1be17a9c5d5067db82e1cf5c074f14389ff09dcc.diff

diff --git a/sandbox/policy/win/sandbox_win.cc b/sandbox/policy/win/sandbox_win.cc
index d7eed71feab0b..2ed0d69713546 100644
--- a/sandbox/policy/win/sandbox_win.cc
+++ b/sandbox/policy/win/sandbox_win.cc
@@ -362,6 +362,8 @@ ResultCode AddDefaultConfigForSandboxedProcess(TargetConfig* config) {
     return result;
 
   config->SetLockdownDefaultDacl();
-  config->AddKernelObjectToClose(HandleToClose::kDeviceApi);
+  // Win8+ adds a device DeviceApi that we don't need.
+  if (base::win::GetVersion() >= base::win::Version::WIN8)
+    config->AddKernelObjectToClose(HandleToClose::kDeviceApi);
   config->SetDesktop(Desktop::kAlternateWinstation);
 
@@ -845,6 +847,10 @@ ResultCode SandboxWin::AddAppContainerPolicy(TargetConfig* config,
 // static
 ResultCode SandboxWin::AddWin32kLockdownPolicy(TargetConfig* config) {
   DCHECK(!config->IsConfigured());
+  // Win32k Lockdown is supported on Windows 8+.
+  if (base::win::GetVersion() < base::win::Version::WIN8)
+    return SBOX_ALL_OK;
+
   MitigationFlags flags = config->GetProcessMitigations();
   // Check not enabling twice. Should not happen.
   DCHECK_EQ(0U, flags & MITIGATION_WIN32K_DISABLE);
diff --git a/sandbox/win/src/process_mitigations.cc b/sandbox/win/src/process_mitigations.cc
index 2b870c0ebd409..5f81e05ada75d 100644
--- a/sandbox/win/src/process_mitigations.cc
+++ b/sandbox/win/src/process_mitigations.cc
@@ -44,22 +44,39 @@ namespace sandbox {
 
 namespace {
 
+// API defined in libloaderapi.h >= Win8.
+using SetDefaultDllDirectoriesFunction = decltype(&SetDefaultDllDirectories);
+
+// APIs defined in processthreadsapi.h >= Win8.
+using SetProcessMitigationPolicyFunction =
+    decltype(&SetProcessMitigationPolicy);
+using GetProcessMitigationPolicyFunction =
+    decltype(&GetProcessMitigationPolicy);
+using SetThreadInformationFunction = decltype(&SetThreadInformation);
+
 // Returns a two-element array of mitigation flags supported on this machine.
+// - This function is only useful on >= base::win::Version::WIN8.
 const ULONG64* GetSupportedMitigations() {
   static ULONG64 mitigations[2] = {};
 
   // This static variable will only be initialized once.
   if (!mitigations[0] && !mitigations[1]) {
-    // NOTE: the two-element-sized input array is only supported on >= Win10
-    // RS2. If an earlier version, the second element will be left 0.
-    size_t mits_size =
-        (base::win::GetVersion() >= base::win::Version::WIN10_RS2)
-            ? (sizeof(mitigations[0]) * 2)
-            : sizeof(mitigations[0]);
-    if (!::GetProcessMitigationPolicy(::GetCurrentProcess(),
-                                      ProcessMitigationOptionsMask,
-                                      &mitigations, mits_size)) {
-      NOTREACHED();
+    GetProcessMitigationPolicyFunction get_process_mitigation_policy =
+        reinterpret_cast<GetProcessMitigationPolicyFunction>(::GetProcAddress(
+            ::GetModuleHandleA("kernel32.dll"), "GetProcessMitigationPolicy"));
+    if (get_process_mitigation_policy) {
+      // NOTE: the two-element-sized input array is only supported on >= Win10
+      // RS2.
+      //       If an earlier version, the second element will be left 0.
+      size_t mits_size =
+          (base::win::GetVersion() >= base::win::Version::WIN10_RS2)
+              ? (sizeof(mitigations[0]) * 2)
+              : sizeof(mitigations[0]);
+      if (!get_process_mitigation_policy(::GetCurrentProcess(),
+                                         ProcessMitigationOptionsMask,
+                                         &mitigations, mits_size)) {
+        NOTREACHED();
+      }
     }
   }
 
