Researchers say two Unicode characters can make fake web addresses appear legitimate in Chromium-based browsers such as Chrome and Edge. Have I Been Squatted showed that the Cyrillic character ө and the Latin character ƙ can bypass Chromium’s Unicode safety and similar-domain checks in Chrome 154, letting registered typo domains such as lookalikes for Apple, SpaceX, Okta, and Nike render in deceptive form instead of safer Punycode.
Why it matters: This increases the risk of convincing phishing links that appear to be trusted brands in major browsers many people use every day. Organizations and users should be cautious with login links, and browser defenders should watch for vendor fixes or mitigations to Chromium’s domain-display logic.
2026.10.10
100% relevant
This article establishes a distinct browser-security and phishing story centered on a newly reported Chromium homoglyph display bypass, not a continuation of any listed tracked event.
← Back to all stories