Chromium lookalike-domain checks bypassed with two characters: Cyrillic ө and Latin hooked ƙ let names like аррӏө.com and oƙta.com show in Unicode in Chrome 154 with no warning; Gmail displays IDN senders in Unicode
Have I Been Squatted researchers Ian Muscat and Leanne Briffa published research on 3 October 2026 showing two edge cases in the internationalised domain name (IDN) spoofing checks used by Chromium-based browsers such as Chrome and Edge. First, Chromium's whole-script confusable check only shows the encoded Punycode form when every character in a single-script Cyrillic label is on its list of Latin lookalikes; Cyrillic ө (a Kazakh, Mongolian and Tatar letter) is not on the list, so аррӏө.com, a lookalike of apple.com that Verisign's .com Cyrillic table allows to be registered, displays in Unicode. Other 'breaker' characters such as ү also work. Second, the top-domain comparison reduces names to a 'skeleton', but a hooked letter such as ƙ, and the bar on ө, survive as combining marks, so oƙta.com does not reduce to okta.com and no match is found. Chromium's navigation-time Safety Tips only fire for matches within one edit and for targets of five or more characters, so short brands such as Okta, Nike, Sky and VK get no near-match protection. The researchers registered 20 lookalike domains (including Cyrillic versions of openai.com, skype.com, sharepoint.com, shell.com and kaspersky.com) and say all showed in Unicode in the Chrome 154 address bar with valid certificates. They found 161,894 lookalike pairs among 733,509 IDNs in the .com zone, which are possible imitations, not confirmed typosquats. In webmail tests Gmail showed all 20 IDN sender domains in Unicode, while Outlook Web showed all of them as Punycode, even harmless ones. Chromium added one more Cyrillic character (м) to its list on 11 September, after Chrome 155 branched; earlier, Chrome 148 closed the ҏ and ӿ breakers. No CVE or Google fix for ө or ƙ has been announced, and no in-the-wild abuse is reported in the research. Wire: The Register (10 Oct).
- Product
- Chromium-based browsers (Google Chrome, Microsoft Edge and others) IDN display checks; Gmail sender display
- Versions
- Chrome 154 tested by researchers; Chrome 155 still ships the 28-character Cyrillic list; no fixed version announced
- CVSS
- not assigned
- Exploited in Australia?
- unknown
- Patch to
- No browser fix announced. Register lookalike spellings of your domains that use ө, ү or hooked letters such as ƙ (especially brands of four characters or fewer); monitor new xn-- registrations within two edits of your domains; turn on the mail gateway's lookalike/impersonation protection, tag inbound mail from xn-- sender domains and keep external-sender banners; use phishing-resistant MFA (FIDO2/passkeys), which will not answer on a lookalike domain; log, banner or block xn-- names in DNS and proxy logs outside an allowlist.
Primary: Have I Been Squatted — Turning IDN edge cases into typosquats (3 Oct 2026) · Vendor: Chromium source — IDN spoof checker (idn_spoof_checker.cc) · The Register — Two characters open up a world of typosquatting opportunities in Chromium browsers (10 Oct 2026)