VULNERABILITY DETAILS
We have found a bug with a certificate status indication in the Google Chrome.

We historically have 2 sites

1. кц.рф with the multi-domain non-EV SSL certificate valid for the names listed below:

cctld.ru
www.cctld.ru
xn--j1ay.xn--p1ai
www.xn--j1ay.xn--p1ai
mxs.cctld.ru

The кц.рф domain is redirected to the cctld.ru domain.

2. cctld.ru with the EV SSL certificate valid for the names listed below:

cctld.ru
mail.cctld.ru
tickets.cctld.ru

If we enter the anonymous mode of the browser and go to the url https://кц.рф, we get a redirection to the site cctld.ru with the non-EV certificate. If we go to the URL http://cctld.ru , redirection to the site cctld.ru with the EV certificate. The certificate we see for the cctld.ru site depends on the order of the operations. 

We think that the bug we found may have security implications. 

Sincerely yours,

Vladimir Grishchenko,
Igor Lidin,
Dmitry Belyavskiy


VERSION
Chrome Version: 50.0.2661.75 m stable
Operating System: Windows 7 SP1

REPRODUCTION CASE
If we enter the anonymous mode of the browser and go to the url https://кц.рф, we get a redirection to the site cctld.ru with the non-EV certificate. If we go to the URL http://cctld.ru , redirection to the site cctld.ru with the EV certificate. The certificate we see for the cctld.ru site depends on the order of the operations.