diff --git a/chromium-browser.sh b/chromium-browser.sh
index 5c95ef8..492a496 100755
--- a/chromium-browser.sh
+++ b/chromium-browser.sh
@@ -52,4 +52,10 @@ CHROMIUM_DISTRO_FLAGS=" --enable-plugins \
                         --enable-sync \
                         --auto-ssl-client-auth @@EXTRA_FLAGS@@"
 
+# Sanitize std{in,out,err} because they'll be shared with untrusted child
+# processes (http://crbug.com/376567).
+exec < /dev/null
+exec > >(exec cat)
+exec 2> >(exec cat >&2)
+
 exec -a "$0" "$HERE/@@CHROMIUM_BROWSER_CHANNEL@@" $CHROMIUM_FLAGS $CHROMIUM_DISTRO_FLAGS "$@"
diff --git a/chromium.spec b/chromium.spec
index 5a39f78..12588eb 100644
--- a/chromium.spec
+++ b/chromium.spec
@@ -241,8 +241,8 @@
 %endif
 
 Name:	chromium%{chromium_channel}
-Version: 112.0.5615.121
-Release: 2%{?dist}
+Version: 112.0.5615.165
+Release: 1%{?dist}
 Summary: A WebKit (Blink) powered web browser that Google doesn't want you to use
 Url: http://www.chromium.org/Home
 License: BSD-3-Clause AND LGPL-2.1-or-later AND Apache-2.0 AND IJG AND MIT AND GPL-2.0-or-later AND ISC AND OpenSSL AND (MPL-1.1 OR GPL-2.0-only OR LGPL-2.0-only)
@@ -977,7 +977,7 @@ udev.
 %patch -P300 -p1 -b .disblegnomekeyring
 %endif
 
-%if 0%{?rhel} == 8
+%if %{clang} && 0%{?rhel} == 8
 %patch -P301 -p1 -b .clang14_c++20
 %endif
 
@@ -1066,9 +1066,9 @@ export READELF=llvm-readelf
 %else
 export CC=gcc
 export CXX=g++ 
-export AR="ar"
-export NM="nm"
-export READELF="readelf"
+export AR=ar
+export NM=nm
+export READELF=readelf
 %endif
 export CFLAGS
 export CXXFLAGS
@@ -1659,6 +1659,9 @@ getent group chrome-remote-desktop >/dev/null || groupadd -r chrome-remote-deskt
 %{chromium_path}/chromedriver
 
 %changelog
+* Thu Apr 20 2023 Than Ngo <than@redhat.com> - 112.0.5615.165-1
+- update to 112.0.5615.165
+
 * Mon Apr 17 2023 Than Ngo <than@redhat.com> - 112.0.5615.121-2
 - fix vaapi issue on xwayland
 - fix the build order, chrome_feed_response_metadata.pb.h file not found
diff --git a/sources b/sources
index 2871077..2425ca7 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
 SHA512 (node-v19.8.1-linux-arm64.tar.xz) = 86ff19085669e92ce7afe2fd7d4df0c5441df2d88c00f29d5463b805f3cf5625626db8aebf98349c9a495b772da1ce6d68263730018207ea98815058a1c81397
 SHA512 (node-v19.8.1-linux-x64.tar.xz) = 925c0037c6b7074d0b0245bced20d0a0d9b1300f53b808106f16b5018d763f5f5b00bc321b33fa1033d736b1e1076608da9b7fcae66aed53d27b100b1186e2c6
-SHA512 (chromium-112.0.5615.121-clean.tar.xz) = 4dfb8abb5ae475f069ff18d98c6b8c5a241187ce2ed5d85d6bc6ac33efdcca6a657539df50b3836baca93190aff96676d6673a1a554b48394cb4625aaea0275d
+SHA512 (chromium-112.0.5615.165-clean.tar.xz) = 68f8f4f0e8add04e608c1d285351b38de0199ac5635b29dcce653b30435e68431f92ea7b381d6fe6cb4ffd5b1910e66ed6f82aab62a8fab952cb969a40f7456a