data: URLs can spoof trusted trusted sites

data: URLs embed data inside them, instead of linking to an externalresource. Opera can mistakenly display the end of a data URL insteadof the beginning. This allows an attacker to spoof the URL of atrusted site...

Malicious torrent files can execute arbitrary code in Opera – Opera Security Advisories

Malicious torrent files can execute arbitrary code in Opera – Opera Security Advisories OPCOM Team | May 24, 2007 Summary A malicious torrent file can cause Opera to execute arbitrary code. Severity: Highly critical Problem description A specially crafted torrent file can cause a buffer overflow ...

Opera security advisory 2004-12-10 – Opera Security Advisories

Opera security advisory 2004-12-10 – Opera Security Advisories OPCOM Team | February 9, 2007 Opera security advisory Named frames or windows can be hi-jacked by malicious frames or windows. Periods in the file name and non-breaking spaces in the Content-Type header can make the save/open dialog...

Information displayed in the security field should be approached with caution. – Opera Security Advisories

Information displayed in the security field should be approached with caution. – Opera Security Advisories OPCOM Team | February 9, 2007 Summary Even though a Certificate Authority has verified and signed it, a usershould not trust the Organization name without checking the domain name.A fraudule...

Double-clicking a link can run a program from the Internet – Opera Security Advisories

Double-clicking a link can run a program from the Internet – Opera Security Advisories OPCOM Team | December 19, 2005 Summary If a user double-clicks a Web link leading to a program,that program can be run. The second click may go intothe “Open” button of the file download dialog. Severity:...

How does Opera make money? An explainer on monetization

Privacy How does Opera make money? An explainer on monetization Share June 22nd, 2026 Hi, Opera users! As many of you know, our products are free to download and use – so one of the most common questions we get from users is, “how does Opera make money?” It’s a fair question, and the answer is...

Update your browser: Security fix for Chrome zero-day CVE-2025-13223

News, Security Update your browser: Security fix for Chrome zero-day CVE-2025-13223 Share November 20th, 2025 Hi everyone! The latest patches to Opera, Opera GX, Opera Air, and Opera for Android address several recent vulnerabilities, including a zero-day exploit CVE-2025-13223. We recommend...

Update your browser: Security fix for Chrome zero-day CVE-2025-6558

News, Security Update your browser: Security fix for Chrome zero-day CVE-2025-6558 Share July 17th, 2025 Hi everyone! The latest patches to the Opera, Opera GX, and Opera Air address several recent vulnerabilities, including a zero-day exploit CVE-2025-6558. We recommend updating your browsers to...

Address bar spoofing in Opera Mini for Android – Opera Security Advisories

Opera Mini for Android before version 52.2 is vulnerable to an address bar spoofing attack. The vulnerability allows a malicious page to trick the browser into showing an address of a different page. This may allow the malicious page to impersonate another page and trick a user into providing...

CORS requests can omit the preflight request – Opera Security Advisories

Cross-Origin Resource Sharing CORS requests are required to send a preflight request if custom headers are included, to check that the host wishes to allow the full request to be made. An example of where this may be needed is for sites that use a custom header with a static value as part of thei...

Repeated attempts to access a target site can trigger address field spoofing – Opera Security Advisories

The browser address field should always show the correct address for the page that is currently being displayed. By making repeated requests to load a target site in rapid succession, an attacking web site can cause Opera to display the target sites address while the attacking page is still being...

HTTP response heap buffer overflow can allow execution of arbitrary code – Opera Security Advisories

When requesting pages using HTTP, Opera temporarily stores the response in a buffer. In some cases, Opera may incorrectly allocate too little space for a buffer, and may then store too much of the response in that buffer. This causes a buffer overflow, which in turn can lead to a memory corruptio...

