diff --git a/.github/workflows/container-codecs.yaml b/.github/workflows/container-codecs.yaml
new file mode 100644
index 0000000..00763c3
--- /dev/null
+++ b/.github/workflows/container-codecs.yaml
@@ -0,0 +1,76 @@
+name: Container (H.264/H.265)
+
+# The image variant with a CEF build that plays H.264 and H.265 (docs/proprietary-codecs.md).
+# A tag codecs-<version> (for example codecs-1.3.3) builds that commit and pushes
+# <version>-codecs. Normal releases (v*.*.*) are not touched.
+on:
+  push:
+    tags: ["codecs-*"]
+
+concurrency:
+  group: container-codecs-${{ github.ref }}
+  cancel-in-progress: false
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - id: cef
+        name: Read the CEF build and refuse an existing tag
+        run: |
+          . docker/cef-codecs/cef.env
+          echo "url=${CEF_CODECS_URL}" >> "$GITHUB_OUTPUT"
+          echo "sha1=${CEF_CODECS_SHA1}" >> "$GITHUB_OUTPUT"
+          tag="${GITHUB_REF_NAME#codecs-}-codecs"
+          echo "tag=${tag}" >> "$GITHUB_OUTPUT"
+          if docker manifest inspect "${REGISTRY}/${IMAGE_NAME,,}:${tag}" >/dev/null 2>&1; then
+            echo "image tag ${tag} exists; tags are never moved" >&2
+            exit 1
+          fi
+
+      - uses: docker/setup-buildx-action@v3
+
+      - uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=raw,value=${{ steps.cef.outputs.tag }}
+            type=raw,value=codecs
+          flavor: |
+            latest=false
+          labels: |
+            org.opencontainers.image.title=mxl-browser-source (H.264/H.265)
+            org.opencontainers.image.description=MXL media function: a web page rendered offscreen with CEF, built with proprietary codecs (H.264, H.265). Codec licensing is the user's responsibility.
+            org.opencontainers.image.source=https://github.com/LeeO86/mxl-browser-source
+            org.opencontainers.image.revision=${{ github.sha }}
+            org.opencontainers.image.licenses=MIT
+            io.dmf.mxl.revision=218ddaa0a08c12ffe75fc475ae65aa3d9eef16d7
+
+      - uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: docker/Dockerfile
+          push: true
+          build-args: |
+            CEF_URL=${{ steps.cef.outputs.url }}
+            CEF_SHA1=${{ steps.cef.outputs.sha1 }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha,scope=codecs
+          cache-to: type=gha,mode=max,scope=codecs
diff --git a/CHANGELOG.md b/CHANGELOG.md
index c0d7473..82435af 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,11 @@
 # Changelog
 
+## Image variant 1.3.3-codecs
+
+- **H.264 and H.265 (proprietary codecs).** A second image, `<version>-codecs`, uses a CEF build of the same version with H.264 (`<video>`, MSE, WebRTC receive) and H.265 (`<video>`, MSE) decoding in software; the normal image cannot play them, so for example the WebRTC previews of other functions stayed black. The function itself is unchanged. **Licensing is the user's responsibility** ([`docs/proprietary-codecs.md`](docs/proprietary-codecs.md)).
+  - `docker/Dockerfile` takes `CEF_URL` (default: the CEF project's build as before); `docker/cef-codecs/` holds the patches and the URL and SHA-1 of the build; a tag `codecs-<version>` runs `.github/workflows/container-codecs.yaml`.
+  - Tests: `tests/codecs/codecs.html` (all OK in the variant: `<video>` and MSE for both codecs, WebRTC H.264 loopback; WebRTC H.265 is not offered).
+
 ## 1.3.3
 
 - **Counters at 0 from the start** (SPEC §12, #14). Every event counter was created on its first event, so `page_hangs_total`, `preview_frames_dropped_total`, `renderer_crashes_total` and the like had no series (dashboards: "no data") until something happened. They are now exported at 0 when the function starts, with every label value the code can produce: `page_hangs_total`, `popups_blocked_total`, `downloads_blocked_total`, `preview_frames_total`, `preview_frames_dropped_total`, `page_loads_total{result}`, `renderer_crashes_total{reason}` (`abnormal`, `killed`, `crashed`, `oom`, `other`, `hung`), `js_dialogs_total{type}`, `permission_denied_total{type}`, `navigation_blocked_total{reason}`, `console_messages_total{level}`, `ograf_actions_total{action,result}`, `ograf_uploads_total{result}`, `ograf_restores_total{result}`, `interaction_events_total{type,result}` and, with audio, `audio_stream_events_total{event}`. Names, labels and meaning are unchanged.
diff --git a/README.md b/README.md
index b2dff3c..706c234 100644
--- a/README.md
+++ b/README.md
@@ -109,6 +109,10 @@ Image size: about 900 MB uncompressed (CEF's `libcef.so` stripped of its debug s
 
 CMake ≥ 3.24 and Ninja. Without CEF and libmxl the core library and its unit tests build anywhere (`cmake -S . -B build -G Ninja && cmake --build build && build/unit-tests`; needs `libsamplerate0-dev`). The process itself builds in `docker/Dockerfile` (CEF minimal distribution, MXL via vcpkg, nmos-cpp). Behind a TLS-intercepting proxy pass `EXTRA_CA_CERT_B64` and the proxy build args.
 
+### Image with H.264 and H.265
+
+`ghcr.io/leeo86/mxl-browser-source:<version>-codecs` is the same function with a CEF build that also plays H.264 (`<video>`, MSE, WebRTC receive) and H.265 (`<video>`, MSE), for example the WebRTC previews of other functions, which stay black in the normal image. **Licensing warning:** H.264 and H.265 are covered by patents; whoever deploys this variant is responsible for any licences that apply. How it is built: [`docs/proprietary-codecs.md`](docs/proprietary-codecs.md).
