Google Chrome Browser UI Spoofing Vulnerability in Omnibox on Android

A vulnerability in the Browser UI of Google Chrome on Android, affecting versions prior to 133.0.6943.98, allowed remote attackers to spoof the contents of the Omnibox (URL bar) through a crafted HTML page. This issue arose from the improper handling of ligatures in the Google logo, which could disguise security-sensitive elements by rendering them as part of the logo.

Impact

Exploitation of this vulnerability could lead to misleading representations in the Omnibox, potentially allowing attackers to spoof URLs in a way that could deceive users.

Reproduction

The vulnerability can be reproduced by using a version of Google Chrome on Android prior to 133.0.6943.98. When a crafted HTML page is loaded, the Omnibox can be manipulated to display spoofed content, such as a distorted version of a legitimate URL.

Remediation

Users can update to Google Chrome version 133.0.6943.98 or later to address this vulnerability.