<!--
Copyright 2020 The Chromium Authors
Use of this source code is governed by a BSD-style license that can be
found in the LICENSE file.
-->

<!--
This file is used to generate a comprehensive list of Security histograms
along with a detailed description for each histogram.

For best practices on writing histogram descriptions, see
https://chromium.googlesource.com/chromium/src.git/+/HEAD/tools/metrics/histograms/README.md

Please follow the instructions in the OWNERS file in this directory to find a
reviewer. If no OWNERS file exists, please consider signing up at
go/reviewing-metrics (Googlers only), as all subdirectories are expected to
have an OWNERS file. As a last resort you can send the CL to
chromium-metrics-reviews@google.com.
-->

<histogram-configuration>

<histograms>

<variants name="SafetyTip">
  <variant name=".SafetyTip_BadReputation" summary="Bad reputation Safety Tip"/>
  <variant name=".SafetyTip_BadReputationIgnored"
      summary="Bad reputation ignored by user"/>
  <variant name=".SafetyTip_Lookalike" summary="Lookalike Safety Tip"/>
  <variant name=".SafetyTip_LookalikeIgnored"
      summary="Lookalike Safety Tip ignored by user"/>
  <variant name=".SafetyTip_None" summary="No Safety Tip"/>
  <variant name=".SafetyTip_Unknown" summary="Unknown Safety Tip status"/>
</variants>

<histogram name="OSCrypt.AppBoundEncryption.SupportLevel"
    enum="AppBoundEncryptionSupportLevel" expires_after="2027-01-17">
  <owner>wfh@chromium.org</owner>
  <owner>nparker@chromium.org</owner>
  <summary>
    The status of the current level of support for App-Bound encryption. This is
    logged once during browser startup on Windows only.
  </summary>
</histogram>

<histogram name="OSCrypt.AppBoundProvider.Decrypt.ResultCode" enum="Hresult"
    expires_after="2027-01-31">
  <owner>wfh@chromium.org</owner>
  <owner>nparker@chromium.org</owner>
  <summary>
    The result code of the application-bound Decrypt operation. This is logged
    once during browser startup on a background thread for supported Windows
    installs only, for a client that is decrypting a previously encrypted stored
    key, when the App-Bound encryption provider is enabled.
  </summary>
</histogram>

<histogram name="OSCrypt.AppBoundProvider.Decrypt.ResultLastError"
    enum="WinGetLastError" expires_after="2027-01-17">
  <owner>wfh@chromium.org</owner>
  <owner>nparker@chromium.org</owner>
  <summary>
    The GetLastError code for a failed application-bound Decrypt operation. This
    is logged once during browser startup on a background thread for supported
    Windows installs only, if the call to Decrypt failed, for a client that is
    decrypting a previously encrypted stored key, when the App-Bound encryption
    provider is enabled.
  </summary>
</histogram>

<histogram name="OSCrypt.AppBoundProvider.Encrypt.ResultCode" enum="Hresult"
    expires_after="2027-02-07">
  <owner>wfh@chromium.org</owner>
  <owner>nparker@chromium.org</owner>
  <summary>
    The result code of the application-bound Encrypt operation with path
    validation. This is logged once during browser startup on a background
    thread for supported Windows installs only, for a client that is
    initializing a new local state or a previously failing client, when the
    App-Bound encryption provider is enabled.
  </summary>
</histogram>

<histogram name="OSCrypt.AppBoundProvider.Encrypt.ResultLastError"
    enum="WinGetLastError" expires_after="2026-12-16">
  <owner>wfh@chromium.org</owner>
  <owner>nparker@chromium.org</owner>
  <summary>
    The GetLastError code for a failed application-bound Encrypt operation with
    path validation. This is logged once during browser startup on a background
    thread for supported Windows installs only, if the call to Encrypt failed,
    for a client that is initializing a new local state or a previously failing
    client, when the App-Bound encryption provider is enabled.
  </summary>
</histogram>

<histogram name="OSCrypt.AppBoundProvider.KeyRetrieval.Status"
    enum="OSCryptAppBoundKeyRetrievalStatus" expires_after="2026-09-06">
  <owner>wfh@chromium.org</owner>
  <owner>nparker@chromium.org</owner>
  <summary>
    The result of the App-Bound OSCrypt Async Key Provider reading the key from
    persistent storage while being initialized. This is recorded once during
    browser startup if the App-Bound Key Provider is enabled, on Windows only.
  </summary>
</histogram>

<histogram name="OSCrypt.AsyncInitialization.Time" units="ms"
    expires_after="2027-01-24">
  <owner>wfh@chromium.org</owner>
  <owner>nparker@chromium.org</owner>
  <summary>
    The amount of time, in ms, that it takes for OSCrypt Async to complete the
    attempt to initialize the keyring during browser process initialization.
    Recorded once per browser start, if the OSCrypt Async completes the
    initialization attempt before the browser shuts down.
  </summary>
</histogram>

<histogram name="OSCrypt.DPAPIProvider.Status" enum="OSCryptDPAPIKeyStatus"
    expires_after="2026-07-26">
  <owner>wfh@chromium.org</owner>
  <owner>nparker@chromium.org</owner>
  <summary>
    The result of the DPAPI OSCrypt Async Key Provider reading the OSCrypt Sync
    DPAPI key from pref store when being initialized. This is recorded once
    during browser startup if the DPAPI Key Provider is enabled, on Windows
    only.
  </summary>
</histogram>

<histogram name="OSCrypt.EncryptionPrefixVersion"
    enum="EncryptionPrefixVersion" expires_after="2027-06-28">
  <owner>wfh@chromium.org</owner>
  <owner>thestig@chromium.org</owner>
  <summary>
    The version prefix of encrypted data. This metric is reported by OSCrypt
    Sync when attempting to decrypt a non-empty value on non-Windows platforms.
  </summary>
</histogram>

<histogram name="OSCrypt.EncryptorKeyCount{EncryptorKeyType}" units="key count"
    expires_after="2027-02-07">
  <owner>wfh@chromium.org</owner>
  <owner>chrome-platform-security-core@google.com</owner>
  <summary>
    Logged whenever the OSCrypt Async instance has been created after a call to
    GetInstance. This counts the {EncryptorKeyType} key(s) in the keyring.
  </summary>
  <token key="EncryptorKeyType">
    <variant name="" summary="total possible"/>
    <variant name=".Available" summary="available"/>
    <variant name=".PermanentlyUnavailable" summary="permanently unavailable"/>
    <variant name=".TemporarilyUnavailable" summary="temporarily unavailable"/>
  </token>
</histogram>

<histogram name="OSCrypt.FreedesktopSecretKeyProvider.InitStatus"
    enum="FreedesktopSecretKeyProviderInitStatus" expires_after="2025-12-17">
  <owner>thomasanderson@chromium.org</owner>
  <owner>thestig@chromium.org</owner>
  <summary>
    The broad outcome of the org.freedesktop.secrets OSCrypt Async Key Provider
    initialization, recorded once during browser startup (Linux only).
  </summary>
</histogram>

