Opera Privacy Statement Update 2019

Privacy Opera Privacy Statement Update 2019 Share February 7th, 2019 This is an outdated article. Please read Opera Privacy Statement Update 2022 instead. We have recently updated our end-user license agreements and our terms of service have been updated as well. We are also about to update our...

Developer 32: Protecting against yourself

Security Developer 32: Protecting against yourself Share June 18th, 2015 Remember the SuperFish scandal? A third party application installed a Certificate Authority on PCs, and then hijacked all secure connections by serving browsers certificates from this local certificate authority. The SuperFi...

Specially crafted WebP images can be used to disclose random chunks of memory – Opera Security Advisories

WebP images may be used as fill patterns in a HTML5 Canvas, and the values of each pixel in the image can then be intentionally read using scripts. Specially crafted WebP images may specify the wrong size for certain parts of their data, which causes Opera to read data from the wrong positions in...

Plug-in content may monitor keystrokes on unrelated pages – Opera Security Advisories

Plug-ins may use operating system features to detect key presses when the plug-in is focused. If the plug-in does not detect its own focused state correctly, it can detect key presses when other pages are focused, allowing the plug-in content to detect key presses intended for pages from other...

A combination of clicks and key presses can lead to cross site scripting or code execution – Opera Security Advisories

When a user double clicks on a page, they may expect the two clicks to target the same object. If a page uses the first click to open a pop-up window in a predictable location, the second click may focus parts of the new window, such as its address field. If the page can then convince the user to...

Overlapping content can trick users into executing downloads – Opera Security Advisories

Dialogs such as the download dialog are usually displayed on top of page content, to ensure that the user knows that the dialog is requesting attention. In some cases, this policy was not implemented correctly in Opera, allowing certain page content to overlay the dialog. In these cases, clicking...

Small windows can be used to trick users into executing downloads – Opera Security Advisories

When the download dialog is displayed, it should always be visible to the user, to ensure that the user realizes it is there. If the dialog is displayed in a small enough window, the user may not realize it is being displayed, and if the right keyboard sequence is carefully followed, they can end...

Changing from a single-user to a multi-user installation on Windows (rev2) – Opera Security Advisories

Changing from a single-user to a multi-user installation on Windows rev2 – Opera Security Advisories OPCOM Team | January 5, 2012 If you received the error message “There was a problem initializing Opera Mail. Engine Init Failed”, it may mean that you have a stand-alone USB installation of Opera...

HTTP header leakage when using Opera Turbo – Opera Security Advisories

HTTP header leakage when using Opera Turbo – Opera Security Advisories OPCOM Team | February 11, 2011 Severity High Description When using Opera Turbo, pages are requested by the Opera Turbo servers, sending the relevant HTTP headers for that request. In some cases, the headers are incorrectly...

Malicious DLL files can be unintentionally loaded and allowed to run arbitrary code – Opera Security Advisories

Malicious DLL files can be unintentionally loaded and allowed to run arbitrary code – Opera Security Advisories OPCOM Team | September 8, 2010 Severity High Description Opera uses dynamic link libraries DLLs of its own, and several provided by the host operating system or plug-ins. In some cases,...

Certain characters may be used for domain name spoofing – Opera Security Advisories

Certain characters may be used for domain name spoofing – Opera Security Advisories OPCOM Team | June 29, 2010 Severity Moderately severe Description Opera uses several approaches to prevent spoofing of internationalized domain names IDN with characters that look similar to each other. With...

Insecure pages can show incorrect security information – Opera Security Advisories

Insecure pages can show incorrect security information – Opera Security Advisories OPCOM Team | December 16, 2008 Severity Less Severe Problem Description When insecure pages load content from secure sites into a frame, they can cause Opera to incorrectly report the insecure site as being secure...

Malformed bitmaps can reveal old data from random places in memory – Opera Security Advisories

Malformed bitmaps can reveal old data from random places in memory – Opera Security Advisories OPCOM Team | December 16, 2008 Severity Moderately Severe Problem Description Specially malformed bitmap images can cause Opera to render the image using a palette made up from uninitialized memory. Usi...

