Two characters open up a world of typosquatting opportunities in Chromium browsers
Attackers abusing rare Cyrillic and Latin letters to impersonate popular websites
Researchers have identified vulnerabilities in Chromium-based browsers that allow attackers to exploit non-ASCII characters for typosquatting, creating deceptive URLs that bypass security checks.
What happened
Security researchers discovered that specific non-ASCII characters in domain names can evade Chromium browsers' security checks, enabling typosquatting attacks. These characters, such as Cyrillic ө and Latin ƙ, appear similar to standard Latin letters but are not flagged by existing browser safeguards.
Why it matters
This vulnerability underscores the ongoing challenges in securing domain name systems against sophisticated phishing attacks, particularly for users relying on Chromium-based browsers. It emphasizes the need for updated security protocols to address Unicode-based spoofing techniques.
- Non-ASCII characters can be exploited to create deceptive URLs that bypass browser security checks.
- Users should verify domain names carefully, especially for critical services like banking or email.
- Browser developers must address gaps in Unicode and Punycode handling to prevent spoofing attacks.
- Organizations should proactively monitor for typosquatted domains resembling their official websites.
- Email clients and other software require consistent security checks for internationalized domain names.
The bigger picture
The vulnerability increases the risk of phishing attacks targeting users of Chromium browsers. Organizations must monitor domain registrations and update security practices to mitigate risks, while browser developers need to refine Unicode handling mechanisms.
The research highlights a critical security gap in Chromium browsers, demonstrating how non-ASCII characters can be weaponized for typosquatting. Addressing this requires updates to browser security protocols and heightened user awareness.
Technical details
- Characters like ө (Cyrillic o with breve) and ƙ (Latin k with hook) are visually indistinguishable from standard Latin letters (e.g., o, k).
- Chromium's 'SafeToDisplayAsUnicode' function fails when non-ASCII characters are not in a hardcoded list of homoglyphs.
- The 'GetSimilarTopDomain' function strips diacritics but does not account for non-ASCII characters like ƙ, allowing spoofed domains to pass checks.
- Punycode encoding is used to represent non-ASCII domains, but browsers often display them in Unicode, masking their true identity.
FAQ
What are typosquatted domains?
Typosquatted domains are fake websites designed to mimic legitimate ones by using similar-looking characters, often to steal user credentials or data.
How do attackers exploit non-ASCII characters?
Attackers use characters like ө and ƙ, which resemble Latin letters (o, k) but are not flagged by browser security checks, allowing them to create deceptive URLs.
Why do browsers fail to detect these domains?
Browsers like Chrome rely on hardcoded lists of homoglyphs and skeleton-based comparisons, which do not account for certain non-ASCII characters, enabling spoofed domains to pass checks.
This summary and analysis were generated with AI from the original article and may contain errors. Read the original for the full story.
Read the full story
Originally published by The Register on Oct 10, 2026.
Comments
Sign in to join the discussion.