<histogram name="OSCrypt.Mac.FindGenericPasswordError"
    enum="MacSecurityFrameworkOSStatus" expires_after="2027-02-14">
  <owner>avi@chromium.org</owner>
  <owner>lgrey@chromium.org</owner>
  <owner>markrowe@chromium.org</owner>
  <owner>thestig@chromium.org</owner>
  <summary>
    Once per launch of Mac Chrome, OSCrypt retrieves the &quot;safe
    storage&quot; item from the Keychain. If an error occurs during this
    retrieval, the OSCrypt.Mac.FindGenericPasswordResult histogram will have a
    kErrorOccurred enum recorded, and this histogram will have the actual error
    code returned by SecItemCopyMatching/SecKeychainFindGenericPassword
    recorded. In all other cases (either the &quot;safe storage&quot; item was
    found or it was not found but there was no error), this metric is not
    recorded.
  </summary>
</histogram>

<histogram name="OSCrypt.Mac.FindGenericPasswordResult"
    enum="FindGenericPasswordResult" expires_after="2027-02-14">
  <owner>avi@chromium.org</owner>
  <owner>lgrey@chromium.org</owner>
  <owner>markrowe@chromium.org</owner>
  <owner>thestig@chromium.org</owner>
  <summary>
    Once per launch of Mac Chrome, OSCrypt retrieves the &quot;safe
    storage&quot; item from the Keychain. This metric is logged for every such
    retrieval, recording an enum of whether the item was found, not found, or an
    error occurred. In the case of an error occurring, the actual error returned
    by the API will be recorded in OSCrypt.Mac.FindGenericPasswordError.
  </summary>
</histogram>

<histogram name="OSCrypt.Mac.SuccessAfterPreviousError"
    enum="MacSecurityFrameworkOSStatus" expires_after="2026-10-18">
  <owner>thestig@chromium.org</owner>
  <owner>thomasanderson@chromium.org</owner>
  <owner>wfh@chromium.org</owner>
  <summary>
    Logged when a Keychain operation successfully retrieves or adds a password
    after a previous operation in the same browser lifetime resulted in an
    error. The logged value is the OSStatus of the *previous* error. This helps
    track which errors are transient and can be successfully recovered from.
  </summary>
</histogram>

<histogram name="OSCrypt.SecretPortalKeyProvider.GotToken" enum="Boolean"
    expires_after="2025-11-30">
  <owner>thomasanderson@chromium.org</owner>
  <owner>thestig@chromium.org</owner>
  <summary>
    True if a token was received from the service. The token is passed back to
    the service on subsequent usage to ensure the same secret will be returned.
    Emitted only on Linux when the desktop portal has emitted the request
    completed signal after user interaction is finished.
  </summary>
</histogram>

<histogram name="OSCrypt.SecretPortalKeyProvider.InitStatus"
    enum="SecretPortalKeyProviderInitStatus" expires_after="2025-11-30">
  <owner>thomasanderson@chromium.org</owner>
  <owner>thestig@chromium.org</owner>
  <summary>
    The result of the org.freedesktop.portal.Secret OSCrypt Async Key Provider
    initialization. This is recorded once during browser startup if
    SecretPortalKeyProvider enabled, on Linux only.
  </summary>
</histogram>

<histogram name="OSCrypt.SecretPortalKeyProvider.NewInitFailure"
    enum="SecretPortalKeyProviderInitStatus" expires_after="2025-11-30">
  <owner>thomasanderson@chromium.org</owner>
  <owner>thestig@chromium.org</owner>
  <summary>
    The result of the org.freedesktop.portal.Secret OSCrypt Async Key Provider
    initialization if the previous initialization succeeded and the current
    initialization failed, and the previous desktop matches the current desktop.
  </summary>
</histogram>

<histogram name="OSCrypt.Win.Decrypt.Result" enum="BooleanSuccess"
    expires_after="2026-09-06">
  <owner>wfh@chromium.org</owner>
  <owner>nparker@chromium.org</owner>
  <summary>
    Whether or not the DPAPI Decrypt call to decrypt the OSCrypt key succeeeded.
    This is logged once during browser startup on Windows.
  </summary>
</histogram>

<histogram name="OSCrypt.Win.Decrypt.Time" units="ms"
    expires_after="2023-11-12">
  <owner>wfh@chromium.org</owner>
  <owner>nparker@chromium.org</owner>
  <summary>
    The amount of time, in ms, that it takes to perform a DPAPI Decrypt call.
    This is logged once during browser startup on Windows.
  </summary>
</histogram>

<histogram name="OSCrypt.Win.Encrypt.Result" enum="BooleanSuccess"
    expires_after="2026-03-01">
  <owner>wfh@chromium.org</owner>
  <owner>nparker@chromium.org</owner>
  <summary>
    Whether or not the DPAPI Encrypt call to encrypt the OSCrypt key succeeeded.
    This is logged once during browser startup on Windows, if there is no stored
    key and a new one has to be generated. This data will therefore be biased
    towards newer clients. See OSCrypt.Win.Decrypt.Result which contains
    unbiased data.
  </summary>
</histogram>

<histogram name="OSCrypt.Win.Encrypt.Time" units="ms"
    expires_after="2023-11-12">
  <owner>wfh@chromium.org</owner>
  <owner>nparker@chromium.org</owner>
  <summary>
    The amount of time, in ms, that it takes to perform a DPAPI Encrypt call.
    This is logged once during browser startup on Windows, if there is no stored
    key and a new one has to be generated. This data will therefore be biased
    towards newer clients. See OSCrypt.Win.Decrypt.Time which contains unbiased
    data.
  </summary>
</histogram>

<histogram name="OSCrypt.Win.KeyDecryptionError" enum="WinGetLastError"
    expires_after="2027-02-07">
  <owner>wfh@chromium.org</owner>
  <owner>forshaw@chromium.org</owner>
  <summary>
    The Windows GetLastError after a failure from calling into DPAPI to decrypt
    the main key for the os_crypt library on Windows. This is recorded by
    DPAPIKeyProvider each time the decryption fails. Note that this metric was
    not recorded between 2021-08 (M91) and 2024-07 (M128).
  </summary>
</histogram>

<histogram name="Security.EnhancedBundle.IsEnhancedSelected"
    enum="BooleanEnabled" expires_after="2026-08-01">
  <owner>awado@google.com</owner>
  <owner>chrome-counter-abuse-alerts@google.com</owner>
  <summary>
    Whether the enhanced-security settings bundle is selected. Recorded for all
    uma log at upload time by the BundleSettingsMetricsProvider for the main
    profile only.
  </summary>
</histogram>

<histogram
    name="Security.EnhancedBundle.JavascriptOptimizerSetting.WasModifiedFromDefault"
    enum="Boolean" expires_after="2026-08-01">
  <owner>awado@google.com</owner>
  <owner>chrome-counter-abuse-alerts@google.com</owner>
  <summary>
    Records whether the user has changed the javascript optimizer setting from
    the default for the enhanced-security bundle. Recorded for all uma logs at
    upload time by the BundleSettingsMetricsProvider for the main profile only.
  </summary>
</histogram>

