SecurityNot yet confirmed elsewhere1 publisher2 min readPublished
Three Cyrillic letters still let lookalike domains through Chromium's address-bar check
Researchers at haveibeensquatted.com found three Cyrillic letters that still break Chromium's whole-script lookalike check in current Chrome. A name built on one can display close to a real brand, so the address bar is a weaker check than users are taught.
The Watch · Security desk
What happened
- Under ICU 78, 64 lowercase Cyrillic characters are both allowed by Chromium and absent from its 29-character Cyrillic lookalike list.
- Chrome 148, released in May 2026, adopted ICU 78.2 and Unicode 17, and the Unicode reclassification now blocks two of the five breakers the researchers named.
- The work revisits Xudong Zheng's April 2017 Cyrillic .com, drawn by Chrome, Firefox and Opera as near-identical to a real domain and shown by Chromium as Punycode ever since.
Why it matters
- exposure Machines still on Chrome 147 or earlier accept all five breaker characters, so slow browser updates widen the set of lookalikes that render as Unicode.
- constraint Mail clients draw sender addresses by their own rules, so a change to Chromium's lookalike list would not cover a deceptive address in an email From line.
- precedent Chrome 148 closed two breakers only because Unicode 17 reclassified them, so the remaining three stay usable until Chromium edits its 29-character list or Unicode reclassifies them as well.
The weak point is in stage 1, in the whole-script confusable rule. Chromium runs the first part of its check through International Components for Unicode (ICU) with a narrowed set of allowed characters, then adds rules of its own [11]. The confusable rule is all-or-nothing. A single Cyrillic character missing from the lookalike list takes the whole label outside the rule [12]. The researchers call that character a breaker [12]. To be useful it must sit in Chromium's allowed set, stay off the lookalike list, and still pass for a Latin letter to someone reading the address bar [13].
Many characters clear the two software tests. Few look enough like a Latin letter to fool a reader. The researchers name five that do [15], about one in thirteen of the candidates [22]. One is a letter used in Kazakh, Mongolian and Tatar that Chromium does not list as a lookalike [19].
A breaker gets a label through stage 1 and no further [9]. Every letter in the label must also be Cyrillic. Several Latin letters have no Cyrillic substitute in Chromium's allowed set, and Chrome 148 removed the substitutes for two more [17]. That limits which brand names can be spelled at all. Stage 2 then reduces the full hostname to comparison strings, called skeletons, and checks them against a bundled list of popular domains. If the hostname matches a different site, the whole name goes back to Punycode [18]. The registry also decides which characters a name may contain [20]. We'd rate the technique exploitable today, but only against brand names that can be written entirely in permitted Cyrillic. The researchers say they found two edge cases that still let a convincing lookalike through [8]. They credit the breaker technique for the name Chrome 154 displays in their opening screenshot [6].
The address-bar advice dates from when domain names could only hold English letters, digits and a hyphen [1]. Names have been able to use almost any writing system since 2003 [2]. For those names the advice depends on Chromium showing deceptive-looking labels in Punycode instead [3]. In our view, reading the address bar still helps, but it has to sit alongside controls that do not rely on a person reading the name correctly. The published findings do not report any attacker using the technique, and they do not describe a Chromium change for the three characters that still pass.
What to watch
- Whether Chromium adds the three remaining breaker characters to its Cyrillic lookalike list, or a later ICU or Unicode release reclassifies them.
- Registrations of all-Cyrillic labels using these characters that spell popular brand names, the first sign of the technique moving from research into phishing.
- Fuller detail on the researchers' second edge case, and whether it reaches stage 2 for brand names the first one cannot spell.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence55
- Adoption
- Insufficient
- Hype gap+15
- Incentives
- Insufficient
- Confidence50
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The 'check the address bar' advice assumes the name there can be read correctly, which held while domain names could only contain English letters, digits, and a hyphen.
- [3]
Chromium, the engine behind Chrome, Edge and other browsers, applies a display check: if a name looks built to deceive, the address bar shows its encoded Punycode form instead.
- [4]
Mail clients make their own choice about how to draw a sender's address.
- [5]
The research investigates whether it is still possible to register a domain that looks like a well-known one and have Chromium-based browsers render it close to the real thing.
- [6]
The post includes a screenshot of Chrome 154 displaying a lookalike name, and says the breaker technique is the mechanism behind the name in its introduction.
- [7]
In April 2017, Xudong Zheng registered a Cyrillic .com that Chrome, Firefox and Opera drew as almost indistinguishable from a real domain; Chromium has shown that name as Punycode ever since.
- [8]
The research finds two edge cases in Chrome's handling of internationalized domain names that still let a convincing lookalike through; the first is in the whole-script confusable check.
- [9]
Chromium's display decision has two stages and a name must pass both to show as Unicode: stage 1 checks each xn-- label through SafeToDisplayAsUnicode() with the TLD as context; stage 2 checks the whole hostname against a list of popular domains and runs only when every label passes stage 1.
- [10]
Stage 1 runs seven checks on each label in a fixed order, and the first one that fails sends the name to Punycode.
- [11]
Chromium runs the first part of the check through International Components for Unicode (ICU), configured with a narrowed set of allowed characters, and then applies rules of its own.
- [12]
The whole-script confusable rule is all-or-nothing, so a single Cyrillic character that is not on the lookalike list keeps the whole label out of it; the post calls that character a 'breaker'.
- [13]
A useful breaker must sit in Chromium's allowed Unicode set (clearing check #1), be missing from the Cyrillic lookalike list (so check #6 does not fire), and still look enough like a Latin letter that a reader can mistake it.
- [14]
Under ICU 78 and the 29-character list, 64 lowercase Cyrillic characters are in Chromium's allowed set and missing from the Cyrillic lookalike list.
- [15]
The research identifies five breakers; the first three meet the allowed-set and lookalike-list conditions today, and the last two met the allowed-set condition only before Chrome 148.
- [16]
Unicode 17.0 moved two of the breaker characters from Recommended to Uncommon_Use; Chrome 148, released in May 2026, moved to ICU 78.2, which carries Unicode 17, so both now fail check #1. Chrome 147 and earlier accept all five.
- [17]
A useful lookalike label must be written wholly in Cyrillic; several Latin letters have no Cyrillic substitute in Chromium's allowed set, and Chrome 148 also removed the substitutes for two more.
- [18]
In stage 2 Chromium reduces the hostname to comparison skeletons and compares them against a bundled list of popular domains; a match for a different site sends the entire hostname back to Punycode even though every label passed stage 1.
- [19]
A Cyrillic letter used in Kazakh, Mongolian and Tatar is not on Chromium's lookalike list.
- [20]
Registries decide separately which characters a domain name may contain.
- [21]
Three of the five identified breakers still pass Chromium's stage 1 conditions in Chrome 148 and later.
- [22]
The five named breakers are about one in thirteen of the 64 characters that meet Chromium's first two conditions.
Sources
1 independent publisher whose own reporting we read for this story.
- https://haveibeensquatted.com/blog/
haveibeensquatted.com
1 article · October 9, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.