diff --git a/.chromium.metadata b/.chromium.metadata
index a90e2ab1..b09254d0 100644
--- a/.chromium.metadata
+++ b/.chromium.metadata
@@ -1,4 +1,4 @@
-fed3dd1bc4e700d32ffb6ed7b499b81a4270a166  SOURCES/chromium-120.0.6099.129.tar.xz
+e4f31bbdbc998f240b4f2e47a592322e3304cb93  SOURCES/chromium-120.0.6099.199.tar.xz
 dea187019741602d57aaf189a80abba261fbd2aa  SOURCES/linux-x64-0.19.2.tgz
 7e5d2c7864c5c83ec789b59c77cd9c20d2594916  SOURCES/linux-arm64-0.19.2.tgz
 769196d081c6a0ad37f1c63dec56febfff3370de  SOURCES/node-v20.6.1-linux-x64.tar.xz
diff --git a/SPECS/chromium.spec b/SPECS/chromium.spec
index 357d9e7e..cd48c5f9 100644
--- a/SPECS/chromium.spec
+++ b/SPECS/chromium.spec
@@ -25,10 +25,6 @@
 
 # enable|disble bootstrap
 %global bootstrap 0
-# workaround for broken gn on epel 8/9
-%if 0%{?rhel} == 8 || 0%{?rhel} == 9
-%global bootstrap 1
-%endif
 
 # Fancy build status, so we at least know, where we are..
 # %1 where
@@ -320,8 +316,8 @@
 %endif
 
 Name:	chromium%{chromium_channel}
-Version: 120.0.6099.129
-Release: 1%{?dist}.inferit.1
+Version: 120.0.6099.199
+Release: 1%{?dist}.inferit
 Summary: A WebKit (Blink) powered web browser that Google doesn't want you to use
 Url: http://www.chromium.org/Home
 License: BSD-3-Clause AND LGPL-2.1-or-later AND Apache-2.0 AND IJG AND MIT AND GPL-2.0-or-later AND ISC AND OpenSSL AND (MPL-1.1 OR GPL-2.0-only OR LGPL-2.0-only)
@@ -481,7 +477,8 @@ patch356: chromium-120-disable-FFmpegAllowLists.patch
 # remove ldflags -Wl,-mllvm,-disable-auto-upgrade-debug-info which is not supported
 Patch357: chromium-120-clang16-disable-auto-upgrade-debug-info.patch
 
-#Patch500: 0001-Yandex-as-default-search-engine.patch
+# Old Yandex patch
+Patch500: 0001-Yandex-as-default-search-engine.patch
 # MSVSphere
 Patch501: 0001-Added-Russian-description-and-summary-for-gnome-soft.patch
 # Yandex Search by default
@@ -1041,8 +1038,7 @@ do
 	cp $i $i.saved
 done
 patch -p1 < %{chromium_path_gost}/patch/chromium.patch
-( cd ./third_party/boringssl/src
-patch -p1 < %{chromium_path_gost}/patch/boringssl.patch )
+patch -p1 -d third_party/boringssl/src < %{chromium_path_gost}/patch/boringssl.patch
 # rollback backups after GOST patching
 for i in \
 	components/search_engines/prepopulated_engines.json \
@@ -1180,6 +1176,8 @@ sed -i 's/std::string data_dir_basename = "chromium"/std::string data_dir_basena
 %patch -P501 -p1 -b .Added-Russian-description-and-summary-for-gnome-soft
 %if ! %{with gost}
 %patch -P502 -p1 -b .Yandex-as-default-search-engine
+%else
+%patch -P500 -p1 -b .Yandex-as-default-search-engine
 %endif
 
 # We patch Chromium to open chrome://new-tab-page even with non-Google search engines
@@ -1909,6 +1907,14 @@ getent group chrome-remote-desktop >/dev/null || groupadd -r chrome-remote-deskt
 %endif
 
 %changelog
+* Sat Jan 06 2024 Arkady L. Shane <tigro@msvsphere-os.ru> - 120.0.6099.199-1.inferit
+- new gn update, drop workaround for broken gn on epel 8/9
+- update to 120.0.6099.199
+    * CVE-2024-0222: Use after free in ANGLE
+    * CVE-2024-0223: Heap buffer overflow in ANGLE
+    * CVE-2024-0224: Use after free in WebAudio
+    * CVE-2024-0225: Use after free in WebGPU
+
 * Tue Dec 26 2023 Arkady L. Shane <tigro@msvsphere-os.ru> - 120.0.6099.129-1.inferit.1
 - Use home page from sphere-indexhtml package