Opera security upgrade for Linux, Solaris and FreeBSD – Opera Security Advisories

Opera security upgrade for Linux, Solaris and FreeBSD – Opera Security Advisories OPCOM Team | December 16, 2008 Summary Opera 9.20 has a highly recommended security upgrade for users of the Adobe Flash Player on Linux, Solaris and FreeBSD Severity Highly critical Problem description A security...

Built-in XSLT templates can allow cross-site scripting – Opera Security Advisories

Built-in XSLT templates can allow cross-site scripting – Opera Security Advisories OPCOM Team | December 15, 2008 Severity Highly Severe Problem Description Built-in XSLT templates incorrectly handle escaped content and can cause it to be treated as markup. If a site accepts content from untruste...

Long hostnames in file: URLs can cause execution of arbitrary code

Exceptionally long host names in file: URLs can cause a buffer overflow, which may be exploited to execute arbitrary code. Remote Web pages cannot refer to file: URLs, so successful exploitation involves tricking users into manually opening the exploit URL, or a local file that refers to it...

Opera security upgrade for Mac OS X – Opera Security Advisories

Opera security upgrade for Mac OS X – Opera Security Advisories OPCOM Team | October 18, 2007 Opera security upgrade for Mac OS X. Severity: Highly Severe Affected Versions Mac OS X system with the Opera Web browser and the Adobe Flash Player 9.0.47.0 and earlier installed. Problem Description...

A malicious torrent can cause Opera to execute arbitrary code – Opera Security Advisories

A malicious torrent can cause Opera to execute arbitrary code – Opera Security Advisories OPCOM Team | July 19, 2007 Summary A malicious torrent file can cause Opera to execute arbitrary code. Severity: High Problem description Removing a specially crafted torrent from the download managercan cra...

A forged SSL server certificate can be accepted by Opera as a valid certificate – Opera Security Advisories

A forged SSL server certificate can be accepted by Opera as a valid certificate – Opera Security Advisories OPCOM Team | September 21, 2006 Summary: A forged SSL server certificate can be accepted by Opera as a valid certificate. Severity: Highly critical Vulnerable versions: Opera for desktop...

(Updated) Specially crafted JPEG images enables the execution of arbitrary code.

A specially crafted JPEG image header can trick Opera into allocatingthe wrong amount of memory for the image. This can make Opera crash,or worse, execute code that has been placed into memory in advance...

A very long title in a web page can cause a crash on startup – Opera Security Advisories

A very long title in a web page can cause a crash on startup – Opera Security Advisories OPCOM Team | December 12, 2005 Summary A web page with an extremely long attribute can causeOpera to crash when certain conditions are met. It affectsWindows users with Input Method Editor IME installed...

Opera may execute command line embedded in URLs – Opera Security Advisories

Opera may execute command line embedded in URLs – Opera Security Advisories OPCOM Team | November 23, 2005 Summary Opera will execute command lines embedded in the URL when anotherprogram uses Opera to open a link. This affects UNIX versions ofOpera Linux/FreeBSD/Solaris. Severity: High Problem...

Malicious setRequestHeader cross-site vulnerability – Opera Security Advisories

Malicious setRequestHeader cross-site vulnerability – Opera Security Advisories OPCOM Team | September 29, 2005 Summary A malicious setRequestHeader can be used to stealuser credentials and inject cross-site JavaScript. Severity: high Opera’s response Since version 8.02 of Opera, double newlineso...

GameMaker security update: Patch now to prevent DoS attacks

Security GameMaker security update: Patch now to prevent DoS attacks Share October 30th, 2025 Today we’re looking at a vulnerability discovered in GameMaker, the game development tool that streamlines and simplifies game dev for all users, regardless of skill level. The vulnerability in question...

