This page committed over a valid TLS connection, so Chrome for
Android applied the page-supplied theme-color (#1a73e8) to
the toolbar and status bar.
After load, the page pulls in an active subresource from a host whose
certificate is invalid but which the user has previously
allow-listed (clicked “Proceed” on its interstitial). Running
that script flips the page to ConnectionSecurityLevel.DANGEROUS
without a navigation and without changing the theme-color
value.
Expected (correct) behaviour: toolbar reverts to the default surface color and the danger-triangle / struck-through “https” are tinted red.
Observed (bug): toolbar stays #1a73e8 and the danger-triangle is
tinted neutral grey/white — TabImpl.updateThemeColor()
short-circuits because the cached color equals the new color, so
isThemingAllowed() is never re-consulted.