# Unicode Homoglyph IDN Lookalike Domains Bypass Chromium Detection for Phishing

> Have I Been Squatted researchers showed that Cyrillic characters missing from Chromium's confusables list (e.g. ө U+04E9) and skeleton-matching weaknesses with hook/stroke characters (e.g. ƙ) allow registrable lookalike IDNs that Chrome 154 renders in Unicode rather than Punycode. This is proof-of-concept research; no in-the-wild campaign, CVE or threat actor is identified.

- **Published:** 2026-10-12T12:08:20Z
- **Last reviewed:** 2026-10-12T12:08:20Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3351
- **ID:** TL-2026-3351
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** TRACKING
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Ian Muscat and Leanne Briffa of Have I Been Squatted published research (blog dated 2026-10-03, covered by Cyber Security News on 2026-10-12) on how internationalized domain name (IDN) homograph protections in Chromium can be bypassed. Chromium decides whether to show a label in Unicode or Punycode (xn--) using whole-script confusable checks derived from Unicode Technical Standard 39 (UTS #39). The Cyrillic whole-script check is all-or-nothing: if even one Cyrillic character in a label is not on Chromium's list of Latin lookalikes, the label is not rejected. The researchers identified Cyrillic 'breakers' absent from the list - ө (U+04E9, resembles o/e), ү (U+04AF, resembles y) and ї (U+0457, resembles i) - which were allowed in Chrome 148+ testing, whereas ҏ (U+048F) and ӿ (U+04FF) were rejected in Chrome 148+ (Unicode 17).

A second weakness concerns skeleton matching against Chromium's bundled top-domain list. Characters such as Latin ƙ (k with hook) and Cyrillic ө (o with bar) are single code points; when diacritics are stripped during skeleton generation, hooks and strokes persist as combining marks, so the skeleton does not exactly equal the target's skeleton (e.g. oƙta.com ends up one edit away from okta.com rather than matching). Navigation warnings do not trigger for labels that are 2+ edits away or for short names (under 5 characters before the TLD). The resulting chain: display check stage 1 passes because of the breaker character, stage 2 skeleton comparison fails to match, and navigation warnings do not fire.

The researchers registered 20 proof-of-concept domains impersonating brands including Apple (аррӏө.com, xn--80a6aa68c8d.com), OpenAI, Skype, Shell, Xerox, Opera, Chess.com, Kaspersky, LexisNexis, Nexon, One.com, Paychex, Okta (oƙta.com), Nike, Sky, VK and Kickstarter; the news article additionally names SharePoint, Pinterest and SpaceX. Chrome 154 displayed the Unicode form. In email, Gmail Web displayed all 20 test sender domains in Unicode while Outlook Web displayed A-labels (Punycode) for all. Chrome 155+ added the Cyrillic character м to the lookalike list on 2026-09-11 (list grew from 28 to 29 characters).

Scale analysis of the October 2026 .com zone: 167,226,216 delegated names, 733,509 in xn-- form, and 161,894 visual lookalike pairs covering 133,953 ASCII domains (102,592 exact Unicode matches, 46,522 reverse-confusable Unicode displays, 12,780 reverse-confusable Punycode displays); some pairs may be defensive registrations. Chromium's bundled domain list holds 8,462 domains, 836 in the top-priority bucket. No CVE, CVSS score, exploitation in the wild or actor attribution is stated by the sources; severity is an analyst estimate.

## MITRE ATT&CK

- T1583.001 Domains
- T1566 Phishing
- T1566.002 Spearphishing Link
- T1036.005 Match Legitimate Resource Name or Location
- T1684.001 Impersonation
- T1204.001 Malicious Link
- T1598.003 Spearphishing Link

## Sources

- [New Unicode Characters Let Attackers Create Convincing Lookalike Domains for Phishing](https://cybersecuritynews.com/unicode-characters-make-domain-look-real/)
- [Turning IDN edge cases into typosquats - Have I Been Squatted](https://haveibeensquatted.com/blog/turning-idn-edge-cases-into-typosquats)
- [Unicode Technical Standard #39: Unicode Security Mechanisms](https://unicode.org/reports/tr39/)
- [Homoglyph Attacks & Domain Squatting: The Hidden Risk to Your Brand - Cloud Security Alliance](https://cloudsecurityalliance.org/blog/2025/07/29/homoglyph-attacks-domain-squatting-the-hidden-risk-to-your-brand)
- [Phishing with Unicode Domains, an attack almost impossible to detect](https://andreafortuna.org/2017/04/18/phishing-with-unicode-domains-an-attack-almost-impossible-to-detect/)
- [Google Chrome to get warnings for lookalike URLs - Slashdot](https://tech.slashdot.org/story/19/01/30/2020218/google-chrome-to-get-warnings-for-lookalike-urls)
- [Homograph attacks still happening - The Register](https://www.theregister.com/2020/03/04/homograph_attacks_still_happening/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3351