This is actually a browser issue, and was anticipated long before. A valid workaround would be to allow for input in Unicode, but display the url output in Punycode.

I'm pretty sure most popular browsers already account for this vulnerability. At the very least, Mozilla-forked browsers should still have a built-in defense against homograph attacks. [https://bugzilla.mozilla.org/show_bug.cgi?id=279099#c135]