<histogram
    name="Security.EnhancedBundle.SafeBrowsingSetting.WasModifiedFromDefault"
    enum="Boolean" expires_after="2026-08-01">
  <owner>awado@google.com</owner>
  <owner>chrome-counter-abuse-alerts@google.com</owner>
  <summary>
    Records whether the user has changed the safe browsing setting from the
    default for the enhanced-security bundle. Recorded for all uma logs at
    upload time by the BundleSettingsMetricsProvider for the main profile only.
  </summary>
</histogram>

<histogram name="Security.GwpAsan.Activated.{Allocator}.{Process}"
    enum="Boolean" expires_after="2026-08-23">
  <owner>mpdenton@chromium.org</owner>
  <owner>kdlee@chromium.org</owner>
  <owner>memory-safety-dev@chromium.org</owner>
  <summary>
    Reports the activation state of {Allocator} GWP-ASan for {Process}. Reported
    once when the memory system initializes.
  </summary>
  <token key="Allocator">
    <variant name="Malloc"/>
    <variant name="PartitionAlloc"/>
  </token>
  <token key="Process">
    <variant name="Browser"/>
    <variant name="Extension"/>
    <variant name="Gpu"/>
    <variant name="Ppapi"/>
    <variant name="Renderer"/>
    <variant name="Utility"/>
  </token>
</histogram>

<histogram name="Security.GwpAsan.AllocatorOom.{Allocator}.{Process}"
    units="allocations" expires_after="2026-06-21">
  <owner>mpdenton@chromium.org</owner>
  <owner>kdlee@chromium.org</owner>
  <owner>memory-safety-dev@chromium.org</owner>
  <summary>
    Reports how many allocations it took for {Allocator} GWP-ASan in {Process}
    to hit OOM. Reported once when GWP-ASan fails to allocate
    `GuardedPageAllocator::kOutOfMemoryCount` times in a row.
  </summary>
  <token key="Allocator">
    <variant name="Malloc"/>
    <variant name="PartitionAlloc"/>
  </token>
  <token key="Process">
    <variant name="Browser"/>
    <variant name="Extension"/>
    <variant name="Gpu"/>
    <variant name="Ppapi"/>
    <variant name="Renderer"/>
    <variant name="Utility"/>
  </token>
</histogram>

<histogram name="Security.GwpAsan.CrashAnalysisResult.{Allocator}"
    enum="GwpAsanCrashAnalysisResult" expires_after="2026-05-04">
  <owner>glazunov@google.com</owner>
  <owner>mpdenton@chromium.org</owner>
  <owner>chrome-memory-tok@google.com</owner>
  <summary>
    Reports the GWP-ASan crash analysis result. That can either be a
    determination that the crash was related to GWP-ASan, not related to
    GWP-ASan, or an error making that determination. Recorded with every crash.
  </summary>
  <token key="Allocator">
    <variant name="Malloc"/>
    <variant name="PartitionAlloc"/>
  </token>
</histogram>

<histogram name="Security.HttpsFirstMode.InterstitialReason"
    enum="HttpsFirstModeInterstitialReason" expires_after="2027-01-03">
  <owner>meacer@chromium.org</owner>
  <owner>trusty-transport@chromium.org</owner>
  <summary>
    Records the reason why the HTTPS-First Mode interstitial was shown. Only one
    reason is recorded per interstitial.
  </summary>
</histogram>

<histogram name="Security.HttpsFirstMode.NavigationEvent"
    enum="HttpsFirstModeNavigationEvent" expires_after="2027-04-01">
  <owner>cthomp@chromium.org</owner>
  <owner>chrome-swan@google.com</owner>
  <summary>
    Events for navigations that are upgraded from HTTP to HTTPS by HTTPS-First
    Mode. Recorded for eligible navigations (HTTP main frame navigations that
    are not allowlisted), if the profile is opted in to HTTPS-First Mode.

    Note: This histogram was expired from 2025-12-21 through 2026-05-13.
  </summary>
</histogram>

<histogram name="Security.HttpsFirstMode.SettingChanged2"
    enum="HttpsFirstModeSetting" expires_after="2027-01-03">
  <owner>cthomp@chromium.org</owner>
  <owner>trusty-transport@chromium.org</owner>
  <summary>
    Records the HTTPS-First Mode setting state when it changes for a profile.
    Recorded for regular profiles only (not for Incognito, Guest, or Sign-in
    profiles). Supersedes the original (superseded)
    Security.HttpsFirstMode.SettingChanged after the rollout of HTTPS-First
    Balanced Mode. Note: Compared to the original (superseded)
    Security.HttpsFirstMode.SettingChanged histogram, this is logged at the
    point of the UI setting changing, rather than the underlying prefs updating.
    This change was made to avoid double-counting now that the feature logic is
    controlled by multiple prefs.
  </summary>
</histogram>

<histogram name="Security.HttpsFirstMode.SettingEnabledAtStartup"
    enum="BooleanEnabled" expires_after="2025-04-15">
  <owner>cthomp@chromium.org</owner>
  <owner>trusty-transport@chromium.org</owner>
  <summary>
    Records whether the HTTPS-First Mode preference is enabled at profile
    startup. Recorded for regular profiles only (not for Incognito, Guest, or
    Sign-in profiles).
  </summary>
</histogram>

<histogram name="Security.HttpsFirstMode.SettingEnabledAtStartup2"
    enum="HttpsFirstModeSetting" expires_after="2027-01-17">
  <owner>cthomp@chromium.org</owner>
  <owner>trusty-transport@chromium.org</owner>
  <summary>
    Records the HTTPS-First Mode setting state at profile startup. Recorded for
    regular profiles only (not for Incognito, Guest, or Sign-in profiles).
    Supercedes Security.HttpsFirstMode.SettingEnabledAtStartup.
  </summary>
</histogram>

<histogram name="Security.HttpsFirstMode.SettingEnabledAtStartupDetailed"
    enum="HttpsFirstModeStartupState" expires_after="2027-06-01">
  <owner>zackhan@chromium.org</owner>
  <owner>chrome-counter-abuse-alerts@google.com</owner>
  <summary>
    The detailed status of the HTTPS-First Mode setting at startup. This
    distinguishes between different reasons why Balanced Mode might be enabled
    (explicit user choice, typically secure heuristic, ESB pairing, or
    auto-enable). Recorded once per profile startup.
  </summary>
</histogram>

<histogram name="Security.HttpsFirstMode.SettingImplicitlyChanged"
    enum="HttpsFirstModeImplicitStateChange" expires_after="2027-06-01">
  <owner>zackhan@chromium.org</owner>
  <owner>chrome-counter-abuse-alerts@google.com</owner>
  <summary>
    Records implicit changes to the HTTPS-First Mode setting. This is logged
    when HFM Balanced Mode is automatically enabled or disabled as a side-effect
    of the user changing their Safe Browsing setting (e.g. enabling/disabling
    Enhanced Safe Browsing), provided the user has not manually customized their
    HFM settings.
  </summary>
</histogram>

