cef/patch/patches/chrome_runtime.patch

diff --git chrome/app/chrome_main_delegate.cc chrome/app/chrome_main_delegate.cc
index 67428f15a7c50..4e418019327e6 100644
--- chrome/app/chrome_main_delegate.cc
+++ chrome/app/chrome_main_delegate.cc
@@ -42,6 +42,7 @@
 #include "base/trace_event/trace_event_impl.h"
 #include "build/build_config.h"
 #include "build/chromeos_buildflags.h"
+#include "cef/libcef/features/features.h"
 #include "chrome/browser/buildflags.h"
 #include "chrome/browser/chrome_content_browser_client.h"
 #include "chrome/browser/chrome_resource_bundle_helper.h"
@@ -611,6 +612,7 @@ struct MainFunction {
   int (*function)(content::MainFunctionParams);
 };

+#if !BUILDFLAG(ENABLE_CEF)
 // Initializes the user data dir. Must be called before InitializeLocalState().
 void InitializeUserDataDir(base::CommandLine* command_line) {
 #if BUILDFLAG(IS_CHROMEOS_LACROS)
@@ -694,6 +696,7 @@ void InitializeUserDataDir(base::CommandLine* command_line) {
     command_line->AppendSwitchPath(switches::kUserDataDir, user_data_dir);
 #endif  // BUILDFLAG(IS_WIN)
 }
+#endif  // !BUILDFLAG(ENABLE_CEF)

 #if BUILDFLAG(IS_CHROMEOS_LACROS)
 // If Lacros was prelaunched at login screen, this method blocks waiting
@@ -855,6 +858,10 @@ ChromeMainDelegate::~ChromeMainDelegate() {
 ChromeMainDelegate::~ChromeMainDelegate() = default;
 #endif  // !BUILDFLAG(IS_ANDROID)

+void ChromeMainDelegate::CleanupOnUIThread() {
+  memory_system_.reset();
+}
+
 std::optional<int> ChromeMainDelegate::PostEarlyInitialization(
     InvokedIn invoked_in) {
   DUMP_WILL_BE_CHECK(base::ThreadPoolInstance::Get());
@@ -880,7 +887,7 @@ std::optional<int> ChromeMainDelegate::PostEarlyInitialization(
     // future session's metrics.
     DeferBrowserMetrics(user_data_dir);

-#if BUILDFLAG(IS_WIN)
+#if BUILDFLAG(IS_WIN) && !BUILDFLAG(ENABLE_CEF)
     // In the case the process is not the singleton process, the uninstall tasks
     // need to be executed here. A window will be displayed asking to close all
     // running instances.
@@ -1040,7 +1047,8 @@ std::optional<int> ChromeMainDelegate::PostEarlyInitialization(

   // Initializes the resource bundle and determines the locale.
   std::string actual_locale = LoadLocalState(
-      chrome_feature_list_creator, invoked_in_browser->is_running_test);
+      chrome_feature_list_creator, GetResourceBundleDelegate(),
+      invoked_in_browser->is_running_test);
   chrome_feature_list_creator->SetApplicationLocale(actual_locale);
   chrome_feature_list_creator->OverrideCachedUIStrings();

@@ -1057,6 +1065,8 @@ std::optional<int> ChromeMainDelegate::PostEarlyInitialization(
       new net::NetworkChangeNotifierFactoryAndroid());
 #endif

+#if !BUILDFLAG(ENABLE_CEF)
+  // Avoid CEF crash with multi-threaded-message-loop.
   if (base::FeatureList::IsEnabled(
           features::kWriteBasicSystemProfileToPersistentHistogramsFile)) {
     bool record = true;
@@ -1067,6 +1077,7 @@ std::optional<int> ChromeMainDelegate::PostEarlyInitialization(
     if (record)
       chrome_content_browser_client_->startup_data()->RecordCoreSystemProfile();
   }
+#endif  // !BUILDFLAG(ENABLE_CEF)

 #if BUILDFLAG(IS_ANDROID)
   UmaSessionStats::OnStartup();
@@ -1104,8 +1115,8 @@ bool ChromeMainDelegate::ShouldInitializeMojo(InvokedIn invoked_in) {
 void ChromeMainDelegate::CreateThreadPool(std::string_view name) {
   base::ThreadPoolInstance::Create(name);
 // `ChromeMainDelegateAndroid::PreSandboxStartup` creates the profiler a little
-// later.
-#if !BUILDFLAG(IS_ANDROID)
+// later. Same with CEF.
+#if !BUILDFLAG(IS_ANDROID) && !BUILDFLAG(ENABLE_CEF)
   // Start the sampling profiler as early as possible - namely, once the thread
   // pool has been created.
   sampling_profiler_ = std::make_unique<MainThreadStackSamplingProfiler>();
@@ -1517,6 +1528,7 @@ void ChromeMainDelegate::PreSandboxStartup() {
   std::string process_type =
       command_line.GetSwitchValueASCII(switches::kProcessType);