+
 ## License
 
 MIT, see [`LICENSE`](LICENSE). The image contains CEF (BSD-3-Clause), Chromium and other components with their own licences: [`THIRD_PARTY_NOTICES.md`](THIRD_PARTY_NOTICES.md), in the image under `/usr/share/doc/mxl-browser-source/` (CEF's `LICENSE.txt` and Chromium's `CREDITS.html` in `cef/`).
diff --git a/docker/Dockerfile b/docker/Dockerfile
index da23f37..2f39a52 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -21,6 +21,8 @@ RUN npm run build
 FROM ${UBUNTU} AS cef
 ARG CEF_VERSION=144.0.21+g4f5b28c+chromium-144.0.7559.248
 ARG CEF_SHA1=e6233049cec12ba108b4b920b499e2a082ffd0ae
+# Another CEF build of the same version, e.g. the one with H.264/H.265 (docs/proprietary-codecs.md).
+ARG CEF_URL=""
 ARG EXTRA_CA_CERT_B64=""
 RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
         ca-certificates curl bzip2 build-essential cmake ninja-build python3 \
@@ -29,7 +31,7 @@ RUN if [ -n "$EXTRA_CA_CERT_B64" ]; then echo "$EXTRA_CA_CERT_B64" | base64 -d >
 COPY docker/fetch.sh /usr/local/bin/fetch.sh
 WORKDIR /opt
 # libcef.so ships with debug symbols (1.5 GB): stripped, the dynamic symbols stay for linking.
-RUN url="https://cef-builds.spotifycdn.com/cef_binary_$(echo "$CEF_VERSION" | sed 's/+/%2B/g')_linux64_minimal.tar.bz2" \
+RUN url="${CEF_URL:-https://cef-builds.spotifycdn.com/cef_binary_$(echo "$CEF_VERSION" | sed 's/+/%2B/g')_linux64_minimal.tar.bz2}" \
     && sh /usr/local/bin/fetch.sh "$url" cef.tar.bz2 "$CEF_SHA1" \
     && mkdir cef && tar xjf cef.tar.bz2 -C cef --strip-components=1 && rm cef.tar.bz2 \
     && strip --strip-unneeded cef/Release/libcef.so \
diff --git a/docker/cef-codecs/cef.env b/docker/cef-codecs/cef.env
new file mode 100644
index 0000000..35575fe
--- /dev/null
+++ b/docker/cef-codecs/cef.env
@@ -0,0 +1,4 @@
+# CEF build with H.264/H.265 for the image variant <version>-codecs (docs/proprietary-codecs.md).
+# Same CEF version as docker/Dockerfile (CEF_VERSION); attached to the GitHub release cef-144.0.21-codecs.
+CEF_CODECS_URL=https://github.com/LeeO86/mxl-browser-source/releases/download/cef-144.0.21-codecs/cef_binary_144.0.21-g4f5b28c-chromium-144.0.7559.248_linux64_minimal_codecs_r2.tar.bz2
+CEF_CODECS_SHA1=0bd9c3db41c2465586cef9c579d1497f7d8763f8
diff --git a/docker/cef-codecs/chromium-media-hevc.patch b/docker/cef-codecs/chromium-media-hevc.patch
new file mode 100644
index 0000000..0490246
--- /dev/null
+++ b/docker/cef-codecs/chromium-media-hevc.patch
@@ -0,0 +1,121 @@
+diff --git a/media/base/supported_types.cc b/media/base/supported_types.cc
+index 117bb7eb6d..3b49f40263 100644
+--- a/media/base/supported_types.cc
++++ b/media/base/supported_types.cc
+@@ -232,6 +232,10 @@ bool IsDecoderHevcProfileSupported(const VideoType& type) {
+   if (!IsDecoderColorSpaceSupported(type.color_space)) {
+     return false;
+   }
++#if BUILDFLAG(ENABLE_FFMPEG_VIDEO_DECODERS) && BUILDFLAG(USE_PROPRIETARY_CODECS)
++  // Software HEVC decoding through FFmpeg (this build).
++  return true;
++#else
+ 
+ #if BUILDFLAG(ENABLE_PLATFORM_HEVC)
+ #if BUILDFLAG(PLATFORM_HAS_OPTIONAL_HEVC_DECODE_SUPPORT)
+@@ -248,6 +252,7 @@ bool IsDecoderHevcProfileSupported(const VideoType& type) {
+ #else
+   return false;
+ #endif  // BUILDFLAG(ENABLE_PLATFORM_HEVC)
++#endif  // ENABLE_FFMPEG_VIDEO_DECODERS && USE_PROPRIETARY_CODECS
+ }
+ 
+ bool IsDecoderVp9ProfileSupported(const VideoType& type) {
+@@ -579,7 +584,7 @@ bool IsEncoderOptionalVideoType(const media::VideoType& type) {
+ 
+ bool IsDecoderBuiltInVideoCodec(VideoCodec codec) {
+ #if BUILDFLAG(ENABLE_FFMPEG_VIDEO_DECODERS) && BUILDFLAG(USE_PROPRIETARY_CODECS)
+-  if (codec == VideoCodec::kH264) {
++  if (codec == VideoCodec::kH264 || codec == VideoCodec::kHEVC) {
+     return true;
+   }
+ #endif  // BUILDFLAG(ENABLE_FFMPEG_VIDEO_DECODERS) &&
+diff --git a/media/ffmpeg/ffmpeg_common.cc b/media/ffmpeg/ffmpeg_common.cc
+index eba1a21b3b..a4be993fc7 100644
+--- a/media/ffmpeg/ffmpeg_common.cc
++++ b/media/ffmpeg/ffmpeg_common.cc
+@@ -64,7 +64,7 @@ VideoColorSpace GetGuessedColorSpace(const VideoColorSpace& color_space) {
+ const char* GetAllowedVideoDecoders() {
+   // This should match the configured lists in //third_party/ffmpeg.
+ #if BUILDFLAG(USE_PROPRIETARY_CODECS) && BUILDFLAG(ENABLE_FFMPEG_VIDEO_DECODERS)
+-  return "h264";
++  return "h264,hevc";
+ #else
+   return "";
+ #endif
+diff --git a/media/ffmpeg/scripts/build_ffmpeg.py b/media/ffmpeg/scripts/build_ffmpeg.py
+index 9ef6ba9afc..591c82c324 100755
+--- a/media/ffmpeg/scripts/build_ffmpeg.py
++++ b/media/ffmpeg/scripts/build_ffmpeg.py
+@@ -1001,9 +1001,9 @@ def ConfigureAndBuild(target_arch, target_os, host_os, host_arch,
+ 
+     # Google Chrome specific configuration.
