Two rarely used letters, a Cyrillic barred o (ө) and a Latin k with a hook (ƙ), can make fake web addresses that imitate well-known brands display as normal-looking text in Google Chrome and other browsers built on the open-source Chromium engine, The Register reported Saturday, citing research by the domain-monitoring service Have I Been Squatted. The finding undercuts a staple of employee phishing training: check the address bar before signing in.

What Happened

In a write-up published Oct. 3, "Turning IDN Edge Cases Into Typosquats," researchers Ian Muscat and Leanne Briffa describe registering 20 lookalike domains as a proof of concept. Fifteen use ө in otherwise Cyrillic names that mimic sites such as apple.com, openai.com and shell.com; five use ƙ to mimic names including okta.com and nike.com. All 20 displayed in readable form in Chrome 154 with valid certificates, the researchers wrote. The Register reported that every test domain got past Chromium's key protections, which also underpin Microsoft Edge.

The weakness lies in how Chromium decides whether to show an internationalized domain name, an address containing non-Latin characters, as readable text or as Punycode, an encoded form beginning with "xn--" that looks obviously odd. One check flags all-Cyrillic names only when every letter appears on a 29-character list of Cyrillic letters that resemble Latin ones. Because ө is not on that list, a single ө switches the check off.

RelatedSuspected Chinese Spies Exploited BeyondTrust Remote Support Flaw Since August, Google Says

A second check reduces each address to a "skeleton" of basic letter shapes and compares it with 8,462 popular domains bundled with the browser. According to the researchers, ө and ƙ leave behind combining marks, the bar and the hook, that survive this reduction, so the fake no longer matches the real name. Accented spellings such as ókta.com, by contrast, are caught.

Chrome also shows warnings when someone navigates to a suspicious site, but those look only for exact matches or near matches one edit away, and skip near-match checks for names shorter than five characters before the domain ending, the write-up says. That leaves okta.com without near-match protection, while the apple.com imitation sits two edits away, outside the window.

Chrome 148, released in May, closed a similar route that used two other characters, according to the researchers. Neither their post nor The Register's article says whether Google has been told about the new characters or plans a fix.

Why It Matters

Lookalike domains are a common tool for stealing passwords, and the test set included identity provider Okta, whose sign-in pages employees at many companies use daily. If a convincing imitation renders cleanly in the address bar, staff trained to inspect URLs have little to go on.

Email widens the exposure. In the researchers' tests, Gmail displayed all 20 lookalike senders in readable form, while Outlook on the web showed all of them, along with harmless accented names, as Punycode. The researchers concluded that neither service performs lookalike checks. They also noted that the email authentication standards known as SPF, DKIM and DMARC pass for lookalike domains an attacker owns, so those controls do not help here.

For security leaders, the lesson is that address-bar vigilance cannot carry the load. The researchers recommend phishing-resistant multifactor authentication such as FIDO2 security keys or passkeys, which will not work on a lookalike domain; registering defensive variants of short brand names; monitoring new "xn--" registrations close to protected domains; and tagging inbound mail from such domains.

The Scale of Lookalikes

Using October 2026 data for the .com zone, the researchers counted about 167 million registered names, roughly 733,500 of them internationalized, and about 162,000 pairs in which an internationalized name resembles a plain-letter .com name. Both the researchers and The Register stressed that a pair shows only resemblance, not malice; some are defensive or legitimate business registrations. Chromium's checks date to 2017, when a researcher registered an all-Cyrillic imitation of apple.com, The Register noted.

What to Watch

  • Chromium changes. The researchers name ө, ү and ї as letters missing from the Cyrillic list, which last grew on Sept. 11.
  • Browser makers' response. Google, Microsoft and other Chromium-based vendors have not commented in either source.
  • Webmail handling. Whether Gmail adds lookalike checks for internationalized sender domains.