+#if !BUILDFLAG(ENABLE_CEF)
   crash_reporter::InitializeCrashKeys();

 #if BUILDFLAG(IS_POSIX)
@@ -1527,6 +1539,7 @@ void ChromeMainDelegate::PreSandboxStartup() {
   InitMacCrashReporter(command_line, process_type);
   SetUpInstallerPreferences(command_line);
 #endif
+#endif  // !BUILDFLAG(ENABLE_CEF)

 #if BUILDFLAG(IS_WIN)
   child_process_logging::Init();
@@ -1538,6 +1551,7 @@ void ChromeMainDelegate::PreSandboxStartup() {
   base::CPU cpu_info;
 #endif

+#if !BUILDFLAG(ENABLE_CEF)
   // Initialize the user data dir for any process type that needs it.
   bool initialize_user_data_dir = chrome::ProcessNeedsProfileDir(process_type);
 #if BUILDFLAG(IS_CHROMEOS_LACROS)
@@ -1549,6 +1563,7 @@ void ChromeMainDelegate::PreSandboxStartup() {
   if (initialize_user_data_dir) {
     InitializeUserDataDir(base::CommandLine::ForCurrentProcess());
   }
+#endif  // !BUILDFLAG(ENABLE_CEF)

 #if BUILDFLAG(IS_CHROMEOS_LACROS)
   // Generate shared resource file only on browser process. This is to avoid
@@ -1707,7 +1722,8 @@ void ChromeMainDelegate::PreSandboxStartup() {
 #else
     const std::string loaded_locale =
         ui::ResourceBundle::InitSharedInstanceWithLocale(
-            locale, nullptr, ui::ResourceBundle::LOAD_COMMON_RESOURCES);
+            locale, GetResourceBundleDelegate(),
+            ui::ResourceBundle::LOAD_COMMON_RESOURCES);

     base::FilePath resources_pack_path;
     base::PathService::Get(chrome::FILE_RESOURCES_PACK, &resources_pack_path);
@@ -1737,6 +1753,7 @@ void ChromeMainDelegate::PreSandboxStartup() {
     CHECK(!loaded_locale.empty()) << "Locale could not be found for " << locale;
   }

+#if !BUILDFLAG(ENABLE_CEF)
 #if BUILDFLAG(IS_POSIX) && !BUILDFLAG(IS_MAC)
   // Zygote needs to call InitCrashReporter() in RunZygote().
   if (process_type != switches::kZygoteProcess &&
@@ -1773,6 +1790,7 @@ void ChromeMainDelegate::PreSandboxStartup() {
   // After all the platform Breakpads have been initialized, store the command
   // line for crash reporting.
   crash_keys::SetCrashKeysFromCommandLine(command_line);
+#endif  // !BUILDFLAG(ENABLE_CEF)

 #if BUILDFLAG(ENABLE_PDF)
   MaybePatchGdiGetFontData();
@@ -1900,6 +1918,7 @@ void ChromeMainDelegate::ZygoteForked() {
     SetUpProfilingShutdownHandler();
   }

+#if !BUILDFLAG(ENABLE_CEF)
   // Needs to be called after we have chrome::DIR_USER_DATA.  BrowserMain sets
   // this up for the browser process in a different manner.
   const base::CommandLine* command_line =
@@ -1912,6 +1931,7 @@ void ChromeMainDelegate::ZygoteForked() {

   // Reset the command line for the newly spawned process.
   crash_keys::SetCrashKeysFromCommandLine(*command_line);
+#endif  // !BUILDFLAG(ENABLE_CEF)
 }

 #endif  // BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_CHROMEOS)
@@ -2020,6 +2040,7 @@ void ChromeMainDelegate::InitializeMemorySystem() {
                              : memory_system::DispatcherParameters::
                                    AllocationTraceRecorderInclusion::kIgnore;

+  memory_system_ = std::make_unique<memory_system::MemorySystem>();
   memory_system::Initializer()
       .SetGwpAsanParameters(gwp_asan_boost_sampling, process_type)
       .SetProfilingClientParameters(chrome::GetChannel(),
@@ -2027,5 +2048,5 @@ void ChromeMainDelegate::InitializeMemorySystem() {
       .SetDispatcherParameters(memory_system::DispatcherParameters::
                                    PoissonAllocationSamplerInclusion::kEnforce,
                                allocation_recorder_inclusion, process_type)
-      .Initialize(memory_system_);
+      .Initialize(*memory_system_);
 }
diff --git chrome/app/chrome_main_delegate.h chrome/app/chrome_main_delegate.h
index 521d5710b6387..8a5f3e6a312d2 100644
--- chrome/app/chrome_main_delegate.h
+++ chrome/app/chrome_main_delegate.h
@@ -17,6 +17,7 @@
 #include "chrome/common/chrome_content_client.h"
 #include "components/memory_system/memory_system.h"
 #include "content/public/app/content_main_delegate.h"
+#include "ui/base/resource/resource_bundle.h"

 namespace base {
 class CommandLine;
@@ -55,6 +56,8 @@ class ChromeMainDelegate : public content::ContentMainDelegate {