+     configure_flags['Chrome'].extend([
+-        '--enable-decoder=aac,h264',
++        '--enable-decoder=aac,h264,hevc',
+         '--enable-demuxer=aac',
+-        '--enable-parser=aac,h264',
++        '--enable-parser=aac,h264,hevc',
+     ])
+ 
+     configure_flags['ChromeAndroid'].extend([
+diff --git a/media/filters/ffmpeg_video_decoder.cc b/media/filters/ffmpeg_video_decoder.cc
+index fef13f6b8a..4d8e2c03e4 100644
+--- a/media/filters/ffmpeg_video_decoder.cc
++++ b/media/filters/ffmpeg_video_decoder.cc
+@@ -73,7 +73,6 @@ static int GetFFmpegVideoDecoderThreadCount(const VideoDecoderConfig& config) {
+     case VideoCodec::kUnknown:
+     case VideoCodec::kVC1:
+     case VideoCodec::kMPEG2:
+-    case VideoCodec::kHEVC:
+     case VideoCodec::kVP9:
+     case VideoCodec::kAV1:
+     case VideoCodec::kDolbyVision:
+@@ -84,6 +83,7 @@ static int GetFFmpegVideoDecoderThreadCount(const VideoDecoderConfig& config) {
+       NOTREACHED();
+ 
+     case VideoCodec::kH264:
++    case VideoCodec::kHEVC:  // Software HEVC (this build): same as H.264.
+       // Normalize to three threads for 1080p content, then scale linearly
+       // with number of pixels.
+       // Examples:
+@@ -117,8 +117,9 @@ static void ReleaseVideoBufferImpl(void* opaque, uint8_t* data) {
+ 
+ // static
+ bool FFmpegVideoDecoder::IsCodecSupported(VideoCodec codec) {
+-  // We only build support for H.264.
+-  return codec == VideoCodec::kH264 && IsDecoderBuiltInVideoCodec(codec);
++  // H.264 and (in this build) HEVC.
++  return (codec == VideoCodec::kH264 || codec == VideoCodec::kHEVC) &&
++         IsDecoderBuiltInVideoCodec(codec);
+ }
+ 
+ FFmpegVideoDecoder::FFmpegVideoDecoder(MediaLog* media_log)
+diff --git a/media/video/renderable_gpu_memory_buffer_video_frame_pool.cc b/media/video/renderable_gpu_memory_buffer_video_frame_pool.cc
+index 5e025cfae4..4fe448a1be 100644
+--- a/media/video/renderable_gpu_memory_buffer_video_frame_pool.cc
++++ b/media/video/renderable_gpu_memory_buffer_video_frame_pool.cc
+@@ -194,6 +194,23 @@ bool FrameResources::Initialize(VideoPixelFormat format,
+ 
+   gfx::BufferUsage buffer_usage = gfx::BufferUsage::SCANOUT_CPU_READ_WRITE;
+ 
++#if BUILDFLAG(IS_WIN)
++  // For CEF OSR feature, currently there's no other place in chromium use RGBA.
++  // If the format is RGBA, currently CEF do not write to the texture anymore
++  // once the GMB is returned from CopyRequest. So there will be no race
++  // condition on that texture. We can request a GMB without a keyed mutex to
++  // accelerate and probably prevent some driver deadlock.
++  if (format == PIXEL_FORMAT_ARGB || format == PIXEL_FORMAT_ABGR) {
++    // This value is 'borrowed', SCANOUT_VEA_CPU_READ is probably invalid
++    // cause there's no real SCANOUT on Windows. We simply use this enum as a
++    // flag to disable mutex in the GMBFactoryDXGI because this enum is also
++    // used above in macOS and CrOS for similar usage (claim no other one will
++    // concurrently use the resource).
++    // https://chromium-review.googlesource.com/c/chromium/src/+/5302103
++    buffer_usage = gfx::BufferUsage::SCANOUT_VEA_CPU_READ;
++  }
++#endif
++
+ #if BUILDFLAG(IS_MAC) || BUILDFLAG(IS_CHROMEOS)
+   buffer_usage = gfx::BufferUsage::SCANOUT_VEA_CPU_READ;
+ #elif BUILDFLAG(IS_LINUX)
diff --git a/docker/cef-codecs/ffmpeg-hevc.patch b/docker/cef-codecs/ffmpeg-hevc.patch
new file mode 100644
index 0000000..b5b730f
--- /dev/null
+++ b/docker/cef-codecs/ffmpeg-hevc.patch
@@ -0,0 +1,286 @@
+diff --git a/BUILD.gn b/BUILD.gn
+index fecd76c..0ecc94f 100644
+--- a/BUILD.gn
++++ b/BUILD.gn
+@@ -220,6 +220,10 @@ target(link_target_type, "ffmpeg_internal") {
+     platform_config_root,
+     ".",
+   ]
++  if (use_linux_config && current_cpu == "x64" && ffmpeg_branding == "Chrome") {
++    # The HEVC decoder (local build) includes libavcodec headers by bare name.