<histogram
    name="Security.HttpsFirstModeWithEngagementHeuristic.AccumulatedHostCount"
    units="hostnames" expires_after="2026-09-06">
  <owner>meacer@chromium.org</owner>
  <owner>trusty-transport@chromium.org</owner>
  <summary>
    Records the accumulated number of host that have HFM enabled at some point
    due to the site engagement heuristic. Includes hosts that have HTTP allowed.
    Recorded at the time of navigation when HFM upgrades trigger.
  </summary>
</histogram>

<histogram name="Security.HttpsFirstModeWithEngagementHeuristic.Duration"
    units="seconds" expires_after="2026-03-01">
  <owner>meacer@chromium.org</owner>
  <owner>trusty-transport@chromium.org</owner>
  <summary>
    Records the duration a host has HFM enabled due to the site engagement
    heuristic. Only recorded for hosts removed from the HFM list. Recorded at
    the time of navigation when HFM upgrades trigger.
  </summary>
</histogram>

<histogram name="Security.HttpsFirstModeWithEngagementHeuristic.HostCount"
    units="hostnames" expires_after="2026-09-06">
  <owner>meacer@chromium.org</owner>
  <owner>trusty-transport@chromium.org</owner>
  <summary>
    Records the current number of host that have HFM enabled due to the site
    engagement heuristic. Includes hosts that have HTTP allowed. Recorded at the
    time of navigation when HFM upgrades trigger.
  </summary>
</histogram>

<histogram
    name="Security.HttpsFirstModeWithEngagementHeuristic.NavigationEvent"
    enum="HttpsFirstModeNavigationEvent" expires_after="2025-12-28">
  <owner>meacer@chromium.org</owner>
  <owner>cthomp@chromium.org</owner>
  <owner>trusty-transport@chromium.org</owner>
  <summary>
    Same as Security.HttpsFirstMode.NavigationEvent but only recorded iff HFM is
    disabled by the UI setting and enabled by the Site Engagement Heuristic
    because the site's HTTPS score is high and HTTP score is low.
  </summary>
</histogram>

<histogram name="Security.HttpsFirstModeWithEngagementHeuristic.State"
    enum="SiteEngagementHeuristicState" expires_after="2026-03-01">
  <owner>meacer@chromium.org</owner>
  <owner>trusty-transport@chromium.org</owner>
  <summary>
    Records whether the HTTPS-First Mode got enabled or disabled on a site due
    to its HTTP and HTTPS site engagement scores. Only recorded if the enabled
    state changes. Recorded even for sites allowlisted to load over HTTP.
  </summary>
</histogram>

<histogram name="Security.HttpsFirstModeWithEsbPairing.NavigationEvent"
    enum="HttpsFirstModeNavigationEvent" expires_after="2027-06-01">
  <owner>zackhan@chromium.org</owner>
  <owner>chrome-counter-abuse-alerts@google.com</owner>
  <summary>
    Records navigation events (upgrade attempts, successes, failures) for
    navigations where HTTPS-First Mode was enabled specifically because the user
    has Enhanced Safe Browsing enabled and has not manually customized their HFM
    settings.
  </summary>
</histogram>

<histogram name="Security.iOS.KeychainMigration.Result"
    enum="IOSKeychainMigrationResult" expires_after="2027-02-21">
  <owner>marq@chromium.org</owner>
  <owner>bling-flags@google.com</owner>
  <summary>
    Tracks whether a keychain item required accessibility migration and if the
    migration attempt succeeded. Migration is needed if the item currently has
    kSecAttrAccessibleWhenUnlocked but should have
    kSecAttrAccessibleAfterFirstUnlock. Recorded on iOS only, after a migration
    attempt has finished.
  </summary>
</histogram>

<histogram name="Security.NavigationRequestSecurityLevel"
    enum="NavigationRequestSecurityLevel" expires_after="2027-01-17">
  <owner>jdeblasio@chromium.org</owner>
  <owner>trusty-transport@chromium.org</owner>
  <summary>
    Records the security level (e.g. secure, not secure, etc.) of each HTTP
    request, recording one histogram per fetch (i.e. including redirects).

    Starting from M128, initial HTTP requests to captive portal login pages are
    not upgraded and this exclusion is recorded in the &quot;HTTP request to a
    captive portal login page&quot; bucket. Previously, these requests could
    have been put under various buckets depending on the captive portal
    configuration.
  </summary>
</histogram>

<histogram name="Security.PageEndReason{SafetyTip}" enum="PageEndReason"
    expires_after="2026-03-01">
  <owner>cthomp@chromium.org</owner>
  <owner>trusty-transport@chromium.org</owner>
  <summary>
    Records the reason the page visit ended (e.g., reload, tab closed, new
    navigation, etc.) for page loads that committed. {SafetyTip}
  </summary>
</histogram>

<histogram name="Security.PageInfo.AboutThisSiteInteraction"
    enum="AboutThisSiteInteraction" expires_after="2027-01-17">
  <owner>dullweber@chromium.org</owner>
  <owner>olesiamarukhno@chromium.org</owner>
  <summary>
    Tracks interactions with the AboutThisSite feature. Recorded when PageInfo
    is opened and when the user interacts with the AboutThisSite row.
  </summary>
</histogram>

<histogram name="Security.PageInfo.AboutThisSiteLanguageSupported"
    enum="Boolean" expires_after="2026-03-22">
  <owner>dullweber@chromium.org</owner>
  <owner>olesiamarukhno@chromium.org</owner>
  <summary>
    Tracks whether AboutThisSite is available for the user's application locale.
    Recorded every time PageInfo is opened.
  </summary>
</histogram>

<histogram name="Security.PageInfo.AboutThisSiteStatus"
    enum="AboutThisSiteStatus" expires_after="2025-09-14">
  <owner>dullweber@chromium.org</owner>
  <owner>olesiamarukhno@chromium.org</owner>
  <summary>
    Tracks status of AboutThisSite queries. Recorded every time PageInfo is
    opened and information about a site is requested.
  </summary>
</histogram>

<histogram name="Security.PageInfo.Cookies.HasFPSInfo" enum="Boolean"
    expires_after="2025-09-10">
  <owner>tommasin@chromium.org</owner>
  <owner>sauski@google.com</owner>
  <owner>olesiamarukhno@google.com</owner>
  <summary>
    Tracks whether the FPS section was shown in the Cookies subpage. Recorded
    every time Cookie subpage from PageInfo is opened.

