Collected research

Multiple Browsers Cross Domain Charset Inheritance

Full Disclosure: Advisory 03/2007: Multiple Browsers Cross Domain Charset Inheritance Vulnerability

Stefan Esser · Full Disclosure

Pages without an explicit charset inherit a cross-origin parent frame’s encoding in affected Firefox, IE7 and Opera9 versions. An attacker can frame a target inside a UTF-7 page so encoded input bypasses XSS filters and becomes executable markup. The advisory identifies affected versions, disclosure dates and Firefox’s fix.

Record

Document

Full Disclosure: Advisory 03/2007: Multiple Browsers Cross Domain Charset Inheritance Vulnerability

Researcher

Stefan Esser

Published by

Full Disclosure

Topic

Browser

In the archive

• Collected in the 2007 research round

Tags

• charset
• encoding
• iframe
• xss
• filter-bypass
• same-origin-policy
• vendor-advisory
• owasp-a01-2021
• owasp-a02-2021
• owasp-a03-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Stefan Esser, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 10 September 2026.