Users can be tricked into uploading unexpected files

Plug-ins may be used to seed the system clipboard with paths to a target file, while the user may not expect that to be the contents of the clipboard. If the user can be convinced to focus a file input and paste the contents of the clipboard, the file can then be immediately uploaded without...

Users can be tricked into uploading unexpected files – Opera Security Advisories

Users can be tricked into uploading unexpected files – Opera Security Advisories OPCOM Team | June 29, 2010 Severity Less severe Description Plug-ins may be used to seed the system clipboard with paths to a target file, while the user may not expect that to be the contents of the clipboard. If th...

Widget properties exposed to third party domains – Opera Security Advisories

Widget properties exposed to third party domains – Opera Security Advisories OPCOM Team | June 29, 2010 Severity Moderately severe Description In some cases, widget properties could be exposed to third party domains, leading to the possibility of leak of widget information, or configuration optio...

XSLT can be used to retrieve random contents of unrelated documents – Opera Security Advisories

XSLT can be used to retrieve random contents of unrelated documents – Opera Security Advisories OPCOM Team | March 18, 2010 Affected versions This vulnerability affects Opera 10.50. Severity Highly severe Description XSLT is normally subject to strict controls, preventing documents from separate...

Insecure pages can show incorrect security information

When insecure pages load content from secure sites into a frame, they can cause Opera to incorrectly report the insecure site as being secure. The padlock icon will incorrectly be shown, and the security information dialog will state that the connection is secure, but without any certificate...

Image properties can be used to execute scripts

Image properties can contain custom comments. When displaying the image properties, Opera can be tricked into treating the comments as script. This can cause the script to be run in the wrong security context...

canvas functions can reveal data from random places in memory

There is a flaw in the way that certain canvas functions are handled, that can cause the canvas to be painted with very small amounts of data constructed from random memory. The resulting canvas image can be read and analyzed by JavaScript, so an attacker can get random samples of the user's...

A JPEG image with a malformed header can crash Opera

A specially crafted DHT marker in the JPEG file header can causea heap overflow. The malformed image alone will only cause a crash. To exploitthe flaw, the computer's memory must first be filled up withcode of the attacker's choice. This is not trivial to do reliably,so attempted attacks will oft...

A very long title in a web page can cause a crash on startup

If a Windows user with Input Method Editor IME installedbookmarks a page with an extremely long element,Opera will crash upon next startup. Opera will not recoverfrom this on its own, so the user will not be able to startOpera.This affects Japanese users and others using IME for textinput. It als...

Fuzzing HTTP Proxies: Privoxy, Part 3

Research Fuzzing HTTP Proxies: Privoxy, Part 3 Share January 4th, 2022 One of my earlier posts outlined how I had discovered six security vulnerabilities in the Privoxy software using the technique of fuzzing to cause the software to crash. This post outlines how I discovered three more...

Address bar spoofing in Opera Touch for iOS – Opera Security Advisories

Opera Touch for iOS before version 2.4.5 is vulnerable to an address bar spoofing attack. The vulnerability allows a malicious page to trick the browser into showing an address of a different page. This may allow the malicious page to impersonate another page and trick a user into providing...

Specially crafted SVG images can allow execution of arbitrary code – Opera Security Advisories

Opera can display images created using the Scalable Vector Graphics SVG format. Specially crafted and malformed SVG images may cause Opera to crash when their documents are unloaded, and the crash may allow execution of malicious arbitrary code. To inject code, additional techniques will have to ...

Opera may be used as a vector for multiple font issues in the underlying operating system – Opera Security Advisories

Opera may be used as a vector for multiple font issues in the underlying operating system – Opera Security Advisories OPCOM Team | December 17, 2010 Affected versions This vulnerability may be targeted through Opera for Windows. Severity Critical Description A flaw in the font handling on the...

XSLT can be used to retrieve random contents of unrelated documents

XSLT is normally subject to strict controls, preventing documents from separate Web sites from reading the contents of other sites. Certain XSLT constructs can cause Opera to retrieve the wrong contents for the resulting document. These contents will appear randomly from the cached versions of an...

Scripts can overwrite functions on pages from other domains – Opera Security Advisories

Scripts can overwrite functions on pages from other domains – Opera Security Advisories OPCOM Team | October 16, 2007 Scripts can overwrite functions on pages from other domains. Severity: Highly Severe Affected Versions All versions of Opera for Desktop prior to Opera 9.24. Problem Description...

Cross-site Scripting in OfA – Opera Security Advisories

URLs using “javascript:” have the protocol removed when pasted into the address bar to protect users from cross-site scripting XSS attacks, but in certain circumstances this removal was not performed. This could allow users to be socially engineered to run an XSS attack against themselves. This...

