Can you please clarify whether you are suggesting:

1) non-latin characters should be highlighted in the omnibox (feature request)

2) there is some security issue because when you highlight the URL in the omnibox, non-latin characters aren't highlighted?

1. it`s future request

first adress example
https://bugs.chromium.org

and adress
https://bugs.chrоmium.org

in the first case, using the Latin o. In second case, using russian letter о.
But 'look exactly the same, so you cannot trust what is written in the Omnibox. It can always be fishing attack

#2 I can't reproduce this on Linux. Can you provide details about your platform and Chrome version (from chrome://version)?

Chrome already has protection built in for this: domains with mixed scripts are shown in Punycode so it's obvious they are not right.

See attached screenshot: the second URL (https://bugs.chrоmium.org) shows up as https://bugs.xn--chrmium-cjg.org/.

If there is a bug here, it's because the domain label "chrоmium" is not being correctly converted into Punycode (there is no highlighting required).

Deleted: omnibox-idna.png 7.4 KB

	omnibox-idna.png 7.4 KB View Download

I don't think this is a report of an existing Chrome bug (see first words of comment 2), it's an issue the reporter is assuming is a potential problem, which we actually already protect against.

#5: But the reporter attached an actual screenshot of the problem (see initial report).

I suspect what's really going on is that the reporter has pasted the URL into the address bar but not confirmed it yet, in which case this is WAI. But I will wait until they confirm that.

That's a screenshot of the normal URL, with the 'o' circled saying "if this weren't a Latin character, there would be a problem".

You can tell because there is no bugs.chrоmium.org today (it's NXDOMAIN).

#7 You mean there is no bugs.xn--chrmium-cjg.org today, and if one navigated there it would show a grey "https" with no padlock?

Good point, this can't be a legit screenshot.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot