HTML uses unrecognized charset
Summary: PortSwigger Research describes an issue where an application specifies an unrecognized character set in HTML, prompting browsers to analyze the content and guess the encoding instead. The presence of non-standard characters anywhere in the response can cause the browser to interpret the content with a different character set, which the source says can lead to cross-site scripting vulnerabilities where encodings like UTF-7 bypass the application's defensive filters.
What you should know: The source notes that in most cases a missing valid charset directive is not a security flaw, particularly for static content, so the exposure depends on reviewing the affected responses and their context. The concrete stake is filter bypass: a non-standard encoding such as UTF-7 can let an attacker slip past the defensive filters the application relies on.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026