New characters let lookalike domains bypass some browser checks

• 

  Researchers identified characters that can make malicious domains look like legitimate websites in some browsers.

• 

  The characters can bypass security checks in Chromium-based browsers, creating a risk of phishing and credential theft.

• 

  The researchers said the characters exploit weaknesses in two Chromium functions that check how domains appear.

• 

  An example domain, аррӏө.com, can appear to users as apple.com.

• 

  An estimated 162,000 pairs of internationalized domain names resemble plain ASCII domains.

Who

Researchers Ian Muscat and Leanne Briffa of Have I Been Squatted identified the issue.

What

Some characters can be used in lookalike domains to bypass browser checks. The domains could be used for phishing and credential theft.

When

The article was published on 2026-10-12; the discovery date is not stated.

Where

Chromium-based browsers are affected.

Why

The characters can evade checks that identify suspicious Unicode domains and compare them with popular website names.

This story does not have two clearly opposing sides.

No direct quotes in the coverage so far.

This story does not have a timeline yet.