Bidirectional text
Bidirectional text refers to text containing characters from scripts with opposing horizontal writing directions, primarily left-to-right (LTR) scripts such as Latin-based languages like English and right-to-left (RTL) scripts such as Arabic and Hebrew.[1][2] To ensure correct visual rendering of such mixed-direction content, computing systems employ the Unicode Bidirectional Algorithm (UBA), a standardized process that reorders characters from their logical storage sequence in memory to the appropriate display order.[1][3]
The UBA, detailed in Unicode Standard Annex #9, processes text in four primary phases: first, separating the input into independent paragraphs using paragraph separators; second, initializing each character's bidirectional type (strong, weak, neutral, or explicit) and base embedding level based on the paragraph's direction; third, resolving embedding levels through explicit directional formatting characters and implicit rules for weak and neutral types; and fourth, reordering directional runs—maximal sequences of characters sharing the same embedding level—within each line for final display.[1] Embedding levels are numeric values from 0 to 125, where even levels indicate LTR direction and odd levels indicate RTL, allowing nested directional contexts up to a practical depth of 61 pairs.[1] Characters are classified by inherent properties: strong directional ones like Latin letters (LTR) or Hebrew letters (RTL), weak ones like European numbers that adapt to surrounding context, and neutral ones like punctuation that inherit direction from adjacent runs or the base paragraph direction.[1][3]
Historically, the UBA extends earlier implicit bidirectional models in Unicode, with major enhancements in version 6.3 (2013) introducing directional isolates (e.g., U+2066 to U+2069) and first-strong isolates to limit the scope of directional changes, preventing unintended effects on surrounding text and improving compatibility with legacy documents.[1] These updates address common challenges in bidirectional text handling, such as mirroring paired punctuation (e.g., parentheses flipping in RTL contexts) and resolving ambiguities in mixed numeral systems, where digits may embed LTR even in RTL paragraphs.[1][3]
In modern computing, bidirectional support is integral to internationalization (i18n) standards, implemented in operating systems like Windows via Unicode properties and control characters (e.g., U+200F Right-to-Left Mark for forcing RTL flow), as well as in web browsers through CSS properties like unicode-bidi and direction.[3][2] For web content, the base direction can be set using HTML's dir attribute (e.g., dir="rtl"), ensuring consistent rendering across diverse linguistic environments, though developers must account for issues like caret positioning during editing or neutral character resolution at direction boundaries.[2] Overall, the UBA enables seamless global text interchange, supporting users of RTL scripts while maintaining logical order for storage and processing efficiency.[1][3]
Fundamentals
Definition and Overview
Bidirectional text refers to sequences of characters that mix left-to-right (LTR) and right-to-left (RTL) directional scripts, requiring algorithmic reordering to achieve correct visual presentation.[1]
This phenomenon arises from the fundamental differences in writing systems: LTR for Latin-based languages like English, and RTL for Semitic languages such as Arabic and Hebrew, which often appear together in multilingual documents or interfaces.[2][4]
A simple example is the string "Hello שלום", where the Hebrew word "שלום" (meaning "peace") is rendered in RTL order—reversing its characters visually—while embedded within the LTR "Hello", resulting in the RTL portion appearing to the right but reading from right to left.[2]
In computing, accurate bidirectional text rendering is crucial for maintaining readability in digital applications, web pages, and software interfaces supporting global users, preventing confusion in mixed-language content.[1][4]
The Unicode standard addresses this through its Bidirectional Algorithm, ensuring consistent display across diverse platforms.[1]
Historical Context
