Chrome · Omnibox
CVE-2025-12729
Logic Error in Omnibox
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
TEST_Fcontent/browser/renderer_host/render_widget_host_view_android_unittest.cc |
modified | |
RenderWidgetHostViewAndroidScalingTestcontent/browser/renderer_host/render_widget_host_view_android_unittest.cc |
modified |
Files Changed
content/browser/renderer_host/render_widget_host_view_android.cccontent/browser/renderer_host/render_widget_host_view_android.hcontent/browser/renderer_host/render_widget_host_view_android_unittest.cc
Patch
From e81ab324244b7c87c500cc0dc022c40089f86bee Mon Sep 17 00:00:00 2001
From: Patrick Noland <pnoland@google.com>
Date: Fri, 24 Oct 2025 09:00:23 -0700
Subject: [PATCH] Push browser controls update whenever bottom controls height changes
The old logic failed to push updates when height changed at 0% shown
ratio. This was a problem because the offset needs to change when the
height changes at 0% to reflect the new height (i.e. the offset should
become the new height) to avoid leaving the controls partially visible.
The new logic matches existing logic for top controls.
Bug: 454354281
Change-Id: I733d103e8cda58a4dbeefe1fa71282924f7bcd27
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7081525
Commit-Queue: Patrick Noland <pnoland@chromium.org>
Reviewed-by: Nasko Oskov <nasko@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1535059}
---
diff --git a/content/browser/renderer_host/render_widget_host_view_android.cc b/content/browser/renderer_host/render_widget_host_view_android.cc
index 5b904f6..f91c4c48 100644
--- a/content/browser/renderer_host/render_widget_host_view_android.cc
+++ b/content/browser/renderer_host/render_widget_host_view_android.cc
@@ -668,6 +668,7 @@
prev_top_controls_translate_(0.f),
prev_top_controls_min_height_offset_pix_(0.f),
prev_bottom_shown_pix_(0.f),
+ prev_bottom_controls_pix_(0.f),
prev_bottom_controls_translate_(0.f),
prev_bottom_controls_min_height_offset_pix_(0.f),
page_scale_(1.f),
@@ -2253,6 +2254,8 @@
float bottom_shown_pix = bottom_controls_pix * bottom_controls_shown_ratio;
bool bottom_changed = !cc::MathUtil::IsFloatNearlyTheSame(
bottom_shown_pix, prev_bottom_shown_pix_);
+ bottom_changed |= !cc::MathUtil::IsFloatNearlyTheSame(
+ bottom_controls_pix, prev_bottom_controls_pix_);
float bottom_translate = bottom_controls_pix - bottom_shown_pix;
float bottom_min_height_offset_pix = bottom_controls_min_height_offset;
@@ -2268,6 +2271,7 @@
prev_bottom_shown_pix_ = bottom_shown_pix;
prev_bottom_controls_translate_ = bottom_translate;
prev_bottom_controls_min_height_offset_pix_ = bottom_min_height_offset_pix;
+ prev_bottom_controls_pix_ = bottom_controls_pix;
controls_initialized_ = true;
return top_changed || bottom_changed;
}
diff --git a/content/browser/renderer_host/render_widget_host_view_android.h b/content/browser/renderer_host/render_widget_host_view_android.h
index baa9346..7e1cbb1 100644
--- a/content/browser/renderer_host/render_widget_host_view_android.h
+++ b/content/browser/renderer_host/render_widget_host_view_android.h
@@ -539,6 +539,7 @@
FRIEND_TEST_ALL_PREFIXES(SitePerProcessBrowserTest,
GestureManagerListensToChildFrames);
FRIEND_TEST_ALL_PREFIXES(RenderWidgetHostViewAndroidTest, DisplayFeature);
+ FRIEND_TEST_ALL_PREFIXES(RenderWidgetHostViewAndroidTest, UpdateControls);
FRIEND_TEST_ALL_PREFIXES(RenderWidgetHostViewAndroidFluidResizeBrowserTest,
ResizeDefersSynchronizationToNextFrame);
@@ -763,6 +764,7 @@
float prev_top_controls_translate_;
float prev_top_controls_min_height_offset_pix_;
float prev_bottom_shown_pix_;
+ float prev_bottom_controls_pix_;
float prev_bottom_controls_translate_;
float prev_bottom_controls_min_height_offset_pix_;
float page_scale_;
diff --git a/content/browser/renderer_host/render_widget_host_view_android_unittest.cc b/content/browser/renderer_host/render_widget_host_view_android_unittest.cc
index 4a243d7..f53031d 100644
--- a/content/browser/renderer_host/render_widget_host_view_android_unittest.cc
+++ b/content/browser/renderer_host/render_widget_host_view_android_unittest.cc
@@ -667,6 +667,85 @@
base::RunLoop().RunUntilIdle();
}
+TEST_F(RenderWidgetHostViewAndroidTest, UpdateControls) {
+ float dip_scale = 1.0f;
+ float top_height = 90.f;
+ float top_ratio = 1.f;
+ float top_min_height = 0.f;
+ float bottom_height = 50.f;
+ float bottom_ratio = 1.f;
+ float bottom_min_height = 0.f;
+
+ // Get the test view instance from the fixture.
