[Security Settings] Implement HFM Balanced Mode row and other UI [chromium/src : main]

0 views
Skip to first unread message

Zack Han (Gerrit)

unread,
May 22, 2026, 2:40:02 PM (10 days ago) May 22
to Awad Osman, Chromium LUCI CQ, chromium...@chromium.org, andysjl...@chromium.org, chromium-a...@chromium.org, extension...@chromium.org, nwoked...@chromium.org, vakh+safe_br...@chromium.org, xinghui...@chromium.org, zackha...@chromium.org
Attention needed from Awad Osman

Zack Han voted Commit-Queue+1

Commit-Queue+1
Open in Gerrit

Related details

Attention is currently required from:
  • Awad Osman
Submit Requirements:
  • requirement satisfiedCode-Coverage
  • requirement is not satisfiedCode-Owners
  • requirement is not satisfiedCode-Review
  • requirement is not satisfiedReview-Enforcement
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: chromium/src
Gerrit-Branch: main
Gerrit-Change-Id: I20055193849252b26462add8c4ddf6f40c8ee595
Gerrit-Change-Number: 7868825
Gerrit-PatchSet: 6
Gerrit-Owner: Zack Han <zac...@chromium.org>
Gerrit-Reviewer: Awad Osman <aw...@google.com>
Gerrit-Reviewer: Zack Han <zac...@chromium.org>
Gerrit-Attention: Awad Osman <aw...@google.com>
Gerrit-Comment-Date: Fri, 22 May 2026 18:39:53 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: Yes
satisfied_requirement
unsatisfied_requirement
open
diffy

Awad Osman (Gerrit)

unread,
May 22, 2026, 5:17:56 PM (10 days ago) May 22
to Zack Han, Chromium LUCI CQ, chromium...@chromium.org, andysjl...@chromium.org, chromium-a...@chromium.org, extension...@chromium.org, nwoked...@chromium.org, vakh+safe_br...@chromium.org, xinghui...@chromium.org, zackha...@chromium.org
Attention needed from Zack Han

Awad Osman added 7 comments

Commit Message
Line 27, Patchset 6 (Latest):
Awad Osman . unresolved

nit: screencast of general behavior would be nice since this CL makes substantial UI changes.

File chrome/browser/resources/settings/privacy_page/security/security_page_feature_row.html
Line 82, Patchset 6 (Latest): <div style="display: flex; align-items: center; gap: 8px;">
Awad Osman . unresolved

nit: instead of inlining the styles I think it'll be better to give the div an id selector and style the selector instead.

File chrome/browser/resources/settings/privacy_page/security/security_page_v2.html
Line 203, Patchset 6 (Latest): animation: none !important;
Awad Osman . unresolved

Is there a way to use these styles without `!important`?. Here and the one below as well.

File chrome/browser/resources/settings/privacy_page/security/security_page_v2.ts
Line 95, Patchset 6 (Latest): set(path: string, value: unknown): void;
Awad Osman . unresolved

Why is this needed?

Line 369, Patchset 6 (Latest): this.set('showNewBadge_', isNew);
Awad Osman . unresolved

nit: can't you just do `this.showNewBadge_ = isNew`?

File chrome/browser/safe_browsing/safe_browsing_service.cc
Line 217, Patchset 6 (Latest): LOG(ERROR) << "BSS Migration Debug - profile is null!";
Awad Osman . unresolved

Think you left the log statement here by accident.

Line 224, Patchset 6 (Latest): LOG(ERROR) << "BSS Migration Debug - starting checks."
Awad Osman . unresolved

Same as above^

Open in Gerrit

Related details

Attention is currently required from:
  • Zack Han
Submit Requirements:
    • requirement satisfiedCode-Coverage
    • requirement is not satisfiedCode-Owners
    • requirement is not satisfiedCode-Review
    • requirement is not satisfiedNo-Unresolved-Comments
    • requirement is not satisfiedReview-Enforcement
    Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
    Gerrit-MessageType: comment
    Gerrit-Project: chromium/src
    Gerrit-Branch: main
    Gerrit-Change-Id: I20055193849252b26462add8c4ddf6f40c8ee595
    Gerrit-Change-Number: 7868825
    Gerrit-PatchSet: 6
    Gerrit-Owner: Zack Han <zac...@chromium.org>
    Gerrit-Reviewer: Awad Osman <aw...@google.com>
    Gerrit-Reviewer: Zack Han <zac...@chromium.org>
    Gerrit-Attention: Zack Han <zac...@chromium.org>
    Gerrit-Comment-Date: Fri, 22 May 2026 21:17:50 +0000
    Gerrit-HasComments: Yes
    Gerrit-Has-Labels: No
    satisfied_requirement
    unsatisfied_requirement
    open
    diffy

    Zack Han (Gerrit)

    unread,
    May 27, 2026, 3:51:46 PM (5 days ago) May 27
    to Awad Osman, Chromium LUCI CQ, chromium...@chromium.org, andysjl...@chromium.org, chromium-a...@chromium.org, extension...@chromium.org, nwoked...@chromium.org, vakh+safe_br...@chromium.org, xinghui...@chromium.org, zackha...@chromium.org
    Attention needed from Awad Osman

    Zack Han added 8 comments

    Patchset-level comments
    File-level comment, Patchset 8 (Latest):
    Zack Han . resolved

    Thanks Awad!