@@ -83,7 +100,14 @@ bool IsRunning32bitEmulatedOnArm64() {
 bool SetProcessMitigationPolicyInternal(PROCESS_MITIGATION_POLICY policy,
                                         PVOID lpBuffer,
                                         SIZE_T dwLength) {
-  PCHECK(::SetProcessMitigationPolicy(policy, lpBuffer, dwLength))
+  HMODULE module = ::GetModuleHandleA("kernel32.dll");
+  SetProcessMitigationPolicyFunction set_process_mitigation_policy_function =
+      reinterpret_cast<SetProcessMitigationPolicyFunction>(
+          ::GetProcAddress(module, "SetProcessMitigationPolicy"));
+  if (!set_process_mitigation_policy_function)
+    return false;
+
+  PCHECK(set_process_mitigation_policy_function(policy, lpBuffer, dwLength))
       << "SetProcessMitigationPolicy failed with Policy: " << policy;
 
   return true;
@@ -100,20 +124,28 @@ bool ApplyProcessMitigationsToCurrentProcess(MitigationFlags starting_flags,
   base::win::Version version = base::win::GetVersion();
 
   if (flags & MITIGATION_DLL_SEARCH_ORDER) {
+    HMODULE module = ::GetModuleHandleA("kernel32.dll");
+    SetDefaultDllDirectoriesFunction set_default_dll_directories =
+        reinterpret_cast<SetDefaultDllDirectoriesFunction>(
+            ::GetProcAddress(module, "SetDefaultDllDirectories"));
+
+    // Check for SetDefaultDllDirectories since it requires KB2533623.
+    if (set_default_dll_directories) {
 #if defined(COMPONENT_BUILD)
-    const DWORD directory_flags = LOAD_LIBRARY_SEARCH_DEFAULT_DIRS;
+      const DWORD directory_flags = LOAD_LIBRARY_SEARCH_DEFAULT_DIRS;
 #else
-    // In a non-component build, all DLLs will be loaded manually, or via
-    // manifest definition, so these flags can be stronger. This prevents DLL
-    // planting in the application directory.
-    const DWORD directory_flags =
-        LOAD_LIBRARY_SEARCH_SYSTEM32 | LOAD_LIBRARY_SEARCH_USER_DIRS;
+      // In a non-component build, all DLLs will be loaded manually, or via
+      // manifest definition, so these flags can be stronger. This prevents DLL
+      // planting in the application directory.
+      const DWORD directory_flags =
+          LOAD_LIBRARY_SEARCH_SYSTEM32 | LOAD_LIBRARY_SEARCH_USER_DIRS;
 #endif
-    if (!::SetDefaultDllDirectories(directory_flags)) {
-      return false;
-    }
+      if (!set_default_dll_directories(directory_flags)) {
+        return false;
+      }
 
-    applied_flags |= MITIGATION_DLL_SEARCH_ORDER;
+      applied_flags |= MITIGATION_DLL_SEARCH_ORDER;
+    }
   }
 
   // Set the heap to terminate on corruption
@@ -156,6 +188,10 @@ bool ApplyProcessMitigationsToCurrentProcess(MitigationFlags starting_flags,
   }
 #endif
 
+  // This is all we can do in Win7 and below.
+  if (version < base::win::Version::WIN8)
+    return true;
+
   // Enable ASLR policies.
   if (flags & MITIGATION_RELOCATE_IMAGE) {
     PROCESS_MITIGATION_ASLR_POLICY policy = {};
@@ -219,6 +255,9 @@ bool ApplyProcessMitigationsToCurrentProcess(MitigationFlags starting_flags,
     applied_flags |= MITIGATION_EXTENSION_POINT_DISABLE;
   }
 
+  if (version < base::win::Version::WIN8_1)
+    return true;
+
   // Enable dynamic code policies.
   if (!IsRunning32bitEmulatedOnArm64() &&
       (flags & MITIGATION_DYNAMIC_CODE_DISABLE)) {
@@ -235,6 +274,9 @@ bool ApplyProcessMitigationsToCurrentProcess(MitigationFlags starting_flags,
     applied_flags |= MITIGATION_DYNAMIC_CODE_DISABLE;
   }
 
+  if (version < base::win::Version::WIN10)
+    return true;
+
   // Enable font policies.
   if (flags & MITIGATION_NONSYSTEM_FONT_DISABLE) {
     PROCESS_MITIGATION_FONT_DISABLE_POLICY policy = {};
@@ -349,16 +391,29 @@ bool ApplyMitigationsToCurrentThread(MitigationFlags flags) {
   if (!CanSetMitigationsPerThread(flags))
     return false;
 
