Chrome · Tab Strip
CVE-2025-5067
Logic Error in Tab Strip
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifchrome/browser/ui/views/tabs/fade_label_view.cc |
modified |
Files Changed
chrome/browser/ui/views/tabs/fade_label_view.ccchrome/browser/ui/views/tabs/fade_label_view.hchrome/browser/ui/views/tabs/tab_hover_card_bubble_view.cc
Patch
From d9a315b74c6648f185aec28d99bf824ddd86f48f Mon Sep 17 00:00:00 2001
From: David Pennington <dpenning@chromium.org>
Date: Wed, 16 Apr 2025 13:05:27 -0700
Subject: [PATCH] Move elide to head for the domain for security purposes
Domain is much more important than the subdomains, thus when showing the
URL we prioritize domain by eliding the head.
Fixed: 40075024
Change-Id: I48e725e32f746b4aa7bb92871a7b6c32d61d3037
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6461121
Reviewed-by: Steven Luong <stluong@chromium.org>
Commit-Queue: David Pennington <dpenning@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1447960}
---
diff --git a/chrome/browser/ui/views/tabs/fade_label_view.cc b/chrome/browser/ui/views/tabs/fade_label_view.cc
index 153f1ab..0e667cf 100644
--- a/chrome/browser/ui/views/tabs/fade_label_view.cc
+++ b/chrome/browser/ui/views/tabs/fade_label_view.cc
@@ -23,7 +23,7 @@
data_ = data;
std::u16string text = data.text;
const bool is_filename = data.is_filename;
- SetElideBehavior(is_filename ? gfx::NO_ELIDE : gfx::ELIDE_TAIL);
+ SetElideBehavior(is_filename ? gfx::NO_ELIDE : data.elide);
if (is_filename) {
text = TruncateFilenameToTwoLines(text);
}
diff --git a/chrome/browser/ui/views/tabs/fade_label_view.h b/chrome/browser/ui/views/tabs/fade_label_view.h
index c55f942..7be4669 100644
--- a/chrome/browser/ui/views/tabs/fade_label_view.h
+++ b/chrome/browser/ui/views/tabs/fade_label_view.h
@@ -9,6 +9,7 @@
#include "chrome/browser/ui/views/tabs/fade_view.h"
#include "ui/base/metadata/metadata_header_macros.h"
+#include "ui/gfx/text_constants.h"
#include "ui/views/accessibility/view_accessibility.h"
#include "ui/views/controls/label.h"
#include "ui/views/style/typography.h"
@@ -16,6 +17,7 @@
struct FadeLabelViewData {
std::u16string text;
bool is_filename = false;
+ gfx::ElideBehavior elide = gfx::ELIDE_TAIL;
};
using FadeWrapper_Label_FadeLabelViewData =
diff --git a/chrome/browser/ui/views/tabs/tab_hover_card_bubble_view.cc b/chrome/browser/ui/views/tabs/tab_hover_card_bubble_view.cc
index 0344029..d330df32 100644
--- a/chrome/browser/ui/views/tabs/tab_hover_card_bubble_view.cc
+++ b/chrome/browser/ui/views/tabs/tab_hover_card_bubble_view.cc
@@ -572,7 +572,7 @@
}
title_label_->SetData({title, is_filename});
- domain_label_->SetData({domain, false});
+ domain_label_->SetData({domain, false, gfx::ELIDE_HEAD});
CollaborationMessagingRowData collaboration_messaging_data =
GetCollaborationMessagingData(tab_data);
Loading diff…
Original Bug Report
reported by ch...@gmail.com
Security: Popup window tab doesn't show the origin elided from the right
VERSION
Chrome Version: 120.0.6071.0 (Official Build) canary (64-bit) (cohort: Clang-64)
Operating System: Windows 11
REPRODUCTION CASE
- Go to https://long-extended-subdomain-name-containing-many-letters-and-dashes.badssl.com
- Hover over the tab
References
On This Page