safetynet/docs/native-runtime/README.md

Chromium 152 WebRTC binder backport

Status: source patch prepared and checked; not compiled or runtime verified. Do not distribute this patch as a proven security fix until the acceptance gates below pass against the resulting binary.

Latest stable candidate checked

The official Electron44.7.1 release uses Chromium152.0.7977.149. Its Windows x64 ZIP was downloaded into an isolated ignored directory, checked against the official SHA256 manifest and extracted with contained-path, symlink and size checks. ZIP SHA256: ace7ce1580d33e9fe7284823d7e23ba687263c448d85d8dc4b5daa9bba73f97a.

Actual positive controls in fresh profiles transmitted synthetic RTC bytes and a benign HTTPS submission from both initial about:blank and srcdoc frames. The matching managed header cases still terminated their renderers with missing network.mojom.MdnsResponder, bad IPC123 and exit3. The tagged binder source also lacks NoOpP2PSocketManager. Therefore this available stable binary does not resolve the gate. Project dependencies remain unchanged.

Ignored evidence: artifacts/electron4471-binary-proof.json. The first run's about:blank positive timeout remains retained; a separate profile-isolated paired run verified both controls without changing attempts or deadlines.

Exact basis and provenance

The adjacent patch targets Chromium 152.0.7977.130, used by Electron 44.7.0. It backports Chromium commit 46fcf3faed9db394de7046a100301f64c2842f0e (CL8485457, bug565837691). Upstream files retain their Chromium copyright notices.

The upstream change fixes a native renderer termination when nested local-scheme frames request a missing WebRTC binder under Connection-Allowlist. It registers the binders consistently, checks the current document policy when binding, and uses no-op mDNS/socket implementations to fail without creating network sockets. It is a temporary transport denial, not WebRTC payload inspection.

Only two context adaptations were needed: insert the policy helper before the older utilities file's namespace close, and place the conditional mDNS include beside the existing connection-policy include. The original implementation, unit tests, WPT tests and GN entries are preserved. The older public RenderFrameHost header exposes both APIs used by the helper: HasPolicyContainerHost() and GetConnectionAllowlists().

On 2026-10-13, the 16 exact touched paths were retrieved individually from the official Chromium tag into an ignored scratch repository. Unmodified tag files were restored, with LF line endings, and this command completed with exit0:

git -C artifacts/rtc-patch-check apply --check C:/Users/karl/Safetynet/docs/native-runtime/chromium-152-webrtc-binder-backport.patch

This proves textual applicability to the tagged files. It does not establish compilation, compatibility with Electron's existing patches, or runtime safety. Repeat the check against the complete Electron-patched source checkout.

Host readiness

Measured host: Ryzen7800X3D, eight exposed logical processors, 16GB RAM (about 4.5GB free during inspection), and 266.6GiB free on NTFS C:. Installed VS2022 Build Tools17.14 includes x64 C++ tools but lacks the ATL/MFC component. SDK rc.exe is26100.7705; symstore.exe is28000.2957. No native checkout or depot_tools/gclient/GN/Ninja installation was found on PATH.

The version-specific Chromium requirements specify at least8GB RAM and100GB disk, recommend more than16GB RAM, and require C++ plus ATL/MFC and SDK26100.7705. This host meets the minimum resources but requires toolchain completion. Plan substantially more memory and disk headroom for comfortable builds; actual full-checkout and output size remains unmeasured. Do not automatically disable endpoint antivirus or change global Git settings.

Build procedure

Follow Electron Windows prerequisites and Electron GN/patch instructions. Use a separate short path such as C:/src/electron44, outside this application. Install missing ATL/MFC and depot_tools first. No large downloads or dependency changes were performed while preparing this review artifact.

