Chrome typosquatting has a new wrinkle. Security researchers Ian Muscat and Leanne Briffa have shown that two uncommon Unicode characters can help lookalike domains pass Chromium’s display checks and appear far more convincing than their underlying domain names suggest.
The research matters because “check the address bar” is still common phishing advice. That advice remains useful, but it is no longer enough on its own when a browser can display a deceptive internationalised domain name in readable Unicode instead of the more obvious Punycode form.
How the new Chrome typosquatting technique works
The research focuses on internationalised domain names, or IDNs. These allow domain names to use characters from writing systems beyond basic ASCII. That is essential for a multilingual internet, but it also creates opportunities for homograph attacks in which one character closely resembles another.
Have I Been Squatted demonstrated two characters of particular interest: the Cyrillic barred o, ө, and the Latin k with hook, ƙ. They used them in proof-of-concept domains designed to resemble brands such as Apple, Okta and Nike.
The researchers registered 20 test domains and analysed Chromium’s decision process for displaying IDNs. Their write-up describes two relevant layers: SafeToDisplayAsUnicode(), which checks individual labels, and GetSimilarTopDomain(), which compares a simplified “skeleton” of a hostname with a bundled list of popular domains.
Why Chromium’s lookalike-domain checks can miss them
The first layer contains protections against known confusable characters. The researchers found that some characters can act as “breakers” because they are not handled in the same way as the rest of a lookalike string. That can allow a domain to pass the Unicode display check instead of being converted to Punycode.
The second layer compares the domain against a list of popular sites. Here, characters such as ƙ can produce a skeleton that does not exactly match the expected brand name. The result is a domain that remains technically different while still looking plausible to a person scanning the address bar.
The Register independently reviewed the research on 10 October and confirmed that the demonstrated domains could bypass Chromium’s main display protections. Its report also notes limits in navigation-time warnings: some checks depend on edit distance, domain length or whether the target is already recognised as a popular or frequently visited site.
What this means for Chrome and Edge users
This is not evidence that attackers control Apple, Okta, Nike or any other imitated brand. The attacker must register a separate domain and persuade the victim to open it. The risk is therefore primarily IDN spoofing, phishing and brand impersonation.
A valid HTTPS certificate does not solve that problem. HTTPS confirms that the browser has an encrypted connection to the domain it actually reached. It does not confirm that the domain belongs to the company a user thinks they are visiting.
The research does not establish widespread active exploitation of these exact domains. The 20 domains used in the study are controlled demonstrations. That distinction matters: the technique is credible and reproducible, but it should not be presented as proof of a mass campaign.
Why it matters for small businesses
Small companies often rely on cloud services for email, banking, identity, collaboration and website administration. A convincing lookalike login page can therefore lead to credential theft even when the business itself has not suffered a website compromise.
The same issue affects customer trust. A company can secure its own website perfectly and still have its brand imitated through another registered domain. Businesses with recognisable names should treat suspiciously similar domains, unexpected login links and email sender domains as part of the same security problem.
For developer teams, this is also a reminder that browser protections are defence-in-depth rather than a guarantee. Repository and credential controls still matter. Nevelit has previously covered GitHub secret scanning and newer secret detectors, which address a different stage of the same broader risk: limiting the damage when credentials are exposed.
Practical checks for staff and website owners
- Use password managers: they are less likely than a person to autofill credentials on a visually similar but different domain.
- Prefer bookmarks for critical services: banking, identity providers and administration portals are safer to open from known saved URLs than from unsolicited messages.
- Verify unexpected login requests: if an email says an account requires urgent action, navigate to the service independently rather than following the link.
- Enable phishing-resistant MFA where available: passkeys and hardware-backed authentication reduce the value of stolen passwords.
- Monitor lookalike domains: organisations with valuable brands can use domain-monitoring services to identify registrations that resemble their names.
- Train beyond “look for the padlock”: an encrypted phishing site can still be a phishing site.
Limitations and trade-offs
Browsers cannot simply display every internationalised domain as Punycode without harming legitimate non-English users. Unicode domain names exist for a valid reason, and aggressive blocking would create accessibility and localisation problems.
That leaves vendors balancing usability against spoofing resistance. Hardcoded confusable-character lists and popular-domain comparisons can reduce risk, but the research shows that edge cases remain. A defensive rule that catches every unusual character would also generate many false positives.
The practical response is therefore layered: browser checks, password managers, authentication controls, user training and domain monitoring should reinforce one another.
Critical analysis
The strongest part of this research is not the visual shock of a fake brand name. It is the technical explanation of why the browser accepts the Unicode form. The researchers document the exact checks involved and provide working proof-of-concept domains, while independent reporting confirms the behaviour in current Chromium-based browsers.
At the same time, the finding should not be exaggerated into “the address bar is useless”. Most phishing domains are less sophisticated, browser warnings still catch many lookalikes, and successful abuse still requires delivery of the malicious link. The lesson is narrower: visual inspection alone is an incomplete authentication method.
For businesses, the most durable control is to reduce the importance of human character-by-character judgement. Password managers, passkeys, verified bookmarks and monitored identity systems are harder for a lookalike domain to defeat than a quick glance at the URL.
Leave a Reply