Emerging Vulnerabilities in Internationalized Domain Names: A Technical Overview
Recent research has shed light on significant vulnerabilities associated with internationalized domain names (IDNs), which, as identified by Ian Muscat and Leanne Briffa from Have I Been Squatted, can compromise the security of online navigation. Their work, published on October 3, 2026, explores how specific combinations of Cyrillic and Latin characters can create domain names that closely mimic those of established and trusted websites, all while bypassing several security measures in Chromium’s browser.
The Mechanics of Domain Spoofing
The researchers undertook a series of experiments, registering 20 proof-of-concept domains, including arӏ̦o.com, which closely resembles apple.com, and oƙta.com, resembling okta.com. Notably, when displayed on macOS using Chrome 154, the domain arӏ̦o.com successfully passed through Unicode display safeguards and displayed a valid certificate. This raised alarms in the cybersecurity community about the effectiveness of current domain display and lookalike detection mechanisms.
Usually, Chromium converts suspicious IDNs into Punycode, an ASCII representation prefixed by "xn--." This transformation begins with a function called SafeToDisplayAsUnicode(), which examines the domain’s labels for prohibited characters and combinations that may be harmful. The significance of this function grew after Xudong Zheng demonstrated in 2017 how arpple.com, an entirely Cyrillic rendering of apple.com, was able to evade detection. Because all characters were part of the Cyrillic lookalike set, it was effectively blocked by Chromium.
However, the new research reveals a critical loophole: the whole-script confusable check operates on an all-or-nothing basis. By substituting a single character—the Cyrillic “е” with a less common “ө” (U+04E9)—the domain arӏ̦o.com slipped through the cybersecurity nets since “ө” was not included in the recognized lookalike list. The researchers designated such characters as “breakers,” reiterating their potential for misuse in creating deceptive domains.
Limitations in Current Detection Methods
In addition to the “breakers,” several other valid characters, including “ү” and “ї,” can facilitate similar impersonations. The complexity of the impersonation process often lies in the combination of characters that are still compliant with the detection algorithms, where mixing Latin letters with Cyrillic typically raises red flags.
After the initial inspection, Chromium moves to another layer of analysis through GetSimilarTopDomain(), which aligns “skeletons” of normalized hostnames against an extensive database of approximately 8,462 known domains. If an exact match occurs, the browser will shift the display to Punycode, effectively alerting the user to the potential danger.
However, the order of transformations within this detection mechanism exposes weaknesses. Chromium eliminates diacritic marks before applying confusable mappings, leading to scenarios where certain characters, such as “ƙ” in oƙta.com, can transform into a standard Latin “k” combined with additional marks. Such adjustments thwart direct comparisons with legitimate domains, allowing these lookalike sites to circumvent security barriers.
Implications for Online Security
Both domains examined in the study successfully escaped detection for various reasons. The character substitutions and the structural format of arӏ̦o.com meant that it was more than two edits away from apple.com, evading the one-edit requirement for near-match scrutiny. Furthermore, for names shorter than five characters, like okta.com, Chromium effectively bypasses the checks for near-matches altogether. Given these findings, both crafted domains successfully loaded without alerting users to potential phishing threats.
Notably, the tests conducted did not encompass a plethora of other security mechanisms, including reputation checks and redirect analyses. Therefore, the conclusions drawn should not suggest a comprehensive evasion of phishing defenses but emphasize emerging vulnerabilities that need urgent attention.
Email communication also emerged as a vulnerability vector. During trials with 20 internationalized senders, Gmail displayed each domain in Unicode, complicating the potential for user awareness. Meanwhile, Outlook Web rendered their encoded A-labels, illuminating how different platforms handle these vulnerabilities variably.
Recommendations for Enhanced Security
In light of the findings, the researchers advocate for more robust vigilance over encoded IDN registrations, particularly those residing within two edits of well-known domains. Suggested measures for web administrators include implementing IDN-aware DNS policies and enhancing gateway impersonation controls. Additionally, employing phishing-resistant FIDO2 authentication or utilizing passkeys could serve as effective deterrents, ensuring that credentials registered under a legitimate domain cannot be employed by lookalike sites.
As the landscape of cybersecurity continues to evolve, it becomes increasingly vital for individuals and organizations to bolster their defenses against these emerging threats. It is essential to remain proactive and stay informed about new malware and vulnerabilities as they arise.