diff --git a/autobuild.xml b/autobuild.xml
index 0ae2f5a2f2..bdd2c9b2f4 100644
--- a/autobuild.xml
+++ b/autobuild.xml
@@ -952,9 +952,9 @@
             <key>archive</key>
             <map>
               <key>hash</key>
-              <string>012aaadd1c40d430866bebda2e60bfae</string>
+              <string>439d92ec73f0500ba1671faad2bd8090</string>
               <key>url</key>
-              <string>https://automated-builds-secondlife-com.s3.amazonaws.com/ct2/100136/882323/dullahan-1.12.3.202205202122_91.1.21_g9dd45fe_chromium-91.0.4472.114-darwin64-572002.tar.bz2</string>
+              <string>https://automated-builds-secondlife-com.s3.amazonaws.com/ct2/104637/916643/dullahan-1.12.4.202209142017_91.1.21_g9dd45fe_chromium-91.0.4472.114-darwin64-575005.tar.bz2</string>
             </map>
             <key>name</key>
             <string>darwin64</string>
@@ -964,9 +964,9 @@
             <key>archive</key>
             <map>
               <key>hash</key>
-              <string>ff1c56b7a28c689442f6439421bb32f5</string>
+              <string>2a7c01da15de77bc1fd1863327174d5e</string>
               <key>url</key>
-              <string>https://automated-builds-secondlife-com.s3.amazonaws.com/ct2/100149/882391/dullahan-1.12.3.202205202205_91.1.21_g9dd45fe_chromium-91.0.4472.114-windows-572002.tar.bz2</string>
+              <string>https://automated-builds-secondlife-com.s3.amazonaws.com/ct2/104638/916654/dullahan-1.12.4.202209142021_91.1.21_g9dd45fe_chromium-91.0.4472.114-windows-575005.tar.bz2</string>
             </map>
             <key>name</key>
             <string>windows</string>
@@ -976,9 +976,9 @@
             <key>archive</key>
             <map>
               <key>hash</key>
-              <string>bbfe23d7f211865b81b291884949a887</string>
+              <string>d06bee9b2517fbb09ba1a65e6d675361</string>
               <key>url</key>
-              <string>https://automated-builds-secondlife-com.s3.amazonaws.com/ct2/100148/882385/dullahan-1.12.3.202205202202_91.1.21_g9dd45fe_chromium-91.0.4472.114-windows64-572002.tar.bz2</string>
+              <string>https://automated-builds-secondlife-com.s3.amazonaws.com/ct2/104639/916659/dullahan-1.12.4.202209142021_91.1.21_g9dd45fe_chromium-91.0.4472.114-windows64-575005.tar.bz2</string>
             </map>
             <key>name</key>
             <string>windows64</string>
@@ -997,7 +997,7 @@
           </map>
         </map>
         <key>version</key>
-        <string>1.12.3.202205202205_91.1.21_g9dd45fe_chromium-91.0.4472.114</string>
+        <string>1.12.4.202209142021_91.1.21_g9dd45fe_chromium-91.0.4472.114</string>
       </map>
       <key>expat</key>
       <map>
diff --git a/indra/llui/llmodaldialog.cpp b/indra/llui/llmodaldialog.cpp
index 50fc6913a9..3e5978eb59 100644
--- a/indra/llui/llmodaldialog.cpp
+++ b/indra/llui/llmodaldialog.cpp
@@ -112,11 +112,13 @@ void LLModalDialog::onOpen(const LLSD& key)
 		setFocus(TRUE);
 
         std::list<LLModalDialog*>::iterator iter = std::find(sModalStack.begin(), sModalStack.end(), this);
-        if (iter == sModalStack.end())
+        if (iter != sModalStack.end())
         {
-            sModalStack.push_front(this);
+            // if already present, we want to move it to front.
+            sModalStack.erase(iter);
         }
-        // else act like it is a 'bring to front'
+
+        sModalStack.push_front(this);
 	}
 }
 
diff --git a/indra/media_plugins/cef/media_plugin_cef.cpp b/indra/media_plugins/cef/media_plugin_cef.cpp
index 4e77fa05d2..b3f2f773b0 100644
--- a/indra/media_plugins/cef/media_plugin_cef.cpp
+++ b/indra/media_plugins/cef/media_plugin_cef.cpp
@@ -57,7 +57,7 @@ private:
 	bool init();
 
 	void onPageChangedCallback(const unsigned char* pixels, int x, int y, const int width, const int height);
-	void onCustomSchemeURLCallback(std::string url);
+	void onCustomSchemeURLCallback(std::string url, bool user_gesture, bool is_redirect);
 	void onConsoleMessageCallback(std::string message, std::string source, int line);
 	void onStatusMessageCallback(std::string value);
 	void onTitleChangeCallback(std::string title);
@@ -301,11 +301,18 @@ void MediaPluginCEF::onOpenPopupCallback(std::string url, std::string target)
 
 ////////////////////////////////////////////////////////////////////////////////
 //
-void MediaPluginCEF::onCustomSchemeURLCallback(std::string url)
+void MediaPluginCEF::onCustomSchemeURLCallback(std::string url, bool user_gesture, bool is_redirect)
 {
 	LLPluginMessage message(LLPLUGIN_MESSAGE_CLASS_MEDIA_BROWSER, "click_nofollow");
-	message.setValue("uri", url);
-	message.setValue("nav_type", "clicked");	// TODO: differentiate between click and navigate to
+    message.setValue("uri", url);
+
+    // indicate if this interaction was from a user click (okay on a SLAPP) or 
+    // via a navigation (e.g. a data URL - see SL-18151) (not okay on a SLAPP)
+    const std::string nav_type = user_gesture ? "clicked" : "navigated";
+
+	message.setValue("nav_type", nav_type);
+    message.setValueBoolean("is_redirect", is_redirect);
+
 	sendMessage(message);
 }
 
@@ -594,7 +601,7 @@ void MediaPluginCEF::receiveMessage(const char* message_string)
             {
                 // event callbacks from Dullahan
                 mCEFLib->setOnPageChangedCallback(std::bind(&MediaPluginCEF::onPageChangedCallback, this, std::placeholders::_1, std::placeholders::_2, std::placeholders::_3, std::placeholders::_4, std::placeholders::_5));
-                mCEFLib->setOnCustomSchemeURLCallback(std::bind(&MediaPluginCEF::onCustomSchemeURLCallback, this, std::placeholders::_1));
+                mCEFLib->setOnCustomSchemeURLCallback(std::bind(&MediaPluginCEF::onCustomSchemeURLCallback, this, std::placeholders::_1, std::placeholders::_2, std::placeholders::_3));
                 mCEFLib->setOnConsoleMessageCallback(std::bind(&MediaPluginCEF::onConsoleMessageCallback, this, std::placeholders::_1, std::placeholders::_2, std::placeholders::_3));
                 mCEFLib->setOnStatusMessageCallback(std::bind(&MediaPluginCEF::onStatusMessageCallback, this, std::placeholders::_1));
                 mCEFLib->setOnTitleChangeCallback(std::bind(&MediaPluginCEF::onTitleChangeCallback, this, std::placeholders::_1));