Overview

Low
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactIncorrect security UI in Omnibox
DescriptionIncorrect security UI in Omnibox
ComponentOmnibox
Bug ClassLogic Error
Tracker442636157
Fix commit649828b3c37c (chromium/src) +7/-1
CISA KEVNot listed
CreditedKhalil Zhani
Disclosed2025-10-28

Changed Functions

FunctionChangeNotes
if
chrome/android/java/src/org/chromium/chrome/browser/compositor/CompositorViewHolder.java
modified

Files Changed

  • chrome/android/java/src/org/chromium/chrome/browser/compositor/CompositorViewHolder.java
From 649828b3c37c0b4b23f61857c6c0398e7ee590e8 Mon Sep 17 00:00:00 2001
From: Patrick Noland <[email protected]>
Date: Thu, 04 Sep 2025 13:57:15 -0700
Subject: [PATCH] Reset active gesture count on tab change or crash

The active gesture count suppresses captures until the gesture ends.
This value can become invalid if we don't receive a balanced number of
acks for gesture begins and ends. Two ways that can happen are changing
tabs between acks or crashes; regardless, it's safe to reset the value
in both these cases.

Bug: 442636157, 434751393
Change-Id: Idb6be4ed8b53bdc2e2f594db01813c2e13c52801
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6917456
Reviewed-by: Sky Malice <[email protected]>
Commit-Queue: Patrick Noland <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1511136}
---

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/compositor/CompositorViewHolder.java b/chrome/android/java/src/org/chromium/chrome/browser/compositor/CompositorViewHolder.java
index 551d47c..aef02b8 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/compositor/CompositorViewHolder.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/compositor/CompositorViewHolder.java
@@ -318,6 +318,11 @@
                 }
 
                 @Override
+                public void onCrash(Tab tab) {
+                    mNumGestureActiveTouches = 0;
+                }
+
+                @Override
                 public void onDidFinishNavigationInPrimaryMainFrame(
                         Tab tab, NavigationHandle navigation) {
                     if (!navigation.isSameDocument() && navigation.hasCommitted()) {
@@ -337,7 +342,7 @@
 
                 @Override
                 public void onGestureEnd() {
-                    mNumGestureActiveTouches--;
+                    mNumGestureActiveTouches = Math.max(mNumGestureActiveTouches - 1, 0);
                     updateInMotion();
                 }
             };
@@ -1541,6 +1546,7 @@
             mHasKeyboardGeometryChangeFired = false;
             if (mTabVisible != null) mTabVisible.removeObserver(mTabObserver);
             if (tab != null) {
+                mNumGestureActiveTouches = 0;
                 tab.addObserver(mTabObserver);
                 mCompositorView.onTabChanged();
             }
Loading diff…

Original Bug Report

reported by [email protected]

Chrome on Android: URL spoof triggered by address bar position Change

Steps to reproduce the problem

  1. Open the test case page and tap the “Try it” button.
  2. Keep your finger pressed inside the page until an alert dialog appears.
  3. Try to move the address bar to the bottom, then dismiss the alert dialog.

Problem Description

When moving the Chrome address bar to the bottom of the screen, the URL displayed in the address bar changes to google.com/csi, but the actual page content does not correspond to this URL. This mismatch between the visible URL and page content can mislead users into believing they are on a trusted site when they are not, potentially enabling URL spoofing attacks. This behavior poses a security risk by undermining user trust in the address bar’s accuracy.

This issue appears to be similar to Issue 437147699, which also involves URL spoofing vulnerabilities related to address bar inconsistencies.

Summary

Chrome on Android: URL spoof triggered by address bar position Change

Additional Data

Category: Security
Chrome Channel: Canary
Regression: N/A \

View on issue tracker