    Commit Message
    Line 27, Patchset 6:
    Awad Osman . resolved

    nit: screencast of general behavior would be nice since this CL makes substantial UI changes.

    Zack Han

    Done

    File chrome/browser/resources/settings/privacy_page/security/security_page_feature_row.html
    Line 82, Patchset 6: <div style="display: flex; align-items: center; gap: 8px;">
    Awad Osman . resolved

    nit: instead of inlining the styles I think it'll be better to give the div an id selector and style the selector instead.

    Zack Han

    Done

    File chrome/browser/resources/settings/privacy_page/security/security_page_v2.html
    Line 203, Patchset 6: animation: none !important;
    Awad Osman . resolved

    Is there a way to use these styles without `!important`?. Here and the one below as well.

    Zack Han

    Done

    File chrome/browser/resources/settings/privacy_page/security/security_page_v2.ts
    Line 95, Patchset 6: set(path: string, value: unknown): void;
    Awad Osman . resolved

    Why is this needed?

    Zack Han

    Done

    Line 369, Patchset 6: this.set('showNewBadge_', isNew);
    Awad Osman . resolved

    nit: can't you just do `this.showNewBadge_ = isNew`?

    Zack Han

    Done

    File chrome/browser/safe_browsing/safe_browsing_service.cc
    Line 217, Patchset 6: LOG(ERROR) << "BSS Migration Debug - profile is null!";
    Awad Osman . resolved

    Think you left the log statement here by accident.

    Zack Han

    Done

    Line 224, Patchset 6: LOG(ERROR) << "BSS Migration Debug - starting checks."
    Awad Osman . resolved

    Same as above^

    Zack Han

    Done

    Open in Gerrit

    Related details

    Attention is currently required from:
    • Awad Osman
    Submit Requirements:
      • requirement satisfiedCode-Coverage
      • requirement is not satisfiedCode-Owners
      • requirement is not satisfiedCode-Review
      • requirement is not satisfiedReview-Enforcement
      Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
      Gerrit-MessageType: comment
      Gerrit-Project: chromium/src
      Gerrit-Branch: main
      Gerrit-Change-Id: I20055193849252b26462add8c4ddf6f40c8ee595
      Gerrit-Change-Number: 7868825
      Gerrit-PatchSet: 8
      Gerrit-Owner: Zack Han <zac...@chromium.org>
      Gerrit-Reviewer: Awad Osman <aw...@google.com>
      Gerrit-Reviewer: Zack Han <zac...@chromium.org>
      Gerrit-Attention: Awad Osman <aw...@google.com>
      Gerrit-Comment-Date: Wed, 27 May 2026 19:51:40 +0000
      Gerrit-HasComments: Yes
      Gerrit-Has-Labels: No
      Comment-In-Reply-To: Awad Osman <aw...@google.com>
      satisfied_requirement
      unsatisfied_requirement
      open
      diffy

      Zack Han (Gerrit)

      unread,
      May 27, 2026, 3:52:37 PM (5 days ago) May 27
      to Chris Thompson, Awad Osman, Chromium LUCI CQ, chromium...@chromium.org, andysjl...@chromium.org, chromium-a...@chromium.org, extension...@chromium.org, nwoked...@chromium.org, vakh+safe_br...@chromium.org, xinghui...@chromium.org, zackha...@chromium.org
      Attention needed from Awad Osman and Chris Thompson

      Zack Han added 1 comment

      Patchset-level comments
      Zack Han . resolved

      Hi Chris, can you take a look at the c/b/s/https_first_mode... related changes? Thanks!

      Open in Gerrit

      Related details

      Attention is currently required from:
      • Awad Osman
      • Chris Thompson
      Submit Requirements:
      • requirement satisfiedCode-Coverage
      • requirement is not satisfiedCode-Owners
      • requirement is not satisfiedCode-Review
      • requirement is not satisfiedReview-Enforcement
      Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
      Gerrit-MessageType: comment
      Gerrit-Project: chromium/src
      Gerrit-Branch: main
      Gerrit-Change-Id: I20055193849252b26462add8c4ddf6f40c8ee595
      Gerrit-Change-Number: 7868825
      Gerrit-PatchSet: 8
      Gerrit-Owner: Zack Han <zac...@chromium.org>
      Gerrit-Reviewer: Awad Osman <aw...@google.com>
      Gerrit-Reviewer: Chris Thompson <cth...@chromium.org>
      Gerrit-Reviewer: Zack Han <zac...@chromium.org>
      Gerrit-Attention: Chris Thompson <cth...@chromium.org>
      Gerrit-Attention: Awad Osman <aw...@google.com>
      Gerrit-Comment-Date: Wed, 27 May 2026 19:52:31 +0000
      Gerrit-HasComments: Yes
      Gerrit-Has-Labels: No
      satisfied_requirement
      unsatisfied_requirement
      open
      diffy

      Awad Osman (Gerrit)

      unread,
      May 28, 2026, 2:34:34 PM (4 days ago) May 28
      to Zack Han, Chris Thompson, Chromium LUCI CQ, chromium...@chromium.org, andysjl...@chromium.org, chromium-a...@chromium.org, extension...@chromium.org, nwoked...@chromium.org, vakh+safe_br...@chromium.org, xinghui...@chromium.org, zackha...@chromium.org
      Attention needed from Chris Thompson and Zack Han

      Awad Osman voted and added 2 comments

      Votes added by Awad Osman

      Code-Review+1

      2 comments

      Patchset-level comments
      Awad Osman . resolved

      LGTM % pending failing tests get resolved

      File chrome/test/data/webui/settings/security/security_page_v2_test.ts
      Line 60, Patchset 8 (Latest): securityStandardBundleSafeBrowsingDefault: SafeBrowsingSetting.STANDARD,
      Awad Osman . unresolved

      What are these variables used for? Here and in the HATS suite below.

