CVE-2019-19788 Security feature bypass in Opera for Android

Medium 5.5 Published 18 Dec 2019 Updated 5 Aug 2024

Attackers can bypass sandboxing in Opera for Android to force redirections from third-party contexts without user interaction.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-19788?

CVE-2019-19788 is a medium-severity vulnerability in Opera for Android, published on 18 Dec 2019. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Opera for Android before 54.0.2669.49432 is vulnerable to a sandboxed cross-origin iframe bypass attack. By using a service working inside a sandboxed iframe it is possible to bypass the normal sandboxing attributes. This allows an attacker to make forced redirections without any user interaction from a third-party context.

Which versions are affected by CVE-2019-19788?

It affects 1 product.

Products include Opera Opera.

How do I fix CVE-2019-19788?

No fix has been published for CVE-2019-19788 yet. Limit exposure of the affected software until one is available.

Is CVE-2019-19788 being exploited?

There is no known exploitation of CVE-2019-19788 in the wild and no public exploit code.

Sources

Also known as GHSA-hg35-v9mq-mjhp.