# CVE-2026-14077: Select Your Own Origin - Spoofing Chrome's Address Bar

A native <select> anchored above the viewport let its picker popup escape into Chrome's toolbar, enabling a fake omnibox and one-click spoofed download.

- Payout: Research
- Severity: medium
- Program: Google Chrome
- Credited: PWNAI Research
- Disclosed: 2026-07-20
- CVE: CVE-2026-14077
- Write-up quality: 8/10
- Original: https://pwn.ai/blog/select-your-own-origin-spoofing-chrome-s-address-bar-with-native-ui
- Library page: https://bugbountylibrary.com/r/blog%3Apwn-ai-blog-select-your-own-origin-spoofing-chrome-s-address-bar-with-native-ui
- Tags: domain:browser impact:integrity kind:research platform:research sev:medium tech:chromium technique:chained technique:source-review vuln:clickjacking vuln:info-disclosure vuln:misconfiguration

**Target:** Chrome native select picker / browser UI (omnibox)
**Root cause:** The renderer-supplied select rectangle was passed to the external picker UI without intersecting it against the visual viewport, so a select starting above the viewport but tall enough to intersect it produced a popup anchored into browser chrome.
**Steps:**
1. Create a `<select>` with `top: -35px`, `height: 10000px`, `width: 1580px` so `select.top < viewport.top < select.bottom` passes the visibility check
2. Open the picker via `showPicker()` under a live user activation; on macOS the popup follows the negative anchor into the toolbar
3. Style the picker with `appearance: base-select` and `::picker(select)` using `position-anchor`, negative `margin-top`, transparent background, no border/shadow to remove native tells
4. Place a fake omnibox inside the option: SVG tune icon, `accounts.google.com` in primary color, `/download/chrome` dimmed, calibrated typography for light/dark
5. Set `selectedIndex = -1` and pad with leading spaces to suppress the checkmark gutter
6. On the same click: `history.replaceState()` to a Google-shaped URL, create hidden iframe with `Content-Disposition: attachment` to force download, open picker, then busy-loop the renderer 8.5s to freeze the painted popup
7. Redirect to real google.com after the hold to close the story
**How found:** Broad objective to find a browser-boundary/privacy bug; agent explored native UI surfaces, noticed native select popups are handed to an external UI surface that can't be clipped to the element box, and probed the inside/outside viewport boundary state.
**Exploitation:** One user click on a 'Continue' button triggers replaceState, a forced attachment download, showPicker() while activation is live, and a renderer freeze holding the spoofed omnibox on screen; victim sees a Google-branded download prompt and executes the downloaded file, believing it came from accounts.google.com.
**Escalation:** Extended demo downloads ChromeSetup.sh which opens Calculator when manually run; not drive-by RCE, but subverts the origin decision before execution.
**Insight:** Native widgets whose popups are rendered by the browser/OS outside the page (select pickers, date pickers, context menus) trust renderer-supplied geometry; test partially-offscreen elements that still intersect the viewport, since visibility checks often only test intersection while the anchor math uses the raw negative coordinate.