Medium chrome Logic Error 📄 Reporter bug report 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactInappropriate implementation in Omnibox
DescriptionInappropriate implementation in Omnibox
ComponentOmnibox
Bug ClassLogic Error
Tracker454354281
Fix commite81ab324244b (chromium/src) +85/-0
CISA KEVNot listed
CreditedKhalil Zhani
Disclosed2025-11-05

Changed Functions

FunctionChangeNotes
TEST_F
content/browser/renderer_host/render_widget_host_view_android_unittest.cc
modified
RenderWidgetHostViewAndroidScalingTest
content/browser/renderer_host/render_widget_host_view_android_unittest.cc
modified

Files Changed

  • content/browser/renderer_host/render_widget_host_view_android.cc
  • content/browser/renderer_host/render_widget_host_view_android.h
  • content/browser/renderer_host/render_widget_host_view_android_unittest.cc
From e81ab324244b7c87c500cc0dc022c40089f86bee Mon Sep 17 00:00:00 2001
From: Patrick Noland <[email protected]>
Date: Fri, 24 Oct 2025 09:00:23 -0700
Subject: [PATCH] Push browser controls update whenever bottom controls height changes

The old logic failed to push updates when height changed at 0% shown
ratio. This was a problem because the offset needs to change when the
height changes at 0% to reflect the new height (i.e. the offset should
become the new height) to avoid leaving the controls partially visible.
The new logic matches existing logic for top controls.

Bug: 454354281
Change-Id: I733d103e8cda58a4dbeefe1fa71282924f7bcd27
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7081525
Commit-Queue: Patrick Noland <[email protected]>
Reviewed-by: Nasko Oskov <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1535059}
---

diff --git a/content/browser/renderer_host/render_widget_host_view_android.cc b/content/browser/renderer_host/render_widget_host_view_android.cc
index 5b904f6..f91c4c48 100644
--- a/content/browser/renderer_host/render_widget_host_view_android.cc
+++ b/content/browser/renderer_host/render_widget_host_view_android.cc
@@ -668,6 +668,7 @@
       prev_top_controls_translate_(0.f),
       prev_top_controls_min_height_offset_pix_(0.f),
       prev_bottom_shown_pix_(0.f),
+      prev_bottom_controls_pix_(0.f),
       prev_bottom_controls_translate_(0.f),
       prev_bottom_controls_min_height_offset_pix_(0.f),
       page_scale_(1.f),
@@ -2253,6 +2254,8 @@
   float bottom_shown_pix = bottom_controls_pix * bottom_controls_shown_ratio;
   bool bottom_changed = !cc::MathUtil::IsFloatNearlyTheSame(
       bottom_shown_pix, prev_bottom_shown_pix_);
+  bottom_changed |= !cc::MathUtil::IsFloatNearlyTheSame(
+      bottom_controls_pix, prev_bottom_controls_pix_);
   float bottom_translate = bottom_controls_pix - bottom_shown_pix;
 
   float bottom_min_height_offset_pix = bottom_controls_min_height_offset;
@@ -2268,6 +2271,7 @@
   prev_bottom_shown_pix_ = bottom_shown_pix;
   prev_bottom_controls_translate_ = bottom_translate;
   prev_bottom_controls_min_height_offset_pix_ = bottom_min_height_offset_pix;
+  prev_bottom_controls_pix_ = bottom_controls_pix;
   controls_initialized_ = true;
   return top_changed || bottom_changed;
 }
diff --git a/content/browser/renderer_host/render_widget_host_view_android.h b/content/browser/renderer_host/render_widget_host_view_android.h
index baa9346..7e1cbb1 100644
--- a/content/browser/renderer_host/render_widget_host_view_android.h
+++ b/content/browser/renderer_host/render_widget_host_view_android.h
@@ -539,6 +539,7 @@
   FRIEND_TEST_ALL_PREFIXES(SitePerProcessBrowserTest,
                            GestureManagerListensToChildFrames);
   FRIEND_TEST_ALL_PREFIXES(RenderWidgetHostViewAndroidTest, DisplayFeature);
+  FRIEND_TEST_ALL_PREFIXES(RenderWidgetHostViewAndroidTest, UpdateControls);
   FRIEND_TEST_ALL_PREFIXES(RenderWidgetHostViewAndroidFluidResizeBrowserTest,
                            ResizeDefersSynchronizationToNextFrame);
 
@@ -763,6 +764,7 @@
   float prev_top_controls_translate_;
   float prev_top_controls_min_height_offset_pix_;
   float prev_bottom_shown_pix_;
+  float prev_bottom_controls_pix_;
   float prev_bottom_controls_translate_;
   float prev_bottom_controls_min_height_offset_pix_;
   float page_scale_;
diff --git a/content/browser/renderer_host/render_widget_host_view_android_unittest.cc b/content/browser/renderer_host/render_widget_host_view_android_unittest.cc
index 4a243d7..f53031d 100644
--- a/content/browser/renderer_host/render_widget_host_view_android_unittest.cc
+++ b/content/browser/renderer_host/render_widget_host_view_android_unittest.cc
@@ -667,6 +667,85 @@
   base::RunLoop().RunUntilIdle();
 }
 
