Low CVSS 6.5 chrome Spoofing 📄 Reporter bug report 🔧 Commit mapped

Overview

Low
Severity
6.5
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactIncorrect security UI in Tab Strip
DescriptionIncorrect security UI in Tab Strip
ComponentTab Strip
Sub-componentHovercard
Bug ClassSpoofing
Tracker458442542
Fix commit4565bd201d41 (chromium/src) +7/-0
CWECWE-451
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CISA KEVNot listed
CreditedHafiizh
Reported2025-11-07 · bounty $1000 (per vendor advisory)
Fix landed2026-05-04 (public git)
Disclosed2026-06-02
Patch gap29 days — fix public in source before the advisory

Changed Functions

FunctionChangeNotes
if
chrome/browser/ui/views/tabs/hovercard/hover_card_anchor_target.cc
modified

Files Changed

  • AUTHORS
  • chrome/browser/ui/views/frame/multi_contents_view_mini_toolbar.cc
  • chrome/browser/ui/views/tabs/hovercard/hover_card_anchor_target.cc
From 4565bd201d41b752c3a5df16298d8d0470e75dbd Mon Sep 17 00:00:00 2001
From: Hafiizh <sas.kunz@gmail.com>
Date: Mon, 04 May 2026 09:20:30 -0700
Subject: [PATCH] hovercard: Fix hover card domain label for about:blank tabs

Previously, the hover card domain label for about:blank tabs was not
handled explicitly, which could cause incorrect domain text to be
displayed. This patch adds an explicit check for about:blank URLs and
sets the domain label to url::kAboutBlankURL16 accordingly.

Bug: 458442542
Change-Id: Ib34c977395919b5c6e7b89cc424867922452aa0f
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7761368
Commit-Queue: Alison Gale <agale@chromium.org>
Auto-Submit: Bug Bounty Channel <sas.kunz@gmail.com>
Reviewed-by: Foromo Daniel Soromou <koretadaniel@chromium.org>
Reviewed-by: Alison Gale <agale@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1624740}
---

diff --git a/AUTHORS b/AUTHORS
index ef9340c..3649262 100644
--- a/AUTHORS
+++ b/AUTHORS
@@ -541,6 +541,7 @@
 Habib Virji <habib.virji@samsung.com>
 Haeun Kim <ggrace.kim93@gmail.com>
 Haeun Kim <haeungun@gmail.com>
+Hafiizh <sas.kunz@gmail.com>
 Haitao Feng <haitao.feng@intel.com>
 Halley Zhao <halley.zhao@intel.com>
 Halton Huo <halton.huo@gmail.com>
diff --git a/chrome/browser/ui/views/frame/multi_contents_view_mini_toolbar.cc b/chrome/browser/ui/views/frame/multi_contents_view_mini_toolbar.cc
index c2fc4be7..7c4f533d 100644
--- a/chrome/browser/ui/views/frame/multi_contents_view_mini_toolbar.cc
+++ b/chrome/browser/ui/views/frame/multi_contents_view_mini_toolbar.cc
@@ -49,6 +49,7 @@
 #include "ui/views/layout/flex_layout.h"
 #include "ui/views/view.h"
 #include "ui/views/view_utils.h"
+#include "url/url_constants.h"
 
 namespace {
 constexpr int kMiniToolbarContentPadding = 4;
@@ -190,6 +191,8 @@
     domain = l10n_util::GetStringUTF16(IDS_HOVER_CARD_BLOB_URL_SOURCE);
   } else if (domain_url.SchemeIs(url::kViewSourceScheme)) {
     domain = l10n_util::GetStringUTF16(IDS_HOVER_CARD_VIEW_SOURCE_URL_SOURCE);
+  } else if (domain_url.IsAboutBlank()) {
+    domain = url::kAboutBlankURL16;
   } else if (tab_ui_helper->ShouldDisplayURL()) {
     domain = url_formatter::FormatUrl(
         domain_url,
diff --git a/chrome/browser/ui/views/tabs/hovercard/hover_card_anchor_target.cc b/chrome/browser/ui/views/tabs/hovercard/hover_card_anchor_target.cc
index 334cd58..70f7cd00 100644
--- a/chrome/browser/ui/views/tabs/hovercard/hover_card_anchor_target.cc
+++ b/chrome/browser/ui/views/tabs/hovercard/hover_card_anchor_target.cc
@@ -21,6 +21,7 @@
 #include "ui/base/interaction/element_tracker.h"
 #include "ui/base/l10n/l10n_util.h"
 #include "ui/views/view.h"
+#include "url/url_constants.h"
 
 namespace {
 
@@ -103,6 +104,8 @@
     domain = l10n_util::GetStringUTF16(IDS_HOVER_CARD_BLOB_URL_SOURCE);
   } else if (domain_url.SchemeIs(url::kViewSourceScheme)) {
     domain = l10n_util::GetStringUTF16(IDS_HOVER_CARD_VIEW_SOURCE_URL_SOURCE);
+  } else if (domain_url.IsAboutBlank()) {
+    domain = url::kAboutBlankURL16;
   } else {
     if (tab_data.should_display_url) {
       is_domain_url = true;
Loading diff…

Original Bug Report

reported by sa...@gmail.com

Popup window tab doesn't show the origin correctly

VULNERABILITY DETAILS

This vulnerability is similar to this: https://issues.chromium.org/issues/40075024, https://issues.chromium.org/issues/448421954

but in this bug Popup window tab doesn’t show correctly. in the popup window it shows subdomain.paypal.auth.docs.google.com which should be about:blank

VERSION Chrome Version 144.0.7513.0 (Official Build) canary (64-bit) Operating System: Windows 11

REPRODUCTION CASE

  1. Open tabdomain.html
  2. Click on button in tabdomain.html
  3. Hover over the tab
View on issue tracker
Uploaded PoC files