    Note: This histogram was expired from M119 until M136.
  </summary>
</histogram>

<histogram name="Security.PageInfo.MerchantTrustEngagement.{Event}"
    units="EngagementScore" expires_after="2027-02-14">
  <owner>tommasin@chromium.org</owner>
  <owner>privacy-on-the-web@google.com</owner>
  <summary>
    Tracks the site engagement score when interacting with the merchant trust
    UI.
  </summary>
  <token key="Event">
    <variant name="BubbleOpened"/>
    <variant name="PageInfoRowShown"/>
    <variant name="SidePanelOpened"/>
  </token>
</histogram>

<histogram name="Security.PageInfo.MerchantTrustInteraction.{SiteFamiliarity}"
    enum="MerchantTrustInteraction" expires_after="2027-02-14">
  <owner>tommasin@chromium.org</owner>
  <owner>privacy-on-the-web@google.com</owner>
  <summary>
    Tracks interactions with the merchant trust feature. Recorded every time the
    user interacts with the merchant trust UI. Only recorded for familiar sites.
  </summary>
  <token key="SiteFamiliarity">
    <variant name="FamiliarSite"/>
    <variant name="UnfamiliarSite"/>
  </token>
</histogram>

<histogram name="Security.PageInfo.MerchantTrustStatus"
    enum="MerchantTrustStatus" expires_after="2026-09-20">
  <owner>tommasin@chromium.org</owner>
  <owner>privacy-on-the-web@google.com</owner>
  <summary>
    Tracks the status of the merchant trust metadata received from the
    Optimization Guide. Recorded every time PageInfo is opened.
  </summary>
</histogram>

<histogram name="Security.PageInfo.TimeOpen.Action{SafetyTip}" units="ms"
    expires_after="2025-02-10">
  <owner>cthomp@chromium.org</owner>
  <owner>security-enamel@chromium.org</owner>
  <summary>
    Records the amount of time the Page Info bubble is open before the user
    closes it, for cases where the user has performed an action inside it.
    {SafetyTip}
  </summary>
  <token key="SafetyTip" variants="SafetyTip">
    <variant name=""/>
  </token>
</histogram>

<histogram name="Security.PageInfo.TimeOpen.NoAction{SafetyTip}" units="ms"
    expires_after="2024-10-20">
  <owner>cthomp@chromium.org</owner>
  <owner>security-enamel@chromium.org</owner>
  <summary>
    Records the amount of time the Page Info bubble is open before the user
    closes it, for cases where the user performed no action inside it.
    {SafetyTip}
  </summary>
  <token key="SafetyTip" variants="SafetyTip">
    <variant name=""/>
  </token>
</histogram>

<histogram name="Security.PageInfo.TimeOpen{SafetyTip}" units="ms"
    expires_after="2023-11-12">
  <owner>cthomp@chromium.org</owner>
  <owner>security-enamel@chromium.org</owner>
  <summary>
    Records the amount of time the Page Info bubble is open before the user
    closes it or takes an action which closes it. {SafetyTip}
  </summary>
  <token key="SafetyTip" variants="SafetyTip">
    <variant name=""/>
  </token>
</histogram>

<histogram name="Security.PopupBypassAllowedType" enum="PopupBypassType"
    expires_after="2026-12-31">
  <owner>evasu@chromium.org</owner>
  <owner>extensions-core@chromium.org</owner>
  <summary>
    Records the type of extension-related context that successfully bypassed the
    popup blocker when creating a new window without transient user activation.
    Recorded whenever ChromeContentBrowserClient::IsPopupBypassAllowed returns
    true.
  </summary>
</histogram>

<histogram name="Security.PopupBypassDeniedByContentEmbedder" enum="Boolean"
    expires_after="2026-12-31">
  <owner>evasu@chromium.org</owner>
  <owner>extensions-core@chromium.org</owner>
  <summary>
    Records whether a popup without transient user activation was denied (true)
    or allowed via bypass (false) by the browser process. Recorded when
    RenderFrameHostImpl::CreateNewWindow is called and the request requires a
    bypass.
  </summary>
</histogram>

<histogram name="Security.PrivateNetworkAccess.CheckResult"
    enum="LocalNetworkAccessCheckResult" expires_after="2027-01-17">
  <owner>hchao@chromium.org</owner>
  <owner>clamy@chromium.org</owner>
  <owner>cthomp@chromium.org</owner>
  <owner>estark@chromium.org</owner>
  <owner>jdeblasio@chromium.org</owner>
  <owner>src/chrome/browser/local_network_access/OWNERS</owner>
  <summary>
    Result of the Local Network Access Check on a new connection. Recorded once
    per call to network::URLLoader::OnConnected(), which may be more than once
    per URL request.
  </summary>
</histogram>

<histogram name="Security.SafetyTips.Interaction{SafetyTip}"
    enum="SafetyTipInteraction" expires_after="2023-06-18">
  <owner>jdeblasio@chromium.org</owner>
  <owner>estark@chromium.org</owner>
  <summary>
    Records a user's interaction with a Safety Tip. Recorded every time a user
    uses one of the Safety Tip's buttons or dismisses it explicitly. Can be
    normalized against Security.SafetyTips.SafetyTipShown, filtered to users
    with the feature enabled to show the UI. {SafetyTip}
  </summary>
  <token key="SafetyTip" variants="SafetyTip">
    <variant name=""/>
  </token>
</histogram>

<histogram name="Security.SafetyTips.SafetyTipShown" enum="SafetyTipStatus"
    expires_after="2024-05-26">
  <owner>jdeblasio@chromium.org</owner>
  <owner>trusty-transport@chromium.org</owner>
  <summary>
    Records the Safety Tip status of a page after navigation commit or page
    visibility change.
  </summary>
</histogram>

<histogram name="Security.Sandbox.LandlockState" enum="LandlockState"
    expires_after="2027-04-16">
  <owner>akhna@google.com</owner>
  <owner>chromeos-hardening@google.com</owner>
  <summary>
    Logged when `ContentMainRunnerImpl::Initialize` is called from the browser
    process.

    Records the status of the Landlock LSM on the system, whether it is enabled,
    available but disabled, not available, or undetermined.
  </summary>
</histogram>

<histogram name="Security.ScreenOrientation.LockRequestIsSandboxed"
    enum="Boolean" expires_after="2027-01-27">
  <owner>alexmos@chromium.org</owner>
  <owner>helmut@januschka.com</owner>
  <summary>
    Records whether the requesting frame lacks the allow-orientation-lock
    sandbox permission for each browser-side screen orientation lock request.
    This measures how often media controls request orientation locks from
    sandboxed frames before browser-side enforcement is reconsidered.
  </summary>
</histogram>

<histogram name="Security.SCTAuditing.NumPersistedReportsLoaded"
    units="reports" expires_after="2024-05-19">
  <owner>cthomp@chromium.org</owner>
  <owner>trusty-transport@chromium.org</owner>
  <summary>
    Records the number of persisted SCT auditing reports that were loaded and
    deserialized from disk, if SCT auditing is enabled. Invalid persisted
    reports are not counted. Recorded once shortly after browser startup (or
    when the network service restarts).
  </summary>
</histogram>

<histogram name="Security.SCTAuditing.OptIn.DedupeCacheHWM" units="reports"
    expires_after="2023-01-15">
  <owner>cthomp@chromium.org</owner>
  <owner>trusty-transport@chromium.org</owner>
  <summary>
    Records the high-water-mark of the number of entries in the SCT auditing
    dedupe cache. Recorded on a timer hourly, if SCT auditing is enabled.
  </summary>
</histogram>

