safetynet/docs/native-runtime/README.md

# Chromium 152 WebRTC binder backport

Status: source patch prepared and checked; **not compiled or runtime verified**.
Do not distribute this patch as a proven security fix until the acceptance gates
below pass against the resulting binary.

## Latest stable candidate checked

The official [Electron44.7.1 release](https://github.com/electron/electron/releases/tag/v44.7.1)
uses Chromium152.0.7977.149. Its Windows x64 ZIP was downloaded into an isolated
ignored directory, checked against the official SHA256 manifest and extracted
with contained-path, symlink and size checks. ZIP SHA256:
`ace7ce1580d33e9fe7284823d7e23ba687263c448d85d8dc4b5daa9bba73f97a`.

Actual positive controls in fresh profiles transmitted synthetic RTC bytes and
a benign HTTPS submission from both initial about:blank and srcdoc frames.
The matching managed header cases still terminated their renderers with
missing `network.mojom.MdnsResponder`, bad IPC123 and exit3. The tagged binder
source also lacks `NoOpP2PSocketManager`. Therefore this available stable binary
does not resolve the gate. Project dependencies remain unchanged.

Ignored evidence: `artifacts/electron4471-binary-proof.json`. The first run's
about:blank positive timeout remains retained; a separate profile-isolated
paired run verified both controls without changing attempts or deadlines.

## Exact basis and provenance

The adjacent patch targets Chromium `152.0.7977.130`, used by Electron `44.7.0`.
It backports Chromium commit
[`46fcf3faed9db394de7046a100301f64c2842f0e`](https://chromium.googlesource.com/chromium/src/+/46fcf3faed9db394de7046a100301f64c2842f0e)
(CL8485457, bug565837691). Upstream files retain their Chromium copyright notices.

The upstream change fixes a native renderer termination when nested local-scheme
frames request a missing WebRTC binder under `Connection-Allowlist`. It registers
the binders consistently, checks the current document policy when binding, and
uses no-op mDNS/socket implementations to fail without creating network sockets.
It is a temporary transport denial, not WebRTC payload inspection.

Only two context adaptations were needed: insert the policy helper before the
older utilities file's namespace close, and place the conditional mDNS include
beside the existing connection-policy include. The original implementation,
unit tests, WPT tests and GN entries are preserved. The older public
`RenderFrameHost` header exposes both APIs used by the helper:
`HasPolicyContainerHost()` and `GetConnectionAllowlists()`.

On 2026-10-13, the 16 exact touched paths were retrieved individually from the
official Chromium tag into an ignored scratch repository. Unmodified tag files
were restored, with LF line endings, and this command completed with exit0:

```powershell
git -C artifacts/rtc-patch-check apply --check C:/Users/karl/Safetynet/docs/native-runtime/chromium-152-webrtc-binder-backport.patch
```

This proves textual applicability to the tagged files. It does not establish
compilation, compatibility with Electron's existing patches, or runtime safety.
Repeat the check against the complete Electron-patched source checkout.

## Host readiness

Measured host: Ryzen7800X3D, eight exposed logical processors, 16GB RAM (about
4.5GB free during inspection), and 266.6GiB free on NTFS C:. Installed VS2022
Build Tools17.14 includes x64 C++ tools but lacks the ATL/MFC component. SDK
`rc.exe` is26100.7705; `symstore.exe` is28000.2957. No native checkout or
depot_tools/gclient/GN/Ninja installation was found on PATH.

The [version-specific Chromium requirements](https://chromium.googlesource.com/chromium/src/+/152.0.7977.130/docs/windows_build_instructions.md)
specify at least8GB RAM and100GB disk, recommend more than16GB RAM, and require
C++ plus ATL/MFC and SDK26100.7705. This host meets the minimum resources but
requires toolchain completion. Plan substantially more memory and disk headroom
for comfortable builds; actual full-checkout and output size remains unmeasured.
Do not automatically disable endpoint antivirus or change global Git settings.

## Build procedure

Follow [Electron Windows prerequisites](https://www.electronjs.org/docs/latest/development/build-instructions-windows)
and [Electron GN/patch instructions](https://www.electronjs.org/docs/latest/development/build-instructions-gn).
Use a separate short path such as `C:/src/electron44`, outside this application.
Install missing ATL/MFC and depot_tools first. No large downloads or dependency
changes were performed while preparing this review artifact.

