New browser flaw lets hackers create fake web addresses that look real

Security researchers Ian Muscat and Leanne Briffa from Have I Been Squatted have identified a vulnerability in Chromium-based browsers, including Chrome and Edge. The discovery reveals that two specific non-ASCII characters can be exploited to create deceptive URLs. By utilizing these glyphs, attackers can bypass standard browser safety protocols to display fraudulent web addresses that appear identical to legitimate domains in Unicode, even though the underlying Punycode remains distinct.

This flaw expands the capabilities of phishers and typosquatters to execute sophisticated impersonation attacks. Because these lookalike URLs can reliably deceive users, businesses may face increased risks regarding digital identity and transaction security. Consequently, organizations might need to adjust their internal protocols for generating, distributing, or verifying sensitive documents such as tax filings and invoices to mitigate the threat of fraudulent communications.