Gated: new third-party libraries. Chromium does not accept one on merit alone.
Outcome: the request must cover what the library does and what alternatives exist, whether it processes untrusted input and is written in a memory-safe language, how it will be kept up to date, how much build time and binary size it adds, and whether it can be built from source at all. Someone has to own the dependency for as long as it ships.
The team that treats every dependency as a liability: Chromium does not accept a new third-party library on merit alone. Adding one requires approval from Chrome’s Technical Steering Council and Chrome Security, and the request has to cover what it does and what alternatives exist, whether it processes untrusted input and is written in a memory-safe language, how it will be kept up to date, how much build time and binary size it adds, and whether it can be built from source at all — “in the latter case, please explain why it can’t be built from source, as you’ll need explicit approval.” Someone has to own the dependency for as long as it ships.
Source: Chromium, Adding third_party Libraries (policy document, last revised 29 September 2026)