v148 · Security · Internationalized Domain Names

IDNA ContextJ rules

Chrome 148 enforces IDNA2008 ContextJ joining rules for internationalized domain names (IDN). Characters that require a specific joining context — such as Zero Width Joiner (ZWJ) and Zero Width Non-Joiner (ZWNJ) — are now validated to ensure they appear only in the Unicode contexts where they are permitted.

concepts

  1. ContextJ Demo

    Shows which domain name strings are accepted or rejected by Chrome 148's ContextJ validation. Includes examples of ZWJ and ZWNJ in valid and invalid positions within IDN labels.

  2. Rule Reference

    Explains the IDNA2008 ContextJ joining categories, what conditions each joining character requires, and why the rules exist to prevent visual spoofing attacks in internationalized hostnames.

  3. Domain Validator

    Enter any internationalized domain name and see whether it passes Chrome 148's ContextJ rules. The validator detects ZWJ and ZWNJ characters, explains the joining-context requirement, and shows a per-character Unicode breakdown including codepoints and joining category.

  4. Domain Security Auditor

    A full IDN security analysis tool: pick from 10 preset domains (including known homograph attacks), see IDNA decoding step-by-step, ContextJ rule application per label, a per-character Unicode breakdown, and a Chrome 148 verdict. A homograph attack gallery shows five famous IDN attacks and whether Chrome 148 blocks them.

  5. Homograph Detector

    Type any domain name into a browser-style address bar (or pick a preset) and see a per-character Unicode breakdown highlighting ZWJ (U+200D), ZWNJ (U+200C), Cyrillic/Greek homoglyphs, and other suspicious codepoints. A verdict panel shows whether Chrome 148 would BLOCK (ContextJ violation), flag as RISKY (visual homograph), or pass as SAFE — plus a gallery of five real-world IDN attacks.

why it shipped

IDNA (Internationalized Domain Names in Applications) allows domain labels to contain non-ASCII characters from scripts like Arabic, Indic, and others. Some Unicode characters are valid only in specific joining contexts — for example, ZWNJ (U+200C) is permitted between two characters of certain Arabic or Indic categories, but not elsewhere. Without enforcing these rules, malicious actors could register domains that look identical to legitimate ones but differ by an invisible character. Chrome 148 aligns with RFC 5891's ContextJ rules, making validation stricter and consistent with other IDNA2008 implementations.

the change

// Zero Width Non-Joiner (ZWNJ, U+200C) — context rules
// Valid: between Virama and a letter that allows it
// "काम‌काज" (Hindi: काम‌काज) — ZWNJ after Virama is valid

// Invalid: ZWNJ at start of label, between unrelated characters
// "example‌test.com" — rejected in Chrome 148+

// Zero Width Joiner (ZWJ, U+200D) — context rules
// Valid: after Virama (e.g. in Malayalam, Hindi)
// "ന‍ — ZWJ after Virama to form a ligature — valid

// Invalid: ZWJ between Latin characters
// "exam‍ple.com" — rejected in Chrome 148+

// Chrome 148 effect: domains using ZWJ/ZWNJ outside their
// permitted joining contexts are treated as invalid hostnames
// and navigation fails with an ERR_INVALID_URL error

references

implementation reference

Need the exact API surface, compatibility boundaries, errors, lifecycle, and source links? Read the matching gendn reference ↗