diff --git a/chromecast/media/cma/backend/audio_decoder_for_mixer.cc b/chromecast/media/cma/backend/audio_decoder_for_mixer.cc
index 00ff7285a4e33..0495d5c6a8f63 100644
--- a/chromecast/media/cma/backend/audio_decoder_for_mixer.cc
+++ b/chromecast/media/cma/backend/audio_decoder_for_mixer.cc
@@ -14,6 +14,7 @@
 
 #include "base/functional/callback_helpers.h"
 #include "base/logging.h"
+#include "base/task/single_thread_task_runner.h"
 #include "base/time/time.h"
 #include "base/trace_event/trace_event.h"
 #include "build/build_config.h"
diff --git a/chromecast/media/cma/backend/desktop/BUILD.gn b/chromecast/media/cma/backend/desktop/BUILD.gn
index dbe8d923eeee7..1ab97705b81ee 100644
--- a/chromecast/media/cma/backend/desktop/BUILD.gn
+++ b/chromecast/media/cma/backend/desktop/BUILD.gn
@@ -27,6 +27,7 @@ cast_source_set("desktop") {
   if (enable_video_with_mixed_audio) {
     sources += [ "desktop_system_volume_control.cc" ]
     deps += [
+      "//chromecast/media/audio:dummy_external_audio_pipeline",
       "//chromecast/media/cma/backend:for_mixer_audio",
       "//chromecast/media/cma/backend:null_video",
       "//chromecast/media/cma/backend:public",
diff --git a/chromecast/media/cma/backend/volume_control.cc b/chromecast/media/cma/backend/volume_control.cc
index 6015a192b1ec2..3dca9319a9ea3 100644
--- a/chromecast/media/cma/backend/volume_control.cc
+++ b/chromecast/media/cma/backend/volume_control.cc
@@ -200,8 +200,11 @@ class VolumeControlInternal : public SystemVolumeControl::Delegate {
 
     for (auto type : {AudioContentType::kMedia, AudioContentType::kAlarm,
                       AudioContentType::kCommunication}) {
+      // Build fix: SetByDottedPath above creates nested dicts, so use the
+      // matching dotted-path lookup. Pre-existing latent bug in this
+      // (non-default) build configuration; unrelated to the vulnerability.
       std::optional<double> dbfs =
-          stored_values_.FindDouble(ContentTypeToDbFSPath(type));
+          stored_values_.FindDoubleByDottedPath(ContentTypeToDbFSPath(type));
       CHECK(dbfs);
       volumes_[type] = VolumeControl::DbFSToVolume(*dbfs);
       volume_multipliers_[type] = 1.0f;
diff --git a/components/crash/content/browser/crash_handler_host_linux.cc b/components/crash/content/browser/crash_handler_host_linux.cc
index 21bff545c754f..a0b7d0aea9125 100644
--- a/components/crash/content/browser/crash_handler_host_linux.cc
+++ b/components/crash/content/browser/crash_handler_host_linux.cc
@@ -2,6 +2,11 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+// Build fix for cast_shell ASAN config: pre-existing unsafe buffer usage in
+// the ADDRESS_SANITIZER paths is not in the unsafe_buffers allowlist for cast.
+#pragma allow_unsafe_buffers
+#pragma allow_unsafe_libc_calls
+
 #include "components/crash/content/browser/crash_handler_host_linux.h"
 
 #include <errno.h>
@@ -384,7 +389,8 @@ void CrashHandlerHostLinux::FindCrashingThreadAndDump(
   info->crash_keys = crash_keys.release();
 #if defined(ADDRESS_SANITIZER)
   asan_report[kMaxAsanReportSize] = '\0';
-  info->asan_report_str = asan_report.release();
+  // Build fix: HeapArray::release() removed; use leak().data().
+  info->asan_report_str = std::move(asan_report).leak().data();
   info->asan_report_length = strlen(info->asan_report_str);
 #endif
 
diff --git a/components/crash/core/app/breakpad_linux.cc b/components/crash/core/app/breakpad_linux.cc
index adc0fb959ac1a..1ee97ea21ef14 100644
--- a/components/crash/core/app/breakpad_linux.cc
+++ b/components/crash/core/app/breakpad_linux.cc
@@ -5,6 +5,11 @@
 // For linux_syscall_support.h. This makes it safe to call embedded system
 // calls when in seccomp mode.
 
+// Build fix for cast_shell ASAN config: pre-existing unsafe buffer usage in
+// this file is not in the unsafe_buffers allowlist for the cast configuration.
+#pragma allow_unsafe_buffers
+#pragma allow_unsafe_libc_calls
+
 #include "components/crash/core/app/breakpad_linux.h"
 
 #include <fcntl.h>