-  if (base::win::GetVersion() < base::win::Version::WIN10_RS1)
+  base::win::Version version = base::win::GetVersion();
+
+  if (version < base::win::Version::WIN10_RS1)
     return true;
 
   // Enable dynamic code per-thread policies.
   if (flags & MITIGATION_DYNAMIC_CODE_OPT_OUT_THIS_THREAD) {
     DWORD thread_policy = THREAD_DYNAMIC_CODE_ALLOW;
 
+    // NOTE: SetThreadInformation API only exists on >= Win8.  Dynamically
+    //       get function handle.
+    base::ScopedNativeLibrary dll(base::FilePath(L"kernel32.dll"));
+    if (!dll.is_valid())
+      return false;
+    SetThreadInformationFunction set_thread_info_function =
+        reinterpret_cast<SetThreadInformationFunction>(
+            dll.GetFunctionPointer("SetThreadInformation"));
+    if (!set_thread_info_function)
+      return false;
+
     // NOTE: Must use the pseudo-handle here, a thread HANDLE won't work.
-    if (!::SetThreadInformation(::GetCurrentThread(), ThreadDynamicCodePolicy,
-                                &thread_policy, sizeof(thread_policy))) {
+    if (!set_thread_info_function(::GetCurrentThread(), ThreadDynamicCodePolicy,
+                                  &thread_policy, sizeof(thread_policy))) {
       return false;
     }
   }
@@ -379,8 +434,14 @@ void ConvertProcessMitigationsToPolicy(MitigationFlags flags,
   *policy_value_1 = 0;
   *policy_value_2 = 0;
 
-#if defined(_WIN64) || defined(_M_IX86)
+#if defined(_WIN64)
   *size = sizeof(*policy_flags);
+#elif defined(_M_IX86)
+  // A 64-bit flags attribute is illegal on 32-bit Win 7.
+  if (version < base::win::Version::WIN8)
+    *size = sizeof(DWORD);
+  else
+    *size = sizeof(*policy_flags);
 #else
 #error This platform is not supported.
 #endif
@@ -398,53 +459,73 @@ void ConvertProcessMitigationsToPolicy(MitigationFlags flags,
     *policy_value_1 |= PROCESS_CREATION_MITIGATION_POLICY_SEHOP_ENABLE;
 #endif
 
-  if (flags & MITIGATION_RELOCATE_IMAGE) {
-    *policy_value_1 |=
-        PROCESS_CREATION_MITIGATION_POLICY_FORCE_RELOCATE_IMAGES_ALWAYS_ON;
-    if (flags & MITIGATION_RELOCATE_IMAGE_REQUIRED) {
+  // Win 7
+  if (version < base::win::Version::WIN8)
+    return;
+
+  // Everything >= Win8, do not return before the end of the function where
+  // the final policy bitmap is sanity checked against what is supported on this
+  // machine.  The API required to do so is only available since Win8.
+
+  // Mitigations >= Win8:
+  //----------------------------------------------------------------------------
+  if (version >= base::win::Version::WIN8) {
+    if (flags & MITIGATION_RELOCATE_IMAGE) {
       *policy_value_1 |=
-          PROCESS_CREATION_MITIGATION_POLICY_FORCE_RELOCATE_IMAGES_ALWAYS_ON_REQ_RELOCS;
+          PROCESS_CREATION_MITIGATION_POLICY_FORCE_RELOCATE_IMAGES_ALWAYS_ON;
+      if (flags & MITIGATION_RELOCATE_IMAGE_REQUIRED) {
+        *policy_value_1 |=
+            PROCESS_CREATION_MITIGATION_POLICY_FORCE_RELOCATE_IMAGES_ALWAYS_ON_REQ_RELOCS;
+      }
     }
-  }
 
-  if (flags & MITIGATION_HEAP_TERMINATE) {
-    *policy_value_1 |=
-        PROCESS_CREATION_MITIGATION_POLICY_HEAP_TERMINATE_ALWAYS_ON;
-  }
+    if (flags & MITIGATION_HEAP_TERMINATE) {
+      *policy_value_1 |=
+          PROCESS_CREATION_MITIGATION_POLICY_HEAP_TERMINATE_ALWAYS_ON;
+    }
 
