diff --git a/res/values/strings.xml b/res/values/strings.xml
index d4d6467..bfed543 100644
--- a/res/values/strings.xml
+++ b/res/values/strings.xml
@@ -632,7 +632,7 @@
     <string name="pref_lab_title">Labs</string>
     <!-- Title for lab quick controls feature [CHAR LIMIT=40] -->
     <string name="pref_lab_quick_controls">Quick controls</string>
-    <!-- Summary for lab quick controls feature [CHAR LIMIT=80] -->
+    <!-- Summary for lab quick controls feature [CHAR LIMIT=120] -->
     <string name="pref_lab_quick_controls_summary">
         Slide thumb from the left or right edge to open quick controls and hide app and URL bars</string>
     <!-- Title for the "Instant search" lab feature [CHAR LIMIT=40] -->
diff --git a/src/com/android/browser/BaseUi.java b/src/com/android/browser/BaseUi.java
index 3128934..a2a51d6 100644
--- a/src/com/android/browser/BaseUi.java
+++ b/src/com/android/browser/BaseUi.java
@@ -34,10 +34,10 @@
 import android.text.TextUtils;
 import android.util.Log;
 import android.view.Gravity;
-import android.view.KeyEvent;
 import android.view.LayoutInflater;
 import android.view.Menu;
 import android.view.MenuItem;
+import android.view.MotionEvent;
 import android.view.View;
 import android.view.View.OnClickListener;
 import android.view.ViewGroup;
@@ -89,8 +89,9 @@
 
     protected FrameLayout mContentView;
     protected FrameLayout mCustomViewContainer;
+    protected FrameLayout mFullscreenContainer;
 
-    private CustomViewHolder mCustomView;
+    private View mCustomView;
     private WebChromeClient.CustomViewCallback mCustomViewCallback;
     private int mOriginalOrientation;
 
@@ -119,7 +120,6 @@
                 browser.getSystemService(Activity.INPUT_METHOD_SERVICE);
         mLockIconSecure = res.getDrawable(R.drawable.ic_secure_holo_dark);
         mLockIconMixed = res.getDrawable(R.drawable.ic_secure_partial_holo_dark);
-
         FrameLayout frameLayout = (FrameLayout) mActivity.getWindow()
                 .getDecorView().findViewById(android.R.id.content);
         LayoutInflater.from(mActivity)
@@ -520,21 +520,11 @@
         }
 
         mOriginalOrientation = mActivity.getRequestedOrientation();
-        WindowManager wm = (WindowManager) mActivity.getSystemService(Context.WINDOW_SERVICE);
-        WindowManager.LayoutParams params = new WindowManager.LayoutParams(
-                WindowManager.LayoutParams.TYPE_APPLICATION,
-                0);
-        params.x = 0;
-        params.y = 0;
-        params.width = LayoutParams.MATCH_PARENT;
-        params.height = LayoutParams.MATCH_PARENT;
-        params.systemUiVisibility = View.STATUS_BAR_HIDDEN;
-        mCustomView = new CustomViewHolder(mActivity);
-        view.setLayoutParams(new FrameLayout.LayoutParams(LayoutParams.MATCH_PARENT,
-                LayoutParams.MATCH_PARENT));
-        mCustomView.addView(view);
-        wm.addView(mCustomView, params);
-
+        FrameLayout decor = (FrameLayout) mActivity.getWindow().getDecorView();
+        mFullscreenContainer = new FullscreenHolder(mActivity);
+        mFullscreenContainer.addView(view, COVER_SCREEN_PARAMS);
+        decor.addView(mFullscreenContainer, COVER_SCREEN_PARAMS);
+        mCustomView = view;
         mCustomViewCallback = callback;
         mActivity.setRequestedOrientation(requestedOrientation);
     }
@@ -543,10 +533,9 @@
     public void onHideCustomView() {
         if (mCustomView == null)
             return;
-
-        WindowManager wm = (WindowManager) mActivity.getSystemService(Context.WINDOW_SERVICE);
-        wm.removeView(mCustomView);
-
+        FrameLayout decor = (FrameLayout) mActivity.getWindow().getDecorView();
+        decor.removeView(mFullscreenContainer);
+        mFullscreenContainer = null;
         mCustomView = null;
         mCustomViewCallback.onCustomViewHidden();
         // Show the content view.
@@ -605,7 +594,10 @@
         Drawable d = null;
         if (securityState == SecurityState.SECURITY_STATE_SECURE) {
             d = mLockIconSecure;
-        } else if (securityState == SecurityState.SECURITY_STATE_MIXED) {
+        } else if (securityState == SecurityState.SECURITY_STATE_MIXED
+                || securityState == SecurityState.SECURITY_STATE_BAD_CERTIFICATE) {
+            // TODO: It would be good to have different icons for insecure vs mixed content.
+            // See http://b/5403800
             d = mLockIconMixed;
         }
         mNavigationBar.setLock(d);
@@ -826,18 +818,17 @@
         mUiController.hideCustomView();
     }
 