1. Set DEPOT_TOOLS_WIN_TOOLCHAIN=0 in the build process and prepend depot_tools to that process's PATH. Keep the application workspace unchanged.
2. Configure gclient with unmanaged src/electron pointing at the official Electron repository. Bootstrap its source, check out exact v44.7.0 in src/electron, then sync with branch heads and tags. Confirm its DEPS pins Chromium152.0.7977.130 before applying anything.
3. From src, run git apply --check <absolute-patch-path> against the already Electron-patched checkout, then apply. Any failure requires review; do not silently drop hunks. Export the change through Electron's patch system (e patches) so future synchronizations reproduce it.
4. Generate a release configuration using import("//electron/build/args/release.gn") target_cpu="x64". For this constrained host, consider symbol_level=0, blink_symbol_level=0, v8_symbol_level=0, and local execution. These reduce debugging detail; keep a separately instrumented build if native investigation requires symbols.
5. Build ninja -C out/Release -j2 electron. Build the relevant Chromium native test target as well; low parallelism is an initial resource choice, not a measured guarantee against memory exhaustion.
6. Only after verification, package with ninja -C out/Release electron:electron_dist_zip and pin artifact hash, Electron/Chromium versions and backport revision in release provenance.

Acceptance gates

• Compile and run NoOpMdnsResponderTest.* and NoOpP2PSocketManagerTest.*.
• Execute the upstream local-scheme allow/block WPT cases.
• Run real paired WebRTC data-channel positive controls in initial about:blank, srcdoc, blob and cross-origin frames; prove exact synthetic bytes arrive.
• Under the actual managed response-header function, repeat the same attempts: no data delivery, no renderer termination, no hanging harness, and successful benign HTTP POSTs. Exercise the initial synchronous iframe window before any navigation or preload; constructor availability alone is not a pass.
• Verify native socket denial without relying on the JavaScript preload. Check redirects and a site-supplied webrtc=allow header cannot relax managed policy.
• Run the complete Windows DLP MVP native acceptance suite and inspect actual exported OpenTelemetry traces, durable deny events and exporter failures.

Alternative runtime status

No tested prebuilt alternative is verified. Electron46 nightly20261013 with Chromium157.0.8091.0 also crashes under the same blocked about:blank/srcdoc attempts; its tagged binder source lacks the no-op implementation. A later binary is acceptable only after source inclusion checks and all native gates above. Current ignored artifacts retain the original crashes and positive controls; an upgrade must not overwrite that evidence.

Local setup started, 2026-10-13

An isolated checkout now exists at C:/Users/karl/Safetynet/artifacts/native-build/electron44. Electron tag44.7.0 resolved to commit 61f55c4ce540416b3e43f75f6c0f125d22e5e908; its DEPS pins152.0.7977.130. The adjacent depot_tools checkout is pinned at 52ae103994896b9ce7742a605de8f43b410e5515. The ignored run-sync.mjs wrapper supplies process-only PATH/toolchain/Git configuration and runs gclient.bat sync --nohooks --shallow --jobs=2 --revision=src@2c592105bbcd9490a9894df48d0fe59b2c512651. It records source-sync.log, stops its own process tree if free disk falls below 150GiB, and bounds each run to30minutes. A live bootstrap is not source completion. Current depot_tools expects git.bat; the first sync failed because only git.exe was installed. An isolated artifacts/native-build/bin/git.bat now forwards to the existing signed C:/Program Files/Git/cmd/git.exe; only the wrapper's PATH includes that shim. The initial Chromium clone observed after retry did not include a depth argument, so the requested shallow option must not be treated as proof of a shallow fetch. Disk/deadline bounds still apply. Hooks, patch application against Electron's full source, compilation and native acceptance remain pending.

The controlled tagged bootstrap completed on2026-10-14 with exit0. Chromium 152.0.7977.130 resolved to 2c592105bbcd9490a9894df48d0fe59b2c512651; Git reports a shallow repository. Electron's pinned nested checkout was preserved. The backport's git apply --check also passed against this complete pristine Chromium checkout. Electron's dependency synchronization and native patch hooks have not yet completed, so this does not replace the required check after Electron patches. The bootstrap wrapper is artifacts/native-build/run-bootstrap.mjs; its log is bootstrap.log. Initial fetch transferred a1.43GB pack; free disk after checkout was259.3GiB. No compiler or native test was executed at this milestone.

