VULNERABILITY DETAILS

We are currently investigating QR code issues across various browsers and have discovered that Chrome on iOS may be susceptible to certain phishing attacks when handling QR codes.

When Chrome scans a QR code on iOS, it attempts to truncate the full URL based on the backslash somehow, trying to display only the SLD in the pop-up. However, when users click the pop-up, Chrome may truncate certain characters in the URL during navigation, potentially redirecting users to a different, misleading website.

VERSION

Chrome Version: 131.0.6778.73

Operating System: iOS 18.1

REPRODUCTION CASE

1. Create a QR code which contains http://msdn.com\\@long.long.evil.com. You can use the first attached picture.
2. Open chrome on iOS then use the build-in camera to scan this QR code.
3. Seeing the second attached picture, user may think it is msdn.com and it is a safe link.
4. After clicking the pop-up, user will be directed to long.long.evil.com.

CREDIT INFORMATION Reporter credit: Zeddy in CUHK