Opera Maker of web browsers

By the Year

In 2025 there have been 1 vulnerability in Opera. Opera did not have any published security vulnerabilities last year. That is, 1 more vulnerability have already been reported in 2025 as compared to last year.

Recent Opera Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2020-6158	Feb 21, 2025	Opera Mini Android <=52.1: Address Bar Spoofing (CVE-2020-6158) Opera Mini for Android before version 52.2 is vulnerable to an address bar spoofing attack. The vulnerability allows a malicious page to trick the browser into showing an address of a different page. This may allow the malicious page to impersonate another page and trick a user into providing sensitive data.	Opera Mini
CVE-2018-16135	Dec 26, 2022	The Opera Mini application 47.1.2249.129326 for Android The Opera Mini application 47.1.2249.129326 for Android allows remote attackers to spoof the Location Permission dialog via a crafted web site.	Opera Mini
CVE-2021-23253	Jan 11, 2021	Opera Mini for Android below 53.1 displays URL left-aligned in the address field Opera Mini for Android below 53.1 displays URL left-aligned in the address field. This allows a malicious attacker to craft a URL with a long domain name, e.g. www.safe.opera.com.attacker.com. With the URL being left-aligned, the user will only see the front part (e.g. www.safe.opera.com) The exact amount depends on the phone screen size but the attacker can craft a number of different domains and target different phones. Starting with version 53.1 Opera Mini displays long URLs with the top-level domain label aligned to the right of the address field which mitigates the issue.	Opera Mini
CVE-2020-6159	Dec 23, 2020	URLs using javascript: have the protocol removed when pasted into the address bar to protect users URLs using javascript: have the protocol removed when pasted into the address bar to protect users from cross-site scripting (XSS) attacks, but in certain circumstances this removal was not performed. This could allow users to be socially engineered to run an XSS attack against themselves. This vulnerability affects Opera for Android versions below 61.0.3076.56532.	Opera
CVE-2020-6157	Nov 13, 2020	Opera Touch for iOS before version 2.4.5 is vulnerable to an address bar spoofing attack Opera Touch for iOS before version 2.4.5 is vulnerable to an address bar spoofing attack. The vulnerability allows a malicious page to trick the browser into showing an address of a different page. This may allow the malicious page to impersonate another page and trick a user into providing sensitive data.	Opera Touch
CVE-2019-12278	Mar 12, 2020	Opera through 53 on Android allows Address Bar Spoofing Opera through 53 on Android allows Address Bar Spoofing. Characters from several languages are displayed in Right-to-Left order, due to mishandling of several Unicode characters. The rendering mechanism, in conjunction with the "first strong character" concept, may improperly operate on a numerical IP address or an alphabetic string, leading to a spoofed URL.	Opera
CVE-2019-19788	Dec 18, 2019	Opera for Android before 54.0.2669.49432 is vulnerable to a sandboxed cross-origin iframe bypass attack Opera for Android before 54.0.2669.49432 is vulnerable to a sandboxed cross-origin iframe bypass attack. By using a service working inside a sandboxed iframe it is possible to bypass the normal sandboxing attributes. This allows an attacker to make forced redirections without any user interaction from a third-party context.	Opera
CVE-2019-18624	Oct 29, 2019	Opera Mini for Android Opera Mini for Android allows attackers to bypass intended restrictions on .apk file download/installation via an RTLO (aka Right to Left Override) approach, as demonstrated by misinterpretation of malicious%E2%80%AEtxt.apk as maliciouskpa.txt. This affects 44.1.2254.142553, 44.1.2254.142659, and 44.1.2254.143214.	Mini
CVE-2019-13607	Jul 18, 2019	The Opera Mini application through 16.0.14 for iOS has a UXSS vulnerability The Opera Mini application through 16.0.14 for iOS has a UXSS vulnerability that can be triggered by performing navigation to a javascript: URL.	Mini
CVE-2018-6608	Mar 28, 2018	In the WebRTC component in Opera 51.0.2830.55, after visiting a web site In the WebRTC component in Opera 51.0.2830.55, after visiting a web site that attempts to gather complete client information (such as https://ip.voidsec.com), the browser can disclose a private IP address in a STUN request.	Opera Browser
CVE-2016-4075	Apr 21, 2017	Opera Mini 13 and Opera Stable 36 Opera Mini 13 and Opera Stable 36 allow remote attackers to spoof the displayed URL via a crafted HTML document, related to the about:blank URL.	Opera Mini Opera Browser