   ~ChromeMainDelegate() override;

+  virtual void CleanupOnUIThread();
+
  protected:
   // content::ContentMainDelegate:
   std::optional<int> BasicStartupComplete() override;
@@ -99,13 +102,17 @@ class ChromeMainDelegate : public content::ContentMainDelegate {

   void InitializeMemorySystem();

+  virtual ui::ResourceBundle::Delegate* GetResourceBundleDelegate() {
+    return nullptr;
+  }
+
   std::unique_ptr<ChromeContentBrowserClient> chrome_content_browser_client_;
   std::unique_ptr<ChromeContentUtilityClient> chrome_content_utility_client_;
   std::unique_ptr<tracing::TracingSamplerProfiler> tracing_sampler_profiler_;

   ChromeContentClient chrome_content_client_;

-  memory_system::MemorySystem memory_system_;
+  std::unique_ptr<memory_system::MemorySystem> memory_system_;

 #if BUILDFLAG(IS_CHROMEOS_LACROS)
   std::unique_ptr<chromeos::LacrosService> lacros_service_;
diff --git chrome/app_shim/BUILD.gn chrome/app_shim/BUILD.gn
index 8bf88eee16370..4c4d31d6a5451 100644
--- chrome/app_shim/BUILD.gn
+++ chrome/app_shim/BUILD.gn
@@ -24,6 +24,7 @@ source_set("app_shim") {
   deps = [
     "//base/allocator:early_zone_registration_apple",
     "//build:chromeos_buildflags",
+    "//cef/libcef/features",
     "//chrome:strings",
     "//chrome/app:command_ids",
     "//chrome/browser/renderer_host:history_swiper",
diff --git chrome/app_shim/chrome_main_app_mode_mac.mm chrome/app_shim/chrome_main_app_mode_mac.mm
index ac1361bd6bc2e..a303ca169c7f7 100644
--- chrome/app_shim/chrome_main_app_mode_mac.mm
+++ chrome/app_shim/chrome_main_app_mode_mac.mm
@@ -35,6 +35,7 @@
 #include "base/task/single_thread_task_executor.h"
 #include "base/task/thread_pool/thread_pool_instance.h"
 #include "base/threading/thread.h"
+#include "cef/libcef/features/features.h"
 #include "chrome/app/chrome_crash_reporter_client.h"
 #include "chrome/app_shim/app_shim_controller.h"
 #include "chrome/app_shim/app_shim_delegate.h"
@@ -171,7 +172,9 @@ int APP_SHIM_ENTRY_POINT_NAME(const app_mode::ChromeAppModeInfo* info) {
         base::FilePath(info->user_data_dir).DirName().DirName().DirName();

     // TODO(crbug.com/40807881): Specify `user_data_dir` to  CrashPad.
+#if !BUILDFLAG(ENABLE_CEF)
     ChromeCrashReporterClient::Create();
+#endif
     crash_reporter::InitializeCrashpad(true, "app_shim");

     base::PathService::OverrideAndCreateIfNeeded(
diff --git chrome/browser/chrome_browser_main.cc chrome/browser/chrome_browser_main.cc
index bf8c5df67c1e3..61bf28f46b423 100644
--- chrome/browser/chrome_browser_main.cc
+++ chrome/browser/chrome_browser_main.cc
@@ -53,6 +53,7 @@
 #include "build/build_config.h"
 #include "build/chromeos_buildflags.h"
 #include "cc/base/switches.h"
+#include "cef/libcef/features/features.h"
 #include "chrome/browser/about_flags.h"
 #include "chrome/browser/active_use_util.h"
 #include "chrome/browser/after_startup_task_utils.h"
@@ -529,7 +530,7 @@ void ProcessSingletonNotificationCallbackImpl(
     return;
   }

-#if BUILDFLAG(IS_WIN)
+#if BUILDFLAG(IS_WIN) && !BUILDFLAG(ENABLE_CEF)
   // The uninstall command-line switch is handled by the origin process; see
   // ChromeMainDelegate::PostEarlyInitialization(...). The other process won't
   // be able to become the singleton process and will display a window asking
@@ -833,7 +834,7 @@ int ChromeBrowserMainParts::PreEarlyInitialization() {
     return content::RESULT_CODE_NORMAL_EXIT;
   }