The wrong executable may be used to display a downloaded file in its folder – Opera Security Advisories

The wrong executable may be used to display a downloaded file in its folder – Opera Security Advisories OPCOM Team | January 28, 2011 Severity Low Affected versions This issue affects Opera for Microsoft Windows. Description Opera’s downloads manager allows users to select a file, and open the...

Heap buffer overflow in HTML5 canvas can be used to execute arbitrary code

Performing some painting operations on a canvas while certain transformations are being applied in Opera may result in heap buffer overflows. In most cases Opera will just freeze or terminate, but in some cases this could lead to a crash which could be used to execute code. To inject code,...

Certain domain names can allow execution of arbitrary code

Specially crafted domain names can cause a memory corruption in Opera, which may lead to a crash. Successful exploitation can lead to execution of arbitrary code...

Simulated text inputs can trick users into uploading arbitrary files

When a user types into a file input, scripts can cause some of the keystrokes to be ignored. If the script can convince the user that they are typing into a normal text input, and not let them see that their keystrokes are being ignored, it can cause the input to point to known file paths on the...

Feed preview can reveal contents of unrelated news feeds

When Opera is previewing a news feed, some scripts are not correctly blocked. These scripts are able to subscribe the user to any feed URL that the attacker chooses, and can also view the contents of any feeds that the user is subscribed to. These may contain sensitive information...

Startup crash can allow execution of arbitrary code

When Opera is registered as a handler for a given protocol, it can be started by external applications. In some cases, being started in this way can cause Opera to crash. To inject code, additional techniques will have to be employed...

Resized canvas patterns can cause Opera to execute arbitrary code

HTML CANVAS elements can use scaled images as patterns. With suitable scaling manipulation of the image, a script can cause Opera to crash. This crash can sometimes cause memory corruption. To inject code, additional techniques will have to be employed...

Newsfeed prompt can cause Opera to execute arbitrary code

When Opera encounters a newsfeed source on a Web page, it prompts to add the source as a newsfeed. A script can manipulate the feed source in a way that can cause Opera to crash. The crash is caused by an erroneous memory access. To inject code, additional techniques will have to be employed...

Rich editing allows cross domain scripting

Rich editing using designMode allows page contents to be edited. Pages can use this ability to inject scripts into pages from other domains. This allows cross domain scripting...

A malicious torrent can cause Opera to execute arbitrary code – Opera Security Advisories

A malicious torrent can cause Opera to execute arbitrary code – Opera Security Advisories OPCOM Team | July 19, 2007 Summary A malicious torrent file can cause Opera to execute arbitrary code. Severity: High Problem description Removing a specially crafted torrent from the download managercan cra...

The createPattern function can reveal old data from random places in memory – Opera Security Advisories

The createPattern function can reveal old data from random places in memory – Opera Security Advisories OPCOM Team | July 19, 2007 Summary The createPattern function can reveal old data from random places in memory Severity: moderately severe Problem description Opera for Linux, FreeBSD, and...

Internationalized domain names (IDN) can be used for spoofing. – Opera Security Advisories

Internationalized domain names IDN can be used for spoofing. – Opera Security Advisories OPCOM Team | February 25, 2005 Summary Opera supports internationalized domain names IDN, which allowsfor example Russian or Chinese domain names to be written in theirown native scripts. However, this also...

Update your browser: Security fix for Chrome zero-day CVE-2025-14174

News, Security Update your browser: Security fix for Chrome zero-day CVE-2025-14174 Share December 18th, 2025 Hi everyone! The latest patches to Opera, Opera GX, Opera Air, and Opera for Android address several recent vulnerabilities, including a zero-day exploit CVE-2025-14174. We recommend...

Prompt injection in Opera Neon: Rapid response through responsible disclosure

Security Prompt injection in Opera Neon: Rapid response through responsible disclosure Share October 23rd, 2025 Hi Opera users, This week, we were able to address a real-world security scenario on Opera Neon thanks to the work of a security researcher team. The researchers reached out to us throu...