      Open in Gerrit

      Related details

      Attention is currently required from:
      • Chris Thompson
      • Zack Han
      Submit Requirements:
        • requirement satisfiedCode-Coverage
        • requirement is not satisfiedCode-Owners
        • requirement satisfiedCode-Review
        • requirement is not satisfiedNo-Unresolved-Comments
        • requirement satisfiedReview-Enforcement
        Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
        Gerrit-MessageType: comment
        Gerrit-Project: chromium/src
        Gerrit-Branch: main
        Gerrit-Change-Id: I20055193849252b26462add8c4ddf6f40c8ee595
        Gerrit-Change-Number: 7868825
        Gerrit-PatchSet: 8
        Gerrit-Owner: Zack Han <zac...@chromium.org>
        Gerrit-Reviewer: Awad Osman <aw...@google.com>
        Gerrit-Reviewer: Chris Thompson <cth...@chromium.org>
        Gerrit-Reviewer: Zack Han <zac...@chromium.org>
        Gerrit-Attention: Zack Han <zac...@chromium.org>
        Gerrit-Attention: Chris Thompson <cth...@chromium.org>
        Gerrit-Comment-Date: Thu, 28 May 2026 18:34:25 +0000
        Gerrit-HasComments: Yes
        Gerrit-Has-Labels: Yes
        satisfied_requirement
        unsatisfied_requirement
        open
        diffy

        Chris Thompson (Gerrit)

        unread,
        May 28, 2026, 3:33:54 PM (4 days ago) May 28
        to Zack Han, Awad Osman, Chromium LUCI CQ, chromium...@chromium.org, andysjl...@chromium.org, chromium-a...@chromium.org, extension...@chromium.org, nwoked...@chromium.org, vakh+safe_br...@chromium.org, xinghui...@chromium.org, zackha...@chromium.org
        Attention needed from Zack Han

        Chris Thompson added 1 comment

        File chrome/browser/ssl/https_first_mode_settings_tracker.h
        Line 71, Patchset 8 (Parent): // Migrates existing Enhanced bundle users to Balanced HFM and schedules the
        // upgrade Toast if they haven't manually customized HFM.
        void MigrateEnhancedBundleUsersAndMaybeShowToast();
        Chris Thompson . unresolved

        Unintended removal of the logic added in the parent CL?

        Open in Gerrit

        Related details

        Attention is currently required from:
        • Zack Han
        Submit Requirements:
        • requirement satisfiedCode-Coverage
        • requirement is not satisfiedCode-Owners
        • requirement satisfiedCode-Review
        • requirement is not satisfiedNo-Unresolved-Comments
        • requirement satisfiedReview-Enforcement
        Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
        Gerrit-MessageType: comment
        Gerrit-Project: chromium/src
        Gerrit-Branch: main
        Gerrit-Change-Id: I20055193849252b26462add8c4ddf6f40c8ee595
        Gerrit-Change-Number: 7868825
        Gerrit-PatchSet: 8
        Gerrit-Owner: Zack Han <zac...@chromium.org>
        Gerrit-Reviewer: Awad Osman <aw...@google.com>
        Gerrit-Reviewer: Chris Thompson <cth...@chromium.org>
        Gerrit-Reviewer: Zack Han <zac...@chromium.org>
        Gerrit-Attention: Zack Han <zac...@chromium.org>
        Gerrit-Comment-Date: Thu, 28 May 2026 19:33:41 +0000
        Gerrit-HasComments: Yes
        Gerrit-Has-Labels: No
        satisfied_requirement
        unsatisfied_requirement
        open
        diffy

        Zack Han (Gerrit)

        unread,
        May 29, 2026, 2:42:03 PM (3 days ago) May 29
        to Awad Osman, Chris Thompson, Chromium LUCI CQ, chromium...@chromium.org, andysjl...@chromium.org, chromium-a...@chromium.org, extension...@chromium.org, nwoked...@chromium.org, vakh+safe_br...@chromium.org, xinghui...@chromium.org, zackha...@chromium.org
        Attention needed from Awad Osman and Chris Thompson

        Zack Han added 2 comments

        File chrome/browser/ssl/https_first_mode_settings_tracker.h
        Line 71, Patchset 8 (Parent): // Migrates existing Enhanced bundle users to Balanced HFM and schedules the
        // upgrade Toast if they haven't manually customized HFM.
        void MigrateEnhancedBundleUsersAndMaybeShowToast();
        Chris Thompson . resolved

        Unintended removal of the logic added in the parent CL?

        Zack Han

        ooops introduced from rebasing, fixed. thanks!

        File chrome/test/data/webui/settings/security/security_page_v2_test.ts
        Line 60, Patchset 8: securityStandardBundleSafeBrowsingDefault: SafeBrowsingSetting.STANDARD,
        Awad Osman . unresolved

        What are these variables used for? Here and in the HATS suite below.