-#if BUILDFLAG(IS_WIN)
+#if BUILDFLAG(IS_WIN) && !BUILDFLAG(ENABLE_CEF)
   // If we are running stale binaries then relaunch and exit immediately.
   if (upgrade_util::IsRunningOldChrome()) {
     if (!upgrade_util::RelaunchChromeBrowser(
@@ -846,7 +847,7 @@ int ChromeBrowserMainParts::PreEarlyInitialization() {
     // result in browser startup bailing.
     return chrome::RESULT_CODE_NORMAL_EXIT_UPGRADE_RELAUNCHED;
   }
-#endif  // BUILDFLAG(IS_WIN)
+#endif  // BUILDFLAG(IS_WIN) && !BUILDFLAG(ENABLE_CEF)

   return load_local_state_result;
 }
@@ -956,7 +957,7 @@ int ChromeBrowserMainParts::OnLocalStateLoaded(
       browser_process_->local_state());
   platform_management_service->RefreshCache(base::NullCallback());

-#if BUILDFLAG(IS_WIN)
+#if BUILDFLAG(IS_WIN) && !BUILDFLAG(ENABLE_CEF)
   if (first_run::IsChromeFirstRun()) {
     bool stats_default;
     if (GoogleUpdateSettings::GetCollectStatsConsentDefault(&stats_default)) {
@@ -969,7 +970,7 @@ int ChromeBrowserMainParts::OnLocalStateLoaded(
                         : metrics::EnableMetricsDefault::OPT_IN);
     }
   }
-#endif  // BUILDFLAG(IS_WIN)
+#endif  // BUILDFLAG(IS_WIN) && !BUILDFLAG(ENABLE_CEF)

   std::string locale =
       startup_data_->chrome_feature_list_creator()->actual_locale();
@@ -1002,6 +1003,7 @@ int ChromeBrowserMainParts::ApplyFirstRunPrefs() {
 #if !BUILDFLAG(IS_ANDROID) && !BUILDFLAG(IS_CHROMEOS_ASH)
   master_prefs_ = std::make_unique<first_run::MasterPrefs>();

+#if !BUILDFLAG(ENABLE_CEF)
   std::unique_ptr<installer::InitialPreferences> installer_initial_prefs =
       startup_data_->chrome_feature_list_creator()->TakeInitialPrefs();
   if (!installer_initial_prefs)
@@ -1035,6 +1037,7 @@ int ChromeBrowserMainParts::ApplyFirstRunPrefs() {
                             master_prefs_->confirm_to_quit);
   }
 #endif  // BUILDFLAG(IS_MAC)
+#endif  // !BUILDFLAG(ENABLE_CEF)
 #endif  // !BUILDFLAG(IS_ANDROID) && !BUILDFLAG(IS_CHROMEOS_ASH)
   return content::RESULT_CODE_NORMAL_EXIT;
 }
@@ -1096,6 +1099,7 @@ int ChromeBrowserMainParts::PreCreateThreadsImpl() {

   browser_process_->browser_policy_connector()->OnResourceBundleCreated();

+#if !BUILDFLAG(ENABLE_CEF)
 // Android does first run in Java instead of native.
 // Chrome OS has its own out-of-box-experience code.
 #if !BUILDFLAG(IS_ANDROID) && !BUILDFLAG(IS_CHROMEOS_ASH)
@@ -1117,6 +1121,7 @@ int ChromeBrowserMainParts::PreCreateThreadsImpl() {
 #endif  // BUILDFLAG(IS_MAC) || BUILDFLAG(IS_LINUX) || BUILDFLAG(IS_CHROMEOS)
   }
 #endif  // !BUILDFLAG(IS_ANDROID) && !BUILDFLAG(IS_CHROMEOS_ASH)
+#endif  // !BUILDFLAG(ENABLE_CEF)

 #if BUILDFLAG(IS_MAC)
 #if defined(ARCH_CPU_X86_64)
@@ -1479,6 +1484,7 @@ int ChromeBrowserMainParts::PreMainMessageLoopRunImpl() {
   browser_process_->PreMainMessageLoopRun();

 #if BUILDFLAG(IS_WIN)
+#if !BUILDFLAG(ENABLE_CEF)
   // If the command line specifies 'uninstall' then we need to work here
   // unless we detect another chrome browser running.
   if (base::CommandLine::ForCurrentProcess()->HasSwitch(switches::kUninstall)) {
@@ -1490,6 +1496,7 @@ int ChromeBrowserMainParts::PreMainMessageLoopRunImpl() {
     return ChromeBrowserMainPartsWin::HandleIconsCommands(
         *base::CommandLine::ForCurrentProcess());
   }
+#endif  // !BUILDFLAG(ENABLE_CEF)

   ui::SelectFileDialog::SetFactory(
       std::make_unique<ChromeSelectFileDialogFactory>());
@@ -1515,6 +1522,7 @@ int ChromeBrowserMainParts::PreMainMessageLoopRunImpl() {
   }
 #endif  // BUILDFLAG(CHROME_FOR_TESTING)

