Recently we detected a security vulnerability in Opera Mobile for Android which can be exploited by a non-privileged application in order to inject JavaScript code into the
context of any domain; therefore, this vulnerability has the same implications as global XSS, albeit from an installed application rather than another website.
Opera Mobile 11.1 update 2 has been released, which incorporates a fix for this bug.
The complete advisory can be found here.
Demo of the PoC:
We would like to thank the Opera Team for the efficient and quick way in which it handled this security issue.
Comments