Chromium IDN display flaws bypass Chrome phishing protections

Researchers Ian Muscat and Leanne Briffa from Have I Been Squatted published findings on October 3, 2026, detailing two edge cases in Chromium’s handling of internationalized domain names. Their work demonstrates how specific character combinations can bypass Unicode display safeguards and navigation warnings, allowing convincing lookalikes of trusted sites to appear without triggering standard protections.

Root cause

Chromium typically converts suspicious internationalized domain names into Punycode, an ASCII format starting with xn--, to prevent confusion. The browser’s first check, SafeToDisplayAsUnicode(), scans for prohibited characters and unsafe script mixes. A whole-script confusable check, added after a 2017 demonstration, blocks domains using only Cyrillic characters that resemble Latin ones. However, this rule is all-or-nothing. By substituting one character with a "breaker" like ө (U+04E9), which is allowed but not on the lookalike list, the domain аррӏө.com passes inspection.

Attack path

The second vulnerability involves the order of transformations in GetSimilarTopDomain(). This stage compares normalized hostname skeletons against 8,462 bundled domains. Chromium strips diacritics before applying confusable mappings. Characters with combining marks, such as ƙ in oƙta.com, retain those marks in the final skeleton. This prevents an exact match with okta.com, allowing the domain to bypass the second check. The researchers registered 20 proof-of-concept domains, including аррӏө.com, to demonstrate these techniques.

Affected versions

The researchers observed these issues in Chrome 154 on macOS. In this version, the Cyrillic lookalike of Apple was displayed in Unicode with a valid certificate. The findings highlight weaknesses in domain display and lookalike-detection controls within the Chromium engine. These specific edge cases do not demonstrate a bypass of all phishing-defense systems, but they expose gaps in the current Unicode rendering logic.

Mitigation

No fix has been confirmed yet for these specific IDN display edge cases. Users should remain cautious when visiting sites with unusual character compositions. Security teams should monitor for updates from the Chromium project regarding these Unicode handling flaws. Until a patch is available, relying on multiple layers of phishing detection is advisable.

What to do and how to stay safe: Chromium

• Verify the exact domain spelling in the address bar, paying close attention to non-Latin characters.
• Use bookmarked links for critical services rather than typing addresses or clicking links.
• Monitor browser updates for patches addressing internationalized domain name display issues.
• Educate users on identifying subtle visual differences in domain names, such as diacritics.

Step-by-step guide: DDoS Protection for Dedicated Server: Architecture and Mitigation

General security guidance from the Vector Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the main issue with Chromium's IDN handling?

Chromium's checks for internationalized domain names have edge cases where specific character combinations bypass Unicode display safeguards and lookalike detection.

Which domains were used as proof-of-concept?

The researchers registered domains like аррӏө.com and oƙta.com, which resemble apple.com and okta.com respectively, to demonstrate the bypass techniques.

Is there a patch available for this vulnerability?

No fix has been confirmed yet; the source material only reports the discovery and demonstration of the flaws in Chrome 154.