Chrome · Omnibox
CVE-2025-12729
Logic Error in Omnibox
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
TEST_Fcontent/browser/renderer_host/render_widget_host_view_android_unittest.cc |
modified | |
RenderWidgetHostViewAndroidScalingTestcontent/browser/renderer_host/render_widget_host_view_android_unittest.cc |
modified |
Files Changed
content/browser/renderer_host/render_widget_host_view_android.cccontent/browser/renderer_host/render_widget_host_view_android.hcontent/browser/renderer_host/render_widget_host_view_android_unittest.cc
Patch
From e81ab324244b7c87c500cc0dc022c40089f86bee Mon Sep 17 00:00:00 2001 From: Patrick Noland <[email protected]> Date: Fri, 24 Oct 2025 09:00:23 -0700 Subject: [PATCH] Push browser controls update whenever bottom controls height changes The old logic failed to push updates when height changed at 0% shown ratio. This was a problem because the offset needs to change when the height changes at 0% to reflect the new height (i.e. the offset should become the new height) to avoid leaving the controls partially visible. The new logic matches existing logic for top controls. Bug: 454354281 Change-Id: I733d103e8cda58a4dbeefe1fa71282924f7bcd27 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7081525 Commit-Queue: Patrick Noland <[email protected]> Reviewed-by: Nasko Oskov <[email protected]> Cr-Commit-Position: refs/heads/main@{#1535059} --- diff --git a/content/browser/renderer_host/render_widget_host_view_android.cc b/content/browser/renderer_host/render_widget_host_view_android.cc index 5b904f6..f91c4c48 100644 --- a/content/browser/renderer_host/render_widget_host_view_android.cc +++ b/content/browser/renderer_host/render_widget_host_view_android.cc @@ -668,6 +668,7 @@ prev_top_controls_translate_(0.f), prev_top_controls_min_height_offset_pix_(0.f), prev_bottom_shown_pix_(0.f), + prev_bottom_controls_pix_(0.f), prev_bottom_controls_translate_(0.f), prev_bottom_controls_min_height_offset_pix_(0.f), page_scale_(1.f), @@ -2253,6 +2254,8 @@ float bottom_shown_pix = bottom_controls_pix * bottom_controls_shown_ratio; bool bottom_changed = !cc::MathUtil::IsFloatNearlyTheSame( bottom_shown_pix, prev_bottom_shown_pix_); + bottom_changed |= !cc::MathUtil::IsFloatNearlyTheSame( + bottom_controls_pix, prev_bottom_controls_pix_); float bottom_translate = bottom_controls_pix - bottom_shown_pix; float bottom_min_height_offset_pix = bottom_controls_min_height_offset; @@ -2268,6 +2271,7 @@ prev_bottom_shown_pix_ = bottom_shown_pix; prev_bottom_controls_translate_ = bottom_translate; prev_bottom_controls_min_height_offset_pix_ = bottom_min_height_offset_pix; + prev_bottom_controls_pix_ = bottom_controls_pix; controls_initialized_ = true; return top_changed || bottom_changed; } diff --git a/content/browser/renderer_host/render_widget_host_view_android.h b/content/browser/renderer_host/render_widget_host_view_android.h index baa9346..7e1cbb1 100644 --- a/content/browser/renderer_host/render_widget_host_view_android.h +++ b/content/browser/renderer_host/render_widget_host_view_android.h @@ -539,6 +539,7 @@ FRIEND_TEST_ALL_PREFIXES(SitePerProcessBrowserTest, GestureManagerListensToChildFrames); FRIEND_TEST_ALL_PREFIXES(RenderWidgetHostViewAndroidTest, DisplayFeature); + FRIEND_TEST_ALL_PREFIXES(RenderWidgetHostViewAndroidTest, UpdateControls); FRIEND_TEST_ALL_PREFIXES(RenderWidgetHostViewAndroidFluidResizeBrowserTest, ResizeDefersSynchronizationToNextFrame); @@ -763,6 +764,7 @@ float prev_top_controls_translate_; float prev_top_controls_min_height_offset_pix_; float prev_bottom_shown_pix_; + float prev_bottom_controls_pix_; float prev_bottom_controls_translate_; float prev_bottom_controls_min_height_offset_pix_; float page_scale_; diff --git a/content/browser/renderer_host/render_widget_host_view_android_unittest.cc b/content/browser/renderer_host/render_widget_host_view_android_unittest.cc index 4a243d7..f53031d 100644 --- a/content/browser/renderer_host/render_widget_host_view_android_unittest.cc +++ b/content/browser/renderer_host/render_widget_host_view_android_unittest.cc @@ -667,6 +667,85 @@ base::RunLoop().RunUntilIdle(); } +TEST_F(RenderWidgetHostViewAndroidTest, UpdateControls) { + float dip_scale = 1.0f; + float top_height = 90.f; + float top_ratio = 1.f; + float top_min_height = 0.f; + float bottom_height = 50.f; + float bottom_ratio = 1.f; + float bottom_min_height = 0.f; + + // Get the test view instance from the fixture. + RenderWidgetHostViewAndroid* rwhva = render_widget_host_view_android(); + + // 1. First call should return true as controls are uninitialized. + EXPECT_TRUE(rwhva->UpdateControls(dip_scale, top_height, top_ratio, + top_min_height, bottom_height, bottom_ratio, + bottom_min_height)); + + EXPECT_FALSE(rwhva->UpdateControls(dip_scale, top_height, top_ratio, + top_min_height, bottom_height, + bottom_ratio, bottom_min_height)); + + // 3. Change top_controls_height. + float new_top_height = 100.f; + EXPECT_TRUE(rwhva->UpdateControls(dip_scale, new_top_height, top_ratio, + top_min_height, bottom_height, bottom_ratio, + bottom_min_height)); + // Call again with same values, should return false. + EXPECT_FALSE(rwhva->UpdateControls(dip_scale, new_top_height, top_ratio, + top_min_height, bottom_height, + bottom_ratio, bottom_min_height)); + + // 4. Change top_controls_shown_ratio. + float new_top_ratio = 0.5f; + EXPECT_TRUE(rwhva->UpdateControls(dip_scale, new_top_height, new_top_ratio, + top_min_height, bottom_height, bottom_ratio, + bottom_min_height)); + EXPECT_FALSE(rwhva->UpdateControls(dip_scale, new_top_height, new_top_ratio, + top_min_height, bottom_height, + bottom_ratio, bottom_min_height)); + + // 5. Change top_controls_min_height_offset. + float new_top_min_height = 10.f; + EXPECT_TRUE(rwhva->UpdateControls(dip_scale, new_top_height, new_top_ratio, + new_top_min_height, bottom_height, + bottom_ratio, bottom_min_height)); + // Call again with same values, should return false. + EXPECT_FALSE(rwhva->UpdateControls(dip_scale, new_top_height, new_top_ratio, + new_top_min_height, bottom_height, + bottom_ratio, bottom_min_height)); + + // 6. Change bottom_controls_shown_ratio. + float new_bottom_ratio = 0.0f; + EXPECT_TRUE(rwhva->UpdateControls(dip_scale, new_top_height, new_top_ratio, + new_top_min_height, bottom_height, + new_bottom_ratio, bottom_min_height)); + + EXPECT_FALSE(rwhva->UpdateControls(dip_scale, new_top_height, new_top_ratio, + new_top_min_height, bottom_height, + new_bottom_ratio, bottom_min_height)); + + // 7. Change bottom_controls_height while at 0% shown ratio. + float new_bottom_height = 60.f; + EXPECT_TRUE(rwhva->UpdateControls(dip_scale, new_top_height, new_top_ratio, + new_top_min_height, new_bottom_height, + new_bottom_ratio, bottom_min_height)); + EXPECT_FALSE(rwhva->UpdateControls(dip_scale, new_top_height, new_top_ratio, + new_top_min_height, new_bottom_height, + new_bottom_ratio, bottom_min_height)); + + // 8. Change bottom_controls_min_height_offset. + float new_bottom_min_height = 10.f; + EXPECT_TRUE(rwhva->UpdateControls(dip_scale, new_top_height, new_top_ratio, + new_top_min_height, new_bottom_height, + new_bottom_ratio, new_bottom_min_height)); + EXPECT_FALSE(rwhva->UpdateControls(dip_scale, new_top_height, new_top_ratio, + new_top_min_height, new_bottom_height, + new_bottom_ratio, new_bottom_min_height)); +} + // Test for scaling. class RenderWidgetHostViewAndroidScalingTest : public RenderWidgetHostViewAndroidTest {
Loading diff…
Regression Test / PoC
shipped with the fix
diff --git a/content/browser/renderer_host/render_widget_host_view_android_unittest.cc b/content/browser/renderer_host/render_widget_host_view_android_unittest.cc
index 4a243d7..f53031d 100644
--- a/content/browser/renderer_host/render_widget_host_view_android_unittest.cc
+++ b/content/browser/renderer_host/render_widget_host_view_android_unittest.cc
@@ -667,6 +667,85 @@
base::RunLoop().RunUntilIdle();
}
+TEST_F(RenderWidgetHostViewAndroidTest, UpdateControls) {
+ float dip_scale = 1.0f;
+ float top_height = 90.f;
+ float top_ratio = 1.f;
+ float top_min_height = 0.f;
+ float bottom_height = 50.f;
+ float bottom_ratio = 1.f;
+ float bottom_min_height = 0.f;
+
+ // Get the test view instance from the fixture.