        Zack Han

        Basically, the browser UI needs to know what the default settings should be when a user clicks on the "Standard" or "Enhanced" card. These values are originally passed from the C++ backend down to the JavaScript frontend through loadTimeData.

        Since we're running isolated frontend WebUI unit tests here, there is no C++ backend running to give us those default values. So, we have to explicitly override those mock values in our suiteSetup so that the JS page behaves exactly like it would in the real browser. Otherwise, the mock page gets initialized with empty defaults, which breaks our test assertions when we click around.

        Note we didn't need these overrides before because HFM used to be completely independent of the security cards clicking Standard or Enhanced didn't change HFM states at all. Now that we are bundling HFM directly into the Standard/Enhanced cards, clicking on a card dynamically queries loadTimeData to find out what default HFM values to set for that card. Since the mock test environment doesn't run the C++ backend to populate those defaults automatically, the card interactions crashed with undefined reads. Overriding them here in suiteSetup ensures the mock page behaves predictably when simulating card clicks. I have added a comment here. Please let me know if this makes sense.

        Open in Gerrit

        Related details

        Attention is currently required from:
        • Awad Osman
        • Chris Thompson
        Submit Requirements:
          • requirement satisfiedCode-Coverage
          • requirement is not satisfiedCode-Owners
          • requirement is not satisfiedCode-Review
          • requirement is not satisfiedNo-Unresolved-Comments
          • requirement is not satisfiedReview-Enforcement
          Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
          Gerrit-MessageType: comment
          Gerrit-Project: chromium/src
          Gerrit-Branch: main
          Gerrit-Change-Id: I20055193849252b26462add8c4ddf6f40c8ee595
          Gerrit-Change-Number: 7868825
          Gerrit-PatchSet: 11
          Gerrit-Owner: Zack Han <zac...@chromium.org>
          Gerrit-Reviewer: Awad Osman <aw...@google.com>
          Gerrit-Reviewer: Chris Thompson <cth...@chromium.org>
          Gerrit-Reviewer: Zack Han <zac...@chromium.org>
          Gerrit-Attention: Chris Thompson <cth...@chromium.org>
          Gerrit-Attention: Awad Osman <aw...@google.com>
          Gerrit-Comment-Date: Fri, 29 May 2026 18:41:53 +0000
          Gerrit-HasComments: Yes
          Gerrit-Has-Labels: No
          Comment-In-Reply-To: Chris Thompson <cth...@chromium.org>
          Comment-In-Reply-To: Awad Osman <aw...@google.com>
          satisfied_requirement
          unsatisfied_requirement
          open
          diffy

          Chris Thompson (Gerrit)

          unread,
          May 29, 2026, 4:31:39 PM (3 days ago) May 29
          to Zack Han, Awad Osman, Chromium LUCI CQ, chromium...@chromium.org, andysjl...@chromium.org, chromium-a...@chromium.org, extension...@chromium.org, nwoked...@chromium.org, vakh+safe_br...@chromium.org, xinghui...@chromium.org, zackha...@chromium.org
          Attention needed from Awad Osman and Zack Han

          Chris Thompson added 2 comments

          File chrome/browser/safe_browsing/safe_browsing_service.cc
          Line 254, Patchset 11 (Latest): // If HFM Balanced Mode features are enabled and available, migrate
          // uncustomized HFM settings to Balanced Mode.
          if (base::FeatureList::IsEnabled(
          safe_browsing::kBundledSecuritySettingsAskBeforeHttp) &&
          !prefs->IsManagedPreference(prefs::kHttpsOnlyModeEnabled) &&
          !prefs->IsManagedPreference(prefs::kHttpsFirstBalancedMode)) {
          if (!prefs->HasPrefPath(prefs::kHttpsOnlyModeEnabled) &&
          !prefs->HasPrefPath(prefs::kHttpsFirstBalancedMode)) {
          prefs->SetBoolean(prefs::kHttpsFirstBalancedMode, true);
          }
          }
          Chris Thompson . unresolved

          Can we put this through the same `MigrateEnhancedBundleUsersAndMaybeShowToast()` path we added in the parent CL? Alternatively, we could add a check here for APP mode users as well.

          File chrome/browser/ssl/https_upgrades_util.cc
          Line 19, Patchset 11 (Latest):#include "components/safe_browsing/core/common/features.h"
          Chris Thompson . unresolved

          Unused?

          Open in Gerrit

          Related details

          Attention is currently required from:
          • Awad Osman
          • Zack Han
          Submit Requirements:
          • requirement satisfiedCode-Coverage
          • requirement is not satisfiedCode-Owners
          • requirement is not satisfiedCode-Review
          • requirement is not satisfiedNo-Unresolved-Comments
          • requirement is not satisfiedReview-Enforcement
          Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
          Gerrit-MessageType: comment
          Gerrit-Project: chromium/src
          Gerrit-Branch: main
          Gerrit-Change-Id: I20055193849252b26462add8c4ddf6f40c8ee595
          Gerrit-Change-Number: 7868825
          Gerrit-PatchSet: 11
          Gerrit-Owner: Zack Han <zac...@chromium.org>
          Gerrit-Reviewer: Awad Osman <aw...@google.com>
          Gerrit-Reviewer: Chris Thompson <cth...@chromium.org>
          Gerrit-Reviewer: Zack Han <zac...@chromium.org>
          Gerrit-Attention: Zack Han <zac...@chromium.org>
          Gerrit-Attention: Awad Osman <aw...@google.com>
          Gerrit-Comment-Date: Fri, 29 May 2026 20:31:28 +0000
          Gerrit-HasComments: Yes
          Gerrit-Has-Labels: No
          satisfied_requirement
          unsatisfied_requirement
          open
          diffy

