Overview

Low
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactInappropriate implementation in Downloads
DescriptionInappropriate implementation in Downloads
ComponentDownloads
Bug ClassLogic Error
Tracker467442136
Fix commit62c1a660407e (chromium/src) +5/-4
CISA KEVNot listed
CreditedHafiizh
Disclosed2026-02-10

Changed Functions

FunctionChangeNotes
if
ui/views/controls/label.cc
modified

Files Changed

  • ash/clipboard/views/clipboard_history_item_view_pixeltest.cc
  • ui/views/controls/label.cc
From 62c1a660407ec8f7589a271587ffee39bc215751 Mon Sep 17 00:00:00 2001
From: David Yeung <[email protected]>
Date: Mon, 15 Dec 2025 19:00:09 -0800
Subject: [PATCH] Fix Multiline label height for glyphs w/ high ascenders and descenders

Label::GetBoundedTextSize calculated the text height solely based on the
baseline height. This ignored the actual visual height of the rendered
text, causing truncation for strings containing characters with large
ascenders or descenders.

This caused bugs with the DownloadBubble where filenames with special
characters were vertically cut off.

Fix is to use the maximum between the text's visual height and the
baseline height.

https://screenshot.googleplex.com/9DZJj79aNFGHccv

Ash pixel test label was also adjusted because of the change. No major
visual changes, just slight visual offset. Instead of triaging, ash
pixel tests require updating the revision number.

Fixed: 467442136
Change-Id: Id0a8b2e95353896e44800801fa508f4e17b7a3f4
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7256959
Reviewed-by: David Black <[email protected]>
Reviewed-by: Keren Zhu <[email protected]>
Reviewed-by: Andrew Xu <[email protected]>
Commit-Queue: David Black <[email protected]>
Auto-Submit: David Yeung <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1559108}
---

diff --git a/ash/clipboard/views/clipboard_history_item_view_pixeltest.cc b/ash/clipboard/views/clipboard_history_item_view_pixeltest.cc
index a59b475..0dcf831 100644
--- a/ash/clipboard/views/clipboard_history_item_view_pixeltest.cc
+++ b/ash/clipboard/views/clipboard_history_item_view_pixeltest.cc
@@ -63,14 +63,14 @@
           clipboard_history_util::kBitmapItemView);
   EXPECT_TRUE(GetPixelDiffer()->CompareUiComponentsOnPrimaryScreen(
       "bitmap_item_view",
-      /*revision_number=*/1, bitmap_contents));
+      /*revision_number=*/2, bitmap_contents));
 
   // Press the tab key to focus on the delete button.
   GetEventGenerator()->PressAndReleaseKey(ui::VKEY_TAB, ui::EF_NONE);
 
   EXPECT_TRUE(GetPixelDiffer()->CompareUiComponentsOnPrimaryScreen(
       "bitmap_item_view_with_delete_button",
-      /*revision_number=*/1, bitmap_contents));
+      /*revision_number=*/2, bitmap_contents));
 }
 
 }  // namespace ash
diff --git a/ui/views/controls/label.cc b/ui/views/controls/label.cc
index 0c5bb34..2c1b9783 100644
--- a/ui/views/controls/label.cc
+++ b/ui/views/controls/label.cc
@@ -1422,8 +1422,9 @@
     size = full_text_->GetStringSize();
 
     if (base_line_height > 0) {
-      size.set_height(base::checked_cast<int>(GetRequiredLines()) *
-                      base_line_height);
+      const int min_total_height =
+          base::checked_cast<int>(GetRequiredLines()) * base_line_height;
+      size.set_height(std::max(size.height(), min_total_height));
     }
   }
 
Loading diff…

Original Bug Report

reported by [email protected]

when the filename contains a very long with special character can break/remove the extension of file in download buble

VULNERABILITY DETAILS this bug almost simillar of https://issues.chromium.org/issues/423956129 (this happened on extension dialog)

when the filename contains a very long filename with the addition (꧁ᬊᬁ ᬊ᭄꧂ツ) this can break/remove the extension of file in download buble (normally when using long filename without ꧂ it still show the extension of file. but when using ꧁ᬊᬁ it can break the text),so that it leads to spoof.

Steps to reproduce:

  1. Open spooffile.html
  2. click on spoof file button (for spoof)

VERSION Chrome Version 145.0.7571.0 (Official Build) canary (64-bit) Operating System: Windows 11

REPRODUCTION CASE Please include a demonstration of the security bug, such as an attached HTML or binary file that reproduces the bug when loaded in Chrome. PLEASE make the file as small as possible and remove any content not required to demonstrate the bug, or any personal or confidential information.

Please attach files directly, not in zip or other archive formats, and if you’ve created a demonstration site please also attach the files needed to reproduce the demonstration locally.

FOR CRASHES, PLEASE INCLUDE THE FOLLOWING ADDITIONAL INFORMATION Type of crash: [tab, browser, etc.] Crash State: [see link above: stack trace with symbols, registers, exception record] Client ID (if relevant): [see link above]

CREDIT INFORMATION Externally reported security bugs may appear in Chrome release notes. If this bug is included, how would you like to be credited? Reporter credit: [goes here]

View on issue tracker