-  if (flags & MITIGATION_BOTTOM_UP_ASLR) {
-    *policy_value_1 |=
-        PROCESS_CREATION_MITIGATION_POLICY_BOTTOM_UP_ASLR_ALWAYS_ON;
-  }
+    if (flags & MITIGATION_BOTTOM_UP_ASLR) {
+      *policy_value_1 |=
+          PROCESS_CREATION_MITIGATION_POLICY_BOTTOM_UP_ASLR_ALWAYS_ON;
+    }
 
-  if (flags & MITIGATION_HIGH_ENTROPY_ASLR) {
-    *policy_value_1 |=
-        PROCESS_CREATION_MITIGATION_POLICY_HIGH_ENTROPY_ASLR_ALWAYS_ON;
-  }
+    if (flags & MITIGATION_HIGH_ENTROPY_ASLR) {
+      *policy_value_1 |=
+          PROCESS_CREATION_MITIGATION_POLICY_HIGH_ENTROPY_ASLR_ALWAYS_ON;
+    }
 
-  if (flags & MITIGATION_STRICT_HANDLE_CHECKS) {
-    *policy_value_1 |=
-        PROCESS_CREATION_MITIGATION_POLICY_STRICT_HANDLE_CHECKS_ALWAYS_ON;
-  }
+    if (flags & MITIGATION_STRICT_HANDLE_CHECKS) {
+      *policy_value_1 |=
+          PROCESS_CREATION_MITIGATION_POLICY_STRICT_HANDLE_CHECKS_ALWAYS_ON;
+    }
 
-  if (flags & MITIGATION_WIN32K_DISABLE) {
-    *policy_value_1 |=
-        PROCESS_CREATION_MITIGATION_POLICY_WIN32K_SYSTEM_CALL_DISABLE_ALWAYS_ON;
-  }
+    if (flags & MITIGATION_WIN32K_DISABLE) {
+      *policy_value_1 |=
+          PROCESS_CREATION_MITIGATION_POLICY_WIN32K_SYSTEM_CALL_DISABLE_ALWAYS_ON;
+    }
 
-  if (flags & MITIGATION_EXTENSION_POINT_DISABLE) {
-    *policy_value_1 |=
-        PROCESS_CREATION_MITIGATION_POLICY_EXTENSION_POINT_DISABLE_ALWAYS_ON;
+    if (flags & MITIGATION_EXTENSION_POINT_DISABLE) {
+      *policy_value_1 |=
+          PROCESS_CREATION_MITIGATION_POLICY_EXTENSION_POINT_DISABLE_ALWAYS_ON;
+    }
   }
 
-  if (flags & MITIGATION_DYNAMIC_CODE_DISABLE) {
-    *policy_value_1 |=
-        PROCESS_CREATION_MITIGATION_POLICY_PROHIBIT_DYNAMIC_CODE_ALWAYS_ON;
+  // Mitigations >= Win8.1:
+  //----------------------------------------------------------------------------
+  if (version >= base::win::Version::WIN8_1) {
+    if (flags & MITIGATION_DYNAMIC_CODE_DISABLE) {
+      *policy_value_1 |=
+          PROCESS_CREATION_MITIGATION_POLICY_PROHIBIT_DYNAMIC_CODE_ALWAYS_ON;
+    }
   }
 
-  if (flags & MITIGATION_NONSYSTEM_FONT_DISABLE) {
-    *policy_value_1 |=
-        PROCESS_CREATION_MITIGATION_POLICY_FONT_DISABLE_ALWAYS_ON;
+  // Mitigations >= Win10:
+  //----------------------------------------------------------------------------
+  if (version >= base::win::Version::WIN10) {
+    if (flags & MITIGATION_NONSYSTEM_FONT_DISABLE) {
+      *policy_value_1 |=
+          PROCESS_CREATION_MITIGATION_POLICY_FONT_DISABLE_ALWAYS_ON;
+    }
   }
 
   // Mitigations >= Win10 TH2:
@@ -557,6 +638,15 @@ void ConvertProcessMitigationsToComponentFilter(MitigationFlags flags,
 }
 