          Zack Han (Gerrit)

          unread,
          May 29, 2026, 5:43:41 PM (3 days ago) May 29
          to Thomas Lukaszewicz, Awad Osman, Chris Thompson, Chromium LUCI CQ, chromium...@chromium.org, andysjl...@chromium.org, chromium-a...@chromium.org, extension...@chromium.org, nwoked...@chromium.org, vakh+safe_br...@chromium.org, xinghui...@chromium.org, zackha...@chromium.org
          Attention needed from Awad Osman, Chris Thompson and Thomas Lukaszewicz

          Zack Han added 3 comments

          Patchset-level comments
          File-level comment, Patchset 12 (Latest):
          Zack Han . resolved

          Hi Thomas, can you take a look at the file: chrome/browser/ui/webui/settings/ settings_localized_strings_provider.cc Thanks!

          File chrome/browser/safe_browsing/safe_browsing_service.cc
          Line 254, Patchset 11: // If HFM Balanced Mode features are enabled and available, migrate

          // uncustomized HFM settings to Balanced Mode.
          if (base::FeatureList::IsEnabled(
          safe_browsing::kBundledSecuritySettingsAskBeforeHttp) &&
          !prefs->IsManagedPreference(prefs::kHttpsOnlyModeEnabled) &&
          !prefs->IsManagedPreference(prefs::kHttpsFirstBalancedMode)) {
          if (!prefs->HasPrefPath(prefs::kHttpsOnlyModeEnabled) &&
          !prefs->HasPrefPath(prefs::kHttpsFirstBalancedMode)) {
          prefs->SetBoolean(prefs::kHttpsFirstBalancedMode, true);
          }
          }
          Chris Thompson . unresolved

          Can we put this through the same `MigrateEnhancedBundleUsersAndMaybeShowToast()` path we added in the parent CL? Alternatively, we could add a check here for APP mode users as well.

          Zack Han

          Done. Good catch! I removed the duplicate HFM migration block from safe_browsing_service.cc. Since setting the bundle to ENHANCED triggers the pref observer in HttpsFirstModeService, it will naturally run MigrateEnhancedBundleUsersAndMaybeShowToast() which already safely handles the APP check.

          File chrome/browser/ssl/https_upgrades_util.cc
          Line 19, Patchset 11:#include "components/safe_browsing/core/common/features.h"
          Chris Thompson . resolved

          Unused?

          Zack Han

          Done

          Open in Gerrit

          Related details

          Attention is currently required from:
          • Awad Osman
          • Chris Thompson
          • Thomas Lukaszewicz
          Submit Requirements:
          • requirement satisfiedCode-Coverage
          • requirement is not satisfiedCode-Owners
          • requirement is not satisfiedCode-Review
          • requirement is not satisfiedNo-Unresolved-Comments
          • requirement is not satisfiedReview-Enforcement
          Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
          Gerrit-MessageType: comment
          Gerrit-Project: chromium/src
          Gerrit-Branch: main
          Gerrit-Change-Id: I20055193849252b26462add8c4ddf6f40c8ee595
          Gerrit-Change-Number: 7868825
          Gerrit-PatchSet: 12
          Gerrit-Owner: Zack Han <zac...@chromium.org>
          Gerrit-Reviewer: Awad Osman <aw...@google.com>
          Gerrit-Reviewer: Chris Thompson <cth...@chromium.org>
          Gerrit-Reviewer: Thomas Lukaszewicz <tl...@chromium.org>
          Gerrit-Reviewer: Zack Han <zac...@chromium.org>
          Gerrit-Attention: Chris Thompson <cth...@chromium.org>
          Gerrit-Attention: Thomas Lukaszewicz <tl...@chromium.org>
          Gerrit-Attention: Awad Osman <aw...@google.com>
          Gerrit-Comment-Date: Fri, 29 May 2026 21:43:30 +0000
          Gerrit-HasComments: Yes
          Gerrit-Has-Labels: No
          Comment-In-Reply-To: Chris Thompson <cth...@chromium.org>
          satisfied_requirement
          unsatisfied_requirement
          open
          diffy

          Awad Osman (Gerrit)

          unread,
          May 29, 2026, 5:52:16 PM (3 days ago) May 29
          to Zack Han, Thomas Lukaszewicz, Chris Thompson, Chromium LUCI CQ, chromium...@chromium.org, andysjl...@chromium.org, chromium-a...@chromium.org, extension...@chromium.org, nwoked...@chromium.org, vakh+safe_br...@chromium.org, xinghui...@chromium.org, zackha...@chromium.org
          Attention needed from Chris Thompson, Thomas Lukaszewicz and Zack Han

          Awad Osman added 1 comment

          File chrome/test/data/webui/settings/security/security_page_v2_test.ts
          Line 60, Patchset 8: securityStandardBundleSafeBrowsingDefault: SafeBrowsingSetting.STANDARD,
          Awad Osman . resolved

          What are these variables used for? Here and in the HATS suite below.