Bidirectional writing practices trace their roots to ancient civilizations, where script directions varied to accommodate inscription surfaces or aesthetic needs. One of the earliest forms was boustrophedon, a method alternating line directions from left-to-right and right-to-left, akin to an ox plowing a field. This style appeared in ancient Greek inscriptions as early as the 8th century BCE, with examples like the Dipylon Oinochoe vase from Athens demonstrating careful reversal of characters to maintain legibility across lines.[5] Etruscan inscriptions from the 7th century BCE, influenced by Greek contact, also frequently employed boustrophedon, as seen in early monumental texts on stone and metal, reflecting a transitional phase before standardization to consistent directions.[6]
Semitic scripts established a more uniform right-to-left orientation that profoundly shaped later writing systems. The Phoenician alphabet, developed around 1200 BCE in the Levant, was consistently inscribed from right to left, omitting vowels for efficiency in trade and administration. This directionality directly influenced the Hebrew script by the 10th century BCE, where shared consonantal forms and phonetic principles preserved the RTL flow in biblical and epigraphic texts. Similarly, through intermediate Aramaic adaptations around the 9th century BCE, Phoenician RTL conventions evolved into the Arabic script, standardizing right-to-left writing across the Islamic world by the 7th century CE.[7]
Other historical systems exhibited bidirectional flexibility tied to visual or contextual cues rather than strict linearity. In ancient Egyptian hieroglyphs, dating from circa 3200 BCE, the reading direction was determined by the orientation of figures—human and animal glyphs faced toward the start of the text, allowing seamless shifts between left-to-right and right-to-left flows within the same composition, as evidenced in tomb inscriptions and stelae.[8]
The advent of printing in the 15th–16th centuries amplified challenges for bidirectional and mixed scripts, predating digital solutions. Early European presses struggled with RTL languages like Hebrew and Arabic, requiring custom type molds for cursive joins and multiple letter variants—up to four forms per Arabic character—resulting in laborious, error-prone composition by undertrained compositors. Mixed-language texts, such as early Arabic works printed in Italy from 1514, demanded reversed setting and frequent plate realignments, limiting production and fidelity to manuscript traditions until specialized foundries emerged in the 19th century.[9][10]
Technical Standards
Unicode Bidirectional Support
The Unicode Standard establishes a foundational framework for handling bidirectional text via its Bidirectional Algorithm, initially specified in version 2.0, released in July 1996.[1][11] This algorithm outlines rules for resolving the visual ordering of text that mixes left-to-right (LTR) and right-to-left (RTL) scripts, enabling consistent rendering across diverse writing systems without requiring script-specific adjustments in applications.[1]
At its core, the algorithm operates on a paragraph-by-paragraph basis, embedding each unit of text independently to isolate directional behavior.[1] It determines the implicit base direction from the first strong directional character in the paragraph, such as an LTR letter or RTL character, and supports explicit overrides through dedicated formatting controls to force specific directions when needed.[1] In resolving implicit direction, the algorithm relies on character classifications, such as left-to-right or right-to-left types, which are detailed elsewhere.[1]
The Bidirectional Algorithm has evolved through successive Unicode versions, with a key enhancement in Unicode 6.3 (released September 2013) introducing bidirectional isolates to manage nested directional runs more precisely, limiting their scope and reducing interference with adjacent text.[1] The Unicode Consortium maintains ongoing refinements to the algorithm, ensuring compatibility with new scripts and internationalization requirements.[1]
This support extends to broader standards, where the algorithm informs implementations in HTML and CSS—such as the dir="rtl" attribute for declaring base direction—and is realized in open-source libraries like the International Components for Unicode (ICU), which provides robust bidirectional text processing for software applications.[1][12]
Character Classification
