Top 10 winner

Lost in Translation: Exploiting Unicode Normalization

Ryan Barnett and Isabella Barnett · Black Hat · 6 January 2026

How Unicode handling diverges between a front-end proxy or CDN and the back-end application. Decoding errors, overlong encodings, byte truncation, confusables, case mapping and combining diacritics all let input that passes validation normalize later into a different, dangerous string, defeating filters and enabling injection or account takeover.

Record

Researcher

Ryan Barnett and Isabella Barnett

Published by

Black Hat

Date

6 January 2026

Format

Recording

In the archive

• Ranked #4 in the 2025 Top 10 Web Hacking Techniques

Related sources

• Slides
• Talk recording

Tags

• unicode
• encoding
• charset
• parser-differential
• filter-bypass
• waf-bypass
• url-parsing
• cdn
• auth-bypass
• owasp-a01-2021
• owasp-a02-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Ryan Barnett and Isabella Barnett, first published at the original source. Preserved copies are kept so the citation survives its host.