++    include_dirs += [ "libavcodec" ]
++  }
+   defines = [
+     "HAVE_AV_CONFIG_H",
+     "_POSIX_C_SOURCE=200112",
+diff --git a/chromium/config/Chrome/linux/x64/config.asm b/chromium/config/Chrome/linux/x64/config.asm
+index fdb62d9..9fb6ee9 100644
+--- a/chromium/config/Chrome/linux/x64/config.asm
++++ b/chromium/config/Chrome/linux/x64/config.asm
+@@ -368,7 +368,7 @@
+ %define HAVE_INLINE_ASM_LABELS 1
+ %define HAVE_INLINE_ASM_NONLOCAL_LABELS 1
+ %define HAVE_PRAGMA_DEPRECATED 1
+-%define HAVE_RSYNC_CONTIMEOUT 1
++%define HAVE_RSYNC_CONTIMEOUT 0
+ %define HAVE_SYMVER_ASM_LABEL 1
+ %define HAVE_SYMVER_GNU_ASM 1
+ %define HAVE_VFP_ARGS 0
+@@ -428,7 +428,7 @@
+ %define HAVE_PERL 1
+ %define HAVE_POD2MAN 1
+ %define HAVE_TEXI2HTML 0
+-%define HAVE_XMLLINT 1
++%define HAVE_XMLLINT 0
+ %define HAVE_ZLIB_GZIP 0
+ %define HAVE_OPENVINO2 0
+ %define CONFIG_DOC 0
+@@ -685,7 +685,7 @@
+ %define CONFIG_AUDIO_FRAME_QUEUE 0
+ %define CONFIG_AUDIODSP 0
+ %define CONFIG_BLOCKDSP 0
+-%define CONFIG_BSWAPDSP 0
++%define CONFIG_BSWAPDSP 1
+ %define CONFIG_CABAC 1
+ %define CONFIG_CBS 0
+ %define CONFIG_CBS_APV 0
+@@ -702,7 +702,7 @@
+ %define CONFIG_DEFLATE_WRAPPER 0
+ %define CONFIG_DIRAC_PARSE 1
+ %define CONFIG_DNN 0
+-%define CONFIG_DOVI_RPUDEC 0
++%define CONFIG_DOVI_RPUDEC 1
+ %define CONFIG_DOVI_RPUENC 0
+ %define CONFIG_DVPROFILE 0
+ %define CONFIG_EVCPARSE 0
+@@ -721,8 +721,8 @@
+ %define CONFIG_H264PRED 1
+ %define CONFIG_H264QPEL 1
+ %define CONFIG_H264_SEI 1
+-%define CONFIG_HEVCPARSE 0
+-%define CONFIG_HEVC_SEI 0
++%define CONFIG_HEVCPARSE 1
++%define CONFIG_HEVC_SEI 1
+ %define CONFIG_HPELDSP 0
+ %define CONFIG_HUFFMAN 0
+ %define CONFIG_HUFFYUVDSP 0
+diff --git a/chromium/config/Chrome/linux/x64/config.h b/chromium/config/Chrome/linux/x64/config.h
+index 521cbf0..633ef34 100644
+--- a/chromium/config/Chrome/linux/x64/config.h
++++ b/chromium/config/Chrome/linux/x64/config.h
+@@ -1,12 +1,12 @@
+ /* Automatically generated by configure - do not modify! */
+ #ifndef FFMPEG_CONFIG_H
+ #define FFMPEG_CONFIG_H
+-/* #define FFMPEG_CONFIGURATION "--disable-everything --disable-all --disable-doc --disable-htmlpages --disable-manpages --disable-podpages --disable-txtpages --disable-static --enable-avcodec --enable-avformat --enable-avutil --enable-static --enable-libopus --disable-debug --disable-bzlib --disable-error-resilience --disable-iconv --disable-network --disable-schannel --disable-sdl2 --disable-symver --disable-xlib --disable-zlib --disable-securetransport --disable-faan --disable-alsa --disable-iamf --disable-autodetect --enable-decoder='vorbis,libopus,flac' --enable-decoder='pcm_u8,pcm_s16le,pcm_s24le,pcm_s32le,pcm_f32le,mp3' --enable-decoder='pcm_s16be,pcm_s24be,pcm_mulaw,pcm_alaw' --enable-demuxer='ogg,matroska,wav,flac,mp3,mov' --enable-parser='opus,vorbis,flac,mpegaudio,vp9' --extra-cflags=-I/usr/local/src/chromium/src/third_party/opus/src/include --disable-linux-perf --x86asmexe=nasm --optflags='\"-O2\"' --enable-lto --arch=x86_64 --target-os=linux --enable-pic --cc=clang --cxx=clang++ --ld=clang --extra-ldflags='-fuse-ld=lld' --enable-decoder='aac,h264' --enable-demuxer=aac --enable-parser='aac,h264'" -- elide long configuration string from binary */
++/* #define FFMPEG_CONFIGURATION "--disable-everything --disable-all --disable-doc --disable-htmlpages --disable-manpages --disable-podpages --disable-txtpages --disable-static --enable-avcodec --enable-avformat --enable-avutil --enable-static --enable-libopus --disable-debug --disable-bzlib --disable-error-resilience --disable-iconv --disable-network --disable-schannel --disable-sdl2 --disable-symver --disable-xlib --disable-zlib --disable-securetransport --disable-faan --disable-alsa --disable-iamf --disable-autodetect --enable-decoder='vorbis,libopus,flac' --enable-decoder='pcm_u8,pcm_s16le,pcm_s24le,pcm_s32le,pcm_f32le,mp3' --enable-decoder='pcm_s16be,pcm_s24be,pcm_mulaw,pcm_alaw' --enable-demuxer='ogg,matroska,wav,flac,mp3,mov' --enable-parser='opus,vorbis,flac,mpegaudio,vp9' --extra-cflags=-I/work/code/chromium/src/third_party/opus/src/include --disable-linux-perf --x86asmexe=nasm --optflags='\"-O2\"' --enable-lto --arch=x86_64 --target-os=linux --enable-pic --cc=clang --cxx=clang++ --ld=clang --extra-ldflags='-fuse-ld=lld' --enable-decoder='aac,h264,hevc' --enable-demuxer=aac --enable-parser='aac,h264,hevc'" -- elide long configuration string from binary */