Update your browser: Security fixes for latest Chrome zero-day

News, Security Update your browser: Security fixes for latest Chrome zero-day Share January 18th, 2024 Hi everyone! The latest patches to the Opera, Opera GX, Opera Crypto, and Opera for Android browsers address several recent vulnerabilities, including a zero-day exploit CVE-2024-0519. We...

Update your browser: Security fixes for latest Chrome bugs

News, Security Update your browser: Security fixes for latest Chrome bugs Share December 1st, 2023 Hi everyone! The latest patches to the Opera, Opera GX, and Opera Crypto browsers address several recent vulnerabilities, including a zero-day exploit CVE-2023-6345. We recommend updating your...

Update your browser: Security fix for latest Chrome zero-day

News, Security Update your browser: Security fix for latest Chrome zero-day Share September 29th, 2023 Hi everyone! Opera browsers have received important updates addressing a number of vulnerabilities and bugs. Among those is the following zero-day vulnerability detected by security researchers,...

New Opera 93 Stable update includes fix for latest Chromium zero-day

Security New Opera 93 Stable update includes fix for latest Chromium zero-day Share December 2nd, 2022 Hi everyone! Opera for Windows and Mac have received Stable updates 93.0.4585.37 and 93.0.4585.39 respectively. Among other things, these updates include Chromium update 107.0.5304.122, which...

Misissued certificates

Security Misissued certificates Share October 29th, 2015 Recently, Google found a google.com pre-certificate in a CT log, without having ordered one. This lead to a series of incidents, also involving Opera and its security team. The backstory Google promptly contacted Symantec who had issued the...

Heartbleed and other heartaches

Security Heartbleed and other heartaches Share April 11th, 2014 As has been reported extensively already, OpenSSL just fixed a serious vulnerability, dubbed Heartbleed. OpenSSL is used in a variety of products used on the internet, including Opera products and servers. We want to share with you h...

TLS response timings can indicate network contents – Opera Security Advisories

When Opera receives incorrectly encrypted network data, Opera will detect this, and let the sender know that the data was not understood. Such encrypted error responses are marginally faster than regular responses. An attacker with access to the network, can by replacing network data measure...

Internet shortcuts used for phishing in elements – Opera Security Advisories

Websites may occasionally want to display image content from untrusted sources. A phishing attack may be carried out by the untrusted source, by displaying malicious instructions on the image, or by navigating the containing page to a similar looking document on another server. Since some image...

Reloads and redirects can allow spoofing and cross site scripting – Opera Security Advisories

Reloads and redirects can allow spoofing and cross site scripting – Opera Security Advisories OPCOM Team | October 6, 2010 Severity Critical Description Scripts on a page are supposed to be restricted so that they can only interact with other pages from the same domain and security context...

Certain characters may be used for domain name spoofing – Opera Security Advisories

Certain characters may be used for domain name spoofing – Opera Security Advisories OPCOM Team | June 29, 2010 Severity Moderately severe Description Opera uses several approaches to prevent spoofing of internationalized domain names IDN with characters that look similar to each other. With...

Multiple asynchronous document modifications can be used to execute arbitrary code – Opera Security Advisories

Multiple asynchronous document modifications can be used to execute arbitrary code – Opera Security Advisories OPCOM Team | April 28, 2010 Affected versions This vulnerability affects Opera for Windows and Mac. Severity Extremely Severe Description Multiple asynchronous calls to a script that...

TLS certificates can be used to execute arbitrary code – Opera Security Advisories

TLS certificates can be used to execute arbitrary code – Opera Security Advisories OPCOM Team | February 13, 2009 Severity Highly Severe Problem Description When connecting to a TLS-protected website, Opera parses the X.509 certificate. If a site uses a specially crafted Subject Alternative Name ...

