CVE-2026-8564
Overview
Background
- Message banners (Android)
- The
components/messagesinfotbar-style banners Chrome shows on Android for security- and download-related prompts, rendered byMessageBannerCoordinator. - Ligatures
- Font-shaping substitutions that render certain character sequences as a single combined glyph, which can change how text (e.g., URLs, filenames, warnings) visually reads.
- `UiUtils.disableLigaturesForSecurity`
- A shared helper that turns off ligature rendering on a view so displayed security-relevant text cannot be visually altered by shaping.
- Spoofing / "Incorrect security UI"
- A class where a user is misled by what security UI displays, rather than by a memory-safety defect.
Root Cause Analysis
MessageBannerCoordinator (the hunk around line 84 edits its view-setup body; the enclosing method name is not in the @@ header) configured the banner view without disabling ligatures, so text drawn in a banner — including attacker-influenced content such as a filename or origin in a download/security prompt — was shaped with ligatures enabled. Ligature substitution can make distinct character sequences render as deceptive combined glyphs, enabling a spoof of the banner’s security-relevant text.
The fix adds UiUtils.disableLigaturesForSecurity(view) in the view-setup path and pulls in the ui_utils_java dependency and org.chromium.ui.UiUtils import. This is a hardening change that matches prior fixes for the omnibox (crrev.com/c/7199504) and permission dialogs (crrev.com/c/7536052); it does not alter control flow or add a bounds/validation check, it changes how banner text is rendered.
UiUtils.disableLigaturesForSecurity(view) so banner text is shaped unambiguously.Attack Path
- Surface attacker-controlled text in a banner An attacker causes a message banner to display content they influence (e.g., a download filename or origin shown in a security/download prompt).
- Exploit ligature shaping With ligatures enabled, crafted character sequences render as combined glyphs that visually misrepresent the true text, spoofing the banner’s security UI.
- User misled The user reads the altered text and makes a trust decision (e.g., about a download) based on a spoofed banner; the diff shows the rendering change, and the concrete deceptive string is not specified in the patch (inferred).
Impact Assessment
Files Changed
components/messages/android/internal/BUILD.gncomponents/messages/android/internal/java/src/org/chromium/components/messages/MessageBannerCoordinator.java
Audit Directions
- Security-relevant text views lacking ligature hardeningAudit other surfaces that display attacker-influenced strings (dialogs, bubbles, sheets, notifications) for a missing
disableLigaturesForSecuritycall, paralleling omnibox/permission-dialog/message-banner fixes. - Shaping/formatting applied to untrusted stringsLook for places where filenames, origins, or URLs are rendered with default text shaping, bidi, or formatting that can visually alter the string.
- Consistency of a known hardening helperWhen a security helper exists (
UiUtils.disableLigaturesForSecurity), grep for all view-construction sites of trust-decision UI and confirm the helper is applied uniformly across platforms/components.
Patch
From 30d6ec8cc044a5cbfb77e08d32c1d8b6edaef76c Mon Sep 17 00:00:00 2001
From: Mustafa Emre Acer <meacer@chromium.org>
Date: Mon, 16 Mar 2026 13:25:11 -0700
Subject: [PATCH] Disable ligatures for all message banners on Android
This change disables rendering of ligatures in message banners for security and readability. Similar changes were previously made
for the omnibox (crrev.com/c/7199504) and permission dialogs (crrev.com/c/7536052).