+ #define FFMPEG_LICENSE "LGPL version 2.1 or later"
+ #define CONFIG_THIS_YEAR 2025
+ #define FFMPEG_DATADIR "/usr/local/share/ffmpeg"
+ #define AVCONV_DATADIR "/usr/local/share/ffmpeg"
+-#define CC_IDENT "clang version 22.0.0git (https://chromium.googlesource.com/a/external/github.com/llvm/llvm-project 8a5f15330feb693bc2c3923c0e77ce808382491f)"
++#define CC_IDENT "clang version 22.0.0git (https://chromium.googlesource.com/a/external/github.com/llvm/llvm-project efe9a8c95451c9dadb5dd522802b05afd8b52d1b)"
+ #define OS_NAME linux
+ #define EXTERN_PREFIX ""
+ #define EXTERN_ASM 
+@@ -382,7 +382,7 @@
+ #define HAVE_INLINE_ASM_LABELS 1
+ #define HAVE_INLINE_ASM_NONLOCAL_LABELS 1
+ #define HAVE_PRAGMA_DEPRECATED 1
+-#define HAVE_RSYNC_CONTIMEOUT 1
++#define HAVE_RSYNC_CONTIMEOUT 0
+ #define HAVE_SYMVER_ASM_LABEL 1
+ #define HAVE_SYMVER_GNU_ASM 1
+ #define HAVE_VFP_ARGS 0
+@@ -442,7 +442,7 @@
+ #define HAVE_PERL 1
+ #define HAVE_POD2MAN 1
+ #define HAVE_TEXI2HTML 0
+-#define HAVE_XMLLINT 1
++#define HAVE_XMLLINT 0
+ #define HAVE_ZLIB_GZIP 0
+ #define HAVE_OPENVINO2 0
+ #define CONFIG_DOC 0
+@@ -699,7 +699,7 @@
+ #define CONFIG_AUDIO_FRAME_QUEUE 0
+ #define CONFIG_AUDIODSP 0
+ #define CONFIG_BLOCKDSP 0
+-#define CONFIG_BSWAPDSP 0
++#define CONFIG_BSWAPDSP 1
+ #define CONFIG_CABAC 1
+ #define CONFIG_CBS 0
+ #define CONFIG_CBS_APV 0
+@@ -716,7 +716,7 @@
+ #define CONFIG_DEFLATE_WRAPPER 0
+ #define CONFIG_DIRAC_PARSE 1
+ #define CONFIG_DNN 0
+-#define CONFIG_DOVI_RPUDEC 0
++#define CONFIG_DOVI_RPUDEC 1
+ #define CONFIG_DOVI_RPUENC 0
+ #define CONFIG_DVPROFILE 0
+ #define CONFIG_EVCPARSE 0
+@@ -735,8 +735,8 @@
+ #define CONFIG_H264PRED 1
+ #define CONFIG_H264QPEL 1
+ #define CONFIG_H264_SEI 1
+-#define CONFIG_HEVCPARSE 0
+-#define CONFIG_HEVC_SEI 0
++#define CONFIG_HEVCPARSE 1
++#define CONFIG_HEVC_SEI 1
+ #define CONFIG_HPELDSP 0
+ #define CONFIG_HUFFMAN 0
+ #define CONFIG_HUFFYUVDSP 0
+diff --git a/chromium/config/Chrome/linux/x64/config_components.asm b/chromium/config/Chrome/linux/x64/config_components.asm
+index ecc57e6..7b943fe 100644
+--- a/chromium/config/Chrome/linux/x64/config_components.asm
++++ b/chromium/config/Chrome/linux/x64/config_components.asm
+@@ -139,7 +139,7 @@
+ %define CONFIG_H264_QSV_DECODER 0
+ %define CONFIG_H264_RKMPP_DECODER 0
+ %define CONFIG_HAP_DECODER 0
+-%define CONFIG_HEVC_DECODER 0
++%define CONFIG_HEVC_DECODER 1
+ %define CONFIG_HEVC_QSV_DECODER 0
+ %define CONFIG_HEVC_RKMPP_DECODER 0
+ %define CONFIG_HEVC_V4L2M2M_DECODER 0
+@@ -1035,7 +1035,7 @@
+ %define CONFIG_H261_PARSER 0
+ %define CONFIG_H263_PARSER 0
+ %define CONFIG_H264_PARSER 1
+-%define CONFIG_HEVC_PARSER 0
++%define CONFIG_HEVC_PARSER 1
+ %define CONFIG_HDR_PARSER 0
+ %define CONFIG_IPU_PARSER 0
+ %define CONFIG_JPEG2000_PARSER 0
+diff --git a/chromium/config/Chrome/linux/x64/config_components.h b/chromium/config/Chrome/linux/x64/config_components.h
+index 0693e0f..2e52d75 100644
+--- a/chromium/config/Chrome/linux/x64/config_components.h
++++ b/chromium/config/Chrome/linux/x64/config_components.h
+@@ -141,7 +141,7 @@
+ #define CONFIG_H264_QSV_DECODER 0
+ #define CONFIG_H264_RKMPP_DECODER 0
+ #define CONFIG_HAP_DECODER 0
+-#define CONFIG_HEVC_DECODER 0
++#define CONFIG_HEVC_DECODER 1
+ #define CONFIG_HEVC_QSV_DECODER 0
+ #define CONFIG_HEVC_RKMPP_DECODER 0
+ #define CONFIG_HEVC_V4L2M2M_DECODER 0
+@@ -1037,7 +1037,7 @@
+ #define CONFIG_H261_PARSER 0
+ #define CONFIG_H263_PARSER 0
+ #define CONFIG_H264_PARSER 1
+-#define CONFIG_HEVC_PARSER 0
++#define CONFIG_HEVC_PARSER 1
+ #define CONFIG_HDR_PARSER 0
+ #define CONFIG_IPU_PARSER 0
+ #define CONFIG_JPEG2000_PARSER 0
+diff --git a/chromium/config/Chrome/linux/x64/libavcodec/codec_list.c b/chromium/config/Chrome/linux/x64/libavcodec/codec_list.c
+index fe5adb0..8e616c6 100644
+--- a/chromium/config/Chrome/linux/x64/libavcodec/codec_list.c
++++ b/chromium/config/Chrome/linux/x64/libavcodec/codec_list.c
+@@ -1,5 +1,6 @@
+ static const FFCodec * const codec_list[] = {
+     &ff_h264_decoder,
++    &ff_hevc_decoder,
