Researchers say two characters still available to typosquatters can trick Chromium browsers into presenting lookalike URLs as genuine web addresses.
The characters in play
Ian Muscat and Leanne Briffa of Have I Been Squatted found two glyphs that bypass the safety checks in Chrome and Edge. One is the Cyrillic letter oe, used in languages such as Kazakh, Mongolian and Tatar. The other is the Latin K with hook, used in Hausa and Karai-karai.
Both look almost identical to ordinary Latin letters. Using them, the researchers registered 20 lookalike domain names. Examples include a spoof of AppLovin, a fake S-p-a-x-o-x style name, and imitations of Oxta and Nike. In Punycode, the form browsers should display safely, the underlying addresses are clearly foreign: prefixes like xn--80a6aa68c8d.com and xn--ota-f6a.com.
Why browsers miss it
The glyphs survive into the address bar looking like the real thing, so a careful user reading the URL can still be fooled. The researchers set up safe demo pages on the domains that explain how each one slips past Chromium’s protections.
What defenders should do
Do not rely on a glance at the address bar. Use a password manager so credentials only autofill on the exact registered domain, keep browser updates current, and watch for homograph warnings in mail gateways. Security teams can monitor certificate transparency logs for new domains mixing non-ASCII glyphs with familiar brand names, and register the obvious lookalikes for their own brands before attackers do.
