Src: Backport latest Chromium CVEs fixes

[kiwibrowser]

Check CVEs from https://www.cvedetails.com/vulnerability-list/vendor_id-1224/product_id-15031/year-2019/Google-Chrome.html that occurred in 2019 and whose fixes are not applied yet in the Kiwi codebase

Reported by @csagan5

[csagan5]

The vulnerabilities which can actually be exploited on Android are very few, I do not follow each of them individually but sometimes you can read about the biggest ones in the news. Most recently:

• https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution_2020-044/
• https://threatpost.com/google-squashes-high-severity-flaws-in-chrome-browser/154424/

There are tools to verify browsers for these problems. See for example: https://www.reddit.com/r/GrapheneOS/comments/ee720p/browserauditcom_vanadium_vs_bromite/ which mentions https://browseraudit.com/

[kiwibrowser]

CVE-2020-6457 - Google Chrome speech recogniser code
Check if feature is active

[kiwibrowser]

Checked CVE-2020-6457, not affected

https://chromium.googlesource.com/chromium/src/+/refs/tags/81.0.4044.112..81.0.4044.113

It's in speech recognizer, a component that Kiwi doesn't use

[kiwibrowser]

Checking others

[kiwibrowser]

Decided to work on a rebase

[LifeIsStrange]

@kiwibrowser do you need help? I think you would benefit from a partnership with e.g brave browser or edge.

[kiwibrowser]

Yes @LifeIsStrange I do need help - and Brave are working on it, as explained on Twitter it's quite complex to follow Chromium releases. The plan is still on 👍

[LifeIsStrange]

@kiwibrowser awesome news to hear! You are making the world a better place 👍

[LifeIsStrange]

@kiwibrowser when will the update be deployed?
Your commit made me curious: https://github.com/kiwibrowser/src/commit/2c669cf9d7c611728f85065a1684eaf5c67446f4

Edit: also what is preventing https://bugs.chromium.org/p/chromium/issues/detail?id=1074710
to be merged?

[kiwibrowser]

I'm working on it, no ETA but as the rebase approaches I want to be sure the pipeline for deployment is implemented and functional.

[kiwibrowser]

Also, there is no need to merge the code from Samsung since it is already in Kiwi in a similar form.

[LifeIsStrange]

@kiwibrowser while you're still around, if you have time to waste with me:
May I ask an exhaustive list of android chromiums with extensions enabled?

I have found thanks to one of your comment that Yandex alpha allow to run e.g uBlock Origin (in dev mode). I wonder if there are pro and cons with their extension implementation vs yours.
Are there other extensions implementations beyond kiwi and yandex?
Which are the three browsers that will be based off kiwi?
Brave is confirmed.
The Samsung employee means that the Samsung browser will get it. Is this the famous very very large OEM?
Which one is the third?
The one I would really like to see is Edge.

Final optional question:
There are many chromiums that have support just for adblock e.g Edge.
How can they enable just adblock and not the other extensions, it's weird. And it's never uBlock...