In bidirectional text processing, characters are classified into categories based on their inherent directional behavior, which determines how they influence the ordering of text in mixed-direction scripts. These classifications are defined by the Unicode Bidirectional Algorithm and form the foundation for resolving text directionality. The primary property governing this is the Bidi_Class, a normative Unicode character property that assigns one of 23 possible bidirectional types to each code point, including unassigned and private-use characters.[1]
Characters are grouped into three main categories: strong, weak, and neutral, with additional explicit formatting types for directional control. Strong characters have a fixed direction that strongly influences surrounding text: L for left-to-right (e.g., Latin letters like A), R for right-to-left (e.g., Hebrew letters like א), and AL for right-to-left Arabic letters (e.g., Arabic ا). Weak characters adopt direction based on context, such as EN for European numbers (e.g., digits 0-9), AN for Arabic numbers (e.g., Eastern Arabic-Indic digits ٠-٩), ES for European number separators (e.g., + or -), ET for European number terminators (e.g., $ or °), CS for common separators (e.g., , or ;), and NSM for nonspacing marks (e.g., diacritics like acute accent ´). Neutral characters have no inherent direction and resolve based on adjacent strong types, including B for paragraph separators (e.g., ¶), S for segment separators (e.g., tab), WS for whitespace (e.g., space), and ON for other neutrals (e.g., most punctuation like !).[1][13]
Explicit embedding and isolate types provide mechanisms for overriding or isolating directional runs: LRE, RLE, LRO, and RLO for legacy embedding and overrides; LRI, RLI, FSI, and PDI for isolates; and PDF and BN for format and boundary neutrals. These types are assigned via the Unicode Character Database, where unassigned code points default to strong types (L or R based on script) and private-use characters may vary by implementation. Additional properties refine classification: Bidi_Mirrored indicates characters that mirror their glyphs in right-to-left contexts (e.g., parentheses () become )( ), while Bidi_Paired_Bracket identifies paired brackets (with types Open or Close) to ensure proper matching within directional runs, typically treating them as ON unless specified otherwise.[1][13]
The following table summarizes the bidirectional character types, their abbreviations, descriptions, and representative examples (based on Unicode 15.1 data, with approximate character counts for scale):
| Category | Type | Description | Examples (Unicode Code Points) | Approx. Count |
|---|
| Strong | L | Left-to-Right | A (U+0041), α (U+03B1) | 112,000 |
| R | Right-to-Left | א (U+05D0), ܐ (U+0710) | 3,700 |
| AL | Right-to-Left Arabic | ا (U+0627), ދ (U+078B) | 1,100 |
| Weak | EN | European Number | 1 (U+0031), १ (U+0967) | 10 |
| ES | European Number Separator | + (U+002B), − (U+2212) | 2 |
| ET | European Number Terminator | ¢ (U+00A2), ₹ (U+20B9) | 5 |
| AN | Arabic Number | ٠ (U+0660), ১ (U+09E7) | 30 |
| CS | Common Number Separator | : (U+003A), ، (U+060C) | 3 |
| NSM | Nonspacing Mark | ̀ (U+0300), ◌̥ (U+0325) | 1,900 |
| BN | Boundary Neutral | (U+00AD), (U+200C) | 27 |
| Neutral | B | Paragraph Separator | ¶ (U+00B6), ‡ (U+2029) | 5 |
| S | Segment Separator | (U+000C), � (U+001D) | 2 |
| WS | Whitespace | (U+0020), (U+2009) | 17 |
| ON | Other Neutral | ! (U+0021), © (U+00A9) | 460 |
| Explicit | LRE | Left-to-Right Embedding | (U+202A) | 1 |
| LRO | Left-to-Right Override | (U+202D) | 1 |
| RLE | Right-to-Left Embedding | (U+202B) | 1 |
| RLO | Right-to-Left Override | (U+202E) | 1 |
| PDF | Pop Directional Format | (U+202C) | 1 |
| LRI | Left-to-Right Isolate | (U+2066) | 1 |
| RLI | Right-to-Left Isolate | (U+2067) | 1 |
| FSI | First Strong Isolate | (U+2068) | 1 |
| PDI | Pop Directional Isolate | (U+2069) | 1 |
Bidirectional Algorithm
The Unicode Bidirectional Algorithm (UBA), defined in Unicode Standard Annex #9, is a standardized process for determining the correct visual ordering of bidirectional text, ensuring that left-to-right (LTR) and right-to-left (RTL) scripts display properly when mixed.[1] It operates on a sequence of characters, each classified by bidirectional type from the Unicode Character Database, such as strong (L for LTR, R or AL for RTL), weak (e.g., numbers like EN), neutral (e.g., punctuation like ON), or explicit formatting controls.[1] The algorithm proceeds in sequential rules to resolve embedding levels and reorder the text for rendering, without altering the logical storage order.[1]
