PatchGap
Chrome · Downloads

CVE-2026-8564

Spoofing in Downloads
Medium watch CVSS 4.2 chrome Spoofing 📄 Reporter bug report 🔧 Commit mapped

Overview

Medium
Severity
4.2
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactIncorrect security UI in Downloads
DescriptionIncorrect security UI in Downloads
ComponentDownloads
Bug ClassSpoofing
Action tierwatch — logic/policy bug — security-relevant, no memory-unsafety
Computed by PatchGap's deterministic exploitability ruler from the fixing commit. patch-now = RCE-class & attacker-reachable in a default config, or exploited in the wild; watch = real security signal below that bar; noise = no security relevance.
Tracker418273622
Fix commit30d6ec8cc044 (chromium/src) +4/-0
CWECWE-451
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L
CISA KEVNot listed
CreditedAlesandro Ortiz https://AlesandroOrtiz.com
Reported2025-05-16 (per vendor advisory)
Fix landed2026-03-16 (public git)
Disclosed2026-05-12
Patch gap57 days — fix public in source before the advisory

Background

Message banners (Android)
The components/messages infotbar-style banners Chrome shows on Android for security- and download-related prompts, rendered by MessageBannerCoordinator.
Ligatures
Font-shaping substitutions that render certain character sequences as a single combined glyph, which can change how text (e.g., URLs, filenames, warnings) visually reads.
`UiUtils.disableLigaturesForSecurity`
A shared helper that turns off ligature rendering on a view so displayed security-relevant text cannot be visually altered by shaping.
Spoofing / "Incorrect security UI"
A class where a user is misled by what security UI displays, rather than by a memory-safety defect.

Root Cause Analysis

MessageBannerCoordinator (the hunk around line 84 edits its view-setup body; the enclosing method name is not in the @@ header) configured the banner view without disabling ligatures, so text drawn in a banner — including attacker-influenced content such as a filename or origin in a download/security prompt — was shaped with ligatures enabled. Ligature substitution can make distinct character sequences render as deceptive combined glyphs, enabling a spoof of the banner’s security-relevant text.

The fix adds UiUtils.disableLigaturesForSecurity(view) in the view-setup path and pulls in the ui_utils_java dependency and org.chromium.ui.UiUtils import. This is a hardening change that matches prior fixes for the omnibox (crrev.com/c/7199504) and permission dialogs (crrev.com/c/7536052); it does not alter control flow or add a bounds/validation check, it changes how banner text is rendered.

Key insight
The core mistake was rendering security-relevant banner text with ligatures enabled, allowing visual spoofing; the fix calls UiUtils.disableLigaturesForSecurity(view) so banner text is shaped unambiguously.

Attack Path

  1. Surface attacker-controlled text in a banner An attacker causes a message banner to display content they influence (e.g., a download filename or origin shown in a security/download prompt).
  2. Exploit ligature shaping With ligatures enabled, crafted character sequences render as combined glyphs that visually misrepresent the true text, spoofing the banner’s security UI.
  3. User misled The user reads the altered text and makes a trust decision (e.g., about a download) based on a spoofed banner; the diff shows the rendering change, and the concrete deceptive string is not specified in the patch (inferred).

Impact Assessment

An attacker can make security-relevant text in Android message banners render deceptively via ligatures, misleading the user, which the advisory classifies as “Incorrect security UI in Downloads” at medium severity. The effect is purely UI/presentation in the Android Chrome client (no memory-safety impact); it requires the user to view and act on the spoofed banner. The advisory states no exploited-in-the-wild status.

Files Changed

  • components/messages/android/internal/BUILD.gn
  • components/messages/android/internal/java/src/org/chromium/components/messages/MessageBannerCoordinator.java

Audit Directions

  • Security-relevant text views lacking ligature hardening
    Audit other surfaces that display attacker-influenced strings (dialogs, bubbles, sheets, notifications) for a missing disableLigaturesForSecurity call, paralleling omnibox/permission-dialog/message-banner fixes.
  • Shaping/formatting applied to untrusted strings
    Look for places where filenames, origins, or URLs are rendered with default text shaping, bidi, or formatting that can visually alter the string.
  • Consistency of a known hardening helper
    When a security helper exists (UiUtils.disableLigaturesForSecurity), grep for all view-construction sites of trust-decision UI and confirm the helper is applied uniformly across platforms/components.

Patch

view commit
From 30d6ec8cc044a5cbfb77e08d32c1d8b6edaef76c Mon Sep 17 00:00:00 2001
From: Mustafa Emre Acer <[email protected]>
Date: Mon, 16 Mar 2026 13:25:11 -0700
Subject: [PATCH] Disable ligatures for all message banners on Android

This change disables rendering of ligatures in message banners for security and readability. Similar changes were previously made
for the omnibox (crrev.com/c/7199504) and permission dialogs (crrev.com/c/7536052).

