CVE-2025-12447
Overview
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifchrome/android/java/src/org/chromium/chrome/browser/compositor/CompositorViewHolder.java |
modified |
Files Changed
chrome/android/java/src/org/chromium/chrome/browser/compositor/CompositorViewHolder.java
Patch
From 649828b3c37c0b4b23f61857c6c0398e7ee590e8 Mon Sep 17 00:00:00 2001
From: Patrick Noland <pnoland@google.com>
Date: Thu, 04 Sep 2025 13:57:15 -0700
Subject: [PATCH] Reset active gesture count on tab change or crash
The active gesture count suppresses captures until the gesture ends.
This value can become invalid if we don't receive a balanced number of
acks for gesture begins and ends. Two ways that can happen are changing
tabs between acks or crashes; regardless, it's safe to reset the value
in both these cases.
Bug: 442636157, 434751393
Change-Id: Idb6be4ed8b53bdc2e2f594db01813c2e13c52801
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6917456
Reviewed-by: Sky Malice <skym@chromium.org>
Commit-Queue: Patrick Noland <pnoland@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1511136}
---
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/compositor/CompositorViewHolder.java b/chrome/android/java/src/org/chromium/chrome/browser/compositor/CompositorViewHolder.java
index 551d47c..aef02b8 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/compositor/CompositorViewHolder.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/compositor/CompositorViewHolder.java
@@ -318,6 +318,11 @@
}
@Override
+ public void onCrash(Tab tab) {
+ mNumGestureActiveTouches = 0;
+ }
+
+ @Override
public void onDidFinishNavigationInPrimaryMainFrame(
Tab tab, NavigationHandle navigation) {
if (!navigation.isSameDocument() && navigation.hasCommitted()) {
@@ -337,7 +342,7 @@
@Override
public void onGestureEnd() {
- mNumGestureActiveTouches--;
+ mNumGestureActiveTouches = Math.max(mNumGestureActiveTouches - 1, 0);
updateInMotion();
}
};
@@ -1541,6 +1546,7 @@
mHasKeyboardGeometryChangeFired = false;
if (mTabVisible != null) mTabVisible.removeObserver(mTabObserver);
if (tab != null) {
+ mNumGestureActiveTouches = 0;
tab.addObserver(mTabObserver);
mCompositorView.onTabChanged();
}
Original Bug Report
Chrome on Android: URL spoof triggered by address bar position Change
Steps to reproduce the problem
- Open the test case page and tap the “Try it” button.
- Keep your finger pressed inside the page until an alert dialog appears.
- Try to move the address bar to the bottom, then dismiss the alert dialog.
Problem Description
When moving the Chrome address bar to the bottom of the screen, the URL displayed in the address bar changes to google.com/csi, but the actual page content does not correspond to this URL. This mismatch between the visible URL and page content can mislead users into believing they are on a trusted site when they are not, potentially enabling URL spoofing attacks. This behavior poses a security risk by undermining user trust in the address bar’s accuracy.
This issue appears to be similar to Issue 437147699, which also involves URL spoofing vulnerabilities related to address bar inconsistencies.
Summary
Chrome on Android: URL spoof triggered by address bar position Change
Additional Data
Category: Security
Chrome Channel: Canary
Regression: N/A \