When is an address bar not an address bar? When it's a fake.
https://nakedsecurity.sophos.com/2019/04/30/researcher-discovers-inception-attack-on-chrome-mobile/