CVE-2007-1115: Opera Browser

Medium severity, CVSS 4.3. EPSS: 2.4% chance of exploitation in the next 30 days.

The child frames in Opera 9 before 9.20 inherit the default charset from the parent window when a charset is not specified in an HTTP Content-Type header or META tag, which allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated using the UTF-7 character set.

Affected products

• Opera Opera Browser: version 9.0 only; version 9.01 only; version 9.02 only; version 9.10 only; version 9.12 only; version 9.20 only

Published 2007-02-26. Last modified 2026-06-16.