v139 · security

Remove auto-detection of ISO-2022-JP charset in HTML

There are known[1] security issues around charset auto-detection for ISO-2022-JP. Given that the usage is very low, and Safari does not support auto-detection of ISO-2022-JP, we will remove support for it to eliminate the security issues.

concepts

  1. Encoding Detection

    ISO-2022-JP auto-detection in HTML is gone. Pages that rely on it must declare the encoding via <meta charset> or HTTP header. Removal closes a long-standing XSS sidechannel.

  2. XSS Sidechannel

    The reason for the removal: an attacker plants ISO-2022-JP escape bytes in an undeclared page, the sniffer re-decodes the stream, and smuggled <script> escapes a server-side sanitiser. Toggle charset declarations and see what each branch renders.

  3. Explicit Charset Guide

    Paste ISO-2022-JP bytes, declare a charset (or don't), and watch how Chrome 138 vs 139 each decode them. Each result tells you the security implication of leaving charset implicit.

  4. Content-Type Validator for Japanese Text

    Pick a Japanese script preset (Hiragana, Katakana, Kanji, Mixed) and see it in an encoding comparison table across UTF-8, Shift-JIS, EUC-JP, and ISO-2022-JP. A live Content-Type header validator and <meta charset> checker tell you whether Chrome 139 will handle your page correctly.

why it shipped

There are known[1] security issues around charset auto-detection for ISO-2022-JP. The use counter[2] shows that the auto-detection of ISO-2022-JP charset only happens around 0.000002% of page load. Given that usage is very low, and Safari does not support auto-detection of ISO-2022-JP, we will remove support for it to eliminate the security issues.

references