IDNA ContextJ rules

at a glance

background: IDNA and ContextJ

Internationalized Domain Names in Applications (IDNA) defines how non-ASCII characters in domain names are encoded and validated. The URL Standard invokes IDNA processing with the CheckJoiners flag, which enables the ContextJ rules from IDNA2008/Unicode Technical Standard 46.

ContextJ rules restrict where the invisible formatting characters ZWNJ (U+200C, Zero Width Non-Joiner) and ZWJ (U+200D, Zero Width Joiner) may appear in domain labels. These characters are legitimate in scripts like Arabic and Indic where they affect shaping, but only in specific phonetically valid positions. Allowing them anywhere creates a security risk: a malicious domain can contain ZWJ/ZWNJ to produce a label that looks identical to a legitimate domain in a browser address bar.

what changed in Chrome 148

Before Chrome 148, Chrome did not enforce ContextJ rules when parsing URLs. A URL containing ZWJ or ZWNJ in a domain label would be parsed and resolved without error — even in positions the IDNA specification disallows.

Chrome 148 passes the UIDNA_CHECK_CONTEXTJ option to ICU when processing domain labels. URLs that violate ContextJ rules are now treated as invalid:

• Navigation to such a URL produces a network error.
• new URL('http://example‌.com/') throws a TypeError.
• The change fixes over 200 previously-failing WPT subtests for IDNA URL parsing.

impact on web content

Legitimate content is not affected. ZWJ and ZWNJ in domain names are only valid in narrow phonological contexts within specific scripts; no correct internationalized domain name uses these characters in the positions that are now rejected.

Sites that constructed URLs programmatically with embedded invisible characters (intentionally or through encoding bugs) will receive a failure instead of a silently accepted URL. This is the intended behaviour.

// Before Chrome 148: silently accepted
// Chrome 148+: throws TypeError — ZWNJ disallowed in this position
try {
  const url = new URL('http://xn--‌nexample.com/');
} catch (e) {
  console.error('Invalid URL:', e.message);
}

browser support

see also

• Unicode Technical Standard 46 — Unicode IDNA Compatibility Processing
• URL Standard — domain to Unicode
• MDN: URL constructor
• chromestatus.com — IDNA ContextJ rules (6295810820145152)