VULNERABILITY DETAILS
Browsing to a non-latin ".com" domain with cyrillic character isn't displayed in it's punycode version.

Hence, users which have been tricked into clicking on the phishing link will be show the misleading address in the URL bar.
As said in previous reports, this is problematic in many ways and the current set of forbidden characters for ".com" domains isn't complete enough or is not working as intended.

I registered today the following domain: xn--x1aaa.xn--80aa1boaj3b9g.com which maps to шнатѕарр.com.

I was expecting the punycode version to be displayed but this is not the case on MacOS, Linux and Android. I was also able to get a Let's Encrypt certificate for this domain which allows me to browse it using HTTPS.


VERSION
Chrome Version: Version 61.0.3163.100 (Official Build) (64-bit) / Version 61.0.3163.98 (Android)

Operating System: OSX 10.11.6 (15G31) / Ubuntu Linux 16.04 LTS amd64 / Android 7

REPRODUCTION CASE
Browse the following url: https://шнатѕарр.com
 

Deleted: Screen Shot 2017-10-12 at 22.35.06.png 138 KB

	Screen Shot 2017-10-12 at 22.35.06.png 138 KB View Download

Deleted: Screen Shot 2017-10-12 at 22.36.14.png 70.7 KB

	Screen Shot 2017-10-12 at 22.36.14.png 70.7 KB View Download