+TEST_F(RenderWidgetHostViewAndroidTest, UpdateControls) {
+  float dip_scale = 1.0f;
+  float top_height = 90.f;
+  float top_ratio = 1.f;
+  float top_min_height = 0.f;
+  float bottom_height = 50.f;
+  float bottom_ratio = 1.f;
+  float bottom_min_height = 0.f;
+
+  // Get the test view instance from the fixture.
+  RenderWidgetHostViewAndroid* rwhva = render_widget_host_view_android();
+
+  // 1. First call should return true as controls are uninitialized.
+  EXPECT_TRUE(rwhva->UpdateControls(dip_scale, top_height, top_ratio,
+                                    top_min_height, bottom_height, bottom_ratio,
+                                    bottom_min_height));
+
+  EXPECT_FALSE(rwhva->UpdateControls(dip_scale, top_height, top_ratio,
+                                     top_min_height, bottom_height,
+                                     bottom_ratio, bottom_min_height));
+
+  // 3. Change top_controls_height.
+  float new_top_height = 100.f;
+  EXPECT_TRUE(rwhva->UpdateControls(dip_scale, new_top_height, top_ratio,
+                                    top_min_height, bottom_height, bottom_ratio,
+                                    bottom_min_height));
+  // Call again with same values, should return false.
+  EXPECT_FALSE(rwhva->UpdateControls(dip_scale, new_top_height, top_ratio,
+                                     top_min_height, bottom_height,
+                                     bottom_ratio, bottom_min_height));
+
+  // 4. Change top_controls_shown_ratio.
+  float new_top_ratio = 0.5f;
+  EXPECT_TRUE(rwhva->UpdateControls(dip_scale, new_top_height, new_top_ratio,
+                                    top_min_height, bottom_height, bottom_ratio,
+                                    bottom_min_height));
+  EXPECT_FALSE(rwhva->UpdateControls(dip_scale, new_top_height, new_top_ratio,
+                                     top_min_height, bottom_height,
+                                     bottom_ratio, bottom_min_height));
+
+  // 5. Change top_controls_min_height_offset.
+  float new_top_min_height = 10.f;
+  EXPECT_TRUE(rwhva->UpdateControls(dip_scale, new_top_height, new_top_ratio,
+                                    new_top_min_height, bottom_height,
+                                    bottom_ratio, bottom_min_height));
+  // Call again with same values, should return false.
+  EXPECT_FALSE(rwhva->UpdateControls(dip_scale, new_top_height, new_top_ratio,
+                                     new_top_min_height, bottom_height,
+                                     bottom_ratio, bottom_min_height));
+
+  // 6. Change bottom_controls_shown_ratio.
+  float new_bottom_ratio = 0.0f;
+  EXPECT_TRUE(rwhva->UpdateControls(dip_scale, new_top_height, new_top_ratio,
+                                    new_top_min_height, bottom_height,
+                                    new_bottom_ratio, bottom_min_height));
+
+  EXPECT_FALSE(rwhva->UpdateControls(dip_scale, new_top_height, new_top_ratio,
+                                     new_top_min_height, bottom_height,
+                                     new_bottom_ratio, bottom_min_height));
+
+  // 7. Change bottom_controls_height while at 0% shown ratio.
+  float new_bottom_height = 60.f;
+  EXPECT_TRUE(rwhva->UpdateControls(dip_scale, new_top_height, new_top_ratio,
+                                    new_top_min_height, new_bottom_height,
+                                    new_bottom_ratio, bottom_min_height));
+  EXPECT_FALSE(rwhva->UpdateControls(dip_scale, new_top_height, new_top_ratio,
+                                     new_top_min_height, new_bottom_height,
+                                     new_bottom_ratio, bottom_min_height));
+
+  // 8. Change bottom_controls_min_height_offset.
+  float new_bottom_min_height = 10.f;
+  EXPECT_TRUE(rwhva->UpdateControls(dip_scale, new_top_height, new_top_ratio,
+                                    new_top_min_height, new_bottom_height,
+                                    new_bottom_ratio, new_bottom_min_height));
+  EXPECT_FALSE(rwhva->UpdateControls(dip_scale, new_top_height, new_top_ratio,
+                                     new_top_min_height, new_bottom_height,
+                                     new_bottom_ratio, new_bottom_min_height));
+}
+
 // Test for scaling.
 class RenderWidgetHostViewAndroidScalingTest
     : public RenderWidgetHostViewAndroidTest {
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/content/browser/renderer_host/render_widget_host_view_android_unittest.cc b/content/browser/renderer_host/render_widget_host_view_android_unittest.cc
index 4a243d7..f53031d 100644
--- a/content/browser/renderer_host/render_widget_host_view_android_unittest.cc
+++ b/content/browser/renderer_host/render_widget_host_view_android_unittest.cc
@@ -667,6 +667,85 @@
   base::RunLoop().RunUntilIdle();
 }
 
