Opera before 12.01 on Windows and UNIX and before 11.66 and 12.x before 12.01 on Mac OS X ignores some characters in HTML documents in unspecified circumstances which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted document.