The process begins with identifying the base direction of each paragraph (rules P1–P3). The text is first split into paragraphs at paragraph separators. The base embedding level is then set to 0 (LTR) if the first strong directional character is of type L, or to 1 (RTL) if it is R or AL; if no strong character is found, the base direction defaults to LTR or follows higher-level protocols.[1] Next, explicit embeddings and overrides are resolved (rules X1–X10), processing directional formatting characters like LRE (start LTR embedding), RLE (start RTL embedding), LRO/RLO (overrides), and their terminators PDF, PDI, along with isolates (LRI, RLI, FSI) that limit the scope of embeddings to prevent deep nesting issues. These are managed via a directional status stack with a maximum depth of 125 to avoid overflow.[1]
Weak and neutral types are then resolved relative to their neighbors and the embedding direction (rules W1–W7 and N1–N2). Weak characters, such as European numbers (EN) or Arabic numbers (AN), adopt the direction of adjacent strong types or the embedding level, with rules adjusting for contexts like numbers following RTL text (e.g., EN becomes AN). Neutral characters, including most punctuation and whitespace, take the direction of the nearest strong type or the paragraph embedding level, with special handling for paired brackets.[1] Following this, implicit levels are assigned (rules I1–I2): characters of type L, EN, or AN receive even levels matching the embedding parity, while R types receive odd levels.[1]
The resolved text is segmented into bidirectional runs, defined as contiguous sequences of characters with the same resolved embedding level and direction.[1] These runs are then reordered for visual display (rules L1–L4). Separators and whitespace are reset to the paragraph level (L1), and runs are reversed within each higher embedding level, starting from the highest odd level down to the base, to achieve the correct visual order.[1] Finally, mirroring is applied (L4): characters with resolved RTL direction and the Bidi_Mirrored property (e.g., < becomes >) are replaced with their mirrored glyphs.[1]
A high-level pseudocode summary of the resolution phases is as follows:
For each paragraph in the text:
Split at paragraph separators (P1)
Determine base embedding level from first strong character (P2–P3)
Process explicit directional formatting to set embedding levels (X1–X10)
For each isolating run sequence:
Resolve weak types based on neighbors (W1–W7)
Resolve neutral types to strong or embedding direction (N1–N2)
Assign implicit levels (I1–I2)
For each rendering line:
Identify and form level runs (L1)
Reorder runs by embedding level (L2)
Adjust marks and numerics (L3)
Apply mirroring for RTL mirrored characters (L4)
For each paragraph in the text:
Split at paragraph separators (P1)
Determine base embedding level from first strong character (P2–P3)
Process explicit directional formatting to set embedding levels (X1–X10)
For each isolating run sequence:
Resolve weak types based on neighbors (W1–W7)
Resolve neutral types to strong or embedding direction (N1–N2)
Assign implicit levels (I1–I2)
For each rendering line:
Identify and form level runs (L1)
Reorder runs by embedding level (L2)
Adjust marks and numerics (L3)
Apply mirroring for RTL mirrored characters (L4)
The UBA has limitations, as it focuses solely on horizontal bidirectional reordering and does not support vertical text orientations or complex layouts, which are handled by higher-level systems such as CSS Writing Modes or layout engines.[1]
Script Applications
Right-to-Left Scripts
Right-to-left (RTL) scripts are writing systems where text is primarily arranged from right to left, a directionality that necessitates specific bidirectional handling when mixed with left-to-right (LTR) elements. Among the primary RTL scripts are Hebrew, Arabic, Syriac, Persian (Farsi), Urdu, Pashto, and Kurdish (Sorani dialect), with Arabic-script variants like Persian, Urdu, and others adapting the cursive forms for their phonologies while maintaining RTL flow. Each of Hebrew, Arabic, and Syriac belongs to the Semitic language family and functions as abjads where consonants form the core of the writing system, with vowels often indicated optionally via diacritics.[21][22]