+TEST_F(RenderWidgetHostViewAndroidTest, UpdateControls) {
+  float dip_scale = 1.0f;
+  float top_height = 90.f;
+  float top_ratio = 1.f;
+  float top_min_height = 0.f;
+  float bottom_height = 50.f;
+  float bottom_ratio = 1.f;
+  float bottom_min_height = 0.f;
+
+  // Get the test view instance from the fixture.
+  RenderWidgetHostViewAndroid* rwhva = render_widget_host_view_android();
+
+  // 1. First call should return true as controls are uninitialized.
+  EXPECT_TRUE(rwhva->UpdateControls(dip_scale, top_height, top_ratio,
+                                    top_min_height, bottom_height, bottom_ratio,
+                                    bottom_min_height));
+
+  EXPECT_FALSE(rwhva->UpdateControls(dip_scale, top_height, top_ratio,
+                                     top_min_height, bottom_height,
+                                     bottom_ratio, bottom_min_height));
+
+  // 3. Change top_controls_height.
+  float new_top_height = 100.f;
+  EXPECT_TRUE(rwhva->UpdateControls(dip_scale, new_top_height, top_ratio,
+                                    top_min_height, bottom_height, bottom_ratio,
+                                    bottom_min_height));
+  // Call again with same values, should return false.
+  EXPECT_FALSE(rwhva->UpdateControls(dip_scale, new_top_height, top_ratio,
+                                     top_min_height, bottom_height,
+                                     bottom_ratio, bottom_min_height));
+
+  // 4. Change top_controls_shown_ratio.
+  float new_top_ratio = 0.5f;
+  EXPECT_TRUE(rwhva->UpdateControls(dip_scale, new_top_height, new_top_ratio,
+                                    top_min_height, bottom_height, bottom_ratio,
+                                    bottom_min_height));
+  EXPECT_FALSE(rwhva->UpdateControls(dip_scale, new_top_height, new_top_ratio,
+                                     top_min_height, bottom_height,
+                                     bottom_ratio, bottom_min_height));
+
+  // 5. Change top_controls_min_height_offset.
+  float new_top_min_height = 10.f;
+  EXPECT_TRUE(rwhva->UpdateControls(dip_scale, new_top_height, new_top_ratio,
+                                    new_top_min_height, bottom_height,
+                                    bottom_ratio, bottom_min_height));
+  // Call again with same values, should return false.
+  EXPECT_FALSE(rwhva->UpdateControls(dip_scale, new_top_height, new_top_ratio,
+                                     new_top_min_height, bottom_height,
+                                     bottom_ratio, bottom_min_height));
+
+  // 6. Change bottom_controls_shown_ratio.
+  float new_bottom_ratio = 0.0f;
+  EXPECT_TRUE(rwhva->UpdateControls(dip_scale, new_top_height, new_top_ratio,
+                                    new_top_min_height, bottom_height,
+                                    new_bottom_ratio, bottom_min_height));
+
+  EXPECT_FALSE(rwhva->UpdateControls(dip_scale, new_top_height, new_top_ratio,
+                                     new_top_min_height, bottom_height,
+                                     new_bottom_ratio, bottom_min_height));
+
+  // 7. Change bottom_controls_height while at 0% shown ratio.
+  float new_bottom_height = 60.f;
+  EXPECT_TRUE(rwhva->UpdateControls(dip_scale, new_top_height, new_top_ratio,
+                                    new_top_min_height, new_bottom_height,
+                                    new_bottom_ratio, bottom_min_height));
+  EXPECT_FALSE(rwhva->UpdateControls(dip_scale, new_top_height, new_top_ratio,
+                                     new_top_min_height, new_bottom_height,
+                                     new_bottom_ratio, bottom_min_height));
+
+  // 8. Change bottom_controls_min_height_offset.
+  float new_bottom_min_height = 10.f;
+  EXPECT_TRUE(rwhva->UpdateControls(dip_scale, new_top_height, new_top_ratio,
+                                    new_top_min_height, new_bottom_height,
+                                    new_bottom_ratio, new_bottom_min_height));
+  EXPECT_FALSE(rwhva->UpdateControls(dip_scale, new_top_height, new_top_ratio,
+                                     new_top_min_height, new_bottom_height,
+                                     new_bottom_ratio, new_bottom_min_height));
+}
+
 // Test for scaling.
 class RenderWidgetHostViewAndroidScalingTest
     : public RenderWidgetHostViewAndroidTest {
Loading diff…

Original Bug Report

reported by [email protected]

Chrome on Android: spoofing issue caused by bottom address bar

Steps to reproduce the problem

(Similar to issue issue 437147699).

  1. Open index.html or https://lbstyle.github.io/bin.html in an incognito window (to reproduce constantly).
  2. Tap the “Click” button.
  3. Tap inside the first input field and wait.
  4. When the alert pops up, tap OK.

Problem Description

The address bar (omnibox) shows google.com, but the page content is incorrect.

Summary

Chrome on Android: spoofing issue caused by bottom address bar

Additional Data

Category: Security
Chrome Channel: Not sure
Regression: N/A \

View on issue tracker