+     &ff_aac_decoder,
+     &ff_flac_decoder,
+     &ff_mp3_decoder,
+diff --git a/chromium/config/Chrome/linux/x64/libavcodec/parser_list.c b/chromium/config/Chrome/linux/x64/libavcodec/parser_list.c
+index e3684b3..93c86ea 100644
+--- a/chromium/config/Chrome/linux/x64/libavcodec/parser_list.c
++++ b/chromium/config/Chrome/linux/x64/libavcodec/parser_list.c
+@@ -2,6 +2,7 @@ static const FFCodecParser * const parser_list[] = {
+     &ff_aac_parser,
+     &ff_flac_parser,
+     &ff_h264_parser,
++    &ff_hevc_parser,
+     &ff_mpegaudio_parser,
+     &ff_opus_parser,
+     &ff_vorbis_parser,
+diff --git a/chromium/config/Chrome/linux/x64/libavutil/ffversion.h b/chromium/config/Chrome/linux/x64/libavutil/ffversion.h
+index 7cf8fc4..c045e99 100644
+--- a/chromium/config/Chrome/linux/x64/libavutil/ffversion.h
++++ b/chromium/config/Chrome/linux/x64/libavutil/ffversion.h
+@@ -1,5 +1,5 @@
+ /* Automatically generated by version.sh, do not manually edit! */
+ #ifndef AVUTIL_FFVERSION_H
+ #define AVUTIL_FFVERSION_H
+-#define FFMPEG_VERSION "N-123075-g71b8313894"
++#define FFMPEG_VERSION "git-2026-01-02-e18f48e"
+ #endif /* AVUTIL_FFVERSION_H */
+diff --git a/ffmpeg_generated.gni b/ffmpeg_generated.gni
+index a9d7ad8..980a024 100644
+--- a/ffmpeg_generated.gni
++++ b/ffmpeg_generated.gni
+@@ -535,3 +535,39 @@ if ((is_android && (current_cpu == "arm64" || current_cpu == "arm64e")) ||
+     (is_android && current_cpu == "x86")) {
+   ffmpeg_c_sources += [ "compat/strtod.c" ]
+ }
++
++# HEVC software decoding (local build with proprietary codecs, linux x64 Chrome branding).
++if (use_linux_config && current_cpu == "x64" && ffmpeg_branding == "Chrome") {
++  ffmpeg_c_sources += [
++    "libavcodec/aom_film_grain.c",
++    "libavcodec/bswapdsp.c",
++    "libavcodec/dovi_rpu.c",
++    "libavcodec/dovi_rpudec.c",
++    "libavcodec/dynamic_hdr_vivid.c",
++    "libavcodec/hevc/autorename_libavcodec_hevc_cabac.c",
++    "libavcodec/hevc/data.c",
++    "libavcodec/hevc/dsp.c",
++    "libavcodec/hevc/filter.c",
++    "libavcodec/hevc/hevcdec.c",
++    "libavcodec/hevc/mvs.c",
++    "libavcodec/hevc/autorename_libavcodec_hevc_parse.c",
++    "libavcodec/hevc/autorename_libavcodec_hevc_parser.c",
++    "libavcodec/hevc/pred.c",
++    "libavcodec/hevc/ps.c",
++    "libavcodec/hevc/refs.c",
++    "libavcodec/hevc/sei.c",
++    "libavcodec/x86/bswapdsp_init.c",
++    "libavcodec/x86/h26x/h2656dsp.c",
++    "libavcodec/x86/hevc/dsp_init.c",
++  ]
++  ffmpeg_asm_sources += [
++    "libavcodec/x86/autorename_libavcodec_x86_bswapdsp.asm",
++    "libavcodec/x86/h26x/h2656_inter.asm",
++    "libavcodec/x86/hevc/add_res.asm",
++    "libavcodec/x86/hevc/deblock.asm",
++    "libavcodec/x86/hevc/idct.asm",
++    "libavcodec/x86/hevc/mc.asm",
++    "libavcodec/x86/hevc/sao.asm",
++    "libavcodec/x86/hevc/sao_10bit.asm",
++  ]
++}
+diff --git a/libavcodec/hevc/autorename_libavcodec_hevc_cabac.c b/libavcodec/hevc/autorename_libavcodec_hevc_cabac.c
+new file mode 100644
+index 0000000..b26cd19
+--- /dev/null
++++ b/libavcodec/hevc/autorename_libavcodec_hevc_cabac.c
+@@ -0,0 +1,2 @@
++// Automatically generated (local HEVC build). See crbug.com/495833.
++#include "cabac.c"
+diff --git a/libavcodec/hevc/autorename_libavcodec_hevc_parse.c b/libavcodec/hevc/autorename_libavcodec_hevc_parse.c
+new file mode 100644
+index 0000000..d7a3c28
+--- /dev/null
++++ b/libavcodec/hevc/autorename_libavcodec_hevc_parse.c
+@@ -0,0 +1,2 @@
++// Automatically generated (local HEVC build). See crbug.com/495833.
++#include "parse.c"
+diff --git a/libavcodec/hevc/autorename_libavcodec_hevc_parser.c b/libavcodec/hevc/autorename_libavcodec_hevc_parser.c
+new file mode 100644
+index 0000000..d162ee5
+--- /dev/null
++++ b/libavcodec/hevc/autorename_libavcodec_hevc_parser.c
+@@ -0,0 +1,2 @@
++// Automatically generated (local HEVC build). See crbug.com/495833.
++#include "parser.c"
+diff --git a/libavcodec/x86/autorename_libavcodec_x86_bswapdsp.asm b/libavcodec/x86/autorename_libavcodec_x86_bswapdsp.asm
+new file mode 100644
+index 0000000..c9a1755
+--- /dev/null
++++ b/libavcodec/x86/autorename_libavcodec_x86_bswapdsp.asm
+@@ -0,0 +1,2 @@
++; Automatically generated (local HEVC build). See crbug.com/495833.
