Researchers at Have I Been Squatted (HIBS) showed that a fake apple.com can get past Chromium's lookalike-domain protections, because one Cyrillic character it uses is missing from the browser's watch list. We did not obtain a statement from the Chromium project, and we could not confirm whether current releases still have the gap.
The domain is аррӏө.com, written entirely in Cyrillic letters. It is not the real Apple address. It is a typosquat: a web address registered to resemble a real one so visitors land on a booby-trapped copy. Ever since the IETF allowed Unicode characters in domain names, homoglyphs (characters that look alike across alphabets) have been the obvious weak point.
Chromium, which underpins Chrome, Edge and Brave, stacks several defenses. Mix one Cyrillic letter into Latin ones and the browser shows the name in Punycode, an ASCII encoding of Unicode names. Cyrillic "а" plus pple.com appears as xn--pple-43d.com. For .com domains, names generally pass only if every character comes from one alphabet. An all-Cyrillic name still fails if it is built solely from the 29 Cyrillic characters Chromium lists as common Latin impersonators.
That is the gap. The "ө", an oval with a line through it, is not on the list of 29. So the name clears the single-alphabet rule and slips past the list rule too.
The pattern matters more than the one character. Chromium is reportedly the best of the major browsers here: a 2020 study found it caught 64.1% of lookalike attempts, with Firefox and Safari trailing, which still leaves more than a third getting through. It also keeps over 8,000 popular domains on a watch list and applies stronger checks to 836 of them. Yet its defense depends on someone spotting lookalikes and adding them, while Unicode holds nearly 173,000 characters and keeps growing, though only a subset can appear in domain names.
HIBS advises companies worried about impersonation to register lookalike domains themselves and to push users toward passkeys. A passkey is bound to a specific domain, so it will not work on an imitation site. Registering lookalikes means chasing an enormous character set; a passkey does not depend on anyone spotting the difference.