Read the docs
TI-2021-05997 Aliases CVE-2021-23253GHSA-prpx-5phw-fx4m

Opera Mini for Android below 53.1 displays URL left-aligned in the address field.

Priority LOW 25Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Opera Mini for Android below 53.1 displays URL left-aligned in the address field. This allows a malicious attacker to craft a URL with a long domain name, e.g. www.safe.opera.com.attacker.com. With the URL being left-aligned, the user will only see the front part (e.g. www.safe.opera.com…) The exact amount depends on the phone screen size but the attacker can craft a number of different domains and target different phones. Starting with version 53.1 Opera Mini displays long URLs with the top-level domain label aligned to the right of the address field which mitigates the issue.

Why it matters now

EPSS 0.0076 55th percentileScored 2026-11-07
Fix Fixed Opera Mini for Android: 53.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Opera Mini for Androidbefore 53.153.1Patch availableCNA
  • Opera Mini for Android Vendor— Affected before 53.1 Fixed in 53.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:opera:opera_mini:*:*:*:*:*:android:*:*before 53.1VulnerableOpera
  • cpe:2.3:a:opera:opera_mini:*:*:*:*:*:android:*:* Versions before 53.1 Vulnerable ·Opera

Remediation

  • Fix · CNA Opera Mini for Android Fixed in 53.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-23253
  2. 2026-10-03 Alias added: GHSA-prpx-5phw-fx4m

References

Advisory 1

  • TI-2018-11535 The Opera Mini application 47.1.2249.129326 for Android allows remote attackers to spoof… CVSS 3.1MEDIUM 6.5
  • TI-2016-03464 Opera Mini 13 and Opera Stable 36 allow remote attackers to spoof the displayed URL via a… CVSS 3.1MEDIUM 6.1
  • TI-2012-04369 The Opera Mobile application before 12.1 and Opera Mini application before 7.5 for… CVSS 2.0MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences