Medium chrome Logic Error 📄 Reporter bug report 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactInappropriate implementation in Omnibox
DescriptionInappropriate implementation in Omnibox
ComponentOmnibox
Bug ClassLogic Error
Tracker443408317
Fix commit6274f4749acb (chromium/src) +1/-0
CISA KEVNot listed
CreditedHafiizh
Disclosed2025-09-30

Files Changed

  • chrome/android/java/res/layout/url_bar.xml
From 6274f4749acb91c4fc07860ffaa0502a75a60620 Mon Sep 17 00:00:00 2001
From: Patrick Noland <pnoland@google.com>
Date: Thu, 18 Sep 2025 12:23:25 -0700
Subject: [PATCH] Fix url bar width when action container is gone

The url bar should be constrained by the padding of the parent
container. When the action container is gone, this doesn't happen
properly; the url bar is clipped but is measured without considering
this padding. This causes it to miscalculate the scroll pos when
emphasizing the tld. We can fix this by setting a margin for when the
url action container is gone equal to the end padding of the parent.

Bug: 443408317
Change-Id: Ie3504baec49048b874e41bac4a2201f4da17142d
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6965664
Reviewed-by: Tomasz Wiszkowski <ender@google.com>
Commit-Queue: Patrick Noland <pnoland@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1517483}
---

diff --git a/chrome/android/java/res/layout/url_bar.xml b/chrome/android/java/res/layout/url_bar.xml
index 3462a3dd..a707fae5 100644
--- a/chrome/android/java/res/layout/url_bar.xml
+++ b/chrome/android/java/res/layout/url_bar.xml
@@ -19,6 +19,7 @@
     android:hint="@string/omnibox_empty_hint"
     app:layout_constraintStart_toEndOf="@id/location_bar_status"
     app:layout_constraintEnd_toStartOf="@id/url_action_container"
+    app:layout_goneMarginEnd="@dimen/location_bar_end_padding"
     app:layout_constraintTop_toTopOf="parent"
     app:layout_constraintHorizontal_weight="1"
     app:layout_constraintWidth_min="@dimen/location_bar_min_url_width"
Loading diff…

Original Bug Report

reported by sa...@gmail.com

Spoof on Address Bar

When opening a long domain using link with 2-4 characters, the address bar reduces by 1, for example:

a.w ww.aaaaa.auths.account.google.c appears in the address bar as www.aaaaa.auths.account.google.c (so the victim will think it’s www.aaaaa.auths.account.google.com).

b. https://www.aaaaa.auths.account.google.run appears in the address bar as www.aaaaa.auths.account.google.ru (so the victim will think it’s www.aaaaa.auths.account.google.ru). .ru is the domain for Russia.

c. https://www.aaaaa.auths.account.facebook.io/ appears in the address bar as www.aaaaa.auths.account.google.i (so the victim will think it’s www.aaaaa.auths.account.google.it). .it is the domain for Italy. and example: other by reducing the number of domain names, this causes spoofing in the address bar.

OS: Android 15 Device: Samsung A56 Chrome Version: 142.0.7396.0 Canary

Steps to reproduce:

  1. open http://http://you-can-billowy-nimble-login-secure-docs-google-source-attacker.com/spoofshortdomain.html
  2. click the link
View on issue tracker