[SergeyZhukovsky]

Security review https://github.com/brave/reviews/issues/1678

Resolves brave/brave-browser#39541
There is a follow up created brave/brave-browser#39574 to make network audit tests for Android.

Submitter Checklist:

• I confirm that no security/privacy review is needed and no other type of reviews are needed, or that I have requested them
• There is a ticket for my issue
• Used Github auto-closing keywords in the PR description above
• Wrote a good PR/commit description
• Squashed any review feedback or "fixup" commits before merge, so that history is a record of what happened in the repo, not your PR
• Added appropriate labels (QA/Yes or QA/No; release-notes/include or release-notes/exclude; OS/...) to the associated issue
• Checked the PR locally:
  • npm run test -- brave_browser_tests, npm run test -- brave_unit_tests wiki
  • npm run presubmit wiki, npm run gn_check, npm run tslint
• Ran git rebase master (if needed)

Reviewer Checklist:

• A security review is not needed, or a link to one is included in the PR description
• New files have MPL-2.0 license header
• Adequate test coverage exists to prevent regressions
• Major classes, functions and non-trivial code blocks are well-commented
• Changes in component dependencies are properly reflected in gn
• Code follows the style guide
• Test plan is specified in PR before merging

After-merge Checklist:

• The associated issue milestone is set to the smallest version that the
  changes has landed on
• All relevant documentation has been updated, for instance:
  • https://github.com/brave/brave-browser/wiki/Deviations-from-Chromium-(features-we-disable-or-remove)
  • https://github.com/brave/brave-browser/wiki/Proxy-redirected-URLs
  • https://github.com/brave/brave-browser/wiki/Fingerprinting-Protections
  • https://github.com/brave/brave-browser/wiki/Brave%E2%80%99s-Use-of-Referral-Codes
  • https://github.com/brave/brave-browser/wiki/Web-Compatibility-Exceptions-in-Brave
  • https://github.com/brave/brave-browser/wiki/QA-Guide
  • https://github.com/brave/brave-browser/wiki/P3A

Test Plan:

1. Install Brave and open it.
2. Make sure there are no icons on NTP.
3. Open a few more NTP and make sure there are no icons.

[kjozwiak]

Verification PASSED on Pixel 6 Pro running Android 15 using the following build(s):

Brave | 1.69.111 Chromium: 127.0.6533.43 (Official Build) canary (64-bit)
--- | ---
Revision | 4d39f6a867ca388981fcb24fb2bf4007ae913651
OS | Android 15; Build/AP31.240517.031; 35; REL

Using 1.69.83 Chromium: 127.0.6533.26, reproduced the original issue where the NTP page is populated with pre-determined websites for a specific region. In doing so, it contacts these websites without user consent to download/retrieve the needed icons as per the following:

Example	Example

Using 1.69.111 Chromium: 127.0.6533.43, ensured that we're not pulling/populating website via NTP as per the following:

Example	Example	Example

• ensured that the pre-determined websites based on region are not being populated via NTP on first launch
• ensured that there's no websites being displayed/being loaded when opening several NTP
• ensured that there's no connections to websites like bestbuy.com, facebook.com & amazon.com via Proxyman
• ensured that once you start visiting several websites, the most popular/visited ones get loaded into Favorites