Overview

Low
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactIncorrect security UI in Omnibox
DescriptionIncorrect security UI in Omnibox
ComponentOmnibox
Bug ClassLogic Error
Tracker374285495
Fix commitf545d50577ba (chromium/src) +21/-7
CISA KEVNot listed
CreditedRenwa Hiwa @RenwaX23
Disclosed2026-04-07

Changed Functions

FunctionChangeNotes
if
ios/chrome/browser/location_bar/ui_bundled/location_bar_steady_view.mm
modified

Files Changed

  • ios/chrome/browser/location_bar/ui_bundled/location_bar_steady_view.h
  • ios/chrome/browser/location_bar/ui_bundled/location_bar_steady_view.mm
  • ios/chrome/browser/location_bar/ui_bundled/location_bar_view_controller.mm
From f545d50577ba5a72a89e1495293d5d4bc52b64a4 Mon Sep 17 00:00:00 2001
From: Ameur Hosni <ameurhosni@google.com>
Date: Wed, 18 Feb 2026 02:26:31 -0800
Subject: [PATCH] [IOS] Fix RTL URL component reordering in the location bar

This change fixes a visual issue where URLs containing RTL characters
(e.g., IDN with RTL scripts) would cause the Location Bar label to
switch to RTL paragraph alignment.
This resulted in the visual reversal of URL components, displaying the
Top-Level Domain on the left instead of the right, which could be
misleading regarding the site's actual domain authority.

Before: https://screenshot.googleplex.com/5KFCzgU68rw3D4D
After: https://screenshot.googleplex.com/zJ8fo6KTKNGDgiZ

Fixed: 470395720,374285495
Change-Id: I33884fc685cb7f9a26c93d67167b4f5529cbb668
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7581320
Reviewed-by: Gauthier Ambard <gambard@chromium.org>
Commit-Queue: Ameur Hosni <ameurhosni@google.com>
Cr-Commit-Position: refs/heads/main@{#1586307}
---

diff --git a/ios/chrome/browser/location_bar/ui_bundled/location_bar_steady_view.h b/ios/chrome/browser/location_bar/ui_bundled/location_bar_steady_view.h
index 0cccea9..26b1e25 100644
--- a/ios/chrome/browser/location_bar/ui_bundled/location_bar_steady_view.h
+++ b/ios/chrome/browser/location_bar/ui_bundled/location_bar_steady_view.h
@@ -43,6 +43,10 @@
 // Sets the location label's text.
 - (void)setLocationLabelText:(NSString*)string;
 
+// Sets the location label's text. `clipTail` indicates whether the label should
+// truncate the tail or the head.
+- (void)setLocationLabelText:(NSString*)string clipTail:(BOOL)clipTail;
+
 // Sets the location label's text and styles it as if it were placeholder text.
 - (void)setLocationLabelPlaceholderText:(NSString*)string;
 
diff --git a/ios/chrome/browser/location_bar/ui_bundled/location_bar_steady_view.mm b/ios/chrome/browser/location_bar/ui_bundled/location_bar_steady_view.mm
index f9e5a44d..a32e0a0 100644
--- a/ios/chrome/browser/location_bar/ui_bundled/location_bar_steady_view.mm
+++ b/ios/chrome/browser/location_bar/ui_bundled/location_bar_steady_view.mm
@@ -429,11 +429,23 @@
 }
 
 - (void)setLocationLabelText:(NSString*)string {
-  if ([self.locationLabel.text isEqualToString:string]) {
-    return;
-  }
+  [self setLocationLabelText:string clipTail:NO];
+}
+
+- (void)setLocationLabelText:(NSString*)string clipTail:(BOOL)clipTail {
+  // Use attributed text to force LTR direction for URLs, preventing RTL
+  // characters from messing up the visual order (e.g. IDN with RTL scripts).
+  NSMutableParagraphStyle* style = [[NSMutableParagraphStyle alloc] init];
+  // https://chromium.googlesource.com/chromium/src/+/HEAD/docs/security/url_display_guidelines/url_display_guidelines.md#rtl
+  [style setBaseWritingDirection:NSWritingDirectionLeftToRight];
+  [style setLineBreakMode:clipTail ? NSLineBreakByTruncatingTail
+                                   : NSLineBreakByTruncatingHead];
+
+  NSDictionary* attributes = @{NSParagraphStyleAttributeName : style};
+
+  self.locationLabel.attributedText =
+      [[NSAttributedString alloc] initWithString:string attributes:attributes];
   self.locationLabel.textColor = self.colorScheme.fontColor;
-  self.locationLabel.text = string;
   [self updateAccessibility];
 }
 
diff --git a/ios/chrome/browser/location_bar/ui_bundled/location_bar_view_controller.mm b/ios/chrome/browser/location_bar/ui_bundled/location_bar_view_controller.mm
index 2be6102f..056f6c9e 100644
--- a/ios/chrome/browser/location_bar/ui_bundled/location_bar_view_controller.mm
+++ b/ios/chrome/browser/location_bar/ui_bundled/location_bar_view_controller.mm
@@ -423,9 +423,7 @@
 #pragma mark - LocationBarSteadyViewConsumer
 
 - (void)updateLocationText:(NSString*)string clipTail:(BOOL)clipTail {
-  [self.locationBarSteadyView setLocationLabelText:string];
-  self.locationBarSteadyView.locationLabel.lineBreakMode =
-      clipTail ? NSLineBreakByTruncatingTail : NSLineBreakByTruncatingHead;
+  [self.locationBarSteadyView setLocationLabelText:string clipTail:clipTail];
 }
 
 - (void)updateLocationIcon:(UIImage*)icon
Loading diff…

Original Bug Report

reported by re...@gmail.com

Chrome iOS Address Bar Spoof Using 2 RTL (Arabic Characters) Subdomains

Security Bug


VERSION

Chrome Version: 130.0.6723.37 (Official Build) stable (64-bit) Operating System: iOS 18 on iPhone 16

REPRODUCTION CASE

  • Using Chrome iOS open https://xn--llb.login.wwww.accounts.google.com.xn--llb.pwr.wtf/

Expected Result

Address bar showing ە.login.wwww.accounts.google.com.ە.pwr.wtf/

Actual Result

Address Bar shows pwr.wtf.ە.ogin.wwww.accounts.google.com...

Details

The issue arises when using 2 RTL characters in different level subdomains and in between add a domain that we want to spoof. First we add a RTL character then any domain we want to spoof and in the end we add another RTL character that will confuse the address bar and mixes up the RTL LTR showing of the URL.

CREDIT INFORMATION

Reporter credit: Renwa Hiwa @RenwaX23

View on issue tracker