Researchers say a Unicode lookalike domain can slip past Chromium checks

The finding shows browser anti-impersonation filters still miss some crafted domains, leaving lookalike abuse possible even in a browser that usually catches more of it.

Researchers from Have I Been Squatted showed that a crafted Unicode domain can still slip past Chromium’s anti-impersonation checks, even though the browser is usually the strongest at catching lookalike names. Their example, "аррӏө.com", works because the Cyrillic character "ө" is not included in Chromium’s special list of 29 Cyrillic lookalikes. The report matters for teams that rely on browser filters or domain-registration rules, since it shows those defenses still miss edge cases as Unicode keeps expanding. HIBS says the practical response is to register lookalike domains and push passkeys, which are bound to a single domain and therefore harder to phish.