Material Symbols Ligature Origin Spoof Test

Current hostname:

Tests apakah target app UI (Brave Wallet, permission prompts, dll) menggunakan Material Symbols font yang akan render ligature substring (mis. verified, home, lock) sebagai icon glyph instead of plain text.

Control: how Material Symbols renders these words on this page

With Material Symbols Outlined font loaded:

verified home lock search settings download error info account_circle

↑ those words above render as ICONS (✓ 🏠 🔒 🔍 ⚙ ⬇ ⚠ ℹ 👤) when Material Symbols font is applied.

Same text without the font (plain):

verified home lock search settings download error info account_circle

↑ plain text.

Key insight: kalo target app's UI uses Material Symbols font for origin display text, the substring di hostname akan render sebagai icon glyph instead of letters. Most apps DON'T use Material Symbols for body text (it's an icon font, not text font) — but if any do for origin display, that's the bug.

Recommended subdomains untuk test

Bikin satu atau lebih subdomain berikut, host this PoC di sana, then open in target app:

Subdomain	Word that may render as icon	Icon if rendered	Trust signal impact
`verified.syarif07.my.id`	`verified`	✓ checkmark	HIGHEST (verified badge)
`home.syarif07.my.id`	`home`	🏠 house	HIGH (looks legit)
`lock.syarif07.my.id`	`lock`	🔒 padlock	HIGH (security signal)
`search.syarif07.my.id`	`search`	🔍 magnifier	MEDIUM
`account.syarif07.my.id`	`account`	👤 person	MEDIUM

My pick: verified.syarif07.my.id — kalo rendered, looks like "✓.syarif07.my.id" = strongest trust spoof.

Test buttons (sama seperti Google Sans test)

Brave Wallet UI

—

Chromium permissions (test di Chrome iOS / macOS / Android)

—

What to screenshot

For each prompt that opens, screenshot the area showing the origin/hostname text. Look for:

VULNERABLE: hostname shows an icon glyph instead of the letters (e.g., "✓.syarif07.my.id" or "🏠.syarif07.my.id")
SAFE: hostname shows plain text (e.g., "verified.syarif07.my.id")

Test on multiple apps if subdomain is set up:

Brave Wallet (Connect prompt, sign prompt)
Chrome iOS / macOS / Android (permission prompts)
Pinterest / Lark / Shopify / Twitter / Discord / Instagram (in-app browser viewing this page, maybe icon doesn't apply to origin pill but worth checking)
Any apps that use Material Design 3 with explicit Material Symbols dependency