Science & Tech · Cybersecurity · 1 day ago
Researchers find two characters that can make fake URLs look real in Chromium
Some letters from other languages look similar to familiar Latin letters.
Researchers found that ө and ƙ can help fake website addresses slip past two checks in Chromium-based browsers, such as Chrome and Edge.
The browsers may then show the lookalike address in a way that makes it seem genuine.
This matters because people could be tricked into visiting a fake site and sharing sensitive information.
Researchers say two characters can make fake web addresses look genuine in Chromium-based browsers.
The characters are ө, used in several Cyrillic languages, and ƙ, used in Hausa and Karai-karai.
The researchers say the characters bypass browser checks and helped them register 20 lookalike domain names.
The domains appear similar to genuine sites in Unicode but should be shown in Punycode to reveal the difference.
- Who
- Researchers Ian Muscat and Leanne Briffa of Have I Been Squatted.
- What
- They found that ө and ƙ can bypass Chromium browser protections and make lookalike URLs appear genuine.
- When
- The article was published on October 10, 2026. The report says Chrome 154 was released to the stable channel on September 22.
- Where
- Chromium-based browsers, including Chrome and Edge.
- Why
- The characters can evade display and domain-similarity checks, causing fake addresses to appear as Unicode rather than Punycode.
This story does not have two clearly opposing sides.
there are still characters available to cyber-imposters that can reliably fool web users into trusting URLs that they certainly should not
Vendors began introducing Chromium checks after researcher Xudong Zheng registered аррӏе.com.
Chrome 154 was released to the stable channel.
The Register published the report on the researchers’ findings.
- Characters
- ө and ƙ
- Researchers
- Ian Muscat and Leanne Briffa
- Lookalike domains registered
- 20
- Browser version cited
- Chrome 154
- Domain-check list
- Almost 8,500 popular websites
Sources
Related news
Canadian cybersecurity negotiator arrested in ShinyHunters investigation
US seizes two China-linked hacking tools used against critical infrastructure
Anthropic offers free AI vulnerability scans to open-source projects
FBI arrests another suspect linked to ShinyHunters jobs-site breach
Canadian cybersecurity executive arrested on extortion-related charges
Illinois college says Flock refused to remove its cameras before contract ended
AI-assisted attacks hit South Korean financial institutions
Ricardo data breach affects about 890,000 user accounts
Account linked to Chinese DDoS group in probe of attacks on South Korean finance
Thousands of GPU servers exposed monitoring data, with hundreds vulnerable to crashes
Security Affairs launches weekly AI and cybersecurity newsletter
