diff --git a/CVE-2025-0436.patch b/CVE-2025-0436.patch
new file mode 100644
index 0000000000000000000000000000000000000000..0a6fffb8d546e31c78eb941d0fca734659a50fc2
--- /dev/null
+++ b/CVE-2025-0436.patch
@@ -0,0 +1,58 @@
+From 71ac0d61af2af32abf95a8ff31d243f72240916b Mon Sep 17 00:00:00 2001
+From: zhaoshun <zhaoshun@cqsoftware.com.cn>
+Date: Tue, 29 Jul 2025 17:32:08 +0800
+Subject: [PATCH] CVE-2025-0436
+
+---
+ .../src/gpu/ops/GrAAHairLinePathRenderer.cpp  | 23 +++++++++++++++----
+ 1 file changed, 18 insertions(+), 5 deletions(-)
+
+diff --git a/src/3rdparty/chromium/third_party/skia/src/gpu/ops/GrAAHairLinePathRenderer.cpp b/src/3rdparty/chromium/third_party/skia/src/gpu/ops/GrAAHairLinePathRenderer.cpp
+index c4ae781..a91eaac 100644
+--- a/src/3rdparty/chromium/third_party/skia/src/gpu/ops/GrAAHairLinePathRenderer.cpp
++++ b/src/3rdparty/chromium/third_party/skia/src/gpu/ops/GrAAHairLinePathRenderer.cpp
+@@ -11,6 +11,7 @@
+ #include "src/core/SkMatrixPriv.h"
+ #include "src/core/SkPointPriv.h"
+ #include "src/core/SkRectPriv.h"
++#include "src/core/SkSafeMath.h"
+ #include "src/core/SkStroke.h"
+ #include "src/gpu/GrAuditTrail.h"
+ #include "src/gpu/GrBuffer.h"
+@@ -1189,16 +1190,28 @@ void AAHairlineOp::onPrepareDraws(Target* target) {
+ 
+     int instanceCount = fPaths.count();
+     bool convertConicsToQuads = !target->caps().shaderCaps()->floatIs32Bits();
+-    for (int i = 0; i < instanceCount; i++) {
++    SkSafeMath safeMath;
++    for (int i = 0; i < instanceCount && safeMath.ok(); i++) {
+         const PathData& args = fPaths[i];
+-        quadCount += gather_lines_and_quads(args.fPath, args.fViewMatrix, args.fDevClipBounds,
+-                                            args.fCapLength, convertConicsToQuads, &lines, &quads,
+-                                            &conics, &qSubdivs, &cWeights);
++        quadCount = safeMath.addInt(quadCount,
++                                    gather_lines_and_quads(args.fPath,
++                                                           args.fViewMatrix,
++                                                           args.fDevClipBounds,
++                                                           args.fCapLength,
++                                                           convertConicsToQuads,
++                                                           &lines,
++                                                           &quads,
++                                                           &conics,
++                                                           &qSubdivs,
++                                                           &cWeights));
+     }
+ 
+     int lineCount = lines.count() / 2;
+     int conicCount = conics.count() / 3;
+-    int quadAndConicCount = conicCount + quadCount;
++    int quadAndConicCount = safeMath.addInt(conicCount, quadCount);
++    if (!safeMath.ok()) {
++        return;
++    }
+ 
+     static constexpr int kMaxLines = SK_MaxS32 / kLineSegNumVertices;
+     static constexpr int kMaxQuadsAndConics = SK_MaxS32 / kQuadNumVertices;
+-- 
+2.43.5
+
diff --git a/qt5-qtwebengine.spec b/qt5-qtwebengine.spec
index d2ddaec7ee2ebce0adce25678857811d676c0fd0..c3e9dcf9663a2db2e69ff97b1275755a7fc888ea 100644
--- a/qt5-qtwebengine.spec
+++ b/qt5-qtwebengine.spec
@@ -52,7 +52,7 @@
 Summary: Qt5 - QtWebEngine components
 Name:    qt5-qtwebengine
 Version: 5.15.16
-Release: 1
+Release: 2
 
 # See LICENSE.GPL LICENSE.LGPL LGPL_EXCEPTION.txt, for details
 # See also http://qt-project.org/doc/qt-5.0/qtdoc/licensing.html
@@ -115,6 +115,10 @@ Patch53: fix-build-tools-to-run-with-python3.11.patch
 # bit-field.h:43:29: error: integer value 7 is outside the valid range of values [0, 3] for the enumeration type 'Kind'
 Patch54: fix-qt5-qtwebengine-build-with-clang-17.patch
 
+# chromium patches
+# from https://code.qt.io/cgit/qt/qtwebengine-chromium.git/commit/?h=87-based&id=8882ed795a3dc6b489982f6d6869e5c22d3703ea
+Patch55: CVE-2025-0436.patch
+
 # riscv64 support patch from Arch Linux
 Patch1000: riscv-v8.patch
 Patch1001: riscv-qt5-qtwebengine.patch
@@ -428,6 +432,7 @@ popd
 %patch -P52 -p1 -b .chromium-python3
 %patch -P53 -p1 -b .fix-build-tools-to-run-with-python3.11
 %patch -P54 -p1 -b .fix-qt5-qtwebengine-build-with-clang-17
+%patch -P55 -p1
 
 %ifarch riscv64
 %patch -P1000 -p1 -b .riscv-v8
@@ -652,6 +657,9 @@ done
 
 
 %changelog
+* Wed Aug 13 2025 Shun Zhao <zhaoshun@cqsoftware.com.cn> - 5.15.16-2
+- Fix CVE-2025-0436
+
 * Tue Apr 22 2025 Funda Wang <fundawang@yeah.net> - 5.15.16-1
 - update to 5.15.16