1. Set `DEPOT_TOOLS_WIN_TOOLCHAIN=0` in the build process and prepend depot_tools
   to that process's PATH. Keep the application workspace unchanged.
2. Configure gclient with unmanaged `src/electron` pointing at the official
   Electron repository. Bootstrap its source, check out exact `v44.7.0` in
   `src/electron`, then sync with branch heads and tags. Confirm its DEPS pins
   Chromium152.0.7977.130 before applying anything.
3. From `src`, run `git apply --check <absolute-patch-path>` against the already
   Electron-patched checkout, then apply. Any failure requires review; do not
   silently drop hunks. Export the change through Electron's patch system
   (`e patches`) so future synchronizations reproduce it.
4. Generate a release configuration using
   `import("//electron/build/args/release.gn") target_cpu="x64"`.
   For this constrained host, consider `symbol_level=0`,
   `blink_symbol_level=0`, `v8_symbol_level=0`, and local execution. These reduce
   debugging detail; keep a separately instrumented build if native investigation
   requires symbols.
5. Build `ninja -C out/Release -j2 electron`. Build the relevant Chromium native
   test target as well; low parallelism is an initial resource choice, not a
   measured guarantee against memory exhaustion.
6. Only after verification, package with
   `ninja -C out/Release electron:electron_dist_zip` and pin artifact hash,
   Electron/Chromium versions and backport revision in release provenance.

## Acceptance gates

- Compile and run `NoOpMdnsResponderTest.*` and `NoOpP2PSocketManagerTest.*`.
- Execute the upstream local-scheme allow/block WPT cases.
- Run real paired WebRTC data-channel positive controls in initial about:blank,
  srcdoc, blob and cross-origin frames; prove exact synthetic bytes arrive.
- Under the actual managed response-header function, repeat the same attempts:
  no data delivery, no renderer termination, no hanging harness, and successful
  benign HTTP POSTs. Exercise the initial synchronous iframe window before any
  navigation or preload; constructor availability alone is not a pass.
- Verify native socket denial without relying on the JavaScript preload. Check
  redirects and a site-supplied `webrtc=allow` header cannot relax managed policy.
- Run the complete Windows DLP MVP native acceptance suite and inspect actual
  exported OpenTelemetry traces, durable deny events and exporter failures.

## Alternative runtime status

No tested prebuilt alternative is verified. Electron46 nightly20261013 with
Chromium157.0.8091.0 also crashes under the same blocked about:blank/srcdoc
attempts; its tagged binder source lacks the no-op implementation. A later
binary is acceptable only after source inclusion checks and all native gates
above. Current ignored artifacts retain the original crashes and positive
controls; an upgrade must not overwrite that evidence.

## Local setup started, 2026-10-13

An isolated checkout now exists at
`C:/Users/karl/Safetynet/artifacts/native-build/electron44`.
Electron tag44.7.0 resolved to commit
`61f55c4ce540416b3e43f75f6c0f125d22e5e908`; its DEPS pins152.0.7977.130.
The adjacent depot_tools checkout is pinned at
`52ae103994896b9ce7742a605de8f43b410e5515`.
The ignored `run-sync.mjs` wrapper supplies process-only PATH/toolchain/Git
configuration and runs `gclient.bat sync --nohooks --shallow --jobs=2
--revision=src@2c592105bbcd9490a9894df48d0fe59b2c512651`.
It records `source-sync.log`, stops its own process tree if free disk falls below
150GiB, and bounds each run to30minutes. A live bootstrap is not source completion.
Current depot_tools expects `git.bat`; the first sync failed because only
`git.exe` was installed. An isolated `artifacts/native-build/bin/git.bat` now
forwards to the existing signed `C:/Program Files/Git/cmd/git.exe`; only the
wrapper's PATH includes that shim. The initial Chromium clone observed after
retry did not include a depth argument, so the requested shallow option must
not be treated as proof of a shallow fetch. Disk/deadline bounds still apply.
Hooks, patch application against Electron's full source, compilation and native
acceptance remain pending.

The controlled tagged bootstrap completed on2026-10-14 with exit0. Chromium
`152.0.7977.130` resolved to
`2c592105bbcd9490a9894df48d0fe59b2c512651`; Git reports a shallow repository.
Electron's pinned nested checkout was preserved. The backport's `git apply
--check` also passed against this **complete pristine Chromium checkout**.
Electron's dependency synchronization and native patch hooks have not yet
completed, so this does not replace the required check after Electron patches.
The bootstrap wrapper is `artifacts/native-build/run-bootstrap.mjs`; its log is
`bootstrap.log`. Initial fetch transferred a1.43GB pack; free disk after checkout
was259.3GiB. No compiler or native test was executed at this milestone.