+ RenderWidgetHostViewAndroid* rwhva = render_widget_host_view_android();
+
+ // 1. First call should return true as controls are uninitialized.
+ EXPECT_TRUE(rwhva->UpdateControls(dip_scale, top_height, top_ratio,
+ top_min_height, bottom_height, bottom_ratio,
+ bottom_min_height));
+
+ EXPECT_FALSE(rwhva->UpdateControls(dip_scale, top_height, top_ratio,
+ top_min_height, bottom_height,
+ bottom_ratio, bottom_min_height));
+
+ // 3. Change top_controls_height.
+ float new_top_height = 100.f;
+ EXPECT_TRUE(rwhva->UpdateControls(dip_scale, new_top_height, top_ratio,
+ top_min_height, bottom_height, bottom_ratio,
+ bottom_min_height));
+ // Call again with same values, should return false.
+ EXPECT_FALSE(rwhva->UpdateControls(dip_scale, new_top_height, top_ratio,
+ top_min_height, bottom_height,
+ bottom_ratio, bottom_min_height));
+
+ // 4. Change top_controls_shown_ratio.
+ float new_top_ratio = 0.5f;
+ EXPECT_TRUE(rwhva->UpdateControls(dip_scale, new_top_height, new_top_ratio,
+ top_min_height, bottom_height, bottom_ratio,
+ bottom_min_height));
+ EXPECT_FALSE(rwhva->UpdateControls(dip_scale, new_top_height, new_top_ratio,
+ top_min_height, bottom_height,
+ bottom_ratio, bottom_min_height));
+
+ // 5. Change top_controls_min_height_offset.
+ float new_top_min_height = 10.f;
+ EXPECT_TRUE(rwhva->UpdateControls(dip_scale, new_top_height, new_top_ratio,
+ new_top_min_height, bottom_height,
+ bottom_ratio, bottom_min_height));
+ // Call again with same values, should return false.
+ EXPECT_FALSE(rwhva->UpdateControls(dip_scale, new_top_height, new_top_ratio,
+ new_top_min_height, bottom_height,
+ bottom_ratio, bottom_min_height));
+
+ // 6. Change bottom_controls_shown_ratio.
+ float new_bottom_ratio = 0.0f;
+ EXPECT_TRUE(rwhva->UpdateControls(dip_scale, new_top_height, new_top_ratio,
+ new_top_min_height, bottom_height,
+ new_bottom_ratio, bottom_min_height));
+
+ EXPECT_FALSE(rwhva->UpdateControls(dip_scale, new_top_height, new_top_ratio,
+ new_top_min_height, bottom_height,
+ new_bottom_ratio, bottom_min_height));
+
+ // 7. Change bottom_controls_height while at 0% shown ratio.
+ float new_bottom_height = 60.f;
+ EXPECT_TRUE(rwhva->UpdateControls(dip_scale, new_top_height, new_top_ratio,
+ new_top_min_height, new_bottom_height,
+ new_bottom_ratio, bottom_min_height));
+ EXPECT_FALSE(rwhva->UpdateControls(dip_scale, new_top_height, new_top_ratio,
+ new_top_min_height, new_bottom_height,
+ new_bottom_ratio, bottom_min_height));
+
+ // 8. Change bottom_controls_min_height_offset.
+ float new_bottom_min_height = 10.f;
+ EXPECT_TRUE(rwhva->UpdateControls(dip_scale, new_top_height, new_top_ratio,
+ new_top_min_height, new_bottom_height,
+ new_bottom_ratio, new_bottom_min_height));
+ EXPECT_FALSE(rwhva->UpdateControls(dip_scale, new_top_height, new_top_ratio,
+ new_top_min_height, new_bottom_height,
+ new_bottom_ratio, new_bottom_min_height));
+}
+
// Test for scaling.
class RenderWidgetHostViewAndroidScalingTest
: public RenderWidgetHostViewAndroidTest {
Loading diff…
Original Bug Report
reported by [email protected]
Chrome on Android: spoofing issue caused by bottom address bar
Steps to reproduce the problem
(Similar to issue issue 437147699).
- Open index.html or https://lbstyle.github.io/bin.html in an incognito window (to reproduce constantly).
- Tap the “Click” button.
- Tap inside the first input field and wait.
- When the alert pops up, tap OK.
Problem Description
The address bar (omnibox) shows google.com, but the page content is incorrect.
Summary
Chrome on Android: spoofing issue caused by bottom address bar
Additional Data
Category: Security
Chrome Channel: Not sure
Regression: N/A \
References
On This Page