 MitigationFlags FilterPostStartupProcessMitigations(MitigationFlags flags) {
+  base::win::Version version = base::win::GetVersion();
+
+  // Windows 7.
+  if (version < base::win::Version::WIN8) {
+    return flags & (MITIGATION_BOTTOM_UP_ASLR | MITIGATION_DLL_SEARCH_ORDER |
+                    MITIGATION_HEAP_TERMINATE);
+  }
+
+  // Windows 8 and above.
   return flags & (MITIGATION_BOTTOM_UP_ASLR | MITIGATION_DLL_SEARCH_ORDER);
 }
 
diff --git a/sandbox/win/src/process_mitigations_deathtest.cc b/sandbox/win/src/process_mitigations_deathtest.cc
index a5390a5080a5d..36b7fc6412304 100644
--- a/sandbox/win/src/process_mitigations_deathtest.cc
+++ b/sandbox/win/src/process_mitigations_deathtest.cc
@@ -56,6 +56,9 @@ SBOX_TESTS_COMMAND int CheckDeath(int argc, wchar_t** argv) {
 }
 
 TEST(ProcessMitigationsDeathTest, CheckRatchetDownOrderMatters) {
+  if (base::win::GetVersion() < base::win::Version::WIN8)
+    GTEST_SKIP() << "Skipping test due to unsupported Windows version";
+
   std::wstring test_command = L"CheckDeath ";
   test_command += base::NumberToWString(kRatchetDown);
   test_command += L" ";
@@ -68,6 +71,9 @@ TEST(ProcessMitigationsDeathTest, CheckRatchetDownOrderMatters) {
 }
 
 TEST(ProcessMitigationsDeathTest, CheckRatchetDownAndLockdownExclusive) {
+  if (base::win::GetVersion() < base::win::Version::WIN8)
+    GTEST_SKIP() << "Skipping test due to unsupported Windows version";
+
   std::wstring test_command = L"CheckDeath ";
   test_command += base::NumberToWString(kRatchetDown);
   test_command += L" ";
@@ -80,6 +86,9 @@ TEST(ProcessMitigationsDeathTest, CheckRatchetDownAndLockdownExclusive) {
 }
 
 TEST(ProcessMitigationsDeathTest, CheckRatchetDownAndLockdownExclusive2) {
+  if (base::win::GetVersion() < base::win::Version::WIN8)
+    GTEST_SKIP() << "Skipping test due to unsupported Windows version";
+
   std::wstring test_command = L"CheckDeath ";
   test_command += base::NumberToWString(kLockdown);
   test_command += L" ";
@@ -92,6 +101,9 @@ TEST(ProcessMitigationsDeathTest, CheckRatchetDownAndLockdownExclusive2) {
 }
 
 TEST(ProcessMitigationsDeathTest, CheckSetStartAndLockdownExclusive) {
+  if (base::win::GetVersion() < base::win::Version::WIN8)
+    GTEST_SKIP() << "Skipping test due to unsupported Windows version";
+
   std::wstring test_command = L"CheckDeath ";
   test_command += base::NumberToWString(kLockdown);
   test_command += L" ";
@@ -104,6 +116,9 @@ TEST(ProcessMitigationsDeathTest, CheckSetStartAndLockdownExclusive) {
 }
 
 TEST(ProcessMitigationsDeathTest, CheckSetStartAndLockdownExclusive2) {
+  if (base::win::GetVersion() < base::win::Version::WIN8)
+    GTEST_SKIP() << "Skipping test due to unsupported Windows version";
+
   std::wstring test_command = L"CheckDeath ";
   test_command += base::NumberToWString(kSetStart);
   test_command += L" ";
diff --git a/sandbox/win/src/process_mitigations_dyncode_unittest.cc b/sandbox/win/src/process_mitigations_dyncode_unittest.cc
index cfd4e03a771f1..b3b08e1540e5f 100644
--- a/sandbox/win/src/process_mitigations_dyncode_unittest.cc
+++ b/sandbox/win/src/process_mitigations_dyncode_unittest.cc
@@ -414,6 +414,9 @@ SBOX_TESTS_COMMAND int TestWin10DynamicCodeWithOptOut(int argc,
 // This test validates that setting the MITIGATION_DYNAMIC_CODE_DISABLE
 // mitigation enables the setting on a process.
 TEST(ProcessMitigationsTest, CheckWin81DynamicCodePolicySuccess) {
+  if (base::win::GetVersion() < base::win::Version::WIN8_1)
+    return;
+
 // TODO(crbug.com/40559699): Windows ASan hotpatching requires dynamic code.
 #if !defined(ADDRESS_SANITIZER)
   std::wstring test_command = L"CheckPolicy ";
@@ -451,6 +454,9 @@ TEST(ProcessMitigationsTest, CheckWin81DynamicCodePolicySuccess) {
 // This test validates that we can meddle with dynamic code if the
 // MITIGATION_DYNAMIC_CODE_DISABLE mitigation is NOT set.
 TEST(ProcessMitigationsTest, CheckWin81DynamicCode_BaseCase) {
+  if (base::win::GetVersion() < base::win::Version::WIN8_1)
+    return;
+
   ScopedTestMutex mutex(hooking_dll::g_hooking_dll_mutex);
 