<histogram name="Security.SCTAuditing.OptIn.ReportCompletionStatus"
    enum="SCTAuditingReportCompletionStatus" expires_after="2024-06-30">
  <owner>cthomp@chromium.org</owner>
  <owner>trusty-transport@chromium.org</owner>
  <summary>
    Records the final status of an SCT auditing report, when it has been
    successfully received or it has run out of retries.
  </summary>
</histogram>

<histogram name="Security.SCTAuditing.OptIn.ReportDeduplicated" enum="Boolean"
    expires_after="2024-05-26">
  <owner>cthomp@chromium.org</owner>
  <owner>trusty-transport@chromium.org</owner>
  <summary>
    Records whether a report was deduplicated (i.e., the SCTs were already in
    the cache) or not. Recorded on each new report seen by the SCT auditing
    cache (i.e., on each connection using certificate transparency).
  </summary>
</histogram>

<histogram name="Security.SCTAuditing.OptIn.ReportersHWM" units="reporters"
    expires_after="2024-05-26">
  <owner>cthomp@chromium.org</owner>
  <owner>trusty-transport@chromium.org</owner>
  <summary>
    Records the high-water-mark of the number of pending reporters in the SCT
    auditing cache. Recorded on a timer hourly, if SCT auditing is enabled.
  </summary>
</histogram>

<histogram name="Security.SCTAuditing.OptIn.ReportSize" units="bytes"
    expires_after="2024-05-26">
  <owner>cthomp@chromium.org</owner>
  <owner>trusty-transport@chromium.org</owner>
  <summary>
    Records the size of an SCT auditing report that will be sent to Safe
    Browsing (i.e., was not deduplicated and was sampled).
  </summary>
</histogram>

<histogram name="Security.SCTAuditing.OptIn.ReportSucceeded" enum="Boolean"
    expires_after="2024-07-28">
  <owner>cthomp@chromium.org</owner>
  <owner>trusty-transport@chromium.org</owner>
  <summary>
    Records whether sending an SCT auditing report succeeded or not. This is
    recorded after we receive the headers from the server (or we stop due to a
    connection error).
  </summary>
</histogram>

<histogram name="Security.SCTAuditing.OptOut.DroppedDueToLogNotFound"
    enum="Boolean" expires_after="2027-04-01">
  <owner>cthomp@chromium.org</owner>
  <owner>trusty-transport@chromium.org</owner>
  <summary>
    Records whether a hashdance report was dropped due to not finding the log
    metadata for the selected SCT. Recorded once when creating a new auditing
    report, but before the report is sampled or deduplicated.

    Note: This histogram was expired from 2024-05-26 through 2025-03-31.
  </summary>
</histogram>

<histogram name="Security.SCTAuditing.OptOut.LookupQueryResult"
    enum="SCTLookupQueryResult" expires_after="2027-04-01">
  <owner>cthomp@chromium.org</owner>
  <owner>nsatragno@chromium.org</owner>
  <owner>trusty-transport@chromium.org</owner>
  <summary>
    Records the result of a hashdance lookup query. Recorded once per query
    regardless of whether the query succeeded, failed, or is a retry.

    Note: This histogram was expired from 2024-05-26 through 2025-03-31.
  </summary>
</histogram>

<histogram name="Security.SCTAuditing.OptOut.PopularSCTSkipped" enum="Boolean"
    expires_after="2027-04-01">
  <owner>cthomp@chromium.org</owner>
  <owner>nsatragno@chromium.org</owner>
  <owner>trusty-transport@chromium.org</owner>
  <summary>
    Records whether an SCT selected for a hashdance lookup query was skipped
    because it was found on the Popular SCTs list. Recorded once when creating a
    new auditing report, but before the report is sampled or deduplicated.

    Note: This histogram was expired from 2024-05-26 through 2025-03-31.
  </summary>
</histogram>

<histogram name="Security.SCTAuditing.OptOut.ReportCount" units="reports"
    expires_after="2027-04-01">
  <owner>cthomp@chromium.org</owner>
  <owner>jdeblasio@chromium.org</owner>
  <summary>
    Records how many full SCT auditing reports the client has sent (i.e., after
    a successful hashdance lookup query resulting in kSCTSuffixNotFound). This
    count is tracked per-client in a pref to limit how many full reports a
    client can send. This metric is emitted every time this count is checked by
    the SCT auditing code, after sampling is performed, and only once per report
    (including across browser restarts). This metric is only emitted for SCT
    auditing hashdance users.

    Note: This histogram was expired from 2024-05-26 through 2025-03-31.
  </summary>
</histogram>

<histogram name="Security.SecurityLevel.DownloadStarted" enum="SecurityLevel"
    expires_after="2023-11-12">
  <owner>cthomp@chromium.org</owner>
  <owner>security-enamel@chromium.org</owner>
  <summary>
    Records the security level of the page that initiated a download (rather
    than the security state of the connection to the download URL itself). The
    recorded security level is the level of the page the download was initiated
    from, not that of the download URL. This histogram is not recorded for
    downloads that are initiated in a new tab or window, as the security level
    of the initiating page cannot be tracked.
  </summary>
</histogram>

<histogram name="Security.SecurityLevel.OnCommit" enum="SecurityLevel"
    expires_after="2027-04-01">
  <owner>cthomp@chromium.org</owner>
  <owner>security-enamel@chromium.org</owner>
  <summary>
    Records the security level of a page at the time the navigation commits.
    Note that the security level of a page can change after commit time, so this
    histogram should often be compared against
    Security.SecurityLevel.OnComplete.
  </summary>
</histogram>

<histogram name="Security.SecurityLevel.OnComplete" enum="SecurityLevel"
    expires_after="2027-04-01">
  <owner>cthomp@chromium.org</owner>
  <owner>security-enamel@chromium.org</owner>
  <summary>
    Records the security level of a page at the end of the page visit (i.e.,
    navigating away from the page, reloading the page, clicking a link, closing
    the tab, etc.). Note that this security level can be different than the
    initial security level of the page, so this histogram should often be
    compared against Security.SecuritLevel.OnCommit.
  </summary>
</histogram>

<histogram name="Security.SiteEngagement{SafetyTip}" units="units"
    expires_after="2023-11-12">
  <owner>cthomp@chromium.org</owner>
  <owner>security-enamel@chromium.org</owner>
  <summary>
    The final Site Engagement score (0 to 100) of a URL during a visit to a
    page. Recorded when the user closes the page or initiates a new navigation.
    {SafetyTip}
  </summary>
</histogram>

<histogram
    name="Security.StandardBundle.JavascriptOptimizerSetting.WasModifiedFromDefault"
    enum="Boolean" expires_after="2026-08-01">
  <owner>awado@google.com</owner>
  <owner>chrome-counter-abuse-alerts@google.com</owner>
  <summary>
    Records whether the user has changed the javascript optimizer setting from
    the default for the standard bundle. Recorded for all uma logs at upload
    time by the BundleSettingsMetricsProvider for the main profile only.
  </summary>
</histogram>

