Medium chrome Logic Error 📄 Reporter bug report 🔧 Commit mapped

Overview

Medium
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactIncorrect security UI in Downloads
DescriptionIncorrect security UI in Downloads
ComponentDownloads
Bug ClassLogic Error
Tracker418273622
Fix commit30d6ec8cc044 (chromium/src) +4/-0
CISA KEVNot listed
CreditedAlesandro Ortiz https://AlesandroOrtiz.com
Disclosed2026-05-12

Files Changed

  • components/messages/android/internal/BUILD.gn
  • components/messages/android/internal/java/src/org/chromium/components/messages/MessageBannerCoordinator.java
From 30d6ec8cc044a5cbfb77e08d32c1d8b6edaef76c Mon Sep 17 00:00:00 2001
From: Mustafa Emre Acer <[email protected]>
Date: Mon, 16 Mar 2026 13:25:11 -0700
Subject: [PATCH] Disable ligatures for all message banners on Android

This change disables rendering of ligatures in message banners for security and readability. Similar changes were previously made
for the omnibox (crrev.com/c/7199504) and permission dialogs (crrev.com/c/7536052).

Bug: 418273622
Change-Id: I881b013b9b341b889fe764071623247ab41bf7f6
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7670344
Commit-Queue: Mustafa Emre Acer <[email protected]>
Reviewed-by: Matthew Jones <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1600082}
---

diff --git a/components/messages/android/internal/BUILD.gn b/components/messages/android/internal/BUILD.gn
index e4004e3..519ec57 100644
--- a/components/messages/android/internal/BUILD.gn
+++ b/components/messages/android/internal/BUILD.gn
@@ -42,6 +42,7 @@
     "//third_party/androidx:androidx_swiperefreshlayout_swiperefreshlayout_java",
     "//ui/accessibility:ax_base_java",
     "//ui/android:ui_full_java",
+    "//ui/android:ui_utils_java",
     "//url:gurl_java",
   ]
 }
diff --git a/components/messages/android/internal/java/src/org/chromium/components/messages/MessageBannerCoordinator.java b/components/messages/android/internal/java/src/org/chromium/components/messages/MessageBannerCoordinator.java
index b5d9b4e..5ee7665 100644
--- a/components/messages/android/internal/java/src/org/chromium/components/messages/MessageBannerCoordinator.java
+++ b/components/messages/android/internal/java/src/org/chromium/components/messages/MessageBannerCoordinator.java
@@ -16,6 +16,7 @@
 import org.chromium.build.annotations.NullMarked;
 import org.chromium.build.annotations.Nullable;
 import org.chromium.components.messages.MessageStateHandler.Position;
+import org.chromium.ui.UiUtils;
 import org.chromium.ui.accessibility.AccessibilityState;
 import org.chromium.ui.listmenu.ListMenuHost.PopupMenuShownListener;
 import org.chromium.ui.modelutil.PropertyModel;
@@ -83,6 +84,8 @@
         view.setSwipeHandler(mMediator);
         view.setPopupMenuShownListener(
                 createPopupMenuShownListener(mTimer, mAutodismissDurationMs.get(), mOnTimeUp));
+
+        UiUtils.disableLigaturesForSecurity(view);
     }
 
     /**
Loading diff…

Original Bug Report

reported by [email protected]

Security: Download UI and address bar spoof with Google Sans font ligatures (similar to issue 391788835)

SUMMARY

Similar to issue 391788835, the Google Sans font ligatures can be used to spoof origin in Download UI after download (“File downloaded” banner + Downloads page). If download URL is opened in a new tab, the spoofed origin is also shown in the address bar during confirmation prompts.

VULNERABILITY DETAILS

Affected UIs:

  • Download banners (such as the “File downloaded” confirmation message)
  • Download page
  • Address bar, if download URL is opened in new tab and prompts are shown (such as “Download file again?” prompts)

VERSION

Verified repro on these versions:

Chrome version: 136.0.7103.87 Stable, 137.0.7151.23 Beta, 138.0.7178.0 Dev, 138.0.7180.0 Canary

Operating System: Android 14, Android 15

REPRODUCTION CASE

Setup: Make your Android device resolve googlelogoligature.com to your malicious server that hosts a downloadable file. In my case, my router let me override DNS entries so it’s easy to test on physical device. For emulated devices, not sure if host’s DNS resolution would affect the emulated devices.

Note: For this PoC, we use HTTP instead of HTTPS because we didn’t set up a cert for googlelogoligature.com or any of the other spoofs. This also causes the “File can’t be downloaded securely” prompt. An attacker can get a valid cert for the actual domain, so these are limitations that exist only in this PoC, not real attacks.

Note: download.zip on my server is a benign file with only the string “empty”.

Scenario 1: Download in same tab (_self)

  1. Navigate to http://plain.text.aogarantiza.com/chromium/ligatures-download.html
  2. Wait a few moments (will trigger download for http://googlelogoligature.com/download.zip).
  3. (For this PoC, click “Keep” in the “File can’t be downloaded securely” prompt.)
  4. Optional: Click a _self download link to trigger another download.

Observed: “File downloaded” banner and download page show spoofed origin (with font ligature).

Expected: “File downloaded” banner and Download page show actual origin.

Scenario 2: Download in new tab (_blank)

  1. Navigate to http://plain.text.aogarantiza.com/chromium/ligatures-download.html
  2. Click a _blank download link to trigger download in new tab.

Observed: While prompts are shown, address bar shows spoofed origin. After download, “File downloaded” banner and download page show spoofed origin (with font ligature).

Expected: While promtps are shown, address bar shows actual origin. After download, “File downloaded” banner and Download page show actual origin.

Credit Information

Reporter credit: Alesandro Ortiz https://AlesandroOrtiz.com

View on issue tracker