Steps to Reproduce
- Open the URL: https://store.spoofing.google.com.name-containing-many-an-dash.comma.sbs/webapp.html
- Observe the address bar: the browser only renders the left portion of the long subdomain.
- The visible portion does not include the registrable domain (comma.sbs).
- Chrome highlights or ensures the eTLD+1 is visible, preventing spoofing.
Refer:
https://msrc.microsoft.com/report/vulnerability/VULN-146658/
https://chromium.googlesource.com/chromium/src/+/HEAD/docs/security/url_display_guidelines/url_display_guidelines.md#simplify
https://hackerone.com/reports/2501378
Description
Summary
The ZEN Browser incorrectly truncates long hostnames in the address bar and shows only the attacker-controlled prefix of the subdomain, hiding the actual registrable domain (eTLD+1). As a result, an attacker can craft extremely long malicious subdomains that visually imitate trusted brands, and the browser will display only the spoofed prefix, misleading users about the actual origin of the site. This directly compromises the URL bar as a security indicator and creates a phishing/supply-chain attack vector.
Expected Behavior:
The browser should always display the eTLD+1 (e.g., comma.sbs) regardless of how long the subdomain is.
Truncation should never hide the actual domain the user is connected to.
Chrome-style handling should be followed: ensure the domain is always visible or highlighted.
The address bar must not allow attacker-controlled prefixes to overshadow a legitimate domain.
Users should be able to reliably verify the website origin without scrolling.
Actual Behavior:
The browser truncates the URL from the right side, exposing only the attacker-controlled prefix of the subdomain.
The true registrable domain is hidden from view inside the collapsed portion.
Users see only the spoofed prefix and may assume the site is legitimate.
No highlighting or emphasis is given to the eTLD+1.
This creates a misleading and unsafe URL presentation.
Impact:
Enables realistic domain spoofing attacks by showing only the spoofed prefix that imitates trusted brands (e.g., apple-secure-login…).
Users cannot see the real domain (attacker.com), undermining the core purpose of the address bar.
High-risk phishing vector: credential theft, payment fraud, and session hijacking.
Attackers can deploy this using free hosting platforms like GitHub Pages or Vercel.
Directly breaks the trust boundary between user and browser making the browser appear to “confirm” a fake domain.
barathstalin6 Reporter
mr-cheffy Remediation developer
Steps to Reproduce
Refer:
https://msrc.microsoft.com/report/vulnerability/VULN-146658/
https://chromium.googlesource.com/chromium/src/+/HEAD/docs/security/url_display_guidelines/url_display_guidelines.md#simplify
https://hackerone.com/reports/2501378
Description
Summary
The ZEN Browser incorrectly truncates long hostnames in the address bar and shows only the attacker-controlled prefix of the subdomain, hiding the actual registrable domain (eTLD+1). As a result, an attacker can craft extremely long malicious subdomains that visually imitate trusted brands, and the browser will display only the spoofed prefix, misleading users about the actual origin of the site. This directly compromises the URL bar as a security indicator and creates a phishing/supply-chain attack vector.
Expected Behavior:
The browser should always display the eTLD+1 (e.g., comma.sbs) regardless of how long the subdomain is.
Truncation should never hide the actual domain the user is connected to.
Chrome-style handling should be followed: ensure the domain is always visible or highlighted.
The address bar must not allow attacker-controlled prefixes to overshadow a legitimate domain.
Users should be able to reliably verify the website origin without scrolling.
Actual Behavior:
The browser truncates the URL from the right side, exposing only the attacker-controlled prefix of the subdomain.
The true registrable domain is hidden from view inside the collapsed portion.
Users see only the spoofed prefix and may assume the site is legitimate.
No highlighting or emphasis is given to the eTLD+1.
This creates a misleading and unsafe URL presentation.
Impact:
Enables realistic domain spoofing attacks by showing only the spoofed prefix that imitates trusted brands (e.g., apple-secure-login…).
Users cannot see the real domain (attacker.com), undermining the core purpose of the address bar.
High-risk phishing vector: credential theft, payment fraud, and session hijacking.
Attackers can deploy this using free hosting platforms like GitHub Pages or Vercel.
Directly breaks the trust boundary between user and browser making the browser appear to “confirm” a fake domain.