<histogram
    name="Security.StandardBundle.SafeBrowsingSetting.WasModifiedFromDefault"
    enum="Boolean" expires_after="2026-08-01">
  <owner>awado@google.com</owner>
  <owner>chrome-counter-abuse-alerts@google.com</owner>
  <summary>
    Records whether the user has changed the safe browsing setting from the
    default for the standard bundle. Recorded for all uma logs at upload time by
    the BundleSettingsMetricsProvider for the main profile only.
  </summary>
</histogram>

<histogram name="Security.TimeOnPage2{SafetyTip}" units="ms"
    expires_after="2025-01-26">
  <owner>cthomp@chromium.org</owner>
  <owner>security-enamel@chromium.org</owner>
  <summary>
    Records the time spent on the page (the time that the page was in the
    foreground from the start of the navigation to the page visit completing due
    to a new navigation or the tab being closed). This aggregates all foreground
    time over the entire visit (multiple times in the foreground are added
    together). {SafetyTip}
  </summary>
</histogram>

<histogram name="SiteIsolation.BrowsingInstance.MaxCountPerProcess"
    units="units" expires_after="2026-11-17">
  <owner>alexmos@chromium.org</owner>
  <owner>creis@chromium.org</owner>
  <summary>
    The maximum number of BrowsingInstances seen in a RenderProcessHost over its
    lifetime. Recorded once when
    ChildProcessSecurityPolicyImpl::ProcessState::~ProcessState() is invoked.
  </summary>
</histogram>

<histogram name="SiteIsolation.BrowsingInstanceCount" units="units"
    expires_after="2027-06-21">
  <owner>alexmos@chromium.org</owner>
  <owner>creis@chromium.org</owner>
  <summary>
    The count of all current BrowsingInstances. Recorded once per UMA ping.
  </summary>
</histogram>

<histogram name="SiteIsolation.CreateOpenerProxiesTime" units="microseconds"
    expires_after="2026-09-20">
  <owner>alexmos@chromium.org</owner>
  <owner>creis@chromium.org</owner>
  <owner>nasko@chromium.org</owner>
  <summary>
    Time spent in RenderFrameHostmanager::CreateOpenerProxies(), which is a core
    site isolation function for creating all necessary proxies when navigating
    cross-site, sending postMessages, etc.

    This histogram only records metrics on machines with high-resolution clocks.
  </summary>
</histogram>

<histogram name="SiteIsolation.DisabledReason.AndroidDesktop"
    enum="SiteIsolationDisabledReason" expires_after="2026-09-26">
  <owner>alexmos@chromium.org</owner>
  <owner>creis@chromium.org</owner>
  <owner>wenz@chromium.org</owner>
  <summary>
    The reason why site isolation is not enabled to the extent of
    site-per-process or stricter, on Android Desktop builds. Records a value of
    'Not disabled' if the site isolation mode is site-per-process or stricter.
    Recorded once shortly after browser startup, because the value does not
    change at runtime.
  </summary>
</histogram>

<histogram name="SiteIsolation.IsolatableSandboxedIframes" units="processes"
    expires_after="2027-07-26">
  <owner>alexmos@chromium.org</owner>
  <owner>creis@chromium.org</owner>
  <summary>
    The number of sandboxed iframes that (i) are same-site (and therefore not
    already process-isolated) and (ii) eligible to be process isolated if
    SiteIsolationPolicy::AreIsolatedSandboxedIframesEnabled() is true. A
    sandboxed iframe is eligible for process-isolation so long as it doesn't
    have `allow-same-origin` among its sandbox permissions, and it isn't an
    about:blank url. This metric measures the upper bound on the process
    overhead of isolating sandboxed iframes, namely the case where every
    sandboxed iframe is placed in its own process. Note that the computation of
    this metric is independent of the current process model. Recorded once per
    UMA ping.
  </summary>
</histogram>

<histogram name="SiteIsolation.IsolatableSandboxedIframes.UniqueOrigins"
    units="processes" expires_after="2027-07-26">
  <owner>alexmos@chromium.org</owner>
  <owner>creis@chromium.org</owner>
  <summary>
    The number of unique origins among the sandboxed iframes reported in
    SiteIsolation.IsolatableSandboxedIframes. Used to estimate the potential
    process overhead if a per-origin process model is used for isolating the
    sandboxed iframes instead of the (current) per-site process model. Note that
    the computation of this metric is independent of the current process model.
    Recorded once per UMA ping.
  </summary>
</histogram>

<histogram name="SiteIsolation.IsolatableSandboxedIframes.UniqueSites"
    units="processes" expires_after="2027-07-26">
  <owner>alexmos@chromium.org</owner>
  <owner>creis@chromium.org</owner>
  <summary>
    The number of unique sites among the sandboxed iframes reported in
    SiteIsolation.IsolatableSandboxedIframes. Note that the computation of this
    metric is independent of the current process model. Recorded once per UMA
    ping.
  </summary>
</histogram>

<histogram name="SiteIsolation.IsPasswordFormSubmittedInDedicatedProcess"
    enum="SiteIsolationIsDedicatedProcess" expires_after="2027-05-24">
  <owner>alexmos@chromium.org</owner>
  <owner>lukasza@chromium.org</owner>
  <summary>
    Logs whether or not a password form was submitted from a site-isolated
    process that's dedicated to a single site. Recorded when a password form is
    submitted.
  </summary>
</histogram>

<histogram name="SiteIsolation.IsSitePerProcessOrStricter" enum="Boolean"
    expires_after="2026-12-27">
  <owner>alexmos@chromium.org</owner>
  <owner>creis@chromium.org</owner>
  <owner>wenz@chromium.org</owner>
  <summary>
    Whether the site isolation mode is site-per-process or more strict. Recorded
    once shortly after browser startup, because the value does not change at
    runtime.
  </summary>
</histogram>

<histogram name="SiteIsolation.IsSitePerProcessOrStricter.AndroidDesktop"
    enum="Boolean" expires_after="2026-11-01">
  <owner>alexmos@chromium.org</owner>
  <owner>creis@chromium.org</owner>
  <owner>wenz@chromium.org</owner>
  <summary>
    Whether the site isolation mode is site-per-process or more strict
    specifically for Android Desktop devices. Recorded once shortly after
    browser startup, because the value does not change at runtime.
  </summary>
</histogram>

<histogram name="SiteIsolation.MainFrameProcessReuse.BlockReason2"
    enum="MainFrameProcessReuseBlockReason" expires_after="2026-12-31">
  <owner>bashi@chromium.org</owner>
  <owner>gjc@google.com</owner>
  <owner>blink-network-stack@google.com</owner>
  <owner>chrome-loading@google.com</owner>
  <summary>
    The reason why process sharing is allowed or disallowed for main frame
    navigation. The UMA is only reported when the feature flag
    ProcessPerSiteWithMainFrameThreshold or
    ReusePrerenderingProcessForMainFrames is enabled. The UMA is recorded when
    initializing a frame tree or getting a site instance for navigation.
  </summary>
</histogram>

