[WizardCM]

Description

Update CEF from 127/6533 to 150/7871, including Flatpak.

Important

• This PR contains obs-browser: Update to 2.27.0 #13890 to make testing easier. They should be reviewed separately.

• Full details at Enable support for CEF 6613+ (Chrome 128 to 150) and Chrome Runtime obs-browser#523

Motivation and Context

Up to date dependencies are healthy.

How Has This Been Tested?

Launched on Windows 10.

Types of changes

• Tweak (non-breaking change to improve existing functionality)

Checklist:

• I have read the contributing document.
• My code has been run through clang-format.
• My code follows the project's style guidelines
• My code is not on the master branch.
• My code has been tested.
• All commit messages are properly formatted and commits squashed where appropriate.
• I have included updates to all appropriate documentation.

[WizardCM]

Pushed a new update.

Changes:

• Include Allow WebSocket requests over the network obs-browser#538
• Fixed Windows ARM64 CEF wrapper
• Rebased on latest obs-studio master

[tytan652]

LGTM for the Flatpak side

[Dan-Shields]

I have tested our suite of broadcast web graphics on this update and we're seeing no new issues. Confirmed that the issue obs-studio#531 fixes is still present and that patch works. Great work on the update!

[Danny3]

Has this ever been audited or verified for privacy and security?

Considering that everyone knows how many things that are against user's privacy and security Google has put into Chromium and that there are even projects like Thorium and Ungoogled-Chromium trying to undo that kind of malware.

Can't you, at least use a cleaner version like from these projects?

[indep-arg]

Late to this, but nice to see CEF moving again. Since browser sources are mostly used for third party overlays, a few questions in case they aren't tracked anywhere:

1. Security fixes: two V8 zero-days were fixed after Chrome 150 shipped, CVE-2026-85046 in 152.0.7977.82 and CVE-2026-87491 in 153.0.8010.36, and Google says both were exploited in the wild. Does the CEF 150 build here include those fixes? I couldn't tell which 150.x patch level it's on.

2. Sandbox: obs-browser still sets settings.no_sandbox = true (2.27.4), so a V8 exploit in an overlay wouldn't even need a sandbox escape. CyberInsider's write-up of the Twitch chat XSS chain says re-enabling it is being looked at. Is there an issue or branch tracking that, and what's blocking it?

3. Cadence: Chrome moved to a two week release cycle with 153, so 150 is already at least 4 majors behind. Is the plan still majors only plus security bumps when needed, and what counts as "needed"? 127 stayed pinned for about two years. Now that the Chrome Runtime work is merged, would it be realistic to make bumps within the same API range routine, like a periodic check for new CEF builds alongside the deps updates?

4. 32.x: release/32.2 is still on 6533. Is a last 32.x with a newer CEF off the table, or is the answer just "update to 33"?

No rush, I know this is volunteer time.