+ RenderWidgetHostViewAndroid* rwhva = render_widget_host_view_android();
+
+ // 1. First call should return true as controls are uninitialized.
+ EXPECT_TRUE(rwhva->UpdateControls(dip_scale, top_height, top_ratio,
+ top_min_height, bottom_height, bottom_ratio,
+ bottom_min_height));
+
+ EXPECT_FALSE(rwhva->UpdateControls(dip_scale, top_height, top_ratio,
+ top_min_height, bottom_height,
+ bottom_ratio, bottom_min_height));
+
+ // 3. Change top_controls_height.
+ float new_top_height = 100.f;
+ EXPECT_TRUE(rwhva->UpdateControls(dip_scale, new_top_height, top_ratio,
+ top_min_height, bottom_height, bottom_ratio,
+ bottom_min_height));
+ // Call again with same values, should return false.
+ EXPECT_FALSE(rwhva->UpdateControls(dip_scale, new_top_height, top_ratio,
+ top_min_height, bottom_height,
+ bottom_ratio, bottom_min_height));
+
+ // 4. Change top_controls_shown_ratio.
+ float new_top_ratio = 0.5f;
+ EXPECT_TRUE(rwhva->UpdateControls(dip_scale, new_top_height, new_top_ratio,
+ top_min_height, bottom_height, bottom_ratio,
+ bottom_min_height));
+ EXPECT_FALSE(rwhva->UpdateControls(dip_scale, new_top_height, new_top_ratio,
+ top_min_height, bottom_height,
+ bottom_ratio, bottom_min_height));
+
+ // 5. Change top_controls_min_height_offset.
+ float new_top_min_height = 10.f;
+ EXPECT_TRUE(rwhva->UpdateControls(dip_scale, new_top_height, new_top_ratio,
+ new_top_min_height, bottom_height,
+ bottom_ratio, bottom_min_height));
+ // Call again with same values, should return false.
+ EXPECT_FALSE(rwhva->UpdateControls(dip_scale, new_top_height, new_top_ratio,
+ new_top_min_height, bottom_height,
+ bottom_ratio, bottom_min_height));
+
+ // 6. Change bottom_controls_shown_ratio.
+ float new_bottom_ratio = 0.0f;
+ EXPECT_TRUE(rwhva->UpdateControls(dip_scale, new_top_height, new_top_ratio,
+ new_top_min_height, bottom_height,
+ new_bottom_ratio, bottom_min_height));
+
+ EXPECT_FALSE(rwhva->UpdateControls(dip_scale, new_top_height, new_top_ratio,
+ new_top_min_height, bottom_height,
+ new_bottom_ratio, bottom_min_height));
+
+ // 7. Change bottom_controls_height while at 0% shown ratio.
+ float new_bottom_height = 60.f;
+ EXPECT_TRUE(rwhva->UpdateControls(dip_scale, new_top_height, new_top_ratio,
+ new_top_min_height, new_bottom_height,
+ new_bottom_ratio, bottom_min_height));
+ EXPECT_FALSE(rwhva->UpdateControls(dip_scale, new_top_height, new_top_ratio,
+ new_top_min_height, new_bottom_height,
+ new_bottom_ratio, bottom_min_height));
+
+ // 8. Change bottom_controls_min_height_offset.
+ float new_bottom_min_height = 10.f;
+ EXPECT_TRUE(rwhva->UpdateControls(dip_scale, new_top_height, new_top_ratio,
+ new_top_min_height, new_bottom_height,
+ new_bottom_ratio, new_bottom_min_height));
+ EXPECT_FALSE(rwhva->UpdateControls(dip_scale, new_top_height, new_top_ratio,
+ new_top_min_height, new_bottom_height,
+ new_bottom_ratio, new_bottom_min_height));
+}
+
// Test for scaling.
class RenderWidgetHostViewAndroidScalingTest
: public RenderWidgetHostViewAndroidTest {
Loading diff…
Regression Test / PoC
shipped with the fix
diff --git a/content/browser/renderer_host/render_widget_host_view_android_unittest.cc b/content/browser/renderer_host/render_widget_host_view_android_unittest.cc
index 4a243d7..f53031d 100644
--- a/content/browser/renderer_host/render_widget_host_view_android_unittest.cc
+++ b/content/browser/renderer_host/render_widget_host_view_android_unittest.cc
@@ -667,6 +667,85 @@
base::RunLoop().RunUntilIdle();
}
+TEST_F(RenderWidgetHostViewAndroidTest, UpdateControls) {
+ float dip_scale = 1.0f;
+ float top_height = 90.f;
+ float top_ratio = 1.f;
+ float top_min_height = 0.f;
+ float bottom_height = 50.f;
+ float bottom_ratio = 1.f;
+ float bottom_min_height = 0.f;
+
+ // Get the test view instance from the fixture.
