# New IDN Domain Spoofing Techniques (Breaker Characters and Diacritic Handling) Bypass Chromium Lookalike Phishing Protections

> Have I Been Squatted researchers Ian Muscat and Leanne Briffa published two internationalized domain name (IDN) edge cases that evade Chromium's Unicode lookalike safeguards: 'breaker' characters absent from the lookalike lists, and diacritic handling that leaves combining marks in the skeleton so it no longer matches the legitimate domain. 20 proof-of-concept .com domains were registered; Chrome 154 on macOS and Gmail Web displayed the lookalikes in Unicode.

- **Published:** 2026-10-12T12:45:40Z
- **Last reviewed:** 2026-10-12T12:45:40Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3353
- **ID:** TL-2026-3353
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 21 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2019-13659, CVE-2019-13663, CVE-2019-13674

## Description

Chromium decides whether to show an IDN hostname in Unicode or as Punycode (A-label) through a two-stage check. Stage 1, SafeToDisplayAsUnicode(), runs seven validation steps per label, including whole-script confusable checks. Stage 2, GetSimilarTopDomain(), compares the hostname's skeleton against about 8,462 bundled top domains. The skeleton computation removes diacritics, generates variants for ambiguous characters and maps confusables to ASCII.

Technique 1 is substitution with 'breaker' characters. Characters such as U+04E9 (ө, resembles o/e), U+04AF (ү, resembles y) and U+0457 (ї, resembles i) are allowed by Chromium but missing from its Cyrillic lookalike lists. A label made of Cyrillic lookalikes plus one breaker passes the whole-script confusable check and is shown in Unicode. The researchers registered domains such as аррӏө.com (apple.com, Punycode xn--80a6aa68c8d.com), орөпаі.com (openai.com), ѕкурө.com (skype.com) and каѕрөгѕку.com (kaspersky.com). Two further breakers, U+048F (ҏ) and U+04FF (ӿ), are already rejected from Chrome 148 onward.

Technique 2 is diacritic handling. Chromium strips diacritics before applying confusable mappings. Accented characters such as ó and é are removed entirely and match the target exactly. Characters with hooks or strokes, such as ƙ, map to a Latin letter plus a combining mark, so the skeleton keeps the mark and sits one or two edits from the legitimate domain. This evades skeleton matching. Examples are oƙta.com (okta.com), niƙe.com (nike.com), sƙy.com (sky.com), vƙ.com (vk.com) and ƙicƙstarter.com (kickstarter.com).

Testing showed Chrome 154 on macOS and Gmail Web rendering the lookalikes in Unicode (Gmail showed all 20 sender domains that way). Outlook Web showed the encoded A-labels. No CVE, CVSS score, threat-actor attribution or in-the-wild exploitation is reported. The reporting says it does not demonstrate a bypass of all phishing defenses, and reputation checks, allowlists, spam filtering and link scanning were not evaluated. The risk is that attackers use the same technique to register convincing brand-impersonation domains for credential phishing and business email compromise.

## MITRE ATT&CK

- T1583.001 Domains
- T1566 Phishing
- T1566.002 Spearphishing Link
- T1598 Phishing for Information
- T1598.003 Spearphishing Link
- T1036 Masquerading
- T1684.001 Impersonation
- T1204.001 Malicious Link

## Sources

- [Researchers Discover New Domain Spoofing Techniques That Bypass Chrome's Phishing Protections](https://gbhackers.com/researchers-discover-new-domain-spoofing-techniques/)
- [Turning IDN Edge Cases into Typosquats - Have I Been Squatted](https://haveibeensquatted.com/blog/turning-idn-edge-cases-into-typosquats)
- [CVE-2019-13659 - Chrome Omnibox IDN spoofing (prior art)](https://tenable.com/cve/CVE-2019-13659)
- [CVE-2019-13663 - Chrome Omnibox IDN spoofing (prior art)](https://www.rapid7.com/db/vulnerabilities/google-chrome-cve-2019-13663/)
- [CVE-2019-13674 - Chrome Omnibox IDN spoofing (prior art)](https://tenable.com/cve/CVE-2019-13674)
- [Internationalized Domain Names (IDN) in Google Chrome - Chromium docs](https://chromium.googlesource.com/chromium/src/+/main/docs/idn.md)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3353