Hebrew employs a square script, characterized by block-like letter forms that do not connect cursively; it primarily represents consonants, with niqqud diacritics for vowels used mainly in educational or religious contexts. Arabic, in contrast, is a cursive script where letters adopt contextual joining forms—initial, medial, final, or isolated—depending on their position within a word, and it frequently incorporates harakat diacritics for short vowels and pronunciation nuances. Persian uses a modified Arabic script with additional letters for sounds like /p/, /ch/, /zh/, and /g/, retaining cursive RTL directionality. Urdu similarly adapts Arabic script with extra characters for Indic sounds, often including more diacritics (zer, zabar) for vowels. Syriac and related Semitic variants, such as those used for Neo-Aramaic languages, also feature cursive connections similar to Arabic, with combining diacritics like qushshaya and rukkakha for vocalization, though they include unique elements like the ligature for the letter Waw with a vertical stroke.[21]
In bidirectional contexts, these scripts establish an RTL base direction, embedding LTR segments for elements like European numerals and dates, which maintain their natural left-to-right order within the flow; for instance, a date such as "2025-11-10" appears with the year reading LTR amid surrounding RTL text. Punctuation in these scripts often undergoes mirroring as per the Unicode Bidirectional Algorithm—for example, opening parentheses visually flip to closing forms in RTL runs to preserve logical pairing. The Unicode Bidirectional Algorithm ensures proper reordering and mirroring for these scripts when integrated with LTR content.[1]
Modern adaptations for RTL scripts include specialized keyboard layouts and font technologies to facilitate digital input and display. The Hebrew QWERTY layout, a phonetic mapping on standard QWERTY keyboards, assigns Hebrew letters to keys based on English sound approximations (e.g., 'k' for Kaf), enabling bilingual users to switch seamlessly between Hebrew and Latin input. For Arabic, Persian, Urdu, and Syriac, fonts must support OpenType shaping tables to render correct joining forms and ligatures, ensuring cursive connectivity across digital platforms.[23][21]
These scripts are prevalent in the Middle East, North Africa, and South Asia, where they serve over 500 million speakers as of 2025, predominantly Arabic (around 400 million), Persian (around 110 million), and Urdu (around 70 million) users, underscoring their cultural and communicative significance in regions spanning from Morocco to Pakistan.[24][25]
Mixed-Direction Examples
Bidirectional text frequently arises in multilingual settings where left-to-right (LTR) elements, such as email addresses, are embedded within right-to-left (RTL) scripts like Arabic. For instance, an Arabic sentence describing a contact might include an LTR email like "[email protected]", which the bidirectional algorithm isolates to prevent reversal while the surrounding Arabic flows from right to left.[26] Similarly, Hebrew documents often incorporate LTR URLs, such as "https://www.example.com", maintaining their sequential order amid RTL text to ensure hyperlinks remain functional and readable.[1] Product labels in bilingual markets, like those combining English brand names with Arabic descriptions, rely on bidi handling to display prices or instructions without visual disruption, as seen in consumer goods sold across the Middle East.[27]
The visual rendering of mixed-direction text involves reordering characters according to the Unicode Bidirectional Algorithm, grouping LTR segments appropriately within RTL contexts. A representative example is the English phrase "Price: $100" inserted into an Arabic paragraph, which displays as "$100 :Price" on screen, with the numeric value and colon mirroring to align with RTL flow while preserving the internal LTR logic of the price.[1] This reordering extends to other neutrals like punctuation, ensuring commas or parentheses pair correctly with adjacent strong directional characters, as demonstrated in mixed sentences like Arabic text quoting English prices or dates.
