From bb02b193e63b6d480831821e27fe8172d0558ba5 Mon Sep 17 00:00:00 2001
From: Jack Miller <jackmil@google.com>
Date: Thu, 28 May 2026 14:10:23 -0700
Subject: [PATCH] Use delay loading and /DEPENDENTLOADFLAG:0x800 when building gcp_sfx

This change introduces delay loading and /DEPENDENTLOADFLAG:0x800 to
prevent DLL search order hijacking in gcp_sfx.exe.

Bug: 513867710
Change-Id: If9e0efe78b801b0d6ea40e08ad8832f44c22a89b
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7877149
Reviewed-by: Yusuf Sengul <yusufsn@google.com>
Reviewed-by: David Bienvenu <davidbienvenu@chromium.org>
Commit-Queue: Jack Miller <jackmil@google.com>
Cr-Commit-Position: refs/heads/main@{#1637945}
---

diff --git a/chrome/credential_provider/setup/BUILD.gn b/chrome/credential_provider/setup/BUILD.gn
index e0763a32..063669a 100644
--- a/chrome/credential_provider/setup/BUILD.gn
+++ b/chrome/credential_provider/setup/BUILD.gn
@@ -67,7 +67,12 @@
     ":version",
     "//third_party/lzma_sdk:7zS2_source",
   ]
-  configs += [ "//build/config/win:windowed" ]
+  configs += [
+    "//build/config/win:windowed",
+    "//build/config/win:delayloads",
+    "//build/config/win:delayloads_not_for_child_dll",
+  ]
+  ldflags = [ "/DEPENDENTLOADFLAG:0x800" ]
 }
 
 executable("gcp_setup") {