CVE-2018-16135 Security feature bypass in n/a

Medium 6.5 Published 26 Dec 2022 Updated 14 Apr 2025

Attackers can spoof the location permission dialog in Opera Mini for Android, bypassing user consent mechanisms.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2018-16135?

CVE-2018-16135 is a medium-severity vulnerability in n/a, published on 26 Dec 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The Opera Mini application 47.1.2249.129326 for Android allows remote attackers to spoof the Location Permission dialog via a crafted web site.

Which versions are affected by CVE-2018-16135?

It affects 1 product.

Products include Opera Opera Mini.

How do I fix CVE-2018-16135?

No fix has been published for CVE-2018-16135 yet. Limit exposure of the affected software until one is available.

Is CVE-2018-16135 being exploited?

There is no known exploitation of CVE-2018-16135 in the wild and no public exploit code.

Sources

Also known as GHSA-xrxj-2pv2-mppf.