Software applications handle these scenarios through built-in bidi support. Microsoft Word introduced comprehensive RTL and bidirectional features in Office 2000, enabling users to toggle paragraph directions, embed LTR isolates for emails or URLs, and process mixed-script documents like bilingual reports.[28] Web browsers such as Firefox and Chrome implement the algorithm natively via CSS properties like unicode-bidi and direction, rendering inline mixed content—such as Hebrew pages with embedded English URLs—correctly across platforms. [29]
Culturally, bidirectional text appears in public signage across diverse regions. In Israel, road signs use trilingual layouts with Hebrew (RTL) on top, followed by Arabic (RTL) and English (LTR) on separate lines, avoiding inline mixing to simplify reading for tourists and locals alike.[30] In the UAE, directional signs and product labels pair Arabic (RTL) with Latin (LTR) scripts, often isolating English terms like brand names or prices to maintain clarity in high-traffic areas like Dubai.[31]
Non-Alphabetic Systems
In ancient Egyptian hieroglyphic writing, the direction of reading is determined by the orientation of human and animal figures, which typically face toward the beginning of the text; a rightward-facing preference is dominant, allowing text to be arranged left-to-right or right-to-left accordingly.[32][33] This flexibility introduces bidirectional elements, as inscriptions on monuments or papyri could reverse direction within a single composition to suit artistic layouts. In the modern Gardiner's sign list, a standardized catalog of over 700 hieroglyphs compiled by Egyptologist Alan H. Gardiner, signs are conventionally oriented to face right, facilitating consistent scholarly transcription while preserving the script's inherent directional variability.[34]
CJK (Chinese, Japanese, and Korean) scripts, which employ logographic Han characters, are primarily rendered left-to-right in horizontal lines or top-to-bottom in vertical columns in contemporary usage, though ancient inscriptions and seals often exhibit bidirectional or rotational arrangements. For instance, Chinese seal scripts on chops or imprints frequently arrange characters in anti-clockwise or clockwise sequences to fit circular or square forms, requiring readers to interpret direction based on context rather than linear flow.[35] In the Unicode Standard, CJK characters are classified with the bidirectional class "L" (left-to-right), treating them as strong directional elements that do not inherently support right-to-left overrides, though neutral punctuation may interact in mixed-text scenarios.[36]
Boustrophedon writing, meaning "as the ox turns" in Greek, features alternating line directions—left-to-right followed by right-to-left—creating a bidirectional pattern akin to plowing a field; this method appears in various ancient non-alphabetic scripts but lacks native support in Unicode, relying on manual formatting or specialized tools for reproduction. The Mayan script of Mesoamerica, used from approximately 300 BCE to 900 CE, often employed boustrophedon in double-column blocks, where glyphs reversed direction at line ends to fill codex pages efficiently.[37] Similarly, the undeciphered Rongorongo script of Easter Island, dating to the 19th century or earlier, follows a reverse boustrophedon style, with lines read right-to-left then flipped 180 degrees for the next, as evidenced in surviving wooden tablets.[38]
Moon type, a tactile writing system developed in 1845 by British inventor William Moon for blind readers, adapts simplified Latin-derived symbols embossed on paper and employs a boustrophedon layout, alternating left-to-right and right-to-left across lines to optimize page space and finger navigation. This mirroring approach made it accessible for illiterate or elderly blind individuals familiar with print shapes, contrasting with Braille's fixed left-to-right progression. Historically promoted in 19th-century Britain by the British and Foreign Blind Association, Moon type saw widespread use until the early 20th century, with approximately 300 books and other works produced.[39][40][41]
Challenges and Considerations
Rendering Issues
Rendering bidirectional text presents several challenges across different platforms and software implementations, often deviating from the ideal standards outlined in the Unicode Bidirectional Algorithm. One common issue arises in legacy software, where incorrect reordering of characters occurs due to incomplete support for complex scripts. For instance, prior to the introduction of Uniscribe in Windows 2000, earlier versions like Windows 95 and 98 lacked robust bidirectional handling, leading to garbled display of mixed-direction text such as Arabic embedded in English.[42]