+#if !BUILDFLAG(ENABLE_CEF)
   if (base::CommandLine::ForCurrentProcess()->HasSwitch(
           switches::kMakeDefaultBrowser)) {
     bool is_managed = g_browser_process->local_state()->IsManagedPreference(
@@ -1528,18 +1536,22 @@ int ChromeBrowserMainParts::PreMainMessageLoopRunImpl() {
                ? static_cast<int>(content::RESULT_CODE_NORMAL_EXIT)
                : static_cast<int>(chrome::RESULT_CODE_SHELL_INTEGRATION_FAILED);
   }
+#endif  // !BUILDFLAG(ENABLE_CEF)

 #if defined(USE_AURA)
   // Make sure aura::Env has been initialized.
   CHECK(aura::Env::GetInstance());
 #endif  // defined(USE_AURA)

+
+#if !BUILDFLAG(ENABLE_CEF)
 #if BUILDFLAG(IS_WIN)
   // We must call DoUpgradeTasks now that we own the browser singleton to
   // finish upgrade tasks (swap) and relaunch if necessary.
   if (upgrade_util::DoUpgradeTasks(*base::CommandLine::ForCurrentProcess()))
     return chrome::RESULT_CODE_NORMAL_EXIT_UPGRADE_RELAUNCHED;
 #endif  // BUILDFLAG(IS_WIN)
+#endif  // !BUILDFLAG(ENABLE_CEF)

 #if !BUILDFLAG(IS_ANDROID) && BUILDFLAG(ENABLE_DOWNGRADE_PROCESSING)
   // Begin relaunch processing immediately if User Data migration is required
@@ -1578,7 +1590,7 @@ int ChromeBrowserMainParts::PreMainMessageLoopRunImpl() {
   }
 #endif  // !BUILDFLAG(IS_ANDROID) && !BUILDFLAG(IS_CHROMEOS)

-#if BUILDFLAG(IS_WIN)
+#if BUILDFLAG(IS_WIN) && !BUILDFLAG(ENABLE_CEF)
   // Check if there is any machine level Chrome installed on the current
   // machine. If yes and the current Chrome process is user level, we do not
   // allow the user level Chrome to run. So we notify the user and uninstall
@@ -1587,7 +1599,7 @@ int ChromeBrowserMainParts::PreMainMessageLoopRunImpl() {
   // obtained but before potentially creating the first run sentinel).
   if (ChromeBrowserMainPartsWin::CheckMachineLevelInstall())
     return chrome::RESULT_CODE_MACHINE_LEVEL_INSTALL_EXISTS;
-#endif  // BUILDFLAG(IS_WIN)
+#endif  // BUILDFLAG(IS_WIN) && !BUILDFLAG(ENABLE_CEF)

   // Desktop construction occurs here, (required before profile creation).
   PreProfileInit();
@@ -1660,6 +1672,7 @@ int ChromeBrowserMainParts::PreMainMessageLoopRunImpl() {
   // Call `PostProfileInit()`and set it up for profiles created later.
   profile_init_manager_ = std::make_unique<ProfileInitManager>(this, profile);

+#if !BUILDFLAG(ENABLE_CEF)
 #if !BUILDFLAG(IS_ANDROID) && !BUILDFLAG(IS_CHROMEOS_ASH)
   // Execute first run specific code after the PrefService has been initialized
   // and preferences have been registered since some of the import code depends
@@ -1699,6 +1712,7 @@ int ChromeBrowserMainParts::PreMainMessageLoopRunImpl() {
         *base::CommandLine::ForCurrentProcess());
   }
 #endif  // BUILDFLAG(IS_WIN)
+#endif  // !BUILDFLAG(ENABLE_CEF)

   // Configure modules that need access to resources.
   net::NetModule::SetResourceProvider(ChromeNetResourceProvider);
@@ -1790,6 +1804,11 @@ int ChromeBrowserMainParts::PreMainMessageLoopRunImpl() {
         g_browser_process->profile_manager()->GetLastOpenedProfiles();
   }
 #endif  // BUILDFLAG(IS_CHROMEOS_ASH)
+
+  // Bypass StartupBrowserCreator and RunLoop creation with CEF.
+  // CEF with the Chrome runtime will create and manage its own RunLoop.
+#if !BUILDFLAG(ENABLE_CEF)
+
   // This step is costly.
   if (browser_creator_->Start(*base::CommandLine::ForCurrentProcess(),
                               base::FilePath(), profile_info,
@@ -1822,11 +1841,14 @@ int ChromeBrowserMainParts::PreMainMessageLoopRunImpl() {

