CVE-2025-11213
Overview
Files Changed
chrome/android/java/res/layout/url_bar.xml
Patch
From 6274f4749acb91c4fc07860ffaa0502a75a60620 Mon Sep 17 00:00:00 2001 From: Patrick Noland <[email protected]> Date: Thu, 18 Sep 2025 12:23:25 -0700 Subject: [PATCH] Fix url bar width when action container is gone The url bar should be constrained by the padding of the parent container. When the action container is gone, this doesn't happen properly; the url bar is clipped but is measured without considering this padding. This causes it to miscalculate the scroll pos when emphasizing the tld. We can fix this by setting a margin for when the url action container is gone equal to the end padding of the parent. Bug: 443408317 Change-Id: Ie3504baec49048b874e41bac4a2201f4da17142d Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6965664 Reviewed-by: Tomasz Wiszkowski <[email protected]> Commit-Queue: Patrick Noland <[email protected]> Cr-Commit-Position: refs/heads/main@{#1517483} --- diff --git a/chrome/android/java/res/layout/url_bar.xml b/chrome/android/java/res/layout/url_bar.xml index 3462a3dd..a707fae5 100644 --- a/chrome/android/java/res/layout/url_bar.xml +++ b/chrome/android/java/res/layout/url_bar.xml @@ -19,6 +19,7 @@ android:hint="@string/omnibox_empty_hint" app:layout_constraintStart_toEndOf="@id/location_bar_status" app:layout_constraintEnd_toStartOf="@id/url_action_container" + app:layout_goneMarginEnd="@dimen/location_bar_end_padding" app:layout_constraintTop_toTopOf="parent" app:layout_constraintHorizontal_weight="1" app:layout_constraintWidth_min="@dimen/location_bar_min_url_width"
Original Bug Report
Spoof on Address Bar
When opening a long domain using link with 2-4 characters, the address bar reduces by 1, for example:
a.w ww.aaaaa.auths.account.google.c appears in the address bar as www.aaaaa.auths.account.google.c (so the victim will think it’s www.aaaaa.auths.account.google.com).
b. https://www.aaaaa.auths.account.google.run appears in the address bar as www.aaaaa.auths.account.google.ru (so the victim will think it’s www.aaaaa.auths.account.google.ru). .ru is the domain for Russia.
c. https://www.aaaaa.auths.account.facebook.io/ appears in the address bar as www.aaaaa.auths.account.google.i (so the victim will think it’s www.aaaaa.auths.account.google.it). .it is the domain for Italy. and example: other by reducing the number of domain names, this causes spoofing in the address bar.
OS: Android 15 Device: Samsung A56 Chrome Version: 142.0.7396.0 Canary
Steps to reproduce:
- open http://http://you-can-billowy-nimble-login-secure-docs-google-source-attacker.com/spoofshortdomain.html
- click the link