Reloads and redirects can allow spoofing and cross site scripting

Scripts on a page are supposed to be restricted so that they can only interact with other pages from the same domain and security context. Carefully timed reloads and redirects, when combined with appropriate caching, can cause scripts to execute in the wrong security context in Opera. This allow...

TLS protocol vulnerable to Man In The Middle attack

A vulnerability has been discovered in all current versions of the SSL and TLS protocols, that may allow an attacker to inject data and instructions into the HTTPS connection and trick the server to believe the date and instructions came from the client.The attacker accomplishes this by first...

Double-clicking a link can unexpectedly run a program from the Internet

When a user clicks a link on a Web page that points to an executable file, Opera will show a download dialog to allow the user to download it. The dialog will allow the user to choose to run the executable directly. If the user accidentally double clicks, the second click will activate whatever i...

Very large link addresses can cause Opera to crash

An extremely long link address can cause Opera to crash.A specially crafted long link could cause malicious codeto be run on the user's computer...

Where to find Opera’s Privacy and Security team online

Security Where to find Opera’s Privacy and Security team online Share September 27th, 2023 Hello everyone! Through this blog, we strive to offer timely updates and important information about Opera and our products. This helps us maintain an open line of communication with our users, particularly...

Private video streams can be intercepted

Video content may be used as filler content for a HTML5 canvas, if the video format is natively supported by Opera. If the video and page are from the same site, the content of the canvas can be safely read out by scripts. In some cases, Opera does not check the video's origin correctly, and may...

HTTP Content-Length header can be used to execute arbitrary code

Large values in the HTTP Content-Length header can cause Opera to crash. Certain specific values can cause a memory corruption, which in some cases can allow arbitrary code to be injected and executed. In most cases Opera will just crash. To inject code, additional techniques will have to be...

Error messages can leak onto unrelated sites

Scripting error messages are normally available only to the page that caused the error. In some cases, the error messages could be passed to other sites as the contents of unrelated variables, and may contain sensitive information. If those sites write the content into the page markup, this could...

Pages can trick users into uploading files

On some Linux or Unix installations, Opera would pass a dropped file to a file input, making it possible for a page to trick users to upload files without the user's knowledge...

Adress bar is not always updated correctly when collapsed

The collapsed Address bar can in some cases temporarily show the previous domain instead of the domain of the present site...

Fast Forward can allow cross-site scripting – Opera Security Advisories

Fast Forward can allow cross-site scripting – Opera Security Advisories OPCOM Team | December 16, 2008 Severity Highly Severe Platforms All desktop versions Problem Description If a link that uses a JavaScript URL triggers Opera’s Fast Forward feature, when the user activates Fast Forward, the...

Scripts can overwrite functions on pages from other domains

When accesing frames from different Web sites, specially crafted scripts can bypass the same-origin policy, and overwrite functions from those frames. If scripts on the page then run those functions, this can cause the script of the attacker's choice to run in the context of the target Web site...

a specially crafted JavaScript can make Opera execute arbitrary code – Opera Security Advisories

a specially crafted JavaScript can make Opera execute arbitrary code – Opera Security Advisories OPCOM Team | August 7, 2007 A specially crafted JavaScript can make Opera execute arbitrary code. Severity: Highly severe Problem description A virtual function call on an invalid pointer that may...

Malicious WMF files stored in Opera’s cache can infect Windows – Opera Security Advisories

Malicious WMF files stored in Opera’s cache can infect Windows – Opera Security Advisories OPCOM Team | January 13, 2006 Summary Windows Meta Files .wmf can contain executable code. A specially craftedWMF file can infect Microsoft Windows with malicious software when it is openedwith Windows’ own...

How we keep Opera users and products safe: Inside the role of Head of Security

Security How we keep Opera users and products safe: Inside the role of Head of Security Share May 8th, 2026 We usually think of security only when something goes wrong – whether it’s a suspicious login we noticed, a strange pop-up we got while browsing, or a headline we read about a data breach...

Update your browser: Security fix for Chrome zero-day CVE-2025-10585

News, Security Update your browser: Security fix for Chrome zero-day CVE-2025-10585 Share September 18th, 2025 Hi everyone! The latest patches to Opera, Opera GX, Opera Air, and Opera for Android address several recent vulnerabilities, including a zero-day exploit CVE-2025-10585. We recommend...

Error pages can be used to guess local file paths – Opera Security Advisories

Remote web pages should not be able to detect what files a user has on their local machine. Certain error pages do not apply this restriction correctly, allowing web pages to produce an error page where a script can run. The script can then use various events to detect whether files on the user’s...

