Chrome · Toolbar
CVE-2025-9865
Logic Error in Toolbar
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifchrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/MiniOriginBarController.java |
modified |
Files Changed
chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/MiniOriginBarController.javachrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/MiniOriginBarControllerTest.java
Patch
From b583fe9162bd751d0c6bd065b4e7da0c76d66c6a Mon Sep 17 00:00:00 2001
From: Patrick Noland <pnoland@google.com>
Date: Tue, 12 Aug 2025 10:46:56 -0700
Subject: [PATCH] [mobar] Handle mid-animation replacement
Although not explicitly documented, it's possible for a new IME
animation to start without the old one finishing, e.g. a "false start"
start-showing-then-hide. If we don't update to reflect the state of the
new animation we mistakenly perform updates as if the old one is still
running which can cause us to e.g. miscalculate the translation.
Bug: 437147699
Change-Id: I56b22c121848acb61410d33b42e82b8c0b05cd1a
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6832030
Reviewed-by: Tomasz Wiszkowski <ender@google.com>
Commit-Queue: Patrick Noland <pnoland@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1500279}
---
diff --git a/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/MiniOriginBarController.java b/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/MiniOriginBarController.java
index 567e5bd..04f67ba2 100644
--- a/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/MiniOriginBarController.java
+++ b/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/MiniOriginBarController.java
@@ -524,7 +524,10 @@
@Override
public void onStart(WindowInsetsAnimationCompat animation, BoundsCompat bounds) {
if (animation != mAnimation) {
- return;
+ if ((animation.getTypeMask() & WindowInsetsCompat.Type.ime()) == 0) {
+ return;
+ }
+ mAnimation = animation;
}
mAnimationInProgress = true;
diff --git a/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/MiniOriginBarControllerTest.java b/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/MiniOriginBarControllerTest.java
index 451ceb7..ce3f59aa 100644
--- a/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/MiniOriginBarControllerTest.java
+++ b/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/MiniOriginBarControllerTest.java
@@ -593,5 +593,40 @@
verify(mLocationBar, never()).setShowOriginOnly(anyBoolean());
}
- // show again, start, finish showing (predictive back)
+ @Test
+ public void testAnimationReplacement() {
+ doReturn(ControlsPosition.BOTTOM).when(mBrowserControlsSizer).getControlsPosition();
+ mMiniOriginBarController.onControlsPositionChanged(ControlsPosition.BOTTOM);
+ final MiniOriginWindowInsetsAnimationListener animationListener =
+ mMiniOriginBarController.getAnimationListenerForTesting();
+
+ final int finalKeyboardHeight = 100;
+ final BoundsCompat bounds =
+ new BoundsCompat(Insets.NONE, Insets.of(0, 0, 0, finalKeyboardHeight));
+ mIsFormFieldFocused.onNodeAttributeUpdated(true, false);
+
+ animationListener.onPrepare(mImeAnimation);
+ mKeyboardVisibilityDelegate.setVisibilityForTests(true);
+ animationListener.onStart(mImeAnimation, bounds);
+
+ int currentKeyboardHeight = 50;
+ WindowInsetsCompat insets =
+ new WindowInsetsCompat.Builder()
+ .setInsets(
+ WindowInsetsCompat.Type.ime(),
+ Insets.of(0, 0, 0, currentKeyboardHeight))
+ .build();
+ mImeAnimation.setFraction(0.5f);
+ animationListener.onProgress(insets, Collections.singletonList(mImeAnimation));
+
+ // Start a second animation, this time hiding the keyboard.
+ final WindowInsetsAnimationCompat secondImeAnimation =
+ new WindowInsetsAnimationCompat(WindowInsetsCompat.Type.ime(), null, 160);
+ mKeyboardVisibilityDelegate.setVisibilityForTests(false);
+ animationListener.onStart(secondImeAnimation, bounds);
+
+ secondImeAnimation.setFraction(0.5f);
+ animationListener.onProgress(insets, Collections.singletonList(secondImeAnimation));
+ assertEquals(-currentKeyboardHeight, (int) mControlContainerTranslationSupplier.get());
+ }
}
Loading diff…
Original Bug Report
reported by ch...@gmail.com
Chrome on Android: Spoof issue triggered by bottom address bar
Steps to reproduce the problem
- Navigate to https://lbstyle.github.io/sandbox.html
- Tap inside the input field
- Tap docwrite1
Problem Description
Note: This is very similar to issue 379652406 and issue 40064686.
The omnibox disappears, and the attack can trick the user into thinking they are seeing a fake omnibox of a secure website.
Summary
Chrome on Android: Spoof issue triggered by bottom address bar
Additional Data
Category: Security
Chrome Channel: Canary
Regression: N/A \
References
On This Page