CVE-2025-12447
Overview
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifchrome/android/java/src/org/chromium/chrome/browser/compositor/CompositorViewHolder.java |
modified |
Files Changed
chrome/android/java/src/org/chromium/chrome/browser/compositor/CompositorViewHolder.java
Patch
From 649828b3c37c0b4b23f61857c6c0398e7ee590e8 Mon Sep 17 00:00:00 2001 From: Patrick Noland <[email protected]> Date: Thu, 04 Sep 2025 13:57:15 -0700 Subject: [PATCH] Reset active gesture count on tab change or crash The active gesture count suppresses captures until the gesture ends. This value can become invalid if we don't receive a balanced number of acks for gesture begins and ends. Two ways that can happen are changing tabs between acks or crashes; regardless, it's safe to reset the value in both these cases. Bug: 442636157, 434751393 Change-Id: Idb6be4ed8b53bdc2e2f594db01813c2e13c52801 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6917456 Reviewed-by: Sky Malice <[email protected]> Commit-Queue: Patrick Noland <[email protected]> Cr-Commit-Position: refs/heads/main@{#1511136} --- diff --git a/chrome/android/java/src/org/chromium/chrome/browser/compositor/CompositorViewHolder.java b/chrome/android/java/src/org/chromium/chrome/browser/compositor/CompositorViewHolder.java index 551d47c..aef02b8 100644 --- a/chrome/android/java/src/org/chromium/chrome/browser/compositor/CompositorViewHolder.java +++ b/chrome/android/java/src/org/chromium/chrome/browser/compositor/CompositorViewHolder.java @@ -318,6 +318,11 @@ } @Override + public void onCrash(Tab tab) { + mNumGestureActiveTouches = 0; + } + + @Override public void onDidFinishNavigationInPrimaryMainFrame( Tab tab, NavigationHandle navigation) { if (!navigation.isSameDocument() && navigation.hasCommitted()) { @@ -337,7 +342,7 @@ @Override public void onGestureEnd() { - mNumGestureActiveTouches--; + mNumGestureActiveTouches = Math.max(mNumGestureActiveTouches - 1, 0); updateInMotion(); } }; @@ -1541,6 +1546,7 @@ mHasKeyboardGeometryChangeFired = false; if (mTabVisible != null) mTabVisible.removeObserver(mTabObserver); if (tab != null) { + mNumGestureActiveTouches = 0; tab.addObserver(mTabObserver); mCompositorView.onTabChanged(); }
Original Bug Report
Chrome on Android: URL spoof triggered by address bar position Change
Steps to reproduce the problem
- Open the test case page and tap the “Try it” button.
- Keep your finger pressed inside the page until an alert dialog appears.
- Try to move the address bar to the bottom, then dismiss the alert dialog.
Problem Description
When moving the Chrome address bar to the bottom of the screen, the URL displayed in the address bar changes to google.com/csi, but the actual page content does not correspond to this URL. This mismatch between the visible URL and page content can mislead users into believing they are on a trusted site when they are not, potentially enabling URL spoofing attacks. This behavior poses a security risk by undermining user trust in the address bar’s accuracy.
This issue appears to be similar to Issue 437147699, which also involves URL spoofing vulnerabilities related to address bar inconsistencies.
Summary
Chrome on Android: URL spoof triggered by address bar position Change
Additional Data
Category: Security
Chrome Channel: Canary
Regression: N/A \