HTML does not specify charset
Summary: When an HTML response declares its content type but omits a character set, the browser analyzes the HTML and guesses which character set it uses, and non-standard characters anywhere in the response can cause it to interpret the content under a different character set. PortSwigger notes this can produce unexpected results and lead to cross-site scripting vulnerabilities where non-standard encodings like UTF-7 bypass the application's defensive filters, though in most cases the missing charset directive is not a security flaw, particularly for static content.
Why it matters: The gap is a browser behavior your filters don't control: a response that looks like UTF-8 can be re-read under an encoding like UTF-7, and the payload that slips past your defensive filters is the one you never saw as an encoding problem.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026