How Chromium Defends Against IDN Homograph Attacks

Internationalized Domain Names (IDNs) allow web addresses to contain non-ASCII characters, enabling native-language URLs for users worldwide. However, cybercriminals exploit this system through homograph attacks, registering domains with foreign characters that look visually identical to standard Latin letters to phish unsuspecting users. To protect against this, the Chromium web browser employs a multi-layered defense system that evaluates domain names using script-mixing rules, confusable character tables, and top-domain comparisons, automatically unmasking deceptive URLs by reverting them to their raw ASCII format in the address bar.

The Core Defense: Punycode Fallback

To understand Chromium's defense, it is necessary to understand how IDNs work. The Domain Name System (DNS) historically only understood ASCII characters. To accommodate international characters (Unicode), browsers use a translation system called Punycode. Punycode translates Unicode strings into an ASCII-compatible encoding format, which always begins with the prefix xn--.

For example, if an attacker registers apple.com using the Cyrillic small letter "а" instead of the Latin "a", the browser translates this behind the scenes to xn--pple-43d.com.

Chromium does not necessarily block users from visiting suspected homograph domains. Instead, its primary defense is Punycode fallback. If Chromium’s algorithms determine a domain name is attempting to spoof another, it refuses to render the Unicode characters in the address bar. The user sees xn--pple-43d.com instead of apple.com, making the deception obvious.

1. Script-Mixing Restrictions

The most common homograph attack involves replacing a single Latin character in a well-known domain name with a look-alike character from another alphabet (like Greek or Cyrillic).

Chromium prevents this by analyzing the scripts used within each label of a domain name (a label is the text between the dots). Legitimate domain names rarely mix different writing systems within the same word. Chromium follows the Unicode Technical Standard #39 (UTS #39) to enforce strict script-mixing rules:

  • Single Script Rule: By default, a domain label must consist of characters from a single script. Mixing Latin and Cyrillic in the same word immediately triggers the Punycode fallback.
  • Allowed Combinations: Chromium allows specific, logical exceptions for languages that naturally mix scripts. For example, Japanese domains are permitted to mix Kanji, Hiragana, Katakana, and Latin ASCII characters.

2. Whole-Script Confusable Detection

Attackers bypassed early script-mixing rules by creating "whole-script" confusables. Instead of mixing one Cyrillic letter into a Latin word, the attacker writes the entire word using only Cyrillic letters that happen to look like Latin letters (such as аррӏе.com, written entirely in Cyrillic).

Because the domain uses only one script, it passes the script-mixing check. To stop this, Chromium uses whole-script confusable detection:

  • Chromium maintains lists of characters in non-Latin scripts (like Cyrillic, Greek, and Hebrew) that are visually indistinguishable from Latin characters.
  • If a domain label is written entirely in a non-Latin script, Chromium checks if every character in that label belongs to the look-alike list.
  • If the entire word is composed of look-alike characters, Chromium assumes it is spoofing a Latin word and displays the domain in Punycode.

3. Skeleton Matching Against Top Domains

Some attacks are more subtle and try to mimic top-tier websites using characters from allowed script combinations or by exploiting similar-looking Latin characters (like using a lowercase "L" to mimic an uppercase "i", or combining r and n to look like m).

To defend high-value targets, Chromium utilizes a "skeleton" matching algorithm:

  • Generating a Skeleton: Chromium converts the visited domain name into a visual "skeleton." This process strips diacritics (accents) and maps all visually similar characters across all languages to a single, standardized base character.
  • Top Domain Comparison: Chromium ships with a pre-compiled list of the skeletons of the most popular domains on the internet (e.g., Google, PayPal, Amazon).
  • Collision Detection: When a user visits an IDN, Chromium generates its skeleton and compares it against the top-domains list. If there is a match—and the visited domain is not the actual top domain—Chromium forces the URL to display as Punycode.

4. Character Blacklisting and Contextual Rules

Unicode contains hundreds of thousands of characters, including emojis, mathematical symbols, and invisible formatting spaces, many of which have no business being in a URL. Chromium enforces strict character-level policies to eliminate abuse:

  • Disallowed Characters: Symbols that look like slashes (/) or dots (.) are strictly forbidden from rendering as Unicode, as attackers use them to fake directory paths or subdomains.
  • Contextual Checks: Certain characters, such as combining marks (accents and umlauts), are only allowed in specific contexts. Chromium prevents attackers from stacking multiple accents on a single letter to obscure it, and blocks invisible characters (like the Zero-Width Joiner) unless they are strictly required to render a specific script, such as Arabic or Indic languages.
  • Digit Mixing: Digits from different numbering systems (such as standard ASCII numbers and Eastern Arabic numerals) cannot be mixed within the same domain label.