This of course applies to all URL encoded strings - the above was just an example.

Able to reproduce the issue on the latest canary(71.0.3551.0) and on stable(69.0.3497.81) on Windows-10,Mac OS 10.13.6 and Linux Debian Rodete. Similar behavior is seen on older chrome version 60.0.3094.0 as well.

Shows the expected behavior on other browsers(IE,Firefox,Edge). Attaching the screenshot of the same.

Triaging this as non regression issue for inputs from the respective team. Tentatively adding UI>Security>UrlFormatting component, feel free to change if not the same.

Deleted: 882933.png 91.2 KB

	882933.png 91.2 KB View Download

meacer: A URL display issue that's a bit different from the usual confusables, can you take a look? Thanks.

Some info:

The string "%E2%80%8B%E2%80%8B" is percent-encoding of U+200B U+200B (ZERO WIDTH SPACE x2).

Generally, spoofing consideration in URLs is only given to the origin, since the path isn't considered a security-sensitive surface. However, I can see how in this case, it might be considered spoofing, since you could impersonate someone else's Twitter account.

The URL standard (https://url.spec.whatwg.org/#url-rendering) does say:

"Other parts of the URL should have their sequences of percent-encoded bytes replaced with code points resulting from percent decoding those sequences converted to bytes, unless that renders those sequences invisible."

So it would be correct to keep these invisible sequences encoded in the path component.

I think non-host parts of the URL are handled by GURL, so I'm not the best owner for this.