Research reveals two edge cases in Chromium's internationalized domain name (IDN) handling that allow convincing typosquats of well-known domains to bypass security checks. By exploiting Cyrillic characters not on lookalike lists and mixing scripts strategically, attackers can register domains that display as Unicode in Chrome rather than Punycode encoding, potentially deceiving users despite browser protections added since 2017.