Researchers expose Unicode gaps in Chromium allowing convincing phishing lookalikes
Security experts found that specific Cyrillic characters bypass Chromium's display rules, enabling fake domains to appear as trusted brands without Punycode warnings.
Key points
- Ian Muscat and Leanne Briffa demonstrated how new Unicode characters bypass Chromium’s homograph detection.
- Chrome 154 displays these deceptive domains in readable Unicode rather than the safer Punycode format.
- The flaw stems from gaps in Chromium’s lookalike list and skeleton matching algorithms for mixed scripts.
Security researchers Ian Muscat and Leanne Briffa of Have I Been Squatted identified vulnerabilities in Chromium-based browsers that allow attackers to register convincing lookalike domains. Their findings, reported by Cyber Security News, reveal that specific Unicode characters can bypass standard security checks, causing phishing pages to appear legitimate to users.
The researchers registered twenty proof-of-concept domains to test Chromium’s display rules against internationalized domain names. One example, аррӏө[.]com, mimics apple[.]com using Cyrillic characters. In Chrome 154, this domain appeared in readable Unicode instead of the encoded Punycode form xn--80a6aa68c8d[.]com, which typically signals a potential security risk to users.
Context and Background
The Domain Name System originally supported only English letters, numbers, and hyphens, but internationalized domain names later allowed characters from many languages. Punycode converts these Unicode names into ASCII for DNS compatibility, using labels starting with "xn--." While this supports a global internet, it creates risks because letters from different scripts can look identical, a technique known as a homograph or homoglyph attack.
Chromium attempts to prevent these tricks by displaying suspicious IDNs as Punycode. Its rules check for mixed scripts, unsafe symbols, whole-script copies, and a comparison form called a skeleton. These checks rely on ideas from Unicode Technical Standard 39 and compare skeletons with popular domains. Chrome added a whole-script confusable check after the famous 2017 аррӏе[.]com test, which used Cyrillic letters resembling Latin ones.
The research found that Chromium’s rule works only when every character in a Cyrillic label appears on its lookalike list. The Cyrillic letter ө, used in Kazakh and Mongolian, is allowed but missing from that list. Replacing the final Cyrillic е with ө disables the whole check, even though the result still resembles apple[.]com to a human observer.
Who Is Affected
A second gap exists in skeleton matching. Chromium removes many accents before comparing names, but marks from letters with hooks or strokes can remain. Consequently, oƙta[.]com does not reduce to the same skeleton as okta[.]com. Similarly, the bar from ө prevents аррӏө[.]com from matching apple[.]com, allowing these deceptive domains to pass through undetected by the browser’s safety mechanisms.
These domains were registered for controlled testing and are not part of a real phishing campaign. However, the ability to create such convincing lookalikes poses a significant risk. Users may see a familiar brand name and no clear browser warning during normal web browsing, making it difficult to distinguish between legitimate sites and malicious impersonations.
What should you do?
No fix has been confirmed yet for these specific Unicode bypasses in Chromium. Security professionals should monitor vendor updates for patches addressing these homograph detection gaps. Until then, users should remain vigilant when entering sensitive information on websites, especially if the domain appears slightly unusual or contains non-Latin characters.
What to do and how to stay safe: Chromium
- Verify domain names carefully by checking the full URL for unexpected characters or scripts before entering credentials.
- Monitor security advisories from browser vendors for updates addressing Unicode and homograph detection vulnerabilities.
- Use multi-factor authentication to reduce the impact of potential credential theft from phishing sites.
- Train users to recognize suspicious domain patterns and report them to security teams immediately.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which browser versions are affected by this Unicode vulnerability?
The research specifically tested and demonstrated the issue in Chrome 154, where deceptive domains appeared in readable Unicode.
What is the Cyrillic letter ө used for in these attacks?
The letter ө is used in languages like Kazakh and Mongolian and is not on Chromium’s lookalike list, allowing it to bypass detection.
Are these domains currently being used in phishing campaigns?
No, the researchers registered the domains for controlled testing purposes only, and they are not part of a real phishing campaign.
