Thanks for your report.

This might be navigation bug, but certainly not a security bug, since the correct URL is displayed before the user gets to interact with the page.

This has same characteristics as an open redirector which we normally do not see as security vulnerabilities.

https://sites.google.com/site/bughunteruniversity/nonvuln/open-redirect

Does this only happen for e.g. microsoft.com - or for any URL?

Hi,
This bug can lead to very security issue, On Desktop Google Chrome if you
type same URL, it will alert you with pop up. But Mobile Browser will not
alert you with any pop up. Imagin if an attacker use Browser Exploit and he
want to redirect user to his own website/server. Then End user can
compromised because most of the end user just foucs on start of the url.
e.g. https://google.com but next url they ignored it. And by using this
technique you can use any website. Such as Google, Apple, Microsoft,
Facebook. And this vulnerability exist in Browser not in website.

eugenebut@ FYI

wfh@, why do you think this is navigation bug? Chrome correctly loaded website with the right domain, and shown correct URL in the omnibox. Maybe I'm missing something?

Hi,
Yes Chrome correctly loaded website with right domain. But What about open
redirection attack? Mobile Chrome browser did not alert you that you are
going to another website, but its only alert you on Desktop PC. Before
clicking on the link we see that its starting from https://www.microsoft.com
but the next parameter will redirect you to malicious.com. And victim can
be compromised if attack hosted any malware on his website.
Here is example below.
https://www.microsoft.com&@
maliciousdomain.com#/enus/education/products/teams/default.aspx

If i copy same URL and paste to Google Chrome Desktop browser it will alert
with popup. But if you paste to mobile chrome browser you can easily
redirected to malicious.com

Thank you,
Best regards,
Arslan Arshad

Reference:
https://www.owasp.org/index.php/Unvalidated_Redirects_and_Forwards_Cheat_Sheet

wfh@, what behavior do you expect from Chrome for iOS here?