     // Create the RunLoop for MainMessageLoopRun() to use and transfer
     // ownership of the browser's lifetime to the BrowserProcess.
+    // CEF with the Chrome runtime will create and manage its own RunLoop.
     DCHECK(!GetMainRunLoopInstance());
     GetMainRunLoopInstance() = std::make_unique<base::RunLoop>();
     browser_process_->SetQuitClosure(
         GetMainRunLoopInstance()->QuitWhenIdleClosure());
   }
+#endif  // !BUILDFLAG(ENABLE_CEF)
+
   browser_creator_.reset();
 #endif  // !BUILDFLAG(IS_ANDROID)

diff --git chrome/browser/chrome_browser_main_mac.mm chrome/browser/chrome_browser_main_mac.mm
index e26e3625c99c8..c0d4a95607e37 100644
--- chrome/browser/chrome_browser_main_mac.mm
+++ chrome/browser/chrome_browser_main_mac.mm
@@ -20,6 +20,7 @@
 #include "base/path_service.h"
 #include "base/strings/sys_string_conversions.h"
 #include "build/branding_buildflags.h"
+#include "cef/libcef/features/features.h"
 #import "chrome/browser/app_controller_mac.h"
 #include "chrome/browser/apps/app_shim/app_shim_listener.h"
 #include "chrome/browser/browser_process.h"
@@ -125,6 +126,7 @@ void ChromeBrowserMainPartsMac::PreCreateMainMessageLoop() {
   }
 #endif  // !BUILDFLAG(CHROME_FOR_TESTING)

+#if !BUILDFLAG(ENABLE_CEF)
   // Create the app delegate by requesting the shared AppController.
   CHECK_EQ(nil, NSApp.delegate);
   AppController* app_controller = AppController.sharedController;
@@ -133,6 +135,7 @@ void ChromeBrowserMainPartsMac::PreCreateMainMessageLoop() {
   chrome::BuildMainMenu(NSApp, app_controller,
                         l10n_util::GetStringUTF16(IDS_PRODUCT_NAME), false);
   [app_controller mainMenuCreated];
+#endif  // BUILDFLAG(ENABLE_CEF)

   ui::WarmScreenCapture();

@@ -187,5 +190,7 @@ void ChromeBrowserMainPartsMac::PostMainMessageLoopRun() {
 }

 void ChromeBrowserMainPartsMac::DidEndMainMessageLoop() {
+#if !BUILDFLAG(ENABLE_CEF)
   [AppController.sharedController didEndMainMessageLoop];
+#endif
 }
diff --git chrome/browser/chrome_content_browser_client.cc chrome/browser/chrome_content_browser_client.cc
index 4db37945148cb..56a31fecf00a2 100644
--- chrome/browser/chrome_content_browser_client.cc
+++ chrome/browser/chrome_content_browser_client.cc
@@ -48,6 +48,7 @@
 #include "build/build_config.h"
 #include "build/chromeos_buildflags.h"
 #include "build/config/chromebox_for_meetings/buildflags.h"  // PLATFORM_CFM
+#include "cef/libcef/features/features.h"
 #include "chrome/browser/after_startup_task_utils.h"
 #include "chrome/browser/ai/ai_manager_keyed_service_factory.h"
 #include "chrome/browser/app_mode/app_mode_utils.h"
@@ -1543,6 +1544,8 @@ ChromeContentBrowserClient::GetPopupNavigationDelegateFactoryForTesting() {
 }

 ChromeContentBrowserClient::ChromeContentBrowserClient() {
+  keepalive_timer_.reset(new base::OneShotTimer());
+
 #if BUILDFLAG(ENABLE_PLUGINS)
   extra_parts_.push_back(
       std::make_unique<ChromeContentBrowserClientPluginsPart>());
@@ -1580,6 +1583,11 @@ ChromeContentBrowserClient::~ChromeContentBrowserClient() {
   }
 }

