Chrome users face typosquatting risks from Cyrillic-Latin character confusion
Threat actors exploit visual similarities between Cyrillic and Latin letters to mimic legitimate websites in Chromium-based browsers, according to The Register.
Key points
- Attackers use rare Cyrillic characters that resemble Latin letters to impersonate sites.
- The vulnerability affects Chromium-based browsers including Chrome and Edge.
- No specific patch or mitigation has been confirmed by vendors yet.
Organisations using Chromium-based browsers face a persistent phishing risk derived from character encoding ambiguities. Threat actors are leveraging the visual similarity between certain Cyrillic and Latin letters to create deceptive Uniform Resource Locators. According to a report by The Register, these subtle differences allow attackers to mimic popular websites with high fidelity, potentially deceiving users into trusting malicious domains.
How it unfolded
- Attackers began exploiting the visual overlap between Cyrillic and Latin alphabets in browser address bars.
- The Register reported that these techniques allow for the creation of convincing lookalike domains.
- The issue persists across multiple Chromium-based browsers without a confirmed vendor resolution.
Who is affected
Any organisation relying on Chromium-based web browsers is potentially affected by this issue. This includes users of Google Chrome, Microsoft Edge, and other derivatives that share the same rendering engine. The risk is particularly acute for employees who frequently interact with external web services, as the deceptive URLs can appear legitimate at a glance. The Register notes that the abuse involves rare Cyrillic letters that are visually indistinguishable from common Latin characters to many users.
The fix
No official fix or update has been confirmed by browser vendors to address this specific encoding ambiguity. The issue stems from the fundamental way Unicode characters are rendered, meaning a simple software patch may not fully resolve the visual deception. Users must remain vigilant and manually inspect domain names for subtle character differences. Until a definitive technical solution is provided by the vendors, the burden of detection remains with the end user and their security awareness training.
Background: Threat actors
A threat actor is any entity that initiates a cyber attack. They range from automated software to organised criminal groups. Understanding their motive helps you predict their behaviour. Most are not after you specifically but exploit common weaknesses for quick financial gain.
Read the full guide: Threat Actors Explained: Motives, Methods and Misconceptions
What to do and how to stay safe: Chromium
- Manually verify the spelling of domain names by hovering over links or typing them directly, checking for subtle Cyrillic characters.
- Implement strict URL filtering policies that flag domains containing mixed-script characters or non-Latin Unicode points.
- Train staff to recognise the visual differences between similar-looking Latin and Cyrillic letters in browser address bars.
- Monitor web traffic logs for connections to newly registered domains that mimic trusted services using homograph attacks.
Step-by-step guide: Incident Response Plans: Real Benefits and Hidden Costs
General security guidance from the Malware Brief newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which browsers are vulnerable to this typosquatting technique?
All Chromium-based browsers, including Google Chrome and Microsoft Edge, are affected because they share the same underlying rendering engine.
Is there a patch available to fix this issue?
No, no specific patch or update has been confirmed by vendors to resolve this character rendering ambiguity yet.
How do attackers create these deceptive websites?
They use rare Cyrillic characters that visually resemble Latin letters to construct domain names that look identical to legitimate sites.
