CVE-2021-23253

Opera Mini for Android below 53.1 displays URL left-aligned in the address field. This allows a malicious attacker to craft a URL with a long domain name, e.g. www.safe.opera.com.attacker.com. With the URL being left-aligned, the user will only see the front part (e.g. www.safe.opera.com…) The exact amount depends on the phone screen size but the attacker can craft a number of different domains and target different phones. Starting with version 53.1 Opera Mini displays long URLs with the top-level domain label aligned to the right of the address field which mitigates the issue.

• https://security.opera.com/address-bar-spoofing-in-opera-mini-opera-security-advisories/Vendor Advisory
• https://security.opera.com/address-bar-spoofing-in-opera-mini-opera-security-advisories/Vendor Advisory

Published

Jan 11, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-23241MERCUSYS Mercury X18G 1.0.5 devices allow Directory Traversa…5.3
• CVE-2021-23242MERCUSYS Mercury X18G 1.0.5 devices allow Directory Traversa…5.3
• CVE-2021-23243In Oppo's battery application, the third-party SDK provides …7.8
• CVE-2021-23244ColorOS pregrant dangerous permissions to apps which are lis…7.8
• CVE-2021-23246In ACE2 ColorOS11, the attacker can obtain the foreground pa…7.5
• CVE-2021-23247A command injection vulerability found in quick game engine …9.8
• CVE-2021-23258Authenticated users with Administrator or Developer roles ma…7.2
• CVE-2021-23259Authenticated users with Administrator or Developer roles ma…7.2
• CVE-2021-2326Vulnerability in the Database Vault component of Oracle Data…2.7
• CVE-2021-23260Authenticated users with Site roles may inject XSS scripts v…5.4
• CVE-2021-23261Authenticated administrators may override the system configu…4.9
• CVE-2021-23262Authenticated administrators may modify the main YAML config…7.2