++%include "bswapdsp.asm"
diff --git a/docker/fetch.sh b/docker/fetch.sh
index 212163a..75c7e07 100644
--- a/docker/fetch.sh
+++ b/docker/fetch.sh
@@ -7,7 +7,7 @@ total=$(curl --http1.1 -fsSIL "$url" | tr -d '\r' | awk 'tolower($1)=="content-l
 i=0
 while [ "$(stat -c %s "$out" 2>/dev/null || echo 0)" -lt "$total" ]; do
   i=$((i + 1)); [ "$i" -le 100 ] || { echo "fetch: gave up after $i attempts" >&2; exit 1; }
-  curl --http1.1 -fsS -C - -o "$out" "$url" || true
+  curl --http1.1 -fsSL -C - -o "$out" "$url" || true
 done
 echo "fetch: $(stat -c %s "$out") bytes in $i attempts"
 [ -z "$sum" ] || echo "$sum  $out" | sha1sum -c -
diff --git a/docs/proprietary-codecs.md b/docs/proprietary-codecs.md
new file mode 100644
index 0000000..925e8a2
--- /dev/null
+++ b/docs/proprietary-codecs.md
@@ -0,0 +1,57 @@
+# Image with H.264 and H.265 (proprietary codecs)
+
+> **Licensing warning.** H.264 (AVC) and H.265 (HEVC) are covered by patents and
+> patent pools. This image variant contains decoders for both. Whoever deploys it is
+> responsible for any licences that apply to their use. This project gives no
+> licence and no advice on it. Use the normal image if in doubt.
+
+The normal image uses the CEF build from the CEF project, which has only royalty-free
+codecs (VP8, VP9, AV1). Pages that play H.264 or H.265 stay black there, for example
+the WebRTC previews of most media functions.
+
+The variant `ghcr.io/leeo86/mxl-browser-source:<version>-codecs` is the same function
+with a CEF build of the same version (`CEF_VERSION` in `docker/Dockerfile`) that adds:
+
+| What | H.264 | H.265 |
+|---|---|---|
+| `<video>` and MSE (FFmpeg, software) | yes | yes |
+| WebRTC receive (FFmpeg, software) | yes | no |
+| WebRTC send (encode) | OpenH264 | no |
+
+A GPU decoder is not needed and not used. (Chromium on Linux decodes video in
+hardware only through VA-API, Intel and AMD; NVIDIA's NVDEC is not supported.)
+
+Checked with `tests/codecs/codecs.html` in the variant (software rendering): H.264
+and H.265 1280x720 play in `<video>` and through MSE, a WebRTC H.264 loopback
+decodes. WebRTC H.265 is left out: Chromium decodes it only with a hardware decoder,
+and a software path could not be tested end to end, so it is not offered.
+
+## How the CEF build is made
+
+CEF's `automate-git.py` at the CEF commit of `CEF_VERSION`, Linux x64, Release, with:
+
+```
+GN_DEFINES=is_official_build=true use_sysroot=true symbol_level=0 is_cfi=false
+  chrome_pgo_phase=0 proprietary_codecs=true ffmpeg_branding="Chrome"
+  enable_hevc_parser_and_hw_decoder=true rtc_use_h264=true rtc_use_h265=true
+```
+
+`proprietary_codecs` and `ffmpeg_branding="Chrome"` give H.264. Chromium decodes H.265
+only with a hardware decoder, so two patches in `docker/cef-codecs/` add a software
+path for `<video>` and MSE (apply after CEF's own patches):
+
+- `ffmpeg-hevc.patch` (in `third_party/ffmpeg`): the FFmpeg configuration for
+  Chrome/linux/x64 regenerated with the HEVC decoder and parser
+  (`media/ffmpeg/scripts/build_ffmpeg.py linux x64 --branding=Chrome`, then
+  `copy_config.sh`), and their sources added to `ffmpeg_generated.gni`. Four of
+  them share a file name with an existing source, so they are built through
+  `autorename_*` wrappers (as `generate_gn.py` does), and the target also
+  searches `libavcodec/` for headers (the HEVC files include them by bare name).
+- `chromium-media-hevc.patch` (in `src`): the FFmpeg video decoder accepts HEVC (and
+  picks its thread count like H.264), HEVC counts as a built-in codec, FFmpeg's
+  allowed decoders include it, and `build_ffmpeg.py` keeps the flags.
+
+Then `make_distrib` builds the minimal distribution. It is attached to a GitHub
+release of this repository; `docker/cef-codecs/cef.env` names its URL and SHA-1.
+A tag `codecs-<version>` builds the image (`.github/workflows/container-codecs.yaml`):
+`docker/Dockerfile` with `CEF_URL` and `CEF_SHA1` set to that file.
diff --git a/tests/codecs/README.md b/tests/codecs/README.md
new file mode 100644
index 0000000..e1ccbf3
--- /dev/null
+++ b/tests/codecs/README.md
@@ -0,0 +1,21 @@
+# Codec check page
+
+`codecs.html` checks what the browser source can play: `canPlayType`, MSE,
+the WebRTC receive and send codecs, playback of H.264 and H.265 files (direct
+and MSE) and a WebRTC H.264 loopback inside the page. It prints OK/NO per line
+and puts the result in the page title (`GET /api/v1/status` → `page.title`).
+
+Make the media next to it and serve the folder over HTTP from an address the
+URL policy allows (not loopback):
+
+```sh
+F="-f lavfi -i testsrc2=size=1280x720:rate=25 -t 4 -pix_fmt yuv420p"
+ffmpeg $F -c:v libx264 -profile:v high -movflags +faststart h264.mp4
+ffmpeg $F -c:v libx265 -tag:v hvc1 -movflags +faststart hevc.mp4
+ffmpeg -i h264.mp4 -c copy -movflags frag_keyframe+empty_moov+default_base_moof h264-frag.mp4
+ffmpeg -i hevc.mp4 -c copy -tag:v hvc1 -movflags frag_keyframe+empty_moov+default_base_moof hevc-frag.mp4
+python3 -m http.server 8080
+```
+
+The normal image gives NO for every H.264 and H.265 line; the `-codecs` image
+gives OK everywhere.