Update your browser: Security fix for Chrome zero-day CVE-2025-6554

News, Security Update your browser: Security fix for Chrome zero-day CVE-2025-6554 Share July 3rd, 2025 Hi everyone! The latest patches to the Opera, Opera GX, Opera Air, and Opera for Android address several recent vulnerabilities, including a zero-day exploit CVE-2025-6554. We recommend updatin...

VPNs explained: How a VPN helps keep your online life private

Privacy, Security VPNs explained: How a VPN helps keep your online life private Share July 1st, 2025 Today, we spend more than half our lives online. So it’s only natural that we worry a lot more about online safety and privacy. VPNs are just one of the tools many internet users already rely on t...

Does the TunnelVision vulnerability affect Opera’s free VPN?

Privacy Does the TunnelVision vulnerability affect Opera’s free VPN? Share June 12th, 2024 Hello! You may have heard recently about a new type of vulnerability called TunnelVision that makes it possible for a malicious actor to bypass VPN protection. So you will be happy to know that Opera’s free...

Opera Privacy Statement Update 2022

Privacy Opera Privacy Statement Update 2022 Share August 29th, 2022 Opera, a browser company based out of Oslo, Norway, cares deeply about user security and data protection. With that in mind, we actively work on improving our internal practices and communications with you, our users. We are maki...

Bug Bounty Guest Post: Local File Read via Stored XSS in The Opera Browser

Research Bug Bounty Guest Post: Local File Read via Stored XSS in The Opera Browser Share September 8th, 2021 Opera manages aBug Bounty program where researchers can report vulnerabilities in Opera’s software and be rewarded for it. For high-quality reports, we like to invite researchers to write...

Opera becomes part of the CNA program

News Opera becomes part of the CNA program Share December 13th, 2019 Usually, Friday the 13th is considered to be an unlucky day. However, this is not the case for Opera, as we have great news, especially for security researchers and all security-minded Opera fans. We are proud to announce that...

Dealing with FREAK and SuperFish

Security Dealing with FREAK and SuperFish Share March 10th, 2015 The FREAK TLS attack Following the trend of memorable names for TLS attacks, FREAK was recently announced. This exploits a bug in some TLS libraries, combined with the support of ancient weak ciphers, to enable a MitM to force...

CORS requests can incorrectly retrieve contents of cross origin pages – Opera Security Advisories

CORS Cross-Origin Resource Sharing allows web pages to retrieve the contents of pages from other sites, with their permission, as they would appear for the current user. When requests are made in this way, the browser should only allow the page content to be retrieved if the target site sends the...

Cross domain access to object constructors can be used to facilitate cross-site scripting – Opera Security Advisories

JavaScripts are able to redefine and override the methods of native objects. They may also do this with the native objects of any document that shares the same origin. By redefining the methods of another document through the constructor property of the document’s host objects, a malicious script...

Element HTML content can be incorrectly returned without escaping, bypassing some HTML sanitizers – Opera Security Advisories

When sites accept HTML from untrusted users, and use that HTML as page content, they typically sanitize the untrusted HTML to ensure that it does not contain any harmful content, such as malicious scripts. In some cases, this sanitization may be performed by writing and reading the contents of DO...

Certain characters in HTML can incorrectly be ignored, which can facilitate XSS attacks – Opera Security Advisories

Sites that allow content to be provided by untrusted users, such as forums and blogging sites, typically sanitize the untrusted content to ensure that it does not contain any harmful content, such as malicious scripts. When certain characters appear at specific locations within HTML markup, they...

Certain URL constructs can allow arbitrary code execution – Opera Security Advisories

Certain page address URL constructs can cause Opera to allocate the wrong amount of memory for storing the address. When it then attempts to store the address, it will overwrite unrelated memory with attacker-controlled data. This can lead to a crash, which may also execute that data as code...

Web page dialogs can be used to to display the wrong address in the address field – Opera Security Advisories

The address field should always show the correct address for the page that is loaded. If a page can cause Opera to display certain dialogs relating to a target site, the dialog may in some cases cause Opera to display the target site’s address instead of the correct address. This can allow an...