          Zack Han

          Basically, the browser UI needs to know what the default settings should be when a user clicks on the "Standard" or "Enhanced" card. These values are originally passed from the C++ backend down to the JavaScript frontend through loadTimeData.

          Since we're running isolated frontend WebUI unit tests here, there is no C++ backend running to give us those default values. So, we have to explicitly override those mock values in our suiteSetup so that the JS page behaves exactly like it would in the real browser. Otherwise, the mock page gets initialized with empty defaults, which breaks our test assertions when we click around.

          Note we didn't need these overrides before because HFM used to be completely independent of the security cards clicking Standard or Enhanced didn't change HFM states at all. Now that we are bundling HFM directly into the Standard/Enhanced cards, clicking on a card dynamically queries loadTimeData to find out what default HFM values to set for that card. Since the mock test environment doesn't run the C++ backend to populate those defaults automatically, the card interactions crashed with undefined reads. Overriding them here in suiteSetup ensures the mock page behaves predictably when simulating card clicks. I have added a comment here. Please let me know if this makes sense.

          Awad Osman

          Acknowledged

          Open in Gerrit

          Related details

          Attention is currently required from:
          • Chris Thompson
          • Thomas Lukaszewicz
          • Zack Han
          Submit Requirements:
          • requirement satisfiedCode-Coverage
          • requirement is not satisfiedCode-Owners
          • requirement is not satisfiedCode-Review
          • requirement is not satisfiedNo-Unresolved-Comments
          • requirement is not satisfiedReview-Enforcement
          Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
          Gerrit-MessageType: comment
          Gerrit-Project: chromium/src
          Gerrit-Branch: main
          Gerrit-Change-Id: I20055193849252b26462add8c4ddf6f40c8ee595
          Gerrit-Change-Number: 7868825
          Gerrit-PatchSet: 13
          Gerrit-Owner: Zack Han <zac...@chromium.org>
          Gerrit-Reviewer: Awad Osman <aw...@google.com>
          Gerrit-Reviewer: Chris Thompson <cth...@chromium.org>
          Gerrit-Reviewer: Thomas Lukaszewicz <tl...@chromium.org>
          Gerrit-Reviewer: Zack Han <zac...@chromium.org>
          Gerrit-Attention: Zack Han <zac...@chromium.org>
          Gerrit-Attention: Chris Thompson <cth...@chromium.org>
          Gerrit-Attention: Thomas Lukaszewicz <tl...@chromium.org>
          Gerrit-Comment-Date: Fri, 29 May 2026 21:52:04 +0000
          Gerrit-HasComments: Yes
          Gerrit-Has-Labels: No
          Comment-In-Reply-To: Zack Han <zac...@chromium.org>
          Comment-In-Reply-To: Awad Osman <aw...@google.com>
          satisfied_requirement
          unsatisfied_requirement
          open
          diffy

          Chris Thompson (Gerrit)

          unread,
          May 29, 2026, 5:58:10 PM (3 days ago) May 29
          to Zack Han, Thomas Lukaszewicz, Awad Osman, Chromium LUCI CQ, chromium...@chromium.org, andysjl...@chromium.org, chromium-a...@chromium.org, extension...@chromium.org, nwoked...@chromium.org, vakh+safe_br...@chromium.org, xinghui...@chromium.org, zackha...@chromium.org
          Attention needed from Thomas Lukaszewicz and Zack Han

          Chris Thompson voted and added 1 comment

          Votes added by Chris Thompson

          Code-Review+1

          1 comment

          File chrome/browser/safe_browsing/safe_browsing_service.cc
          Line 254, Patchset 11: // If HFM Balanced Mode features are enabled and available, migrate
          // uncustomized HFM settings to Balanced Mode.
          if (base::FeatureList::IsEnabled(
          safe_browsing::kBundledSecuritySettingsAskBeforeHttp) &&
          !prefs->IsManagedPreference(prefs::kHttpsOnlyModeEnabled) &&
          !prefs->IsManagedPreference(prefs::kHttpsFirstBalancedMode)) {
          if (!prefs->HasPrefPath(prefs::kHttpsOnlyModeEnabled) &&
          !prefs->HasPrefPath(prefs::kHttpsFirstBalancedMode)) {
          prefs->SetBoolean(prefs::kHttpsFirstBalancedMode, true);
          }
          }
          Chris Thompson . resolved

          Can we put this through the same `MigrateEnhancedBundleUsersAndMaybeShowToast()` path we added in the parent CL? Alternatively, we could add a check here for APP mode users as well.

          Zack Han

          Done. Good catch! I removed the duplicate HFM migration block from safe_browsing_service.cc. Since setting the bundle to ENHANCED triggers the pref observer in HttpsFirstModeService, it will naturally run MigrateEnhancedBundleUsersAndMaybeShowToast() which already safely handles the APP check.

          Chris Thompson

          Sounds good! Resolving.