+void ChromeContentBrowserClient::CleanupOnUIThread() {
+  DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
+  keepalive_timer_.reset();
+}
+
 // static
 void ChromeContentBrowserClient::RegisterLocalStatePrefs(
     PrefRegistrySimple* registry) {
@@ -3956,28 +3964,25 @@ bool UpdatePreferredColorScheme(WebPreferences* web_prefs,
         web_prefs->preferred_color_scheme;
   }
 #else
-  // Update based on native theme scheme.
-  web_prefs->preferred_color_scheme =
-      ToBlinkPreferredColorScheme(native_theme->GetPreferredColorScheme());
-
-  bool using_different_colored_frame = false;
-  if (Profile* profile =
-          Profile::FromBrowserContext(web_contents->GetBrowserContext())) {
-    if (ThemeService* theme_service =
-            ThemeServiceFactory::GetForProfile(profile)) {
-      using_different_colored_frame = !theme_service->UsingDefaultTheme() ||
-                                      theme_service->GetUserColor().has_value();
-    }
+  auto preferred_color_scheme = native_theme->GetPreferredColorScheme();
+
+  auto* profile = Profile::FromBrowserContext(
+      web_contents->GetBrowserContext());
+  const auto* theme_service = ThemeServiceFactory::GetForProfile(profile);
+
+  const auto browser_color_scheme = theme_service->GetBrowserColorScheme();
+  if (browser_color_scheme != ThemeService::BrowserColorScheme::kSystem) {
+    // Override the native theme.
+    preferred_color_scheme =
+        browser_color_scheme == ThemeService::BrowserColorScheme::kLight
+            ? ui::NativeTheme::PreferredColorScheme::kLight
+            : ui::NativeTheme::PreferredColorScheme::kDark;
   }

-  // Update based on the ColorProvider associated with `web_contents`. Depends
-  // on the browser color mode settings and whether the user profile has set a
-  // custom coloring for the browser ui.
-  web_prefs->preferred_root_scrollbar_color_scheme =
-      web_contents->GetColorMode() == ui::ColorProviderKey::ColorMode::kLight ||
-              using_different_colored_frame
-          ? blink::mojom::PreferredColorScheme::kLight
-          : blink::mojom::PreferredColorScheme::kDark;
+  // Update based on native theme scheme.
+  web_prefs->preferred_color_scheme =
+      web_prefs->preferred_root_scrollbar_color_scheme =
+      ToBlinkPreferredColorScheme(preferred_color_scheme);
 #endif  // BUILDFLAG(IS_ANDROID)

   // Reauth WebUI doesn't support dark mode yet because it shares the dialog
@@ -4748,9 +4753,11 @@ void ChromeContentBrowserClient::BrowserURLHandlerCreated(
                           &search::HandleNewTabURLReverseRewrite);
 #endif  // BUILDFLAG(IS_ANDROID)

+#if !BUILDFLAG(ENABLE_CEF)
   // chrome: & friends.
   handler->AddHandlerPair(&ChromeContentBrowserClient::HandleWebUI,
                           &ChromeContentBrowserClient::HandleWebUIReverse);
+#endif
 }

 base::FilePath ChromeContentBrowserClient::GetDefaultDownloadDirectory() {
@@ -6877,7 +6884,7 @@ void ChromeContentBrowserClient::OnNetworkServiceCreated(
 #endif
 }

-void ChromeContentBrowserClient::ConfigureNetworkContextParams(
+bool ChromeContentBrowserClient::ConfigureNetworkContextParams(
     content::BrowserContext* context,
     bool in_memory,
     const base::FilePath& relative_partition_path,
@@ -6895,6 +6902,8 @@ void ChromeContentBrowserClient::ConfigureNetworkContextParams(
     network_context_params->user_agent = GetUserAgentBasedOnPolicy(context);
     network_context_params->accept_language = GetApplicationLocale();
   }
+
+  return true;
 }

 std::vector<base::FilePath>
@@ -8047,11 +8056,11 @@ void ChromeContentBrowserClient::OnKeepaliveRequestStarted(
   const auto now = base::TimeTicks::Now();
   const auto timeout = GetKeepaliveTimerTimeout(context);
   keepalive_deadline_ = std::max(keepalive_deadline_, now + timeout);
-  if (keepalive_deadline_ > now && !keepalive_timer_.IsRunning()) {
+  if (keepalive_deadline_ > now && !keepalive_timer_->IsRunning()) {
     if (!KeepAliveRegistry::GetInstance()->IsShuttingDown()) {
       DVLOG(1) << "Starting a keepalive timer(" << timeout.InSecondsF()
                << " seconds)";
-      keepalive_timer_.Start(
+      keepalive_timer_->Start(
           FROM_HERE, keepalive_deadline_ - now,
           base::BindOnce(
               &ChromeContentBrowserClient::OnKeepaliveTimerFired,
@@ -8073,7 +8082,8 @@ void ChromeContentBrowserClient::OnKeepaliveRequestFinished() {
   --num_keepalive_requests_;
   if (num_keepalive_requests_ == 0) {
     DVLOG(1) << "Stopping the keepalive timer";
-    keepalive_timer_.Stop();
+    if (keepalive_timer_)
+      keepalive_timer_->Stop();
     // This deletes the keep alive handle attached to the timer function and
     // unblock the shutdown sequence.
   }
@@ -8237,7 +8247,7 @@ void ChromeContentBrowserClient::OnKeepaliveTimerFired(
   const auto now = base::TimeTicks::Now();
   const auto then = keepalive_deadline_;
   if (now < then) {
-    keepalive_timer_.Start(
+    keepalive_timer_->Start(
         FROM_HERE, then - now,
         base::BindOnce(&ChromeContentBrowserClient::OnKeepaliveTimerFired,
                        weak_factory_.GetWeakPtr(),
diff --git chrome/browser/chrome_content_browser_client.h chrome/browser/chrome_content_browser_client.h
index 355d347c1ae84..8b1eb079ab348 100644
--- chrome/browser/chrome_content_browser_client.h
+++ chrome/browser/chrome_content_browser_client.h
@@ -151,6 +151,8 @@ class ChromeContentBrowserClient : public content::ContentBrowserClient {

