Chrome · Toolbar
CVE-2025-9865
Logic Error in Toolbar
Overview
Medium
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifchrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/MiniOriginBarController.java |
modified |
Files Changed
chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/MiniOriginBarController.javachrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/MiniOriginBarControllerTest.java
Patch
From b583fe9162bd751d0c6bd065b4e7da0c76d66c6a Mon Sep 17 00:00:00 2001 From: Patrick Noland <[email protected]> Date: Tue, 12 Aug 2025 10:46:56 -0700 Subject: [PATCH] [mobar] Handle mid-animation replacement Although not explicitly documented, it's possible for a new IME animation to start without the old one finishing, e.g. a "false start" start-showing-then-hide. If we don't update to reflect the state of the new animation we mistakenly perform updates as if the old one is still running which can cause us to e.g. miscalculate the translation. Bug: 437147699 Change-Id: I56b22c121848acb61410d33b42e82b8c0b05cd1a Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6832030 Reviewed-by: Tomasz Wiszkowski <[email protected]> Commit-Queue: Patrick Noland <[email protected]> Cr-Commit-Position: refs/heads/main@{#1500279} --- diff --git a/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/MiniOriginBarController.java b/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/MiniOriginBarController.java index 567e5bd..04f67ba2 100644 --- a/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/MiniOriginBarController.java +++ b/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/MiniOriginBarController.java @@ -524,7 +524,10 @@ @Override public void onStart(WindowInsetsAnimationCompat animation, BoundsCompat bounds) { if (animation != mAnimation) { - return; + if ((animation.getTypeMask() & WindowInsetsCompat.Type.ime()) == 0) { + return; + } + mAnimation = animation; } mAnimationInProgress = true; diff --git a/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/MiniOriginBarControllerTest.java b/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/MiniOriginBarControllerTest.java index 451ceb7..ce3f59aa 100644 --- a/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/MiniOriginBarControllerTest.java +++ b/chrome/browser/ui/android/toolbar/java/src/org/chromium/chrome/browser/toolbar/MiniOriginBarControllerTest.java @@ -593,5 +593,40 @@ verify(mLocationBar, never()).setShowOriginOnly(anyBoolean()); } - // show again, start, finish showing (predictive back) + @Test + public void testAnimationReplacement() { + doReturn(ControlsPosition.BOTTOM).when(mBrowserControlsSizer).getControlsPosition(); + mMiniOriginBarController.onControlsPositionChanged(ControlsPosition.BOTTOM); + final MiniOriginWindowInsetsAnimationListener animationListener = + mMiniOriginBarController.getAnimationListenerForTesting(); + + final int finalKeyboardHeight = 100; + final BoundsCompat bounds = + new BoundsCompat(Insets.NONE, Insets.of(0, 0, 0, finalKeyboardHeight)); + mIsFormFieldFocused.onNodeAttributeUpdated(true, false); + + animationListener.onPrepare(mImeAnimation); + mKeyboardVisibilityDelegate.setVisibilityForTests(true); + animationListener.onStart(mImeAnimation, bounds); + + int currentKeyboardHeight = 50; + WindowInsetsCompat insets = + new WindowInsetsCompat.Builder() + .setInsets( + WindowInsetsCompat.Type.ime(), + Insets.of(0, 0, 0, currentKeyboardHeight)) + .build(); + mImeAnimation.setFraction(0.5f); + animationListener.onProgress(insets, Collections.singletonList(mImeAnimation)); + + // Start a second animation, this time hiding the keyboard. + final WindowInsetsAnimationCompat secondImeAnimation = + new WindowInsetsAnimationCompat(WindowInsetsCompat.Type.ime(), null, 160); + mKeyboardVisibilityDelegate.setVisibilityForTests(false); + animationListener.onStart(secondImeAnimation, bounds); + + secondImeAnimation.setFraction(0.5f); + animationListener.onProgress(insets, Collections.singletonList(secondImeAnimation)); + assertEquals(-currentKeyboardHeight, (int) mControlContainerTranslationSupplier.get()); + } }
Loading diff…
Original Bug Report
reported by [email protected]
Chrome on Android: Spoof issue triggered by bottom address bar
Steps to reproduce the problem
- Navigate to https://lbstyle.github.io/sandbox.html
- Tap inside the input field
- Tap docwrite1
Problem Description
Note: This is very similar to issue 379652406 and issue 40064686.
The omnibox disappears, and the attack can trick the user into thinking they are seeing a fake omnibox of a secure website.
Summary
Chrome on Android: Spoof issue triggered by bottom address bar
Additional Data
Category: Security
Chrome Channel: Canary
Regression: N/A \
References
On This Page