Bug: 418273622
Change-Id: I881b013b9b341b889fe764071623247ab41bf7f6
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7670344
Commit-Queue: Mustafa Emre Acer <[email protected]>
Reviewed-by: Matthew Jones <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1600082}
---

diff --git a/components/messages/android/internal/BUILD.gn b/components/messages/android/internal/BUILD.gn
index e4004e3..519ec57 100644
--- a/components/messages/android/internal/BUILD.gn
+++ b/components/messages/android/internal/BUILD.gn
@@ -42,6 +42,7 @@
     "//third_party/androidx:androidx_swiperefreshlayout_swiperefreshlayout_java",
     "//ui/accessibility:ax_base_java",
     "//ui/android:ui_full_java",
+    "//ui/android:ui_utils_java",
     "//url:gurl_java",
   ]
 }
diff --git a/components/messages/android/internal/java/src/org/chromium/components/messages/MessageBannerCoordinator.java b/components/messages/android/internal/java/src/org/chromium/components/messages/MessageBannerCoordinator.java
index b5d9b4e..5ee7665 100644
--- a/components/messages/android/internal/java/src/org/chromium/components/messages/MessageBannerCoordinator.java
+++ b/components/messages/android/internal/java/src/org/chromium/components/messages/MessageBannerCoordinator.java
@@ -16,6 +16,7 @@
 import org.chromium.build.annotations.NullMarked;
 import org.chromium.build.annotations.Nullable;
 import org.chromium.components.messages.MessageStateHandler.Position;
+import org.chromium.ui.UiUtils;
 import org.chromium.ui.accessibility.AccessibilityState;
 import org.chromium.ui.listmenu.ListMenuHost.PopupMenuShownListener;
 import org.chromium.ui.modelutil.PropertyModel;
@@ -83,6 +84,8 @@
         view.setSwipeHandler(mMediator);
         view.setPopupMenuShownListener(
                 createPopupMenuShownListener(mTimer, mAutodismissDurationMs.get(), mOnTimeUp));
+
+        UiUtils.disableLigaturesForSecurity(view);
     }
 
     /**
Loading diff…

Original Bug Report

reported by [email protected]

Security: Download UI and address bar spoof with Google Sans font ligatures (similar to issue 391788835)

SUMMARY

Similar to issue 391788835, the Google Sans font ligatures can be used to spoof origin in Download UI after download (“File downloaded” banner + Downloads page). If download URL is opened in a new tab, the spoofed origin is also shown in the address bar during confirmation prompts.

VULNERABILITY DETAILS

Affected UIs:

  • Download banners (such as the “File downloaded” confirmation message)
  • Download page
  • Address bar, if download URL is opened in new tab and prompts are shown (such as “Download file again?” prompts)

VERSION

Verified repro on these versions:

Chrome version: 136.0.7103.87 Stable, 137.0.7151.23 Beta, 138.0.7178.0 Dev, 138.0.7180.0 Canary

Operating System: Android 14, Android 15

REPRODUCTION CASE

Setup: Make your Android device resolve googlelogoligature.com to your malicious server that hosts a downloadable file. In my case, my router let me override DNS entries so it’s easy to test on physical device. For emulated devices, not sure if host’s DNS resolution would affect the emulated devices.

Note: For this PoC, we use HTTP instead of HTTPS because we didn’t set up a cert for googlelogoligature.com or any of the other spoofs. This also causes the “File can’t be downloaded securely” prompt. An attacker can get a valid cert for the actual domain, so these are limitations that exist only in this PoC, not real attacks.

Note: download.zip on my server is a benign file with only the string “empty”.

Scenario 1: Download in same tab (_self)

  1. Navigate to http://plain.text.aogarantiza.com/chromium/ligatures-download.html
  2. Wait a few moments (will trigger download for http://googlelogoligature.com/download.zip).
  3. (For this PoC, click “Keep” in the “File can’t be downloaded securely” prompt.)
  4. Optional: Click a _self download link to trigger another download.

Observed: “File downloaded” banner and download page show spoofed origin (with font ligature).

Expected: “File downloaded” banner and Download page show actual origin.

Scenario 2: Download in new tab (_blank)

  1. Navigate to http://plain.text.aogarantiza.com/chromium/ligatures-download.html
  2. Click a _blank download link to trigger download in new tab.

Observed: While prompts are shown, address bar shows spoofed origin. After download, “File downloaded” banner and download page show spoofed origin (with font ligature).

Expected: While promtps are shown, address bar shows actual origin. After download, “File downloaded” banner and Download page show actual origin.

Credit Information

Reporter credit: Alesandro Ortiz https://AlesandroOrtiz.com

View on issue tracker
Links in the report
On This Page