   // Expect success, no mitigation.
@@ -462,6 +468,9 @@ TEST(ProcessMitigationsTest, CheckWin81DynamicCode_BaseCase) {
 // This test validates that setting the MITIGATION_DYNAMIC_CODE_DISABLE
 // mitigation prevents meddling with dynamic code.
 TEST(ProcessMitigationsTest, CheckWin81DynamicCode_TestMitigation) {
+  if (base::win::GetVersion() < base::win::Version::WIN8_1)
+    return;
+
   ScopedTestMutex mutex(hooking_dll::g_hooking_dll_mutex);
 
   // Expect failure, with mitigation.
diff --git a/sandbox/win/src/process_mitigations_extensionpoints_unittest.cc b/sandbox/win/src/process_mitigations_extensionpoints_unittest.cc
index 6b0634f322d16..83bdaba82aeb3 100644
--- a/sandbox/win/src/process_mitigations_extensionpoints_unittest.cc
+++ b/sandbox/win/src/process_mitigations_extensionpoints_unittest.cc
@@ -364,6 +364,9 @@ namespace sandbox {
 // This test validates that setting the MITIGATION_EXTENSION_POINT_DISABLE
 // mitigation enables the setting on a process.
 TEST(ProcessMitigationsTest, CheckWin8ExtensionPointPolicySuccess) {
+  if (base::win::GetVersion() < base::win::Version::WIN8)
+    return;
+
   std::wstring test_command = L"CheckPolicy ";
   test_command += std::to_wstring(sandbox::TESTPOLICY_EXTENSIONPOINT);
 
@@ -397,6 +400,9 @@ TEST(ProcessMitigationsTest, CheckWin8ExtensionPointPolicySuccess) {
 // MANUAL testing only.
 TEST(ProcessMitigationsTest,
      DISABLED_CheckWin8ExtensionPoint_GlobalHook_Success) {
+  if (base::win::GetVersion() < base::win::Version::WIN8)
+    return;
+
   ScopedTestMutex mutex(g_extension_point_test_mutex);
 
   TestWin8ExtensionPointHookWrapper(true /* is_success_test */,
@@ -409,6 +415,9 @@ TEST(ProcessMitigationsTest,
 // MANUAL testing only.
 TEST(ProcessMitigationsTest,
      DISABLED_CheckWin8ExtensionPoint_GlobalHook_Failure) {
+  if (base::win::GetVersion() < base::win::Version::WIN8)
+    return;
+
   ScopedTestMutex mutex(g_extension_point_test_mutex);
 
   TestWin8ExtensionPointHookWrapper(false /* is_success_test */,
@@ -420,6 +429,9 @@ TEST(ProcessMitigationsTest,
 //
 // MANUAL testing only.
 TEST(ProcessMitigationsTest, DISABLED_CheckWin8ExtensionPoint_Hook_Success) {
+  if (base::win::GetVersion() < base::win::Version::WIN8)
+    return;
+
   ScopedTestMutex mutex(g_extension_point_test_mutex);
 
   TestWin8ExtensionPointHookWrapper(true /* is_success_test */,
@@ -434,6 +446,9 @@ TEST(ProcessMitigationsTest, DISABLED_CheckWin8ExtensionPoint_Hook_Success) {
 //
 // MANUAL testing only.
 TEST(ProcessMitigationsTest, DISABLED_CheckWin8ExtensionPoint_Hook_Failure) {
+  if (base::win::GetVersion() < base::win::Version::WIN8)
+    return;
+
   ScopedTestMutex mutex(g_extension_point_test_mutex);
 
