Medium chrome Logic Error 📄 Reporter bug report 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactInappropriate implementation in Toolbar
DescriptionInappropriate implementation in Toolbar
ComponentToolbar
Bug ClassLogic Error
Tracker437147699
Fix commitb583fe9162bd (chromium/src) +40/-2
CISA KEVNot listed
CreditedKhalil Zhani
Disclosed2025-09-02

Changed Functions

FunctionChangeNotes
if
chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/MiniOriginBarController.java
modified

Files Changed

  • chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/MiniOriginBarController.java
  • chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/MiniOriginBarControllerTest.java
From b583fe9162bd751d0c6bd065b4e7da0c76d66c6a Mon Sep 17 00:00:00 2001
From: Patrick Noland <[email protected]>
Date: Tue, 12 Aug 2025 10:46:56 -0700
Subject: [PATCH] [mobar] Handle mid-animation replacement

Although not explicitly documented, it's possible for a new IME
animation to start without the old one finishing, e.g. a "false start"
start-showing-then-hide. If we don't update to reflect the state of the
new animation we mistakenly perform updates as if the old one is still
running which can cause us to e.g. miscalculate the translation.

Bug: 437147699
Change-Id: I56b22c121848acb61410d33b42e82b8c0b05cd1a
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6832030
Reviewed-by: Tomasz Wiszkowski <[email protected]>
Commit-Queue: Patrick Noland <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1500279}
---

diff --git a/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/MiniOriginBarController.java b/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/MiniOriginBarController.java
index 567e5bd..04f67ba2 100644
--- a/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/MiniOriginBarController.java
+++ b/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/MiniOriginBarController.java
@@ -524,7 +524,10 @@
         @Override
         public void onStart(WindowInsetsAnimationCompat animation, BoundsCompat bounds) {
             if (animation != mAnimation) {
-                return;
+                if ((animation.getTypeMask() & WindowInsetsCompat.Type.ime()) == 0) {
+                    return;
+                }
+                mAnimation = animation;
             }
 
             mAnimationInProgress = true;
diff --git a/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/MiniOriginBarControllerTest.java b/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/MiniOriginBarControllerTest.java
index 451ceb7..ce3f59aa 100644
--- a/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/MiniOriginBarControllerTest.java
+++ b/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/MiniOriginBarControllerTest.java
@@ -593,5 +593,40 @@
         verify(mLocationBar, never()).setShowOriginOnly(anyBoolean());
     }
 
-    // show again, start, finish showing (predictive back)
+    @Test
+    public void testAnimationReplacement() {
+        doReturn(ControlsPosition.BOTTOM).when(mBrowserControlsSizer).getControlsPosition();
+        mMiniOriginBarController.onControlsPositionChanged(ControlsPosition.BOTTOM);
+        final MiniOriginWindowInsetsAnimationListener animationListener =
+                mMiniOriginBarController.getAnimationListenerForTesting();
+
+        final int finalKeyboardHeight = 100;
+        final BoundsCompat bounds =
+                new BoundsCompat(Insets.NONE, Insets.of(0, 0, 0, finalKeyboardHeight));
+        mIsFormFieldFocused.onNodeAttributeUpdated(true, false);
+
+        animationListener.onPrepare(mImeAnimation);
+        mKeyboardVisibilityDelegate.setVisibilityForTests(true);
+        animationListener.onStart(mImeAnimation, bounds);
+
+        int currentKeyboardHeight = 50;
+        WindowInsetsCompat insets =
+                new WindowInsetsCompat.Builder()
+                        .setInsets(
+                                WindowInsetsCompat.Type.ime(),
+                                Insets.of(0, 0, 0, currentKeyboardHeight))
+                        .build();
+        mImeAnimation.setFraction(0.5f);
+        animationListener.onProgress(insets, Collections.singletonList(mImeAnimation));
+
+        // Start a second animation, this time hiding the keyboard.
+        final WindowInsetsAnimationCompat secondImeAnimation =
+                new WindowInsetsAnimationCompat(WindowInsetsCompat.Type.ime(), null, 160);
+        mKeyboardVisibilityDelegate.setVisibilityForTests(false);
+        animationListener.onStart(secondImeAnimation, bounds);
+
+        secondImeAnimation.setFraction(0.5f);
+        animationListener.onProgress(insets, Collections.singletonList(secondImeAnimation));
+        assertEquals(-currentKeyboardHeight, (int) mControlContainerTranslationSupplier.get());
+    }
 }
Loading diff…

Original Bug Report

reported by [email protected]

Chrome on Android: Spoof issue triggered by bottom address bar

Steps to reproduce the problem

  1. Navigate to https://lbstyle.github.io/sandbox.html
  2. Tap inside the input field
  3. Tap docwrite1

Problem Description

Note: This is very similar to issue 379652406 and issue 40064686.

The omnibox disappears, and the attack can trick the user into thinking they are seeing a fake omnibox of a secure website.

Summary

Chrome on Android: Spoof issue triggered by bottom address bar

Additional Data

Category: Security
Chrome Channel: Canary
Regression: N/A \

View on issue tracker