diff --git third_party/crashpad/crashpad/client/prune_crash_reports.cc third_party/crashpad/crashpad/client/prune_crash_reports.cc
index 3aaaeee..d99fcb4 100644
--- third_party/crashpad/crashpad/client/prune_crash_reports.cc
+++ third_party/crashpad/crashpad/client/prune_crash_reports.cc
@@ -67,13 +67,19 @@ void PruneCrashReportDatabase(CrashReportDatabase* database,
 }
 
 // static
-std::unique_ptr<PruneCondition> PruneCondition::GetDefault() {
+std::unique_ptr<PruneCondition> PruneCondition::GetDefault(
+    int max_size_in_mb,
+    int max_age_in_days) {
   // DatabaseSizePruneCondition must be the LHS so that it is always evaluated,
   // due to the short-circuting behavior of BinaryPruneCondition.
+  if (max_size_in_mb <= 0)
+    max_size_in_mb = 128;
+  if (max_age_in_days <= 0)
+    max_age_in_days = 365;
   return base::WrapUnique(
       new BinaryPruneCondition(BinaryPruneCondition::OR,
-                               new DatabaseSizePruneCondition(1024 * 128),
-                               new AgePruneCondition(365)));
+                               new DatabaseSizePruneCondition(max_size_in_mb),
+                               new AgePruneCondition(max_age_in_days)));
 }
 
 static const time_t kSecondsInDay = 60 * 60 * 24;
diff --git third_party/crashpad/crashpad/client/prune_crash_reports.h third_party/crashpad/crashpad/client/prune_crash_reports.h
index 6dac5f3..34f5ee1 100644
--- third_party/crashpad/crashpad/client/prune_crash_reports.h
+++ third_party/crashpad/crashpad/client/prune_crash_reports.h
@@ -57,7 +57,8 @@ class PruneCondition {
   //! of 128 MB.
   //!
   //! \return A PruneCondition for use with PruneCrashReportDatabase().
-  static std::unique_ptr<PruneCondition> GetDefault();
+  static std::unique_ptr<PruneCondition> GetDefault(int max_size_in_mb,
+                                                    int max_age_in_days);
 
   virtual ~PruneCondition() {}
 
diff --git third_party/crashpad/crashpad/client/settings.cc third_party/crashpad/crashpad/client/settings.cc
index 15d16f2..5e8eadf 100644
--- third_party/crashpad/crashpad/client/settings.cc
+++ third_party/crashpad/crashpad/client/settings.cc
@@ -38,7 +38,7 @@ void ScopedLockedFileHandleTraits::Free(FileHandle handle) {
 
 struct Settings::Data {
   static const uint32_t kSettingsMagic = 'CPds';
-  static const uint32_t kSettingsVersion = 1;
+  static const uint32_t kSettingsVersion = 2;
 
   enum Options : uint32_t {
     kUploadsEnabled = 1 << 0,
@@ -49,6 +49,9 @@ struct Settings::Data {
            options(0),
            padding_0(0),
            last_upload_attempt_time(0),
+           next_upload_attempt_time(0),
+           backoff_step(0),
+           padding_1(0),
            client_id() {}
 
   uint32_t magic;
@@ -56,6 +59,9 @@ struct Settings::Data {
   uint32_t options;
   uint32_t padding_0;
   int64_t last_upload_attempt_time;  // time_t
+  int64_t next_upload_attempt_time;  // time_t
+  uint32_t backoff_step;
+  uint32_t padding_1;
   UUID client_id;
 };
 
@@ -141,6 +147,56 @@ bool Settings::SetLastUploadAttemptTime(time_t time) {
   return WriteSettings(handle.get(), settings);
 }
 
