CVE-2025-11213
Overview
Files Changed
chrome/android/java/res/layout/url_bar.xml
Patch
From 6274f4749acb91c4fc07860ffaa0502a75a60620 Mon Sep 17 00:00:00 2001
From: Patrick Noland <pnoland@google.com>
Date: Thu, 18 Sep 2025 12:23:25 -0700
Subject: [PATCH] Fix url bar width when action container is gone
The url bar should be constrained by the padding of the parent
container. When the action container is gone, this doesn't happen
properly; the url bar is clipped but is measured without considering
this padding. This causes it to miscalculate the scroll pos when
emphasizing the tld. We can fix this by setting a margin for when the
url action container is gone equal to the end padding of the parent.
Bug: 443408317
Change-Id: Ie3504baec49048b874e41bac4a2201f4da17142d
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6965664
Reviewed-by: Tomasz Wiszkowski <ender@google.com>
Commit-Queue: Patrick Noland <pnoland@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1517483}
---
diff --git a/chrome/android/java/res/layout/url_bar.xml b/chrome/android/java/res/layout/url_bar.xml
index 3462a3dd..a707fae5 100644
--- a/chrome/android/java/res/layout/url_bar.xml
+++ b/chrome/android/java/res/layout/url_bar.xml
@@ -19,6 +19,7 @@
android:hint="@string/omnibox_empty_hint"
app:layout_constraintStart_toEndOf="@id/location_bar_status"
app:layout_constraintEnd_toStartOf="@id/url_action_container"
+ app:layout_goneMarginEnd="@dimen/location_bar_end_padding"
app:layout_constraintTop_toTopOf="parent"
app:layout_constraintHorizontal_weight="1"
app:layout_constraintWidth_min="@dimen/location_bar_min_url_width"
Original Bug Report
Spoof on Address Bar
When opening a long domain using link with 2-4 characters, the address bar reduces by 1, for example:
a.w ww.aaaaa.auths.account.google.c appears in the address bar as www.aaaaa.auths.account.google.c (so the victim will think it’s www.aaaaa.auths.account.google.com).
b. https://www.aaaaa.auths.account.google.run appears in the address bar as www.aaaaa.auths.account.google.ru (so the victim will think it’s www.aaaaa.auths.account.google.ru). .ru is the domain for Russia.
c. https://www.aaaaa.auths.account.facebook.io/ appears in the address bar as www.aaaaa.auths.account.google.i (so the victim will think it’s www.aaaaa.auths.account.google.it). .it is the domain for Italy. and example: other by reducing the number of domain names, this causes spoofing in the address bar.
OS: Android 15 Device: Samsung A56 Chrome Version: 142.0.7396.0 Canary
Steps to reproduce:
- open http://http://you-can-billowy-nimble-login-secure-docs-google-source-attacker.com/spoofshortdomain.html
- click the link