🔓 Google Sans Ligature Spoofing

Proof of Concept Suite - Critical Unfixed Surfaces

⚠️ SECURITY RESEARCH ONLY

This PoC suite is for authorized security research and testing only. Do not use against real users or systems you don't own. Report findings responsibly to Chromium security team.

About This Vulnerability

CVE Status: Partially fixed (CL 7536052)

Fix Coverage: ~23% (permission prompts only)

Unfixed Surfaces: 27+ UI surfaces remain vulnerable

Severity: CRITICAL (S2) - Credential theft, financial fraud, identity theft


What's the issue?

The Google Sans font contains special ligatures that render strings like "googlelogoligature" as the Google logo. When these strings appear in domain names, Chrome displays them as the logo in various UI surfaces, allowing attackers to spoof Google's origin.


What was fixed?

CL 7536052 disabled ligatures in permission prompts (camera, microphone, location, etc.) on Android.


What remains vulnerable?

The 7 critical surfaces demonstrated in this PoC suite, plus 20+ other surfaces.

7
Critical PoCs
27+
Unfixed Surfaces
~2B
Affected Users
23%
Fix Coverage

Select a Proof of Concept:

CRITICAL
🔑

PoC #1: Password Manager

Demonstrates ligature spoofing in Chrome's password save prompt, autofill suggestions, and password settings page.

Impact: Credential theft, password database poisoning
CRITICAL
💳

PoC #2: Payment Request API

Demonstrates ligature spoofing in Chrome's Payment Request UI and secure payment confirmation dialogs.

Impact: Financial fraud, credit card theft
CRITICAL
🔐

PoC #3: FedCM

Demonstrates ligature spoofing in Chrome's Federated Credential Management (FedCM) login prompts.

Impact: OAuth token theft, full account compromise
CRITICAL
📁

PoC #4: File System Access

Demonstrates ligature spoofing in Chrome's File System Access API file and directory pickers.

Impact: Local file access, data exfiltration
CRITICAL
🪪

PoC #5: Digital Credentials

Demonstrates ligature spoofing in Chrome's Digital Credentials API for government-issued IDs.

Impact: Identity theft, document fraud
CRITICAL
📋

PoC #6: Clipboard API

Demonstrates ligature spoofing in clipboard settings and clipboard swap attacks for crypto addresses.

Impact: Data theft, crypto address swap
CRITICAL
📱

PoC #7: SMS Fetcher (WebOTP)

Demonstrates ligature spoofing in Chrome's WebOTP API for SMS verification code auto-fill.

Impact: 2FA bypass, account takeover

Testing Instructions

  1. Ensure DNS is configured to point googlelogoligature.com to this server
  2. Accept HTTPS certificate warning (if using self-signed cert)
  3. Click on any PoC card above to test that surface
  4. Follow the on-page instructions for each PoC
  5. Take screenshots of the spoofed origin display
  6. Check browser console for detailed logging
  7. Review captured data in the yellow boxes on each page

What to look for:

Reporting

After testing, report findings to:

PoC Suite v1.0 | Created for security research | May 14, 2026

Based on Chromium Issue #1 and related vulnerabilities