The first dependency-sync attempt after bootstrap attempted a broad Chromium remote fetch because the DEPS revision was a textual tag. That owned process tree was explicitly stopped; its terminal exit was1. The matching local tag was installed and the wrapper now overrides src with the exact existing commit above, without modifying DEPS. The next run advanced into dependencies: Node's v24.21.0 checkout completed at 955266bfdd854cd280dffd47548673914484e4c0, followed by other Chromium dependencies. At this documentation snapshot the bounded dependency run is still active: dependency completion, patch hooks and compilation are not verified. Gclient initial dependency clones may still fetch full histories despite the shallow option; the disk floor and run deadline remain mandatory.

The same dependency sync was subsequently stopped deliberately to free resources for failed application-test diagnosis. Its terminal exit was1; the owned process tree was verified and stopped, without starting another sync. Chromium, Electron and Node pins remain unchanged. Dawn, DevTools, ICU and Ink checkouts are present; V8 and WebRTC dependency checkouts are still absent. Free disk at this checkpoint was246.2GiB. This is a resumable preparation checkpoint, not a completed build.

A subsequent bounded resume has checked out WebRTC at 6f37672d358475cd17544121a12494da454d85fb and V8 at fedd021b538607860f9c56e5c193ad8dcd4f2bb1, each verified against its own Git root. A read-only snapshot found all nineteen required patch targets present and tracked-clean, with no patch imports yet. The post-import verifier's real negative control rejected all nineteen unpatched targets as expected. Ignored evidence: artifacts/native-build/patch-readiness.json and patch-import-negative-control.json. At this checkpoint synchronization is still active on VK-GL-CTS and WebGPU CTS; this was not full dependency completion, patch applicability, compilation or native acceptance.

That same resume subsequently terminated with exit1 (stopped:false): Windows antivirus rejected CIPD package chromium/third_party/updater/chrome_win_x86, instance NuXBEfKu8082d55WUbs6_3P0puTPCI4A1Df4BnQ1Z40C, during fetch/install. This is a measured security-tool rejection, not a timeout or a completed sync. No antivirus exception, disabling, bypass or package retry was performed. Compilation remains unverified. The existing Git sources can be independently rechecked for the targeted Python patch import, which neither installs that package nor proves complete dependency readiness.

The subsequent official patch import used normal host Python after the isolated embedded interpreter failed before entering patch code. The official import then terminated with exit1: the excluded fontconfig directory existed without its own Git root, so its target fell back to Chromium during parallel import. Its Git-Am invocation failed against Chromium's active import and overwrote Chromium's upstream patch references. Chromium has272 commits relative to the saved pristine baseline and no remaining Git-Am directory, but its overwritten references count only268 commits. This discrepancy is a real failed gate, not an accepted successful import. Preserve the original log and verification failure; verify the complete ordered series against the saved baseline before considering an explicit, evidence-backed reference repair. No reset, abort, patch replay or automatic reference repair has been performed at this checkpoint.

The ordered-series verification subsequently proved all272 Chromium patches and all eighteen other required repositories. Each of the thirteen modified parent Gitlinks was checked against its registered, independently verified child's actual HEAD, own Git root and stage0 mode160000 entry; arbitrary source changes remain rejected. Only the two corrupted upstream references remained invalid. An explicit atomic compare-and-swap repair then restored both references to 2c592105bbcd9490a9894df48d0fe59b2c512651, requiring their observed old value 619d23e60466caaa2b5f35e16f15a255b5c09ffa. Chromium HEAD stayed b33e21917a1ce686ca6134585cdaca88eaadf9f6. A first transaction failed due to CRLF stdin; a synthetic/no-op protocol check proved literal LF bytes necessary, and the corrected start/prepare/commit transaction exited0. Original failures and both transaction journals remain retained. No patch replay, source reset or dependency staging occurred. The fresh post-repair verifier then passed all nineteen required targets with the thirteen explicitly matched Gitlinks, and git apply --check for the backport exited0 against Electron-patched Chromium. Evidence: artifacts/native-build/patch-import-verification-post-cas.json and the retained recovery journal. This proves combined source applicability, not a compiled or runtime-verified fix.

