Read the docs
TI-2019-14260 Aliases CVE-2019-19788GHSA-hg35-v9mq-mjhp

Opera for Android before 54.0.2669.49432 is vulnerable to a sandboxed cross-origin iframe…

Priority LOW 25Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Opera for Android before 54.0.2669.49432 is vulnerable to a sandboxed cross-origin iframe bypass attack. By using a service working inside a sandboxed iframe it is possible to bypass the normal sandboxing attributes. This allows an attacker to make forced redirections without any user interaction from a third-party context.

Why it matters now

EPSS 0.00288 21st percentileScored 2026-11-07
Fix Fixed Opera for Android (Opera Software AS): 54.0.2669.49432

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Opera Software ASOpera for Androidbefore 54.0.2669.4943254.0.2669.49432Patch availableCNA
  • Opera for Android VendorOpera Software AS Affected before 54.0.2669.49432 Fixed in 54.0.2669.49432 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:opera:opera:*:*:*:*:*:android:*:*before 54.0.2669.49432VulnerableOpera
  • cpe:2.3:a:opera:opera:*:*:*:*:*:android:*:* Versions before 54.0.2669.49432 Vulnerable ·Opera

Remediation

  • Fix · CNA Opera for Android (Opera Software AS) Fixed in 54.0.2669.49432

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-19788
  2. 2026-10-03 Alias added: GHSA-hg35-v9mq-mjhp

References

Advisory 1

  • TI-2008-04929 Heap-based buffer overflow in Opera 9.62 on Windows allows remote attackers to execute… CVSS 2.0HIGH 9.3
  • TI-2008-04479 Cross-site scripting (XSS) vulnerability in Opera.dll in Opera before 9.61 allows remote… CVSS 2.0MEDIUM 4.3
  • TI-2008-04094 Unspecified vulnerability in Opera before 9.52 on Windows, when registered as a protocol… CVSS 2.0HIGH 10.0
  • TI-2008-01689 Opera before 9.27 allows remote attackers to cause a denial of service (crash) and… CVSS 2.0HIGH 9.3
  • TI-2008-04478 Opera before 9.60 allows remote attackers to obtain sensitive information and have… CVSS 2.0HIGH 9.3
  • TI-2008-02947 Unspecified vulnerability in Opera before 9.51 on Windows allows attackers to execute… CVSS 2.0HIGH 10.0
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences