CVE-2019-12278

Opera through 53 on Android allows Address Bar Spoofing. Characters from several languages are displayed in Right-to-Left order, due to mishandling of several Unicode characters. The rendering mechanism, in conjunction with the "first strong character" concept, may improperly operate on a numerical IP address or an alphabetic string, leading to a spoofed URL.

• https://help.opera.com/en/latest/security-and-privacy/Vendor Advisory
• https://medium.com/bugbountywriteup/opera-android-address-bar-spoofing-cve-2019-12278-9ffcfd6c508cExploit, Third Party Advisory
• https://help.opera.com/en/latest/security-and-privacy/Vendor Advisory
• https://medium.com/bugbountywriteup/opera-android-address-bar-spoofing-cve-2019-12278-9ffcfd6c508cExploit, Third Party Advisory

Published

Mar 12, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-12271Sandline Centraleyezer (On Premises) allows unrestricted Fil…9.8
• CVE-2019-12272In OpenWrt LuCI through 0.10, the endpoints admin/status/rea…
• CVE-2019-12273OutSystems Platform 10 through 11 allows ImageResourceDetail…6.5
• CVE-2019-12274In Rancher 1 and 2 through 2.2.3, unprivileged users (if all…
• CVE-2019-12276A Path Traversal vulnerability in Controllers/LetsEncryptCon…
• CVE-2019-12277Blogifier 2.3 before 2019-05-11 does not properly restrict A…
• CVE-2019-12279Nagios XI 5.6.1 allows SQL injection via the username parame…
• CVE-2019-1228An information disclosure vulnerability exists when the Wind…5.5
• CVE-2019-12280PC-Doctor Toolbox before 7.3 has an Uncontrolled Search Path…
• CVE-2019-12288An issue was discovered in upgrade_htmls.cgi on VStarcam 100…9.8
• CVE-2019-12289An issue was discovered in upgrade_firmware.cgi on VStarcam …
• CVE-2019-1229An elevation of privilege vulnerability exists in Dynamics O…