Two Unicode glyphs let Chrome and Edge display lookalike sites

Two characters can quietly break the way Chromium-based browsers decide what looks safe to display. In a new demonstration, researchers showed that certain non‑ASCII glyphs can make lookalike domains appear authentic in Chrome, Edge and other Chromium browsers. The problem is not just a quirky bug; it’s a real phishing vector that could trick ordinary users into visiting fake sites that resemble real brands.

The researchers from Have I Been Squatted tested glyphs that aren’t common in ASCII: ө and ƙ, alongside a few others. When these characters slip into a domain name, they can resemble letters like e, o, i and k to the human eye, but they’re not the same characters the browser uses for safety checks. The combined effect can bypass Chromium’s seven‑check safety net that’s meant to catch spoofed domains and show them in Punycode instead of the familiar looking address.

To make this concrete, the demo domains used lookalikes such as arcane strings that, when displayed, appear almost identical to real sites but actually route to harmless demo pages set up by the researchers. The key point is that some of these glyphs simply aren’t included in Chromium’s hardcoded “spoofing” list, so one or more checks don’t trigger. When the checks fail, the browser may display a fake URL that looks trustworthy to a casual glance.

Chromium does have a second defense: a function that builds a “skeleton” of the domain to compare it against a list of about 8,500 popular sites. The idea is to catch near‑matches that could mislead users. But the researchers found the characters in question can still slip past this skeleton check because the glyphs are treated as different letters in the skeleton path. The result is a warning gap that could be exploited in the wild.

Safety tips remain in place as a final line of defense. Browsers will sometimes warn you if the domain looks fake or if a substitution seems suspicious. But those warnings have limits too. If the domain is only slightly altered or uses a short string, the browser might not raise an alert. And if a user does not have a history of visiting the genuine site, the warning logic may not trigger at all.

In practice, what this means for everyday users is simple: phishing and impostor domains are not going away, and there are new, subtle ways attackers could try to slip a fake site past you. Keeping a sharp eye on the address bar, avoiding clicking through from unfamiliar links, and using multi‑factor authentication where available remain wise steps. If you ever see a domain that looks off, even slightly, trust your instincts and type the site address manually or use a trusted bookmark.

Ultimately, this isn’t a Chrome problem alone. It’s a reminder that phishing lures evolve with language and script. Browser vendors will likely respond with tighter checks or new warnings, but users still need to stay vigilant, especially on sites that request login credentials or payment details.