Researchers Find IDN Flaws Bypassing Chrome Phishing Safeguards

Two edge cases in internationalized domain name handling allow Cyrillic-Latin lookalikes to evade Chromium’s display and navigation warnings.

Threat Times Intrusion DeskOctober 13, 20261 min read

Share LinkedIn Reddit

Illustration: A sleek silver laptop sits on a clean white desk. — AI-generated illustration: Threat Times

Key points

Researchers Ian Muscat and Leanne Briffa identified two IDN edge cases bypassing Chromium protections.
The flaws allow domains like аррӏө.com to display in Unicode instead of Punycode.
Findings published on October 3, 2026, show how character mixing evades script checks.

Security researchers Ian Muscat and Leanne Briffa published findings on October 3, 2026, detailing two internationalized domain name edge cases that bypass Chromium’s phishing protections. Their work demonstrates how specific character combinations can create trusted domain lookalikes without triggering standard safety warnings.

According to GBHackers, the researchers registered twenty proof-of-concept domains to illustrate the issue. These include аррӏө.com, which visually resembles apple.com, and oƙta.com, mimicking okta.com. In Chrome 154 on macOS, the Apple lookalike displayed in Unicode with a valid certificate, raising concerns about lookalike-detection controls.

How the Bypass Works

Chromium typically converts suspicious IDNs into Punycode, an ASCII format starting with xn--. Its first inspection stage, SafeToDisplayAsUnicode(), checks for prohibited characters and unsafe script mixes. A whole-script confusable check was added after Xudong Zheng’s 2017 demonstration of an all-Cyrillic apple.com lookalike.

The rule operates on an all-or-nothing basis. By replacing the final Cyrillic е with ө (U+04E9), the domain аррӏө.com passes checks. Although ө is allowed, it is not on the lookalike list. The researchers call such characters “breakers.” Other eligible breakers include ү and ї, though success depends on remaining characters and subsequent checks.

Skeleton Matching Flaws

Chromium’s second stage, GetSimilarTopDomain(), compares normalized hostname skeletons against 8,462 bundled domains. Exact matches force a switch to Punycode display. However, the weakness lies in the order of transformations. Chromium strips diacritics before applying confusable mappings.

Characters with combining marks during later mapping retain those marks in final skeletons. Consequently, the ƙ in oƙta.com becomes a Latin k followed by a combining mark. This prevents an exact match with okta.com, allowing the domain to bypass the protection. Mixing ordinary Latin letters with Cyrillic usually fails earlier script-mixing inspections.

What should you do?

These findings highlight limitations in current browser-based domain display safeguards. While the research does not demonstrate a bypass of all phishing-defense systems, it shows that visual inspection alone may be insufficient. Organizations should monitor for new domain registration patterns that exploit these specific character combinations.

What to do and how to stay safe: Chromium

Verify domain legitimacy by manually typing known URLs or using bookmarks rather than clicking links in emails or messages.
Monitor browser updates for patches addressing internationalized domain name handling and Unicode display logic.
Train users to recognize subtle character differences in domain names, especially when Cyrillic and Latin scripts are mixed.
Implement additional DNS-layer filtering or threat intelligence feeds that flag known lookalike domains and suspicious IDN patterns.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.