BiDi Swap: A Decade-Old Unicode Flaw Still Enables URL Spoofing

BiDi Swap is a long-standing Unicode flaw that continues to enable URL spoofing by exploiting how browsers render mixed LTR and RTL scripts. The Varonis Threat Labs team highlights that attackers can craft deceptive URLs that appear legitimate while redirecting victims elsewhere, often used in phishing. The article notes that the Bidi Algorithm sometimes struggles with subdomains and URL parameters, creating gaps in display that mislead users.

As examples, it points to spoofed links that blend scripts to mimic trusted domains, and cites Chrome’s partial protection from its Navigation suggestion for lookalike URLs, while Firefox and Edge approaches differ. It also stresses that user awareness remains crucial and calls on browser developers to strengthen domain highlighting and lookalike detection. The piece was published on 22 September 2025. According to Varonis Threat Labs, these issues persist despite their long history, underscoring the need for ongoing vigilance against URL spoofing.