CVE-2015-4000	May 21, 2015	The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, aka the "Logjam" issue.	Opera Browser
CVE-2011-3389	Sep 06, 2011	The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack.	Opera Browser
CVE-2009-3046	Sep 02, 2009	Opera before 10.00 does not check all intermediate X.509 certificates for revocation, which makes it easier for remote SSL servers to bypass validation of the certificate chain Opera before 10.00 does not check all intermediate X.509 certificates for revocation, which makes it easier for remote SSL servers to bypass validation of the certificate chain via a revoked certificate.	Opera Browser
CVE-2009-2540	Jul 20, 2009	Opera, possibly 9.64 and earlier Opera, possibly 9.64 and earlier, allows remote attackers to cause a denial of service (memory consumption) via a large integer value for the length property of a Select object, a related issue to CVE-2009-1692.	Opera Browser
CVE-2009-0915	Mar 16, 2009	Opera before 9.64 allows remote attackers to conduct cross-domain scripting attacks Opera before 9.64 allows remote attackers to conduct cross-domain scripting attacks via unspecified vectors related to plug-ins.	Opera Browser
CVE-2008-2716	Jun 16, 2008	Unspecified vulnerability in Opera before 9.5 Unspecified vulnerability in Opera before 9.5 allows remote attackers to spoof the contents of trusted frames on the same parent page by modifying the location, which can facilitate phishing attacks.	Opera Browser
CVE-2007-5276	Oct 08, 2007	Opera 9 drops DNS pins based on failed connections to irrelevant TCP ports Opera 9 drops DNS pins based on failed connections to irrelevant TCP ports, which makes it easier for remote attackers to conduct DNS rebinding attacks, as demonstrated by a port 81 URL in an IMG SRC, when the DNS pin had been established for a session on port 80.	Opera Browser
CVE-2007-4367	Aug 15, 2007	Opera before 9.23 allows remote attackers to execute arbitrary code via crafted Javascript Opera before 9.23 allows remote attackers to execute arbitrary code via crafted Javascript that triggers a "virtual function call on an invalid pointer."	Opera Browser
CVE-2007-3929	Jul 21, 2007	Use-after-free vulnerability in the BitTorrent support in Opera before 9.22 Use-after-free vulnerability in the BitTorrent support in Opera before 9.22 allows user-assisted remote attackers to execute arbitrary code via a crafted header in a torrent file, which leaves a dangling pointer to an invalid object.	Opera Browser
CVE-2007-2809	May 22, 2007	Buffer overflow in the transfer manager in Opera before 9.21 for Windows Buffer overflow in the transfer manager in Opera before 9.21 for Windows allows user-assisted remote attackers to execute arbitrary code via a crafted torrent file. NOTE: due to the lack of details, it is not clear if this is the same issue as CVE-2007-2274.	Opera Browser
CVE-2007-2274	Apr 25, 2007	The BitTorrent implementation in Opera 9.2 The BitTorrent implementation in Opera 9.2 allows remote attackers to cause a denial of service (CPU consumption and application crash) via a malformed torrent file. NOTE: the original disclosure refers to this as a memory leak, but it is not certain.	Opera Browser
CVE-2007-1377	Mar 10, 2007	AcroPDF.DLL in Adobe Reader 8.0, when accessed from Mozilla Firefox, Netscape, or Opera, allows remote attackers to cause a denial of service (unspecified resource consumption) via a .pdf URL with an anchor identifier AcroPDF.DLL in Adobe Reader 8.0, when accessed from Mozilla Firefox, Netscape, or Opera, allows remote attackers to cause a denial of service (unspecified resource consumption) via a .pdf URL with an anchor identifier that begins with search= followed by many %n sequences, a different vulnerability than CVE-2006-6027 and CVE-2006-6236.	Opera Browser
CVE-2007-0802	Feb 07, 2007	Mozilla Firefox 2.0.0.1 Mozilla Firefox 2.0.0.1 allows remote attackers to bypass the Phishing Protection mechanism by adding certain characters to the end of the domain name, as demonstrated by the "." and "/" characters, which is not caught by the Phishing List blacklist filter.	Opera Browser
CVE-2006-3353	Jul 06, 2006	Opera 9 allows remote attackers to cause a denial of service (crash) via a crafted web page Opera 9 allows remote attackers to cause a denial of service (crash) via a crafted web page that triggers an out-of-bounds memory access, related to an iframe and JavaScript that accesses certain style sheets properties.	Opera Browser