Vulnerability in createSVGTransformFromMatrix (JavaScript, SVG) – Opera Security Advisories

Vulnerability in createSVGTransformFromMatrix JavaScript, SVG – Opera Security Advisories OPCOM Team | December 16, 2008 Summary A vulnerability in createSVGTransformFromMatrix ObjectTypecasting can crash Opera. Severity Moderate Problem description Passing an incorrect object to...

Opera security upgrade for Linux, Solaris and FreeBSD – Opera Security Advisories

Opera security upgrade for Linux, Solaris and FreeBSD – Opera Security Advisories OPCOM Team | December 16, 2008 Summary Opera 9.20 has a highly recommended security upgrade for users of the Adobe Flash Player on Linux, Solaris and FreeBSD Severity Highly critical Problem description A security...

Images can be read cross-domain with canvas – Opera Security Advisories

Images can be read cross-domain with canvas – Opera Security Advisories OPCOM Team | June 9, 2008 Severity: Less Severe Problem Description HTML CANVAS elements can use images as patterns, and that image data is made available to scripts. When the images are retrieved from other Web sites, the...

Opera security upgrade for Mac OS X – Opera Security Advisories

Opera security upgrade for Mac OS X – Opera Security Advisories OPCOM Team | October 18, 2007 Opera security upgrade for Mac OS X. Severity: Highly Severe Affected Versions Mac OS X system with the Opera Web browser and the Adobe Flash Player 9.0.47.0 and earlier installed. Problem Description...

(Updated) Specially crafted JPEG images enables the execution of arbitrary code.

A specially crafted JPEG image header can trick Opera into allocatingthe wrong amount of memory for the image. This can make Opera crash,or worse, execute code that has been placed into memory in advance...

Malicious setRequestHeader cross-site vulnerability – Opera Security Advisories

Malicious setRequestHeader cross-site vulnerability – Opera Security Advisories OPCOM Team | September 29, 2005 Summary A malicious setRequestHeader can be used to stealuser credentials and inject cross-site JavaScript. Severity: high Opera’s response Since version 8.02 of Opera, double newlineso...

Update your browser: Security fix for Chrome zero-day CVE-2026-5281

News, Security Update your browser: Security fix for Chrome zero-day CVE-2026-5281 Share April 4th, 2026 Hi everyone! The latest patches to Opera’s browsers address several recent vulnerabilities, including a zero-day exploit CVE-2026-5281. We recommend updating your browsers to the latest versio...

GameMaker security update: Patch now to prevent DoS attacks

Security GameMaker security update: Patch now to prevent DoS attacks Share October 30th, 2025 Today we’re looking at a vulnerability discovered in GameMaker, the game development tool that streamlines and simplifies game dev for all users, regardless of skill level. The vulnerability in question...

VPNs explained: How a VPN helps keep your online life private

Privacy, Security VPNs explained: How a VPN helps keep your online life private Share July 1st, 2025 Today, we spend more than half our lives online. So it’s only natural that we worry a lot more about online safety and privacy. VPNs are just one of the tools many internet users already rely on t...

Addressing the “CrossBarking” vulnerability discovered in collaboration with Guardio

News, Security Addressing the “CrossBarking” vulnerability discovered in collaboration with Guardio Share October 30th, 2024 Hi Opera users! Over time, we have shared details about how we approach security vulnerabilities, and especially how we work with external security researchers to identify...

Does the TunnelVision vulnerability affect Opera’s free VPN?

Privacy Does the TunnelVision vulnerability affect Opera’s free VPN? Share June 12th, 2024 Hello! You may have heard recently about a new type of vulnerability called TunnelVision that makes it possible for a malicious actor to bypass VPN protection. So you will be happy to know that Opera’s free...

Update your browser: Security fixes for latest Chrome zero-day

News, Security Update your browser: Security fixes for latest Chrome zero-day Share December 22nd, 2023 Hi everyone! The latest patches to the Opera, Opera GX, Opera Crypto, and Opera for Android browsers address several recent vulnerabilities, including a zero-day exploit CVE-2023-7024. We...