Cross-site scripting (XSS) vulnerability in Opera before 10.54 on Windows and Mac OS X and before 10.11 on UNIX platforms allows remote attackers to inject arbitrary web script or HTML via a data: URI related to incorrect detection of the \opening site.\