You'll noticeTier: how much it should matter to you
3Useful: my rating, 1 to 5
2Signal: worth watching, 1 to 5
SandboxArea: what it touches
New FeaturesKind: in v2.1.251,
New FeaturesSection of the release
What
When a sandboxed process asks for network access, the prompt now refuses hosts whose spelling changes under international-domain normalization, the trick behind lookalike domain names. No permission rule is created and a warning is logged.
Details
Unconditional in the sandbox ask callback, not behind a flag.
Companion to the same check on session-level host grants.
Evidence
Refusing a sandbox network ask for a host srt would re-spell
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