CVE-2006-3331	Jun 30, 2006	Opera before 9.0 does not reset the SSL security bar after displaying a download dialog from an SSL-enabled website, which Opera before 9.0 does not reset the SSL security bar after displaying a download dialog from an SSL-enabled website, which allows remote attackers to spoof a trusted SSL certificate from an untrusted website and facilitates phishing attacks.	Opera Browser
CVE-2006-3199	Jun 23, 2006	Opera 9 allows remote attackers to cause a denial of service (crash) Opera 9 allows remote attackers to cause a denial of service (crash) via an A tag with an href attribute with a URL containing a long hostname, which triggers an out-of-bounds operation.	Opera Browser
CVE-2006-3198	Jun 23, 2006	Integer overflow in Opera 8.54 and earlier Integer overflow in Opera 8.54 and earlier allows remote attackers to execute arbitrary code via a JPEG image with large height and width values, which causes less memory to be allocated than intended.	Opera Browser
CVE-2005-4718	Dec 31, 2005	Opera 8.02 and earlier Opera 8.02 and earlier allows remote attackers to cause a denial of service (client crash) via (1) a crafted HTML file with a "content: url(0);" style attribute, a "bodyA" tag, a long string, and a "u" tag with a long attribute, as demonstrated by opera.html; and (2) a BGSOUND element with a "margin:-99;" STYLE attribute.	Opera Browser
CVE-2005-4210	Dec 13, 2005	Opera before 8.51, when running on Windows with Input Method Editor (IME) installed Opera before 8.51, when running on Windows with Input Method Editor (IME) installed, allows remote attackers to cause a denial of service (persistent application crash) by bookmarking a site with a long title.	Opera Browser
CVE-2005-3946	Dec 01, 2005	Opera 8.50 allows remote attackers to cause a denial of service (crash) Opera 8.50 allows remote attackers to cause a denial of service (crash) via a Java applet with a large string argument to the removeMember JNI method for the com.opera.JSObject class.	Opera Browser
CVE-2005-3750	Nov 22, 2005	Opera before 8.51 on Linux and Unix systems allows remote attackers to execute arbitrary code via shell metacharacters (backticks) in a URL Opera before 8.51 on Linux and Unix systems allows remote attackers to execute arbitrary code via shell metacharacters (backticks) in a URL that another product provides in a command line argument when launching Opera.	Opera Browser
CVE-2005-3699	Nov 21, 2005	Opera Web Browser 8.50 and 8.0 through 8.0.2 Opera Web Browser 8.50 and 8.0 through 8.0.2 allows remote attackers to spoof the URL in the status bar via the title in an image in a link to a trusted site within a form to the malicious site.	Opera Browser
CVE-2005-3041	Sep 22, 2005	Unspecified "drag-and-drop vulnerability" in Opera Web Browser before 8.50 on Windows allows "unintentional file uploads Unspecified "drag-and-drop vulnerability" in Opera Web Browser before 8.50 on Windows allows "unintentional file uploads."	Opera Browser
CVE-2005-3007	Sep 21, 2005	Opera before 8.50 allows remote attackers to spoof the content type of files via a filename with a trailing " Opera before 8.50 allows remote attackers to spoof the content type of files via a filename with a trailing "." (dot), which might allow remote attackers to trick users into processing dangerous content.	Opera Browser
CVE-2005-2407	Aug 01, 2005	A design error in Opera 8.01 and earlier A design error in Opera 8.01 and earlier allows user-assisted attackers to execute arbitrary code by overlaying a malicious new window above a file download dialog box, then tricking the user into double-clicking on the "Run" button, aka "link hijacking".	Opera Browser
CVE-2005-2406	Aug 01, 2005	Opera 8.01 allows remote attackers to conduct cross-site scripting (XSS) attacks or modify which files are uploaded by tricking a user into dragging an image Opera 8.01 allows remote attackers to conduct cross-site scripting (XSS) attacks or modify which files are uploaded by tricking a user into dragging an image that is a "javascript:" URI.	Opera Browser
CVE-2005-2405	Aug 01, 2005	Opera 8.01, when the "Arial Unicode MS" font (ARIALUNI.TTF) is installed, does not properly handle extended ASCII characters in the file download dialog box, which Opera 8.01, when the "Arial Unicode MS" font (ARIALUNI.TTF) is installed, does not properly handle extended ASCII characters in the file download dialog box, which allows remote attackers to spoof file extensions and possibly trick users into executing arbitrary code.	Opera Browser
CVE-2005-2309	Jul 19, 2005	Opera 8.01 allows remote attackers to cause a denial of service (CPU consumption) Opera 8.01 allows remote attackers to cause a denial of service (CPU consumption) via a crafted JPEG image, as demonstrated using random.jpg.	Opera Browser
