Unicode Vulnerabilities Allow Phishing Domains to Bypass Chromium Security
AI-generated image · US National Wire
Researchers have identified specific characters that trick Chrome and Edge into displaying deceptive URLs as genuine Unicode instead of revealing their Punycode identity.
Security researchers Ian Muscat and Leanne Briffa of Have I Been Squatted have discovered that specific characters can be used to bypass the security checks in Chromium-based browsers, such as Google Chrome and Microsoft Edge, allowing attackers to impersonate popular websites, as first reported by The Register.
According to The Register, the researchers identified two specific characters that act as "breakers" to fool browser display logic: the Cyrillic letter ө (used in languages including Tatar, Mongolian, and Kazakh) and the Latin K with hook, ƙ (used in Karai-karai and Hausa). These characters visually resemble the letters o/e and k, respectively. By using these glyphs, the researchers successfully registered 20 lookalike domains, including oƙta[.]com, niƙe[.]com, sрасөх[.]com, and aррӏө[.]com.
While these domains are represented as Punycode (e.g., xn--ota-f6a.com for oƙta[.]com) to ensure safety, the researchers found they could trick Chromium into displaying them in Unicode, making them appear identical to legitimate sites.
The vulnerability stems from failures in two primary defense layers. The first is the SafeToDisplayAsUnicode function, which runs seven sequential checks to detect spoofing. This system relies on a hardcoded list of known Cyrillic characters; however, it only triggers if every character in the string is on that list. Because characters like ө are not on the list as of Chrome 154 (released September 22), the check is bypassed.
The second defense, the GetSimilarTopDomain() function, compares a domain against a list of approximately 8,500 popular websites by creating a "skeleton" of the URL. The Latin ƙ bypasses this because it is added to the skeleton as a Latin k with a combining mark rather than a standard k. Similarly, the Cyrillic ө retains its bar in the skeleton, preventing it from matching the genuine Apple domain.
Additionally, the researchers found that Chromium's "Safety Tips" navigation warnings fail to trigger in these instances. These warnings only appear if a domain is a one-edit match, an exact-character match, or contains an adjacent swap. Because domains like aррӏө[.]com involve two or more changes, they do not trigger the alert.