The first dependency-sync attempt after bootstrap attempted a broad Chromium
remote fetch because the DEPS revision was a textual tag. That owned process
tree was explicitly stopped; its terminal exit was1. The matching local tag
was installed and the wrapper now overrides `src` with the exact existing
commit above, without modifying DEPS. The next run advanced into dependencies:
Node's `v24.21.0` checkout completed at
`955266bfdd854cd280dffd47548673914484e4c0`, followed by other Chromium
dependencies. At this documentation snapshot the bounded dependency run is
still active: dependency completion, patch hooks and compilation are **not
verified**. Gclient initial dependency clones may still fetch full histories
despite the shallow option; the disk floor and run deadline remain mandatory.

The same dependency sync was subsequently stopped deliberately to free resources
for failed application-test diagnosis. Its terminal exit was1; the owned process
tree was verified and stopped, without starting another sync. Chromium, Electron
and Node pins remain unchanged. Dawn, DevTools, ICU and Ink checkouts are present;
V8 and WebRTC dependency checkouts are still absent. Free disk at this checkpoint
was246.2GiB. This is a resumable preparation checkpoint, not a completed build.

A subsequent bounded resume has checked out WebRTC at
`6f37672d358475cd17544121a12494da454d85fb` and V8 at
`fedd021b538607860f9c56e5c193ad8dcd4f2bb1`, each verified against its own Git
root. A read-only snapshot found all nineteen required patch targets present
and tracked-clean, with no patch imports yet. The post-import verifier's real
negative control rejected all nineteen unpatched targets as expected. Ignored
evidence: `artifacts/native-build/patch-readiness.json` and
`patch-import-negative-control.json`. At this checkpoint synchronization is
still active on VK-GL-CTS and WebGPU CTS; this was not full dependency completion,
patch applicability, compilation or native acceptance.

That same resume subsequently terminated with exit1 (`stopped:false`): Windows
antivirus rejected CIPD package `chromium/third_party/updater/chrome_win_x86`,
instance `NuXBEfKu8082d55WUbs6_3P0puTPCI4A1Df4BnQ1Z40C`, during fetch/install.
This is a measured security-tool rejection, not a timeout or a completed sync.
No antivirus exception, disabling, bypass or package retry was performed.
Compilation remains unverified. The existing Git sources can be independently
rechecked for the targeted Python patch import, which neither installs that
package nor proves complete dependency readiness.

The subsequent official patch import used normal host Python after the isolated
embedded interpreter failed before entering patch code. The official import
then terminated with exit1: the excluded `fontconfig` directory existed without
its own Git root, so its target fell back to Chromium during parallel import.
Its Git-Am invocation failed against Chromium's active import and overwrote
Chromium's upstream patch references. Chromium has272 commits relative to the
saved pristine baseline and no remaining Git-Am directory, but its overwritten
references count only268 commits. This discrepancy is a real failed gate, not
an accepted successful import. Preserve the original log and verification
failure; verify the complete ordered series against the saved baseline before
considering an explicit, evidence-backed reference repair. No reset, abort,
patch replay or automatic reference repair has been performed at this checkpoint.

The ordered-series verification subsequently proved all272 Chromium patches and
all eighteen other required repositories. Each of the thirteen modified parent
Gitlinks was checked against its registered, independently verified child's
actual HEAD, own Git root and stage0 mode160000 entry; arbitrary source changes
remain rejected. Only the two corrupted upstream references remained invalid.
An explicit atomic compare-and-swap repair then restored both references to
`2c592105bbcd9490a9894df48d0fe59b2c512651`, requiring their observed old value
`619d23e60466caaa2b5f35e16f15a255b5c09ffa`. Chromium HEAD stayed
`b33e21917a1ce686ca6134585cdaca88eaadf9f6`. A first transaction failed due to CRLF
stdin; a synthetic/no-op protocol check proved literal LF bytes necessary, and
the corrected start/prepare/commit transaction exited0. Original failures and
both transaction journals remain retained. No patch replay, source reset or
dependency staging occurred. The fresh post-repair verifier then passed all
nineteen required targets with the thirteen explicitly matched Gitlinks, and
`git apply --check` for the backport exited0 against Electron-patched Chromium.
Evidence: `artifacts/native-build/patch-import-verification-post-cas.json` and
the retained recovery journal. This proves combined source applicability, not
a compiled or runtime-verified fix.