-    // custom FrameLayout to forward key events
-    static class CustomViewHolder extends FrameLayout {
-        Activity mActivity;
+    static class FullscreenHolder extends FrameLayout {
 
-        public CustomViewHolder(Activity act) {
-            super(act);
-            mActivity = act;
+        public FullscreenHolder(Context ctx) {
+            super(ctx);
+            setBackgroundColor(ctx.getResources().getColor(R.color.black));
         }
 
-        public boolean dispatchKeyEvent(KeyEvent event) {
-            return mActivity.dispatchKeyEvent(event);
+        @Override
+        public boolean onTouchEvent(MotionEvent evt) {
+            return true;
         }
+
     }
-
 }
diff --git a/src/com/android/browser/Tab.java b/src/com/android/browser/Tab.java
index 936aca9..f2aa529 100644
--- a/src/com/android/browser/Tab.java
+++ b/src/com/android/browser/Tab.java
@@ -114,16 +114,19 @@
     }
 
     public enum SecurityState {
-        // The page does not use SSL.
+        // The page's main resource does not use SSL. Note that we use this
+        // state irrespective of the SSL authentication state of sub-resources.
         SECURITY_STATE_NOT_SECURE,
-        // The page uses SSL, the certificate is good and all elements are secure.
+        // The page's main resource uses SSL and the certificate is good. The
+        // same is true of all sub-resources.
         SECURITY_STATE_SECURE,
-        // The page uses SSL and the certificate is good, but some elements are insecure.
+        // The page's main resource uses SSL and the certificate is good, but
+        // some sub-resources either do not use SSL or have problems with their
+        // certificates.
         SECURITY_STATE_MIXED,
-        // TODO: Add SECURITY_STATE_BAD_CERTIFICATE
-        // See http://b/5403366
-        // The page uses SSL but there is a problem with the certificate.
-        //SECURITY_STATE_BAD_CERTIFICATE,
+        // The page's main resource uses SSL but there is a problem with its
+        // certificate.
+        SECURITY_STATE_BAD_CERTIFICATE,
     }
 
     Context mContext;
@@ -778,6 +781,7 @@
                             public void onClick(DialogInterface dialog,
                                     int whichButton) {
                                 handler.proceed();
+                                handleProceededAfterSslError(error);
                             }
                         })
                     .setNeutralButton(R.string.view_certificate,
@@ -813,6 +817,17 @@
         }
 
         /**
+         * Called when an SSL error occurred while loading a resource, but the
+         * WebView but chose to proceed anyway based on a decision retained
+         * from a previous response to onReceivedSslError(). We update our
+         * security state to reflect this.
+         */
+        @Override
+        public void onProceededAfterSslError(WebView view, SslError error) {
+            handleProceededAfterSslError(error);
+        }
+
+        /**
          * Displays client certificate request to the user.
          */
         @Override
@@ -2252,4 +2267,12 @@
         return builder.toString();
     }
 
+    private void handleProceededAfterSslError(SslError error) {
+        if (error.getUrl().equals(mCurrentState.mUrl)) {
+            // The security state should currently be SECURITY_STATE_SECURE.
+            setSecurityState(SecurityState.SECURITY_STATE_BAD_CERTIFICATE);
+        } else if (getSecurityState() == SecurityState.SECURITY_STATE_SECURE) {
+            setSecurityState(SecurityState.SECURITY_STATE_MIXED);
+        }
+    }
 }