Android Chrome Font Vulnerability: Spoofing Google Domains with Ligatures

Security researcher Jeffrey Yasskin discovered an Android Chrome font vulnerability: Attackers can register domains like "googlelogoligature.net" and exploit a ligature in Google Sans to make Chrome display it as "Google.net," potentially tricking users. This leverages how the font renders specific character combinations as a stylized Google logo. The vulnerability highlights the risks of custom fonts in security-sensitive contexts, especially when rendering attacker-controlled text.