<histogram name="SiteIsolation.MissedReuseOpportunity.Found.MainFrame"
    enum="Boolean" expires_after="2027-01-24">
  <owner>aattar@google.com</owner>
  <owner>olivierli@chromium.org</owner>
  <summary>
    Records whether a recently destroyed RenderProcessHost was found (true) or
    not (false) that could have been reused for a new main frame navigation.
    This is recorded when a live reusable process could not be found, by
    checking for hosts destroyed within the last 2 hours.
  </summary>
</histogram>

<histogram name="SiteIsolation.MissedReuseOpportunity.Found.Subframe"
    enum="Boolean" expires_after="2027-01-24">
  <owner>aattar@google.com</owner>
  <owner>olivierli@chromium.org</owner>
  <summary>
    Records whether a recently destroyed RenderProcessHost was found (true) or
    not (false) that could have been reused for a new subframe navigation. This
    is recorded when a live reusable process could not be found, by checking for
    hosts destroyed within the last 60 seconds.
  </summary>
</histogram>

<histogram name="SiteIsolation.OutOfProcessIframes" units="oopifs"
    expires_after="2027-02-07">
  <owner>alexmos@chromium.org</owner>
  <owner>creis@chromium.org</owner>
  <owner>lukasza@chromium.org</owner>
  <owner>nasko@chromium.org</owner>
  <summary>
    The count of all out-of-process iframes. Recorded once per UMA ping.
  </summary>
</histogram>

<histogram name="SiteIsolation.OutOfProcessInnerFrameTrees" units="frame trees"
    expires_after="2027-07-21">
  <owner>alexmos@chromium.org</owner>
  <owner>creis@chromium.org</owner>
  <owner>lukasza@chromium.org</owner>
  <owner>nasko@chromium.org</owner>
  <summary>
    The count of all out-of-process inner frame trees. Recorded once per UMA
    ping.
  </summary>
</histogram>

<histogram
    name="SiteIsolation.ProcessPerSiteWithMainFrameThreshold.IsDevToolsUser"
    enum="Boolean" expires_after="M135">
  <owner>dtapuska@chromium.org</owner>
  <owner>blink-network-stack@google.com</owner>
  <summary>
    Whether any profile exists with devtools last opened time within 7 days and
    ProcessPerSiteWithMainFrameThreshold feature will be opted out because of
    this. This is logged once per browser process launch.
  </summary>
</histogram>

<histogram name="SiteIsolation.ProxyCount" units="proxies"
    expires_after="2027-02-21">
  <owner>alexmos@chromium.org</owner>
  <owner>creis@chromium.org</owner>
  <owner>lukasza@chromium.org</owner>
  <summary>
    The count of all RenderFrameProxyHosts. Recorded once per UMA ping.
  </summary>
</histogram>

<histogram name="SiteIsolation.ProxyCountPerBrowsingInstance" units="units"
    expires_after="2027-07-09">
  <owner>alexmos@chromium.org</owner>
  <owner>creis@chromium.org</owner>
  <owner>lukasza@chromium.org</owner>
  <summary>
    The count of RenderFrameProxyHosts in each BrowsingInstance. Recorded each
    UMA ping, once per BrowsingInstance.
  </summary>
</histogram>

<histogram name="SiteIsolation.ReusePendingOrCommittedSite.CouldReuse2"
    enum="ReusePendingOrCommittedSiteEnum" expires_after="2023-06-04">
  <owner>clamy@chromium.org</owner>
  <summary>
    Whether SiteInstances with a ProcessReusePolicy of
    kReusePendingOrCommittedSite could reuse an existing RenderProcessHost or
    they had to create a new one. True when they reused an existing process,
    false when they created a new one.

    (Was expired between M77 and M105 before moving on to V2.)
  </summary>
</histogram>

<histogram
    name="SiteIsolation.ReusePendingOrCommittedSite.TimeSinceReusableProcessDestroyed.MainFrame2"
    units="ms" expires_after="2027-01-24">
  <owner>aattar@google.com</owner>
  <owner>olivierli@chromium.org</owner>
  <summary>
    Recorded when creating a new process for a main frame navigation, after
    failing to find a live one to reuse. Measures the time since a
    RenderProcessHost for the same site was last destroyed, up to 2 hours. This
    metric does not record a value for misses; use
    SiteIsolation.MissedReuseOpportunity.Found.MainFrame to determine hit rate.
  </summary>
</histogram>

<histogram
    name="SiteIsolation.ReusePendingOrCommittedSite.TimeSinceReusableProcessDestroyed.Subframe2"
    units="ms" expires_after="2026-12-27">
  <owner>aattar@google.com</owner>
  <owner>olivierli@chromium.org</owner>
  <summary>
    Recorded on subframe navigations when a live reusable process could not be
    found. Measures the time since a RenderProcessHost for the same site was
    last destroyed, up to 60 seconds. This metric does not record a value for
    misses; use SiteIsolation.MissedReuseOpportunity.Found.Subframe to determine
    hit rate.
  </summary>
</histogram>

<histogram name="SiteIsolation.SavedOAuthSites.Size" units="origins"
    expires_after="2027-07-28">
  <owner>alexmos@chromium.org</owner>
  <owner>creis@chromium.org</owner>
  <owner>lukasza@chromium.org</owner>
  <summary>
    The number of currently saved sites that had been isolated due to OAuth.
    This is only used by Site Isolation on Android. Recorded once on browser
    startup.
  </summary>
</histogram>

<histogram name="SiteIsolation.SavedUserTriggeredIsolatedOrigins.Size"
    units="origins" expires_after="2027-07-28">
  <owner>alexmos@chromium.org</owner>
  <owner>creis@chromium.org</owner>
  <owner>lukasza@chromium.org</owner>
  <summary>
    The number of currently saved user-triggered isolated sites. This includes
    sites where the user has entered a password while using Site Isolation for
    password sites (which is a currently active site isolation mode on Android).
    Recorded once on browser startup.
  </summary>
</histogram>

<histogram name="SiteIsolation.SavedWebTriggeredIsolatedOrigins.Size"
    units="origins" expires_after="2027-07-28">
  <owner>alexmos@chromium.org</owner>
  <owner>creis@chromium.org</owner>
  <owner>lukasza@chromium.org</owner>
  <summary>
    The number of currently saved web-triggered isolated sites. This includes
    sites that were isolated due to Cross-Origin-Opener-Policy headers, which is
    a heuristic used for site isolation on Android. Recorded once on browser
    startup.
  </summary>
</histogram>

<histogram name="SiteIsolation.SiteInstancesPerBrowsingInstance" units="units"
    expires_after="2026-12-27">
  <owner>alexmos@chromium.org</owner>
  <owner>creis@chromium.org</owner>
  <owner>lukasza@chromium.org</owner>
  <owner>nasko@chromium.org</owner>
  <summary>
    The count of SiteInstances in a single BrowsingInstance. Recorded each UMA
    ping, once per BrowsingInstance.
  </summary>
</histogram>

</histograms>

</histogram-configuration>
