Address Bar Spoofing Flaw Discovered

SummaryAn Address Bar Spoofing vulnerability has been discovered in Aloha Browser for Android. When a website switches to fullscreen mode, the browser's genuine address bar becomes entirely hidden, with no persistent fullscreen notification or trusted visual indicator to alert users. This allows an attacker to display a counterfeit address bar showing a legitimate domain, such as google.com, while the actual page is served from a malicious origin.

This issue aligns with the security risk highlighted by the Chromium team in its official which explains that fullscreen websites can control the entire visible screen, making it difficult for users to determine whether they are in fullscreen mode.
https://chromium.googlesource.com/chromium/src/+/main/docs/security/fullscreen.md/geometry dash

Although Aloha Browser is built on Chromium, it appears not to implement the fullscreen security safeguards emphasized by the Chromium team, including persistent fullscreen notifications and trusted browser UI indicators for security-sensitive situations.