 +                    for( int i = 0; i < count; i++ )
 +                        if( responseFlags & CFUserNotificationCheckBoxChecked( i ) )
 +                        {
++                            scoped_refptr<X509Certificate> cert = X509Certificate::CreateFromBytes( certs[i], lens[i] );
++                            if( !cert.get() )
++                                continue;
 +                            ScopedCFTypeRef<SecIdentityRef> sec_identity;
-+                            scoped_refptr<X509Certificate> cert( X509Certificate::CreateFromBytes( certs[i], lens[i] ) );
 +                            selected_identities.push_back( std::make_unique<ClientCertIdentityMac>( cert, std::move( sec_identity ) ) );
 +                            break;
 +                        }

 sandbox/win/src/process_mitigations.cc        |   4 +
 .../service_manager/sandbox/mac/common.sb     |  15 +++
 third_party/boringssl/BUILD.generated.gni     |   2 +
 26 files changed, 420 insertions(+), 17 deletions(-)

diff --git a/chrome/app/app-entitlements.plist b/chrome/app/app-entitlements.plist
index 4a1d735cfe35..310d9aab7d47 100644

 }
 
diff --git a/net/ssl/client_cert_store_nss.cc b/net/ssl/client_cert_store_nss.cc
index f4d3e893c231..6b0264b2c772 100644
--- a/net/ssl/client_cert_store_nss.cc
+++ b/net/ssl/client_cert_store_nss.cc
@@ -146,6 +146,12 @@ void ClientCertStoreNSS::FilterCertsOnWorkerThread(
