Chrome · Toolbar
CVE-2025-14373
Logic Error in Toolbar
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
chrome/android/java/src/org/chromium/chrome/browser/fullscreen/BrowserControlsManager.java
Patch
From 044d94f7f47fe37c0fea4556f89d336307f33e0a Mon Sep 17 00:00:00 2001
From: Patrick Noland <pnoland@google.com>
Date: Fri, 21 Nov 2025 14:42:42 -0800
Subject: [PATCH] Force relayout when constraints change to SHOWN or BOTH
The linked bug occurs due to not doing a relayout when exiting
fullscreen. Without the relayout, the view does not redraw despite being
VISIBLE and positioned in the correct location. This can occur even when
transitioning to the BOTH state.
Bug: 461532432
Change-Id: I3112a3d05c8ddaee2538d5e17880604f4374046c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7186537
Reviewed-by: Peilin Wang <peilinwang@google.com>
Commit-Queue: Patrick Noland <pnoland@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1548734}
---
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/fullscreen/BrowserControlsManager.java b/chrome/android/java/src/org/chromium/chrome/browser/fullscreen/BrowserControlsManager.java
index 243bc88..17554ad 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/fullscreen/BrowserControlsManager.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/fullscreen/BrowserControlsManager.java
@@ -243,21 +243,23 @@
renderDrivenShowConstraint);
}
- // From https://crbug.com/452885338: Some devices when changing the top
- // controls visibility when exiting fullscreen, the visibility change might
- // not honor a redraw. We do this through forcing a relayout to avoid
- // the toolbar remains hidden.
- if (getAndroidControlsVisibility() != View.VISIBLE
- && BrowserControlsUtils.doSyncMinHeightWithTotalHeightV2()) {
- mForceRelayoutOnVisibilityChange = true;
- }
-
// If controls become locked, it's possible we've previously delayed
// actually setting visibility until a touch event is over. In this case, we
// need to trigger an update again now, which should go through due to
// constraints.
scheduleVisibilityUpdate();
}
+
+ // From https://crbug.com/452885338, https://crbug.com/461532432: When changing
+ // controls visibility when exiting fullscreen, the visibility change might not
+ // honor a redraw. We do this through forcing a relayout to avoid the toolbar
+ // remains hidden.
+ if ((constraints == BrowserControlsState.SHOWN
+ || constraints == BrowserControlsState.BOTH)
+ && getAndroidControlsVisibility() != View.VISIBLE) {
+ mForceRelayoutOnVisibilityChange = true;
+ scheduleVisibilityUpdate();
+ }
});
}
Loading diff…
Original Bug Report
reported by ch...@gmail.com
Bottom Minibar Fails to Display URL – Potential Phishing via Spoof Bar
Steps to reproduce the problem
- Go to https://lbstyle.github.io/testcase.html
- Tap inside the textarea field.
- Tap the button labeled “Go to google.com”.
Problem Description
Observed behavior: The spoof bar minibar does not display the current URL. This could allow a malicious page to overlay a fake minibar with a fake URL, potentially tricking users into entering sensitive information.
Summary
Bottom Minibar Fails to Display URL – Potential Phishing via Spoof Bar
Additional Data
Category: Security
Chrome Channel: Not sure
Regression: N/A \
References
On This Page