Bug: 418273622
Change-Id: I881b013b9b341b889fe764071623247ab41bf7f6
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7670344
Commit-Queue: Mustafa Emre Acer <meacer@chromium.org>
Reviewed-by: Matthew Jones <mdjones@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1600082}
---
diff --git a/components/messages/android/internal/BUILD.gn b/components/messages/android/internal/BUILD.gn
index e4004e3..519ec57 100644
--- a/components/messages/android/internal/BUILD.gn
+++ b/components/messages/android/internal/BUILD.gn
@@ -42,6 +42,7 @@
"//third_party/androidx:androidx_swiperefreshlayout_swiperefreshlayout_java",
"//ui/accessibility:ax_base_java",
"//ui/android:ui_full_java",
+ "//ui/android:ui_utils_java",
"//url:gurl_java",
]
}
diff --git a/components/messages/android/internal/java/src/org/chromium/components/messages/MessageBannerCoordinator.java b/components/messages/android/internal/java/src/org/chromium/components/messages/MessageBannerCoordinator.java
index b5d9b4e..5ee7665 100644
--- a/components/messages/android/internal/java/src/org/chromium/components/messages/MessageBannerCoordinator.java
+++ b/components/messages/android/internal/java/src/org/chromium/components/messages/MessageBannerCoordinator.java
@@ -16,6 +16,7 @@
import org.chromium.build.annotations.NullMarked;
import org.chromium.build.annotations.Nullable;
import org.chromium.components.messages.MessageStateHandler.Position;
+import org.chromium.ui.UiUtils;
import org.chromium.ui.accessibility.AccessibilityState;
import org.chromium.ui.listmenu.ListMenuHost.PopupMenuShownListener;
import org.chromium.ui.modelutil.PropertyModel;
@@ -83,6 +84,8 @@
view.setSwipeHandler(mMediator);
view.setPopupMenuShownListener(
createPopupMenuShownListener(mTimer, mAutodismissDurationMs.get(), mOnTimeUp));
+
+ UiUtils.disableLigaturesForSecurity(view);
}
/**
Original Bug Report
Security: Download UI and address bar spoof with Google Sans font ligatures (similar to issue 391788835)
SUMMARY
Similar to issue 391788835, the Google Sans font ligatures can be used to spoof origin in Download UI after download (“File downloaded” banner + Downloads page). If download URL is opened in a new tab, the spoofed origin is also shown in the address bar during confirmation prompts.
VULNERABILITY DETAILS
Affected UIs:
- Download banners (such as the “File downloaded” confirmation message)
- Download page
- Address bar, if download URL is opened in new tab and prompts are shown (such as “Download file again?” prompts)
VERSION
Verified repro on these versions:
Chrome version: 136.0.7103.87 Stable, 137.0.7151.23 Beta, 138.0.7178.0 Dev, 138.0.7180.0 Canary
Operating System: Android 14, Android 15
REPRODUCTION CASE
Setup:
Make your Android device resolve googlelogoligature.com to your malicious server that hosts a downloadable file. In my case, my router let me override DNS entries so it’s easy to test on physical device. For emulated devices, not sure if host’s DNS resolution would affect the emulated devices.
Note: For this PoC, we use HTTP instead of HTTPS because we didn’t set up a cert for googlelogoligature.com or any of the other spoofs. This also causes the “File can’t be downloaded securely” prompt. An attacker can get a valid cert for the actual domain, so these are limitations that exist only in this PoC, not real attacks.
Note: download.zip on my server is a benign file with only the string “empty”.
Scenario 1: Download in same tab (_self)
- Navigate to http://plain.text.aogarantiza.com/chromium/ligatures-download.html
- Wait a few moments (will trigger download for http://googlelogoligature.com/download.zip).
- (For this PoC, click “Keep” in the “File can’t be downloaded securely” prompt.)
- Optional: Click a
_selfdownload link to trigger another download.
Observed: “File downloaded” banner and download page show spoofed origin (with font ligature).
Expected: “File downloaded” banner and Download page show actual origin.
Scenario 2: Download in new tab (_blank)
- Navigate to http://plain.text.aogarantiza.com/chromium/ligatures-download.html
- Click a
_blankdownload link to trigger download in new tab.
Observed: While prompts are shown, address bar shows spoofed origin. After download, “File downloaded” banner and download page show spoofed origin (with font ligature).
Expected: While promtps are shown, address bar shows actual origin. After download, “File downloaded” banner and Download page show actual origin.
Credit Information
Reporter credit: Alesandro Ortiz https://AlesandroOrtiz.com