diff --git a/patch/patch.cfg b/patch/patch.cfg index e431036c2..b8d7a06ec 100644 --- a/patch/patch.cfg +++ b/patch/patch.cfg @@ -344,4 +344,9 @@ patches = [ # https://bitbucket.org/chromiumembedded/cef/issues/1947 'name': 'extensions_1947', }, + { + # Don't enable sandbox::MITIGATION_STRICT_HANDLE_CHECKS in WinRT apps. + # https://bitbucket.org/chromiumembedded/cef/issues/2274 + 'name': 'win_rt_2274', + }, ] diff --git a/patch/patches/win_rt_2274.patch b/patch/patches/win_rt_2274.patch new file mode 100644 index 000000000..0bcb71c31 --- /dev/null +++ b/patch/patches/win_rt_2274.patch @@ -0,0 +1,18 @@ +diff --git content/common/sandbox_win.cc content/common/sandbox_win.cc +index a98c8bd7646b..7c100ff20d34 100644 +--- content/common/sandbox_win.cc ++++ content/common/sandbox_win.cc +@@ -782,8 +782,11 @@ sandbox::ResultCode StartSandboxedProcess( + #endif + + // Post-startup mitigations. +- mitigations = sandbox::MITIGATION_STRICT_HANDLE_CHECKS | +- sandbox::MITIGATION_DLL_SEARCH_ORDER; ++ mitigations = sandbox::MITIGATION_DLL_SEARCH_ORDER; ++ if (!browser_command_line.HasSwitch("win-rt-app")) { ++ // Don't enable this mitigation in WinRT apps. See issue #2274. ++ mitigations |= sandbox::MITIGATION_STRICT_HANDLE_CHECKS; ++ } + if (base::FeatureList::IsEnabled(features::kWinSboxForceMsSigned)) + mitigations |= sandbox::MITIGATION_FORCE_MS_SIGNED_BINS; +