before applying anything.
3. From src, run git apply --check <absolute-patch-path> against the already Electron-patched checkout, then apply. Any failure requires review; do not silently drop hunks. Export the change through Electron's patch system (e patches) so future synchronizations reproduce it.
4. Generate a release configuration using import("//electron/build/args/release.gn") target_cpu="x64". For this constrained host, consider symbol_level=0, blink_symbol_level=0, v8_symbol_level=0, and local execution. These reduce debugging detail; keep a separately instrumented build if native investigation requires symbols.
5. Build ninja -C out/Release -j2 electron. Build the relevant Chromium native test target as well; low parallelism is an initial resource choice, not a measured guarantee against memory exhaustion.
6. Only after verification, package with ninja -C out/Release electron:electron_dist_zip and pin artifact hash, Electron/Chromium versions and backport revision in release provenance.

Acceptance gates

• Compile and run NoOpMdnsResponderTest.* and NoOpP2PSocketManagerTest.*.
• Execute the upstream local-scheme allow/block WPT cases.
• Run real paired WebRTC data-channel positive controls in initial about:blank, srcdoc, blob and cross-origin frames; prove exact synthetic bytes arrive.
• Under the actual managed response-header function, repeat the same attempts: no data delivery, no renderer termination, no hanging harness, and successful benign HTTP POSTs. Exercise the initial synchronous iframe window before any navigation or preload; constructor availability alone is not a pass.
• Verify native socket denial without relying on the JavaScript preload. Check redirects and a site-supplied webrtc=allow header cannot relax managed policy.
• Run the complete Windows DLP MVP native acceptance suite and inspect actual exported OpenTelemetry traces, durable deny events and exporter failures.

Alternative runtime status

No tested prebuilt alternative is verified. Electron46 nightly20261013 with Chromium157.0.8091.0 also crashes under the same blocked about:blank/srcdoc attempts; its tagged binder source lacks the no-op implementation. A later binary is acceptable only after source inclusion checks and all native gates above. Current ignored artifacts retain the original crashes and positive controls; an upgrade must not overwrite that evidence.

Local setup started, 2026-10-13

An isolated checkout now exists at C:/Users/karl/Safetynet/artifacts/native-build/electron44. Electron tag44.7.0 resolved to commit 61f55c4ce540416b3e43f75f6c0f125d22e5e908; its DEPS pins152.0.7977.130. The adjacent depot_tools checkout is pinned at 52ae103994896b9ce7742a605de8f43b410e5515. The ignored run-sync.mjs wrapper supplies process-only PATH/toolchain/Git configuration and runs gclient.bat sync --nohooks --shallow --jobs=2 --revision=src@2c592105bbcd9490a9894df48d0fe59b2c512651. It records source-sync.log, stops its own process tree if free disk falls below 150GiB, and bounds each run to30minutes. A live bootstrap is not source completion. Current depot_tools expects git.bat; the first sync failed because only git.exe was installed. An isolated artifacts/native-build/bin/git.bat now forwards to the existing signed C:/Program Files/Git/cmd/git.exe; only the wrapper's PATH includes that shim. The initial Chromium clone observed after retry did not include a depth argument, so the requested shallow option must not be treated as proof of a shallow fetch. Disk/deadline bounds still apply. Hooks, patch application against Electron's full source, compilation and native acceptance remain pending.

The controlled tagged bootstrap completed on2026-10-14 with exit0. Chromium 152.0.7977.130 resolved to 2c592105bbcd9490a9894df48d0fe59b2c512651; Git reports a shallow repository. Electron's pinned nested checkout was preserved. The backport's git apply --check also passed against this complete pristine Chromium checkout. Electron's dependency synchronization and native patch hooks have not yet completed, so this does not replace the required check after Electron patches. The bootstrap wrapper is artifacts/native-build/run-bootstrap.mjs; its log is bootstrap.log. Initial fetch transferred a1.43GB pack; free disk after checkout was259.3GiB. No compiler or native test was executed at this milestone.

The first dependency-sync attempt after bootstrap attempted a broad Chromium remote fetch because the DEPS revision was a textual tag. That owned process tree was explicitly stopped; its terminal exit was1. The matching local tag was installed and the wrapper now overrides src with the exact existing commit above, without modifying DEPS. The next run advanced into dependencies: Node's v24.21.0 checkout completed at 955266bfdd854cd280dffd47548673914484e4c0, followed by other Chromium dependencies. At this documentation snapshot the bounded dependency run is still active: dependency completion, patch hooks and compilation are not verified. Gclient initial dependency clones may still fetch full histories despite the shallow option; the disk floor and run deadline remain mandatory.

The same dependency sync was subsequently stopped deliberately to free resources for failed application-test diagnosis. Its terminal exit was1; the owned process tree was verified and stopped, without starting another sync. Chromium, Electron and Node pins remain unchanged. Dawn, DevTools, ICU and Ink checkouts are present; V8 and WebRTC dependency checkouts are still absent. Free disk at this checkpoint was246.2GiB. This is a resumable preparation checkpoint, not a completed build.

Missing ATL/MFC: explicit administrator step

Inspection found the existing installer at C:/Program Files (x86)/Microsoft Visual Studio/Installer/setup.exe, version 4.10.30.62513. Its Authenticode status was Valid, signer Microsoft Corporation. Existing installation: C:/Program Files (x86)/Microsoft Visual Studio/2022/BuildTools. The official required component ID is Microsoft.VisualStudio.Component.VC.ATLMFC.

The current agent process is not elevated. No UAC bypass or installer launch was attempted. To install only this missing component, a user can run the following in an administrator PowerShell and allow the normal installer flow:

& 'C:/Program Files (x86)/Microsoft Visual Studio/Installer/setup.exe' modify `
  --installPath 'C:/Program Files (x86)/Microsoft Visual Studio/2022/BuildTools' `
  --add Microsoft.VisualStudio.Component.VC.ATLMFC --passive --norestart

Verify afterward using vswhere.exe -products '*' -requires Microsoft.VisualStudio.Component.VC.ATLMFC -property installationPath. Treat installer exit3010 as restart required; do not claim build readiness until the component is detected and toolchain checks pass.