   TestWin8ExtensionPointHookWrapper(false /* is_success_test */,
@@ -446,6 +461,9 @@ TEST(ProcessMitigationsTest, DISABLED_CheckWin8ExtensionPoint_Hook_Failure) {
 // MANUAL testing only.
 // Must run this test as admin/elevated.
 TEST(ProcessMitigationsTest, DISABLED_CheckWin8ExtensionPoint_AppInit_Success) {
+  if (base::win::GetVersion() < base::win::Version::WIN8)
+    return;
+
   ScopedTestMutex mutex(g_extension_point_test_mutex);
 
   TestWin8ExtensionPointAppInitWrapper(true /* is_success_test */);
@@ -457,6 +475,9 @@ TEST(ProcessMitigationsTest, DISABLED_CheckWin8ExtensionPoint_AppInit_Success) {
 // MANUAL testing only.
 // Must run this test as admin/elevated.
 TEST(ProcessMitigationsTest, DISABLED_CheckWin8ExtensionPoint_AppInit_Failure) {
+  if (base::win::GetVersion() < base::win::Version::WIN8)
+    return;
+
   ScopedTestMutex mutex(g_extension_point_test_mutex);
 
   TestWin8ExtensionPointAppInitWrapper(false /* is_success_test */);
diff --git a/sandbox/win/src/process_mitigations_unittest.cc b/sandbox/win/src/process_mitigations_unittest.cc
index bfdfebd913104..267d5dfcaef6c 100644
--- a/sandbox/win/src/process_mitigations_unittest.cc
+++ b/sandbox/win/src/process_mitigations_unittest.cc
@@ -537,6 +537,28 @@ SBOX_TESTS_COMMAND int TestChildProcess(int argc, wchar_t** argv) {
 // Exported Mitigation Tests
 //------------------------------------------------------------------------------
 
+//------------------------------------------------------------------------------
+// DEP (MITIGATION_DEP and MITIGATION_DEP_NO_ATL_THUNK)
+// Win7 x86
+//------------------------------------------------------------------------------
+
+#if !defined(_WIN64)
+// DEP is always enabled on 64-bit.  Only test on x86.
+TEST(ProcessMitigationsTest, CheckDepWin7) {
+  if (base::win::GetVersion() > base::win::Version::WIN7)
+    return;
+
+  TestRunner runner;
+  sandbox::TargetConfig* config = runner.GetPolicy()->GetConfig();
+
+  EXPECT_EQ(config->SetProcessMitigations(MITIGATION_DEP |
+                                          MITIGATION_DEP_NO_ATL_THUNK |
+                                          MITIGATION_SEHOP),
+            SBOX_ALL_OK);
+  EXPECT_EQ(SBOX_TEST_SUCCEEDED, runner.RunTest(L"CheckDep"));
+}
+#endif  // !defined(_WIN64)
+
 //------------------------------------------------------------------------------
 // DEP (MITIGATION_DEP and MITIGATION_DEP_NO_ATL_THUNK)
 // >= Win8 x86
@@ -548,6 +570,9 @@ SBOX_TESTS_COMMAND int TestChildProcess(int argc, wchar_t** argv) {
 // This test validates that setting the MITIGATION_DEP*
 // mitigations enables the setting on a process.
 TEST(ProcessMitigationsTest, CheckDepWin8PolicySuccess) {
+  if (base::win::GetVersion() < base::win::Version::WIN8)
+    return;
+
   DWORD flags;
   BOOL permanent;
   ASSERT_TRUE(::GetProcessDEPPolicy(::GetCurrentProcess(), &flags, &permanent));
@@ -594,6 +619,9 @@ TEST(ProcessMitigationsTest, CheckDepWin8PolicySuccess) {
 //------------------------------------------------------------------------------
 
 TEST(ProcessMitigationsTest, CheckWin8AslrPolicySuccess) {
+  if (base::win::GetVersion() < base::win::Version::WIN8)
+    return;
+
   std::wstring test_command = L"CheckPolicy ";
   test_command += base::NumberToWString(TESTPOLICY_ASLR);
 
@@ -619,6 +647,9 @@ TEST(ProcessMitigationsTest, CheckWin8AslrPolicySuccess) {
 //------------------------------------------------------------------------------
 