CVE-2005-2273	Jul 13, 2005	Opera 7.x and 8 before 8.01 does not clearly associate a Javascript dialog box with the web page Opera 7.x and 8 before 8.01 does not clearly associate a Javascript dialog box with the web page that generated it, which allows remote attackers to spoof a dialog box from a trusted site and facilitates phishing attacks, aka the "Dialog Origin Spoofing Vulnerability."	Opera Browser
CVE-2005-1669	Jun 16, 2005	Cross-site scripting (XSS) vulnerability in Opera 8.0 Final Build 1095 Cross-site scripting (XSS) vulnerability in Opera 8.0 Final Build 1095 allows remote attackers to inject arbitrary web script or HTML via "javascript:" URLs when a new window or frame is opened, which allows remote attackers to bypass access restrictions and perform unauthorized actions on other domains.	Opera Browser
CVE-2005-1475	Jun 16, 2005	The XMLHttpRequest object in Opera 8.0 Final Build 1095 The XMLHttpRequest object in Opera 8.0 Final Build 1095 allows remote attackers to bypass access restrictions and perform unauthorized actions on other domains via a redirect.	Opera Browser
CVE-2005-0238	May 02, 2005	The International Domain Name (IDN) support in Epiphany allows remote attackers to spoof domain names using punycode encoded domain names The International Domain Name (IDN) support in Epiphany allows remote attackers to spoof domain names using punycode encoded domain names that are decoded in URLs and SSL certificates in a way that uses homograph characters from other character sets, which facilitates phishing attacks.	Opera Browser
CVE-2005-0457	May 02, 2005	Opera 7.54 and earlier on Gentoo Linux uses an insecure path for plugins, which could Opera 7.54 and earlier on Gentoo Linux uses an insecure path for plugins, which could allow local users to gain privileges by inserting malicious libraries into the PORTAGE_TMPDIR (portage) temporary directory.	Opera Browser
CVE-2005-0235	May 02, 2005	The International Domain Name (IDN) support in Opera 7.54 allows remote attackers to spoof domain names using punycode encoded domain names The International Domain Name (IDN) support in Opera 7.54 allows remote attackers to spoof domain names using punycode encoded domain names that are decoded in URLs and SSL certificates in a way that uses homograph characters from other character sets, which facilitates phishing attacks.	Opera Browser
CVE-2005-1139	Apr 14, 2005	Opera 8 Beta 3, when using first-generation vetted digital certificates, displays the Organizational information of an SSL certificate Opera 8 Beta 3, when using first-generation vetted digital certificates, displays the Organizational information of an SSL certificate, which is easily spoofed and can facilitate phishing attacks.	Opera Browser
CVE-2005-0233	Feb 08, 2005	The International Domain Name (IDN) support in Firefox 1.0, Camino .8.5, and Mozilla before 1.7.6 allows remote attackers to spoof domain names using punycode encoded domain names The International Domain Name (IDN) support in Firefox 1.0, Camino .8.5, and Mozilla before 1.7.6 allows remote attackers to spoof domain names using punycode encoded domain names that are decoded in URLs and SSL certificates in a way that uses homograph characters from other character sets, which facilitates phishing attacks.	Opera Browser
CVE-2005-0456	Jan 12, 2005	Opera 7.54 and earlier does not properly validate base64 encoded binary data in a data: (RFC 2397) URL, which causes the URL to be obscured in a download dialog, which may Opera 7.54 and earlier does not properly validate base64 encoded binary data in a data: (RFC 2397) URL, which causes the URL to be obscured in a download dialog, which may allow remote attackers to trick users into executing arbitrary code.	Opera Browser
CVE-2004-1201	Jan 10, 2005	Opera 7.54 allows remote attackers to cause a denial of service (application crash from memory exhaustion), as demonstrated using Javascript code Opera 7.54 allows remote attackers to cause a denial of service (application crash from memory exhaustion), as demonstrated using Javascript code that continuously creates nested arrays and then sorts the newly created arrays.	Opera Browser
CVE-2004-1157	Jan 10, 2005	Opera 7.x up to 7.54, and possibly other versions Opera 7.x up to 7.54, and possibly other versions, allows remote attackers to spoof arbitrary web sites by injecting content from one window into a target window whose name is known but resides in a different domain, as demonstrated using a pop-up window on a trusted web site, aka the "window injection" vulnerability.	Opera Browser