Researchers Discover New Domain Spoofing Techniques That Bypass Chrome’s Phishing Protections

What happened

Researchers identified two edge cases involving internationalized domain names (IDNs) that bypass Unicode display safeguards and certain navigation warnings in Chromium. Published on October 3, 2026, their research demonstrates how carefully selected Cyrillic and Latin characters can create convincing lookalikes of trusted domains without triggering these protections. Apple is a software and consumer electronics company based in Cupertino.

Read Researchers Discover New Domain Spoofing Techniques That Bypass Chrome’s Phishing Protections By Divya October 12, 2026 Share Facebook Twitter Pinterest WhatsApp Researchers identified two edge cases involving internationalized domain names (IDNs) that bypass Unicode display safeguards and certain navigation warnings in Chromium. The findings raise concerns about domain display and lookalike-detection controls, but do not demonstrate a bypass of all phishing (messages that impersonate someone to obtain passwords or money)-defense systems.

New Domain Spoofing Techniques Chromium usually converts suspicious IDNs into Punycode, an ASCII representation that begins with xn--. The researchers Ian Muscat and Leanne Briffa at […] The post Researchers Discover New Domain Spoofing Techniques That Bypass Chrome’s Phishing Protections appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

In Chrome 154, macOS displayed the Cyrillic lookalike of Apple (аррӏө.com) in Unicode on macOS with a valid certificate. However, the rule operates on an all-or-nothing basis.