Researchers Discover New Domain Spoofing Techniques That Bypass Chrome’s Phishing Protections
Researchers showed IDN lookalike domains can evade Chrome’s Unicode display and near-match phishing warnings.
Have I Been Squatted researchers Ian Muscat and Leanne Briffa found two internationalized-domain edge cases that evade Chromium’s Unicode display checks and some navigation warnings. Using “breaker” characters omitted from the lookalike list, and a diacritic-stripping order that prevents exact skeleton matches, they registered 20 proof-of-concept domains resembling brands such as Apple and Okta. In Chrome 154 on macOS, a Cyrillic Apple lookalike rendered in Unicode with a valid certificate and without a lookalike warning. The tests did not cover reputation, allowlists, or redirects, so this is not a universal phishing bypass.
- Certain allowed Cyrillic characters bypass Chromium's whole-script confusable block.
- Skeleton comparison strips diacritics before confusable mapping, missing exact matches.
- Near-match warnings skip short domains and distances beyond one edit.
- Chrome 154 on macOS displayed a Unicode Apple lookalike with a valid certificate.
- Gmail showed Unicode IDN senders; Outlook Web showed Punycode labels.
- Organizations
- Have I Been SquattedAppleOkta
From the original article
3 min read at gbhackers.com
Researchers identified two edge cases involving internationalized domain names (IDNs) that bypass Unicode display safeguards and certain navigation warnings in Chromium. Published on October 3, 2026, their research demonstrates how carefully selected Cyrillic and Latin characters can create convincing lookalikes of trusted domains without triggering these protections.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.