[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-one-cyrillic-letter-slipped-past-chromiums-lookalike-checks":10,"sections":41},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":30,"tags":31,"sources":36,"feedback":40,"feedback_at":22,"cost_usd":40,"total_tokens":40},11769,"one-cyrillic-letter-slipped-past-chromiums-lookalike-checks","One Cyrillic Letter Slipped Past Chromium's Lookalike Checks","Researchers say a fake apple.com built from Cyrillic lookalikes passed Chromium's checks because one character was missing from its list of 29.","Researchers at Have I Been Squatted (HIBS) showed that a fake `apple.com` can get past Chromium's lookalike-domain protections, because one Cyrillic character it uses is missing from the browser's watch list. We did not obtain a statement from the Chromium project, and we could not confirm whether current releases still have the gap.\n\nThe domain is `аррӏө.com`, written entirely in Cyrillic letters. It is not the real Apple address. It is a typosquat: a web address registered to resemble a real one so visitors land on a booby-trapped copy. Ever since the IETF allowed Unicode characters in domain names, homoglyphs (characters that look alike across alphabets) have been the obvious weak point.\n\nChromium, which underpins Chrome, Edge and Brave, stacks several defenses. Mix one Cyrillic letter into Latin ones and the browser shows the name in Punycode, an ASCII encoding of Unicode names. Cyrillic \"а\" plus `pple.com` appears as `xn--pple-43d.com`. For .com domains, names generally pass only if every character comes from one alphabet. An all-Cyrillic name still fails if it is built solely from the 29 Cyrillic characters Chromium lists as common Latin impersonators.\n\nThat is the gap. The \"ө\", an oval with a line through it, is not on the list of 29. So the name clears the single-alphabet rule and slips past the list rule too.\n\nThe pattern matters more than the one character. Chromium is reportedly the best of the major browsers here: a 2020 study found it caught 64.1% of lookalike attempts, with Firefox and Safari trailing, which still leaves more than a third getting through. It also keeps over 8,000 popular domains on a watch list and applies stronger checks to 836 of them. Yet its defense depends on someone spotting lookalikes and adding them, while Unicode holds nearly 173,000 characters and keeps growing, though only a subset can appear in domain names.\n\nHIBS advises companies worried about impersonation to register lookalike domains themselves and to push users toward passkeys. A passkey is bound to a specific domain, so it will not work on an imitation site. Registering lookalikes means chasing an enormous character set; a passkey does not depend on anyone spotting the difference.","[\"typosquatting\",\"chromium\",\"unicode\",\"passkeys\"]","2026-10-18T12:05:00.000Z","2026-10-18T12:58:11.531Z","2026-10-18T12:58:11.796Z","published",null,[24],{"id":25,"reviewer":26,"round":27,"reason":28,"status":29},"editor-r1","editor",1,"Remove the leftover sourcing note ('which the source calls not nearly enough'), and stop attributing the 'newer Chromium release can and probably will add it' line to the researchers, since that was Tom's Hardware's commentary; also state that Chromium's response or current patch status was not obtained (or find it), because the headline's 'still slips past' implies the bypass works today and the draft has no statement or confirmation to back that.","resolved","security",[32,33,34,35],"typosquatting","chromium","unicode","passkeys",[37],{"name":38,"url":39},"Tom's Hardware","https:\u002F\u002Fwww.tomshardware.com\u002Ftech-industry\u002Fcyber-security\u002Ftypo-squatting-attacks-with-major-domains-are-still-viable-corner-cases-with-cyrillic-characters-still-evade-the-best-checks",0,{"sections":42},[43,48,51,56,61,66,71,76,81,86,91,96,101,106],{"name":44,"slug":45,"count":46,"latest_published_at":47},"AI","ai",7040,"2026-10-18T11:00:00.000Z",{"name":49,"slug":30,"count":50,"latest_published_at":18},"Security",1004,{"name":52,"slug":53,"count":54,"latest_published_at":55},"Policy","policy",539,"2026-10-17T19:38:12.000Z",{"name":57,"slug":58,"count":59,"latest_published_at":60},"Deals","deals",524,"2026-10-17T07:00:00.000Z",{"name":62,"slug":63,"count":64,"latest_published_at":65},"Hardware","hardware",265,"2026-10-18T13:24:23.000Z",{"name":67,"slug":68,"count":69,"latest_published_at":70},"Consumer Tech","consumer-tech",237,"2026-10-18T14:33:47.000Z",{"name":72,"slug":73,"count":74,"latest_published_at":75},"Science","science",203,"2026-10-17T12:40:00.000Z",{"name":77,"slug":78,"count":79,"latest_published_at":80},"Startups","startups",134,"2026-10-18T12:02:57.000Z",{"name":82,"slug":83,"count":84,"latest_published_at":85},"Software","software",129,"2026-10-15T22:21:06.000Z",{"name":87,"slug":88,"count":89,"latest_published_at":90},"Dev Tools","dev-tools",118,"2026-10-16T15:52:39.000Z",{"name":92,"slug":93,"count":94,"latest_published_at":95},"General","general",82,"2026-10-16T16:06:38.000Z",{"name":97,"slug":98,"count":99,"latest_published_at":100},"Gaming","gaming",77,"2026-10-17T16:59:39.000Z",{"name":102,"slug":103,"count":104,"latest_published_at":105},"Reviews","reviews",37,"2026-10-14T10:00:00.000Z",{"name":107,"slug":108,"count":109,"latest_published_at":110},"How-To","how-to",8,"2026-10-05T09:00:00.000Z"]