Skip to content
OpenAdvisories

Weakness (CWE)

CWE-1007: Insufficient Visual Distinction of Homoglyphs Presented to User

Base Incomplete

The product displays information or identifiers to a user, but the display mechanism does not make it easy for the user to distinguish between visually similar or identical glyphs (homoglyphs), which may cause the user to misinterpret a glyph and perform an unintended, insecure action.

More detail

Adversaries can exploit this visual similarity for attacks such as phishing, e.g. by providing a link to an attacker-controlled hostname that looks like a hostname that the victim trusts. In a different use of homoglyphs, an adversary may create a back door username that is visually similar to the username of a regular user, which then makes it more difficult for a system administrator to detect the malicious username while reviewing logs.

How to prevent it (2 mitigations)

  1. Implementation

    Use a browser that displays Punycode for IDNs in the URL and status bars, or which color code various scripts in URLs.

    Due to the prominence of homoglyph attacks, several browsers now help safeguard against this attack via the use of Punycode. For example, Mozilla Firefox and Google Chrome will display IDNs as Punycode if top-level domains do not restrict which characters can be used in domain names or if labels mix scripts for different languages.

  2. Implementation

    Use an email client that has strict filters and prevents messages that mix character sets to end up in a user's inbox.

    Certain email clients such as Google's GMail prevent the use of non-Latin characters in email addresses or in links contained within emails. This helps prevent homoglyph attacks by flagging these emails and redirecting them to a user's spam folder.

Source: MITRE CWE-1007

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-48760

    Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense

    Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0 until 6.4.41, 7.4.13, and 8.0.13, UrlSanitizer::parse() rejected raw BiDi formatting characters but not percent-encoded forms and used an ASCII-only w…

    symfony symfony html-sanitizer symfony/symfony Debian Ubuntu Packagist
  • Medium 5.4
    CVE-2025-0996

    Inappropriate implementation in Browser UI in Google Chrome on Android prior to 133.0.6943.98 allowed a remote attacker…

    Google Chrome chromium qt6-qtwebengine Browsers Debian Alpine
  • Medium 4.3
    CVE-2021-4221

    If a domain name contained a RTL character, it would cause the domain to be rendered to the right of the path. This cou…

    Mozilla Firefox Browsers