The verified backport was then applied with git apply --index and committed as 6f8b80fef13bfdc9d9c70df567ebcad722d70467, parent b33e21917a1ce686ca6134585cdaca88eaadf9f6, in the ignored native source checkout. Exactly the sixteen expected files were staged; no dependency Gitlinks were included. Thirteen structural source assertions passed, the index is clean and both official upstream references remain unchanged. The single-commit mailbox artifacts/native-build/backport-applied.patch has SHA256 070ece6ffbd5723aa8bb0c7e94f855c931be2b2277a6e69b5908cabb5881343b; backport-applied-journal.json records provenance and exact files. This source checkpoint remains uncompiled and runtime-unverified. The shipped project runtime is unchanged; source assertions cannot substitute for the native gates.

Rejected package: dependency scope

The pinned Chromium DEPS requires the rejected x86 package under checkout_win, independently of the build target CPU. Its source consumers are updater test fixtures: chrome/updater/BUILD.gn selects UpdaterSetup_test.exe as test data, and third_party/updater/BUILD.gn defines the test-only old_updater copy target. Branded updater tests may include x86 fixtures even in an x64 build. No direct updater dependency was found in Electron's app/link target declarations; the transitive GN graph has not been generated or verified. Therefore this package is not identified as a compiler tool, but the official full sync remains failed. This read-only analysis authorizes neither skipping dependencies nor changing antivirus policy. ATL/MFC remains independently missing at the host check.

Patch readiness before compilation

ATL/MFC is required for the native toolchain, not for the Python patch import or a combined-source text check. After dependency synchronization is terminal, verify each required Windows repository's own Git root, pinned revision and clean working tree; git -C <directory> rev-parse HEAD alone can accidentally resolve the parent Chromium repository when a dependency has not yet checked out.

The pinned official DEPS hook invokes the following action from artifacts/native-build/electron44:

python3 src/electron/script/apply_all_patches.py src/electron/patches/config.json
git -C src apply --check C:/Users/karl/Safetynet/docs/native-runtime/chromium-152-webrtc-binder-backport.patch

This identifies the upstream action; do not rerun its unfiltered twenty-target config on Windows after the measured ancestor collision. For a fresh checkout, first run scripts/native-patch-preflight.mjs, explicitly verify the Linux-only fontconfig exclusion, and use a reviewed config containing only the nineteen required targets with the same official Python importer. Never replay imports over an already patched tree. The hook does not invoke compilation. Its exit code is insufficient evidence: missing repositories are skipped with warnings. Verify imports and upstream references for each required target in patches/config.json. In this pinned checkout, nineteen targets are required: despite their names, squirrel.mac and ReactiveObjC are synchronized under process_deps, without a macOS condition. Only fontconfig is excluded by its Chromium checkout_linux condition. Do not infer exclusions from directory names. Save each repository's pre-import HEAD. Both the legacy and checkout-specific upstream references must resolve to that commit, and it must be an ancestor of the resulting HEAD. Compare imported commit counts and ordered subjects with the repository's .patches list. Reference existence alone is insufficient: the importer writes references before git am, which can subsequently fail. Do not blindly rerun the hook after partial failure or reset conflicting hunks. Seven existing Chromium patches touch backport paths, so the earlier pristine check does not prove compatibility with Electron's patches. Full runhooks, GN, compilation and native transport acceptance remain separate gates. The backport addresses denial stability; it does not provide WebRTC content inspection.

Missing ATL/MFC: explicit administrator step

Inspection found the existing installer at C:/Program Files (x86)/Microsoft Visual Studio/Installer/setup.exe, version 4.10.30.62513. Its Authenticode status was Valid, signer Microsoft Corporation. Existing installation: C:/Program Files (x86)/Microsoft Visual Studio/2022/BuildTools. The official required component ID is Microsoft.VisualStudio.Component.VC.ATLMFC.

The current agent process is not elevated. No UAC bypass or installer launch was attempted. To install only this missing component, a user can run the following in an administrator PowerShell and allow the normal installer flow:

& 'C:/Program Files (x86)/Microsoft Visual Studio/Installer/setup.exe' modify `
  --installPath 'C:/Program Files (x86)/Microsoft Visual Studio/2022/BuildTools' `
  --add Microsoft.VisualStudio.Component.VC.ATLMFC --passive --norestart

Verify afterward using vswhere.exe -products '*' -requires Microsoft.VisualStudio.Component.VC.ATLMFC -property installationPath. Treat installer exit3010 as restart required; do not claim build readiness until the component is detected and toolchain checks pass.