Read the docs
TI-2020-05024 Aliases CVE-2020-6159GHSA-7hrc-g4hv-6p8r

Cross-site scripting in Opera for Android

Priority LOW 28CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

URLs using “javascript:” have the protocol removed when pasted into the address bar to protect users from cross-site scripting (XSS) attacks, but in certain circumstances this removal was not performed. This could allow users to be socially engineered to run an XSS attack against themselves. This vulnerability affects Opera for Android versions below 61.0.3076.56532.

Why it matters now

EPSS 0.00641 50th percentileScored 2026-11-07
Fix Fixed Opera for Android: 61.0.3076.56532

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Opera for Androidbefore 61.0.3076.5653261.0.3076.56532Patch availableCNA
  • Opera for Android Vendor— Affected before 61.0.3076.56532 Fixed in 61.0.3076.56532 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:opera:opera:*:*:*:*:*:android:*:*before 61.0.3076.56532VulnerableOpera
  • cpe:2.3:a:opera:opera:*:*:*:*:*:android:*:* Versions before 61.0.3076.56532 Vulnerable ·Opera

Remediation

  • Fix · CNA Opera for Android Fixed in 61.0.3076.56532

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-6159
  2. 2026-10-03 Alias added: GHSA-7hrc-g4hv-6p8r
  3. 2026-10-21 EPSS moved to the 50th–90th percentile

References

Advisory 1

  • TI-2008-04929 Heap-based buffer overflow in Opera 9.62 on Windows allows remote attackers to execute… CVSS 2.0HIGH 9.3
  • TI-2008-04479 Cross-site scripting (XSS) vulnerability in Opera.dll in Opera before 9.61 allows remote… CVSS 2.0MEDIUM 4.3
  • TI-2008-04094 Unspecified vulnerability in Opera before 9.52 on Windows, when registered as a protocol… CVSS 2.0HIGH 10.0
  • TI-2008-01689 Opera before 9.27 allows remote attackers to cause a denial of service (crash) and… CVSS 2.0HIGH 9.3
  • TI-2008-04478 Opera before 9.60 allows remote attackers to obtain sensitive information and have… CVSS 2.0HIGH 9.3
  • TI-2008-02947 Unspecified vulnerability in Opera before 9.51 on Windows allows attackers to execute… CVSS 2.0HIGH 10.0
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences