Later archive addition

Multiple Browsers Cross Domain Charset Inheritance

Stefan Esser · Full Disclosure

Pages without an explicit charset inherit a cross-origin parent frame’s encoding in affected Firefox, IE7 and Opera9 versions. An attacker can frame a target inside a UTF-7 page so encoded input bypasses XSS filters and becomes executable markup. The advisory identifies affected versions, disclosure dates and Firefox’s fix.

Record

Researcher

Stefan Esser

Published by

Full Disclosure

In the archive

• Added to the 2007 archive after the original list was published

Tags

• charset
• encoding
• iframe
• xss
• filter-bypass
• same-origin-policy
• vendor-advisory
• owasp-a01-2021
• owasp-a02-2021
• owasp-a03-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Stefan Esser, first published at the original source. Preserved copies are kept so the citation survives its host.