   ~ChromeContentBrowserClient() override;

+  virtual void CleanupOnUIThread();
+
   // TODO(crbug.com/41356866): This file is about calls from content/ out
   // to chrome/ to get values or notify about events, but both of these
   // functions are from chrome/ to chrome/ and don't involve content/ at all.
@@ -707,7 +709,7 @@ class ChromeContentBrowserClient : public content::ContentBrowserClient {
       override;
   void OnNetworkServiceCreated(
       network::mojom::NetworkService* network_service) override;
-  void ConfigureNetworkContextParams(
+  bool ConfigureNetworkContextParams(
       content::BrowserContext* context,
       bool in_memory,
       const base::FilePath& relative_partition_path,
@@ -1255,7 +1257,7 @@ class ChromeContentBrowserClient : public content::ContentBrowserClient {

 #if !BUILDFLAG(IS_ANDROID)
   uint64_t num_keepalive_requests_ = 0;
-  base::OneShotTimer keepalive_timer_;
+  std::unique_ptr<base::OneShotTimer> keepalive_timer_;
   base::TimeTicks keepalive_deadline_;
 #endif

diff --git chrome/browser/prefs/browser_prefs.cc chrome/browser/prefs/browser_prefs.cc
index 812bb38a0c53e..5fc84ff4b855e 100644
--- chrome/browser/prefs/browser_prefs.cc
+++ chrome/browser/prefs/browser_prefs.cc
@@ -16,6 +16,7 @@
 #include "build/build_config.h"
 #include "build/chromecast_buildflags.h"
 #include "build/chromeos_buildflags.h"
+#include "cef/libcef/features/features.h"
 #include "chrome/browser/about_flags.h"
 #include "chrome/browser/accessibility/accessibility_labels_service.h"
 #include "chrome/browser/accessibility/invert_bubble_prefs.h"
@@ -205,6 +206,10 @@
 #include "chrome/browser/background/background_mode_manager.h"
 #endif

+#if BUILDFLAG(ENABLE_CEF)
+#include "cef/libcef/browser/prefs/browser_prefs.h"
+#endif
+
 #if BUILDFLAG(ENABLE_EXTENSIONS)
 #include "chrome/browser/accessibility/animation_policy_prefs.h"
 #include "chrome/browser/apps/platform_apps/shortcut_manager.h"
@@ -1731,7 +1736,8 @@ void RegisterLocalState(PrefRegistrySimple* registry) {
 #endif  // BUILDFLAG(GOOGLE_CHROME_BRANDING)
 #endif  // BUILDFLAG(IS_WIN)

-#if !BUILDFLAG(IS_ANDROID) && !BUILDFLAG(IS_CHROMEOS)
+#if !BUILDFLAG(IS_ANDROID) && !BUILDFLAG(IS_CHROMEOS) && \
+    BUILDFLAG(ENABLE_DOWNGRADE_PROCESSING)
   downgrade::RegisterPrefs(registry);
 #endif

@@ -1784,6 +1790,11 @@ void RegisterLocalState(PrefRegistrySimple* registry) {

   // This is intentionally last.
   RegisterLocalStatePrefsForMigration(registry);
+
+#if BUILDFLAG(ENABLE_CEF)
+  // Always call this last.
+  browser_prefs::RegisterLocalStatePrefs(registry);
+#endif
 }

 // Register prefs applicable to all profiles.
@@ -2233,6 +2244,10 @@ void RegisterUserProfilePrefs(user_prefs::PrefRegistrySyncable* registry,
                               const std::string& locale) {
   RegisterProfilePrefs(registry, locale);

+#if BUILDFLAG(ENABLE_CEF)
+  browser_prefs::RegisterProfilePrefs(registry);
+#endif
+
 #if BUILDFLAG(IS_ANDROID)
   ::android::RegisterUserProfilePrefs(registry);
 #endif