When the Internet Engineering Task Force (IETF) resolved to permit Unicode characters within domain names, the move was widely viewed as a commendable step toward linguistic inclusivity on the modern web. However, it also introduced substantial cybersecurity risks. Because hundreds of unique glyphs across different alphabets appear identical or nearly identical to standard Latin characters, deceptive actors have long sought to exploit these overlaps through typosquatting and homoglyph attacks.
In these campaigns, attackers establish functioning websites using deliberately deceptive web addresses that mimic legitimate brand names. Unsuspecting users who misspell a URL or click misleading search engine results can easily be routed to fraudulent destinations. While web browsers have established increasingly intricate defense mechanisms to identify and block these deceptive lookalikes, novel research reveals that specific edge cases continue to evade even the strictest automated filters.
The Limits of Chromium’s Defenses
Among existing desktop and mobile browsers, the Chromium engine—which forms the foundation of Google Chrome, Microsoft Edge, and Brave—features the most comprehensive rule set designed to catch mischievous domains. A past study from 2020 highlighted Chromium’s defensive lead, recording a 64.1 percent detection rate for domain lookalike attempts, outperforming competitors like Mozilla Firefox and Apple Safari.
To maintain security, Chromium enforces several layers of evaluation. Under ordinary circumstances, if an attacker attempts to mix an isolated non-Latin character into an otherwise standard Latin web address, the browser automatically flags the inconsistency. Rather than presenting the deceptive visual rendering, Chromium falls back to displaying the domain in its raw Punycode representation. Under this mechanism, inserting a Cyrillic character into an address such as “apple.com” converts the displayed address to an explicit Punycode string, such as “xn--pple-43d.com”.
Furthermore, domain names ending in popular generic top-level domains like .com that incorporate non-Latin characters generally pass verification only if every character in the string originates from the same script. In addition, Chromium retains a specific blacklist of 29 Cyrillic characters known to routinely mimic Latin letters, including equivalents for characters like “a”, “e”, “o”, “p”, and “c”. An address assembled solely from entries on this 29-character list is barred from displaying as pure text.
How Edge Cases Slip Through
Despite these overlapping defenses, detailed findings published by Have I Been Squatted (HIBS) demonstrate that specific permutations of characters can still slip through browser barriers. Using an impersonation attempt targeting “apple.com” as a test case, researchers illustrated how a domain spelled using Cyrillic characters could successfully load without triggering a Punycode conversion or browser warning.
The bypass succeeds because the trailing character used in the demonstration, a Cyrillic character configured as an oval intersected by a horizontal line, is omitted from Chromium’s designated 29-character list. Because the domain avoided mixing scripts and utilized a character absent from the targeted restriction index, Chromium treated the string as a valid native script address rather than a spoofing attempt. While developers are expected to update the engine to include this specific glyph in future releases, the finding illustrates the perpetual game of catch-up required to secure internationalized domain names.
Scale and Mitigation Challenges
Detecting homoglyphs remains an immense cataloging challenge. The Unicode standard continues to expand and currently encompasses nearly 173,000 distinct entries. Although only a subset of those characters can legally be registered as top-level domains or domain names in practice, the sheer volume provides bad actors with ample opportunity to search for overlooked corner cases.
Chromium already expends significant resources monitoring high-risk targets. The platform maintains a registry of more than 8,000 popular domains identified as prime targets for typosquatting, subjecting 836 of them to even stricter verification protocols. Top-level domain registries also attempt to regulate which character sets are permissible across specific extensions, yet these combined restrictions have proven insufficient to eliminate all attack surfaces.
Because software detection cannot guarantee absolute protection against homoglyph spoofing, researchers at HIBS emphasize structural mitigations. Organizations concerned about impersonation are advised to proactively purchase lookalike domains before attackers can claim them. Additionally, security experts strongly advocate for the wider adoption of passkey authentication. Because cryptographic passkeys are strictly tied to specific, authenticated root domains, users navigating to deceptive spoof sites are inherently prevented from submitting credentials, neutralizing one of the primary threats posed by typosquatting.