 TEST(ProcessMitigationsTest, CheckWin8StrictHandlePolicySuccess) {
+  if (base::win::GetVersion() < base::win::Version::WIN8)
+    return;
+
   std::wstring test_command = L"CheckPolicy ";
   test_command += base::NumberToWString(TESTPOLICY_STRICTHANDLE);
 
@@ -643,6 +674,9 @@ TEST(ProcessMitigationsTest, CheckWin8StrictHandlePolicySuccess) {
 // This test validates that setting the MITIGATION_NON_SYSTEM_FONTS_DISABLE
 // mitigation enables the setting on a process.
 TEST(ProcessMitigationsTest, CheckWin10NonSystemFontLockDownPolicySuccess) {
+  if (base::win::GetVersion() < base::win::Version::WIN10)
+    return;
+
   std::wstring test_command = L"CheckPolicy ";
   test_command += base::NumberToWString(TESTPOLICY_NONSYSFONT);
 
@@ -671,12 +705,18 @@ TEST(ProcessMitigationsTest, CheckWin10NonSystemFontLockDownPolicySuccess) {
 // This test validates that we can load a non-system font if the
 // MITIGATION_NON_SYSTEM_FONTS_DISABLE mitigation is NOT set.
 TEST(ProcessMitigationsTest, CheckWin10NonSystemFontLockDownLoadSuccess) {
+  if (base::win::GetVersion() < base::win::Version::WIN10)
+    return;
+
   TestWin10NonSystemFont(true /* is_success_test */);
 }
 
 // This test validates that setting the MITIGATION_NON_SYSTEM_FONTS_DISABLE
 // mitigation prevents the loading of a non-system font.
 TEST(ProcessMitigationsTest, CheckWin10NonSystemFontLockDownLoadFailure) {
+  if (base::win::GetVersion() < base::win::Version::WIN10)
+    return;
+
   TestWin10NonSystemFont(false /* is_success_test */);
 }
 
@@ -1231,6 +1271,9 @@ TEST(ProcessMitigationsTest, SetPreAndPostStartupSamePolicy_ImageLoad) {
 // This test validates setting a pre-startup mitigation and a post startup
 // mitigation on the same windows policy works in release and crashes in debug.
 TEST(ProcessMitigationsTest, SetPreAndPostStartupSamePolicy_ProcessDep) {
+  if (base::win::GetVersion() < base::win::Version::WIN8)
+    return;
+
   std::wstring test_command = L"CheckPolicy ";
   test_command += base::NumberToWString(TESTPOLICY_DEP);
 
@@ -1253,6 +1296,9 @@ TEST(ProcessMitigationsTest, SetPreAndPostStartupSamePolicy_ProcessDep) {
 // This test validates setting a pre-startup mitigation and a post startup
 // mitigation on the same windows policy works in release and crashes in debug.
 TEST(ProcessMitigationsTest, SetPreAndPostStartupSamePolicy_ASLR) {
+  if (base::win::GetVersion() < base::win::Version::WIN8)
+    return;
+
   std::wstring test_command = L"CheckPolicy ";
   test_command += base::NumberToWString(TESTPOLICY_ASLR);
 
diff --git a/sandbox/win/src/process_mitigations_win32k_unittest.cc b/sandbox/win/src/process_mitigations_win32k_unittest.cc
index 67a337cac92ca..180b36c552385 100644
--- a/sandbox/win/src/process_mitigations_win32k_unittest.cc
+++ b/sandbox/win/src/process_mitigations_win32k_unittest.cc
@@ -25,6 +25,9 @@ namespace sandbox {
 // the target process causes the launch to fail in process initialization.
 // The test process itself links against user32/gdi32.
 TEST(ProcessMitigationsWin32kTest, CheckWin8LockDownFailure) {
+  if (base::win::GetVersion() < base::win::Version::WIN8)
+    return;
+
   std::wstring test_policy_command = L"CheckPolicy ";
   test_policy_command += std::to_wstring(TESTPOLICY_WIN32K);
 
@@ -42,6 +45,9 @@ TEST(ProcessMitigationsWin32kTest, CheckWin8LockDownFailure) {
 // The test process itself links against user32/gdi32.
 
 TEST(ProcessMitigationsWin32kTest, CheckWin8LockDownSuccess) {
+  if (base::win::GetVersion() < base::win::Version::WIN8)
+    return;
+
   std::wstring test_policy_command = L"CheckPolicy ";
   test_policy_command += std::to_wstring(TESTPOLICY_WIN32K);