UserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3074.0 Safari/537.36

Steps to reproduce the problem:
1. Register a domain with a kurdish unicode characters.
2. Create a hyperlink to that page.
3. Browse to the page in chrome.
4. Observe the browser displays the unicode instead of the puny code.

What is the expected behavior?
Chrome should display the punycode version of the URL instead of the kurdish unicode character. 

What went wrong?
Chrome recently fixed a security issue where unicode characters could be used in phishing attacks. The mitigation however is incomplete. It's possible to bypass the mitigations by using unicode chars from the Kurdish language. For example the following link: www.companîes.com
An attacker could register this domain and host a phishing page there. End users would believe they are visting companies.com 

References:
https://www.xudongz.com/blog/2017/idn-phishing/
https://codereview.chromium.org/2683793010

Did this work before? N/A 

Chrome version: 60.0.3074.0  Channel: canary
OS Version: OS X 10.12.4
Flash Version: Shockwave Flash 25.0 r0