Research reveals two edge cases in Chromium's internationalized domain name (IDN) handling that allow convincing typosquats of well-known domains to bypass security checks. By exploiting Cyrillic characters not on lookalike lists and mixing scripts strategically, attackers can register domains that display as Unicode in Chrome rather than Punycode encoding, potentially deceiving users despite browser protections added since 2017.
Chromium browsers face typosquatting vulnerabilities that exploit character interpretation, creating security risks for users. The flaw opens pathways for attackers to register deceptive domains that appear legitimate to users navigating the web.