Nested embeddings exacerbate these problems, as improper nesting of directional controls can cause punctuation and neutral characters to associate with the wrong embedding level, resulting in visually incorrect layouts. The Unicode standard addresses this through explicit directional isolates (e.g., RLI, LRI, PDI) to prevent interference between embedded segments, but many implementations fail to handle deep nesting correctly, leading to reversed or misaligned text blocks.[43][44][45]
Platform variations further complicate rendering, with notable differences between mobile operating systems. iOS introduced stronger RTL support with Auto Layout in iOS 6 (2012), enabling automatic mirroring of layouts for languages like Arabic and Hebrew, though full UI overhauls came in iOS 9 (2015). In contrast, Android's bidirectional support evolved unevenly; versions prior to 4.2 (2012) offered minimal RTL handling, while later releases like Android 5.0+ integrated better bidi via HarfBuzz, but inconsistencies persist in text shaping for mixed scripts across devices.[46][47][48]
On the web, inconsistencies arise without explicit CSS controls like unicode-bidi: bidi-override, as browsers may apply the bidirectional algorithm differently, leading to erratic reordering of inline elements. For example, Firefox and Chrome have historically diverged in handling SVG RTL text with overrides, requiring developers to use the bdo element or directional formatting codes for consistent isolation.[49][50][51]
Accessibility challenges include screen readers mishandling bidirectional directions and multilingual content, which can disrupt the logical reading order for users. Developers are recommended to test with tools such as the Unicode text-rendering test suite, which includes bidi conformance tests, to ensure proper isolation and directionality in applications.[52][53]
Security Implications
Bidirectional text introduces significant security risks, particularly through homograph attacks where right-to-left (RTL) characters are used to visually mimic left-to-right (LTR) domains, deceiving users into interacting with malicious sites. For instance, attackers can embed RTL override characters to reverse the apparent order of characters in a URL, making a phishing domain like a spoofed "apple.com" appear legitimate while directing to a harmful endpoint. This technique, known as BiDi Swap, exploits the Unicode Bidirectional Algorithm's handling of mixed-direction scripts to create deceptive links that bypass casual inspection. BiDi Swap attacks continue to be reported in phishing campaigns as of 2025.[54][55]
Phishing campaigns have leveraged these vulnerabilities, with the Unicode Technical Standard #39 (UTS #39) highlighting bidi spoofing as a persistent threat since at least Unicode 10.0 in 2017, where reordering of characters like "A1<שׂ" to resemble "Αשֺ>1" enables visual confusion in identifiers such as email addresses or domains. In response, browsers implemented mitigations; Google Chrome addressed incorrect handling of RTL domains in its Omnibox via CVE-2018-18348, introducing stricter RTL detection and display rules starting with version 71.0.3578.80 in late 2018 to prevent spoofing.[56][57]
Algorithmic exploits further compound these risks, as overly long bidirectional embeddings or control sequences can trigger buffer overflows in text parsers. A notable example is CVE-2014-8146 in the International Components for Unicode (ICU) library, where the resolveImplicitLevels function in the bidirectional algorithm suffers a heap-based buffer overflow due to improper bounds checking on input levels, potentially leading to remote code execution in affected applications. Similarly, bidirectional override characters have been abused in supply-chain attacks, as detailed in the Trojan Source vulnerability (CVE-2021-42574), where hidden RTL/LTR controls reorder source code or text to conceal malicious logic from reviewers while preserving functional execution.[58][59]
Mitigations emphasize robust input validation and user warnings for mixed-script content, with standards like UTS #39 recommending restriction levels to limit dangerous character mixing and confusable detection via normalized skeletons. Unicode 15.0 (2022) enhanced security by reclassifying joiner control characters (e.g., U+200D Zero Width Joiner) as restricted in identifier contexts, reducing opportunities for isolation bypasses in bidirectional processing, while updates to UAX #9 improved algorithm isolation to counter reordering exploits. Browsers and libraries continue to evolve, with Chrome's IDN spoof checker enforcing script-specific policies and Punycode fallbacks for suspicious domains.[56][60][55]