Web page content may overlap the address field – Opera Security Advisories

The browser’s user interface contains several pieces of security information. To preserve this information correctly, web page content should not be able to display over the user interface. Certain styling can cause Opera to allow the content to be displayed outside the page, over the address...

Carefully timed reloads and redirects can spoof the address field – Opera Security Advisories

The address field should always show the address of the page that is being displayed. In certain cases, if a target site responds slowly, reloading an attacking page and redirecting to the target page can cause the address field to show the target site’s address, while the attacking site is still...

Frameset issue allows execution of arbitrary code – Opera Security Advisories

Framesets allow web pages to hold other pages inside them. Certain frameset constructs are not handled correctly when the page is unloaded, causing a memory corruption. To inject code, additional techniques will have to be employed...

Multiple asynchronous document modifications can be used to execute arbitrary code – Opera Security Advisories

Multiple asynchronous document modifications can be used to execute arbitrary code – Opera Security Advisories OPCOM Team | April 28, 2010 Affected versions This vulnerability affects Opera for Windows and Mac. Severity Extremely Severe Description Multiple asynchronous calls to a script that...

History Search can be used to execute arbitrary code – Opera Security Advisories

History Search can be used to execute arbitrary code – Opera Security Advisories OPCOM Team | December 16, 2008 Severity Extremely Severe Problem Description When certain parameters are passed to Opera’s History Search, they can cause content not to be correctly sanitized. This can allow scripts ...

canvas functions can reveal data from random places in memory – Opera Security Advisories

canvas functions can reveal data from random places in memory – Opera Security Advisories OPCOM Team | December 16, 2008 Severity Moderately severe Problem description There is a flaw in the way that certain canvas functions are handled, that can cause the canvas to be painted with very small...

Feed links can link to local files

As a security precaution, Opera does not allow Web pages to link to files on the user's local disk. However, a flaw exists that allows Web pages to link to feed source files on the user's computer. Suitable detection of JavaScript events and appropriate manipulation can unreliably allow a script ...

External news readers and e-mail clients can be used to execute arbitrary code – Opera Security Advisories

External news readers and e-mail clients can be used to execute arbitrary code – Opera Security Advisories OPCOM Team | October 16, 2007 External news readers and e-mail clients can be used to execute arbitrary code. Severity: Highly Severe Affected Versions All versions of Opera for Desktop prio...

Opera not vulnerable to JPEG processing vulnerability in Microsoft’s GDI+ library – Opera Security Advisories

Opera not vulnerable to JPEG processing vulnerability in Microsoft’s GDI+ library – Opera Security Advisories OPCOM Team | February 9, 2007 Opera is not vulnerable to the JPEG processing vulnerability in Microsoft’s GDI+ library. Details: Microsoft Security Bulletin MS04-028 Buffer Overrun in JPE...

Data Privacy Day: Inside the role of Data Protection Officer at Opera

Privacy Data Privacy Day: Inside the role of Data Protection Officer at Opera Share January 28th, 2026 Privacy matters all year round. But every January, Data Privacy Day is a great opportunity to learn more about data privacy and protection, and to highlight their importance for everyone in the...

Protected with Opera Neon: Understanding agentic browser security

Security Protected with Opera Neon: Understanding agentic browser security Share October 21st, 2025 Hi Opera users, If you were hanging out around these parts in the past few weeks, you might have noticed that we launched Opera Neon – an AI agentic browser that can browse with you or for you, tak...

Update your browser: Security fixes for latest Chrome zero-day

News, Security Update your browser: Security fixes for latest Chrome zero-day Share June 5th, 2025 Hi everyone! The latest patches to the Opera, Opera GX, Opera Air, and Opera for Android address several recent vulnerabilities, including a zero-day exploit CVE-2025-5419. We recommend updating you...

Opera for Android has received Google Play’s Independent Security Review badge. Here’s what this means for your security

Security Opera for Android has received Google Play’s Independent Security Review badge. Here’s what this means for your security Share January 30th, 2025 Hey Opera users! You might have seen that Opera for Android has achieved a new security-focused milestone: If you search for Opera for Android...