Chromium typo-squatting loophole allows phishing via Cyrillic homoglyphs

Security researchers found a loophole in Chromium's defenses against phishing. The gap enables malicious websites to sidestep browser warnings. That's important because even if the browser warns them away, users can still end up on fake login pages that appear just like real services. The loophole is related to the browser's treatment of internationalized domains with non-Latin characters.

Security researchers identify a gap in Chromium's homoglyph detection that lets malicious sites bypass warnings

The problem has to do with Cyrillic homoglyphs. These are characters that look like Latin, but aren't exactly the same. In Google's Chromium browser, mixed Latin/Cyrillic domain names typically get blocked by showing their Punycode version. But the browser's current blocklist only recognizes 29 common Cyrillic "lookalikes." Other characters go unchecked.

At Have I Been Squatted (HIBS), researchers found a way to beat that system. A domain with the Cyrillic "e" (U+04E9) character doesn't get flagged. That particular Cyrillic isn't on the Chromium blocklist, so the domain shows up as a familiar Latin word.

No warning. The all-Cyrillic domain is accepted by the browser because it doesn't trigger the mixed script rules.

Chromium also has a special list of more than 8,000 popular domains to ward off typical typo squatting. A 2020 study found it blocked 64.1 percent of such attempts. But it doesn't fix the homoglyph problem.

At HIBS, they advise companies to register their own lookalike domains. And urge people to switch to passkeys. Passkeys are specific to domains. They won't let you log in to spoofed domains — whether or not they look like the real thing.