CVE-2025-11213
Overview
Background
- URL bar (Android omnibox)
- the text field defined in
chrome/android/java/res/layout/url_bar.xmlthat shows the current page’s URL in Chrome for Android’s location bar. - TLD emphasis / scroll position
- when the URL is too long to fit, the URL bar works out a horizontal scroll offset so the end of the hostname (the registrable domain and TLD) stays visible, since that is the part that tells the user what the origin is.
- `ConstraintLayout` gone margins
app:layout_constraintEnd_toStartOfanchors the URL bar’s end tourl_action_container. When that sibling isGONE, the constraint falls back to the parent edge, andapp:layout_goneMarginEndis the margin used in that case only.- `location_bar_end_padding`
- the end padding of the parent location-bar container, which visually clips the URL bar.
Root Cause Analysis
The bug is a layout and measurement mismatch in the Android omnibox, not a code-logic bug. The only change is an XML attribute in url_bar.xml. When url_action_container is GONE, the URL bar’s end constraint fell back to the parent edge with no margin. The commit message says the parent’s end padding still clipped the URL bar, but the bar was measured without that padding.
As a result, the bar’s idea of its visible width was larger than the area actually drawn. The scroll-position calculation used to emphasize the TLD therefore aimed for an offset where the end of the hostname sat in the clipped area. The domain the user most needs to see could be hidden, letting a crafted URL show a misleading visible part.
The fix adds app:layout_goneMarginEnd="@dimen/location_bar_end_padding", so that when the action container is gone the bar’s measured width matches the clipped visible width and the TLD-emphasis scroll lands correctly.
url_action_container was GONE, so the TLD-emphasis scroll aimed at a region that was clipped. Adding a gone-margin equal to location_bar_end_padding makes the measured and visible widths match again.Attack Path
- Reach the action-container-gone state
The bug only shows up when
url_action_containerisGONE, which depends on browser UI state (which URL actions are shown). The page does not directly control this, and the patch does not say which states cause it. - Navigate to a long, crafted URL The attacker gets the victim to load a URL whose hostname is long enough that the omnibox must scroll to emphasize the registrable domain and TLD.
- Mis-scrolled TLD emphasis Because the bar is measured as wider than its clipped visible area, the scroll offset leaves the end of the hostname under the parent’s padding, so the true TLD and domain are partly or fully hidden.
- Origin confusion The visible part of the hostname, such as a subdomain chosen to look like a trusted brand, is what the user sees as the site’s identity, which enables URL spoofing (inferred).
Impact Assessment
url_action_container is GONE. There is no memory-safety issue and no privilege gain beyond deceiving the user, and it only matters if the user relies on the omnibox to decide whether to trust the page. The vendor severity is Medium (“Inappropriate implementation in Omnibox”), and the metadata gives no in-the-wild exploitation status.Files Changed
chrome/android/java/res/layout/url_bar.xml
Audit Directions
- Measured vs. visible width in security UILook at other origin-display surfaces (Custom Tabs toolbar, PWA minimal-UI title bar, page-info bubble, permission prompts) where the parent’s padding or clipping is not included in the measurement used for eliding or scrolling the hostname.
- `ConstraintLayout` siblings toggled to `GONE`For views constrained to a sibling that can become
GONE, check that the matchinglayout_goneMargin*keeps the same geometry. This matters especially where the view’s width feeds security-relevant logic such as URL scrolling or eliding. - Dynamic omnibox action statesTest TLD emphasis under every combination of URL-action, status-icon and button visibility, as well as RTL and font scaling, since each changes the available width.
Patch
From 6274f4749acb91c4fc07860ffaa0502a75a60620 Mon Sep 17 00:00:00 2001 From: Patrick Noland <[email protected]> Date: Thu, 18 Sep 2025 12:23:25 -0700 Subject: [PATCH] Fix url bar width when action container is gone The url bar should be constrained by the padding of the parent container. When the action container is gone, this doesn't happen properly; the url bar is clipped but is measured without considering this padding. This causes it to miscalculate the scroll pos when emphasizing the tld. We can fix this by setting a margin for when the url action container is gone equal to the end padding of the parent. Bug: 443408317 Change-Id: Ie3504baec49048b874e41bac4a2201f4da17142d Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6965664 Reviewed-by: Tomasz Wiszkowski <[email protected]> Commit-Queue: Patrick Noland <[email protected]> Cr-Commit-Position: refs/heads/main@{#1517483} --- diff --git a/chrome/android/java/res/layout/url_bar.xml b/chrome/android/java/res/layout/url_bar.xml index 3462a3dd..a707fae5 100644 --- a/chrome/android/java/res/layout/url_bar.xml +++ b/chrome/android/java/res/layout/url_bar.xml @@ -19,6 +19,7 @@ android:hint="@string/omnibox_empty_hint" app:layout_constraintStart_toEndOf="@id/location_bar_status" app:layout_constraintEnd_toStartOf="@id/url_action_container" + app:layout_goneMarginEnd="@dimen/location_bar_end_padding" app:layout_constraintTop_toTopOf="parent" app:layout_constraintHorizontal_weight="1" app:layout_constraintWidth_min="@dimen/location_bar_min_url_width"
Original Bug Report
Spoof on Address Bar
When opening a long domain using link with 2-4 characters, the address bar reduces by 1, for example:
a.w ww.aaaaa.auths.account.google.c appears in the address bar as www.aaaaa.auths.account.google.c (so the victim will think it’s www.aaaaa.auths.account.google.com).
b. https://www.aaaaa.auths.account.google.run appears in the address bar as www.aaaaa.auths.account.google.ru (so the victim will think it’s www.aaaaa.auths.account.google.ru). .ru is the domain for Russia.
c. https://www.aaaaa.auths.account.facebook.io/ appears in the address bar as www.aaaaa.auths.account.google.i (so the victim will think it’s www.aaaaa.auths.account.google.it). .it is the domain for Italy. and example: other by reducing the number of domain names, this causes spoofing in the address bar.
OS: Android 15 Device: Samsung A56 Chrome Version: 142.0.7396.0 Canary
Steps to reproduce:
- open http://http://you-can-billowy-nimble-login-secure-docs-google-source-attacker.com/spoofshortdomain.html
- click the link
