Jonathan Kew

The issue is related to memory safety bugs and buffer copying without checking the size of input data, which could potentially be exploited to run arbitrary code. This may lead to memory corruption.

The issue concerns an incorrect security UI in the Omnibox, which is the URL bar in Google Chrome. This allowed a remote attacker to spoof the contents of the Omnibox via a crafted HTML page. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited.

The issue allows for domain spoofing attacks by exploiting the display of combined characters in the address bar. Specifically, the dotless version of the letter 'i' followed by an accent can be used to spoof the combined, single character version of the letter 'i' with the same accent in Unicode, such as acute or grave. This is possible because most font sets do not display these combined domain names as punycode. The vulnerability can be exploited by a remote attacker to conduct spoofing attacks.