+ RenderWidgetHostViewAndroid* rwhva = render_widget_host_view_android();
+
+ // 1. First call should return true as controls are uninitialized.
+ EXPECT_TRUE(rwhva->UpdateControls(dip_scale, top_height, top_ratio,
+ top_min_height, bottom_height, bottom_ratio,
+ bottom_min_height));
+
+ EXPECT_FALSE(rwhva->UpdateControls(dip_scale, top_height, top_ratio,
+ top_min_height, bottom_height,
+ bottom_ratio, bottom_min_height));
+
+ // 3. Change top_controls_height.
+ float new_top_height = 100.f;
+ EXPECT_TRUE(rwhva->UpdateControls(dip_scale, new_top_height, top_ratio,
+ top_min_height, bottom_height, bottom_ratio,
+ bottom_min_height));
+ // Call again with same values, should return false.
+ EXPECT_FALSE(rwhva->UpdateControls(dip_scale, new_top_height, top_ratio,
+ top_min_height, bottom_height,
+ bottom_ratio, bottom_min_height));
+
+ // 4. Change top_controls_shown_ratio.
+ float new_top_ratio = 0.5f;
+ EXPECT_TRUE(rwhva->UpdateControls(dip_scale, new_top_height, new_top_ratio,
+ top_min_height, bottom_height, bottom_ratio,
+ bottom_min_height));
+ EXPECT_FALSE(rwhva->UpdateControls(dip_scale, new_top_height, new_top_ratio,
+ top_min_height, bottom_height,
+ bottom_ratio, bottom_min_height));
+
+ // 5. Change top_controls_min_height_offset.
+ float new_top_min_height = 10.f;
+ EXPECT_TRUE(rwhva->UpdateControls(dip_scale, new_top_height, new_top_ratio,
+ new_top_min_height, bottom_height,
+ bottom_ratio, bottom_min_height));
+ // Call again with same values, should return false.
+ EXPECT_FALSE(rwhva->UpdateControls(dip_scale, new_top_height, new_top_ratio,
+ new_top_min_height, bottom_height,
+ bottom_ratio, bottom_min_height));
+
+ // 6. Change bottom_controls_shown_ratio.
+ float new_bottom_ratio = 0.0f;
+ EXPECT_TRUE(rwhva->UpdateControls(dip_scale, new_top_height, new_top_ratio,
+ new_top_min_height, bottom_height,
+ new_bottom_ratio, bottom_min_height));
+
+ EXPECT_FALSE(rwhva->UpdateControls(dip_scale, new_top_height, new_top_ratio,
+ new_top_min_height, bottom_height,
+ new_bottom_ratio, bottom_min_height));
+
+ // 7. Change bottom_controls_height while at 0% shown ratio.
+ float new_bottom_height = 60.f;
+ EXPECT_TRUE(rwhva->UpdateControls(dip_scale, new_top_height, new_top_ratio,
+ new_top_min_height, new_bottom_height,
+ new_bottom_ratio, bottom_min_height));
+ EXPECT_FALSE(rwhva->UpdateControls(dip_scale, new_top_height, new_top_ratio,
+ new_top_min_height, new_bottom_height,
+ new_bottom_ratio, bottom_min_height));
+
+ // 8. Change bottom_controls_min_height_offset.
+ float new_bottom_min_height = 10.f;
+ EXPECT_TRUE(rwhva->UpdateControls(dip_scale, new_top_height, new_top_ratio,
+ new_top_min_height, new_bottom_height,
+ new_bottom_ratio, new_bottom_min_height));
+ EXPECT_FALSE(rwhva->UpdateControls(dip_scale, new_top_height, new_top_ratio,
+ new_top_min_height, new_bottom_height,
+ new_bottom_ratio, new_bottom_min_height));
+}
+
// Test for scaling.
class RenderWidgetHostViewAndroidScalingTest
: public RenderWidgetHostViewAndroidTest {
Loading diff…
Original Bug Report
reported by ch...@gmail.com
Chrome on Android: spoofing issue caused by bottom address bar
Steps to reproduce the problem
(Similar to issue issue 437147699).
- Open index.html or https://lbstyle.github.io/bin.html in an incognito window (to reproduce constantly).
- Tap the “Click” button.
- Tap inside the first input field and wait.
- When the alert pops up, tap OK.
Problem Description
The address bar (omnibox) shows google.com, but the page content is incorrect.
Summary
Chrome on Android: spoofing issue caused by bottom address bar
Additional Data
Category: Security
Chrome Channel: Not sure
Regression: N/A \
References
On This Page