+bool Settings::GetNextUploadAttemptTime(time_t* time) {
+  DCHECK(initialized_.is_valid());
+
+  Data settings;
+  if (!OpenAndReadSettings(&settings))
+    return false;
+
+  *time = InRangeCast<time_t>(settings.next_upload_attempt_time,
+                              std::numeric_limits<time_t>::max());
+  return true;
+}
+
+bool Settings::SetNextUploadAttemptTime(time_t time) {
+  DCHECK(initialized_.is_valid());
+
+  Data settings;
+  ScopedLockedFileHandle handle = OpenForWritingAndReadSettings(&settings);
+  if (!handle.is_valid())
+    return false;
+
+  settings.next_upload_attempt_time = InRangeCast<int64_t>(time, 0);
+
+  return WriteSettings(handle.get(), settings);
+}
+
+bool Settings::GetBackoffStep(int* step) {
+  DCHECK(initialized_.is_valid());
+
+  Data settings;
+  if (!OpenAndReadSettings(&settings))
+    return false;
+
+  *step = InRangeCast<int>(settings.backoff_step,
+                           std::numeric_limits<int>::max());
+  return true;
+}
+
+bool Settings::SetBackoffStep(int step) {
+  DCHECK(initialized_.is_valid());
+
+  Data settings;
+  ScopedLockedFileHandle handle = OpenForWritingAndReadSettings(&settings);
+  if (!handle.is_valid())
+    return false;
+
+  settings.backoff_step = InRangeCast<uint32_t>(step, 0);
+
+  return WriteSettings(handle.get(), settings);
+}
+
 // static
 Settings::ScopedLockedFileHandle Settings::MakeScopedLockedFileHandle(
     FileHandle file,
diff --git third_party/crashpad/crashpad/client/settings.h third_party/crashpad/crashpad/client/settings.h
index b64f74f..0c3c22e 100644
--- third_party/crashpad/crashpad/client/settings.h
+++ third_party/crashpad/crashpad/client/settings.h
@@ -102,6 +102,11 @@ class Settings {
   //!     error logged.
   bool SetLastUploadAttemptTime(time_t time);
 
+  bool GetNextUploadAttemptTime(time_t* time);
+  bool SetNextUploadAttemptTime(time_t time);
+  bool GetBackoffStep(int* step);
+  bool SetBackoffStep(int step);
+
  private:
   struct Data;
 
diff --git third_party/crashpad/crashpad/handler/crash_report_upload_thread.h third_party/crashpad/crashpad/handler/crash_report_upload_thread.h
index c769efe..daec6cd 100644
--- third_party/crashpad/crashpad/handler/crash_report_upload_thread.h
+++ third_party/crashpad/crashpad/handler/crash_report_upload_thread.h
@@ -89,7 +89,7 @@ class CrashReportUploadThread : public WorkerThread::Delegate {
   //! This method may be called from any thread.
   void ReportPending(const UUID& report_uuid);
 
- private:
+ protected:
   //! \brief The result code from UploadReport().
   enum class UploadResult {
     //! \brief The crash report was uploaded successfully.
@@ -117,7 +117,7 @@ class CrashReportUploadThread : public WorkerThread::Delegate {
   //! object was constructed with \a watch_pending_reports, it will also scan
   //! the crash report database for other pending reports, and process those as
   //! well.
-  void ProcessPendingReports();
+  virtual void ProcessPendingReports();
 
   //! \brief Processes a single pending report from the database.
   //!
@@ -131,7 +131,7 @@ class CrashReportUploadThread : public WorkerThread::Delegate {
   //! remain in the “pending” state. If the upload fails and no more retries are
   //! desired, or report upload is disabled, it will be marked as “completed” in
   //! the database without ever having been uploaded.
-  void ProcessPendingReport(const CrashReportDatabase::Report& report);
+  virtual void ProcessPendingReport(const CrashReportDatabase::Report& report);
 