Data URIs can be used to facilitate Cross-Site Scripting – Opera Security Advisories

Data URIs are only supposed to inherit the scripting origin from the site that creates them, such as by including them as the target of a link or an inline frame in the source of the document. Specific sequences of document and data URI loading can cause Opera to forget which document created the...

Widget properties exposed to third party domains

In some cases, widget properties could be exposed to third party domains, leading to the possibility of leak of widget information, or configuration options for the widget...

Malformed bitmaps can reveal old data from random places in memory

Specially malformed bitmap images can cause Opera to render the image using a palette made up from uninitialized memory. Using canvas, the pattern can be read and analyzed by JavaScript, so an attacker can get random samples of the user's memory, which may contain data...

Resized canvas patterns can cause Opera to execute arbitrary code – Opera Security Advisories

Resized canvas patterns can cause Opera to execute arbitrary code – Opera Security Advisories OPCOM Team | December 16, 2008 Severity Moderately Severe Problem Description HTML CANVAS elements can use scaled images as patterns. With suitable scaling manipulation of the image, a script can cause...

Specially crafted addresses can execute arbitrary code – Opera Security Advisories

Specially crafted addresses can execute arbitrary code – Opera Security Advisories OPCOM Team | December 16, 2008 Severity Extremely Severe Problem Description If a malicious page redirects Opera to a specially crafted address URL, it can cause Opera to crash. Given sufficient address content, th...

History Search can be used to execute arbitrary code

When certain parameters are passed to Opera's History Search, they can cause content not to be correctly sanitized. This can allow scripts to be injected into the History Search results page. Such scripts can then run with elevated privileges and interact with Opera's configuration, allowing them...

A malicious torrent can cause Opera to execute arbitrary code

Removing a specially crafted torrent from the download managercan crash Opera. The crash is caused by an erroneous memoryaccess.An attacker needs to entice the user to accept the maliciousBitTorrent download, and later remove it from Opera's downloadmanager. To inject code, additional means will...

Data URLs with executables and misleading download dialog – Opera Security Advisories

Data URLs with executables and misleading download dialog – Opera Security Advisories OPCOM Team | February 9, 2007 Severity: Moderate Summary A data URL RCF 2397 containing an executable file maycause Opera to mislead the user. Opera’s download dialogwill in some cases say “Open with NOTEPAD.EXE...

Opera may execute command line embedded in URLs

Opera for UNIX uses a wrapper shell script to start up Opera.This shell script reads the input arguments, like the file namesor URLs that Opera is to open. It also performs some environmentchecks, for example whether Java is available and if so, where itis located.This wrapper script can also run...

Phishing attack possible with a delayed JavaScript prompt – Opera Security Advisories

Phishing attack possible with a delayed JavaScript prompt – Opera Security Advisories OPCOM Team | January 5, 2005 Severity: Moderate/low Problem description A malicious page can be crafted to send the userto his banking site, and shortly afterwardsdisplay a dialog enticing the user to type inhis...

Fuzzing HTTP Proxies: Privoxy, Part 1

Research Fuzzing HTTP Proxies: Privoxy, Part 1 Share May 17th, 2021 Here at Opera, we’re always looking for ways to improve the browsing experience of our users with speed and usability. Perhaps more importantly though, we also look for ways to improve users’ privacy and security. While we...

Unexpected changes in tab focus can be used to run programs from the Internet

Tabs may be used to obscure a download dialog that is visible in another tab. The dialog will allow the user to choose to run downloaded executables directly. If the tab is closed or hidden at the moment that a user was about to click, they can end up clicking on the buttons in the dialog, causin...

*.com accepted as wildcard match in SSL/TLS name matching

Certificate authorities are expected to vet all certificate registrations, but may fail to prevent fraudulent or erroneous registrations. Certificates which use a wild card immediately before the top level domain, or nulls in the domain name, may pass validation checks in Opera. Sites using such...

Specially crafted JPEG images can be used to execute arbitrary code

Specially crafted JPEG images can cause Opera to corrupt memory and crash. Successful exploitation can lead to execution of arbitrary code...

History Search can reveal browsing history

Certain constructs are not escaped correctly by Opera's History Search results. These can be used to inject scripts into the page, which can then be used to look through the user's browsing history, including the contents of the pages they have visited. These may contain sensitive information...

Specially crafted addresses can execute arbitrary code

If a malicious page redirects Opera to a specially crafted address URL, it can cause Opera to crash. Given sufficient address content, the crash could cause execution of code controlled by the attacking page...

The links panel can allow cross-site scripting

The links panel shows links in all frames on the current page, including links with JavaScript URLs. When a page is held in a frame, the script is incorrectly executed on the outermost page, not the page where the URL was located. This can be used to execute scripts in the context of an unrelated...