Chrome · Tab Strip
CVE-2025-5067
Logic Error in Tab Strip
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifchrome/browser/ui/views/tabs/fade_label_view.cc |
modified |
Files Changed
chrome/browser/ui/views/tabs/fade_label_view.ccchrome/browser/ui/views/tabs/fade_label_view.hchrome/browser/ui/views/tabs/tab_hover_card_bubble_view.cc
Patch
From d9a315b74c6648f185aec28d99bf824ddd86f48f Mon Sep 17 00:00:00 2001 From: David Pennington <[email protected]> Date: Wed, 16 Apr 2025 13:05:27 -0700 Subject: [PATCH] Move elide to head for the domain for security purposes Domain is much more important than the subdomains, thus when showing the URL we prioritize domain by eliding the head. Fixed: 40075024 Change-Id: I48e725e32f746b4aa7bb92871a7b6c32d61d3037 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6461121 Reviewed-by: Steven Luong <[email protected]> Commit-Queue: David Pennington <[email protected]> Cr-Commit-Position: refs/heads/main@{#1447960} --- diff --git a/chrome/browser/ui/views/tabs/fade_label_view.cc b/chrome/browser/ui/views/tabs/fade_label_view.cc index 153f1ab..0e667cf 100644 --- a/chrome/browser/ui/views/tabs/fade_label_view.cc +++ b/chrome/browser/ui/views/tabs/fade_label_view.cc @@ -23,7 +23,7 @@ data_ = data; std::u16string text = data.text; const bool is_filename = data.is_filename; - SetElideBehavior(is_filename ? gfx::NO_ELIDE : gfx::ELIDE_TAIL); + SetElideBehavior(is_filename ? gfx::NO_ELIDE : data.elide); if (is_filename) { text = TruncateFilenameToTwoLines(text); } diff --git a/chrome/browser/ui/views/tabs/fade_label_view.h b/chrome/browser/ui/views/tabs/fade_label_view.h index c55f942..7be4669 100644 --- a/chrome/browser/ui/views/tabs/fade_label_view.h +++ b/chrome/browser/ui/views/tabs/fade_label_view.h @@ -9,6 +9,7 @@ #include "chrome/browser/ui/views/tabs/fade_view.h" #include "ui/base/metadata/metadata_header_macros.h" +#include "ui/gfx/text_constants.h" #include "ui/views/accessibility/view_accessibility.h" #include "ui/views/controls/label.h" #include "ui/views/style/typography.h" @@ -16,6 +17,7 @@ struct FadeLabelViewData { std::u16string text; bool is_filename = false; + gfx::ElideBehavior elide = gfx::ELIDE_TAIL; }; using FadeWrapper_Label_FadeLabelViewData = diff --git a/chrome/browser/ui/views/tabs/tab_hover_card_bubble_view.cc b/chrome/browser/ui/views/tabs/tab_hover_card_bubble_view.cc index 0344029..d330df32 100644 --- a/chrome/browser/ui/views/tabs/tab_hover_card_bubble_view.cc +++ b/chrome/browser/ui/views/tabs/tab_hover_card_bubble_view.cc @@ -572,7 +572,7 @@ } title_label_->SetData({title, is_filename}); - domain_label_->SetData({domain, false}); + domain_label_->SetData({domain, false, gfx::ELIDE_HEAD}); CollaborationMessagingRowData collaboration_messaging_data = GetCollaborationMessagingData(tab_data);
Loading diff…
Original Bug Report
reported by [email protected]
Security: Popup window tab doesn't show the origin elided from the right
VERSION
Chrome Version: 120.0.6071.0 (Official Build) canary (64-bit) (cohort: Clang-64)
Operating System: Windows 11
REPRODUCTION CASE
- Go to https://long-extended-subdomain-name-containing-many-letters-and-dashes.badssl.com
- Hover over the tab
References
On This Page