Vulnerability in Opera Mini
CVE-2021-23253
Opera Mini for Android below 53.1 displays URL left-aligned in the address field. This allows a malicious attacker to craft a URL with a long domain name, e.g. www.safe.opera.com.attacker.com. With the URL being left-aligned, the user will only see the front part (e.g. www.safe.opera.com…) The exact amount depends on the phone screen size but the attacker can craft a number of different domains and target different phones. Starting with version 53.1 Opera Mini displays long URLs with the top-level domain label aligned to the right of the address field which mitigates the issue.
EPSS: 0.008 (51.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.
Affected products
- Opera Opera_mini
- N/a Opera Mini For Android — versions Below 53.1
References
- security@opera.com (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2021-23253?
- CVE-2021-23253 is a medium-severity vulnerability in Opera Mini. CVSS score: 5.3/10. Published 2021-01-11.
- How severe is CVE-2021-23253?
- Medium severity. CVSS v3 base score is 5.3 out of 10.