diff --git a/tests/codecs/codecs.html b/tests/codecs/codecs.html
new file mode 100644
index 0000000..a4d586f
--- /dev/null
+++ b/tests/codecs/codecs.html
@@ -0,0 +1,71 @@
+<!doctype html>
+<html><head><meta charset="utf-8"><title>codecs</title>
+<style>
+body{margin:0;background:#111;color:#eee;font:28px/1.25 monospace}
+#out{position:absolute;left:20px;top:10px;width:1240px;white-space:pre-wrap}
+video{position:absolute;width:300px;height:169px;background:#000}
+.ok{color:#5f5}.no{color:#f55}
+</style></head><body>
+<div id="out"></div>
+<video id="v1" muted playsinline style="right:330px;top:10px"></video>
+<video id="v2" muted playsinline style="right:10px;top:10px"></video>
+<video id="v3" muted playsinline style="right:330px;top:190px"></video>
+<video id="v4" muted playsinline style="right:10px;top:190px"></video>
+<video id="v5" muted playsinline autoplay style="right:10px;top:370px"></video>
+<script>
+const out = document.getElementById('out');
+const line = (name, ok, extra='') => { out.innerHTML += `<span class="${ok?'ok':'no'}">${ok?'OK  ':'NO  '}</span>${name} ${extra}\n`; };
+const AVC = 'video/mp4; codecs="avc1.640028"', HEVC = 'video/mp4; codecs="hvc1.1.6.L93.B0"';
+line('canPlayType H.264', document.createElement('video').canPlayType(AVC) !== '', document.createElement('video').canPlayType(AVC));
+line('canPlayType H.265', document.createElement('video').canPlayType(HEVC) !== '', document.createElement('video').canPlayType(HEVC));
+line('MSE H.264', MediaSource.isTypeSupported(AVC));
+line('MSE H.265', MediaSource.isTypeSupported(HEVC));
+const rx = [...new Set(RTCRtpReceiver.getCapabilities('video').codecs.map(c => c.mimeType.replace('video/','')))];
+const tx = [...new Set(RTCRtpSender.getCapabilities('video').codecs.map(c => c.mimeType.replace('video/','')))];
+line('WebRTC receive H.264', rx.includes('H264')); line('WebRTC H.265 not offered', !rx.includes('H265'));
+out.innerHTML += `    receive: ${rx.join(' ')}\n    send: ${tx.join(' ')}\n`;
+
+// Decoded picture is not black and time moves: the video really plays.
+async function playing(v, name) {
+  try { await v.play(); } catch (e) { line(name, false, e.name); return; }
+  await new Promise(r => setTimeout(r, 2000));
+  const c = document.createElement('canvas'); c.width = 64; c.height = 36;
+  const g = c.getContext('2d'); g.drawImage(v, 0, 0, 64, 36);
+  const d = g.getImageData(0, 0, 64, 36).data; let sum = 0; for (let i = 0; i < d.length; i += 4) sum += d[i] + d[i+1] + d[i+2];
+  line(name, v.currentTime > 0.5 && sum > 64*36*30, `t=${v.currentTime.toFixed(2)} s, ${v.videoWidth}x${v.videoHeight}, level ${(sum/64/36/3).toFixed(0)}`);
+}
+function mse(v, file, type) {
+  const ms = new MediaSource(); v.src = URL.createObjectURL(ms);
+  ms.addEventListener('sourceopen', async () => {
+    const sb = ms.addSourceBuffer(type); const buf = await (await fetch(file)).arrayBuffer();
+    sb.addEventListener('updateend', () => { if (ms.readyState === 'open') ms.endOfStream(); }, {once: true});
+    sb.appendBuffer(buf);
+  });
+}
+async function webrtc() {
+  const c = document.createElement('canvas'); c.width = 640; c.height = 360; const g = c.getContext('2d');
+  let n = 0; setInterval(() => { g.fillStyle = `hsl(${n*7%360},80%,50%)`; g.fillRect(0, 0, 640, 360); g.fillStyle = '#fff'; g.font = '80px monospace'; g.fillText(String(n++), 40, 200); }, 40);
+  const a = new RTCPeerConnection(), b = new RTCPeerConnection();
+  a.onicecandidate = e => e.candidate && b.addIceCandidate(e.candidate);
+  b.onicecandidate = e => e.candidate && a.addIceCandidate(e.candidate);
+  b.ontrack = e => { document.getElementById('v5').srcObject = e.streams[0]; };
+  const t = a.addTransceiver(c.captureStream(25).getVideoTracks()[0], {direction: 'sendonly', streams: [new MediaStream()]});
+  t.setCodecPreferences(RTCRtpSender.getCapabilities('video').codecs.filter(x => x.mimeType === 'video/H264'));
+  await a.setLocalDescription(); await b.setRemoteDescription(a.localDescription);
+  await b.setLocalDescription(); await a.setRemoteDescription(b.localDescription);
+  await new Promise(r => setTimeout(r, 4000));
+  let inb = null, codec = ''; const st = await b.getStats();
+  st.forEach(s => { if (s.type === 'inbound-rtp' && s.kind === 'video') inb = s; });
+  if (inb && inb.codecId) codec = st.get(inb.codecId).mimeType;
+  line('WebRTC H.264 loopback', !!inb && inb.framesDecoded > 20 && codec === 'video/H264', inb ? `${codec} decoded ${inb.framesDecoded} by ${inb.decoderImplementation}` : 'no stats');
+}
+(async () => {
+  const v1 = document.getElementById('v1'), v2 = document.getElementById('v2'), v3 = document.getElementById('v3'), v4 = document.getElementById('v4');
+  v1.src = 'h264.mp4'; v2.src = 'hevc.mp4'; v1.loop = v2.loop = true;
+  mse(v3, 'h264-frag.mp4', AVC); mse(v4, 'hevc-frag.mp4', HEVC);
+  await playing(v1, 'video H.264'); await playing(v2, 'video H.265');
+  await playing(v3, 'MSE H.264'); await playing(v4, 'MSE H.265');
+  await webrtc();
+  out.innerHTML += 'done\n'; document.title = out.textContent.replace(/\n/g, ' | ');
+})();
+</script></body></html>