CVE-2025-3074
Overview
Background
- `chrome://downloads`
- Chrome’s WebUI downloads page, whose per-item UI is rendered by a Lit-based component defined in
item.html.tsand styled byitem.css. - Filename display
- the download’s name is shown in
#name(a<span>) or#file-link(an<a>), whose text comes fromthis.data?.fileName, a server/attacker-influenced value. - Text elision
- CSS (
overflow: hidden,text-overflow: ellipsis,white-space: nowrap) that clips overflowing text to one line, versus wrapping/word-break: break-all, which lets long text expand vertically. - `title` attribute
- the standard HTML tooltip attribute; the fix sets it to the full
fileNameso the untruncated name is available on hover.
Root Cause Analysis
Before the patch, the download filename shown at #name / #file-link used word-break: break-all with no single-line elision, so an overly long filename would wrap across many lines and expand the item’s layout on chrome://downloads. Because fileName is attacker-influenced (a site controls the downloaded file’s name), a crafted long filename could distort the downloads UI, an “inappropriate implementation in Downloads” (inferred: a layout/spoofing concern rather than a memory-safety bug, consistent with the LogicError class).
The fix moves elision styling (overflow: hidden, text-overflow: ellipsis, white-space: nowrap) onto #name, #file-link, and #url, wraps them in a flex #title-area, and adds title="${this.data?.fileName || ''}" so the full name is still reachable via tooltip. It also adds RTL handling (:host-context([dir=rtl]) #name/#file-link { direction: ltr; }) so filenames render with a stable direction. The change constrains untrusted filename text to a single elided line while preserving the complete value on hover.
chrome://downloads layout; the fix elides the name to one line (with an ellipsis) and exposes the full value only through the title tooltip.Attack Path
- Serve a file with a crafted name
A malicious site initiates a download whose
fileNameis excessively long (or direction-manipulating), a value the site controls. - Name reaches the WebUI unelided
On
chrome://downloads,item.html.tsrendersthis.data?.fileNameinto#name/#file-link, which pre-patch usedword-break: break-allwith nowhite-space: nowrap/ellipsis. - Layout distortion The long filename wraps across multiple lines, expanding the download item and disrupting the downloads page layout, enabling UI distortion or spoofing of surrounding elements (inferred).
- Mitigation
The patch confines the name to one elided line and moves the full string into the
titleattribute, removing the layout-distortion vector.
Impact Assessment
chrome://downloads WebUI layout, an inappropriate implementation in Downloads per the advisory. The precondition is that the victim downloads an attacker-named file and views the downloads page; exploitation is limited to UI presentation, and any escalation to a convincing spoof or user-deception primitive is (inferred). The advisory classifies this as a LogicError and does not report in-the-wild exploitation.Files Changed
chrome/browser/resources/downloads/item.csschrome/browser/resources/downloads/item.html.ts
Audit Directions
- Untrusted strings in WebUI layoutAudit privileged
chrome://pages that render attacker-influenced values (filenames, URLs, titles) for missing single-line elision or length bounds that could distort or overflow the UI. - Text direction handlingReview filename/URL display for RTL/LTR override handling, since bidirectional control characters in names can reorder visible text and mislead users.
- Elision-without-disclosureWhere text is elided, verify a
title/tooltip or equivalent still exposes the full value, so mitigations don’t hide security-relevant content.
Patch
From fdf50ecfb6bcba3e7b19ca8aad93b28e2e37ef65 Mon Sep 17 00:00:00 2001 From: Lily Chen <[email protected]> Date: Thu, 06 Feb 2025 14:51:47 -0800 Subject: [PATCH] [Downloads] Truncate/elide overly long filenames This adjusts the CSS on chrome://downloads to elide the filename if it would otherwise wrap, thereby limiting it to one line. Also adds a title attribute to the filename display, so that hovering over an elided filename will display the full filename. Screenshots: https://drive.google.com/drive/folders/1LrF74w51di8eNfs6bO9DmSGhLy45KdTl Bug: 392818696 Change-Id: I234bf55844396bf29120db034b1128d460f95e06 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6237214 Commit-Queue: Lily Chen <[email protected]> Reviewed-by: John Lee <[email protected]> Cr-Commit-Position: refs/heads/main@{#1417034} --- diff --git a/chrome/browser/resources/downloads/item.css b/chrome/browser/resources/downloads/item.css index f5c2357..b2a70b2e 100644 --- a/chrome/browser/resources/downloads/item.css +++ b/chrome/browser/resources/downloads/item.css @@ -187,16 +187,25 @@ } } +#title-area { + display: flex; + flex-direction: row; +} + #name, #file-link, #url { max-width: 100%; + overflow: hidden; + text-overflow: ellipsis; + white-space: nowrap; } #name, #file-link { font-weight: 500; word-break: break-all; + text-align: start; } @media (prefers-color-scheme: light) { @@ -209,13 +218,10 @@ } } -#name { - margin-inline-end: 12px; /* Only really affects #tag. */ -} - #tag { color: #5a5a5a; font-weight: 500; + margin-inline-start: 12px; } #url { @@ -223,10 +229,7 @@ display: block; margin-top: 6px; min-height: 0; - overflow: hidden; text-decoration: none; - text-overflow: ellipsis; - white-space: nowrap; /* Ellipsize beginning and preserve the end to always display the eTLD+1. */ direction: rtl; text-align: end; @@ -257,6 +260,14 @@ direction: ltr; } +:host-context([dir=rtl]) #name { + direction: ltr; +} + +:host-context([dir=rtl]) #file-link { + direction: ltr; +} + .is-active #url { color: var(--cr-secondary-text-color); } diff --git a/chrome/browser/resources/downloads/item.html.ts b/chrome/browser/resources/downloads/item.html.ts index 1e0f2c8..00e8ed3 100644 --- a/chrome/browser/resources/downloads/item.html.ts +++ b/chrome/browser/resources/downloads/item.html.ts @@ -32,11 +32,13 @@ href="${this.data?.url?.url || ''}" @click="${this.onFileLinkClick_}" focus-row-control focus-type="fileLink" + title="${this.data?.fileName || ''}" ?hidden="${!this.shouldLinkFilename_}"><!-- No line break -->${this.data?.fileName || ''}<!-- No line break --></a><!-- Before #name. --><span id="name" + title="${this.data?.fileName || ''}" ?hidden="${this.shouldLinkFilename_}"><!-- No line break -->${this.data?.fileName || ''}</span> <span id="tag">${this.computeTag_()}</span>
Original Bug Report
Bypass :// Characters in Download Security UI lead to Origin Spoofing
Steps to reproduce the problem
1.Prepare spoof.html 2. Access the spoof.html 3. Download the file 4. You will see that the :// blacklist is getting bypassed and allow attacker to create a fake origin
Problem Description
By default, Chrome’s Security UI blocks :// from appearing as a filename in the Download UI. One reason Chrome may block these characters is to prevent spoofing techniques in the Download UI. However, in this case, I was able to bypass this restriction using ∶⧸⧸ (Ratio U+2236 + Long Division Slash U+29F8, x2). With this bypass method, an attacker can create a fake origin in the filename, such as creating a different origin source like From https://google.com to a malicious file in the Download Origin UI.
Summary
Bypass :// Characters in Download Security UI lead to Origin Spoofing
Additional Data
Category: Security
Chrome Channel: Not sure
Regression: N/A