You are here: Security Center > Mozilla Foundation Security Advisories > MFSA 2010-61

Mozilla Foundation Security Advisory 2010-61

Title: UTF-7 XSS by overriding document charset using <object> type attribute
Impact: High
Announced: September 7, 2010
Reporter: David Huang, Collin Jackson
Products: Firefox, Thunderbird, SeaMonkey

Fixed in: Firefox 3.6.9
  Firefox 3.5.12
  Thunderbird 3.1.3
  Thunderbird 3.0.7
  SeaMonkey 2.0.7


Security researchers David Huang and Collin Jackson of Carnegie Mellon University CyLab (Silicon Valley campus) reported that the type attribute of an <object> tag can override the charset of a framed HTML document, even when the document is included across origins. A page could be constructed containing such an <object> tag which sets the charset of the framed document to UTF-7. This could potentially allow an attacker to inject UTF-7 encoded JavaScript into a site, bypassing the site's XSS filters, and then executing the code using the above technique.