CVE-2004-2491

Opera Browser < 7.53 - URL Spoofing via Race Condition in Address Bar

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2004-2491. PoCs published by bitlance winter.

AI-analyzed exploit summary This exploit leverages a race condition in Opera Web Browser to spoof the address bar, allowing an attacker to display a trusted URL while redirecting the user to a malicious site. The PoC uses JavaScript to open a new window with a trusted URL and quickly replace it with a malicious one.

Description

A race condition in Opera web browser 7.53 Build 3850 causes Opera to fill in the address bar before the page has been loaded, which allows remote attackers to spoof the URL in the address bar via the window.open and location.replace HTML parameters, which facilitates phishing attacks.

Exploits (1)

exploitdb WORKING POC VERIFIED
by bitlance winter · htmlremotemultiple
https://www.exploit-db.com/exploits/24325

This exploit leverages a race condition in Opera Web Browser to spoof the address bar, allowing an attacker to display a trusted URL while redirecting the user to a malicious site. The PoC uses JavaScript to open a new window with a trusted URL and quickly replace it with a malicious one.

Classification
Working Poc 90%
Attack Type
Other
Complexity
Trivial
Reliability
Racy
Target: Opera Web Browser (versions affected by CVE-2004-2491)
No auth needed
Prerequisites: User interaction (clicking a malicious link)
MITRE ATT&CK
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (6)

Core 6
Core References
Broken Link, Patch x_refsource_confirm
http://www.opera.com/windows/changelogs/754/
Broken Link, Exploit vdb-entry x_refsource_osvdb
http://www.osvdb.org/8317
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/16816
Broken Link, Exploit mailing-list x_refsource_fulldisc
http://archives.neohapsis.com/archives/fulldisclosure/2004-07/1056.html
Broken Link, Patch third-party-advisory x_refsource_secunia
http://secunia.com/advisories/12162
Broken Link, Exploit, Patch, Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/10810

Scores

EPSS 0.0632
EPSS Percentile 92.7%

Details

CWE
CWE-362
Status published
Products (1)
opera/opera_browser < 7.53
Published Dec 31, 2004
Tracked Since Feb 18, 2026