The verified backport was then applied with `git apply --index` and committed as
`6f8b80fef13bfdc9d9c70df567ebcad722d70467`, parent
`b33e21917a1ce686ca6134585cdaca88eaadf9f6`, in the ignored native source checkout.
Exactly the sixteen expected files were staged; no dependency Gitlinks were
included. Thirteen structural source assertions passed, the index is clean and
both official upstream references remain unchanged. The single-commit mailbox
`artifacts/native-build/backport-applied.patch` has SHA256
`070ece6ffbd5723aa8bb0c7e94f855c931be2b2277a6e69b5908cabb5881343b`;
`backport-applied-journal.json` records provenance and exact files. This source
checkpoint remains **uncompiled and runtime-unverified**. The shipped project
runtime is unchanged; source assertions cannot substitute for the native gates.

### Rejected package: dependency scope

The pinned Chromium `DEPS` requires the rejected x86 package under `checkout_win`,
independently of the build target CPU. Its source consumers are updater test
fixtures: `chrome/updater/BUILD.gn` selects `UpdaterSetup_test.exe` as test data,
and `third_party/updater/BUILD.gn` defines the test-only `old_updater` copy target.
Branded updater tests may include x86 fixtures even in an x64 build. No direct
updater dependency was found in Electron's app/link target declarations; the
transitive GN graph has not been generated or verified. Therefore this package
is not identified as a compiler tool, but the official full sync remains failed.
This read-only analysis authorizes neither skipping dependencies nor changing
antivirus policy. ATL/MFC remains independently missing at the host check.

### Patch readiness before compilation

ATL/MFC is required for the native toolchain, not for the Python patch import
or a combined-source text check. After dependency synchronization is terminal,
verify each required Windows repository's own Git root, pinned revision and clean
working tree; `git -C <directory> rev-parse HEAD` alone can accidentally resolve
the parent Chromium repository when a dependency has not yet checked out.

The pinned official DEPS hook invokes the following action from
`artifacts/native-build/electron44`:

```powershell
python3 src/electron/script/apply_all_patches.py src/electron/patches/config.json
git -C src apply --check C:/Users/karl/Safetynet/docs/native-runtime/chromium-152-webrtc-binder-backport.patch
```

This identifies the upstream action; **do not rerun its unfiltered twenty-target
config on Windows** after the measured ancestor collision. For a fresh checkout,
first run `scripts/native-patch-preflight.mjs`, explicitly verify the Linux-only
fontconfig exclusion, and use a reviewed config containing only the nineteen
required targets with the same official Python importer. Never replay imports
over an already patched tree. The hook does not invoke compilation.
Its exit code is insufficient evidence: missing repositories are skipped with
warnings. Verify imports and upstream references for each required target in
`patches/config.json`. In this pinned checkout, nineteen targets are required:
despite their names, `squirrel.mac` and `ReactiveObjC` are synchronized under
`process_deps`, without a macOS condition. Only `fontconfig` is excluded by its
Chromium `checkout_linux` condition. Do not infer exclusions from directory names.
Save each repository's pre-import HEAD. Both the legacy and checkout-specific
upstream references must resolve to that commit, and it must be an ancestor of
the resulting HEAD. Compare imported commit counts and ordered subjects with
the repository's `.patches` list. Reference existence alone is insufficient:
the importer writes references before `git am`, which can subsequently fail.
Do not blindly rerun the hook after partial failure or reset conflicting hunks.
Seven existing Chromium patches touch backport paths, so the earlier pristine
check does not prove compatibility with Electron's patches. Full `runhooks`, GN,
compilation and native transport acceptance remain separate gates. The backport
addresses denial stability; it does not provide WebRTC content inspection.

### Missing ATL/MFC: explicit administrator step

Inspection found the existing installer at
`C:/Program Files (x86)/Microsoft Visual Studio/Installer/setup.exe`, version
4.10.30.62513. Its Authenticode status was **Valid**, signer Microsoft Corporation.
Existing installation:
`C:/Program Files (x86)/Microsoft Visual Studio/2022/BuildTools`.
The official required component ID is
`Microsoft.VisualStudio.Component.VC.ATLMFC`.

The current agent process is not elevated. No UAC bypass or installer launch was
attempted. To install only this missing component, a user can run the following
in an **administrator PowerShell** and allow the normal installer flow:

```powershell
& 'C:/Program Files (x86)/Microsoft Visual Studio/Installer/setup.exe' modify `
  --installPath 'C:/Program Files (x86)/Microsoft Visual Studio/2022/BuildTools' `
  --add Microsoft.VisualStudio.Component.VC.ATLMFC --passive --norestart
```

Verify afterward using `vswhere.exe -products '*' -requires
Microsoft.VisualStudio.Component.VC.ATLMFC -property installationPath`.
Treat installer exit3010 as restart required; do not claim build readiness until
the component is detected and toolchain checks pass.