          Open in Gerrit

          Related details

          Attention is currently required from:
          • Thomas Lukaszewicz
          • Zack Han
          Submit Requirements:
            • requirement satisfiedCode-Coverage
            • requirement is not satisfiedCode-Owners
            • requirement satisfiedCode-Review
            • requirement satisfiedReview-Enforcement
            Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
            Gerrit-MessageType: comment
            Gerrit-Project: chromium/src
            Gerrit-Branch: main
            Gerrit-Change-Id: I20055193849252b26462add8c4ddf6f40c8ee595
            Gerrit-Change-Number: 7868825
            Gerrit-PatchSet: 13
            Gerrit-Owner: Zack Han <zac...@chromium.org>
            Gerrit-Reviewer: Awad Osman <aw...@google.com>
            Gerrit-Reviewer: Chris Thompson <cth...@chromium.org>
            Gerrit-Reviewer: Thomas Lukaszewicz <tl...@chromium.org>
            Gerrit-Reviewer: Zack Han <zac...@chromium.org>
            Gerrit-Attention: Zack Han <zac...@chromium.org>
            Gerrit-Attention: Thomas Lukaszewicz <tl...@chromium.org>
            Gerrit-Comment-Date: Fri, 29 May 2026 21:57:57 +0000
            Gerrit-HasComments: Yes
            Gerrit-Has-Labels: Yes
            Comment-In-Reply-To: Zack Han <zac...@chromium.org>
            Comment-In-Reply-To: Chris Thompson <cth...@chromium.org>
            satisfied_requirement
            unsatisfied_requirement
            open
            diffy

            Thomas Lukaszewicz (Gerrit)

            unread,
            May 31, 2026, 2:36:28 PM (yesterday) May 31
            to Zack Han, Chris Thompson, Awad Osman, Chromium LUCI CQ, chromium...@chromium.org, andysjl...@chromium.org, chromium-a...@chromium.org, extension...@chromium.org, nwoked...@chromium.org, vakh+safe_br...@chromium.org, xinghui...@chromium.org, zackha...@chromium.org
            Attention needed from Chris Thompson and Zack Han

            Thomas Lukaszewicz added 1 comment

            File chrome/browser/safe_browsing/security_settings_bundle_toast_helper.cc
            Line 46, Patchset 14 (Latest): if (toast_state !=
            static_cast<int>(SecuritySettingsBundleToastState::kPending) ||
            toast_state ==
            static_cast<int>(SecuritySettingsBundleToastState::kShown)) {
            Thomas Lukaszewicz . unresolved

            Is this right? If
            ```
            toast_state != SecuritySettingsBundleToastState::kPending
            ```
            then I believe the second condition is irrelevant

            Open in Gerrit

            Related details

            Attention is currently required from:
            • Chris Thompson
            • Zack Han
            Submit Requirements:
              • requirement satisfiedCode-Coverage
              • requirement is not satisfiedCode-Owners
              • requirement is not satisfiedCode-Review
              • requirement is not satisfiedNo-Unresolved-Comments
              • requirement is not satisfiedReview-Enforcement
              Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
              Gerrit-MessageType: comment
              Gerrit-Project: chromium/src
              Gerrit-Branch: main
              Gerrit-Change-Id: I20055193849252b26462add8c4ddf6f40c8ee595
              Gerrit-Change-Number: 7868825
              Gerrit-PatchSet: 14
              Gerrit-Owner: Zack Han <zac...@chromium.org>
              Gerrit-Reviewer: Awad Osman <aw...@google.com>
              Gerrit-Reviewer: Chris Thompson <cth...@chromium.org>
              Gerrit-Reviewer: Thomas Lukaszewicz <tl...@chromium.org>
              Gerrit-Reviewer: Zack Han <zac...@chromium.org>
              Gerrit-Attention: Zack Han <zac...@chromium.org>
              Gerrit-Attention: Chris Thompson <cth...@chromium.org>
              Gerrit-Comment-Date: Sun, 31 May 2026 18:35:56 +0000
              Gerrit-HasComments: Yes
              Gerrit-Has-Labels: No
              satisfied_requirement
              unsatisfied_requirement
              open
              diffy

              Zack Han (Gerrit)

              unread,
              12:45 PM (4 hours ago) 12:45 PM
              to Chris Thompson, Thomas Lukaszewicz, Awad Osman, Chromium LUCI CQ, chromium...@chromium.org, andysjl...@chromium.org, chromium-a...@chromium.org, extension...@chromium.org, nwoked...@chromium.org, vakh+safe_br...@chromium.org, xinghui...@chromium.org, zackha...@chromium.org
              Attention needed from Chris Thompson and Thomas Lukaszewicz

              Zack Han added 2 comments

              Patchset-level comments
              File-level comment, Patchset 15 (Latest):
              Zack Han . resolved

              Thank you!!

              File chrome/browser/safe_browsing/security_settings_bundle_toast_helper.cc
              Line 46, Patchset 14: if (toast_state !=

              static_cast<int>(SecuritySettingsBundleToastState::kPending) ||
              toast_state ==
              static_cast<int>(SecuritySettingsBundleToastState::kShown)) {
              Thomas Lukaszewicz . resolved

              Is this right? If
              ```
              toast_state != SecuritySettingsBundleToastState::kPending
              ```
              then I believe the second condition is irrelevant

              Zack Han

              Yeah, the second condition was redundant! I have removed it. Thanks for catching it.