   //! \brief Attempts to upload a crash report.
   //!
diff --git third_party/crashpad/crashpad/handler/handler_main.cc third_party/crashpad/crashpad/handler/handler_main.cc
index e6d05e2..93e5eb1 100644
--- third_party/crashpad/crashpad/handler/handler_main.cc
+++ third_party/crashpad/crashpad/handler/handler_main.cc
@@ -35,8 +35,10 @@
 #include "base/metrics/persistent_histogram_allocator.h"
 #include "base/scoped_generic.h"
 #include "base/strings/stringprintf.h"
+#include "base/strings/string_number_conversions.h"
 #include "base/strings/utf_string_conversions.h"
 #include "build/build_config.h"
+#include "cef/libcef/features/features.h"
 #include "client/crash_report_database.h"
 #include "client/crashpad_client.h"
 #include "client/crashpad_info.h"
@@ -76,6 +78,10 @@
 #include "util/win/session_end_watcher.h"
 #endif  // OS_MACOSX
 
+#if BUILDFLAG(ENABLE_CEF)
+#include "cef/libcef/common/cef_crash_report_upload_thread.h"
+#endif
+
 namespace crashpad {
 
 namespace {
@@ -147,6 +153,9 @@ struct Options {
   bool periodic_tasks;
   bool rate_limit;
   bool upload_gzip;
+  int max_uploads;
+  int max_database_size;
+  int max_database_age;
 };
 
 // Splits |key_value| on '=' and inserts the resulting key and value into |map|.
@@ -430,6 +439,9 @@ int HandlerMain(int argc,
     kOptionResetOwnCrashExceptionPortToSystemDefault,
 #endif  // OS_MACOSX
     kOptionURL,
+    kOptionMaxUploads,
+    kOptionMaxDatabaseSize,
+    kOptionMaxDatabaseAge,
 
     // Standard options.
     kOptionHelp = -2,
@@ -476,6 +488,9 @@ int HandlerMain(int argc,
     {"url", required_argument, nullptr, kOptionURL},
     {"help", no_argument, nullptr, kOptionHelp},
     {"version", no_argument, nullptr, kOptionVersion},
+    {"max-uploads", required_argument, nullptr, kOptionMaxUploads},
+    {"max-db-size", required_argument, nullptr, kOptionMaxDatabaseSize},
+    {"max-db-age", required_argument, nullptr, kOptionMaxDatabaseAge},
     {nullptr, 0, nullptr, 0},
   };
 
@@ -575,6 +590,27 @@ int HandlerMain(int argc,
         options.url = optarg;
         break;
       }
+      case kOptionMaxUploads: {
+        if (base::StringToInt(optarg, &options.max_uploads)) {
+          if (options.max_uploads < 0)
+            options.max_uploads = 0;
+        }
+        break;
+      }
+      case kOptionMaxDatabaseSize: {
+        if (base::StringToInt(optarg, &options.max_database_size)) {
+          if (options.max_database_size < 0)
+            options.max_database_size = 0;
+        }
+        break;
+      }
+      case kOptionMaxDatabaseAge: {
+        if (base::StringToInt(optarg, &options.max_database_age)) {
+          if (options.max_database_age < 0)
+            options.max_database_age = 0;
+        }
+        break;
+      }
       case kOptionHelp: {
         Usage(me);
         MetricsRecordExit(Metrics::LifetimeMilestone::kExitedEarly);
@@ -734,17 +770,27 @@ int HandlerMain(int argc,
   // TODO(scottmg): options.rate_limit should be removed when we have a
   // configurable database setting to control upload limiting.
   // See https://crashpad.chromium.org/bug/23.
+#if BUILDFLAG(ENABLE_CEF)
+  CefCrashReportUploadThread upload_thread(database.get(),
+                                           options.url,
+                                           options.periodic_tasks,
+                                           options.rate_limit,
+                                           options.upload_gzip,
+                                           options.max_uploads);
+#else
   CrashReportUploadThread upload_thread(database.get(),
                                         options.url,
                                         options.periodic_tasks,
                                         options.rate_limit,
                                         options.upload_gzip);
+#endif
   upload_thread.Start();
 
   std::unique_ptr<PruneCrashReportThread> prune_thread;
   if (options.periodic_tasks) {
     prune_thread.reset(new PruneCrashReportThread(
-        database.get(), PruneCondition::GetDefault()));
+        database.get(), PruneCondition::GetDefault(options.max_database_size,
+                                                   options.max_database_age)));
     prune_thread->Start();
   }