Chromium Browsers Vulnerable to IDN Homograph Typosquatting

An analysis shows Chromium-based browsers cannot reliably distinguish visually identical Unicode characters from different scripts in internationalized domain names. Researchers registered xn--80a6aa68c8d.com, which mimics apple.com, and replicated the exploit with spacex.com. Existing Punycode and script-mixing checks fail to block such spoofing.

• Domain xn--80a6aa68c8d.com visually mimics apple.com using Cyrillic characters
• Chromium's Punycode detection fails to flag embedded homographic characters
• Script-mixing checks pass characters from visually equivalent script families
• The same exploit was reproduced against the spacex.com domain