Overview

Low
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactIncorrect security UI in WebUI
DescriptionIncorrect security UI in WebUI
ComponentWebUI
Bug ClassLogic Error
Tracker503346647
Fix commitd69cea6324b1 (chromium/src) +12/-1
CISA KEVNot listed
CreditedTareq Ahamed - itztrq
Disclosed2026-06-02

Files Changed

  • chrome/test/data/webui/cr_elements/cr_url_list_item_test.ts
  • ui/webui/resources/cr_elements/cr_url_list_item/cr_url_list_item.html.ts
From d69cea6324b1be71f533c5b85a9cb7670935f654 Mon Sep 17 00:00:00 2001
From: Alison Gale <[email protected]>
Date: Wed, 22 Apr 2026 08:34:01 -0700
Subject: [PATCH] [Reading List]Fix domain rendering for reading list

The url list item will render the title and domain or description of a
tab. Directionality of the text is reversed to elide from the front
which results in domains being rendered backwards. This ensures the
domain direction is isolated from the eliding so it will render
correctly.

https://screenshot.googleplex.com/BhFRWMFYrmJ7uN4

Bug: 503346647
Change-Id: Ic4ce0ef132d0b027a20922ed4d5da03f82b7a6a0
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7782762
Commit-Queue: Alison Gale <[email protected]>
Reviewed-by: John Lee <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1618889}
---

diff --git a/chrome/test/data/webui/cr_elements/cr_url_list_item_test.ts b/chrome/test/data/webui/cr_elements/cr_url_list_item_test.ts
index c40e48fa..da2b00a 100644
--- a/chrome/test/data/webui/cr_elements/cr_url_list_item_test.ts
+++ b/chrome/test/data/webui/cr_elements/cr_url_list_item_test.ts
@@ -65,6 +65,17 @@
     assertEquals('99+', count.textContent);
   });
 
+  test('DescriptionWithBdi', async () => {
+    element.description = '1.google.com';
+    await element.updateComplete;
+    const descriptionText =
+        element.shadowRoot.querySelector('.description-text')!;
+    assertTrue(!!descriptionText);
+    const bdi = descriptionText.querySelector('bdi');
+    assertTrue(!!bdi);
+    assertEquals('1.google.com', bdi.textContent);
+  });
+
   test('SetsActiveClass', () => {
     assertFalse(element.classList.contains('active'));
     element.dispatchEvent(new PointerEvent('pointerdown'));
diff --git a/ui/webui/resources/cr_elements/cr_url_list_item/cr_url_list_item.html.ts b/ui/webui/resources/cr_elements/cr_url_list_item/cr_url_list_item.html.ts
index 9a2d762f..fef7ea5 100644
--- a/ui/webui/resources/cr_elements/cr_url_list_item/cr_url_list_item.html.ts
+++ b/ui/webui/resources/cr_elements/cr_url_list_item/cr_url_list_item.html.ts
@@ -56,7 +56,7 @@
     <span class="title">${this.title}</span>
     <div class="descriptions">
       <div class="description" ?hidden="${!this.description}">
-        <span class="description-text">${this.description}</span>
+        <span class="description-text"><bdi>${this.description}</bdi></span>
         <span class="description-meta" ?hidden="${!this.descriptionMeta}">
           &middot; ${this.descriptionMeta}
         </span>
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/chrome/test/data/webui/cr_elements/cr_url_list_item_test.ts b/chrome/test/data/webui/cr_elements/cr_url_list_item_test.ts
index c40e48fa..da2b00a 100644
--- a/chrome/test/data/webui/cr_elements/cr_url_list_item_test.ts
+++ b/chrome/test/data/webui/cr_elements/cr_url_list_item_test.ts
@@ -65,6 +65,17 @@
     assertEquals('99+', count.textContent);
   });
 
+  test('DescriptionWithBdi', async () => {
+    element.description = '1.google.com';
+    await element.updateComplete;
+    const descriptionText =
+        element.shadowRoot.querySelector('.description-text')!;
+    assertTrue(!!descriptionText);
+    const bdi = descriptionText.querySelector('bdi');
+    assertTrue(!!bdi);
+    assertEquals('1.google.com', bdi.textContent);
+  });
+
   test('SetsActiveClass', () => {
     assertFalse(element.classList.contains('active'));
     element.dispatchEvent(new PointerEvent('pointerdown'));
Loading diff…

Original Bug Report

reported by [email protected]

I identified that the Chrome browser’s Reading List feature introduces an origin confusion issue by reordering domain names. This behavior can mislead users about the true origin of a website.


Report description

I identified that the Chrome browser’s Reading List feature introduces an origin confusion issue by reordering domain names. This behavior can mislead users about the true origin of a website.


Bug location

Where do you want to report your vulnerability?

Chrome VRP – Report security issues affecting the Chrome browser. See program rules

Which URL (or repository) have you found the vulnerability in?

Chrome Browser


The problem

Please describe the technical details of the vulnerability

I identified that the Chrome browser’s Reading List feature introduces an origin confusion issue by reordering domain names. This behavior can mislead users about the true origin of a website.

The Chrome Reading List feature alters how domains are displayed by reordering parts of the hostname. For example, visiting 1.attacker.com shown as attacker.com.1, and 1111.google.com appear as google.com.1111.

This transformation breaks the standard visual cues users rely on to identify legitimate domains, potentially causing them to misinterpret malicious domains as trusted ones.

Step To Produce:

  1. Open Chrome Browser.
  2. Visit website like https://1.attacker.com/ , http://1111.google.com/
  3. Add these two sites to the reading list.
  4. Now open the Chrome Reading List it’ll show attacker.com.1, google.com.1111

Impact analysis

This issue can lead to origin confusion attacks, where users mistakenly trust a malicious domain due to misleading display formatting. An attacker could craft domains that appear similar to legitimate services (e.g., mimicking trusted brands) and rely on Chrome Browser’s Reading List reordering to obscure the true origin. This increases the risk of phishing, credential theft, and unintended interaction with malicious websites, especially in scenarios where users rely on quick tab switching rather than carefully inspecting full URLs.


The cause

What version of Chrome have you found the security issue in?

147.0.7727.57 (Official Build) (64-bit) (cohort: Control)

No, it is not related to a crash.

Choose the type of vulnerability

Security UI Spoofing

How would you like to be publicly acknowledged for your report?

Tareq Ahamed - itztrq

View on issue tracker