              Open in Gerrit

              Related details

              Attention is currently required from:
              • Chris Thompson
              • Thomas Lukaszewicz
              Submit Requirements:
                • requirement satisfiedCode-Coverage
                • requirement is not satisfiedCode-Owners
                • requirement is not satisfiedCode-Review
                • requirement is not satisfiedReview-Enforcement
                Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
                Gerrit-MessageType: comment
                Gerrit-Project: chromium/src
                Gerrit-Branch: main
                Gerrit-Change-Id: I20055193849252b26462add8c4ddf6f40c8ee595
                Gerrit-Change-Number: 7868825
                Gerrit-PatchSet: 15
                Gerrit-Owner: Zack Han <zac...@chromium.org>
                Gerrit-Reviewer: Awad Osman <aw...@google.com>
                Gerrit-Reviewer: Chris Thompson <cth...@chromium.org>
                Gerrit-Reviewer: Thomas Lukaszewicz <tl...@chromium.org>
                Gerrit-Reviewer: Zack Han <zac...@chromium.org>
                Gerrit-Attention: Chris Thompson <cth...@chromium.org>
                Gerrit-Attention: Thomas Lukaszewicz <tl...@chromium.org>
                Gerrit-Comment-Date: Mon, 01 Jun 2026 16:45:33 +0000
                Gerrit-HasComments: Yes
                Gerrit-Has-Labels: No
                Comment-In-Reply-To: Thomas Lukaszewicz <tl...@chromium.org>
                satisfied_requirement
                unsatisfied_requirement
                open
                diffy

                Thomas Lukaszewicz (Gerrit)

                unread,
                1:56 PM (3 hours ago) 1:56 PM
                to Zack Han, Chris Thompson, Awad Osman, Chromium LUCI CQ, chromium...@chromium.org, andysjl...@chromium.org, chromium-a...@chromium.org, extension...@chromium.org, nwoked...@chromium.org, vakh+safe_br...@chromium.org, xinghui...@chromium.org, zackha...@chromium.org
                Attention needed from Chris Thompson and Zack Han

                Thomas Lukaszewicz voted and added 1 comment

                Votes added by Thomas Lukaszewicz

                Code-Review+1

                1 comment

                Patchset-level comments
                Thomas Lukaszewicz . resolved

                lgtm

                Open in Gerrit

                Related details

                Attention is currently required from:
                • Chris Thompson
                • Zack Han
                Submit Requirements:
                • requirement satisfiedCode-Coverage
                • requirement satisfiedCode-Owners
                • requirement satisfiedCode-Review
                • requirement satisfiedReview-Enforcement
                Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
                Gerrit-MessageType: comment
                Gerrit-Project: chromium/src
                Gerrit-Branch: main
                Gerrit-Change-Id: I20055193849252b26462add8c4ddf6f40c8ee595
                Gerrit-Change-Number: 7868825
                Gerrit-PatchSet: 15
                Gerrit-Owner: Zack Han <zac...@chromium.org>
                Gerrit-Reviewer: Awad Osman <aw...@google.com>
                Gerrit-Reviewer: Chris Thompson <cth...@chromium.org>
                Gerrit-Reviewer: Thomas Lukaszewicz <tl...@chromium.org>
                Gerrit-Reviewer: Zack Han <zac...@chromium.org>
                Gerrit-Attention: Zack Han <zac...@chromium.org>
                Gerrit-Attention: Chris Thompson <cth...@chromium.org>
                Gerrit-Comment-Date: Mon, 01 Jun 2026 17:56:15 +0000
                Gerrit-HasComments: Yes
                Gerrit-Has-Labels: Yes
                satisfied_requirement
                open
                diffy

                Zack Han (Gerrit)

                unread,
                2:40 PM (2 hours ago) 2:40 PM
                to Thomas Lukaszewicz, Chris Thompson, Awad Osman, Chromium LUCI CQ, chromium...@chromium.org, andysjl...@chromium.org, chromium-a...@chromium.org, extension...@chromium.org, nwoked...@chromium.org, vakh+safe_br...@chromium.org, xinghui...@chromium.org, zackha...@chromium.org
                Attention needed from Chris Thompson

                Zack Han voted Commit-Queue+2

                Commit-Queue+2
                Open in Gerrit

                Related details

                Attention is currently required from:
                • Chris Thompson
                Submit Requirements:
                • requirement satisfiedCode-Coverage
                • requirement satisfiedCode-Owners
                • requirement satisfiedCode-Review
                • requirement satisfiedReview-Enforcement
                Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
                Gerrit-MessageType: comment
                Gerrit-Project: chromium/src
                Gerrit-Branch: main
                Gerrit-Change-Id: I20055193849252b26462add8c4ddf6f40c8ee595
                Gerrit-Change-Number: 7868825
                Gerrit-PatchSet: 15
                Gerrit-Owner: Zack Han <zac...@chromium.org>
                Gerrit-Reviewer: Awad Osman <aw...@google.com>
                Gerrit-Reviewer: Chris Thompson <cth...@chromium.org>
                Gerrit-Reviewer: Thomas Lukaszewicz <tl...@chromium.org>
                Gerrit-Reviewer: Zack Han <zac...@chromium.org>
                Gerrit-Attention: Chris Thompson <cth...@chromium.org>
                Gerrit-Comment-Date: Mon, 01 Jun 2026 18:40:07 +0000
                Gerrit-HasComments: No
                Gerrit-Has-Labels: Yes
                satisfied_requirement
                open
                diffy
                Reply all
                Reply to author
                Forward
                0 new messages