Researchers Ian Muscat and Leanne Briffa of Have I Been Squatted have found two Unicode characters that let them register 20 domain names designed to impersonate popular websites in Chromium browsers. The characters—Cyrillic ө and the Latin K with hook, ƙ—produce URLs that, when displayed as Unicode, closely resemble the real thing. Examples include аррӏө[.]com for Apple and niƙe[.]com for Nike.
Chromium's first line of defense, the SafeToDisplayAsUnicode function, runs seven checks against a hardcoded list of known Cyrillic lookalikes. The check only triggers if every character in the string is on that list; a single missing character lets the whole domain through. ө is not on the list, so it acts as a "breaker." The second defense, GetSimilarTopDomain, strips diacritics to build a skeleton and compares it to almost 8,500 popular domains. ƙ has no diacritic, so the skeleton for oƙta[.]com doesn't match Okta's genuine domain.
A third layer, Safety Tips, can warn users when a domain is an exact match, one edit away, or an adjacent swap from a known site. But аррӏө[.]com differs from apple.com by more than one edit, so no warning appears. The researchers note that Chrome 148 previously blocked other breakers, ҏ and ӿ, but these two characters remain effective as of Chrome 154.